[Peyton-Spencer]

Summary

/plugins install https://github.com/ditto-assistant/ditto-plugins now works in Kimi Code. It finds 3 skills and the MCP plugin-ditto:ditto, which shows as needing auth. On main the same command fails with No manifest at kimi.plugin.json or .kimi-plugin/plugin.json (reproduced with Kimi Code 2.4.1).

Change: a root .kimi-plugin/plugin.json. It is the plugin's own plugins/ditto/.kimi-plugin/plugin.json with one change: skills is ["./plugins/ditto/skills"]. The MCP server stays declared inline. The README now gives the GitHub install, replacing the clone-only note. All manifests bump to 0.3.7.

Why a root manifest

Kimi's plugin docs give no subdirectory option:

• A manifest must be at <plugin_root>/kimi.plugin.json or <plugin_root>/.kimi-plugin/plugin.json.
• The GitHub URL forms are the repository itself, /tree/<ref>, /releases/tag/<tag> and /commit/<sha>. They take a ref but no subdirectory.
• A custom marketplace entry's source is again a local path, a zip URL or a GitHub URL, so it doesn't help either.

That leaves the ticket's fallback, a root manifest. Kimi copies the whole checkout to plugins/managed/ditto and loads skills from the rebased path. The repository has no releases or tags, so the bare URL resolves to the default branch.

The root manifest doesn't change the other hosts. None of them reads .kimi-plugin/, and every install below still behaves as on DITTO-1800: Antigravity still reports "Found bulk plugins directory" and source: antigravity.

Validator and generator

• validate_package.py requires the root manifest to equal the plugin's Kimi manifest apart from the rebased skills path. A drifted version, MCP URL or skills path fails, and so does a missing file. 13 tests (was 12).
• scripts/shared_skills.py is the byte-identical copy from ditto-assistant/ditto-skills#15 (head b65d94a, which includes the Ditto Review fixes). That version bumps root_manifests from scripts/plugins.json along with the plugin. shared-skills.lock.json was regenerated with build --source <ditto-skills@b65d94a>; only source_commit and generator_sha256 changed, and no skill bytes changed.

Repo checks: unittest 13 OK. validate_package.py: 19 files. shared_skills.py verify --host plugins --repo .: 3 skills (also with --source).

Host results

Each CLI ran in its own throwaway HOME, with no host sign-in and no Ditto OAuth. Branch head af845df. After the generator re-vendor (07559a7), I re-ran Kimi (GitHub and local), agy and Claude: same results.

Host (version)	Validator	Install source	Found	Result
Kimi Code 2.4.1	none	GitHub …/ditto-plugins/tree/<branch> ("Installed Ditto 0.3.7 from github …@")	skills 3, 1/1 MCP; plugin-ditto:ditto needs auth	PASS
Kimi Code 2.4.1	none	local plugins/ditto from a fresh clone	skills 3; needs auth	PASS
Antigravity agy 1.4.12	validate --strict passes	GitHub …/tree/<branch>	3 skills, 1 MCP, 0.3.7, source: antigravity	PASS
Claude Code 2.1.314	plugin --strict + marketplace pass	GitHub #<branch>	0.3.7; "Needs authentication"	PASS
Codex CLI 0.163.0	none	GitHub --ref <branch>	0.3.7; "Not logged in"	PASS
Copilot CLI 1.0.105	none	GitHub .git#<branch>	3 skills, 0.3.7; mcp get ditto: Source: Plugin	PASS
Grok 1.0.70	plugin validate passes	fresh clone of the pushed branch (no ref option)	installed ditto	PASS (local clone)
Gemini CLI 0.66.0	fails: no gemini-extension.json (unchanged; DITTO-1798)	n/a	n/a	not a host yet
Cursor	not run (needs a signed-in Cursor account)	n/a	n/a	manual

Limitations

• Installed from a branch, not the bare URL. Kimi's GitHub install was tested with /tree/<branch>. The bare https://github.com/ditto-assistant/ditto-plugins reads main, so it only works after merge.
• Kimi has no headless plugin command. The install was driven through the Kimi TUI in a private tmux server: type /plugins install, choose "Trust and install", then run /plugins list and /mcp.
• The root manifest serves ditto only. A second plugin installs in Kimi from a clone, as CONTRIBUTING.md now says.
• No OAuth sign-in or tool call on any host.

Stack: based on #18 (DITTO-1800). Related: ditto-assistant/ditto-skills#15.

🤖 Generated with Claude Code

[ditto-code]

✅ Ditto reviewed af845df

See this review run → · 3 new comments · approved

_{Open in Ditto · 6m41s}

[ditto-code]

Ditto Review

No blocking issues found · risk: medium · 140fac0

File coverage: 2 fully reviewed, 0 reviewed briefly, 0 not reviewed.

Enable Kimi Code installs from the repository’s GitHub URL — Adds a repository-root Kimi manifest that points to Ditto’s skills under plugins/ditto, enabling installation directly from the GitHub URL, and updates the Kimi installation guidance. Extends package validation and shared-skill generation so the root manifest stays aligned with the plugin manifest and is versioned with it; reviewers should look closely at that synchronization and validation logic. Also bumps Ditto’s host-manifest versions and updates the shared-skills lock metadata.

Walkthrough (8 files)

File	Change
.kimi-plugin/plugin.json	Adds a root-level Kimi manifest that exposes Ditto’s hosted MCP server and points to plugins/ditto/skills.
CONTRIBUTING.md	Documents how Kimi’s root-manifest installation differs from other plugins.
README.md	Replaces the local-only Kimi instructions with GitHub installation steps and explains the root manifest.
plugins/ditto/.{antigravity-plugin,claude-plugin,codex-plugin,cursor-plugin,.github/plugin,.grok-plugin,.kimi-plugin}/plugin.json	Bumps Ditto’s version to 0.3.7 across its host-specific manifests.
plugins/ditto/shared-skills.lock.json	Updates the shared-skills source commit and generator digest.
scripts/shared_skills.py	Adds support for registered root host manifests and includes them in manifest version bumps during skill generation.
scripts/validate_package.py	Validates that the root Kimi manifest matches the plugin manifest except for its rebased skills path, and rejects missing or linked inputs.
tests/test_package.py	Adds coverage for root Kimi manifest consistency, missing files, and symlink rejection.

Review details

• Models: review z-ai/glm-5.3-flash · verify openai/gpt-6-luna
• Findings: 0 candidates → 0 verified → 0 posted
• Context index: 38 files · 15 changed symbols · 74 references
• Tokens: 219726 in / 14310 out · $0.02
• Incremental since 51d16bb
• Run: b85e2394-195a-4fd8-9e24-872949e79543 · engine v2.0.0 · details
• Ditto approves or requests changes in a separate review (blocking: 🟠 High and above). Inference is billed through your Ditto Router endpoint.

_{Open in Ditto · reply @ditto review to re-run · @ditto fix to push fixes}

[ditto-code]

Ditto: approved — no blocking findings (🟠 High or above) in a complete review of af845df. Findings below that do not block merging.

[ditto-code]

✅ Ditto reviewed 07559a7

See this review run → · no new comments · approved

_{Open in Ditto · 1m13s}

[ditto-code]

Ditto: approved — no blocking findings (🟠 High or above) in a complete review of 07559a7. Findings below that do not block merging.

[Peyton-Spencer]

Ditto Review follow-up. The generator fixes are in ditto-assistant/ditto-skills#15 at b65d94a, and ditto-plugins#19 re-vendors them at 07559a7.

• Non-string root_manifests entries. Fixed. They are now a registry ValueError, and a test covers [{}].
• A root manifest the registry doesn't list. Fixed differently from the suggestion. Auto-including every existing root manifest would bump .kimi-plugin/plugin.json for every plugin in the monorepo, ditto-partner included. Instead, build_all now fails when a known root manifest exists but no plugin claims it, and the test checks that the file's version is left unchanged.
• Making a declared-but-missing root manifest fatal. Not taken. Tolerating it lets ditto-skills and ditto-plugins merge in either order without a failing sync proposal. A stale root manifest still can't ship: the ditto-plugins validator requires .kimi-plugin/plugin.json to exist and to equal the plugin's Kimi manifest, version included.

The base branch was changed.

[ditto-code]

✅ Ditto reviewed 6fcbbd4

See this review run → · 1 new comment · approved

_{Open in Ditto · 9m56s}

[ditto-code]

Ditto: approved — no blocking findings (🟠 High or above) in a complete review of 6fcbbd4. Findings below that do not block merging.

[ditto-code]

✅ Ditto reviewed 51d16bb

See this review run → · 1 new comment · approved

_{Open in Ditto · 2m9s}

[ditto-code]

Ditto: approved — no blocking findings (🟠 High or above) in a complete review of 51d16bb. Findings below that do not block merging.

[ditto-code]

✅ Ditto reviewed 140fac0

See this review run → · no new comments · approved

_{Open in Ditto · 1m21s}

[ditto-code]

Ditto: approved — no blocking findings (🟠 High or above) in a complete review of 140fac0. Findings below that do not block merging.