v0.9.8: ship Kimi-level plugin system and federated marketplaces

[Hmbown]

Problem

Codewhale already has a strong plugin security and installation foundation, but it does not yet feel like a complete plugin product.

Today Codewhale ships Agent Plugins v1 plugin.json parsing (plus legacy plugin.toml), local/GitHub/tarball install and update, immutable workspace registries, hash-bound capability review, trust/enable/disable/revoke/reload, and active Skill + MCP contributions. Commands, agents/profiles, hooks, LSP, and native declarations are recognized but inactive. /plugin is still primarily a transcript command, and there is no marketplace index.

Kimi Code demonstrates the product/runtime outcome we want: a real marketplace and manager, versioned manifests, app/workspace/agent lifecycle projection, Skills, agent profiles, commands, MCP, hooks, session-start guidance, install/update state, and explicit behavior when plugins change during a live session. Claude Code provides the broader marketplace ecosystem and an established catalog format.

The goal is Kimi-level plugin outcome parity on Codewhale's stronger trust model, plus compatible Claude/Kimi/Codewhale marketplace discovery. This is outcome parity, not a TypeScript architecture port and not a second agent runtime.

Product contract

One federated marketplace

• Bare /plugin and /plugins open a first-class extensions manager. Scriptable subcommands remain stable for headless use and recovery.
• The manager can browse three catalog sources through one normalized candidate model:
  • a small Codewhale-curated catalog;
  • compatible Claude Code .claude-plugin/marketplace.json catalogs;
  • compatible Kimi plugins/marketplace.json catalogs.
• Each normalized candidate records source, publisher/provenance, catalog tier, version/ref/SHA when available, declared components, and per-component compatibility.
• One malformed catalog entry degrades that entry; it must not make every other marketplace/plugin disappear.
• Catalog labels such as official or curated are provenance only. They never inherit trust. Every installed plugin enters Codewhale disabled and untrusted and goes through the existing content/capability hash review.
• Compatibility is explicit: full, partial with named inactive components, or unsupported with a reason. Never imply that a Kimi/Claude plugin is runnable merely because it is listed.

One runtime and lifecycle

• Skills and MCP continue through the existing reviewed staged-tree adapters.
• Plugin commands become namespaced executable prompt/command contributions and cannot bypass command safety, approvals, or receipts.
• Plugin agent definitions become reviewed Fleet/profile contributions. Fleet remains the sole scheduler and owner of workspace authority, lifecycle, cancellation, write claims, usage, and receipts. Plugins do not get a second sub-agent executor.
• Plugin hooks use Codewhale's existing hook policy/executor and must declare and review their lifecycle mutation and filesystem/network authority.
• Kimi-style system prompt/session-start guidance is bounded, reviewed, attributable to the plugin, and frozen for the live session.
• A plugin install/enable/disable/update during a live session does not silently mutate that session's prompt or tool set. The UI reports the change and requires /reload or a new session to apply it.
• LSP/native/other unsupported declarations remain fail-closed and visibly partial until their adapters and authority models exist.

Manager behavior

• Installed and marketplace views support search, status/source filters, stable selection, component detail, trust state, compatibility, version/update state, and actionable empty/loading/error states.
• Install, update, uninstall, enable, disable, revoke, validate, reload, and per-MCP-server enablement invoke the same typed lifecycle operations as the command surface.
• Trust review displays the existing bounded capability digest and exact confirmation token. No modal action can bypass review or approval.
• Keyboard, mouse, narrow terminals, localization, reduced motion, restart, workspace switch, and session reload are covered.
• Desktop/web consumers use typed Runtime API list/action receipts rather than scraping TUI prose.

v0.9.8 acceptance

• Extensions manager ships on top of the existing PluginRegistry and state file.
• Claude, Kimi, and Codewhale catalog adapters normalize into one candidate type with fault isolation and compatibility reporting.
• Existing Skill/MCP plugins install from marketplace candidates and still enter disabled/untrusted.
• Agent/profile and command contributions work end to end through Fleet/the normal prompt pipeline.
• Kimi-style session-start/system guidance and live-session freeze/reload behavior are implemented and tested.
• Plugin hooks either ship through the existing reviewed hook boundary or remain an explicitly blocking parity gap; the release must not call the system Kimi-parity while silently ignoring them.
• PTY tests prove manager navigation and mutations; command tests prove the scripted path reaches the same lifecycle; focused runtime tests prove trust, compatibility, session freeze, and Fleet authority.
• cargo fmt --all -- --check, focused tests, source/runtime budgets, and a human terminal pass are green on current main.

Follow-on compatibility

Claude-specific LSP/monitor surfaces and native extensions may continue in v0.9.9 only when the v0.9.8 manager reports them honestly as partial/unsupported. They are not required for Kimi parity, but they remain required for broader Claude ecosystem parity.

Reference implementations

• Kimi manifest, manager, marketplace, and lifecycle:
  • MoonshotAI/kimi-code/plugins/marketplace.json
  • MoonshotAI/kimi-code/packages/agent-core-v2/src/app/plugin/
  • MoonshotAI/kimi-code/packages/agent-core-v2/src/agent/plugin/
  • MoonshotAI/kimi-code/packages/agent-core-v2/src/workspace/workspaceSkillCatalog/pluginSkillSource.ts
  • MoonshotAI/kimi-code/packages/agent-core-v2/src/workspace/workspaceAgentProfileLoader/pluginAgentProfileLoader.ts
  • MoonshotAI/kimi-code/apps/kimi-code/src/tui/components/dialogs/plugins-selector.ts
• Claude marketplace and component contract:
  • https://code.claude.com/docs/en/plugin-marketplaces
  • https://code.claude.com/docs/en/plugins-reference
• Existing Codewhale seams:
  • crates/tui/src/plugins/
  • crates/tui/src/commands/groups/plugins/
  • docs/PLUGIN_BUNDLES.md
  • docs/PLUGINS.md

Boundaries

No auto-install, no auto-trust, no inherited vendor trust, no arbitrary marketplace claims, no duplicate plugin database, no plugin-owned Fleet scheduler, no silent inactive components, and no release claim based only on parsing a foreign manifest.