@kyo-so/cli 0.7.1 → 0.9.0

package/dist/cli/codexPluginDetector.d.ts

@@ -0,0 +1,70 @@
+import { PLUGIN_RUNTIME_EXPECTED_CONTRACT } from "./pluginRuntimeContract.js";
+export declare const CODEX_PLUGIN_INSPECTION_TIMEOUT_MS = 5000;
+export type CodexInspectionOperation = "version" | "plugin_list" | "mcp_list";
+export type CodexInspectionFailureReason = "unavailable" | "timeout" | "command_failed" | "invalid_output" | "unknown_schema" | "unsupported_version";
+export type CodexInspectionFailure = {
+    operation: CodexInspectionOperation;
+    reason: CodexInspectionFailureReason;
+};
+export type CodexCommand = {
+    args: readonly string[];
+    cwd: string;
+    env: NodeJS.ProcessEnv;
+    timeoutMs: number;
+};
+export type CodexCommandResult = {
+    kind: "completed";
+    exitCode: number;
+    stdout: string;
+} | {
+    kind: "unavailable";
+} | {
+    kind: "timeout";
+} | {
+    kind: "failed";
+};
+export type CodexCommandRunner = (command: CodexCommand) => CodexCommandResult;
+export type CodexPluginInspectionOptions = {
+    cwd: string;
+    env?: NodeJS.ProcessEnv;
+    timeoutMs?: number;
+    runCodex?: CodexCommandRunner;
+};
+export type CodexPluginState = "enabled" | "disabled" | "not_installed";
+export type CodexPluginInspection = {
+    status: "supported";
+    codexVersion: string;
+    plugin: {
+        pluginId: typeof PLUGIN_RUNTIME_EXPECTED_CONTRACT.marketplace.pluginId;
+        installed: boolean;
+        enabled: boolean;
+        state: CodexPluginState;
+    };
+} | {
+    status: "unsupported";
+    failure: CodexInspectionFailure;
+};
+export type CodexMcpStatus = "enabled" | "disabled" | "missing" | "unknown";
+export type CodexMcpListInspection = {
+    status: "supported";
+    kyoso: CodexMcpStatus;
+} | {
+    status: "unsupported";
+    failure: CodexInspectionFailure;
+};
+/**
+ * Inspects only the stable Codex Plugin interface. It intentionally does not
+ * read Plugin cache files or configuration; Doctor composes this with the
+ * separately resolved manual-MCP and Plugin-override state.
+ */
+export declare function inspectCodexPlugin(options: CodexPluginInspectionOptions): CodexPluginInspection;
+/**
+ * Reads the effective MCP list lazily. Doctor must call this only after it has
+ * confirmed that no top-level manual `mcp_servers.kyoso` entry exists.
+ */
+export declare function inspectCodexMcpList(options: CodexPluginInspectionOptions): CodexMcpListInspection;
+/**
+ * Returns a fixed, display-safe diagnostic. Never append command stderr or
+ * filesystem paths to this message.
+ */
+export declare function formatCodexInspectionFailure(failure: CodexInspectionFailure): string;

package/dist/cli/doctor.d.ts

@@ -1,3 +1,4 @@
+import { type CodexMcpListInspection, type CodexPluginInspection, type CodexPluginInspectionOptions } from "./codexPluginDetector.js";
 export declare function runDoctor(options: {
     cwd: string;
     configPath?: string;
@@ -7,4 +8,6 @@ export declare function runDoctor(options: {
     promptForTrust?: boolean;
     trustStorePath?: string;
     env?: NodeJS.ProcessEnv;
+    pluginInspector?: (options: CodexPluginInspectionOptions) => CodexPluginInspection;
+    mcpListInspector?: (options: CodexPluginInspectionOptions) => CodexMcpListInspection;
 }): Promise<string>;

package/dist/cli/integration.d.ts

@@ -0,0 +1,30 @@
+import type { ManualMcpStatus } from "./setup.js";
+export type IntegrationMode = "manual-mcp" | "cli-skill" | "skill-on-demand" | "mcp-only" | "cli-only" | "missing" | "unknown";
+export type InstalledCli = {
+    kind: "installed";
+    version: string;
+    scope: "project" | "global";
+};
+export type CliAvailability = InstalledCli | {
+    kind: "missing" | "transient" | "unknown";
+};
+export type CliDetection = {
+    kyoso: CliAvailability;
+    npx: boolean;
+    bunx: boolean;
+};
+export type NonPluginIntegration = {
+    mode: IntegrationMode;
+    warnings: string[];
+};
+export declare function detectCli(options: {
+    cwd: string;
+    env?: NodeJS.ProcessEnv;
+    platform?: NodeJS.Platform;
+}): CliDetection;
+export declare function determineNonPluginIntegration(options: {
+    manualMcpStatus: ManualMcpStatus;
+    hasSkill: boolean;
+    cli: CliDetection;
+}): NonPluginIntegration;
+export declare function formatCliAvailability(cli: CliAvailability): string;

package/dist/cli/knownSkillDigests.d.ts

@@ -0,0 +1,11 @@
+export declare const CURRENT_SKILL_DIGEST = "sha256:98e715396ee3e1994c29ab49bc489197f242091c8ac0e06e182c0eccd5ab277e";
+export declare const KNOWN_SKILL_DIGESTS_BY_VERSION: {
+    readonly "0.8.0": readonly [{
+        readonly digest: "sha256:b16ea3f8141a01399b96dee650365d99df2b8c5fc99184d9cb22d5d72c106fd8";
+        readonly kind: "historical";
+    }];
+};
+export declare function knownSkillDigest(digest: string): {
+    version: string;
+    kind: "current" | "historical";
+} | undefined;

package/dist/cli/pluginRuntimeContract.d.ts

@@ -0,0 +1,232 @@
+/**
+ * Runtime facts captured by the disposable Codex Plugin probe.
+ *
+ * Keep this bundled contract structurally identical to the stable portion of
+ * docs/compatibility/codex-plugin-runtime.json. The documentation record also
+ * retains dated probe metadata, which deliberately does not belong in the
+ * published CLI.
+ */
+export declare const PLUGIN_RUNTIME_COMPATIBILITY_SCHEMA_VERSION = 1;
+export declare const MINIMUM_SUPPORTED_CODEX_VERSION = "0.144.0-alpha.4";
+export declare const PLUGIN_RUNTIME_EXPECTED_CONTRACT: {
+    readonly distribution: {
+        readonly pluginVersion: "0.1.0";
+        readonly mcpCommand: "npx";
+        readonly mcpPackagePin: "@kyo-so/cli@0.8.0";
+    };
+    readonly marketplace: {
+        readonly name: "kyoso";
+        readonly listed: true;
+        readonly pluginId: "kyoso@kyoso";
+        readonly selector: "kyoso@kyoso";
+        readonly installPolicy: "AVAILABLE";
+        readonly authPolicy: "ON_USE";
+    };
+    readonly transitions: {
+        readonly beforeAdd: {
+            readonly installed: false;
+            readonly enabled: false;
+        };
+        readonly afterAdd: {
+            readonly installed: true;
+            readonly enabled: true;
+        };
+        readonly disabled: {
+            readonly installed: true;
+            readonly enabled: false;
+        };
+        readonly afterRemove: {
+            readonly installed: false;
+            readonly enabled: false;
+        };
+        readonly installPluginId: "kyoso@kyoso";
+        readonly removePluginId: "kyoso@kyoso";
+    };
+    readonly mcp: {
+        readonly default: {
+            readonly enabled: true;
+            readonly command: "$NODE";
+            readonly args: readonly ["$PROBE_SERVER", "$OBSERVATION"];
+            readonly envVars: readonly ["OPENAI_API_KEY", "CODEX_API_KEY", "CODEX_HOME", "CODEX_ACCESS_TOKEN", "ANTHROPIC_API_KEY", "CLAUDE_CODE_OAUTH_TOKEN"];
+            readonly cwd: null;
+            readonly startupTimeoutSec: 20;
+            readonly toolTimeoutSec: 360;
+        };
+        readonly pluginOverride: {
+            readonly enabled: false;
+            readonly command: "$NODE";
+            readonly args: readonly ["$PROBE_SERVER", "$OBSERVATION"];
+            readonly envVars: readonly ["OPENAI_API_KEY", "CODEX_API_KEY", "CODEX_HOME", "CODEX_ACCESS_TOKEN", "ANTHROPIC_API_KEY", "CLAUDE_CODE_OAUTH_TOKEN"];
+            readonly cwd: null;
+            readonly startupTimeoutSec: 20;
+            readonly toolTimeoutSec: 360;
+        };
+        readonly manualOverride: {
+            readonly enabled: true;
+            readonly command: "manual-kyoso";
+            readonly args: readonly ["mcp"];
+            readonly envVars: readonly [];
+            readonly cwd: null;
+            readonly startupTimeoutSec: null;
+            readonly toolTimeoutSec: null;
+        };
+    };
+    readonly appServer: {
+        readonly default: {
+            readonly serverFound: true;
+            readonly toolNames: readonly ["probe_environment"];
+            readonly authStatus: "unsupported";
+            readonly skillFound: false;
+            readonly skillEnabled: null;
+            readonly skillHasKyosoMcpDependency: false;
+        };
+        readonly pluginOverride: {
+            readonly serverFound: true;
+            readonly toolNames: readonly [];
+            readonly authStatus: "unsupported";
+            readonly skillFound: false;
+            readonly skillEnabled: null;
+            readonly skillHasKyosoMcpDependency: false;
+            readonly mcpObservationWritten: false;
+        };
+    };
+    readonly environment: {
+        readonly cwdIsWorkspace: true;
+        readonly homeInherited: true;
+        readonly codexHomeForwarded: true;
+        readonly tempDirectoryInherited: true;
+        readonly pathInherited: true;
+        readonly allowlistedEnvForwarded: {
+            readonly OPENAI_API_KEY: true;
+            readonly CODEX_API_KEY: true;
+            readonly CODEX_ACCESS_TOKEN: true;
+            readonly ANTHROPIC_API_KEY: true;
+            readonly CLAUDE_CODE_OAUTH_TOKEN: true;
+        };
+        readonly deniedSentinelForwarded: false;
+    };
+    readonly isolation: {
+        readonly distinctHomeAndCodexHome: true;
+        readonly distinctWorkspace: true;
+    };
+};
+/**
+ * `codex plugin list --json` is supported only when entries have these
+ * probe-observed fields. Doctor must treat all other shapes as unsupported.
+ */
+export declare const PLUGIN_LIST_JSON_SCHEMA: {
+    readonly collections: readonly ["installed", "available"];
+    readonly entry: {
+        readonly pluginId: "kyoso@kyoso";
+        readonly requiredFields: readonly ["pluginId", "installed", "enabled"];
+    };
+};
+/** Stable runtime contract consumed by Doctor and distribution verification. */
+export declare const pluginRuntimeContract: {
+    readonly schemaVersion: 1;
+    readonly minimumSupportedCodexVersion: "0.144.0-alpha.4";
+    readonly pluginId: "kyoso@kyoso";
+    readonly pluginListTopLevelKeys: readonly ["installed", "available"];
+    readonly expectedContract: {
+        readonly distribution: {
+            readonly pluginVersion: "0.1.0";
+            readonly mcpCommand: "npx";
+            readonly mcpPackagePin: "@kyo-so/cli@0.8.0";
+        };
+        readonly marketplace: {
+            readonly name: "kyoso";
+            readonly listed: true;
+            readonly pluginId: "kyoso@kyoso";
+            readonly selector: "kyoso@kyoso";
+            readonly installPolicy: "AVAILABLE";
+            readonly authPolicy: "ON_USE";
+        };
+        readonly transitions: {
+            readonly beforeAdd: {
+                readonly installed: false;
+                readonly enabled: false;
+            };
+            readonly afterAdd: {
+                readonly installed: true;
+                readonly enabled: true;
+            };
+            readonly disabled: {
+                readonly installed: true;
+                readonly enabled: false;
+            };
+            readonly afterRemove: {
+                readonly installed: false;
+                readonly enabled: false;
+            };
+            readonly installPluginId: "kyoso@kyoso";
+            readonly removePluginId: "kyoso@kyoso";
+        };
+        readonly mcp: {
+            readonly default: {
+                readonly enabled: true;
+                readonly command: "$NODE";
+                readonly args: readonly ["$PROBE_SERVER", "$OBSERVATION"];
+                readonly envVars: readonly ["OPENAI_API_KEY", "CODEX_API_KEY", "CODEX_HOME", "CODEX_ACCESS_TOKEN", "ANTHROPIC_API_KEY", "CLAUDE_CODE_OAUTH_TOKEN"];
+                readonly cwd: null;
+                readonly startupTimeoutSec: 20;
+                readonly toolTimeoutSec: 360;
+            };
+            readonly pluginOverride: {
+                readonly enabled: false;
+                readonly command: "$NODE";
+                readonly args: readonly ["$PROBE_SERVER", "$OBSERVATION"];
+                readonly envVars: readonly ["OPENAI_API_KEY", "CODEX_API_KEY", "CODEX_HOME", "CODEX_ACCESS_TOKEN", "ANTHROPIC_API_KEY", "CLAUDE_CODE_OAUTH_TOKEN"];
+                readonly cwd: null;
+                readonly startupTimeoutSec: 20;
+                readonly toolTimeoutSec: 360;
+            };
+            readonly manualOverride: {
+                readonly enabled: true;
+                readonly command: "manual-kyoso";
+                readonly args: readonly ["mcp"];
+                readonly envVars: readonly [];
+                readonly cwd: null;
+                readonly startupTimeoutSec: null;
+                readonly toolTimeoutSec: null;
+            };
+        };
+        readonly appServer: {
+            readonly default: {
+                readonly serverFound: true;
+                readonly toolNames: readonly ["probe_environment"];
+                readonly authStatus: "unsupported";
+                readonly skillFound: false;
+                readonly skillEnabled: null;
+                readonly skillHasKyosoMcpDependency: false;
+            };
+            readonly pluginOverride: {
+                readonly serverFound: true;
+                readonly toolNames: readonly [];
+                readonly authStatus: "unsupported";
+                readonly skillFound: false;
+                readonly skillEnabled: null;
+                readonly skillHasKyosoMcpDependency: false;
+                readonly mcpObservationWritten: false;
+            };
+        };
+        readonly environment: {
+            readonly cwdIsWorkspace: true;
+            readonly homeInherited: true;
+            readonly codexHomeForwarded: true;
+            readonly tempDirectoryInherited: true;
+            readonly pathInherited: true;
+            readonly allowlistedEnvForwarded: {
+                readonly OPENAI_API_KEY: true;
+                readonly CODEX_API_KEY: true;
+                readonly CODEX_ACCESS_TOKEN: true;
+                readonly ANTHROPIC_API_KEY: true;
+                readonly CLAUDE_CODE_OAUTH_TOKEN: true;
+            };
+            readonly deniedSentinelForwarded: false;
+        };
+        readonly isolation: {
+            readonly distinctHomeAndCodexHome: true;
+            readonly distinctWorkspace: true;
+        };
+    };
+};

package/dist/cli/setup.d.ts

@@ -1,6 +1,18 @@
 export type SetupClient = "codex" | "claude-code";
 export type SetupRunner = "npx" | "bunx";
 export type SetupScope = "project" | "global";
+export type ManualMcpStatus = "enabled" | "disabled" | "missing" | "unknown";
+export type SetupDetection = {
+    mcp: boolean;
+    skill: boolean;
+    manualMcpStatus: ManualMcpStatus;
+    mcpPaths: string[];
+    skillPaths: string[];
+};
+export type CodexPluginMcpOverride = {
+    status: ManualMcpStatus;
+    path: string;
+};
 export type SetupOptions = {
     cwd: string;
     client?: string;
@@ -8,6 +20,8 @@ export type SetupOptions = {
     global: boolean;
     runner?: string;
     command?: string;
+    skillOnly?: boolean;
+    force?: boolean;
     env?: NodeJS.ProcessEnv;
 };
 type McpCommand = {
@@ -19,11 +33,17 @@ export declare function commandForRunner(runner: SetupRunner): McpCommand;
 export declare function buildCodexMcpToml(command: McpCommand): string;
 export declare function buildClaudeMcpEntry(command: McpCommand): Record<string, unknown>;
 export declare function skillDestination(client: SetupClient, scope: SetupScope, cwd: string, home: string): string;
+export declare function resolveUserHome(env?: NodeJS.ProcessEnv): string;
+export declare function resolveCodexConfigPath(env?: NodeJS.ProcessEnv, cwd?: string): string;
+export declare function resolveCodexUserSkillPath(env?: NodeJS.ProcessEnv): string;
+export declare function detectCodexPluginMcpOverride(options: {
+    cwd: string;
+    env?: NodeJS.ProcessEnv;
+}): CodexPluginMcpOverride;
 export declare function detectSetup(options: {
     cwd: string;
     home?: string;
-}): Record<SetupClient, {
-    mcp: boolean;
-    skill: boolean;
-}>;
+    codexHome?: string;
+    env?: NodeJS.ProcessEnv;
+}): Record<SetupClient, SetupDetection>;
 export {};

package/dist/cli/skillInstall.d.ts

@@ -0,0 +1,16 @@
+export declare const SKILL_INSTALL_MARKER = ".kyoso-install.json";
+export declare const SKILL_INSTALL_BACKUP = ".kyoso-review.backup";
+export declare const SKILL_INSTALL_TRANSACTION = ".kyoso-review.install-transaction.json";
+export type ManagedSkillResult = {
+    status: "dry-run" | "created" | "updated" | "skipped" | "conflict";
+    path: string;
+    detail: string;
+};
+export declare function ensureManagedSkill(options: {
+    sourceDir: string;
+    destinationDir: string;
+    trustedRoot: string;
+    write: boolean;
+    force: boolean;
+}): Promise<ManagedSkillResult>;
+export declare function hashSkillDirectory(directory: string): Promise<string>;

package/dist/config/configOverrides.d.ts

@@ -0,0 +1,2 @@
+import { type KyosoConfig } from "./schema.js";
+export declare function applyConfigOverrides(config: KyosoConfig, assignments: string[]): KyosoConfig;

package/dist/config/projectScope.d.ts

@@ -6,6 +6,8 @@ type Violation = {
     path: string;
     reason?: string;
 };
+export declare const kyosoConfigOverridePaths: readonly ["agents.codex.enabled", "agents.codex.model", "agents.codex.effort", "agents.codex.role", "agents.codex.timeoutMs", "agents.claude.enabled", "agents.claude.model", "agents.claude.effort", "agents.claude.role", "agents.claude.timeoutMs", "verification.enabled", "verification.maxFindings", "verification.timeoutMs", "judge.mode", "judge.provider", "judge.timeoutMs"];
+export declare function isAllowedConfigOverridePath(path: string[]): boolean;
 export declare function mergeProjectTomlConfig(baseConfig: unknown, projectConfig: unknown, options: ProjectScopeOptions): unknown;
 export declare function collectProjectScopeViolations(config: unknown): Violation[];
 export declare function flattenLeaves(value: unknown, path?: string[]): Array<{

package/dist/core/constants.d.ts

@@ -4,4 +4,4 @@ export declare const DEFAULT_MAX_DIFF_BYTES = 300000;
 export declare const RAW_OUTPUT_MAX_CHARS = 16384;
 export declare const TRACE_DIR = ".kyoso/traces";
 export declare const KYOSO_CHILD_AGENT = "KYOSO_CHILD_AGENT";
-export declare const KYOSO_VERSION = "0.7.1";
+export declare const KYOSO_VERSION = "0.9.0";

package/dist/core/runReview.d.ts

@@ -1,12 +1,15 @@
 import { type KyosoConfig } from "../config/schema.js";
 import { type LoadConfigOptions } from "../config/loadConfig.js";
 import type { AcpAgentManager } from "../acp/AcpAgentManager.js";
+import { type TraceWriter, type TraceWriterOptions } from "../audit/trace.js";
 import type { KyosoResult, KyosoReviewRequest, NetworkMode, ReviewTool } from "./types.js";
 export type RunReviewOptions = LoadConfigOptions & {
     config?: KyosoConfig;
+    configOverrides?: string[];
     configHash?: string;
     agentManager?: AcpAgentManager;
     env?: NodeJS.ProcessEnv;
     mcpNetworkMode?: NetworkMode;
+    traceWriterFactory?: (options: TraceWriterOptions) => TraceWriter;
 };
 export declare function runReview(tool: ReviewTool, request: KyosoReviewRequest, options?: RunReviewOptions): Promise<KyosoResult>;