Repository navigation
feat: add plugin marketplace and native mcp oauth - #4525
Conversation
code-app: 2c4a3a6b91bcdf5d1aa427c0218070584b4a1fd6
🦋 Changeset detectedLatest commit: f72b932 The changes in this PR will be included in the next version bump. This PR includes changesets to release 5 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
There was a problem hiding this comment.
Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.
An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.
code-app: bce227c948f3b6cbc9371ac4d80d1deb132a4370
code-app: 34092014df516f8ec0bf91adf78c75c9ddd9a60d
# Conflicts: # apps/kimi-code/dist-web/assets/CodeBlockNode-DN6tN-fd.js # apps/kimi-code/dist-web/assets/CodeBlockNode-DnNeGjd2.js # apps/kimi-code/dist-web/assets/CodeBlockNode-UZZg5gHp.js # apps/kimi-code/dist-web/assets/PreCodeBlock-CwnbxLyB.js # apps/kimi-code/dist-web/assets/PreCodeBlock-DKgDTiZH.js # apps/kimi-code/dist-web/assets/PreCodeBlock-De4sXzpb.js # apps/kimi-code/dist-web/assets/Tooltip-CBoeS4mO.js # apps/kimi-code/dist-web/assets/Tooltip-CKClijn4.js # apps/kimi-code/dist-web/assets/Tooltip-CsVtTVYl.js # apps/kimi-code/dist-web/assets/abnfDiagram-VRR7QNED-C0F_mbj1.js # apps/kimi-code/dist-web/assets/abnfDiagram-VRR7QNED-Dw7C85u7.js # apps/kimi-code/dist-web/assets/abnfDiagram-VRR7QNED-Id86ug7C.js # apps/kimi-code/dist-web/assets/arc-Bsib46yB.js # apps/kimi-code/dist-web/assets/arc-CBcVCQMr.js # apps/kimi-code/dist-web/assets/arc-CBqyenpI.js # apps/kimi-code/dist-web/assets/architectureDiagram-ZJ3FMSHR-BU3h4qH_.js # apps/kimi-code/dist-web/assets/architectureDiagram-ZJ3FMSHR-nh3c_qTo.js # apps/kimi-code/dist-web/assets/architectureDiagram-ZJ3FMSHR-uDBghsgL.js # apps/kimi-code/dist-web/assets/blockDiagram-677ZJIJ3-B6F4Cp_k.js # apps/kimi-code/dist-web/assets/blockDiagram-677ZJIJ3-DVoda3uu.js # apps/kimi-code/dist-web/assets/blockDiagram-677ZJIJ3-DWIUQjzE.js # apps/kimi-code/dist-web/assets/c4Diagram-LMCZKHZV-Bu_3WzlR.js # apps/kimi-code/dist-web/assets/c4Diagram-LMCZKHZV-DK8zAX4-.js # apps/kimi-code/dist-web/assets/c4Diagram-LMCZKHZV-DubDU1Hh.js # apps/kimi-code/dist-web/assets/chunk-2Q5K7J3B-BG6es7i7.js # apps/kimi-code/dist-web/assets/chunk-2Q5K7J3B-BhqfYswo.js # apps/kimi-code/dist-web/assets/chunk-2Q5K7J3B-DL_oG78-.js # apps/kimi-code/dist-web/assets/chunk-32BRIVSS-Bs2qOQkG.js # apps/kimi-code/dist-web/assets/chunk-32BRIVSS-CYFkA-hP.js # apps/kimi-code/dist-web/assets/chunk-32BRIVSS-DompFR0C.js # apps/kimi-code/dist-web/assets/chunk-5VM5RSS4-BRm-UcvZ.js # apps/kimi-code/dist-web/assets/chunk-5VM5RSS4-CZPfFxs8.js # apps/kimi-code/dist-web/assets/chunk-5VM5RSS4-DactliZz.js # apps/kimi-code/dist-web/assets/chunk-EX3LRPZG-DDKia6Wx.js # apps/kimi-code/dist-web/assets/chunk-EX3LRPZG-DKeya_Nh.js # apps/kimi-code/dist-web/assets/chunk-EX3LRPZG-DNGZpN35.js # apps/kimi-code/dist-web/assets/chunk-JWPE2WC7-BlIxYDeZ.js # apps/kimi-code/dist-web/assets/chunk-JWPE2WC7-CLdUjjB6.js # apps/kimi-code/dist-web/assets/chunk-JWPE2WC7-DiGu-64o.js # apps/kimi-code/dist-web/assets/chunk-MOJQB5TN-BSyzgfKN.js # apps/kimi-code/dist-web/assets/chunk-MOJQB5TN-B_4qq8M2.js # apps/kimi-code/dist-web/assets/chunk-MOJQB5TN-TDhzsKaU.js # apps/kimi-code/dist-web/assets/chunk-RYQCIY6F-BBtlUlC2.js # apps/kimi-code/dist-web/assets/chunk-RYQCIY6F-BWPNh9WA.js # apps/kimi-code/dist-web/assets/chunk-RYQCIY6F-Doiirtiw.js # apps/kimi-code/dist-web/assets/chunk-V7JOEXUC-BeBDLO_d.js # apps/kimi-code/dist-web/assets/chunk-V7JOEXUC-gc4j6mJE.js # apps/kimi-code/dist-web/assets/chunk-V7JOEXUC-hOjH0svY.js # apps/kimi-code/dist-web/assets/chunk-VR4S4FIN-8bf_mCzp.js # apps/kimi-code/dist-web/assets/chunk-VR4S4FIN-C0Aw3V2v.js # apps/kimi-code/dist-web/assets/chunk-VR4S4FIN-CBSF7Uhy.js # apps/kimi-code/dist-web/assets/chunk-XXDRQBXY-9kW4cjFh.js # apps/kimi-code/dist-web/assets/chunk-XXDRQBXY-Di7YUrsz.js # apps/kimi-code/dist-web/assets/chunk-XXDRQBXY-h83Z76mT.js # apps/kimi-code/dist-web/assets/cose-bilkent-JH36ORCC-BJZkFZnP.js # apps/kimi-code/dist-web/assets/cose-bilkent-JH36ORCC-NLouu6tm.js # apps/kimi-code/dist-web/assets/cose-bilkent-JH36ORCC-Rq-Oi3RS.js # apps/kimi-code/dist-web/assets/cynefin-VYW2F7L2-BXN2FRZL.js # apps/kimi-code/dist-web/assets/cynefin-VYW2F7L2-CPEG8-Vi.js # apps/kimi-code/dist-web/assets/cynefin-VYW2F7L2-KkOFmjEG.js # apps/kimi-code/dist-web/assets/cynefinDiagram-TSTJHNR4-BxQYNKgE.js # apps/kimi-code/dist-web/assets/cynefinDiagram-TSTJHNR4-ClIEQzxH.js # apps/kimi-code/dist-web/assets/cynefinDiagram-TSTJHNR4-Cx1H0a5W.js # apps/kimi-code/dist-web/assets/dagre-VKFMJZFB-D0TIaws6.js # apps/kimi-code/dist-web/assets/dagre-VKFMJZFB-DmTFvAJt.js # apps/kimi-code/dist-web/assets/dagre-VKFMJZFB-ptq00KuZ.js # apps/kimi-code/dist-web/assets/diagram-FQU43EPY-BJ0uLCEZ.js # apps/kimi-code/dist-web/assets/diagram-FQU43EPY-BrJ6XXhF.js # apps/kimi-code/dist-web/assets/diagram-FQU43EPY-Dd0HSMZA.js # apps/kimi-code/dist-web/assets/diagram-G47NLZAW-BihKArCL.js # apps/kimi-code/dist-web/assets/diagram-G47NLZAW-Bo2riSBI.js # apps/kimi-code/dist-web/assets/diagram-G47NLZAW-DVqQNs4W.js # apps/kimi-code/dist-web/assets/diagram-NH7WQ7WH-DT8Wun3S.js # apps/kimi-code/dist-web/assets/diagram-NH7WQ7WH-DeFBJSVr.js # apps/kimi-code/dist-web/assets/diagram-NH7WQ7WH-pI2gpWBg.js # apps/kimi-code/dist-web/assets/diagram-OA4YK3LP-CDDFynlc.js # apps/kimi-code/dist-web/assets/diagram-OA4YK3LP-CsiOOqY1.js # apps/kimi-code/dist-web/assets/diagram-OA4YK3LP-DzDSMAZf.js # apps/kimi-code/dist-web/assets/diagram-WEI45ONY-CKDZSMR2.js # apps/kimi-code/dist-web/assets/diagram-WEI45ONY-CXBgtykE.js # apps/kimi-code/dist-web/assets/diagram-WEI45ONY-DRDdsmaR.js # apps/kimi-code/dist-web/assets/ebnfDiagram-CCIWWBDH-3u_QW33C.js # apps/kimi-code/dist-web/assets/ebnfDiagram-CCIWWBDH-B-sMl9AN.js # apps/kimi-code/dist-web/assets/ebnfDiagram-CCIWWBDH-CPZtqNO1.js # apps/kimi-code/dist-web/assets/erDiagram-Q63AITRT-BUUoeEan.js # apps/kimi-code/dist-web/assets/erDiagram-Q63AITRT-DlsWQCVk.js # apps/kimi-code/dist-web/assets/erDiagram-Q63AITRT-OXNvxKyl.js # apps/kimi-code/dist-web/assets/flowDiagram-23GEKE2U-BgRIGxtY.js # apps/kimi-code/dist-web/assets/flowDiagram-23GEKE2U-Cpg_K1S0.js # apps/kimi-code/dist-web/assets/flowDiagram-23GEKE2U-D03iyCLb.js # apps/kimi-code/dist-web/assets/ganttDiagram-NO4QXBWP-BPjlGhob.js # apps/kimi-code/dist-web/assets/ganttDiagram-NO4QXBWP-CrTDxXwh.js # apps/kimi-code/dist-web/assets/ganttDiagram-NO4QXBWP-CvsplL3l.js # apps/kimi-code/dist-web/assets/gitGraphDiagram-IHSO6WYX-CBqntniz.js # apps/kimi-code/dist-web/assets/gitGraphDiagram-IHSO6WYX-CkPzgGiM.js # apps/kimi-code/dist-web/assets/gitGraphDiagram-IHSO6WYX-DGTxB2o0.js # apps/kimi-code/dist-web/assets/index-4jSVmVLR.css # apps/kimi-code/dist-web/assets/index-AgSzbavm.js # apps/kimi-code/dist-web/assets/index-B68Y3p9W.js # apps/kimi-code/dist-web/assets/index-BJ3eGrh9.js # apps/kimi-code/dist-web/assets/index-BTn4U4mS.js # apps/kimi-code/dist-web/assets/index-BvkSYG-C.js # apps/kimi-code/dist-web/assets/index-BzZ34GS1.js # apps/kimi-code/dist-web/assets/index-CEWtXGqT.js # apps/kimi-code/dist-web/assets/index-CIEFQm8q.js # apps/kimi-code/dist-web/assets/index-CQcWT59y.js # apps/kimi-code/dist-web/assets/index10-B5ifztdO.js # apps/kimi-code/dist-web/assets/index10-D0AEmZyD.js # apps/kimi-code/dist-web/assets/index10-X5vZpglB.js # apps/kimi-code/dist-web/assets/index5-COtrqpTL.js # apps/kimi-code/dist-web/assets/index5-CR9IbT_I.js # apps/kimi-code/dist-web/assets/index5-DuOTUxfY.js # apps/kimi-code/dist-web/assets/index6-BidN6rkR.js # apps/kimi-code/dist-web/assets/index6-BosaMqz3.js # apps/kimi-code/dist-web/assets/index6-CoOgkfRu.js # apps/kimi-code/dist-web/assets/index8-B3kOd_lN.js # apps/kimi-code/dist-web/assets/index8-BkZ_nVKY.js # apps/kimi-code/dist-web/assets/index8-CkikbLH9.js # apps/kimi-code/dist-web/assets/index9-6cg8BGrC.js # apps/kimi-code/dist-web/assets/index9-BbcZIVAx.js # apps/kimi-code/dist-web/assets/index9-tIE0Vojz.js # apps/kimi-code/dist-web/assets/infoDiagram-FWYZ7A6U-BTsrmCcp.js # apps/kimi-code/dist-web/assets/infoDiagram-FWYZ7A6U-BnROAGmN.js # apps/kimi-code/dist-web/assets/infoDiagram-FWYZ7A6U-i0sqzIdk.js # apps/kimi-code/dist-web/assets/ishikawaDiagram-FXEZZL3T-CD2HXIn9.js # apps/kimi-code/dist-web/assets/ishikawaDiagram-FXEZZL3T-CG4SQ4h6.js # apps/kimi-code/dist-web/assets/ishikawaDiagram-FXEZZL3T-CWi6p4Fs.js # apps/kimi-code/dist-web/assets/journeyDiagram-5HDEW3XC-69Mpdm1i.js # apps/kimi-code/dist-web/assets/journeyDiagram-5HDEW3XC-DN7ziWf0.js # apps/kimi-code/dist-web/assets/journeyDiagram-5HDEW3XC-DoXENIdm.js # apps/kimi-code/dist-web/assets/kanban-definition-HUTT4EX6-BRn8cYnl.js # apps/kimi-code/dist-web/assets/kanban-definition-HUTT4EX6-Cn4uJR7z.js # apps/kimi-code/dist-web/assets/kanban-definition-HUTT4EX6-vX5StZkg.js # apps/kimi-code/dist-web/assets/linear-CDah2Fig.js # apps/kimi-code/dist-web/assets/linear-Cyvch2b1.js # apps/kimi-code/dist-web/assets/linear-eT45Pk4H.js # apps/kimi-code/dist-web/assets/markstream-9V28iECG.js # apps/kimi-code/dist-web/assets/markstream-BD7TOIP5.js # apps/kimi-code/dist-web/assets/markstream-Bi91cHW2.js # apps/kimi-code/dist-web/assets/mermaid.core-BTdvNJFM.js # apps/kimi-code/dist-web/assets/mermaid.core-BigoYC3R.js # apps/kimi-code/dist-web/assets/mermaid.core-CPvYwC1W.js # apps/kimi-code/dist-web/assets/mindmap-definition-LN4V7U3C-B8mfB2gJ.js # apps/kimi-code/dist-web/assets/mindmap-definition-LN4V7U3C-CQgNs0q1.js # apps/kimi-code/dist-web/assets/mindmap-definition-LN4V7U3C-hUFoFMn_.js # apps/kimi-code/dist-web/assets/pegDiagram-2B236MQR-7cr_V7js.js # apps/kimi-code/dist-web/assets/pegDiagram-2B236MQR-DRysFqa8.js # apps/kimi-code/dist-web/assets/pegDiagram-2B236MQR-rHOWnNl6.js # apps/kimi-code/dist-web/assets/pieDiagram-ENE6RG2P-BothDbBB.js # apps/kimi-code/dist-web/assets/pieDiagram-ENE6RG2P-CF2EEouT.js # apps/kimi-code/dist-web/assets/pieDiagram-ENE6RG2P-G7nomqX9.js # apps/kimi-code/dist-web/assets/quadrantDiagram-ABIIQ3AL-BEvlLLL9.js # apps/kimi-code/dist-web/assets/quadrantDiagram-ABIIQ3AL-BzvL4DZU.js # apps/kimi-code/dist-web/assets/quadrantDiagram-ABIIQ3AL-DSWGD1og.js # apps/kimi-code/dist-web/assets/railroadDiagram-RFXS5EU6-C204BVeM.js # apps/kimi-code/dist-web/assets/railroadDiagram-RFXS5EU6-DrzununQ.js # apps/kimi-code/dist-web/assets/railroadDiagram-RFXS5EU6-tMYfgW3B.js # apps/kimi-code/dist-web/assets/requirementDiagram-TGXJPOKE-BDgbCoqu.js # apps/kimi-code/dist-web/assets/requirementDiagram-TGXJPOKE-BwZTxUww.js # apps/kimi-code/dist-web/assets/requirementDiagram-TGXJPOKE-CloEciiT.js # apps/kimi-code/dist-web/assets/sankeyDiagram-HTMAVEWB-4xW6Sp9V.js # apps/kimi-code/dist-web/assets/sankeyDiagram-HTMAVEWB-BXKQrGMx.js # apps/kimi-code/dist-web/assets/sankeyDiagram-HTMAVEWB-aV3OD9GV.js # apps/kimi-code/dist-web/assets/sequenceDiagram-DBY2YBRQ-Bi6rVWH0.js # apps/kimi-code/dist-web/assets/sequenceDiagram-DBY2YBRQ-BnQzDUtU.js # apps/kimi-code/dist-web/assets/sequenceDiagram-DBY2YBRQ-DpzxIYFA.js # apps/kimi-code/dist-web/assets/sizeCapture-X5ZJPWSS-Do5KxOE0.js # apps/kimi-code/dist-web/assets/sizeCapture-X5ZJPWSS-gWXyZzoI.js # apps/kimi-code/dist-web/assets/sizeCapture-X5ZJPWSS-zaoKWXBh.js # apps/kimi-code/dist-web/assets/stateDiagram-2N3HPSRC-BvSRgWBd.js # apps/kimi-code/dist-web/assets/stateDiagram-2N3HPSRC-CSBDJyOQ.js # apps/kimi-code/dist-web/assets/stateDiagram-2N3HPSRC-DbnAxkh4.js # apps/kimi-code/dist-web/assets/swimlanes-5IMT3BWC-CzbmjPLM.js # apps/kimi-code/dist-web/assets/swimlanes-5IMT3BWC-DQZfDcOF.js # apps/kimi-code/dist-web/assets/swimlanes-5IMT3BWC-JtIWmWxC.js # apps/kimi-code/dist-web/assets/timeline-definition-FHXFAJF6-DAdAcwVP.js # apps/kimi-code/dist-web/assets/timeline-definition-FHXFAJF6-DzJM0sQI.js # apps/kimi-code/dist-web/assets/timeline-definition-FHXFAJF6-T9GJ5Hp2.js # apps/kimi-code/dist-web/assets/vennDiagram-L72KCM5P-CPRS6YoG.js # apps/kimi-code/dist-web/assets/vennDiagram-L72KCM5P-C_wspp6X.js # apps/kimi-code/dist-web/assets/vennDiagram-L72KCM5P-DuiLWTnw.js # apps/kimi-code/dist-web/assets/vue.runtime.esm-bundler-BpD3cemV.js # apps/kimi-code/dist-web/assets/vue.runtime.esm-bundler-CSkTYLTh.js # apps/kimi-code/dist-web/assets/vue.runtime.esm-bundler-DrbcV_y0.js # apps/kimi-code/dist-web/assets/wardleyDiagram-EHGQE667-BVtPoREV.js # apps/kimi-code/dist-web/assets/wardleyDiagram-EHGQE667-DaNV0jkS.js # apps/kimi-code/dist-web/assets/wardleyDiagram-EHGQE667-vztNr3wj.js # apps/kimi-code/dist-web/assets/xychartDiagram-FW5EYKEG-C0ZiXh9l.js # apps/kimi-code/dist-web/assets/xychartDiagram-FW5EYKEG-MOZl_6XO.js # apps/kimi-code/dist-web/assets/xychartDiagram-FW5EYKEG-UOnbMUrX.js # apps/kimi-code/dist-web/index.html # packages/agent-core-v2/src/program/program.ts # packages/node-sdk/src/sdk-rpc-client-v2.ts
code-app: 58f637b4642109ad38f9c6a22a4c2e16af489929
code-app: fc4c87dcbc1a4e1fe7aa6f5947f89b7f358b2ca2
code-app: 6d15295b66c9b9c0d6caf5a0adbd7bb53ded447e
code-app: ccbbf58a8db6aa81e106892ab4ea206fbc379c1e
code-app: 8df46fd4ac24caa5667a2463952306347c549580
code-app: 667924aa29d0e33fc96fbded2a8f375bccce1df8
code-app: a641f2f0e0ebd2e366b7a3bfad2bb652d4b51f5a
|
@codex review |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
commit: |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 4522a37f10
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
|
@codex review |
💡 Codex Reviewkimi-code/packages/agent-core-v2/src/app/capability/entries/kimiCu.ts Lines 182 to 185 in f32d0fb  Pass catalog digests into capability installs
Installing Kimi CU from the official catalog always fails because this request omits AGENTS.md reference: AGENTS.md:L127-L129 https://github.com/MoonshotAI/kimi-code/blob/f32d0fb8e874157cb27bdaa8bf26d7a1f33b18fd/apps/kimi-code/dist-web/assets/index-DZx2OsVe.js#L148 For every non-capability ZIP entry opened or installed from the bundled web UI, the synced client sends only AGENTS.md reference: AGENTS.md:L123-L125 kimi-code/apps/kimi-code/src/tui/commands/plugins.ts Lines 331 to 335 in f32d0fb  Keep resolving versions for bare GitHub catalog entries
When a custom marketplace entry uses the documented bare GitHub repository source and omits AGENTS.md reference: AGENTS.md:L111-L113 Revoke plugin OAuth credentials without an active workspace
When a plugin is removed through the app-global REST or SDK API before any workspace instance has been created—for example, immediately after restarting the server—there is no ℹ️ About Codex in GitHubCodex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback". |
|
@codex review |
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0dc6208f81
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: efd6160037
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: efd6160037
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a59f369241
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: bc0e35e728
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 12cdbcc47c
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Redact secrets embedded in MCP arguments and URLs
When an installed plugin places a credential in stdio arguments (for example, args: ["--api-key", "secret"]), the new plugin-detail endpoint returns it verbatim through this field; the remote branch similarly returns the full URL, including any userinfo or query token. Although the manifest, environment values, and header values are now redacted, any caller of GET /api/v1/plugins/{plugin_id} can still recover these credentials, including external desktop/web consumers, so omit or sanitize args and credential-bearing URL components as well.
AGENTS.md reference: AGENTS.md:L122-L124
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
…into feat/plugin-center-marketplace
Requirement or Bug
插件用户需要统一的市场目录、详情预览、安装更新和旧插件迁移；声明 OAuth 的远程 MCP 还需要可控的授权与卸载清理。这个 PR 在 core 建立上述服务端能力，并同步 CLI、SDK 与 Web 产物。
Bug Reproduction Steps
N/A
Root Cause
N/A
Code Changes
核心思路
以
PluginMarketplaceService解析市场目录和安装来源，以PluginService统一编排预览、安装、更新与旧记录迁移；以内容 SHA-256 为主键共享 ZIP 与解析结果；在现有原生 OAuth 管理面上补齐禁用、卸载和授权取消的生命周期。Browser Extension / Computer Use 保留各自 capability 检测与设置流程，只把插件包安装、改名迁移和来源记录接入统一市场链路。flowchart TD A[Desktop / Web / CLI / SDK] --> B[kap-server 插件与 MCP 管理接口] B --> C[PluginService] C --> D[PluginMarketplaceService] D --> E[市场目录与版本解析] C --> F[PluginManager] F --> G[ZIP 磁盘缓存] G --> H[locale-neutral 解析缓存] B --> I[Workspace MCP 配置与 OAuth 生命周期] I --> J[授权取消、回调清理与凭据失效]市场接口返回插件元数据，ZIP 仍从条目的
source下载；预览与安装共享同一 ZIP 获取入口，因此不需要分别下载。OAuth 清理由 server 随配置生命周期执行，避免 UI、重连和代理进程各自决定何时取消授权或清理凭据。1. 插件市场与安装编排
KIMI_CODE_BASE_URL、provider 和 region 配置请求${baseUrl}/plugins/marketplace，不再固定读取 CDN 的marketplace.json。401/403时携带 token 重试。source安装和marketplaceId + expectedVersion安装。PLUGIN_CATALOG_CHANGED，要求刷新目录后重试。2. ZIP 磁盘缓存与详情预览
~/.kimi-code/plugins/cache/archives/<sha256>.zip，按内容寻址；读取时重新校验，损坏或被修改时删除并重下。previewPlugin不写入已安装记录即可返回 MCP 与 Skill 清单；切换 locale 只重新生成文案，不重新下载或解压。3. 插件元数据与能力清单
origin、catalogId、installedAt，区分市场插件、自定义插件和旧记录。defaultLocale、多语言资源以及mcpOverrides/skillOverrides。shortDescription、longDescription和cliDescription。distribution、billing、userLevel等分发字段随目录契约透传。会员、region、billing 的可见性由市场服务端决定；core 本地负责操作系统与官方 capability 是否适用的过滤，不重新实现会员规则。
4. Browser Extension / Computer Use 官方链路
kimi-browser-extension，继续识别旧 IDkimi-webbridge；升级时通过migrateFrom迁移记录并保留安装时间与能力状态。kimi-cu和 Windows 的kimi-cu-win。这里变化的是包来源、命名和旧记录映射，不是把 Browser/CU 简单改成普通插件，也不是重写它们的原生检测链路。
5. MCP OAuth 生命周期
auth: "oauth"的 HTTP/SSE MCP 使用原生 OAuth 管理面；本 PR 重点补齐插件场景下的生命周期收尾。cancelAuthorization取消活动授权流程、中止等待并关闭回调监听。Program将 OAuth 服务注入 workspace MCP 配置管理，确保配置变更触发清理。mcp-remotetoken 不做隐式迁移，切换到原生 OAuth 包后需要一次显式重新授权。6. kap-server、Klient 与 Node SDK
GET /plugins/marketplace，返回合并本地安装版本、启停状态和更新状态的市场目录。POST /plugins/preview，不安装即可读取 MCP 与 Skill 能力。POST /plugins，支持市场 ID、预期版本和旧插件迁移；插件详情支持 locale 与完整能力清单。PLUGIN_CATALOG_CHANGED错误码，并在 Node SDK 中标记为可重试，提示刷新市场。7. CLI / TUI
cliDescription，不再复用 UI 长介绍。8. 市场构建、内置数据与 Web 产物
sha256sum，本地开发市场服务器生成同样的摘要。kimi-browser-extension。apps/kimi-code/dist-web，包含插件市场与 OAuth 界面。阅读指南
packages/agent-core-v2/src/app/plugin/marketplaceService.ts：市场地址、认证、版本和安装来源解析。packages/agent-core-v2/src/app/plugin/pluginService.ts：自定义与市场安装、详情预览和管理读写编排。packages/agent-core-v2/src/app/plugin/manager.ts：ZIP 安装、manifest 校验、能力预览、locale 与解析缓存。packages/agent-core-v2/src/app/plugin/packageCache.ts：ZIP 校验、原子写入、并发去重和 LRU。packages/agent-core-v2/src/app/capability/entries/：Browser Extension / Computer Use 的官方链路与迁移。packages/agent-core-v2/src/mcpCore/oauth/service.ts和workspaceMcpConfigService.ts：OAuth 取消、卸载清理与凭据失效。packages/kap-server/src/routes/plugins.ts和protocol/rest-plugin.ts：插件 HTTP 契约。apps/kimi-code/src/tui/、packages/klient/、packages/node-sdk/：CLI、类型和 SDK 透传；构建脚本、文档、测试与dist-web可随后阅读。Screenshots / Recordings
以下截图来自与本
dist-web同源的 Web UI，使用隔离的临时 home，只读取公开市场插件，没有执行安装或账号授权。插件市场列表与安装入口：
详情中的介绍、MCP 应用和技能：
Behavior Changes and Affected Users
marketplace.json/plugins/marketplace，使用对应认证上下文source安装保持原路径。kimi-webbridge和硬编码 CDN 包kimi-browser-extension，包安装走市场，旧记录可迁移mcp-remotetoken 不迁移，需要一次显式重授权。cliDescription，统一市场状态与来源标签受影响模块与验证
agent-core-v2：市场解析、安装、缓存、旧记录迁移、capability 和 OAuth 生命周期均有对应单元测试。kap-server：市场合并、预览、安装、目录变化、平台过滤和缓存行为由路由测试覆盖。klient/node-sdk：新契约、错误码和 SDK 透传已同步；既有sdk-rpc-client-v2.test.ts102/102 通过。mcpManagement.test.ts58 项与plugins.test.ts26 项，合计 84/84 通过。未完成的验证：没有使用真实 Vercel 账号完成登录，因此真实账号的 token 交换和 Vercel 工具调用仍待验证；没有执行全量回归测试。
Checklist
mcp-remote包与官方 capability 路径保持可用。gen-changesetsskill, or this PR needs no changeset.（已保留插件 OAuth 与 Web UI 的 patch changeset。）gen-docsskill, or this PR needs no doc update.（已检查文档需求，并同步插件与 Server API 中英文文档。）