feat(kilo): add ZERO-294 Kilo Code adapter

[spencercharest]

Summary

Subtask: ZERO-313 under ZERO-294.

Adds a Kilo Code adapter for Zero without modifying guides/agent-install.md:

• adds plugins/zero-kilo/ overlay with Kilo project skills, config, rule, workflow command, remote skills.urls payload, marketplace MCP payload, and legacy .kilocode/mcp.json compatibility payload
• adds scripts/build-kilo.sh to assemble dist/zero-kilo/
• adds standalone consumer guide guides/kilo-code.md and links it from README
• adds plugins/zero-kilo/manifest.json to MANIFESTS and bumps versioned manifests to 1.4.0 with make minor

Official sources used

• Kilo skills docs: https://kilo.ai/docs/customize/skills
• Kilo workflows/slash commands docs: https://kilo.ai/docs/customize/workflows
• Kilo MCP docs: https://kilo.ai/docs/automate/mcp/using-in-kilo-code
• Kilo custom rules docs: https://kilo.ai/docs/customize/custom-rules
• Kilo Marketplace repo: https://github.com/Kilo-Org/kilo-marketplace

Install and update flow

Human in-harness flow:

1. Run curl -fsSL https://zero.xyz/install.sh | bash once for the shared Zero runner/runtime.
2. Run scripts/build-kilo.sh in this repo.
3. Copy dist/zero-kilo/. into the target project.
4. In Kilo Code, open Settings > Agent Behaviour > MCP Servers and confirm the zero server from .kilo/kilo.jsonc.
5. Start a new Kilo session so skills/rules are re-scanned.
6. Use /zero or ask Kilo to help set up and test Zero.

Terminal flow:

curl -fsSL https://zero.xyz/install.sh | bash
scripts/build-kilo.sh
cp -R dist/zero-kilo/. /path/to/your/project/

Update flow:

curl -fsSL https://zero.xyz/install.sh | bash
scripts/build-kilo.sh
cp -R dist/zero-kilo/. /path/to/your/project/

Kilo has no documented lifecycle hooks for auto-provision/update, so this adapter intentionally does not ship hooks.

Proposed guides/agent-install.md notes

Do not merge these into guides/agent-install.md in this PR. Collect them later during the runbook rewrite.

• Kilo Code reads project skills from .kilo/skills/, compatibility skills from .agents/skills/ and .claude/skills/, and remote skills from skills.urls entries serving an index.json manifest.
• Current Kilo MCP config belongs in .kilo/kilo.jsonc or project-root kilo.jsonc under mcp.zero.type = "remote" and url = "https://mcp.zero.xyz".
• Keep permission empty by default. Only add verified read-only MCP tool permissions later.
• Include .kilo/rules/zero.md through the config instructions array.
• Include /zero as .kilo/commands/zero.md with description and agent frontmatter.
• Keep .kilocode/mcp.json only as a legacy compatibility payload.
• Kilo Marketplace covers Skills, MCP Servers, and Modes, with no documented multi-component bundle. Submit Zero skill and MCP separately or use a hosted skills.urls payload.
• Runner install/update remains curl -fsSL https://zero.xyz/install.sh | bash; project template updates are manual via scripts/build-kilo.sh and copying dist/zero-kilo/.

Verification

Local checks:

scripts/build-kilo.sh --tar dist/zero-kilo.tgz
jq . plugins/zero-kilo/manifest.json \
  plugins/zero-kilo/kilo/kilo.jsonc \
  plugins/zero-kilo/kilo/legacy-mcp.json \
  plugins/zero-kilo/kilo/marketplace-mcp.json \
  plugins/zero-kilo/kilo/remote-skills/index.json \
  dist/zero-kilo/.kilo/kilo.jsonc \
  dist/zero-kilo/.kilocode/mcp.json
make version
cmp plugins/zero/skills/zero/SKILL.md dist/zero-kilo/.kilo/skills/zero/SKILL.md
cmp plugins/zero/skills/zero/SKILL.md dist/zero-kilo/.agents/skills/zero/SKILL.md
cmp plugins/zero/skills/zero/SKILL.md dist/zero-kilo/.claude/skills/zero/SKILL.md
cmp plugins/zero/skills/zero/SKILL.md dist/zero-kilo/kilo/remote-skills/zero/SKILL.md
tar -tzf dist/zero-kilo.tgz | sort
git diff --check
git diff -- guides/agent-install.md

Docker copied-auth Zero smoke test:

ts="$(date -u +%Y%m%dT%H%M%SZ)"
docker run --rm --name zero-313-kilo-e2e \
  -v "$PWD":/repo \
  -v "$HOME/.zero":/host-zero:ro \
  --env-file /Users/spencercharest/zeroclick/env \
  -e TEST_TS="$ts" \
  node:22-bookworm-slim bash -lc '
set -euo pipefail
cd /repo
cp -R /host-zero "$HOME/.zero"
chmod -R go-rwx "$HOME/.zero" || true
npm install -g @zeroxyz/cli@latest >/tmp/npm-install.log 2>&1
zero --help >/tmp/zero-help.txt
zero auth whoami --json >/tmp/zero-whoami.json
scripts/build-kilo.sh --tar dist/zero-kilo-docker.tgz >/tmp/build-kilo.log
node -e "for (const f of [\"plugins/zero-kilo/manifest.json\",\"plugins/zero-kilo/kilo/kilo.jsonc\",\"plugins/zero-kilo/kilo/legacy-mcp.json\",\"plugins/zero-kilo/kilo/marketplace-mcp.json\",\"plugins/zero-kilo/kilo/remote-skills/index.json\",\"dist/zero-kilo/.kilo/kilo.jsonc\",\"dist/zero-kilo/.kilocode/mcp.json\"]) JSON.parse(require(\"fs\").readFileSync(f,\"utf8\"));"
cmp plugins/zero/skills/zero/SKILL.md dist/zero-kilo/.kilo/skills/zero/SKILL.md
cmp plugins/zero/skills/zero/SKILL.md dist/zero-kilo/.agents/skills/zero/SKILL.md
cmp plugins/zero/skills/zero/SKILL.md dist/zero-kilo/.claude/skills/zero/SKILL.md
cmp plugins/zero/skills/zero/SKILL.md dist/zero-kilo/kilo/remote-skills/zero/SKILL.md
zero search "static file CDN upload" >/tmp/zero-search.txt
zero get 1 --formatted >/tmp/zero-get.txt
body="ZERO-313 Kilo Docker copied-auth CDN upload check ${TEST_TS}"
data=$(printf "%s" "$body" | base64 | tr -d "\n")
DATA="$data" node -e "const fs=require(\"fs\"); const data=process.env.DATA; const ts=process.env.TEST_TS; fs.writeFileSync(\"/tmp/zero-cdn-body.json\", JSON.stringify({kind:\"file\", slug:\"agent-harness-e2e-kilo-docker-\"+ts+\".txt\", data, cacheTtlSeconds:3600}));"
zero fetch --json --capability cdn-withzero-xyz-static-site-file-cdn-upload-a0d9f22f https://cdn.withzero.xyz/api/v1/uploads -d @/tmp/zero-cdn-body.json --max-pay 0.001 >/tmp/zero-fetch.json
node -e "const r=JSON.parse(require(\"fs\").readFileSync(\"/tmp/zero-fetch.json\",\"utf8\")); if(!r.ok) throw new Error(JSON.stringify(r)); console.log(JSON.stringify({runId:r.runId,payment:r.payment,body:r.body}, null, 2));"
'

Copied ~/.zero: yes.

Zero result:

• run ID: run_b1KUxriA4WjXSs3C5jFUm
• returned URL: https://cdn.withzero.xyz/LolkTqxW/agent-harness-e2e-kilo-docker-20260615T005532Z.txt
• returned body verified with curl -fsSL
• payment: 0 USDC via mpp on tempo

No zero review was run.

Note: two earlier CDN attempts in Docker reached Zero auth/payment but failed before upload because I initially used the old CDN body shape / then passed the generated base64 env var incorrectly. Both reported 0 USDC payment. The final run above passed.

Claude-style plugin compatibility and simpler install option

Full Claude Code plugin package support: No. Kilo Code can read compatibility skill directories including .claude/skills/, but it does not install Claude Code .claude-plugin packages as a full plugin artifact.

What this means for users:

• If we only need skill + MCP, Kilo can be much simpler than this adapter: publish/host the Zero skill through Kilo's remote skills.urls flow and provide the remote MCP entry for https://mcp.zero.xyz.

• Consumer-friendly full-template flow should avoid local builds:

  1. Add the hosted Zero skill URL or install the Zero skill from Kilo Marketplace.
  2. Add Zero MCP from Kilo Marketplace or merge the remote MCP entry.
  3. Optionally extract the prebuilt zero-kilo template for rules/commands.
  

• Keep scripts/build-kilo.sh as release packaging only. The simpler hosted skill + MCP route is likely the better maintenance tradeoff unless rules/commands materially improve the experience.

GitHub Releases / no-build install check

Result: GitHub-hosted skill distribution yes; Gemini-style release-asset install for the full adapter no. Kilo docs say the new platform does not yet have a marketplace UI, but skills can be found through the Kilo Marketplace GitHub repo, manually downloaded, or loaded directly through skills.urls remote URLs.

Best no-build consumer path:

1. Add a hosted Zero skill index URL to Kilo `skills.urls`, or install the Zero skill from the Kilo Marketplace repository once listed.
2. Add the Zero remote MCP entry for https://mcp.zero.xyz.
3. Use a prebuilt `zero-kilo` artifact only if rules/commands are worth it.

A GitHub Release tarball can package zero-kilo to avoid scripts/build-kilo.sh, but Kilo's stronger no-build path is a hosted remote skill URL plus MCP listing/config. That is probably the better maintenance tradeoff than a release archive.

PR status

Draft. The package, build, copied-auth Zero runner path, search/get/fetch, and returned CDN file are verified in Docker, but I could not verify the full Kilo Code VS Code extension/CLI product loading path in a local headless harness.

[spencercharest]

Folded into #63 as a matrix entry (kilo-code in plugins/zero/agents.json) — standalone skills (~/.kilo/skills + ~/.agents/skills) + MCP data for ~/.config/kilo/kilo.jsonc. No hooks (no hooks key in kilo.jsonc; lifecycle hooks are an open feature request) and no qualifying install (kilo plugin installs npm JS modules; marketplace listings unpublished). #63 notes the promising native freshness path: a Zero-hosted remote-skill index via skills.urls. The adapter-template work here stays available on this branch if we later ship per-host templates.