@kyo-so/cli 0.9.1 → 0.11.0

package/dist/cli/knownSkillDigests.d.ts

@@ -1,4 +1,4 @@
-export declare const CURRENT_SKILL_DIGEST = "sha256:98e715396ee3e1994c29ab49bc489197f242091c8ac0e06e182c0eccd5ab277e";
+export declare const CURRENT_SKILL_DIGEST = "sha256:570f83f716734f34db00147f1b98bc8cd4e9c0016d3946b352ecef4a5d6b8734";
 export declare const KNOWN_SKILL_DIGESTS_BY_VERSION: {
     readonly "0.8.0": readonly [{
         readonly digest: "sha256:b16ea3f8141a01399b96dee650365d99df2b8c5fc99184d9cb22d5d72c106fd8";

package/dist/cli/openRouterAcpSmoke.d.ts

@@ -0,0 +1,25 @@
+import { type KyosoConfig } from "../config/schema.js";
+import type { AgentRunInput, AgentRunResult } from "../core/types.js";
+export declare const OPENROUTER_ACP_SMOKE_OPT_IN_ENV = "KYOSO_OPENROUTER_ACP_SMOKE";
+export declare const OPENROUTER_ACP_SMOKE_OPT_IN_VALUE = "release";
+export declare const OPENROUTER_ACP_SMOKE_MODEL_ENV = "KYOSO_OPENROUTER_MODEL";
+export declare const OPENROUTER_ACP_SMOKE_SUCCESS_MARKER = "KYOSO_OPENROUTER_ACP_SMOKE_OK";
+export declare class OpenRouterCodexAcpSmokePreflightError extends Error {
+    constructor(message: string);
+}
+export declare class OpenRouterCodexAcpSmokeRuntimeError extends Error {
+    constructor(message: string);
+}
+export type OpenRouterCodexAcpSmokeOptions = {
+    env?: NodeJS.ProcessEnv;
+    runAgent?: (input: AgentRunInput, config: KyosoConfig, childEnv: NodeJS.ProcessEnv) => Promise<AgentRunResult>;
+};
+export declare function assertOpenRouterCodexAcpSmokeArguments(input: {
+    positionals: string[];
+    flags: Record<string, string | boolean | string[]>;
+}): void;
+export declare function validateOpenRouterCodexAcpSmoke(env: NodeJS.ProcessEnv): {
+    model: string;
+};
+export declare function createOpenRouterCodexAcpSmokeConfig(model: string): KyosoConfig;
+export declare function runOpenRouterCodexAcpSmoke(options?: OpenRouterCodexAcpSmokeOptions): Promise<string>;

package/dist/cli/pluginRuntimeContract.d.ts

@@ -10,9 +10,9 @@ export declare const PLUGIN_RUNTIME_COMPATIBILITY_SCHEMA_VERSION = 1;
 export declare const MINIMUM_SUPPORTED_CODEX_VERSION = "0.144.0-alpha.4";
 export declare const PLUGIN_RUNTIME_EXPECTED_CONTRACT: {
     readonly distribution: {
-        readonly pluginVersion: "0.3.0";
+        readonly pluginVersion: "0.4.0";
         readonly mcpCommand: "npx";
-        readonly mcpPackagePin: "@kyo-so/cli@0.9.0";
+        readonly mcpPackagePin: "@kyo-so/cli@0.10.0";
     };
     readonly marketplace: {
         readonly name: "kyoso";
@@ -47,7 +47,7 @@ export declare const PLUGIN_RUNTIME_EXPECTED_CONTRACT: {
             readonly enabled: true;
             readonly command: "$NODE";
             readonly args: readonly ["$PROBE_SERVER", "$OBSERVATION"];
-            readonly envVars: readonly ["OPENAI_API_KEY", "CODEX_API_KEY", "CODEX_HOME", "CODEX_ACCESS_TOKEN", "ANTHROPIC_API_KEY", "CLAUDE_CODE_OAUTH_TOKEN"];
+            readonly envVars: readonly ["OPENAI_API_KEY", "CODEX_API_KEY", "CODEX_HOME", "CODEX_ACCESS_TOKEN", "OPENROUTER_API_KEY", "ANTHROPIC_API_KEY", "CLAUDE_CODE_OAUTH_TOKEN"];
             readonly cwd: null;
             readonly startupTimeoutSec: 20;
             readonly toolTimeoutSec: 360;
@@ -56,7 +56,7 @@ export declare const PLUGIN_RUNTIME_EXPECTED_CONTRACT: {
             readonly enabled: false;
             readonly command: "$NODE";
             readonly args: readonly ["$PROBE_SERVER", "$OBSERVATION"];
-            readonly envVars: readonly ["OPENAI_API_KEY", "CODEX_API_KEY", "CODEX_HOME", "CODEX_ACCESS_TOKEN", "ANTHROPIC_API_KEY", "CLAUDE_CODE_OAUTH_TOKEN"];
+            readonly envVars: readonly ["OPENAI_API_KEY", "CODEX_API_KEY", "CODEX_HOME", "CODEX_ACCESS_TOKEN", "OPENROUTER_API_KEY", "ANTHROPIC_API_KEY", "CLAUDE_CODE_OAUTH_TOKEN"];
             readonly cwd: null;
             readonly startupTimeoutSec: 20;
             readonly toolTimeoutSec: 360;
@@ -100,6 +100,7 @@ export declare const PLUGIN_RUNTIME_EXPECTED_CONTRACT: {
             readonly OPENAI_API_KEY: true;
             readonly CODEX_API_KEY: true;
             readonly CODEX_ACCESS_TOKEN: true;
+            readonly OPENROUTER_API_KEY: true;
             readonly ANTHROPIC_API_KEY: true;
             readonly CLAUDE_CODE_OAUTH_TOKEN: true;
         };
@@ -129,9 +130,9 @@ export declare const pluginRuntimeContract: {
     readonly pluginListTopLevelKeys: readonly ["installed", "available"];
     readonly expectedContract: {
         readonly distribution: {
-            readonly pluginVersion: "0.3.0";
+            readonly pluginVersion: "0.4.0";
             readonly mcpCommand: "npx";
-            readonly mcpPackagePin: "@kyo-so/cli@0.9.0";
+            readonly mcpPackagePin: "@kyo-so/cli@0.10.0";
         };
         readonly marketplace: {
             readonly name: "kyoso";
@@ -166,7 +167,7 @@ export declare const pluginRuntimeContract: {
                 readonly enabled: true;
                 readonly command: "$NODE";
                 readonly args: readonly ["$PROBE_SERVER", "$OBSERVATION"];
-                readonly envVars: readonly ["OPENAI_API_KEY", "CODEX_API_KEY", "CODEX_HOME", "CODEX_ACCESS_TOKEN", "ANTHROPIC_API_KEY", "CLAUDE_CODE_OAUTH_TOKEN"];
+                readonly envVars: readonly ["OPENAI_API_KEY", "CODEX_API_KEY", "CODEX_HOME", "CODEX_ACCESS_TOKEN", "OPENROUTER_API_KEY", "ANTHROPIC_API_KEY", "CLAUDE_CODE_OAUTH_TOKEN"];
                 readonly cwd: null;
                 readonly startupTimeoutSec: 20;
                 readonly toolTimeoutSec: 360;
@@ -175,7 +176,7 @@ export declare const pluginRuntimeContract: {
                 readonly enabled: false;
                 readonly command: "$NODE";
                 readonly args: readonly ["$PROBE_SERVER", "$OBSERVATION"];
-                readonly envVars: readonly ["OPENAI_API_KEY", "CODEX_API_KEY", "CODEX_HOME", "CODEX_ACCESS_TOKEN", "ANTHROPIC_API_KEY", "CLAUDE_CODE_OAUTH_TOKEN"];
+                readonly envVars: readonly ["OPENAI_API_KEY", "CODEX_API_KEY", "CODEX_HOME", "CODEX_ACCESS_TOKEN", "OPENROUTER_API_KEY", "ANTHROPIC_API_KEY", "CLAUDE_CODE_OAUTH_TOKEN"];
                 readonly cwd: null;
                 readonly startupTimeoutSec: 20;
                 readonly toolTimeoutSec: 360;
@@ -219,6 +220,7 @@ export declare const pluginRuntimeContract: {
                 readonly OPENAI_API_KEY: true;
                 readonly CODEX_API_KEY: true;
                 readonly CODEX_ACCESS_TOKEN: true;
+                readonly OPENROUTER_API_KEY: true;
                 readonly ANTHROPIC_API_KEY: true;
                 readonly CLAUDE_CODE_OAUTH_TOKEN: true;
             };

package/dist/cli/setup.d.ts

@@ -18,6 +18,7 @@ export type SetupOptions = {
     client?: string;
     write: boolean;
     global: boolean;
+    withOpenRouter?: boolean;
     runner?: string;
     command?: string;
     skillOnly?: boolean;
@@ -30,8 +31,8 @@ type McpCommand = {
 };
 export declare function runSetup(options: SetupOptions): Promise<string>;
 export declare function commandForRunner(runner: SetupRunner): McpCommand;
-export declare function buildCodexMcpToml(command: McpCommand): string;
-export declare function buildClaudeMcpEntry(command: McpCommand): Record<string, unknown>;
+export declare function buildCodexMcpToml(command: McpCommand, withOpenRouter?: boolean): string;
+export declare function buildClaudeMcpEntry(command: McpCommand, withOpenRouter?: boolean): Record<string, unknown>;
 export declare function skillDestination(client: SetupClient, scope: SetupScope, cwd: string, home: string): string;
 export declare function resolveUserHome(env?: NodeJS.ProcessEnv): string;
 export declare function resolveCodexConfigPath(env?: NodeJS.ProcessEnv, cwd?: string): string;

package/dist/config/loadConfig.d.ts

@@ -26,5 +26,24 @@ export type LoadedConfig = {
     sources: LoadedConfigSource[];
     warnings: string[];
 };
+export type ConfigValidationContext = {
+    source?: LoadedConfigSource;
+    projectTsExecuted: boolean;
+};
+export declare function getConfigValidationContext(error: unknown): ConfigValidationContext | undefined;
+export declare class ProjectOpenRouterAuthorizationError extends Error {
+    readonly code = "PROJECT_OPENROUTER_AUTHORIZATION_REQUIRED";
+    readonly projectPath: string;
+    readonly projectDirectory: string;
+    readonly layer: "project_toml" | "project_ts";
+    readonly globalConfigPath: string;
+    constructor(input: {
+        projectPath: string;
+        projectDirectory: string;
+        layer: "project_toml" | "project_ts";
+        globalConfigPath: string;
+    });
+}
 export declare function loadConfig(options?: LoadConfigOptions): Promise<LoadedConfig>;
 export declare function resolveGlobalTomlConfigPath(env?: NodeJS.ProcessEnv): string;
+export declare function applyProjectCodexProviderReset(baseConfig: unknown, projectConfig: unknown, mergedConfig: unknown): unknown;

package/dist/config/projectScope.d.ts

@@ -6,7 +6,7 @@ type Violation = {
     path: string;
     reason?: string;
 };
-export declare const kyosoConfigOverridePaths: readonly ["agents.codex.enabled", "agents.codex.model", "agents.codex.effort", "agents.codex.role", "agents.codex.timeoutMs", "agents.claude.enabled", "agents.claude.model", "agents.claude.effort", "agents.claude.role", "agents.claude.timeoutMs", "verification.enabled", "verification.maxFindings", "verification.timeoutMs", "judge.mode", "judge.provider", "judge.timeoutMs"];
+export declare const kyosoConfigOverridePaths: readonly ["agents.codex.enabled", "agents.codex.model", "agents.codex.provider", "agents.codex.effort", "agents.codex.role", "agents.codex.timeoutMs", "agents.claude.enabled", "agents.claude.model", "agents.claude.effort", "agents.claude.role", "agents.claude.timeoutMs", "verification.enabled", "verification.maxFindings", "verification.timeoutMs", "judge.mode", "judge.provider", "judge.timeoutMs"];
 export declare function isAllowedConfigOverridePath(path: string[]): boolean;
 export declare function mergeProjectTomlConfig(baseConfig: unknown, projectConfig: unknown, options: ProjectScopeOptions): unknown;
 export declare function collectProjectScopeViolations(config: unknown): Violation[];

package/dist/config/schema.d.ts

@@ -1,4 +1,8 @@
 import { z } from "zod";
+export declare const CODEX_OPENROUTER_PROVIDER: "openrouter";
+export declare const CODEX_DEFAULT_PROVIDER: "default";
+export declare const CODEX_OPENROUTER_MODEL_REQUIRED_ISSUE: "codex_openrouter_model_required";
+export type CodexProvider = typeof CODEX_OPENROUTER_PROVIDER | typeof CODEX_DEFAULT_PROVIDER;
 type PartialDeep<T> = {
     [K in keyof T]?: T[K] extends Record<string, unknown> ? PartialDeep<T[K]> : T[K];
 };
@@ -35,6 +39,11 @@ export declare const kyosoConfigSchema: z.ZodObject<{
                 recommendedEnv: z.ZodArray<z.ZodString>;
                 envWhitelist: z.ZodArray<z.ZodString>;
             }, z.core.$strip>;
+            provider: z.ZodOptional<z.ZodEnum<{
+                openrouter: "openrouter";
+                default: "default";
+            }>>;
+            allowProjectProvider: z.ZodDefault<z.ZodArray<z.ZodString>>;
         }, z.core.$strip>;
         claude: z.ZodObject<{
             enabled: z.ZodDefault<z.ZodBoolean>;
@@ -114,6 +123,13 @@ export declare const kyosoConfigSchema: z.ZodObject<{
         timeoutMs: z.ZodDefault<z.ZodNumber>;
         allowDemotion: z.ZodDefault<z.ZodBoolean>;
     }, z.core.$strip>;
+    reviewBudget: z.ZodObject<{
+        maxModelCalls: z.ZodNumber;
+        maxTotalWallTimeMs: z.ZodNumber;
+        maxAgentOutputBytes: z.ZodNumber;
+        maxFindingsPerAgent: z.ZodNumber;
+        skipOptionalPhasesWhenTokenUsageUnknown: z.ZodBoolean;
+    }, z.core.$strip>;
     audit: z.ZodObject<{
         enabled: z.ZodBoolean;
         format: z.ZodLiteral<"jsonl">;

package/dist/core/constants.d.ts

@@ -1,7 +1,9 @@
 export declare const DEFAULT_AGENT_TIMEOUT_MS = 120000;
 export declare const DEFAULT_MAX_CONTEXT_BYTES = 500000;
 export declare const DEFAULT_MAX_DIFF_BYTES = 300000;
+export declare const MAX_AGENT_OUTPUT_BYTES = 1048576;
+export declare const JUDGE_MAX_OUTPUT_TOKENS = 4096;
 export declare const RAW_OUTPUT_MAX_CHARS = 16384;
 export declare const TRACE_DIR = ".kyoso/traces";
 export declare const KYOSO_CHILD_AGENT = "KYOSO_CHILD_AGENT";
-export declare const KYOSO_VERSION = "0.9.1";
+export declare const KYOSO_VERSION = "0.11.0";

package/dist/core/requestFingerprint.d.ts

@@ -0,0 +1,11 @@
+import type { KyosoConfig } from "../config/schema.js";
+import type { AgentRole, KyosoReviewRequest, ReviewBudget, ReviewTool } from "./types.js";
+export declare const REVIEW_CONTRACT_VERSION = "2026-07-15-v1";
+export declare function createRequestFingerprint(input: {
+    tool: ReviewTool;
+    request: KyosoReviewRequest;
+    config: KyosoConfig;
+    roles: Partial<Record<"codex" | "claude", AgentRole>>;
+    budget: ReviewBudget;
+}): string;
+export declare function canonicalJson(value: unknown): string;

package/dist/core/reviewBudget.d.ts

@@ -0,0 +1,68 @@
+import type { AgentName, ModelCallKind, ModelTokenUsage, ReviewBudget, ReviewBudgetRequest, ReviewCompletion, ReviewCompletionReason, ReviewExecutionBudget, ReviewModelCallAudit } from "./types.js";
+type ReservationStatus = "reserved" | "started" | "completed" | "skipped";
+type Reservation = {
+    id: number;
+    kind: ModelCallKind;
+    agent?: AgentName;
+    status: ReservationStatus;
+    reason?: string;
+    outputBytes?: number;
+    usage?: ModelTokenUsage;
+    stopReason?: string;
+};
+export type ModelCallReservation = Pick<Reservation, "id" | "kind" | "agent">;
+export type BudgetReservationFailure = {
+    reason: "model_call_budget" | "deadline";
+};
+export declare function resolveReviewBudget(ceiling: ReviewBudget, requested: ReviewBudgetRequest | undefined): ReviewBudget;
+export declare class ReviewBudgetTracker {
+    readonly budget: ReviewBudget;
+    readonly startedAtEpochMs: number;
+    readonly deadlineAtEpochMs: number;
+    private readonly reservations;
+    private readonly skippedCalls;
+    private readonly incompleteReasons;
+    private nextReservationId;
+    constructor(budget: ReviewBudget, startedAtEpochMs?: number);
+    remainingWallTimeMs(now?: number): number;
+    hasDeadlineExpired(now?: number): boolean;
+    reserveMany(inputs: Array<{
+        kind: ModelCallKind;
+        agent?: AgentName;
+    }>): {
+        reservations: ModelCallReservation[];
+    } | {
+        failure: BudgetReservationFailure;
+    };
+    reserve(input: {
+        kind: ModelCallKind;
+        agent?: AgentName;
+    }): {
+        reservation: ModelCallReservation;
+    } | {
+        failure: BudgetReservationFailure;
+    };
+    markStarted(reservation: ModelCallReservation): void;
+    hasStarted(reservation: ModelCallReservation): boolean;
+    complete(reservation: ModelCallReservation, values?: {
+        outputBytes?: number;
+        usage?: ModelTokenUsage;
+        stopReason?: string;
+    }): void;
+    skip(reservation: ModelCallReservation, reason: string): void;
+    recordSkipped(input: {
+        kind: ModelCallKind;
+        agent?: AgentName;
+        reason: string;
+    }): void;
+    markIncomplete(reason: ReviewCompletionReason): void;
+    isTokenUsageUnknown(): boolean;
+    snapshot(now?: number): {
+        completion: ReviewCompletion;
+        executionBudget: ReviewExecutionBudget;
+        modelCalls: ReviewModelCallAudit[];
+    };
+    private usedCapacity;
+    private modelCalls;
+}
+export {};

package/dist/core/tokenUsage.d.ts

@@ -0,0 +1,2 @@
+import type { ModelTokenUsage } from "./types.js";
+export declare function normalizeModelTokenUsage(usage: unknown): ModelTokenUsage | undefined;

package/dist/core/types.d.ts

@@ -4,6 +4,29 @@ export type GateStatus = "pass" | "warn" | "fail" | "not_applicable";
 export type NetworkMode = "model_only" | "unrestricted";
 export type JudgeProvider = "auto" | "openai" | "anthropic" | "none";
 export type Severity = "critical" | "high" | "medium" | "low" | "info";
+export type ReviewBudget = {
+    maxModelCalls: number;
+    maxTotalWallTimeMs: number;
+    maxAgentOutputBytes: number;
+    maxFindingsPerAgent: number;
+    skipOptionalPhasesWhenTokenUsageUnknown: boolean;
+};
+export type ReviewBudgetRequest = Partial<ReviewBudget>;
+export type ReviewCompletionReason = "model_call_budget" | "deadline" | "agent_output_limit" | "token_usage_unknown" | "coverage_incomplete" | "disputed_finding";
+export type ReviewCompletion = {
+    status: "complete" | "incomplete";
+    reasons: ReviewCompletionReason[];
+    retryable: false;
+};
+export type ModelCallKind = "primary" | "verifier" | "judge";
+export type ModelTokenUsage = {
+    totalTokens?: number;
+    inputTokens?: number;
+    outputTokens?: number;
+    thoughtTokens?: number;
+    cachedReadTokens?: number;
+    cachedWriteTokens?: number;
+};
 export type FindingCategory = "architecture" | "authn" | "authz" | "csrf" | "xss" | "ssrf" | "injection" | "secret" | "supply_chain" | "privacy" | "data_loss" | "test" | "maintainability" | "cisa_secure_by_design" | "other";
 export type CisaDimension = "customer_security_outcomes" | "secure_by_default" | "transparency_and_accountability" | "governance";
 export type KyosoReviewRequest = {
@@ -30,6 +53,7 @@ export type KyosoReviewRequest = {
     options?: {
         network?: NetworkMode;
         maxAgentTimeoutMs?: number;
+        reviewBudget?: ReviewBudgetRequest;
         includeAgentRawOutputs?: boolean;
         judgeProvider?: JudgeProvider;
         allowSecretRedaction?: boolean;
@@ -110,7 +134,10 @@ export type AgentRunInput = {
     prompt: string;
     workspaceDir: string;
     timeoutMs: number;
+    deadlineAtEpochMs?: number;
+    maxOutputBytes?: number;
     networkMode: NetworkMode;
+    onStarted?: (() => void) | (() => Promise<void>);
 };
 export type AgentRunResult = {
     agent: AgentName;
@@ -124,11 +151,54 @@ export type AgentRunResult = {
         detail?: string;
     };
     warnings?: string[];
+    usage?: ModelTokenUsage;
+    outputBytes?: number;
+    stopReason?: string;
     startedAt: string;
     completedAt?: string;
 };
+export type ReviewExecutionBudget = {
+    maxModelCalls: number;
+    modelCalls: {
+        planned: number;
+        consumed: number;
+        skipped: number;
+        byKind: Record<ModelCallKind, {
+            planned: number;
+            consumed: number;
+            skipped: number;
+        }>;
+    };
+    wallTime: {
+        limitMs: number;
+        consumedMs: number;
+        remainingMs: number;
+    };
+    maxAgentOutputBytes: number;
+    maxFindingsPerAgent: number;
+    skipOptionalPhasesWhenTokenUsageUnknown: boolean;
+    agentOutputBytes: Partial<Record<AgentName, number>>;
+    tokenUsage: {
+        status: "reported" | "partial" | "unknown";
+        reportedCalls: number;
+        unknownCalls: number;
+        totals: ModelTokenUsage;
+    };
+};
+export type ReviewModelCallAudit = {
+    kind: ModelCallKind;
+    agent?: AgentName;
+    status: "completed" | "skipped";
+    reason?: string;
+    outputBytes?: number;
+    usage?: ModelTokenUsage;
+    stopReason?: string;
+};
 export type KyosoResult = {
     decision: KyosoDecision;
+    completion: ReviewCompletion;
+    executionBudget: ReviewExecutionBudget;
+    requestFingerprint: string;
     degraded: boolean;
     agentsUsed: AgentName[];
     reviewMode: ReviewMode;
@@ -165,6 +235,7 @@ export type KyosoResult = {
         workspaceMode: "temp_snapshot";
         configHash?: string;
         warnings?: string[];
+        modelCalls: ReviewModelCallAudit[];
     };
 };
 export type SecretScanResult = {

package/dist/core/verification.d.ts

@@ -18,7 +18,7 @@ export declare function groupVerificationTargetsByVerifier(targets: Verification
     verifier: AgentName;
     findings: KyosoFinding[];
 }>;
-export declare function markVerificationOverflow(targets: VerificationTarget[]): void;
+export declare function markVerificationOverflow(targets: VerificationTarget[], reason?: string): void;
 export declare function parseVerificationVerdicts(rawText: string | undefined): VerificationVerdict[] | undefined;
 export declare function applyVerificationVerdicts(targets: VerificationTarget[], verifier: AgentName, verdicts: VerificationVerdict[] | undefined): Record<"confirmed" | "refuted" | "uncertain", number>;
 export declare function countVerificationStatuses(findings: KyosoFinding[]): Record<"confirmed" | "refuted" | "uncertain" | "not_verified", number>;

package/dist/index.d.ts

@@ -1,3 +1,3 @@
 export { defineConfig } from "./config/defineConfig.js";
 export { runReview } from "./core/runReview.js";
-export type { CisaSecureByDesignResult, GateStatus, KyosoDecision, KyosoFinding, KyosoResult, KyosoReviewRequest, NetworkMode, ReviewTool, } from "./core/types.js";
+export type { CisaSecureByDesignResult, GateStatus, KyosoDecision, KyosoFinding, KyosoResult, KyosoReviewRequest, ModelTokenUsage, NetworkMode, ReviewBudget, ReviewBudgetRequest, ReviewCompletion, ReviewExecutionBudget, ReviewModelCallAudit, ReviewTool, } from "./core/types.js";