1 Commits

Author	SHA1	Message	Date
Yige	fb6005cd7b	feat: 新增钉钉官方 CLI 市场入口（含 14 个官方子技能） (#104) ... ## 中文 补齐官方市场里唯一缺失的主流 IM CLI 条目：**钉钉官方命令行工具 `dws`**（npm 包 `dingtalk-workspace-cli`，Apache-2.0，Copyright 2026 Alibaba Group），与已有的 `wecom-cli`、`larksuite-cli` 形成对称。市场此前只有社区的 `dingtalk-api`，覆盖面远小于官方 CLI。 ### 变更 | 文件 | 说明 | | --- | --- | | `skills/dingtalk-cli/entry.json` | 合集指针条目 + 14 个官方子技能 `children` | | `skills/dingtalk-cli/catalog-metadata.v1.json` | 治理 sidecar | | `manifest.json` | `stats.totalSkills` 62 → 63；`version` 1.2.30 → 1.2.31；`lastUpdated` | | `README.md` | 外部条目计数与清单同步 | ### 14 个子技能 `dingtalk-aisearch`、`dingtalk-aitable`、`dingtalk-calendar`、`dingtalk-chat`、`dingtalk-contact`、`dingtalk-doc`、`dingtalk-drive`、`dingtalk-event`、`dingtalk-mail`、`dingtalk-minutes`、`dingtalk-misc`、`dingtalk-shared`、`dingtalk-todo`、`dingtalk-wiki` ### 外部依赖披露 CLI 是**独立分发的第三方软件**，本条目只是市场登记，四处均已声明： - **discovery description**（`entry.json#i18n.<locale>.shortDesc`）：需自行用 npm 安装 `dingtalk-workspace-cli`，需完成钉钉 OAuth 授权登录（**不支持账号密码登录**），DesireCore 不打包、不授权、不安装也不代运营钉钉或该 CLI - **`compatibility.requirements`**（4 条）：CLI 需在 PATH 上、Node.js >= 16.7.0、`dws auth login` 建立的授权会话（缺失时必须在外部调用前停止，禁止编造成功结果）、能力覆盖取决于组织授予的 OAuth 范围与钉钉权益 - **本地化市场文案**：sidecar `presentation.i18n` 与 `entry.json#i18n` 逐字一致，zh-CN / en-US 双语 - **执行说明**：随 CLI 分发的上游 `SKILL.md`，不在本仓库 `redistribution: verify-package-terms` 会让客户端在安装响应里带出条款提示。 ### 来源与治理的取舍（诚实声明） 上游 git 仓库 `https://github.com/open-dingtalk/dingtalk-workspace-cli`（该 URL 是发布方在 npm `package.json#repository` 里自己声明的）**当前对外返回 404，不可公开访问**，因此： - `source` 用 `kind: git` + 该声明 URL，**不写 `ref`**——没有可观察的 commit，不编造固定版本 - 相应地 `provenance.content` 不可变，`governance.availability` 只能是 `listing-only`（`validate_catalog_metadata.py` 的 installable 强证据门禁要求不可变 ref + 已知 license + `reviewedAt` + `compliance`，本条目一样都拿不出） - `governance.license` 保持 `{state: "unknown"}`（`entry.json#license: "Apache-2.0"` 取自发布方声明与包内 LICENSE/NOTICE，但仓库内没有许可证据文件，只产生既有的 `legacy-license-unverified` warning） - `timestamps.reviewedAt` / `releasePublishedAt` 保持 `unknown`；只有 `catalogUpdatedAt` 与 `upstreamObservedAt` 写入真实观察时刻 - `branding` 声明 `independent-listing` / `nominative` / `not-used`：独立登记、名称为指代性使用、未使用对方 Logo（图标是通用终端窗形） - 因为来源未固定，`gen-collection-children.py --check` 会输出 `SKIP`（与既有的 `mattpocock-skills` 同一路径），`children` 由人工按分发件内实际布局 `multi/<id>/` 撰写 ### 校验（已实际执行，全部 exit 0） ``` uv run --quiet scripts/i18n/test_validate_i18n.py exit=0 uv run --quiet scripts/catalog/test_validate_catalog_metadata.py exit=0 uv run --quiet scripts/catalog/test_collection_generator.py exit=0 uv run --quiet scripts/catalog/validate_catalog_metadata.py --require-complete 0 error(s), 117 warning(s). agents=1, builtinSkills=34, pointerSkills=29, publishableSkills=63, collections=8, collectionChildren=161, sidecars=64 exit=0 uv run --quiet scripts/i18n/validate-i18n.py 0 error(s) exit=0 uv run --quiet scripts/i18n/translate.py --check exit=0 uv run --quiet scripts/gen-collection-children.py --check exit=0 ``` 本条目产生的唯一 warning 是 `legacy-license-unverified`，与其余全部 pointer 条目一致。`entry.json` 另经客户端 `marketSkillEntrySchema` 的 Ajv 校验通过。 发布前公开信息边界检查已按 `CLAUDE.md` 执行并通过（工作树全量扫描含隐藏文件、路径名、分支名、commit 文案与本 PR 文本，零结果；令牌清单保存在仓库之外）。 --- ## English Adds the one mainstream IM CLI the official market was still missing: the **official DingTalk CLI `dws`** (npm package `dingtalk-workspace-cli`, Apache-2.0, Copyright 2026 Alibaba Group), making it symmetric with the existing `wecom-cli` and `larksuite-cli` entries. Until now the market only carried the community `dingtalk-api`, whose surface is far smaller. ### Changes | File | Purpose | | --- | --- | | `skills/dingtalk-cli/entry.json` | Collection pointer entry with 14 official sub-skill `children` | | `skills/dingtalk-cli/catalog-metadata.v1.json` | Governance sidecar | | `manifest.json` | `stats.totalSkills` 62 → 63; `version` 1.2.30 → 1.2.31; `lastUpdated` | | `README.md` | External-entry count and list kept in sync | ### External dependency disclosure The CLI is **separately distributed third-party software**; this entry is a marketplace listing only. The dependency is disclosed in all four required places: - **Discovery description** (`entry.json#i18n.<locale>.shortDesc`): the operator installs `dingtalk-workspace-cli` from npm and completes DingTalk OAuth sign-in (**no username-and-password login**); DesireCore does not bundle, license, install or operate DingTalk or this CLI. - **`compatibility.requirements`** (4 entries): the `dws` binary on PATH, Node.js >= 16.7.0, an operator-authorized session from `dws auth login` (without it the skills must stop before the external call and must never fabricate a successful result), and the fact that capability coverage depends on the organization's granted OAuth scopes and DingTalk entitlements. - **Localized marketplace text**: sidecar `presentation.i18n` matches `entry.json#i18n` verbatim, in both zh-CN and en-US. - **Execution instructions**: the upstream `SKILL.md` files shipped with the CLI, outside this repository. `redistribution: verify-package-terms` makes the client surface a terms notice on install. ### Source and governance trade-off (stated plainly) The upstream git repository `https://github.com/open-dingtalk/dingtalk-workspace-cli` — the URL the publisher itself declares in the npm `package.json#repository` — **currently returns 404 and is not publicly readable**. Therefore: - `source` uses `kind: git` with that declared URL and **no `ref`**: there is no observable commit, and inventing a pinned one is not acceptable. - Content provenance is consequently not immutable, so `governance.availability` can only be `listing-only` (the installable evidence gate in `validate_catalog_metadata.py` requires an immutable ref, a known license, `reviewedAt` and `compliance`; none of these exist here). - `governance.license` stays `{state: "unknown"}`. `entry.json#license: "Apache-2.0"` reflects the publisher's declaration and the LICENSE/NOTICE shipped in the package, but there is no license evidence file in this repository, so only the existing `legacy-license-unverified` warning is produced. - `timestamps.reviewedAt` and `releasePublishedAt` stay `unknown`; only `catalogUpdatedAt` and `upstreamObservedAt` carry real observed values. - `branding` declares `independent-listing` / `nominative` / `not-used`: an independent listing, nominative use of the product name, and no third-party logo (the icon is a generic terminal-window glyph). - Because the source is unpinned, `gen-collection-children.py --check` reports `SKIP` (the same path the existing `mattpocock-skills` entry takes). The `children` list was written by hand against the `multi/<id>/` layout actually observed in the distributed skill bundle. ### Validation (actually executed, all exit 0) All seven checks from `.github/workflows/i18n-validate.yml` were run locally and passed; the only warning attributable to this entry is `legacy-license-unverified`, matching every other pointer entry. `entry.json` additionally validates against the client's `marketSkillEntrySchema` under Ajv. The pre-publication public-information-boundary check in `CLAUDE.md` was performed and passed with a zero-result scan across the working tree (hidden files included), path names, branch name, commit text and this PR text. The search tokens are kept outside the repository. --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Co-authored-by: yi-ge <jackyoncode@gmail.com>	2026-09-02 06:25:24 -04:00