## What changed
- teach the one-line macOS/Linux and Windows installers to detect DSH,
install the AgentKey skill globally, and invoke the DSH device-code MCP
writer without passing `dsh` to `skills add -a`
- remove only top-level AgentKey managed blocks during uninstall while
preserving marker-prefix collisions, YAML block scalars, malformed
blocks, and unrelated patches
- add a DSH-specific Skill setup branch explaining why DSH rc.7 must use
device-code Bearer authentication instead of generic MCP OAuth
- document the home-level patch, safe legacy migration, symlink-profile
behavior, HMR limits, tool-policy limits, and actual readiness checks in
English and Chinese
- route the Kimi plugin through the client-attributed
`https://api.agentkey.app/kimi/v1/mcp` alias while keeping its native
OAuth flow and the same AgentKey MCP surface
- add macOS/Linux Bats coverage, an attributed endpoint contract, and a
Windows PowerShell marker regression gate
## Why
DSH users need one global AgentKey integration across current and future
profiles without selecting an AgentKey preset. DSH 0.1.0-rc.7 cannot
complete the generic header-free MCP OAuth flow, so the public setup and
self-repair guidance must consistently route DSH through `@agentkey/cli
--auth-login --only dsh`.
Kimi uses a client-attributed MCP path so Server telemetry and routing
can identify the originating client without changing Kimi's OAuth or
tool behavior.
## User impact
After the Server and CLI dependency are released, DSH users can run the
normal one-line installer or the documented two-step flow. They verify
success by checking the `agentkey` Loader row and then calling
`find_tools`, `describe_tool`, and `execute_tool`; Mounted/active alone
is not treated as a successful MCP connection.
Kimi plugin users continue to authenticate with the existing native
OAuth command; only the remote path changes to the attributed alias.
## Validation
- `bats tests/` (41/41)
- `bash -n scripts/install.sh`
- `bash -n scripts/uninstall.sh`
- Windows marker regression is configured on `windows-latest`
- `git diff --check`
## Release dependency
- Server/CLI implementation:
https://github.com/chainbase-labs/AgentKey-Server/pull/241
- deploy and verify the Server routes first
- publish and canary `@agentkey/cli@1.0.4` second
- release these installers, Skill changes, Kimi route, and public
documentation last
This is a CLI-managed DSH MCP integration, not a native installable DSH
plugin.
---------
Co-authored-by: Allen <0xfatdog@gmail.com>
## Summary
- add a Kimi Code plugin manifest with an inline AgentKey MCP server
definition
- use Kimi's native MCP OAuth flow while keeping browser login explicit
through `/mcp-config login plugin-agentkey:agentkey`
- document the required `/reload`, browser authorization, local-plugin
update flow, and legacy global MCP cleanup
- include the Kimi manifest in release-please and version-sync checks
- add regression coverage for the Kimi manifest shape and OAuth
configuration
## Why
Kimi requires `mcpServers` to be declared inline in the plugin manifest.
The previous path-based configuration was not loaded as a plugin MCP
server, so installation did not produce the expected MCP-aware reload
guidance. With the corrected manifest, Kimi recognizes the MCP server
during installation and shows its standard `/new` or `/reload` prompt.
After reloading, the user completes Kimi's native browser OAuth flow
explicitly with `/mcp-config login plugin-agentkey:agentkey`.
## User impact
After installing the plugin, users receive the reload guidance from
Kimi. They run `/reload`, follow Kimi's OAuth prompt with `/mcp-config
login plugin-agentkey:agentkey`, approve the browser authorization, and
can then use AgentKey normally.
## Validation
- installed the local plugin with Kimi Code CLI 0.31.1 and confirmed the
success screen reports one MCP server plus `Run /new or /reload to apply
plugin changes.`
- verified the managed Kimi plugin copy matches the repository manifest
- validated the Kimi manifest shape and native-OAuth constraints
- verified all six release version values remain synchronized at 1.12.1
- parsed the modified GitHub Actions workflows as YAML
- ran `git diff --check`
The repository CI runs the full Bats suite on Ubuntu and macOS.
---------
Co-authored-by: Allen <0xfatdog@gmail.com>
lxcong