morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[PR #4090] feat: add Kimi Code plugin manifest with deferred tool loading #6050

New issue

Open

opened 2026-10-31 01:11:28 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 01:11:28 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/4090
Author: @chengluyu
Created: 10/15/2026
Status: 🔄 Open

Base: main ← Head: feat/kimi-code-plugin

📝 Commits (1)

d0fa3dd feat: add Kimi Code plugin manifest with deferred tool loading

📊 Changes

8 files changed (+179 additions, -55 deletions)

View changed files

📝 .github/workflows/release-recovery.yml (+1 -1)
📝 .github/workflows/release.yml (+1 -1)
📝 docs/client-configuration.md (+22 -0)
➕ kimi.plugin.json (+34 -0)
📝 package.json (+2 -2)
📝 release-please-config.json (+9 -0)
➖ scripts/verify-mcp-registry-metadata.mjs (+0 -51)
➕ scripts/verify-release-metadata.mjs (+110 -0)

📄 Description

中文说明（点击展开）

一句话

在仓库根目录新增 kimi.plugin.json，让 Kimi Code 可以直接以插件形式安装 REA：

/plugins install https://github.com/morluto/rea

并通过 deferred: true 让 REA 的全部 207 个 MCP 工具按需动态加载，不再一次性塞进模型上下文。

动机

目前 Kimi Code 用户要通过 rea setup --client kimi 注册 MCP server，这条路在 /plugins 插件管理器里不可见；而且在不支持工具懒加载的客户端上，整个 compact 工具目录（约 290 KB / 6.8 万 token）会随每次请求全量发送。插件化之后：Desktop 端（强制开启 tool-select）默认全部懒加载；终端 CLI 用户在 /experiments 里开一次 Tool select 即可，不开则回退到现有的 compact 内联模式，行为不变。

改动内容

kimi.plugin.json（新增）：钉版本的 npx -y rea-agents@<version> mcp 注册（与 rea setup 写的一致）、compact schema profile、Ghidra 超时（30s 启动 / 450s 工具）、deferred: true；skills 路径精确指向 reverse-engineer-anything，避免把贡献者向的 skill 带给最终用户
版本同步：release-please 通过 extra-files 自动 bump manifest 里的两处版本（json updater 管 $.version，generic updater 管 args 里的钉版本，块标记放在 Kimi 会静默剥离的忽略字段里，已实测无副作用）
校验合并：原 mcp-registry:check 扩展为 release-metadata:check（scripts/verify-release-metadata.mjs），同时校验 server.json 和 kimi.plugin.json 与 package.json 的对齐；接入 check:pr 和两个发布 workflow
文档：docs/client-configuration.md 的 Kimi Code 一节新增插件安装说明

验证（均为实际执行）

隔离 KIMI_CODE_HOME 端到端实测：插件加载成功、发现 207 个工具；开启 tool-select 时模型请求里只有 28 个工具（0 个内联），select_tools 成功加载并调用了 REA 工具拿到真实结构化结果；关闭 flag 时 207 个工具全部内联（优雅回退）
node scripts/verify-release-metadata.mjs、npm run check:fast、pinned oxfmt 0.72.0 格式检查、pre-commit/pre-push 钩子全部通过

已知遗留（未验证项）

release-please 对标记的实际 bump 要等下一次发布 PR 才能确认（与 docs/installation.md 同款模式，风险低）
真实的 /plugins install GitHub URL 安装未跑（测试用的是等价的 managed 目录布局）
headless kimi -p 首轮可能因客户端竞态缺少可加载工具清单公告（Desktop 交互场景不受影响；这是 Kimi Code 客户端行为，本 PR 不涉及）

设计取舍（留给评审的决策点）

钉版本 + 对齐校验是遵循 REA 的既定惯例（src/identity.ts 的注册命令也是钉版本）。如果 maintainer 更倾向简单，可以改用 rea-agents@latest 让 manifest 完全静态，删掉 release-please 条目和对齐校验——欢迎评审时直接拍板。

Summary

REA becomes installable as a Kimi Code plugin directly from this repository:

/plugins install https://github.com/morluto/rea

The plugin declares the same pinned MCP registration rea setup --client kimi
writes today, ships the reverse-engineer-anything skill, and sets
deferred: true so REA's full tool catalog (207 tools at 6.5.0) stays out of
the model's base context and loads on demand through select_tools wherever
progressive tool disclosure is active.

Problem and expected behavior

Kimi Code users currently register REA through rea setup --client kimi, which
writes ~/.kimi-code/mcp.json and installs the skill. That path is not
discoverable from Kimi Code's plugin manager, and on clients without deferred
tool loading the whole compact catalog (~290 KB, ~68k tokens) rides every
request for the entire session.

Expected: /plugins install delivers MCP server + skill in one step; on the
Kimi Code desktop app (which force-enables tool-select) all REA tools are
deferred by default; terminal CLI users can opt in via /experiments and fall
back to the compact inline profile unchanged when the flag is off.

Change and scope

New authored kimi.plugin.json at the repository root: pinned
npx -y rea-agents@<version> mcp, REA_MCP_INPUT_SCHEMA_PROFILE=compact,
Ghidra-aware timeouts (30s startup / 450s tool), deferred: true, and a
skills path pointing at the authored reverse-engineer-anything skill only,
so contributor-facing skills in .agents/skills/ stay out of the plugin.
release-please-config.json gains two extra-files entries for
kimi.plugin.json: a json updater for $.version and a generic updater
for the args pin. The generic updater's block markers live in ignored
manifest keys around the args line; Kimi's MCP server schema is non-strict
and strips them (verified live).
The existing registry metadata check grows into
npm run release-metadata:check (scripts/verify-release-metadata.mjs,
formerly verify-mcp-registry-metadata.mjs): besides server.json it now
also fails closed when kimi.plugin.json drifts from package.json
(version, pinned args, compact profile, deferred, timeouts, markers,
skill presence). Runs in check:pr, release.yml, and
release-recovery.yml.
docs/client-configuration.md documents the plugin install path and the
deferred-loading prerequisites.

Scope: packaging/distribution metadata only; no new provider, capability, or
target-execution surface, so no maintainer scope decision is required ("not
applicable"). Intentionally not included: a slim release zip asset (GitHub repo
install downloads the full source tree), and any change to rea setup.

Contract and boundary impact

Semantic owner and earliest changed stage: packaging metadata; no domain,
application, or server code changes.
Contribution scope fit and linked maintainer decision: not applicable
(distribution of the existing MCP server and skill).
CLI and MCP/tool-catalog contract: unchanged; the plugin launches the
existing mcp entrypoint.
Provider, bridge, target-format, or platform compatibility: unchanged; the
registration mirrors rea setup --client kimi.
Evidence, artifact, provenance, or reconstruction contract: unchanged.
Target selection, authority, upstream behavior, and cleanup details: not
applicable.
Generated metadata, package, or installation impact: new authored manifest +
alignment check; no generated outputs committed; skills/ build output
remains the npm-package skill source.

Expected effects (check known effects; use documentation-only on its own).
Unchecked items do not establish absence; leave uncertainties visible.

Read existing files or captured data.
Launch or attach to a process.
Inject instrumentation or run scripts/code.
Change process memory, registers, files, or configuration.
Contact network services.
Recover protected code or work around protections.
Documentation or usability only; no target interaction.
Not sure yet; investigation or maintainer guidance needed.

(Installing the plugin makes the Kimi Code client spawn the existing
npx -y rea-agents@<version> mcp server process; the change itself adds no
analysis capability.)

Evidence and regression coverage

Tests added or updated: scripts/verify-release-metadata.mjs (extends the
existing registry check), wired into check:pr and both release workflows.
Base reproduction or other evidence: executed end-to-end against Kimi Code
CLI with an isolated KIMI_CODE_HOME, the plugin placed as a managed copy:
- server plugin-rea:rea connected and reported 207 tools;
- with KIMI_CODE_EXPERIMENTAL_TOOL_SELECT=1 the model request carried 28
  tools (0 mcp__* inline) and select_tools loaded and called
  mcp__plugin-rea_rea__list_cutter_sessions, which returned its structured
  result;
- without the flag all 207 tools were inline (existing compact-profile
  fallback), confirming graceful degradation;
- plugin skill catalog exposed reverse-engineer-anything only, and no
  manifest diagnostics were logged.
User-visible CLI/MCP output (if applicable): not applicable; no CLI/MCP
surface change.
Remaining proof gaps:
- release-please's bump of the marker-guarded args pin is unverified until
  the next release PR (same marker pattern as docs/installation.md);
- /plugins install from the GitHub URL was not run end-to-end; the test
  used the equivalent managed-copy layout the installer produces;
- headless kimi -p first turns can miss the loadable-tools announcement
  (client-side race between MCP discovery and context assembly); interactive
  desktop sessions were unaffected in testing. This is a Kimi Code client
  behavior, not something this PR changes.

For evidence-bearing changes:

Observed, derived, and inferred claims remain distinguishable.
Artifact identity, source provenance, and failed attempts remain preserved.
Unsupported, incomplete, unavailable, or uncertain outcomes remain visible.

Validation performed

node scripts/verify-release-metadata.mjs — "Release metadata is aligned for
rea-agents@6.5.0."
npx oxfmt --check kimi.plugin.json release-please-config.json package.json
— pass with the pinned oxfmt 0.72.0.
pre-commit lint-staged (oxfmt + oxlint --fix) — pass.
Isolated-KIMI_CODE_HOME kimi -p runs against the real manifest — results
listed under Evidence.
npm run check:fast — pass (turbo typecheck + lint, 2/2 tasks successful).

Compatibility, safety, and release

Breaking changes or migration steps: none.
Real Hopper/Ghidra, browser, or OS coverage: not applicable; no provider or
bridge changes.
Package or release metadata impact: release-please bumps kimi.plugin.json
alongside server.json; release workflows additionally validate the manifest
before publishing.
Security, privacy, process, or containment review: the plugin starts the same
pinned npm package command that rea setup registers today; no new network
surface beyond the existing npm download.

Author readiness

Human owner:

I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work.
I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps.
I declare this PR ready for initial maintainer review.

Before merge

This PR addresses a concrete problem or an agreed enhancement.
Material scope and authority questions are resolved, and any required maintainer scope decision covers the final diff.
The PR has one focused outcome and the title follows type(scope): outcome.
Related issue is linked, or the reason for not linking one is stated above.
Tests cover changed observable behavior and meaningful failure paths.
Owning docs, contracts, and generated metadata are updated where needed.
User-visible CLI/MCP changes include representative output.
I checked the final diff for secrets, unrelated cleanup, and unsupported claims.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/4090 **Author:** [@chengluyu](https://github.com/chengluyu) **Created:** 10/15/2026 **Status:** 🔄 Open **Base:** `main` ← **Head:** `feat/kimi-code-plugin` --- ### 📝 Commits (1) - [`d0fa3dd`](https://github.com/morluto/rea/commit/d0fa3ddf8b260afb246ade7d01d323bb57e9acdf) feat: add Kimi Code plugin manifest with deferred tool loading ### 📊 Changes **8 files changed** (+179 additions, -55 deletions) <details> <summary>View changed files</summary> 📝 `.github/workflows/release-recovery.yml` (+1 -1) 📝 `.github/workflows/release.yml` (+1 -1) 📝 `docs/client-configuration.md` (+22 -0) ➕ `kimi.plugin.json` (+34 -0) 📝 `package.json` (+2 -2) 📝 `release-please-config.json` (+9 -0) ➖ `scripts/verify-mcp-registry-metadata.mjs` (+0 -51) ➕ `scripts/verify-release-metadata.mjs` (+110 -0) </details> ### 📄 Description <details> <summary>中文说明（点击展开）</summary> ## 一句话在仓库根目录新增 `kimi.plugin.json`，让 Kimi Code 可以直接以插件形式安装 REA： ```text /plugins install https://github.com/morluto/rea ``` 并通过 `deferred: true` 让 REA 的全部 207 个 MCP 工具按需动态加载，不再一次性塞进模型上下文。 ## 动机目前 Kimi Code 用户要通过 `rea setup --client kimi` 注册 MCP server，这条路在 `/plugins` 插件管理器里不可见；而且在不支持工具懒加载的客户端上，整个 compact 工具目录（约 290 KB / 6.8 万 token）会随每次请求全量发送。插件化之后：Desktop 端（强制开启 tool-select）默认全部懒加载；终端 CLI 用户在 `/experiments` 里开一次 Tool select 即可，不开则回退到现有的 compact 内联模式，行为不变。 ## 改动内容 - **`kimi.plugin.json`（新增）**：钉版本的 `npx -y rea-agents@<version> mcp` 注册（与 `rea setup` 写的一致）、compact schema profile、Ghidra 超时（30s 启动 / 450s 工具）、`deferred: true`；skills 路径精确指向 `reverse-engineer-anything`，避免把贡献者向的 skill 带给最终用户 - **版本同步**：release-please 通过 extra-files 自动 bump manifest 里的两处版本（`json` updater 管 `$.version`，`generic` updater 管 args 里的钉版本，块标记放在 Kimi 会静默剥离的忽略字段里，已实测无副作用） - **校验合并**：原 `mcp-registry:check` 扩展为 `release-metadata:check`（`scripts/verify-release-metadata.mjs`），同时校验 `server.json` 和 `kimi.plugin.json` 与 `package.json` 的对齐；接入 `check:pr` 和两个发布 workflow - **文档**：`docs/client-configuration.md` 的 Kimi Code 一节新增插件安装说明 ## 验证（均为实际执行） - 隔离 `KIMI_CODE_HOME` 端到端实测：插件加载成功、发现 207 个工具；开启 tool-select 时模型请求里只有 28 个工具（0 个内联），`select_tools` 成功加载并调用了 REA 工具拿到真实结构化结果；关闭 flag 时 207 个工具全部内联（优雅回退） - `node scripts/verify-release-metadata.mjs`、`npm run check:fast`、pinned oxfmt 0.72.0 格式检查、pre-commit/pre-push 钩子全部通过 ## 已知遗留（未验证项） - release-please 对标记的实际 bump 要等下一次发布 PR 才能确认（与 `docs/installation.md` 同款模式，风险低） - 真实的 `/plugins install` GitHub URL 安装未跑（测试用的是等价的 managed 目录布局） - headless `kimi -p` 首轮可能因客户端竞态缺少可加载工具清单公告（Desktop 交互场景不受影响；这是 Kimi Code 客户端行为，本 PR 不涉及） ## 设计取舍（留给评审的决策点）钉版本 + 对齐校验是遵循 REA 的既定惯例（`src/identity.ts` 的注册命令也是钉版本）。如果 maintainer 更倾向简单，可以改用 `rea-agents@latest` 让 manifest 完全静态，删掉 release-please 条目和对齐校验——欢迎评审时直接拍板。 --- </details> ## Summary REA becomes installable as a Kimi Code plugin directly from this repository: ```text /plugins install https://github.com/morluto/rea ``` The plugin declares the same pinned MCP registration `rea setup --client kimi` writes today, ships the `reverse-engineer-anything` skill, and sets `deferred: true` so REA's full tool catalog (207 tools at 6.5.0) stays out of the model's base context and loads on demand through `select_tools` wherever progressive tool disclosure is active. ## Problem and expected behavior Kimi Code users currently register REA through `rea setup --client kimi`, which writes `~/.kimi-code/mcp.json` and installs the skill. That path is not discoverable from Kimi Code's plugin manager, and on clients without deferred tool loading the whole compact catalog (~290 KB, ~68k tokens) rides every request for the entire session. Expected: `/plugins install` delivers MCP server + skill in one step; on the Kimi Code desktop app (which force-enables `tool-select`) all REA tools are deferred by default; terminal CLI users can opt in via `/experiments` and fall back to the compact inline profile unchanged when the flag is off. ## Change and scope - New authored `kimi.plugin.json` at the repository root: pinned `npx -y rea-agents@<version> mcp`, `REA_MCP_INPUT_SCHEMA_PROFILE=compact`, Ghidra-aware timeouts (30s startup / 450s tool), `deferred: true`, and a skills path pointing at the authored `reverse-engineer-anything` skill only, so contributor-facing skills in `.agents/skills/` stay out of the plugin. - `release-please-config.json` gains two extra-files entries for `kimi.plugin.json`: a `json` updater for `$.version` and a `generic` updater for the args pin. The generic updater's block markers live in ignored manifest keys around the `args` line; Kimi's MCP server schema is non-strict and strips them (verified live). - The existing registry metadata check grows into `npm run release-metadata:check` (`scripts/verify-release-metadata.mjs`, formerly `verify-mcp-registry-metadata.mjs`): besides `server.json` it now also fails closed when `kimi.plugin.json` drifts from `package.json` (version, pinned args, compact profile, `deferred`, timeouts, markers, skill presence). Runs in `check:pr`, `release.yml`, and `release-recovery.yml`. - `docs/client-configuration.md` documents the plugin install path and the deferred-loading prerequisites. Scope: packaging/distribution metadata only; no new provider, capability, or target-execution surface, so no maintainer scope decision is required ("not applicable"). Intentionally not included: a slim release zip asset (GitHub repo install downloads the full source tree), and any change to `rea setup`. ## Contract and boundary impact - Semantic owner and earliest changed stage: packaging metadata; no domain, application, or server code changes. - Contribution scope fit and linked maintainer decision: not applicable (distribution of the existing MCP server and skill). - CLI and MCP/tool-catalog contract: unchanged; the plugin launches the existing `mcp` entrypoint. - Provider, bridge, target-format, or platform compatibility: unchanged; the registration mirrors `rea setup --client kimi`. - Evidence, artifact, provenance, or reconstruction contract: unchanged. - Target selection, authority, upstream behavior, and cleanup details: not applicable. - Generated metadata, package, or installation impact: new authored manifest + alignment check; no generated outputs committed; `skills/` build output remains the npm-package skill source. Expected effects (check known effects; use documentation-only on its own). Unchecked items do not establish absence; leave uncertainties visible. - [ ] Read existing files or captured data. - [ ] Launch or attach to a process. - [ ] Inject instrumentation or run scripts/code. - [ ] Change process memory, registers, files, or configuration. - [ ] Contact network services. - [ ] Recover protected code or work around protections. - [x] Documentation or usability only; no target interaction. - [ ] Not sure yet; investigation or maintainer guidance needed. (Installing the plugin makes the Kimi Code client spawn the existing `npx -y rea-agents@<version> mcp` server process; the change itself adds no analysis capability.) ## Evidence and regression coverage - Tests added or updated: `scripts/verify-release-metadata.mjs` (extends the existing registry check), wired into `check:pr` and both release workflows. - Base reproduction or other evidence: executed end-to-end against Kimi Code CLI with an isolated `KIMI_CODE_HOME`, the plugin placed as a managed copy: - server `plugin-rea:rea` connected and reported 207 tools; - with `KIMI_CODE_EXPERIMENTAL_TOOL_SELECT=1` the model request carried 28 tools (0 `mcp__*` inline) and `select_tools` loaded and called `mcp__plugin-rea_rea__list_cutter_sessions`, which returned its structured result; - without the flag all 207 tools were inline (existing compact-profile fallback), confirming graceful degradation; - plugin skill catalog exposed `reverse-engineer-anything` only, and no manifest diagnostics were logged. - User-visible CLI/MCP output (if applicable): not applicable; no CLI/MCP surface change. - Remaining proof gaps: - release-please's bump of the marker-guarded args pin is unverified until the next release PR (same marker pattern as `docs/installation.md`); - `/plugins install` from the GitHub URL was not run end-to-end; the test used the equivalent managed-copy layout the installer produces; - headless `kimi -p` first turns can miss the loadable-tools announcement (client-side race between MCP discovery and context assembly); interactive desktop sessions were unaffected in testing. This is a Kimi Code client behavior, not something this PR changes. For evidence-bearing changes: - [x] Observed, derived, and inferred claims remain distinguishable. - [x] Artifact identity, source provenance, and failed attempts remain preserved. - [x] Unsupported, incomplete, unavailable, or uncertain outcomes remain visible. ## Validation performed - `node scripts/verify-release-metadata.mjs` — "Release metadata is aligned for rea-agents@6.5.0." - `npx oxfmt --check kimi.plugin.json release-please-config.json package.json` — pass with the pinned oxfmt 0.72.0. - pre-commit lint-staged (oxfmt + `oxlint --fix`) — pass. - Isolated-`KIMI_CODE_HOME` `kimi -p` runs against the real manifest — results listed under Evidence. - `npm run check:fast` — pass (turbo typecheck + lint, 2/2 tasks successful). ## Compatibility, safety, and release - Breaking changes or migration steps: none. - Real Hopper/Ghidra, browser, or OS coverage: not applicable; no provider or bridge changes. - Package or release metadata impact: release-please bumps `kimi.plugin.json` alongside `server.json`; release workflows additionally validate the manifest before publishing. - Security, privacy, process, or containment review: the plugin starts the same pinned npm package command that `rea setup` registers today; no new network surface beyond the existing npm download. ## Author readiness Human owner:  - [ ] I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work. - [ ] I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps. - [ ] I declare this PR ready for initial maintainer review. ## Before merge - [ ] This PR addresses a concrete problem or an agreed enhancement. - [ ] Material scope and authority questions are resolved, and any required maintainer scope decision covers the final diff. - [ ] The PR has one focused outcome and the title follows `type(scope): outcome`. - [ ] Related issue is linked, or the reason for not linking one is stated above. - [ ] Tests cover changed observable behavior and meaningful failure paths. - [ ] Owning docs, contracts, and generated metadata are updated where needed. - [ ] User-visible CLI/MCP changes include representative output. - [ ] I checked the final diff for secrets, unrelated cleanup, and unsupported claims. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi added the

pull-request

label

2026-10-31 01:11:28 +00:00

bsakaguchi referenced this issue

2026-11-01 21:46:30 +00:00

[PR #6277] [MERGED] fix(windows): report missing native launch controls as unavailable capabilities #7250

bsakaguchi referenced this issue

2026-11-01 21:46:51 +00:00

[PR #6348] [CLOSED] fix(windows): type missing process-control refusals as capability_unavailable (#6050) #7297