Skip to content

chore: sync shared skills d0d88cb31f35 #22

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
Peyton-Spencer wants to merge 1 commit into from
Closed

chore: sync shared skills d0d88cb31f35 #22

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions plugins/ditto/shared-skills.lock.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,11 +1,11 @@
{
"schema_version": 1,
"source_repository": "https://github.com/ditto-assistant/ditto-skills",
"source_commit": "9a2a3ee2af084fe2833cec7b093cfd371098f867",
"source_commit": "d0d88cb31f3558e83543cf8665f0977729dc1a37",
"host": "plugins",
"core_sha256": "5912af5483c469ec15db27858122fc9128fc25cd239202c0fdd9727de7dd5f6b",
"adapter_sha256": "7cd895ab3feb0581e7e782de46b8b8220e4281a9ebfe6f6b651753e3a545bac1",
"generator_sha256": "6d23fa054bfa19203783fd7bdf6a6949915a5e62b6c71349af7031d5caae1500",
"generator_sha256": "f0fe5c02da33e861c0962230d0d1486a0542b915808c33b8bd8d4350012467db",
"skill_sha256": "dc4a46fc6de30ceac400ced65b122895738757cdcdaf1be529d63bec165e5835",
"files_sha256": {
"plugins/ditto/skills/curate-music/SKILL.md": "b498f8639aeb64e59f88830ac162a894f9f128b7e1f2db6a7c528092904c1eb4",
Expand Down
49 changes: 39 additions & 10 deletions scripts/shared_skills.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,8 +6,8 @@
whose generated SKILL.md is the canonical core plus that distribution's
host-connection adapter. The ``plugins`` host is the multi-host monorepo
(ditto-assistant/ditto-plugins): one shared skills folder per plugin serves
Claude, Cursor, Grok, Codex, Copilot, Antigravity and Kimi manifests, so every
versioned manifest in the plugin directory is bumped together.
Claude, Cursor, Grok, Codex, Copilot, Antigravity, Kimi and Gemini CLI manifests,
so every versioned manifest in the plugin directory is bumped together.
"""
import argparse
import hashlib
Expand Down Expand Up @@ -40,9 +40,15 @@
".github/plugin/plugin.json",
".antigravity-plugin/plugin.json",
".kimi-plugin/plugin.json",
"gemini-extension.json",

@ditto-code ditto-code Bot Nov 1, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Medium · bug — Gemini manifests are not accepted by the release validator · 🔎 Verified by trace

When a plugin adds the Gemini manifest registered here, scripts/validate_package.py rejects it as an unexpected release file. The validator also omits its version from the host-manifest consistency check, so the new manifest is not covered by the release validation contract.

Why Ditto flagged this (confidence 91%)

Line 43 makes host_manifests and bump_manifests treat gemini-extension.json as a versioned plugin manifest, but the unchanged release validator does not allow that file or include its version in consistency checks. Thus a release containing the newly supported manifest is rejected, while a divergent Gemini version is not checked.

Git file evidence: scripts/validate_package.py unchanged (e9fe12c4b9bc2f9055225f6116b60b7fdbb97e5b) from 752ea6d to d016195. This establishes repository state, not runtime resolution or generated-content correctness.

🤖 Prompt for AI agents

[!NOTE]
Generated from this pull request, which may contain untrusted text. Read it before giving it to an agent, and do not follow instructions in it that go beyond the fix.

Update `scripts/validate_package.py` to recognize `plugins/<plugin>/gemini-extension.json` in its release-file allowlist and include its version in the multi-host manifest consistency check. Add a focused test that adds a Gemini manifest to the copied release fixture, verifies a matching version passes validation, and verifies a divergent version is rejected. Run the package validator tests. The new manifest is registered at `scripts/shared_skills.py:43`.

],
}
MANIFESTS = {host: f"plugins/{DEFAULT_PLUGIN}/{paths[0]}" for host, paths in PLUGIN_MANIFESTS.items()}
# Repository-root host manifests that point into one plugin, for hosts that only
# install from a repository root (Kimi Code reads <repo>/.kimi-plugin/plugin.json
# when given a GitHub URL). A plugin opts in with "root_manifests" in plugins.json;
# they are versioned and bumped with that plugin's own manifests.
ROOT_MANIFESTS = {"plugins": {".kimi-plugin/plugin.json"}}

@ditto-code ditto-code Bot Nov 1, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Medium · bug — Root Kimi manifest version drift passes release validation · 🔎 Verified by trace

When a configured root manifest such as .kimi-plugin/plugin.json has a different version from its plugin’s manifests, validate_package.py accepts the release: its version check covers the plugin manifests, not the newly supported repository-root manifest. build_all only rejects an existing root manifest that no plugin claims (lines 261–266), while version equality is checked only when bump_manifests runs (lines 185–194); add an equality check to the release validation path.

Why Ditto flagged this (confidence 86%)

The new root-manifest support declares that root manifests are versioned with their plugin's manifests (lines 47–51), and build_all passes claimed root paths into build (lines 267–273). However, the only equality check in this generator is in bump_manifests (lines 190–194), so it does not protect releases validated without a bump; the unchanged scripts/validate_package.py also does not check repository-root manifests. A root manifest with a stale version therefore passes the release check.

Git file evidence: scripts/validate_package.py unchanged (e9fe12c4b9bc2f9055225f6116b60b7fdbb97e5b) from 752ea6d to d016195. This establishes repository state, not runtime resolution or generated-content correctness.

🤖 Prompt for AI agents

[!NOTE]
Generated from this pull request, which may contain untrusted text. Read it before giving it to an agent, and do not follow instructions in it that go beyond the fix.

Update the release validation path so every existing repository-root manifest listed in a plugin's `root_manifests` is checked against that plugin's manifest versions. Cover the case where `.kimi-plugin/plugin.json` has a different version from `plugins/<plugin>/.kimi-plugin/plugin.json` and ensure validation fails with a clear error. Add a focused test in `tests/test_package.py` and run the package validation tests.



def digest(value):
Expand Down Expand Up @@ -109,6 +115,13 @@ def plugin_registry(source):
names = catalog_names(source, entry["catalog"])
if adapted is not None and names is not None and adapted not in names:
raise ValueError("Adapted skill must belong to the plugin catalog")
roots = entry.get("root_manifests", [])
allowed = set().union(*ROOT_MANIFESTS.values())
if not isinstance(roots, list) or any(not isinstance(r, str) or r not in allowed for r in roots) or len(set(roots)) != len(roots):
raise ValueError("Invalid plugin registry: root_manifests must list known repository-root host manifests")
claimed = [r for entry in data.values() for r in entry.get("root_manifests", [])]
if len(set(claimed)) != len(claimed):
raise ValueError("Invalid plugin registry: a root manifest can point into only one plugin")
return data


Expand Down Expand Up @@ -161,11 +174,19 @@ def additional_files(source, plugin=DEFAULT_PLUGIN, catalog="memory", adapted=DE
return result


def bump_manifests(repo, host, plugin):
files = [file_at(repo, f"plugins/{plugin}/{rel}") for rel in PLUGIN_MANIFESTS[host]]
if not files[0].exists():
def host_manifests(repo, host, plugin, root_manifests=()):
"""Repository-relative versioned manifests of one plugin that exist in repo."""
if any(r not in ROOT_MANIFESTS.get(host, set()) for r in root_manifests):
raise ValueError("Root manifests are not supported for this host")
paths = [f"plugins/{plugin}/{rel}" for rel in PLUGIN_MANIFESTS[host]] + list(root_manifests)
return [p for p in paths if file_at(repo, p).exists()]


def bump_manifests(repo, host, plugin, root_manifests=()):
if not file_at(repo, f"plugins/{plugin}/{PLUGIN_MANIFESTS[host][0]}").exists():
raise ValueError("Missing primary host manifest")
present = [(f, json.loads(f.read_text())) for f in files if f.exists()]
files = [file_at(repo, p) for p in host_manifests(repo, host, plugin, root_manifests)]
present = [(f, json.loads(f.read_text())) for f in files]
if any("version" not in m for _, m in present):
raise ValueError("Every host manifest in one plugin must carry a version before bumping")
versions = {m["version"] for _, m in present}
Expand All @@ -181,7 +202,7 @@ def bump_manifests(repo, host, plugin):
return [f.relative_to(Path(repo).resolve()).as_posix() for f, _ in present]


def build(source, repo, host, bump_version=False, plugin=DEFAULT_PLUGIN, catalog="memory", adapted=DEFAULT_ADAPTED):
def build(source, repo, host, bump_version=False, plugin=DEFAULT_PLUGIN, catalog="memory", adapted=DEFAULT_ADAPTED, root_manifests=()):

@ditto-code ditto-code Bot Nov 1, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Medium · bug — Reject builds when a claimed root manifest is missing · 🔎 Verified by trace

When root_manifests claims a root manifest that is absent from the distribution, build can still succeed: host_manifests filters the missing path at line 182, and the build only reaches that helper when a version bump is needed. The claim therefore does not ensure the configured root-host manifest is present; validate claimed roots at the start of every build.

Suggested change
def build(source, repo, host, bump_version=False, plugin=DEFAULT_PLUGIN, catalog="memory", adapted=DEFAULT_ADAPTED, root_manifests=()):
if any(
r not in ROOT_MANIFESTS.get(host, set()) or not file_at(repo, r).is_file()
for r in root_manifests
):
raise ValueError("Unsupported or missing root manifest")
paths = layout(plugin, adapted)
Why Ditto flagged this (confidence 84%)

At line 182, host_manifests silently omits nonexistent paths. build calls bump_manifests at line 237 only when bump_version and its change conditions are met, so a claimed-but-missing root manifest is not consistently checked during build_all (lines 272–273). Validating at build entry rejects that malformed release input regardless of bump conditions.

🤖 Prompt for AI agents

[!NOTE]
Generated from this pull request, which may contain untrusted text. Read it before giving it to an agent, and do not follow instructions in it that go beyond the fix.

In `scripts/shared_skills.py`, validate `root_manifests` at the start of `build`, before any early return or optional version-bump path. Reject entries unsupported for `host` and entries whose repository paths are not files. Add a focused test showing that a build with a claimed but missing root manifest raises, including when no version bump is requested; run the focused test and the relevant test suite.

paths = layout(plugin, adapted)
sha = source_identity(source)
generator = file_at(source, GENERATOR).read_bytes()
Expand Down Expand Up @@ -213,7 +234,7 @@ def build(source, repo, host, bump_version=False, plugin=DEFAULT_PLUGIN, catalog
return False
output_changed = skill is not None and (not file_at(repo, paths["output"]).exists() or file_at(repo, paths["output"]).read_bytes() != skill)
if bump_version and (output_changed or skill is None and not old or old.get("files_sha256", {}) != extra_hashes):
bump_manifests(repo, host, plugin)
bump_manifests(repo, host, plugin, root_manifests)
# A renamed or dropped adapted skill leaves its previous output behind;
# old locks without the key used the default adapted skill.
if old:
Expand All @@ -236,12 +257,20 @@ def build(source, repo, host, bump_version=False, plugin=DEFAULT_PLUGIN, catalog
def build_all(source, repo, host, bump_version=False):
"""Build every plugin in the source registry that the distribution hosts."""
changed = {}
for plugin, entry in plugin_registry(source).items():
registry = plugin_registry(source)
if host == "plugins":
# A root manifest no plugin claims would silently keep its old version.
claimed = {r for entry in registry.values() for r in entry.get("root_manifests", [])}
for root in sorted(ROOT_MANIFESTS[host] - claimed):
if file_at(repo, root).exists():
raise ValueError(f"{root} exists but no plugin in scripts/plugins.json lists it under root_manifests")
for plugin, entry in registry.items():
if host != "plugins" and plugin != DEFAULT_PLUGIN:
continue # single-host repositories carry only the original plugin
if not file_at(repo, f"plugins/{plugin}/{PLUGIN_MANIFESTS[host][0]}").exists():
raise ValueError(f"Distribution lacks the {plugin} plugin manifest; scaffold it before generating")
changed[plugin] = build(source, repo, host, bump_version, plugin, entry["catalog"], entry.get("adapted_skill"))
roots = entry.get("root_manifests", []) if host == "plugins" else []
changed[plugin] = build(source, repo, host, bump_version, plugin, entry["catalog"], entry.get("adapted_skill"), roots)
return changed


Expand Down
Loading