release-skill 0.1.7 → 0.1.8

package/src/commands/assess.mjs

@@ -128,7 +128,8 @@ function identifyTopology(config) {
   const hasNpm = uniqueDistTypes.includes('npm');
   const hasPlugin =
     uniqueDistTypes.includes('claude-plugin') ||
-    uniqueDistTypes.includes('codex-plugin');
+    uniqueDistTypes.includes('codex-plugin') ||
+    uniqueDistTypes.includes('kimi-plugin');
 
   if (units.length === 0) {
     type = 'no-release-units';
@@ -379,6 +380,54 @@ async function checkPluginManifests(root, config) {
         }
       }
     }
+
+    if (distributionTypes.has('kimi-plugin')) {
+      const manifestPath = resolve(unitRoot, '.kimi-plugin', 'plugin.json');
+      const displayPath = unitFile(unit, '.kimi-plugin/plugin.json');
+      const exists = await fileExists(manifestPath);
+      if (!exists) {
+        gaps.push(
+          createGap({
+            scope: GapScope.PROFILE,
+            category: GapCategory.MANIFEST,
+            severity: Severity.ERROR,
+            code: 'KIMI_MANIFEST_MISSING',
+            message: `发布单元 "${unit.id}" 缺少 .kimi-plugin/plugin.json 插件清单`,
+            file: displayPath,
+          }),
+        );
+      } else {
+        try {
+          const content = await readFile(manifestPath, 'utf8');
+          const manifest = JSON.parse(content);
+          const requiredFields = ['name', 'version', 'description'];
+          const missingFields = requiredFields.filter((f) => !(f in manifest));
+          if (missingFields.length > 0) {
+            gaps.push(
+              createGap({
+                scope: GapScope.PROFILE,
+                category: GapCategory.MANIFEST,
+                severity: Severity.ERROR,
+                code: 'KIMI_MANIFEST_INCOMPLETE',
+                message: `Kimi 插件清单缺少必填字段: ${missingFields.join(', ')}`,
+                file: displayPath,
+              }),
+            );
+          }
+        } catch {
+          gaps.push(
+            createGap({
+              scope: GapScope.PROFILE,
+              category: GapCategory.MANIFEST,
+              severity: Severity.ERROR,
+              code: 'KIMI_MANIFEST_INVALID',
+              message: '.kimi-plugin/plugin.json 解析失败',
+              file: displayPath,
+            }),
+          );
+        }
+      }
+    }
   }
 
   return gaps;

package/src/commands/prepare.mjs

@@ -966,6 +966,35 @@ function buildExternalActions(unitResults, resolvedVersions, productionAssets) {
           status: 'PENDING',
         });
       }
+      const kimiDist = (unit.distributions ?? []).find((d) => d.type === 'kimi-plugin');
+      if (kimiDist) {
+        const identity = marketplaceIdentity(kimiDist);
+        const kimiTimeoutMs = Number.isInteger(kimiDist.timeoutMs) ? kimiDist.timeoutMs : 300000;
+        // Kimi Code has no non-interactive install/marketplace API, so the kimi
+        // action carries no marketplace identity (MINOR-1). plugin + entrySkill
+        // are the meaningful identity fields.
+        actions.push({
+          id: `kimi-marketplace-install-${unit.id}`,
+          type: 'kimi-marketplace-install',
+          adapter: 'plugin-marketplace',
+          unitId: unit.id,
+          parameters: {
+            consumer: 'kimi',
+            plugin: identity.plugin,
+            repo: unit.publicRepo,
+            version,
+            entrySkill: identity.entrySkill,
+            timeoutMs: kimiTimeoutMs,
+          },
+          expected: {
+            installed: true,
+            plugin: identity.plugin,
+            version,
+            entrySkill: identity.entrySkill,
+          },
+          status: 'PENDING',
+        });
+      }
     }
     return actions;
   }
@@ -1180,6 +1209,42 @@ function buildExternalActions(unitResults, resolvedVersions, productionAssets) {
         status: 'PENDING',
       });
     }
+    const kimiDist = (unit.distributions ?? []).find((d) => d.type === 'kimi-plugin');
+    if (kimiDist) {
+      const identity = marketplaceIdentity(kimiDist);
+      const kimiTimeoutMs = Number.isInteger(kimiDist.timeoutMs) ? kimiDist.timeoutMs : 300000;
+      // No marketplace identity for kimi (MINOR-1): Kimi Code has an interactive
+      // marketplace but no non-interactive install API.
+      actions.push({
+        id: `kimi-marketplace-install-${unit.id}`,
+        type: 'kimi-marketplace-install',
+        adapter: 'plugin-marketplace',
+        unitId: unit.id,
+        parameters: {
+          consumer: 'kimi',
+          plugin: identity.plugin,
+          repo: unit.publicRepo,
+          ref: resolvedTag,
+          version: unitVersion,
+          entrySkill: identity.entrySkill,
+          snapshotPath: asset.snapshotPath,
+          manifestDigest: asset.manifestDigest,
+          timeoutMs: kimiTimeoutMs,
+        },
+        expected: {
+          installed: true,
+          consumer: 'kimi',
+          plugin: identity.plugin,
+          repo: unit.publicRepo,
+          version: unitVersion,
+          ref: resolvedTag,
+          entrySkill: identity.entrySkill,
+          entrySkillFound: true,
+          manifestDigest: asset.manifestDigest,
+        },
+        status: 'PENDING',
+      });
+    }
   }
 
   return actions;

package/src/commands/publish.mjs

@@ -81,6 +81,7 @@ const CHECKPOINT_ORDER = [
   'github-release',
   'claude-marketplace-install',
   'codex-marketplace-install',
+  'kimi-marketplace-install',
 ];
 
 /**
@@ -99,11 +100,13 @@ const ADAPTER_ACTION_TYPE_MAP = {
   'github-release': 'github-release',
   'claude-marketplace-install': 'claude-marketplace-install',
   'codex-marketplace-install': 'codex-marketplace-install',
+  'kimi-marketplace-install': 'kimi-marketplace-install',
 };
 
 const MARKETPLACE_TYPES = new Set([
   'claude-marketplace-install',
   'codex-marketplace-install',
+  'kimi-marketplace-install',
 ]);
 
 // ---------------------------------------------------------------------------

package/src/commands/reconcile.mjs

@@ -77,6 +77,7 @@ const CHECKPOINT_ORDER = [
   'github-release',
   'claude-marketplace-install',
   'codex-marketplace-install',
+  'kimi-marketplace-install',
 ];
 
 /**
@@ -92,6 +93,7 @@ const ADAPTER_ACTION_TYPE_MAP = {
   'github-release': 'github-release',
   'claude-marketplace-install': 'claude-marketplace-install',
   'codex-marketplace-install': 'codex-marketplace-install',
+  'kimi-marketplace-install': 'kimi-marketplace-install',
 };
 
 /**
@@ -102,6 +104,7 @@ const ADAPTER_ACTION_TYPE_MAP = {
 const MARKETPLACE_TYPES = new Set([
   'claude-marketplace-install',
   'codex-marketplace-install',
+  'kimi-marketplace-install',
 ]);
 
 // ---------------------------------------------------------------------------

package/src/commands/setup.mjs

@@ -33,7 +33,7 @@ import { readTrustedPackageResource } from '../core/trusted-resource.mjs';
 
 const execFile = promisify(execFileCb);
 const SKIP_DIRS = new Set([
-  '.git', '.release-skill', '.worktrees', '.claude', '.codex', '.cache', '.tmp',
+  '.git', '.release-skill', '.worktrees', '.claude', '.codex', '.kimi', '.cache', '.tmp',
   '.pytest_cache', '.mypy_cache', '.ruff_cache', '.tox', '.venv', 'venv',
   'node_modules', 'dist', 'coverage', 'build', 'out', 'tmp', 'temp',
   'runs', 'test', 'tests', 'test-fixtures', 'fixtures', 'examples',
@@ -88,6 +88,7 @@ async function walkDiscoveryFiles(root, maxDepth = 8) {
           /^CHANGELOG(?:\.|$)/i.test(child.name) ||
           absolute.endsWith('/.claude-plugin/plugin.json') ||
           absolute.endsWith('/.codex-plugin/plugin.json') ||
+          absolute.endsWith('/.kimi-plugin/plugin.json') ||
           absolute.endsWith('/.claude-plugin/marketplace.json') ||
           absolute.endsWith('/.codex-plugin/marketplace.json'))
       ) {
@@ -422,7 +423,7 @@ async function discoverFacts(root) {
   const files = await walkDiscoveryFiles(root);
   const packageFiles = files.filter((path) => (
     basename(path) === 'package.json' &&
-    !/[\\/]adapters[\\/](?:claude|codex)[\\/]package\.json$/.test(path)
+    !/[\\/]adapters[\\/](?:claude|codex|kimi)[\\/]package\.json$/.test(path)
   ));
   const pluginFiles = files.filter((path) => path.endsWith('/plugin.json'));
   const marketplaceFiles = files.filter((path) => path.endsWith('/marketplace.json'));
@@ -458,7 +459,9 @@ async function discoverFacts(root) {
     const value = await readJsonBounded(path, 'discovered plugin manifest');
     manifests.push({
       path: safeRelative(root, path),
-      host: path.includes('/.claude-plugin/') ? 'claude' : 'codex',
+      host: path.includes('/.claude-plugin/') ? 'claude'
+        : path.includes('/.kimi-plugin/') ? 'kimi'
+          : 'codex',
       kind: path.endsWith('/marketplace.json') ? 'marketplace' : 'plugin',
       name: typeof value.name === 'string' ? value.name : null,
       version: typeof value.version === 'string' ? value.version : null,
@@ -483,7 +486,8 @@ async function discoverFacts(root) {
         name: skillIndex >= 0 ? segments[skillIndex + 1] ?? null : null,
         host: relPath.includes('/adapters/claude/') ? 'claude'
           : relPath.includes('/adapters/codex/') ? 'codex'
-            : 'shared',
+            : relPath.includes('/adapters/kimi/') ? 'kimi'
+              : 'shared',
       };
     })
     .filter((item) => item.name)
@@ -651,7 +655,7 @@ function buildCandidates(facts) {
   const ids = new Set();
   const knownFiles = new Set(facts.fileDigests.map((file) => file.path));
   const manifestRoots = facts.manifests.map((manifest) => {
-    const match = manifest.path.match(/^(.*?)(?:\/)?(?:\.claude-plugin|\.codex-plugin)\/(?:plugin|marketplace)\.json$/);
+    const match = manifest.path.match(/^(.*?)(?:\/)?(?:\.claude-plugin|\.codex-plugin|\.kimi-plugin)\/(?:plugin|marketplace)\.json$/);
     return { ...manifest, root: match?.[1] || '.' };
   });
   const manifestOwners = new Map();
@@ -698,6 +702,7 @@ function buildCandidates(facts) {
     ) distributions.push('npm');
     if (pluginHosts.includes('claude')) distributions.push('claude-plugin');
     if (pluginHosts.includes('codex')) distributions.push('codex-plugin');
+    if (pluginHosts.includes('kimi')) distributions.push('kimi-plugin');
     if (pkg.private && matchingLegacyUnits.length === 0 && facts.legacyReleaseConfigs.length > 0) continue;
     if (pkg.private && distributions.length === 0) continue;
 

package/src/commands/verify.mjs

@@ -68,6 +68,7 @@ const ADAPTER_ACTION_TYPE_MAP = {
   'github-release': 'github-release',
   'claude-marketplace-install': 'claude-marketplace-install',
   'codex-marketplace-install': 'codex-marketplace-install',
+  'kimi-marketplace-install': 'kimi-marketplace-install',
 };
 
 // ---------------------------------------------------------------------------
@@ -706,7 +707,8 @@ export async function verifyRelease(options) {
     // =======================================================================
     // Step 3: Verify all actions via adapters
     //
-    // Marketplace actions (claude-marketplace-install, codex-marketplace-install)
+    // Marketplace actions (claude-marketplace-install, codex-marketplace-install,
+    // kimi-marketplace-install)
     // are verified as fresh, isolated consumer installs in verify's own runDir.
     // This ensures verify does not read the publish run's consumer install
     // directories or evidence.
@@ -721,6 +723,7 @@ export async function verifyRelease(options) {
     const MARKETPLACE_TYPES = new Set([
       'claude-marketplace-install',
       'codex-marketplace-install',
+      'kimi-marketplace-install',
     ]);
 
     for (const action of actions) {
@@ -831,7 +834,9 @@ export async function verifyRelease(options) {
 
         const distribution = action.type === 'claude-marketplace-install'
           ? 'claude-plugin'
-          : 'codex-plugin';
+          : action.type === 'codex-marketplace-install'
+            ? 'codex-plugin'
+            : 'kimi-plugin';
         const installPath = verifyResult.observation?.installPath;
         consumerGateResults.push(...await runConsumerVerificationGates({
           plan,
@@ -845,10 +850,15 @@ export async function verifyRelease(options) {
                 HOME: resolve(runDir, 'consumers', `claude-${action.parameters.plugin}`),
                 CLAUDE_CONFIG_DIR: resolve(runDir, 'consumers', `claude-${action.parameters.plugin}`, '.claude'),
               }
-            : {
-                HOME: resolve(runDir, 'consumers', `codex-${action.parameters.plugin}`),
-                CODEX_HOME: resolve(runDir, 'consumers', `codex-${action.parameters.plugin}`),
-              },
+            : action.type === 'codex-marketplace-install'
+              ? {
+                  HOME: resolve(runDir, 'consumers', `codex-${action.parameters.plugin}`),
+                  CODEX_HOME: resolve(runDir, 'consumers', `codex-${action.parameters.plugin}`),
+                }
+              : {
+                  HOME: resolve(runDir, 'consumers', `kimi-${action.parameters.plugin}`),
+                  KIMI_CODE_HOME: resolve(runDir, 'consumers', `kimi-${action.parameters.plugin}`),
+                },
         }));
       } else {
         // --- Non-marketplace: read-only adapter.verify() ---

package/src/core/plan.mjs

@@ -285,6 +285,7 @@ const EXPECTED_ADAPTER = {
   'npm-publish': 'npm',
   'claude-marketplace-install': 'plugin-marketplace',
   'codex-marketplace-install': 'plugin-marketplace',
+  'kimi-marketplace-install': 'plugin-marketplace',
   'set-default-branch': 'git-github',
 };
 
@@ -301,6 +302,7 @@ const REQUIRED_ACTION_TYPES = ['push-snapshot', 'create-tag', 'github-release'];
  * - 1 npm-publish    (adapter: npm) — only if the unit has an npm distribution
  * - 1 claude-marketplace-install (adapter: plugin-marketplace) — only if the unit has a claude-plugin distribution
  * - 1 codex-marketplace-install  (adapter: plugin-marketplace) — only if the unit has a codex-plugin distribution
+ * - 1 kimi-marketplace-install   (adapter: plugin-marketplace) — only if the unit has a kimi-plugin distribution
  *
  * Every action must bind to the correct unitId, correct adapter, correct
  * version, correct publicRepo (where applicable), and correct tag derived
@@ -821,6 +823,122 @@ export function validatePlanActionCompleteness(plan, options = {}) {
       }
     }
 
+    // kimi-marketplace-install: only required if unit has kimi-plugin distribution
+    const kimiDist = distributions.find((d) => d.type === 'kimi-plugin');
+    if (kimiDist) {
+      const plugin = kimiDist.plugin;
+      // marketplace is NOT a required identity field for kimi: Kimi Code has an
+      // interactive marketplace but no non-interactive install API, so the kimi
+      // action carries no executable marketplace identity (MINOR-1). Only plugin
+      // and entrySkill are required; a declared marketplace is tolerated as an
+      // optional legacy value but never bound as a required condition.
+      const marketplace = kimiDist.marketplace;
+      const entrySkill = kimiDist.entrySkill;
+      if (!plugin || !entrySkill) {
+        failures.push(`unit "${unitId}": kimi-plugin distribution requires plugin and entrySkill`);
+      }
+      expectedCount++;
+      const expectedActionId = `kimi-marketplace-install-${unitId}`;
+      const kimiActions = actions.filter(
+        (a) => a.unitId === unitId && a.type === 'kimi-marketplace-install',
+      );
+
+      if (kimiActions.length === 0) {
+        failures.push(
+          `unit "${unitId}": kimi-plugin distribution declared but "kimi-marketplace-install" action is missing`,
+        );
+      } else if (kimiActions.length > 1) {
+        failures.push(
+          `unit "${unitId}": duplicate kimi-marketplace-install actions (${kimiActions.length} found, expected 1)`,
+        );
+      } else {
+        const action = kimiActions[0];
+
+        if (action.id !== expectedActionId) {
+          failures.push(
+            `unit "${unitId}", action "${action.id}": id is "${action.id}", expected "${expectedActionId}"`,
+          );
+        }
+        if (action.unitId !== unitId) {
+          failures.push(
+            `unit "${unitId}", action "${action.id}": unitId is "${action.unitId}", expected "${unitId}"`,
+          );
+        }
+        if (action.adapter !== 'plugin-marketplace') {
+          failures.push(
+            `unit "${unitId}", action "${action.id}": adapter is "${action.adapter}", expected "plugin-marketplace"`,
+          );
+        }
+        if (action.status !== 'PENDING') {
+          failures.push(
+            `unit "${unitId}", action "${action.id}": status is "${action.status ?? '(missing)'}", expected "PENDING"`,
+          );
+        }
+
+        // Parameter checks
+        _checkRequired(action, 'parameters.consumer', action.parameters?.consumer, 'kimi', unitId, failures);
+        _checkRequired(action, 'parameters.plugin', action.parameters?.plugin, plugin, unitId, failures);
+        // marketplace is optional for kimi (MINOR-1). If a legacy plan still
+        // carries it, it must be consistent with the declared distribution but
+        // is never a required identity condition.
+        if (action.parameters?.marketplace !== undefined && marketplace !== undefined
+          && action.parameters.marketplace !== marketplace) {
+          failures.push(
+            `unit "${unitId}", action "${action.id}": parameters.marketplace is "${action.parameters.marketplace}", expected optional legacy value "${marketplace}"`,
+          );
+        }
+        _checkRequired(action, 'parameters.repo', action.parameters?.repo, publicRepo, unitId, failures);
+        _checkRequired(action, 'parameters.version', action.parameters?.version, targetVersion, unitId, failures);
+        _checkRequired(action, 'parameters.entrySkill', action.parameters?.entrySkill, entrySkill, unitId, failures);
+        if (production) {
+          _checkRequired(action, 'parameters.snapshotPath', action.parameters?.snapshotPath, frozen?.path, unitId, failures);
+          _checkRequired(action, 'parameters.ref', action.parameters?.ref, expectedTag, unitId, failures);
+          _checkRequired(action, 'parameters.manifestDigest', action.parameters?.manifestDigest, frozen?.manifestDigest, unitId, failures);
+        }
+        // timeoutMs is mandatory for all marketplace install actions.
+        // Legacy plans (pre-v0.1.5) lack this field; legacyCompatibility
+        // relaxes the check for reconcile/verify paths only, and only when
+        // the property is genuinely absent (undefined). An explicit null is
+        // NOT "absent" -- it is an invalid value and always fails closed,
+        // like strings or out-of-range numbers, even in legacyCompatibility.
+        {
+          const raw = action.parameters?.timeoutMs;
+          if (raw === undefined) {
+            if (!options.legacyCompatibility) {
+              failures.push(
+                `unit "${unitId}", action "${action.id}": parameters.timeoutMs is missing, expected a valid timeout (30000-900000)`,
+              );
+            }
+          } else {
+            // Field is present -- always validate range/type, even in legacy mode
+            if (typeof raw !== 'number' || !Number.isFinite(raw) || !Number.isInteger(raw)) {
+              failures.push(
+                `unit "${unitId}", action "${action.id}": parameters.timeoutMs must be a finite integer, got: ${JSON.stringify(raw)}`,
+              );
+            } else if (raw < 30000 || raw > 900000) {
+              failures.push(
+                `unit "${unitId}", action "${action.id}": parameters.timeoutMs must be between 30000 and 900000, got: ${raw}`,
+              );
+            }
+          }
+        }
+
+        // Expected checks. marketplace is NOT part of the kimi expected
+        // identity (MINOR-1): the kimi observation never binds a marketplace.
+        _checkRequired(action, 'expected.installed', action.expected?.installed, true, unitId, failures);
+        _checkRequired(action, 'expected.plugin', action.expected?.plugin, plugin, unitId, failures);
+        _checkRequired(action, 'expected.version', action.expected?.version, targetVersion, unitId, failures);
+        _checkRequired(action, 'expected.entrySkill', action.expected?.entrySkill, entrySkill, unitId, failures);
+        if (production) {
+          _checkRequired(action, 'expected.consumer', action.expected?.consumer, 'kimi', unitId, failures);
+          _checkRequired(action, 'expected.repo', action.expected?.repo, publicRepo, unitId, failures);
+          _checkRequired(action, 'expected.ref', action.expected?.ref, expectedTag, unitId, failures);
+          _checkRequired(action, 'expected.entrySkillFound', action.expected?.entrySkillFound, true, unitId, failures);
+          _checkRequired(action, 'expected.manifestDigest', action.expected?.manifestDigest, frozen?.manifestDigest, unitId, failures);
+        }
+      }
+    }
+
     // set-default-branch: only required when productionConfig.setAsDefaultBranch is true
     if (branchStrategy === 'initialize-default-branch') {
       const oldBranch = productionConfig.expectedCurrentDefaultBranch;

package/src/core/verification-gates.mjs

@@ -57,7 +57,7 @@ function validateGate(gate) {
   if (!gate.scope || typeof gate.scope.unit !== 'string') {
     throw gateError(gate, 'must declare scope.unit');
   }
-  if (gate.phase === 'consumer-verify' && !['npm', 'claude-plugin', 'codex-plugin'].includes(gate.scope.distribution)) {
+  if (gate.phase === 'consumer-verify' && !['npm', 'claude-plugin', 'codex-plugin', 'kimi-plugin'].includes(gate.scope.distribution)) {
     throw gateError(gate, 'consumer-verify must declare a supported scope.distribution');
   }
   if (!Array.isArray(gate.command) || gate.command.length === 0 || gate.command.some((value) => typeof value !== 'string')) {

package/src/producers/build-adapters.mjs

@@ -2,10 +2,10 @@
  * Pure producer: build adapters from skills and plugin templates.
  *
  * Reads skill metadata from skills-src/ and plugin.json templates,
- * generates self-contained adapter directories for each platform (claude, codex).
+ * generates self-contained adapter directories for each platform (claude, codex, kimi).
  *
  * Each adapter root contains:
- * - Plugin manifest (.claude-plugin/ or .codex-plugin/)
+ * - Plugin manifest (.claude-plugin/, .codex-plugin/, or .kimi-plugin/)
  * - Skills with host-specific root resolution
  * - bin/release-skill.mjs (wrapper) + bin/release-skill.bundle.mjs (self-contained bundle)
  * - schemas/ (JSON Schema files)
@@ -205,6 +205,12 @@ const PLATFORMS = [
     templateFileName: 'plugin.json',
     hasMarketplace: false,
   },
+  {
+    name: 'kimi',
+    pluginDirName: '.kimi-plugin',
+    templateFileName: 'plugin.json',
+    hasMarketplace: false,
+  },
 ];
 
 const REQUIRED_SCHEMA_FILES = Object.freeze([
@@ -290,37 +296,61 @@ const CODEX_PREAMBLE = `\
 >\n\
 `;
 
+/**
+ * Preamble prepended to every Kimi Code SKILL.md.
+ *
+ * Kimi Code's official Agent Skills contract defines the body placeholder
+ * `${KIMI_SKILL_DIR}`: the host expands it to the absolute directory containing
+ * the current SKILL.md before sending the body to the agent. This is the ONLY
+ * authoritative input for locating the entry point — the agent must NOT guess
+ * any undocumented host-metadata path. The literal placeholder is emitted
+ * verbatim (the generator does not pre-expand it); the host expands it at load
+ * time. Generated skills live at `<pluginRoot>/skills/<name>/SKILL.md`, so the
+ * plugin root is two levels above the expanded skill directory.
+ */
+const KIMI_PREAMBLE = `\
+> **Kimi Code 安装入口解析协议**：Kimi Code 官方技能契约提供正文占位符 \`\${KIMI_SKILL_DIR}\`，宿主在向 Agent 发送正文前会将其展开为当前 \`SKILL.md\` 所在目录的绝对路径。必须把展开后的字面量作为当前技能目录的唯一权威输入，记为 \`SKILL_DIR\`。\n\
+> 禁止从工作目录、可执行搜索路径、源码仓库、shell 调用上下文或任何未记载的宿主元数据路径猜测技能目录。若正文中的 \`\${KIMI_SKILL_DIR}\` 未被宿主展开（仍是字面量占位符），立即停止并报告安装定位失败。\n\
+> 对 \`SKILL_DIR\` 执行 \`realpath\`，取其目录向上两级得到 \`PLUGIN_ROOT\`；校验真实技能路径匹配 \`PLUGIN_ROOT/skills/*/SKILL.md\` 且仍位于插件根内（路径包含检查）。\n\
+> 令 \`RELEASE_SKILL_ENTRY=PLUGIN_ROOT/bin/release-skill.mjs\`，对入口执行 \`realpath\` containment、\`lstat\` 非符号链接且为普通文件校验。\n\
+> 每一次 shell 工具调用都必须在同一个调用中用上述已验证绝对值设置 \`RELEASE_SKILL_ENTRY\`，然后执行 \`node "$RELEASE_SKILL_ENTRY" ...\`；不得依赖前一次 shell 的变量。\n\
+>\n\
+`;
+
 /**
  * Render SKILL.md content for a specific platform.
  *
  * - Claude: verbatim copy (uses ${CLAUDE_PLUGIN_ROOT})
  * - Codex: replaces the Claude-only path with $RELEASE_SKILL_ENTRY,
  *   and prepends the path resolution protocol preamble.
+ * - Kimi: same substitution as Codex, with the Kimi Code preamble.
  *
  * @param {string} content - Canonical SKILL.md content.
- * @param {string} platformName - 'claude' or 'codex'.
+ * @param {string} platformName - 'claude', 'codex', or 'kimi'.
  * @returns {string}
  */
 function renderSkillForPlatform(content, platformName) {
   if (platformName === 'claude') return content;
 
-  if (platformName === 'codex') {
+  if (platformName === 'codex' || platformName === 'kimi') {
+    const hostLabel = platformName === 'codex' ? 'Codex' : 'Kimi';
+    const preamble = platformName === 'codex' ? CODEX_PREAMBLE : KIMI_PREAMBLE;
     let rendered = content.replaceAll(
       '${CLAUDE_PLUGIN_ROOT}/bin/release-skill.mjs',
       '$RELEASE_SKILL_ENTRY',
     );
-    // A remaining bare host-root reference has no safe Codex equivalent.
+    // A remaining bare host-root reference has no safe path-derived equivalent.
     if (rendered.includes('${CLAUDE_PLUGIN_ROOT}')) {
-      throw new Error('Codex rendering found an unsupported bare CLAUDE_PLUGIN_ROOT reference');
+      throw new Error(`${hostLabel} rendering found an unsupported bare CLAUDE_PLUGIN_ROOT reference`);
     }
     // Preserve YAML frontmatter as the first bytes so the host can discover
     // the skill. Insert the host-specific protocol immediately after it.
     const frontmatterEnd = rendered.indexOf('\n---\n', 4);
     if (!rendered.startsWith('---\n') || frontmatterEnd < 0) {
-      throw new Error('Codex rendering requires a valid leading YAML frontmatter block');
+      throw new Error(`${hostLabel} rendering requires a valid leading YAML frontmatter block`);
     }
     const insertionPoint = frontmatterEnd + '\n---\n'.length;
-    return `${rendered.slice(0, insertionPoint)}\n${CODEX_PREAMBLE}${rendered.slice(insertionPoint)}`;
+    return `${rendered.slice(0, insertionPoint)}\n${preamble}${rendered.slice(insertionPoint)}`;
   }
 
   return content;