feat: add plugin marketplace and native mcp oauth

.changeset/README.md

@@ -37,7 +37,6 @@ Example scenarios:
 | SDK behavior change affects CLI user experience | Add changesets to both `@moonshot-ai/kimi-code-sdk` and `@moonshot-ai/kimi-code` |
 | Provider abstraction change affects SDK / CLI | Add changesets to the affected `@moonshot-ai/kimi-code-sdk` and/or `@moonshot-ai/kimi-code` |
 | Test-only, internal refactor, docs, or private debug tooling changes | Usually no changeset needed |
-| Bundled official plugin change under `plugins/` (e.g. `kimi-datasource`) | No changeset — the plugin is versioned via its own `kimi.plugin.json` / `plugins/marketplace.json` and shipped through the marketplace CDN, not the npm package |
 
 ## Prerequisite: NPM Trusted Publishing (OIDC)
 
@@ -141,7 +140,6 @@ The root-level `pnpm run publish` first runs typecheck, lint, sherif, test, buil
 ## Notes
 
 - Every PR that affects publishable-package behavior or public API should include a corresponding changeset.
-- Changes under `plugins/` (the bundled official plugins such as `kimi-datasource`) do **not** need a changeset: each plugin carries its own version in `kimi.plugin.json` and `plugins/marketplace.json` and is distributed via the marketplace CDN, separately from the `@moonshot-ai/kimi-code` npm package.
 - Changeset files must be committed to the repository — release PRs are only triggered after they're merged.
 - Release PRs require human review and approval. They do not publish before merge; merging the approved PR automatically publishes after its commit passes CI.
 - Do not add release changesets for private internal packages; only select `@moonshot-ai/kimi-code` and `@moonshot-ai/kimi-code-sdk`.

.changeset/cli-marketplace-description-layout.md

@@ -0,0 +1,5 @@
+---
+"@moonshot-ai/kimi-code": patch
+---
+
+Improve plugin marketplace interactions.

.changeset/plugin-marketplace-core-v2.md

@@ -0,0 +1,5 @@
+---
+"@moonshot-ai/agent-core-v2": patch
+---
+
+Support digest-verified marketplace plugin installation and preserve OAuth credentials across configuration changes.

.changeset/plugin-marketplace-server.md

@@ -0,0 +1,5 @@
+---
+"@moonshot-ai/kap-server": patch
+---
+
+Bind marketplace plugin installs to the displayed archive digest and declare catalog errors consistently.

.changeset/sdk-plugin-marketplace.md

@@ -0,0 +1,5 @@
+---
+"@moonshot-ai/kimi-code-sdk": minor
+---
+
+Add structured plugin marketplace installs and marketplace helpers to the SDK.

apps/kimi-code/package.json

@@ -67,8 +67,6 @@
     "dev:kap-server": "KIMI_CODE_DEV_SERVER=1 tsx --tsconfig ./tsconfig.dev.json --import ../../build/register-raw-text-loader.mjs ./src/main.ts web --no-open --debug-endpoints",
     "dev:kap-server:multi": "KIMI_CODE_DEV_SERVER=1 tsx --tsconfig ./tsconfig.dev.json --import ../../build/register-raw-text-loader.mjs ./src/main.ts web --no-open --debug-endpoints",
     "dev:server:restart": "node scripts/dev-server-restart.mjs",
-    "dev:plugin-marketplace": "node scripts/dev-plugin-marketplace-server.mjs",
-    "build:plugin-marketplace": "node scripts/build-plugin-marketplace-cdn.mjs",
     "dev:prod": "node dist/main.mjs",
     "clean": "rm -rf dist",
     "typecheck": "tsc -p tsconfig.json --noEmit",