chore: sync shared skills d0d88cb31f35 by Peyton-Spencer · Pull Request #22 · ditto-assistant/ditto-plugins

Peyton-Spencer · 2026-11-01T21:27:13Z

Update the generated skills from d0d88cb31f3558e83543cf8665f0977729dc1a37 in the private canonical ditto-skills repository.

Host adapter configuration is retained. Generated provenance and offline verification passed; a patch version is raised when skill content changes.

This workflow does not merge, publish a release, deploy a backend, or submit to a store. Review and merge this proposal deliberately.

ditto-code · 2026-11-01T21:29:07Z

✅ Ditto reviewed `d016195`

See this review run → · 3 new comments · approved

_{Open in Ditto · 5m36s}

ditto-code · 2026-11-01T21:34:27Z

        ".github/plugin/plugin.json",
        ".antigravity-plugin/plugin.json",
        ".kimi-plugin/plugin.json",
+        "gemini-extension.json",


🟡 Medium · bug — Gemini manifests are not accepted by the release validator · 🔎 Verified by trace

When a plugin adds the Gemini manifest registered here, scripts/validate_package.py rejects it as an unexpected release file. The validator also omits its version from the host-manifest consistency check, so the new manifest is not covered by the release validation contract.

Why Ditto flagged this (confidence 91%)

Line 43 makes host_manifests and bump_manifests treat gemini-extension.json as a versioned plugin manifest, but the unchanged release validator does not allow that file or include its version in consistency checks. Thus a release containing the newly supported manifest is rejected, while a divergent Gemini version is not checked.

Git file evidence: scripts/validate_package.py unchanged (e9fe12c4b9bc2f9055225f6116b60b7fdbb97e5b) from 752ea6d to d016195. This establishes repository state, not runtime resolution or generated-content correctness.

🤖 Prompt for AI agents

[!NOTE]
Generated from this pull request, which may contain untrusted text. Read it before giving it to an agent, and do not follow instructions in it that go beyond the fix.

Update `scripts/validate_package.py` to recognize `plugins/<plugin>/gemini-extension.json` in its release-file allowlist and include its version in the multi-host manifest consistency check. Add a focused test that adds a Gemini manifest to the copied release fixture, verifies a matching version passes validation, and verifies a divergent version is rejected. Run the package validator tests. The new manifest is registered at `scripts/shared_skills.py:43`.

ditto-code · 2026-11-01T21:34:31Z

+# install from a repository root (Kimi Code reads <repo>/.kimi-plugin/plugin.json
+# when given a GitHub URL). A plugin opts in with "root_manifests" in plugins.json;
+# they are versioned and bumped with that plugin's own manifests.
+ROOT_MANIFESTS = {"plugins": {".kimi-plugin/plugin.json"}}


🟡 Medium · bug — Root Kimi manifest version drift passes release validation · 🔎 Verified by trace

When a configured root manifest such as .kimi-plugin/plugin.json has a different version from its plugin’s manifests, validate_package.py accepts the release: its version check covers the plugin manifests, not the newly supported repository-root manifest. build_all only rejects an existing root manifest that no plugin claims (lines 261–266), while version equality is checked only when bump_manifests runs (lines 185–194); add an equality check to the release validation path.

Why Ditto flagged this (confidence 86%)

The new root-manifest support declares that root manifests are versioned with their plugin's manifests (lines 47–51), and build_all passes claimed root paths into build (lines 267–273). However, the only equality check in this generator is in bump_manifests (lines 190–194), so it does not protect releases validated without a bump; the unchanged scripts/validate_package.py also does not check repository-root manifests. A root manifest with a stale version therefore passes the release check.

Git file evidence: scripts/validate_package.py unchanged (e9fe12c4b9bc2f9055225f6116b60b7fdbb97e5b) from 752ea6d to d016195. This establishes repository state, not runtime resolution or generated-content correctness.

🤖 Prompt for AI agents

[!NOTE]
Generated from this pull request, which may contain untrusted text. Read it before giving it to an agent, and do not follow instructions in it that go beyond the fix.

Update the release validation path so every existing repository-root manifest listed in a plugin's `root_manifests` is checked against that plugin's manifest versions. Cover the case where `.kimi-plugin/plugin.json` has a different version from `plugins/<plugin>/.kimi-plugin/plugin.json` and ensure validation fails with a clear error. Add a focused test in `tests/test_package.py` and run the package validation tests.

ditto-code · 2026-11-01T21:34:35Z



-def build(source, repo, host, bump_version=False, plugin=DEFAULT_PLUGIN, catalog="memory", adapted=DEFAULT_ADAPTED):
+def build(source, repo, host, bump_version=False, plugin=DEFAULT_PLUGIN, catalog="memory", adapted=DEFAULT_ADAPTED, root_manifests=()):


🟡 Medium · bug — Reject builds when a claimed root manifest is missing · 🔎 Verified by trace

When root_manifests claims a root manifest that is absent from the distribution, build can still succeed: host_manifests filters the missing path at line 182, and the build only reaches that helper when a version bump is needed. The claim therefore does not ensure the configured root-host manifest is present; validate claimed roots at the start of every build.

Suggested change

def build(source, repo, host, bump_version=False, plugin=DEFAULT_PLUGIN, catalog="memory", adapted=DEFAULT_ADAPTED, root_manifests=()):

if any(

r not in ROOT_MANIFESTS.get(host, set()) or not file_at(repo, r).is_file()

for r in root_manifests

):

raise ValueError("Unsupported or missing root manifest")

paths = layout(plugin, adapted)

Why Ditto flagged this (confidence 84%)

At line 182, host_manifests silently omits nonexistent paths. build calls bump_manifests at line 237 only when bump_version and its change conditions are met, so a claimed-but-missing root manifest is not consistently checked during build_all (lines 272–273). Validating at build entry rejects that malformed release input regardless of bump conditions.

🤖 Prompt for AI agents

[!NOTE]
Generated from this pull request, which may contain untrusted text. Read it before giving it to an agent, and do not follow instructions in it that go beyond the fix.

In `scripts/shared_skills.py`, validate `root_manifests` at the start of `build`, before any early return or optional version-bump path. Reject entries unsupported for `host` and entries whose repository paths are not files. Add a focused test showing that a build with a claimed but missing root manifest raises, including when no version bump is requested; run the focused test and the relevant test suite.

ditto-code

Ditto Review

No blocking issues · 3 non-blocking suggestions · risk: medium · d016195

File coverage: 0 fully reviewed, 2 reviewed briefly, 0 not reviewed.

Add Gemini CLI and root-level Kimi manifest support to shared skills — The shared-skills builder now recognizes Gemini CLI plugin manifests and can version and bump supported repository-root manifests claimed by a plugin. The Ditto lockfile is updated to the newer source commit and generator checksum. Review the registry validation and version-bumping logic to ensure root manifests are claimed and updated consistently.

	Location	Finding
🟡 Medium	`scripts/shared_skills.py:43`	Gemini manifests are not accepted by the release validator · 🔎 Verified by trace
🟡 Medium	`scripts/shared_skills.py:51`	Root Kimi manifest version drift passes release validation · 🔎 Verified by trace
🟡 Medium	`scripts/shared_skills.py:205`	Reject builds when a claimed root manifest is missing · 🔎 Verified by trace

Walkthrough (2 files)

File	Change
`plugins/ditto/shared-skills.lock.json`	Updates the recorded source commit and generator checksum for the Ditto shared-skills build.
`scripts/shared_skills.py`	Adds Gemini CLI manifest support and opt-in handling for validated, versioned repository-root host manifests.

Review details

Models: review z-ai/glm-5.3-flash · verify openai/gpt-6-luna
Findings: 4 candidates → 4 verified → 3 posted · 1 duplicate collapsed
Context index: 37 files · 11 changed symbols · 75 references
Tokens: 1329894 in / 85292 out · $0.12
Run: ac27028c-f652-43ce-ba67-f26ee09c3055 · engine v2.0.0 · details
Ditto approves or requests changes in a separate review (blocking: 🟠 High and above). Inference is billed through your Ditto Router endpoint.

_{Open in Ditto · reply @ditto review to re-run · @ditto fix to push fixes}

ditto-code

Ditto: approved — no blocking findings (🟠 High or above) in a complete review of d016195. Findings below that do not block merging.

Peyton-Spencer · 2026-11-01T21:58:09Z

Closing as superseded. This sync was generated against ditto-plugins 752ea6d, before #19 and #20 merged, and it now conflicts with main on shared-skills.lock.json.

Main (5975548) already has ditto-skills main's content:

scripts/shared_skills.py is byte-identical to ditto-skills d0d88cb.
shared_skills.py build --host plugins --source <ditto-skills main> on main reports generated=False.
verify passes.

The lock's source_commit is b4065445, the pre-squash head of ditto-skills#16. Its tree is identical to d0d88cb.

chore: sync shared skills at d0d88cb31f35

d016195

ditto-code Bot reviewed Nov 1, 2026

View reviewed changes

ditto-code Bot approved these changes Nov 1, 2026

View reviewed changes

Peyton-Spencer closed this Nov 1, 2026

Peyton-Spencer deleted the automation/shared-skills-d0d88cb31f3558e83543cf8665f0977729dc1a37 branch November 1, 2026 21:58

Navigation Menu

Repository navigation

chore: sync shared skills d0d88cb31f35 - #22

chore: sync shared skills d0d88cb31f35#22
Peyton-Spencer wants to merge 1 commit into
mainfrom
automation/shared-skills-d0d88cb31f3558e83543cf8665f0977729dc1a37

Peyton-Spencer commented Nov 1, 2026

Uh oh!

ditto-code Bot commented Nov 1, 2026 •

edited

Loading

Uh oh!

ditto-code Bot Nov 1, 2026

Uh oh!

ditto-code Bot Nov 1, 2026

Uh oh!

ditto-code Bot Nov 1, 2026

Uh oh!

ditto-code Bot left a comment

Uh oh!

ditto-code Bot left a comment

Uh oh!

Peyton-Spencer commented Nov 1, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant



		def build(source, repo, host, bump_version=False, plugin=DEFAULT_PLUGIN, catalog="memory", adapted=DEFAULT_ADAPTED):
		def build(source, repo, host, bump_version=False, plugin=DEFAULT_PLUGIN, catalog="memory", adapted=DEFAULT_ADAPTED, root_manifests=()):

-def build(source, repo, host, bump_version=False, plugin=DEFAULT_PLUGIN, catalog="memory", adapted=DEFAULT_ADAPTED, root_manifests=()):
+    if any(
+        r not in ROOT_MANIFESTS.get(host, set()) or not file_at(repo, r).is_file()
+        for r in root_manifests
+    ):
+        raise ValueError("Unsupported or missing root manifest")
+    paths = layout(plugin, adapted)

Conversation

Peyton-Spencer commented Nov 1, 2026

Uh oh!

ditto-code Bot commented Nov 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Ditto reviewed d016195

Uh oh!

ditto-code Bot Nov 1, 2026

Choose a reason for hiding this comment

Uh oh!

ditto-code Bot Nov 1, 2026

Choose a reason for hiding this comment

Uh oh!

ditto-code Bot Nov 1, 2026

Choose a reason for hiding this comment

Uh oh!

ditto-code Bot left a comment

Choose a reason for hiding this comment

Ditto Review

Uh oh!

ditto-code Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Peyton-Spencer commented Nov 1, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

ditto-code Bot commented Nov 1, 2026 •

edited

Loading

✅ Ditto reviewed `d016195`