release-skill 0.9.30 → 0.9.32

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.9.30",
+  "version": "0.9.32",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/.codebuddy-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.9.30",
+  "version": "0.9.32",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.9.30",
+  "version": "0.9.32",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"
@@ -19,7 +19,7 @@
     ],
     "defaultPrompt": [
       "Assess this project for release readiness.",
-      "Prepare a release plan for version 0.9.30.",
+      "Prepare a release plan for version 0.9.32.",
       "Help me understand the release workflow."
     ]
   }

package/.cursor-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.9.30",
+  "version": "0.9.32",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/.kimi-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.9.30",
+  "version": "0.9.32",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/.qoder-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.9.30",
+  "version": "0.9.32",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/CHANGELOG.md

@@ -1,5 +1,60 @@
 # Changelog
 
+<!-- release-skill:changelog:start version=0.9.32 locale=en baseline=sha256:760080f3cd309b1d75cc9f41fe29c9ac5dc80f228f9946db9e6d0cf303954f42 -->
+## [0.9.32] - 2026-10-17
+
+0.9.32 fixes the adapter failure caused by waiting for a complete title after selection movement in the Kimi 2.2.0 removal menu while retaining exact Foundation 0.25.0 dependencies. This note is not evidence of publication, real-host acceptance, consumer installation verification, or independent acceptance.
+
+### Security
+
+- Maintains strict confirmation boundaries: exact plugin ID and selection must be verified before removal. No changes to frozen install URL/ref/sha or post-install payload validation. Hub gate failure prevents GitHub Git Data API write. Writes bind the observed branch head through `compare-and-swap`. Partial Hub publication is never rolled back or force-pushed; completed steps are not overwritten. Existing `RELEASE_SKILL_HUB_RELEASE_EVIDENCE` environment variable continues to require an existing regular file at an absolute path (not a symlink), validated via `npm run release:check -- --release-evidence <file>`. Independent checkpoint approval, no replay of historical frozen plans, and `ALREADY_CURRENT` gate remain enforced.
+
+### Changed
+
+- Skill Family Hub remains the unified market. GitHub Git Data API integration continues with `compare-and-swap` write semantics; no automatic rollback or overwrite of completed steps.
+
+### Fixed
+
+- Handle Kimi 2.2.0 menu redraws that omit the plugin title and final newline after selection movement. The adapter must re-observe the selection after movement and confirm unique selection of `Remove plugin` before proceeding.
+- Initial exact plugin ID is verified before frame reading. Direction key is sent only after reading the frame, followed by a full incremental frame to confirm unique selection. Full title redraw still validates exact ID. Unknown, ambiguous, un-moved, incomplete frame, timeout, or EOF all stop the update before installation.
+
+### Upgrade Notes
+
+This fix applies to real update workflows, not limited to offline testing. Retain Kimi 0.40.1’s actual prompt `Confirm remove plugin "<id>"?`, bracketed paste, and CSI Enter input method. Frozen install URL/ref/sha, post-install name/version, and payload verification rules unchanged. Shared setup for same `unitId/plugin/version` is merged by unit, plugin, and version; different physical `skillFile` paths in Claude/Codex no longer count as separate setups, as per 0.9.31. Each host’s installation, loading, and configuration must still be verified separately, with feedback bound to `host/unit/path/plan/config/root`. Failure does not alter `VERIFIED`/`DISTRIBUTED` state. `Foundation 0.25.0` exact dependencies remain in use. The old release-skill standalone marketplace is deprecated; use `ifoohoo/skill-family-hub` and `release-skill@skill-family-hub`. Provider upgrades do not republish domain plugins or expand host authorization.
+
+Real Kimi 2.2.0 was observed through exact identity checks, selection movement, and selection verification, then canceled with Esc and exited without removal, installation, or update. All 47 focused tests passed, and independent code review found no issues. Full real-consumer update and loading acceptance remains pending.
+<!-- release-skill:changelog:end version=0.9.32 locale=en -->
+
+
+<!-- release-skill:changelog:start version=0.9.31 locale=en baseline=sha256:d40f153bfc277e24178ac5d32d20a0b6d824cf611d0fa65709cea01463b037ea -->
+## [0.9.31] - 2026-10-17
+
+0.9.31 fixes Kimi removal confirmation and shared setup ownership while retaining exact Foundation 0.25.0 dependencies. This note is not evidence of publication, real-host acceptance, consumer installation verification, or independent acceptance.
+
+### Security
+
+- Maintains strict confirmation boundaries: exact plugin ID and selection must be verified before removal. No changes to frozen install URL/ref/sha or post-install payload validation. Hub gate failure prevents GitHub Git Data API write. Writes bind the observed branch head through `compare-and-swap`. Partial Hub publication is never rolled back or force-pushed; completed steps are not overwritten. Existing `RELEASE_SKILL_HUB_RELEASE_EVIDENCE` environment variable continues to require an existing regular file at an absolute path (not a symlink), validated via `npm run release:check -- --release-evidence <file>`. Independent checkpoint approval, no replay of historical frozen plans, and `ALREADY_CURRENT` gate remain enforced.
+
+### Changed
+
+- Skill Family Hub remains the unified market. GitHub Git Data API integration continues with `compare-and-swap` write semantics; no automatic rollback or overwrite of completed steps.
+
+### Fixed
+
+- Kimi 2.2.0: The remove confirmation page now uses `Remove <displayName> (<id>)?` with `Cancel` and `Remove plugin` options. The adapter verifies the exact plugin ID and current selection. When selection movement is required, move first and re-observe before confirming. No direction key input is needed when `Remove plugin` is already selected. Removal is submitted only while that option is selected.
+- Kimi 2.2.0: Display names containing `Confirm` or `Sure`, or titles arriving in chunks, no longer trigger the old broad regex path. Invalid ID, unknown or ambiguous selection, timeout, or EOF stop the update without proceeding to installation.
+- The adapter retains the existing `Confirm remove plugin "<id>"?` wording, bracketed paste, and CSI Enter input method from Kimi 0.40.1. Frozen install URL/ref/sha, post-install name/version, and payload verification remain unchanged. Offline Expect/fake validation only; no real Kimi consumer installation or update performed.
+- Shared environment setup for the same `unitId/plugin/version` is now merged. Different physical `skillFile` paths under Claude/Codex no longer count as separate setup owners. Only one precise setup feedback from a loaded host is required to satisfy shared environment checks.
+- Host-specific installation, loading, and configuration still require separate verification. Feedback continues to bind `host/unit/path/plan/config/root`. True multiple plugin ownership still requires disambiguation. Failure in any host (Kimi or others) results in `FAILED` status; `VERIFIED`/`DISTRIBUTED` release state is unchanged.
+
+### Upgrade Notes
+
+Existing release plans can continue to be finalized after obtaining the new provider. No need to re-publish plugins from the original domain. Use the existing frozen plan within the explicitly authorized host scope; the provider update does not authorize additional host operations. Host installation, loading, and setup facts must be verified independently. This round’s offline Expect/fake testing does not imply the fix is limited to offline use; the product is intended for real hosts. Real Kimi consumer acceptance has not been performed, and thus cannot be claimed as passed.
+
+The old release-skill standalone marketplace is deprecated; use `ifoohoo/skill-family-hub` and `release-skill@skill-family-hub`.
+<!-- release-skill:changelog:end version=0.9.31 locale=en -->
+
+
 <!-- release-skill:changelog:start version=0.9.30 locale=en baseline=sha256:f96989498b14d998fb38751ca6bd2610255761ebb1618018ec2ca362ebe707a5 -->
 ## [0.9.30] - 2026-10-16
 

package/INSTALL.md

@@ -2,7 +2,7 @@
 
 [简体中文](INSTALL.zh-CN.md)
 
-<!-- release-skill:release-version: 0.9.30 -->
+<!-- release-skill:release-version: 0.9.32 -->
 ## Prerequisites
 
 - Node.js `>=22.22.2 <23` (22.22.2 or newer, and below 23)
@@ -125,7 +125,7 @@ tag pinned to the exact version (never the bare repository URL, which installs
 the latest release or default branch), confirm the trust prompt, then reload:
 
    ```
-   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.9.30
+   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.9.32
    /plugins reload
    ```
 

package/INSTALL.zh-CN.md

@@ -2,7 +2,7 @@
 
 [English](INSTALL.md)
 
-<!-- release-skill:release-version: 0.9.30 -->
+<!-- release-skill:release-version: 0.9.32 -->
 ## 前置条件
 
 - Node.js `>=22.22.2 <23`（22.22.2 及以上，且低于 23）
@@ -113,7 +113,7 @@ release-skill 当前只采用并验证 Kimi Code 的交互式 TUI 路径，**无
 （切勿使用裸仓库地址，它会安装最新 release 或默认分支），确认信任提示后重新加载：
 
    ```
-   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.9.30
+   /plugins install https://github.com/ifoohoo/release-skill/releases/tag/release-skill-v0.9.32
    /plugins reload
    ```
 

package/README.md

@@ -2,7 +2,7 @@
 
 [简体中文](README.zh-CN.md) · Installation: [English](INSTALL.md) / [简体中文](INSTALL.zh-CN.md)
 
-<!-- release-skill:release-version: 0.9.30 -->
+<!-- release-skill:release-version: 0.9.32 -->
 Release preparation for Claude Code, CodeBuddy, WorkBuddy, Codex, and Kimi Code, with human-edited files kept intact.
 
 release-skill helps a maintainer answer three questions: what will be released,
@@ -14,36 +14,32 @@ Setup surfaces only the deterministic `compactSummary` review view; the full
 report stays in a temporary session directory.
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.9.30** (2026-10-16)
+**0.9.32** (2026-10-17)
 
-0.9.30 fixes the private Hub hook's missing release-evidence argument while retaining exact Foundation 0.25.0 dependencies. This note is not evidence of publication, real-host acceptance, consumer installation verification, or independent acceptance.
+0.9.32 fixes the adapter failure caused by waiting for a complete title after selection movement in the Kimi 2.2.0 removal menu while retaining exact Foundation 0.25.0 dependencies. This note is not evidence of publication, real-host acceptance, consumer installation verification, or independent acceptance.
 
 **Security**
 
-- The hook rejects missing or invalid evidence paths before remote access; the authoritative Hub gate validates the original release evidence.
-- Gate failure prevents Git Data API writes. Partial Hub publication is never rolled back or force-pushed, and completed steps are not overwritten. Writes remain bound to the observed branch head through compare-and-swap.
+- Maintains strict confirmation boundaries: exact plugin ID and selection must be verified before removal. No changes to frozen install URL/ref/sha or post-install payload validation. Hub gate failure prevents GitHub Git Data API write. Writes bind the observed branch head through `compare-and-swap`. Partial Hub publication is never rolled back or force-pushed; completed steps are not overwritten. Existing `RELEASE_SKILL_HUB_RELEASE_EVIDENCE` environment variable continues to require an existing regular file at an absolute path (not a symlink), validated via `npm run release:check -- --release-evidence <file>`. Independent checkpoint approval, no replay of historical frozen plans, and `ALREADY_CURRENT` gate remain enforced.
 
 **Changed**
 
-- Skill Family Hub remains the unified market; entries are updated via GitHub Git Data API after post-verify validation.
+- Skill Family Hub remains the unified market. GitHub Git Data API integration continues with `compare-and-swap` write semantics; no automatic rollback or overwrite of completed steps.
 
 **Fixed**
 
-- The private Hub hook forwards the absolute path supplied through `RELEASE_SKILL_HUB_RELEASE_EVIDENCE` to `npm run release:check -- --release-evidence <file>`. The path must name an existing regular file; symbolic links are rejected.
+- Handle Kimi 2.2.0 menu redraws that omit the plugin title and final newline after selection movement. The adapter must re-observe the selection after movement and confirm unique selection of `Remove plugin` before proceeding.
+- Initial exact plugin ID is verified before frame reading. Direction key is sent only after reading the frame, followed by a full incremental frame to confirm unique selection. Full title redraw still validates exact ID. Unknown, ambiguous, un-moved, incomplete frame, timeout, or EOF all stop the update before installation.
 
 **Upgrade Notes**
 
-Before running `postverify`, maintainers set the `RELEASE_SKILL_HUB_RELEASE_EVIDENCE` environment variable to the absolute path of the original Hub evidence descriptor; the existing `envAllowlist` forwards only that key. The descriptor and referenced native records are not copied or rewritten.
+This fix applies to real update workflows, not limited to offline testing. Retain Kimi 0.40.1’s actual prompt `Confirm remove plugin "<id>"?`, bracketed paste, and CSI Enter input method. Frozen install URL/ref/sha, post-install name/version, and payload verification rules unchanged. Shared setup for same `unitId/plugin/version` is merged by unit, plugin, and version; different physical `skillFile` paths in Claude/Codex no longer count as separate setups, as per 0.9.31. Each host’s installation, loading, and configuration must still be verified separately, with feedback bound to `host/unit/path/plan/config/root`. Failure does not alter `VERIFIED`/`DISTRIBUTED` state. `Foundation 0.25.0` exact dependencies remain in use. The old release-skill standalone marketplace is deprecated; use `ifoohoo/skill-family-hub` and `release-skill@skill-family-hub`. Provider upgrades do not republish domain plugins or expand host authorization.
 
-A new plan freezes the corrected hook and still requires independent checkpoint approval. Historical plans, approvals and frozen hooks remain unchanged and are not replayed. `ALREADY_CURRENT` still requires the authoritative Hub gate.
-
-Existing Hub users need no configuration migration. The old release-skill standalone marketplace is deprecated; use `ifoohoo/skill-family-hub` and `release-skill@skill-family-hub`.
-
-This note does not authorize publication or prove real-host business or consumer installation verification. No consumer installation or update is added.
+Real Kimi 2.2.0 was observed through exact identity checks, selection movement, and selection verification, then canceled with Esc and exited without removal, installation, or update. All 47 focused tests passed, and independent code review found no issues. Full real-consumer update and loading acceptance remains pending.
 <!-- release-skill:managed:end id=latest-release -->
 
 <!-- release-skill:capability:external-write-boundary -->
-> **Current boundary:** v0.9.30: this README records capabilities and verification boundaries;
+> **Current boundary:** v0.9.32: this README records capabilities and verification boundaries;
 > it is not evidence of
 > publication, consumer-installation verification, or independent acceptance.
 > Release availability must be established from the corresponding release records
@@ -67,7 +63,7 @@ This note does not authorize publication or prove real-host business or consumer
 > publish global preflight.
 
 <!-- release-skill:capability:safe-first-command -->
-> **Production path verified since the v0.1.1 milestone; for v0.9.30,
+> **Production path verified since the v0.1.1 milestone; for v0.9.32,
 > publication, consumer-installation verification, and independent acceptance
 > require version-specific release records and verification results.**
 > The npm-installed CLI is the supported user entry. Source checkout

package/README.zh-CN.md

@@ -2,42 +2,38 @@
 
 [English](README.md) · 安装指南：[中文](INSTALL.zh-CN.md) / [English](INSTALL.md)
 
-<!-- release-skill:release-version: 0.9.30 -->
+<!-- release-skill:release-version: 0.9.32 -->
 面向 Claude Code、CodeBuddy、WorkBuddy、Codex 和 Kimi Code 的发布准备工具，完整保留人工维护的文件内容。
 
 release-skill 帮助维护者回答三个问题：准备发布什么、还有哪些检查未通过、最终发布的内容是什么。它不重新生成、也不回写项目源文件。`prepare` 把每个配置的公开文件复制到隔离快照并验证字节——先冻结并供人工审阅，再从同一份冻结产物发布。`setup` 只显示确定性的 `compactSummary` 审阅视图，完整报告保留在临时会话目录中。
 
 <!-- release-skill:managed:start id=latest-release -->
-**0.9.30** (2026-10-16)
+**0.9.32** (2026-10-17)
 
-0.9.30 修复项目私有 Hub 钩子漏传发布证据参数的问题，继续使用精确的 Foundation 0.25.0 依赖。本说明不代表已经发布、完成真实宿主验收、完成消费者安装验证或通过独立验收。
+0.9.32 修复 Kimi 2.2.0 移除菜单移动后，适配器因等待完整标题而失败的问题，继续采用精确的 Foundation 0.25.0 依赖。本说明不代表已经发布、完成真实宿主验收、完成消费者安装验证或通过独立验收。
 
 **安全**
 
-- 钩子在访问远端前拒绝缺失或非法的证据路径，证据内容交由 Hub 正式门禁验证。
-- 门禁失败不进行 Git Data API 写入；部分发布不回滚、不覆盖已完成步骤、不自动强推；写入绑定观察到的分支头并比较后写入。
+- 保持严格确认边界：移除前必须精确核对插件ID与选择。冻结的安装URL/ref/sha与安装后载荷验证规则未变。Hub门禁失败将阻止GitHub Git Data API写入。写入采用 `compare-and-swap`，绑定已观察的分支头并比较后写入；部分发布不回滚、不覆盖已完成步骤、不自动强推。现有 `RELEASE_SKILL_HUB_RELEASE_EVIDENCE` 环境变量仍须指定已有普通文件的绝对路径（拒绝符号链接），交由 `npm run release:check -- --release-evidence <file>` 验证。独立检查点批准、历史冻结计划不重放、ALREADY_CURRENT 门禁仍强制执行。
 
 **变更**
 
-- Skill Family Hub 仍是统一市场，验证后经 GitHub Git Data API 更新条目。
+- Skill Family Hub 保持统一市场。GitHub Git Data API 机制延续，写入采用 compare-and-swap 语义；不自动回滚或覆盖已完成步骤。
 
 **修复**
 
-- 项目私有 Hub 钩子把 `RELEASE_SKILL_HUB_RELEASE_EVIDENCE` 指定的绝对路径传给 `npm run release:check -- --release-evidence <file>`。路径必须指向已有普通文件，不接受符号链接。
+- 适配 Kimi 2.2.0 在方向键移动后只输出菜单增量重绘、不重发插件标题且最后一行没有换行的行为。适配器在移动后必须重新观察选中项，确认唯一选中 `Remove plugin` 后才允许提交操作。
+- 读取帧前先核实初始精确插件 ID，读完该帧后才发送方向键，再读取完整增量帧并核对唯一选中项，完整标题重绘时仍核对精确 ID。未知、歧义、未移动、帧未完成、timeout、EOF 均导致失败关闭。
 
 **升级说明**
 
-维护者在运行 `postverify` 前，将环境变量 `RELEASE_SKILL_HUB_RELEASE_EVIDENCE` 设为原始 Hub 证据描述符的绝对路径；现有 `envAllowlist` 只转发该键。描述符及其引用的原生记录不复制、不改写。
+本修复用于真实更新流程，非仅限离线测试。保留 Kimi 0.40.1 实际措辞 `Confirm remove plugin "<id>"?`、括号粘贴与 CSI Enter 输入方式。冻结的安装 URL/ref/sha、安装后 name/version 与载荷核对规则不变。同一 `unitId/plugin/version` 的共享 setup 按单元、插件、版本归并，Claude/Codex 不同物理 `skillFile` 路径不再视为多个 setup 归属，沿用 0.9.31 已有逻辑。各宿主安装、加载及专属配置仍需分别核实，反馈绑定 `host/unit/path/plan/config/root`。失败不改 `VERIFIED`/`DISTRIBUTED` 状态。`Foundation 0.25.0` 精确依赖继续采用。旧版独立的 `release-skill` 市场已弃用，使用 `ifoohoo/skill-family-hub` 与 `release-skill@skill-family-hub`。获取新提供方后可继续原冻结计划，无需重发原领域插件，也不扩大宿主授权。
 
-新计划冻结修正的钩子，仍须取得独立检查点批准；历史计划、批准和冻结钩子保持不变，不重放。`ALREADY_CURRENT` 仍须通过 Hub 正式门禁。
-
-已使用 Hub 的用户无需配置迁移。旧版独立的 `release-skill` 市场已弃用，应改用 `ifoohoo/skill-family-hub` 与 `release-skill@skill-family-hub`。
-
-本说明不授权发布，也不证明真实宿主业务或消费者安装验证完成；不新增消费者安装或更新动作。
+真实 Kimi 2.2.0 已完成确认前的精确身份、移动及选中项观察，随后按 Esc 取消并退出，未执行移除、安装或更新。47 项聚焦测试通过，独立代码审阅无发现；真实消费者的完整更新与加载验收仍待执行。
 <!-- release-skill:managed:end id=latest-release -->
 
 <!-- release-skill:capability:external-write-boundary -->
-> **当前边界：** v0.9.30 的能力范围与验证边界见本 README，
+> **当前边界：** v0.9.32 的能力范围与验证边界见本 README，
 > 不代表已经发布、完成消费者安装验证或通过独立验收。
 > 版本可用性以对应发布记录及发布后验证结果为准。
 > v0.4.1 是更早的已发布里程碑（v0.2.2 曾处于已发布状态，后因平台验证收敛修复而更新）。
@@ -53,7 +49,7 @@ release-skill 帮助维护者回答三个问题：准备发布什么、还有哪
 > 远端唯一性检查在 `publish` 全局预检执行。
 
 <!-- release-skill:capability:safe-first-command -->
-> **生产路径自 v0.1.1 里程碑起已完成真实生产验证；v0.9.30 的发布、消费者安装验证和独立验收状态须由该版本的发布记录及验证结果确认。**
+> **生产路径自 v0.1.1 里程碑起已完成真实生产验证；v0.9.32 的发布、消费者安装验证和独立验收状态须由该版本的发布记录及验证结果确认。**
 > npm 安装的 CLI 是受支持的用户入口；源码 checkout 保留为开发/贡献者路径。
 >
 > **第一条命令：**

package/adapters/claude/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.9.30",
+  "version": "0.9.32",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"

package/adapters/claude/bin/release-skill.bundle.mjs

@@ -9,9 +9,9 @@ const __bundlePkgRoot = __bundleResolve(__bundleDirname(__bundleFileURLToPath(im
 // Provide a real require() for CJS packages bundled into ESM (e.g. yaml, ajv).
 const __bundleRealRequire = __bundleCreateRequire(import.meta.url);
 // Package identity injected at build time — closure-independent --version probe.
-const __bundlePkg = Object.freeze({"name":"release-skill","version":"0.9.30"});
+const __bundlePkg = Object.freeze({"name":"release-skill","version":"0.9.32"});
 // Build-time source digest for the BUNDLE_STALE freshness gate (see above).
-const __bundleSourceDigest = "52acbaddf4e589b42b49defb03ff5dfa59e0306f37a3ce0e8e3aaa240b9cfba4";
+const __bundleSourceDigest = "b023c0808411ba0bf3fea258860422e38fe89a744a6c33676eb07e08c2a43b0b";
 
 var __create = Object.create;
 var __defProp = Object.defineProperty;
@@ -137228,17 +137228,198 @@ function parseCodeBuddyRemoteObservation(target, stdout) {
   };
 }
 function kimiExpectProgram({ removePlugin } = {}) {
-  const removeCommand = removePlugin ? `submitCommand "/plugins remove $removePlugin"
-expect {
-  -nocase -re {(remove|delete|uninstall).*(confirm|sure)|(confirm|sure).*(remove|delete|uninstall)} {
+  const removeCommand = removePlugin ? `proc kimi22RemoveIdentity {dialog} {
+  set identity ""
+  foreach rawLine [split $dialog "\\n"] {
+    set line [string trim $rawLine]
+    if {[regexp -nocase {Remove .+ \\(([^()]+)\\)\\?} $line match pluginId]} {
+      if {$identity ne "" && $identity ne $pluginId} { return "" }
+      set identity $pluginId
+    }
+  }
+  return $identity
+}
+
+proc kimi22RemoveDialogComplete {dialog} {
+  set hasCancel 0
+  set hasRemove 0
+  foreach rawLine [split $dialog "\\n"] {
+    set line [string trim $rawLine]
+    regsub {^\u276F[ \\t]*} $line {} label
+    set label [string trim $label]
+    if {[string equal -nocase $label "Cancel"]} { set hasCancel 1 }
+    if {[string equal -nocase $label "Remove plugin"]} { set hasRemove 1 }
+  }
+  return [expr {$hasCancel && $hasRemove}]
+}
+
+proc kimi22RemoveAction {dialog state unknownCode} {
+  set labels {}
+  set selectedCount 0
+  set selectedIndex -1
+  set selectedLabel ""
+  set removeCount 0
+  set removeIndex -1
+  foreach rawLine [split $dialog "\\n"] {
+    set line [string trim $rawLine]
+    if {$line eq ""} { continue }
+    set selected [regexp {^\u276F[ \\t]*} $line]
+    if {$selected} {
+      regsub {^\u276F[ \\t]*} $line {} label
+      set label [string trim $label]
+    } else {
+      set label $line
+    }
+    set knownAction [expr {
+      [string equal -nocase $label "Cancel"]
+      || [string equal -nocase $label "Remove plugin"]
+    }]
+    if {!$knownAction && $selected} {
+      puts stderr "KIMI_TUI_STATE:$state:unknown"
+      exit $unknownCode
+    }
+    if {!$knownAction} { continue }
+    set index [llength $labels]
+    lappend labels $label
+    if {[string equal -nocase $label "Remove plugin"]} {
+      incr removeCount
+      set removeIndex $index
+    }
+    if {$selected} {
+      incr selectedCount
+      set selectedIndex $index
+      set selectedLabel $label
+    }
+  }
+  if {[llength $labels] != 2 || $removeCount != 1 || $selectedCount != 1} {
+    puts stderr "KIMI_TUI_STATE:$state:unknown"
+    exit $unknownCode
+  }
+  if {[string equal -nocase $selectedLabel "Remove plugin"]} {
+    return selected-remove
+  }
+  if {![string equal -nocase $selectedLabel "Cancel"]} {
+    puts stderr "KIMI_TUI_STATE:$state:unknown"
+    exit $unknownCode
+  }
+  if {$selectedIndex + 1 == $removeIndex} { return move-down }
+  if {$selectedIndex - 1 == $removeIndex} { return move-up }
+  puts stderr "KIMI_TUI_STATE:$state:unknown"
+  exit $unknownCode
+}
+
+proc readKimi22RemoveDialog {prefix state timeoutCode unknownCode eofCode} {
+  global expect_out
+  set dialogBuffer $prefix
+  set cleaned [cleanScreen $dialogBuffer]
+  if {![regexp -nocase {Remove .+ \\(([^()]+)\\)\\?} $cleaned]} {
     expect {
-      -ex $removePlugin {
-        send -- "\\033\\[B"
-        send -- "\\033\\[13u"
+      -nocase -re {Remove [^\\r\\n]*\\([^\\r\\n]+\\)\\?} {
+        append dialogBuffer $expect_out(buffer)
       }
-      timeout { failTimeout remove-confirmation 125 127 }
-      eof { failEof remove-confirmation 126 }
+      timeout { failTimeout $state $timeoutCode $unknownCode }
+      eof { failEof $state $eofCode }
     }
+    set cleaned [cleanScreen $dialogBuffer]
+  }
+  while {![kimi22RemoveDialogComplete $cleaned]} {
+    expect {
+      -nocase -re {Trust this folder\\?} { unexpectedDirectoryTrust }
+      -nocase -re {(?:Cancel|Remove plugin)[^\\r\\n]*\\r*\\n} {
+        append dialogBuffer $expect_out(buffer)
+      }
+      -re {([^\\r\\n]+\\r*\\n)} {
+        append dialogBuffer $expect_out(buffer)
+      }
+      timeout { failTimeout $state $timeoutCode $unknownCode }
+      eof { failEof $state $eofCode }
+    }
+    set cleaned [cleanScreen $dialogBuffer]
+  }
+  # Consume the initial synchronized frame before sending a selection key.
+  # Otherwise its remaining rows can be mistaken for the selection repaint.
+  if {[string last "\\033\\[?2026h" $dialogBuffer] > [string last "\\033\\[?2026l" $dialogBuffer]} {
+    expect {
+      -exact "\\033\\[?2026l" { append dialogBuffer $expect_out(buffer) }
+      timeout { failTimeout $state $timeoutCode $unknownCode }
+      eof { failEof $state $eofCode }
+    }
+    set cleaned [cleanScreen $dialogBuffer]
+  }
+  return $cleaned
+}
+
+proc readKimi22RemoveSelection {} {
+  global expect_out removePlugin
+  expect {
+    -nocase -re {Trust this folder\\?} { unexpectedDirectoryTrust }
+    -nocase -re {Remove [^\\r\\n]*\\([^\\r\\n]+\\)\\?} {
+      set dialog [readKimi22RemoveDialog $expect_out(buffer) remove-confirm-selection 125 127 126]
+      if {[kimi22RemoveIdentity $dialog] ne $removePlugin} {
+        puts stderr "KIMI_TUI_STATE:remove-confirm-selection:unknown"
+        exit 127
+      }
+      return $dialog
+    }
+    -exact "\\033\\[?2026l" {
+      # Kimi 2.2 redraws only the changed menu rows, with no title or final newline.
+      # The initial dialog already bound the plugin; require one complete new frame.
+      if {[string first "\\033\\[?2026h" $expect_out(buffer)] < 0} {
+        puts stderr "KIMI_TUI_STATE:remove-confirm-selection:unknown"
+        exit 127
+      }
+      return [cleanScreen $expect_out(buffer)]
+    }
+    timeout { failTimeout remove-confirm-selection 125 127 }
+    eof { failEof remove-confirm-selection 126 }
+  }
+}
+
+proc confirmKimi22Remove {} {
+  global expect_out promptPattern removePlugin
+  set dialog [readKimi22RemoveDialog $expect_out(buffer) remove-confirmation 125 127 126]
+  set identity [kimi22RemoveIdentity $dialog]
+  if {$identity eq "" || $identity ne $removePlugin} {
+    puts stderr "KIMI_TUI_STATE:remove-confirmation:unknown"
+    exit 127
+  }
+  set action [kimi22RemoveAction $dialog remove-confirmation 127]
+  if {$action eq "move-down"} {
+    send -- "\\033\\[B"
+  } elseif {$action eq "move-up"} {
+    send -- "\\033\\[A"
+  }
+  if {$action ne "selected-remove"} {
+    set confirmedDialog [readKimi22RemoveSelection]
+    set confirmedIdentity [kimi22RemoveIdentity $confirmedDialog]
+    if {$confirmedIdentity ne "" && $confirmedIdentity ne $removePlugin} {
+      puts stderr "KIMI_TUI_STATE:remove-confirm-selection:unknown"
+      exit 127
+    }
+    set confirmedAction [kimi22RemoveAction $confirmedDialog remove-confirm-selection 127]
+    if {$confirmedAction ne "selected-remove"} {
+      puts stderr "KIMI_TUI_STATE:remove-confirm-selection:unknown"
+      exit 127
+    }
+  }
+  send -- "\\033\\[13u"
+  expect {
+    -nocase -re {Trust this folder\\?} { unexpectedDirectoryTrust }
+    -re $promptPattern {}
+    timeout { failTimeout remove-prompt 128 130 }
+    eof { failEof remove-prompt 129 }
+  }
+}
+
+submitCommand "/plugins remove $removePlugin"
+expect {
+  -nocase -re {Confirm remove plugin "([^"\\r\\n]+)"\\?\\r*\\n} {
+    if {$expect_out(1,string) ne $removePlugin} {
+      puts stderr "KIMI_TUI_STATE:remove-confirmation:unknown"
+      exit 127
+    }
+    send -- "\\033\\[B"
+    send -- "\\033\\[13u"
     expect {
       -nocase -re {Trust this folder\\?} { unexpectedDirectoryTrust }
       -re $promptPattern {}
@@ -137246,6 +137427,9 @@ expect {
       eof { failEof remove-prompt 129 }
     }
   }
+  -nocase -re {Remove [^\\r\\n]*\\([^\\r\\n]+\\)\\?} {
+    confirmKimi22Remove
+  }
   -re $promptPattern {}
   -nocase -re {Trust this folder\\?} { unexpectedDirectoryTrust }
   timeout { failTimeout remove-dialog 122 124 }
@@ -146909,7 +147093,7 @@ async function runPostReleaseFinish({
   }
   const setupSkill = loaded.config.releaseFinish?.setupSkill;
   const candidates = observations.filter((entry) => entry.installation === "current" && entry.loaded === true && typeof entry.skillFile === "string");
-  const candidateOwners = new Set(candidates.map((entry) => `${entry.plugin}\0${entry.version}\0${entry.skillFile}`));
+  const candidateOwners = new Set(candidates.map((entry) => `${entry.unitId}\0${entry.plugin}\0${entry.version}`));
   const effectiveSetup = updateKeepsFeedback ? feedback.setup : null;
   let setupStep;
   if (!setupSkill) {

package/adapters/claude/skills/release-help/SKILL.md

@@ -29,9 +29,15 @@ description: "Discoverable entry point for release-skill: dependency and environ
 
 治理诊断只运行 release-skill 自己的只读检查程序，不运行目标 Skill、业务脚本、构建、hook 或发布动作，也不把 `prepare`、`verify`、`release-finish` 当作静态治理入口。用户要求实际接入或发布时，把已有授权带到对应原业务入口；各入口继续执行原有确认、副作用和状态机合同。
 
-## 0.9.30 能力与证据边界
+## 0.9.32 能力与证据边界
 
-release-skill 0.9.30 保留 Foundation 0.25.0 精确依赖、可选宿主覆盖诊断输入 `--host-coverage <file>` 与 `--observe-hosts`、Codex 0.154.0 静态加载规则检查 11 份真实生成 Skill 的原字节等既有事实；本版修复私有 Hub 的 postVerify 钩子：通过既有 `envAllowlist` 传递 `RELEASE_SKILL_HUB_RELEASE_EVIDENCE`，其值为原始描述符所指向的已有普通文件绝对路径（拒绝符号链接），交由 Hub `npm run release:check -- --release-evidence <file>` 验证。Qoder 本机更新路径处理维持既有能力，支持 `./adapters/qoder/skills/` 与 `./skills/` 两种布局，仍核对安装 name/version/skills、路径包含性与实际载荷。静态检查不证明安装、会话选择或业务执行通过，批准、发布和验证状态以对应计划、批准及执行记录为准。
+0.9.32 修复了 Kimi 2.2.0 移除菜单移动后，适配器因等待完整标题而失败的问题。真实终端只重绘变动的菜单行，不重发插件标题，末行也没有换行。适配器在移动后必须先重新观察选中项，确认唯一选中 `Remove plugin` 后才允许提交操作。读取帧前先核实初始精确插件 ID，读完该帧后才发送方向键，再读取完整增量帧并核对唯一选中项，完整标题重绘时仍核对精确 ID。未知、歧义、未移动、帧未完成、timeout、EOF 均导致失败关闭，不继续安装。 移除确认页仍采用 `Remove <displayName> (<id>)?`，包含 Cancel 和 Remove plugin 选项；已选中 `Remove plugin` 时无需方向键。显示名含 Confirm 或 Sure，或标题分块到达，仍核对精确身份，不触发旧宽泛正则路径。
+
+保留 Kimi 0.40.1 的实际确认措辞 `Confirm remove plugin "<id>"?`、括号粘贴与 CSI Enter 输入方式。冻结的安装 URL/ref/sha、安装后 name/version 与载荷核对规则未变。 真实 Kimi 2.2.0 已完成确认前的精确身份、移动及选中项观察，随后按 Esc 取消并退出，未执行移除、安装或更新。47 项聚焦测试通过，独立代码审阅无发现；真实消费者的完整更新与加载验收仍待执行。修复面向真实更新流程，提供方升级不扩大宿主授权，也无需重发原领域插件。
+
+同一 `unitId/plugin/version` 的共享环境 setup 按单元、插件、版本归并，Claude/Codex 不同物理 `skillFile` 路径不再视为多个 setup 归属。仅需一个已加载宿主的精确 setup 反馈即可满足共享环境检查要求。各宿主的安装、加载及专属配置仍需分别核实，反馈继续绑定 `host/unit/path/plan/config/root`；真正多插件归属仍需消歧，Kimi 失败或其他宿主失败均导致收尾状态为 FAILED，不改变 `VERIFIED`/`DISTRIBUTED` 发布状态。
+
+本版保留 Foundation 0.25.0 精确依赖、可选宿主覆盖诊断输入 `--host-coverage <file>` 与 `--observe-hosts`、Codex 0.154.0 对 11 份真实生成 Skill 的原字节静态检查能力。静态检查不证明安装、会话选择或业务执行通过，批准、发布和验证状态以对应计划、批准及执行记录为准。Qoder 本机更新路径处理维持既有能力，支持 `./adapters/qoder/skills/` 与 `./skills/` 两种布局，仍核对安装 name/version/skills、路径包含性与实际载荷。私有 Hub 的 `RELEASE_SKILL_HUB_RELEASE_EVIDENCE` 环境变量继续要求原始描述符指向的已有普通文件绝对路径（拒绝符号链接），交由 `npm run release:check -- --release-evidence <file>` 验证。实际版本能力不能等同于发布状态或真实宿主验收。
 
 在冻结前，`prepare` 或新建 `ship` 状态时可重复传入 `--unit <id>`；未传入则默认选择全部单元。延期单元不进入发布计划，亦不获得发布状态。完整配置、生成物新鲜度检查及顶层 Hook 仍作用于全项目范围。`publicSourceAuthorityReceipt` 的 coordinator 与全部 subjects 必须共同选择。
 

package/adapters/codex/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.9.30",
+  "version": "0.9.32",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "author": {
     "name": "广州市风荷科技有限公司"
@@ -19,7 +19,7 @@
     ],
     "defaultPrompt": [
       "Assess this project for release readiness.",
-      "Prepare a release plan for version 0.9.30.",
+      "Prepare a release plan for version 0.9.32.",
       "Help me understand the release workflow."
     ]
   }