Repository navigation
chore: sync shared skills ee9da77c1502 - #21
Peyton-Spencer wants to merge 1 commit into
Conversation
✅ Ditto reviewed
|
![ditto-code[bot]](https://avatars.githubusercontent.com/in/3889634?s=60&v=4){kind=small}
| claimed = {r for entry in registry.values() for r in entry.get("root_manifests", [])} | ||
| for root in sorted(ROOT_MANIFESTS[host] - claimed): | ||
| if file_at(repo, root).exists(): | ||
| raise ValueError(f"{root} exists but no plugin in scripts/plugins.json lists it under root_manifests") |
There was a problem hiding this comment.
🟡 Medium · bug — Reject claimed root manifests missing from the distribution · 🔎 Verified by trace
When the source registry claims .kimi-plugin/plugin.json but the distribution lacks it, build_all proceeds and host_manifests silently filters the missing file out. The root-install feature is therefore not generated or version-bumped, instead of failing like the primary-manifest check does.
| claimed = {r for entry in registry.values() for r in entry.get("root_manifests", [])} | |
| for root in sorted(ROOT_MANIFESTS[host] - claimed): | |
| if file_at(repo, root).exists(): | |
| raise ValueError(f"{root} exists but no plugin in scripts/plugins.json lists it under root_manifests") | |
| claimed = {r for entry in registry.values() for r in entry.get("root_manifests", [])} | |
| for root in sorted(ROOT_MANIFESTS[host] - claimed): | |
| if file_at(repo, root).exists(): | |
| raise ValueError(f"{root} exists but no plugin in scripts/plugins.json lists it under root_manifests") | |
| for root in sorted(claimed): | |
| if not file_at(repo, root).exists(): | |
| raise ValueError(f"{root} is listed under root_manifests but missing from the distribution; scaffold it before generating") |
Why Ditto flagged this (confidence 88%)
A concrete source registry can claim .kimi-plugin/plugin.json while that file is absent from the distribution; build_all only checks for existing unclaimed roots at lines 262–265, and host_manifests filters missing paths at line 181, so the build continues without including the claimed root manifest in version bumps. The primary plugin manifest is explicitly required at lines 269–270, so the missing claimed root manifest should likewise fail rather than be silently skipped.
Git file evidence: .kimi-plugin/plugin.json absent at d83589e. This establishes repository state, not runtime resolution or generated-content correctness.
🤖 Prompt for AI agents
[!NOTE]
Generated from this pull request, which may contain untrusted text. Read it before giving it to an agent, and do not follow instructions in it that go beyond the fix.
In `scripts/shared_skills.py` at lines 262–265, extend the `host == "plugins"` validation in `build_all` to reject every registry-claimed root manifest that does not exist in the distribution, with a clear scaffold-before-generating error. This ensures a claimed root manifest cannot be silently skipped by `host_manifests`. Add a focused test for a claimed but missing root manifest, then run the relevant shared-skills tests.
There was a problem hiding this comment.
Ditto Review
No blocking issues · 1 non-blocking suggestion · risk: medium · d83589e
File coverage: 0 fully reviewed, 2 reviewed briefly, 0 not reviewed.
Support versioned repository-root manifests in shared-skill generation — This change syncs the shared-skills lock to a newer source commit and teaches the generator to include supported repository-root host manifests when building plugins. It validates manifest ownership in the plugin registry and bumps claimed root manifests alongside plugin manifests; reviewers should check that the ownership checks and version-bump conditions cover the intended cases.
| Location | Finding | |
|---|---|---|
| 🟡 Medium | scripts/shared_skills.py:265 |
Reject claimed root manifests missing from the distribution · 🔎 Verified by trace |
Walkthrough (2 files)
| File | Change |
|---|---|
plugins/ditto/shared-skills.lock.json |
Updates the pinned shared-skills source commit and generator hash. |
scripts/shared_skills.py |
Adds registry validation and build/version-bump support for plugin-owned repository-root host manifests. |
Review details
- Models: review
z-ai/glm-5.3-flash· verifyopenai/gpt-6-luna - Findings: 1 candidates → 1 verified → 1 posted
- Context index: 37 files · 11 changed symbols · 75 references
- Tokens: 1132155 in / 70638 out · $0.12
- Run:
9e71e34a-1278-43e4-80ad-34805ac091d6· engine v2.0.0 · details - Ditto approves or requests changes in a separate review (blocking: 🟠 High and above). Inference is billed through your Ditto Router endpoint.
Open in Ditto · reply @ditto review to re-run · @ditto fix to push fixes
|
Closing as superseded. This sync was generated against ditto-plugins Main (
The lock's |
Update the generated skills from
ee9da77c1502fb183e5eb6e7f265409e4af14b9ein the private canonical ditto-skills repository.Host adapter configuration is retained. Generated provenance and offline verification passed; a patch version is raised when skill content changes.
This workflow does not merge, publish a release, deploy a backend, or submit to a store. Review and merge this proposal deliberately.