## 摘要 / Summary
**中文**：新增市场第 2 个 Agent 条目
`dingtalk-workspace`（钉钉工作台助手），作为钉钉全产品能力的**发现入口**。条目只提供发现元数据与治理事实，Agent
正文不在本仓库分发。
**English**: Adds the marketplace's second Agent listing,
`dingtalk-workspace` (DingTalk Workspace Assistant), as a **discovery
entry** for DingTalk's product surface. The listing carries discovery
metadata and governance facts only; the Agent's own content is not
distributed from this repository.
## 变更 / Changes
| 文件 / File | 说明 / Note |
| --- | --- |
| `agents/dingtalk-workspace/agent.json` | 市场展示元数据，zh-CN + en-US 双语 /
Market display metadata, zh-CN + en-US |
| `agents/dingtalk-workspace/catalog-metadata.v1.json` | 治理 sidecar /
Governance sidecar |
| `agents/dingtalk-workspace/assets/avatar.webp` | 512×512 中性图形头像 /
Neutral 512×512 avatar |
| `manifest.json` | `totalAgents` 1 → 2；version 1.2.30 →
1.3.0；lastUpdated |
| `README.md` | Agent 计数与目录示意 / Agent count and repository shape |
## 条目形态：可安装 / Shape: installable
**中文**：条目随附完整 Agent 正文（`persona.md`、`principles.md`、2 个 Skill、13
篇文档），安装后即得到完整可用的 Agent。
治理字段取值与理由：
| 字段 | 取值 | 理由 |
| --- | --- | --- |
| `installPolicy` / `updatePolicy` | `market` / `market` |
正文已在条目内，Market 负责安装与更新。这也避开了
`isMarketAgentMetadataOnly()`（`sync/market.ts:113-128`）——它只在
`system`+`repository` 时返回 true，另一条分支是对 `desirecore` 的 id 硬编码特判，本条目不适用 |
| `release` | `known` `1.0.0` `semver` | 非 system Agent 时
`validate_catalog_metadata.py:625-630` 要求 `release` 保留 legacy `version`
|
| `timestamps.releasePublishedAt` | `2026-09-01` | 本次发布日 |
| `governance.availability` | `listing-only` | 见下 |
**为什么 `availability` 不是
`installable`**：`validate_catalog_metadata.py:650-712` 的强证据门禁要求不可变
`provenance.content`（git 40 位 SHA 或 sha256）+ 已知 license + 已知
`reviewedAt` + `compliance`。本条目正文就在本仓库这次提交里，无法自指一个尚不存在的固定
ref；未做治理审查，也不会编造 `reviewedAt` 与许可证据。`listing-only`
在本仓库既有先例（`wecom-cli`、`larksuite-cli` 都是 `listing-only`
且实际可安装），且客户端不读该字段——真正决定可安装性的是 `installPolicy`。
**English**: The listing ships the complete Agent content (`persona.md`,
`principles.md`, 2 Skills, 13 documents), so installing yields a fully
working Agent.
| Field | Value | Rationale |
| --- | --- | --- |
| `installPolicy` / `updatePolicy` | `market` / `market` | Content lives
in the listing, so Market owns install and update. This also avoids
`isMarketAgentMetadataOnly()` (`sync/market.ts:113-128`), which returns
true only for `system`+`repository`; its other branch is an id-hardcoded
special case for `desirecore` that does not apply here |
| `release` | `known` `1.0.0` `semver` | For a non-system Agent,
`validate_catalog_metadata.py:625-630` requires `release` to preserve
the legacy `version` |
| `timestamps.releasePublishedAt` | `2026-09-01` | Publication date |
| `governance.availability` | `listing-only` | See below |
**Why `availability` is not `installable`**: the strict evidence gate at
`validate_catalog_metadata.py:650-712` requires an immutable
`provenance.content` (40-hex Git SHA or sha256) plus a known license, a
known `reviewedAt`, and `compliance`. This listing's content lives in
this very commit, so it cannot pin a ref that does not yet exist; no
governance review was performed, and no `reviewedAt` or license evidence
will be invented. `listing-only` has precedent here (`wecom-cli` and
`larksuite-cli` are both `listing-only` yet installable in practice),
and the client does not read the field — installability is actually
decided by `installPolicy`.
### agent.json 的双重身份 / agent.json serves two contracts
**中文**：安装时整个 `agents/<id>/` 目录被 `cpSync` 到
`~/.desirecore/agents/<id>/`（`market-routes.ts:1228-1252`），因此这个
`agent.json` **同时**是市场展示元数据和 AgentFS 运行时配置。已把源 Agent 的运行时配置并入（`llm` 智能路由
flagship、`heartbeat`、`session_mode`、`env`、`mcp_servers`、并发上限等）。
已知副作用：两套 Schema 在 10 个字段上不相交（市场侧的 `category` / `updatedAt` /
`maintainer` / `i18n` / `persona` / `changelog` / `installPolicy` /
`updatePolicy`，以及 `avatar.t` / `avatar.bg`），AgentFS 侧
`agentConfigSchema` 是 `additionalProperties: false`，`id` 还要求 UUID
形态。因此安装后
`parseAgentJsonText`（`agent/reader.ts:375-397`）会走宽松解析分支，每个进程打印一条
warning。宽松分支原样返回解析结果，配置全部生效——已实测确认（见下）。这是「内联可安装 Market
Agent」这一形态固有的，本仓库此前没有先例。
**English**: On install the whole `agents/<id>/` directory is
`cpSync`-ed into `~/.desirecore/agents/<id>/`
(`market-routes.ts:1228-1252`), so this `agent.json` is
**simultaneously** the marketplace display metadata and the AgentFS
runtime config. The source Agent's runtime configuration has been merged
in (`llm` smart routing at flagship tier, `heartbeat`, `session_mode`,
`env`, `mcp_servers`, concurrency cap).
Known side effect: the two schemas are disjoint on 10 fields
(market-side `category`, `updatedAt`, `maintainer`, `i18n`, `persona`,
`changelog`, `installPolicy`, `updatePolicy`, plus `avatar.t` /
`avatar.bg`), AgentFS's `agentConfigSchema` is `additionalProperties:
false`, and its `id` expects a UUID shape. So after install,
`parseAgentJsonText` (`agent/reader.ts:375-397`) takes the lenient
branch and prints one warning per process. That branch returns the
parsed object as-is, so every setting still applies — verified below.
This is inherent to the "inline installable Market Agent" shape, which
has no prior precedent in this repository.
## 外部依赖披露 / External dependency disclosure
**中文**：本 Agent 依赖一个由第三方独立分发的命令行程序，并需要用户自行完成钉钉账号 OAuth 授权。按仓库
`CLAUDE.md`「External dependency disclosure」要求，已在四处披露：
1. **发现描述** — `agent.json#i18n.<locale>.shortDesc`（zh-CN 与 en-US 各一份）
2. **`compatibility` 字段** — sidecar `compatibility.requirements[]`，4
条：runtime（用户自行安装第三方 CLI）、runtime（官方产品技能需手工拷贝且每次升级重做）、permission（钉钉账号
OAuth，能力范围取决于授权范围）、connection（网络与所在组织已开通的产品/权益）
3. **本地化市场文案** — `agent.json#i18n.<locale>.fullDesc` 与 sidecar
`presentation.i18n.<locale>.description` 中的「外部依赖声明」整节
4. **执行约定** — 同一节明确：依赖不可用（未安装 / 未授权 / 无权限 /
组织未开通）时，在发起外部调用**之前**停止并如实说明，**不编造成功结果**
明确声明 DesireCore
**不打包、不分发、不授权、不安装、不代付、不运营**该程序及其背后的产品；凭据与费用由用户与服务方之间的条款约束。
**English**: This Agent depends on an independently distributed
third-party CLI and requires the user's own account OAuth. Per
`CLAUDE.md` "External dependency disclosure", it is disclosed in all
four required places:
1. **Discovery description** — `agent.json#i18n.<locale>.shortDesc`, in
both zh-CN and en-US
2. **`compatibility` field** — sidecar `compatibility.requirements[]`,
four entries: runtime (user installs the third-party CLI), runtime
(official product skills must be copied manually and re-copied after
each upgrade), permission (account OAuth; coverage depends on granted
scopes), connection (network plus the products and entitlements enabled
for the user's own organization)
3. **Localized marketplace text** — the "External dependency disclosure"
section inside `agent.json#i18n.<locale>.fullDesc` and sidecar
`presentation.i18n.<locale>.description`
4. **Execution instructions** — the same section states that when the
dependency is unavailable (not installed, not authorized, not permitted,
or not enabled), the Agent stops **before** the external call and never
fabricates a successful result
It states explicitly that DesireCore does **not bundle, distribute,
license, install, pay for, or operate** that program or the products
behind it; credentials and fees are governed by terms between the user
and the service provider.
## 品牌与商标 / Branding
**中文**：`branding.relationship: independent-listing` / `nameUsage:
nominative` / `logoStatus: not-used`。头像是自制的中性图形（对话气泡 + 终端提示符
`>_`，表达「自然语言意图 → 命令调用」），**未使用任何第三方 logo 或商标图形**。
**English**: `branding.relationship: independent-listing` / `nameUsage:
nominative` / `logoStatus: not-used`. The avatar is an original neutral
mark (a speech bubble containing a `>_` terminal prompt, expressing
"natural-language intent becomes a command call"). **No third-party logo
or trademark artwork is used.**
## 未审查的事实保持 unknown / Unverified facts left unknown
**中文**：未做治理审查，因此
`governance.license`、`timestamps.reviewedAt`、`timestamps.releasePublishedAt`、`timestamps.upstreamObservedAt`、`release`
一律如实为 `unknown`，不编造许可证据或审查时间。`compatibility.platforms` 同样为
`unknown`——实际只在 macOS 上验证过，不宣称未验证的平台。
**English**: No governance review was performed, so
`governance.license`, `timestamps.reviewedAt`,
`timestamps.releasePublishedAt`, `timestamps.upstreamObservedAt`, and
`release` are all honestly `unknown`; no license evidence or review date
is invented. `compatibility.platforms` is likewise `unknown` — only
macOS was actually exercised, and untested platforms are not claimed.
## 校验 / Validation
**中文**：按 `.github/workflows/i18n-validate.yml` 的顺序在本地跑完 7 步，全部 `exit
0`；`0 error(s)`，116 warning 全部是主干既有条目的历史告警，**新条目零告警**。
**English**: All seven steps from `.github/workflows/i18n-validate.yml`
were run locally in order; every step exited `0`. `0 error(s)`; all 116
warnings are pre-existing on `main` for other listings — **the new
listing produces none**.
```
exit=0 errors=0 新条目命中=0 <-- scripts/i18n/test_validate_i18n.py
exit=0 errors=0 新条目命中=0 <-- scripts/catalog/test_validate_catalog_metadata.py
exit=0 errors=0 新条目命中=0 <-- scripts/catalog/test_collection_generator.py
exit=0 errors=0 新条目命中=0 <-- scripts/catalog/validate_catalog_metadata.py --require-complete
exit=0 errors=0 新条目命中=0 <-- scripts/i18n/validate-i18n.py
exit=0 errors=0 新条目命中=0 <-- scripts/i18n/translate.py --check
exit=0 errors=0 新条目命中=0 <-- scripts/gen-collection-children.py --check
0 error(s), 116 warning(s). agents=2, builtinSkills=34, pointerSkills=28,
publishableSkills=62, collections=7, collectionChildren=147, sidecars=64
```
另外用客户端契约做了运行时验证：按 `readAgentDetail` 的归一化逻辑（i18n 拍平 + changelog 按 locale
解析 + system 策略下 `version` → `metadataRevision`）还原 detail
对象后，`validateMarketAgent` 在 zh-CN 与 en-US 下均 PASS。
Additionally verified against the client contract: after reproducing
`readAgentDetail`'s normalization (i18n flattening, per-locale changelog
resolution, and `version` → `metadataRevision` under the system policy),
`validateMarketAgent` PASSes for both zh-CN and en-US.
### 安装验证 / Install verification
**中文**：用 agent-service 的**真实导出函数**复刻 `market-routes.ts:1185-1260`
的安装流水线（`skillCopyFilter`、`computeCapabilityContentDigest`、`isMarketAgentMetadataOnly`、`extractAgentVersion`、`parseAgentJsonText`），在
vitest unit project 中执行。
**English**: The install pipeline from `market-routes.ts:1185-1260` was
reproduced using agent-service's **real exported functions**
(`skillCopyFilter`, `computeCapabilityContentDigest`,
`isMarketAgentMetadataOnly`, `extractAgentVersion`,
`parseAgentJsonText`) and executed inside the vitest unit project.
```
[1] isMarketAgentMetadataOnly = false => 放行可装
[2] cpSync ok; source=cb8c961bb55b9abe… staged=cb8c961bb55b9abe…
[3] installedVersion = 1.0.0
[5] 应存在 19 项，缺失 0 项
[6] parseAgentJsonText => 可用配置
name=钉钉工作台助手 llm.routingMode=smart tier=flagship
max_concurrent_sessions=3 accepts_messages=true
avatar.image.path=assets/avatar.webp
✓ packages/agent-service/src/__tests__/… (1 test) 75ms
Test Files 1 passed (1)
```
19 项断言覆盖 `agent.json` / `persona.md` / `principles.md` / 2 个 `SKILL.md`
/ `assets/avatar.webp` / 13 篇文档，全部存在；staged 摘要与源摘要一致（内容无漂移）。
All 19 assertions — `agent.json`, `persona.md`, `principles.md`, both
`SKILL.md` files, `assets/avatar.webp`, and all 13 documents — are
present, and the staged digest matches the source digest (no content
drift).
## 公开信息边界 / Public information boundary
**中文**：按 `CLAUDE.md`「Required pre-publication
check」执行完毕。敏感令牌清单通过私有渠道获取并保存在仓库之外，未落盘、未写入否定名单。全工作树扫描（含隐藏文件、排除 `.git`）后，本
PR 新增与修改的文件（含本次新增的 17
个正文文件）**零命中**；已对示例做语义复核，正文示例统一使用「某某」「张三」这类中文通用占位人名，正文只描述公开的软件包名、公开命令与中立能力域，不含任何租户、客户、伙伴或个人身份，也无截图。分支名、commit
标题与正文、以及本 PR 文本同样零命中。检查通过。
**English**: The `CLAUDE.md` "Required pre-publication check" was
completed. The sensitive token list was obtained through a private
channel and kept outside the repository; it was not persisted and not
added to any denylist. After scanning the complete working tree
(including hidden files, excluding `.git`), the files added or modified
by this PR — including the 17 content files added in this round —
produce **zero hits**. Examples were reviewed semantically: the text
describes only public package names, public commands, and neutral
capability domains, with no tenant, customer, partner, or individual
identity, and no screenshots. The branch name, commit subject and body,
and this PR text are likewise clean. Check passed.
## 备注 / Notes
**中文**：与 #104（`skills/dingtalk-cli` 技能条目）互补——那个 PR 登记工具层，本 PR 登记 Agent
层。两者都改了 `manifest.json` 与 `README.md` 的统计行，后合并的一方需要重算计数。本分支基于 `main`，不依赖
#104。
目录 slug 选用 `dingtalk-workspace` 而非本机 AgentFS 实例目录名：AgentFS
实例目录是创建时按中文名自动生成的拼音串，不满足市场 slug 的语义可读性要求；`dingtalk-workspace`
与它所面向的产品域（钉钉工作台）及上游 CLI 包名一一对应，对应关系明确可查。
**English**: Complementary to #104 (the `skills/dingtalk-cli` listing) —
that PR registers the tool layer, this one the Agent layer. Both touch
the stats lines in `manifest.json` and `README.md`, so whichever merges
second must recount. This branch is based on `main` and does not depend
on #104.
The directory slug is `dingtalk-workspace` rather than the local AgentFS
instance directory name: that instance directory is an auto-generated
pinyin transliteration of the Chinese display name and is not
meaningfully readable as a marketplace slug. `dingtalk-workspace` maps
one-to-one onto the product surface it fronts and onto the upstream CLI
package name, so the correspondence stays explicit.
---------
Co-authored-by: yi-ge <jackyoncode@gmail.com>
## 中文
补齐官方市场里唯一缺失的主流 IM CLI 条目：**钉钉官方命令行工具 `dws`**（npm 包
`dingtalk-workspace-cli`，Apache-2.0，Copyright 2026 Alibaba Group），与已有的
`wecom-cli`、`larksuite-cli` 形成对称。市场此前只有社区的 `dingtalk-api`，覆盖面远小于官方 CLI。
### 变更
| 文件 | 说明 |
| --- | --- |
| `skills/dingtalk-cli/entry.json` | 合集指针条目 + 14 个官方子技能 `children` |
| `skills/dingtalk-cli/catalog-metadata.v1.json` | 治理 sidecar |
| `manifest.json` | `stats.totalSkills` 62 → 63；`version` 1.2.30 →
1.2.31；`lastUpdated` |
| `README.md` | 外部条目计数与清单同步 |
### 14 个子技能
`dingtalk-aisearch`、`dingtalk-aitable`、`dingtalk-calendar`、`dingtalk-chat`、`dingtalk-contact`、`dingtalk-doc`、`dingtalk-drive`、`dingtalk-event`、`dingtalk-mail`、`dingtalk-minutes`、`dingtalk-misc`、`dingtalk-shared`、`dingtalk-todo`、`dingtalk-wiki`
### 外部依赖披露
CLI 是**独立分发的第三方软件**，本条目只是市场登记，四处均已声明：
- **discovery description**（`entry.json#i18n.<locale>.shortDesc`）：需自行用
npm 安装 `dingtalk-workspace-cli`，需完成钉钉 OAuth
授权登录（**不支持账号密码登录**），DesireCore 不打包、不授权、不安装也不代运营钉钉或该 CLI
- **`compatibility.requirements`**（4 条）：CLI 需在 PATH 上、Node.js >=
16.7.0、`dws auth login` 建立的授权会话（缺失时必须在外部调用前停止，禁止编造成功结果）、能力覆盖取决于组织授予的
OAuth 范围与钉钉权益
- **本地化市场文案**：sidecar `presentation.i18n` 与 `entry.json#i18n` 逐字一致，zh-CN
/ en-US 双语
- **执行说明**：随 CLI 分发的上游 `SKILL.md`，不在本仓库
`redistribution: verify-package-terms` 会让客户端在安装响应里带出条款提示。
### 来源与治理的取舍（诚实声明）
上游 git 仓库 `https://github.com/open-dingtalk/dingtalk-workspace-cli`（该
URL 是发布方在 npm `package.json#repository` 里自己声明的）**当前对外返回 404，不可公开访问**，因此：
- `source` 用 `kind: git` + 该声明 URL，**不写 `ref`**——没有可观察的 commit，不编造固定版本
- 相应地 `provenance.content` 不可变，`governance.availability` 只能是
`listing-only`（`validate_catalog_metadata.py` 的 installable 强证据门禁要求不可变
ref + 已知 license + `reviewedAt` + `compliance`，本条目一样都拿不出）
- `governance.license` 保持 `{state: "unknown"}`（`entry.json#license:
"Apache-2.0"` 取自发布方声明与包内 LICENSE/NOTICE，但仓库内没有许可证据文件，只产生既有的
`legacy-license-unverified` warning）
- `timestamps.reviewedAt` / `releasePublishedAt` 保持 `unknown`；只有
`catalogUpdatedAt` 与 `upstreamObservedAt` 写入真实观察时刻
- `branding` 声明 `independent-listing` / `nominative` /
`not-used`：独立登记、名称为指代性使用、未使用对方 Logo（图标是通用终端窗形）
- 因为来源未固定，`gen-collection-children.py --check` 会输出 `SKIP`（与既有的
`mattpocock-skills` 同一路径），`children` 由人工按分发件内实际布局 `multi/<id>/` 撰写
### 校验（已实际执行，全部 exit 0）
```
uv run --quiet scripts/i18n/test_validate_i18n.py exit=0
uv run --quiet scripts/catalog/test_validate_catalog_metadata.py exit=0
uv run --quiet scripts/catalog/test_collection_generator.py exit=0
uv run --quiet scripts/catalog/validate_catalog_metadata.py --require-complete
0 error(s), 117 warning(s). agents=1, builtinSkills=34, pointerSkills=29,
publishableSkills=63, collections=8, collectionChildren=161, sidecars=64 exit=0
uv run --quiet scripts/i18n/validate-i18n.py 0 error(s) exit=0
uv run --quiet scripts/i18n/translate.py --check exit=0
uv run --quiet scripts/gen-collection-children.py --check exit=0
```
本条目产生的唯一 warning 是 `legacy-license-unverified`，与其余全部 pointer
条目一致。`entry.json` 另经客户端 `marketSkillEntrySchema` 的 Ajv 校验通过。
发布前公开信息边界检查已按 `CLAUDE.md` 执行并通过（工作树全量扫描含隐藏文件、路径名、分支名、commit 文案与本 PR
文本，零结果；令牌清单保存在仓库之外）。
---
## English
Adds the one mainstream IM CLI the official market was still missing:
the **official DingTalk CLI `dws`** (npm package
`dingtalk-workspace-cli`, Apache-2.0, Copyright 2026 Alibaba Group),
making it symmetric with the existing `wecom-cli` and `larksuite-cli`
entries. Until now the market only carried the community `dingtalk-api`,
whose surface is far smaller.
### Changes
| File | Purpose |
| --- | --- |
| `skills/dingtalk-cli/entry.json` | Collection pointer entry with 14
official sub-skill `children` |
| `skills/dingtalk-cli/catalog-metadata.v1.json` | Governance sidecar |
| `manifest.json` | `stats.totalSkills` 62 → 63; `version` 1.2.30 →
1.2.31; `lastUpdated` |
| `README.md` | External-entry count and list kept in sync |
### External dependency disclosure
The CLI is **separately distributed third-party software**; this entry
is a marketplace listing only. The dependency is disclosed in all four
required places:
- **Discovery description** (`entry.json#i18n.<locale>.shortDesc`): the
operator installs `dingtalk-workspace-cli` from npm and completes
DingTalk OAuth sign-in (**no username-and-password login**); DesireCore
does not bundle, license, install or operate DingTalk or this CLI.
- **`compatibility.requirements`** (4 entries): the `dws` binary on
PATH, Node.js >= 16.7.0, an operator-authorized session from `dws auth
login` (without it the skills must stop before the external call and
must never fabricate a successful result), and the fact that capability
coverage depends on the organization's granted OAuth scopes and DingTalk
entitlements.
- **Localized marketplace text**: sidecar `presentation.i18n` matches
`entry.json#i18n` verbatim, in both zh-CN and en-US.
- **Execution instructions**: the upstream `SKILL.md` files shipped with
the CLI, outside this repository.
`redistribution: verify-package-terms` makes the client surface a terms
notice on install.
### Source and governance trade-off (stated plainly)
The upstream git repository
`https://github.com/open-dingtalk/dingtalk-workspace-cli` — the URL the
publisher itself declares in the npm `package.json#repository` —
**currently returns 404 and is not publicly readable**. Therefore:
- `source` uses `kind: git` with that declared URL and **no `ref`**:
there is no observable commit, and inventing a pinned one is not
acceptable.
- Content provenance is consequently not immutable, so
`governance.availability` can only be `listing-only` (the installable
evidence gate in `validate_catalog_metadata.py` requires an immutable
ref, a known license, `reviewedAt` and `compliance`; none of these exist
here).
- `governance.license` stays `{state: "unknown"}`. `entry.json#license:
"Apache-2.0"` reflects the publisher's declaration and the
LICENSE/NOTICE shipped in the package, but there is no license evidence
file in this repository, so only the existing
`legacy-license-unverified` warning is produced.
- `timestamps.reviewedAt` and `releasePublishedAt` stay `unknown`; only
`catalogUpdatedAt` and `upstreamObservedAt` carry real observed values.
- `branding` declares `independent-listing` / `nominative` / `not-used`:
an independent listing, nominative use of the product name, and no
third-party logo (the icon is a generic terminal-window glyph).
- Because the source is unpinned, `gen-collection-children.py --check`
reports `SKIP` (the same path the existing `mattpocock-skills` entry
takes). The `children` list was written by hand against the
`multi/<id>/` layout actually observed in the distributed skill bundle.
### Validation (actually executed, all exit 0)
All seven checks from `.github/workflows/i18n-validate.yml` were run
locally and passed; the only warning attributable to this entry is
`legacy-license-unverified`, matching every other pointer entry.
`entry.json` additionally validates against the client's
`marketSkillEntrySchema` under Ajv.
The pre-publication public-information-boundary check in `CLAUDE.md` was
performed and passed with a zero-result scan across the working tree
(hidden files included), path names, branch name, commit text and this
PR text. The search tokens are kept outside the repository.
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: yi-ge <jackyoncode@gmail.com>
Removes the temporary QA-only Agent listing after successful real Market
installation verification. The installed local copy is intentionally
verified separately to ensure delisting does not delete user-owned
installations.
Temporary QA-only Agent pointer for validating the real publish,
install, and delist lifecycle.\n\n- Source repo is public and MIT
licensed\n- Pointer is pinned to immutable commit
dd4abbe342f25d0569dba152ce1be3fb867c3474\n- No user data, credentials,
or third-party content\n- A follow-up PR will remove this entry after
installation verification
## 变更说明 / Summary
### 中文
- 在 `workforce-optimization` 的发现描述、`compatibility`、中英文市场摘要和正文中明确 MindOpt
是需要独立安装/部署并取得有效许可证的外部第三方求解器。
- 明确 `MindOptSolve` 只是受治理的 Connector/Adapter，不包含 MindOpt
求解器软件、许可证、算力托管、采购或运行费用。
- 增加运行前检查：必须确认 Connector ready、capabilities 可用且部署具备当前用途所需的有效许可证；仅注册 Tool
名称不能证明依赖可用。
- 增加安全降级：外部依赖不可用时仍可完成需求澄清和建模制品，但不得调用求解器、伪造 `SolveResult` 或宣称可行/最优/收益。
- 在 `AGENTS.md` 与 `CLAUDE.md` 中固化通用的第三方商业依赖披露规则。
- Skill 版本升级到 `2.3.3`，Market 版本升级到 `1.2.24`。
MindOpt 官方文档说明运行前必须取得有效许可证，并同时提供商业许可和社区许可；适用范围与采购要求以官方条款为准：
https://opt.aliyun.com/doc/mindopt/latest/cn/html/installation/license.html
### English
- Discloses in discovery metadata, `compatibility`, localized
marketplace text, and runtime instructions that MindOpt is separately
installed/deployed third-party solver software requiring a valid
applicable license.
- Clarifies that `MindOptSolve` is only the governed connector/adapter
and does not bundle the solver, license, hosted compute, procurement, or
operating costs.
- Adds a preflight gate for connector readiness, required capabilities,
and applicable licensing.
- Defines safe degraded behavior: requirement and model artifacts may
still be produced, but no solver call or fabricated solution claim is
allowed.
- Adds a generic third-party dependency disclosure rule to both
repository instruction entrypoints.
- Bumps the Skill to `2.3.3` and the Market to `1.2.24`.
The official MindOpt documentation states that a valid license is
required and documents both commercial and community licenses;
eligibility and purchasing remain governed by those official terms:
https://opt.aliyun.com/doc/latest/en/html/installation/license.html
## 验证 / Validation
- `uv run --quiet scripts/i18n/test_validate_i18n.py` — 8 passed
- `uv run --quiet scripts/i18n/validate-i18n.py` — no issues
- `uv run --quiet scripts/i18n/translate.py --check` — current; human
translation hash aligned
- `git diff --check`
- Public-worktree customer-identity/path scan — 0 matches
## Summary / 摘要
Normalize the Configure Compute, Using Services, and Register Services
source SVG icons to pure white.
将“配置算力”、“使用服务”和“注册服务”的源 SVG 图标统一为纯白。
## Version / 版本
- Market: `1.2.16` → `1.2.17`
- Each affected skill: `1.0.2` → `1.0.3`
## Validation / 验证
- `uv run scripts/i18n/validate-i18n.py`
- `uv run scripts/i18n/translate.py --check`
- Parsed all three SVGs and asserted their only hex color is `#FFFFFF`
- `git diff --check`
## 摘要 / Summary
### 中文
在去除机械数字上限（#58）后，进一步删掉技能里追问/展示数量的**软性倾向措辞**——create
的「一次不要问太多以免用户负担」、discover 的「避免一次刷屏过多」。数量与节奏完全交由执行 Agent
自主判断，不带任何倾向暗示。create 2.5.4 / discover 2.6.4，manifest 1.2.15，中英双份同步、重算
source_hash（validate-i18n 通过）。
### English
After removing the mechanical numeric caps (#58), further drop the soft
directional hints on ask/display count — create's "don't ask too many so
as not to burden the user" and discover's "avoid flooding the screen".
Count and pacing are left entirely to the executing Agent's judgment
with no bias. create 2.5.4 / discover 2.6.4, manifest 1.2.15, both
locales synced, hashes recomputed (validate-i18n passes).
## 摘要 / Summary
### 中文
去除技能里束缚执行 Agent 自主判断的**机械数字策略**：create 需求收集的「每轮最多问 2 个」、discover
排序的「最多展示 5 个候选」。改为交由 Agent 按情况自主把握追问节奏与展示数量，保留「别让用户负担 /
别一次刷屏」的原则意图——把控制权交还给判断力更强的执行者，而非用固定上限约束。create 2.5.3 / discover
2.6.3，manifest 1.2.14，中英双份同步、重算 source_hash（validate-i18n 通过）。
### English
Remove mechanical numeric limits that constrain the executing Agent's
judgment: create's "at most 2 questions per turn" and discover's "show
at most 5 candidates". Both become "the Agent decides the pacing/count
by situation", keeping the principle intent (don't burden the user /
don't flood the screen) while handing control back to the more capable
executor instead of a fixed cap. create 2.5.3 / discover 2.6.3, manifest
1.2.14, both locales synced, hashes recomputed (validate-i18n passes).
## 摘要 / Summary
### 中文
#56 的复盘修正。上一轮"强改写压缩"把四技能 L1
的**技术属性、使用场景与交互示范当套话一刀切**，造成实质信息丢失（承诺"意图全保留"但未做到）。本 PR 补回：
- **create**：`创建仓库符合 AgentFS v2 规范、git
管理版本（可治理/可追溯）`定位；`基础创建`形态（name+description，description 自动填充 persona
L0）；需求收集的**引导问题示例**（"起什么名字？/主要负责什么？"…）；企业部署/开发者原型使用场景。
- **update**：`agent 目录 git 管理版本、历史可追溯`定位 + 使用场景。
- **discover**：使用场景（浏览/新用户/找替代）+ `语义匹配而非关键词搜索`。
- **delete**：使用场景（清理/测试/释放存储）。
根因：L1 混着实质技术属性与营销套话、使用场景是触发判据、引导问题是交互示范，不该按"只留独有信息"一刀切。补回后仍保留结构性压缩（zh
正文合计仍降 ~64%）。版本 create 2.5.2 / update 3.1.3 / delete 2.5.2 / discover
2.6.2，manifest 1.2.13，中英双份同步、重算 source_hash（validate-i18n 通过）。
### English
Post-mortem fix for #56. The previous aggressive compression treated the
skills' L1 technical attributes, use cases, and interaction demos as
boilerplate and cut them in a blanket way, dropping substantive
information (the "all intent preserved" claim wasn't fully met). This PR
restores: create's AgentFS-v2 / git-version-management positioning, the
"basic create" form (name+description auto-filling persona L0), the
requirement-gathering prompt questions, and enterprise/developer use
cases; update's git-versioned/traceable positioning and use cases;
discover's use cases and "semantic match, not keyword search"; delete's
use cases. Root cause: L1 mixed real technical attributes with marketing
boilerplate, use cases are trigger cues, and prompt questions are
interaction demos — none should have been blanket-cut. Structural
compression is retained (zh bodies still ~64% smaller). Versions bumped,
manifest 1.2.13, both locales synced, source hashes recomputed
(validate-i18n passes).
## 摘要 / Summary
### 中文
market#52 的修正:update-agent
附录示例使用了错误的字段名(`communicationStyle`/`must`),照示例调用会被 ManageAgent 的 Ajv
校验(additionalProperties: false)直接拒绝;`personality` 示例应为字符串数组。同时把 `get`
的返回示例对齐真实输出格式(`## persona.md` / `## principles.md` 段落含分层 markdown 原文,对应
desirecore#1230),并在附录固定列出结构化字段名清单。update-agent 3.1.1,manifest 1.2.11。
### English
Correction to market#52: the update-agent appendix examples used wrong
field names (`communicationStyle`/`must`) that ManageAgent's Ajv
validation (additionalProperties: false) would reject outright;
`personality` must be a string array. The `get` response example is
aligned with the actual output format (`## persona.md` / `##
principles.md` sections, per desirecore#1230), and the appendix now
lists the fixed structured field names. update-agent 3.1.1, manifest
1.2.11.
## Summary / 摘要
Add inline SVG icons to all 20 external pointer skills, so their cards
no longer fall back to an empty icon. The market catalog version is
bumped from `1.2.8` to `1.2.9`.
为全部 20 个外部 pointer skill 补齐内联 SVG 图标，市场卡片不再显示为空；市场版本由 `1.2.8` 升至
`1.2.9`。
## Compatibility / 兼容性
Depends on desirecore/desirecore#1177, which permits the `icon` field in
strict pointer-entry validation and forwards it through the offline
list/detail responses. That PR must merge first.
## Skill → icon screenshot / Skill 与图标截图
The preview labels every card with its display name and id.
Covered skills: `agent-reach`, `ai-news-radar`, `amap-jsapi-skill`,
`dingtalk-api`, `flyai-skill`, `follow-builders`,
`ian-xiaohei-illustrations`, `karpathy-guidelines`, `khazix-skills`,
`larksuite-cli`, `last30days`, `luckin-my-coffee`, `mattpocock-skills`,
`minimax-image-gen`, `minimax-tts`, `mt-paotui-for-client`,
`netease-skills`, `taste-skill`, `wechatpay-skills`, and `wecom-cli`.
## Validation / 验证
- `uv run scripts/i18n/validate-i18n.py`
- `uv run scripts/i18n/translate.py --check`
- Parsed all 20 `entry.json` icons as SVG XML
- `git diff --check`
- Rendered the committed preview asset locally
## 中文
新增官方内置技能 `configuring-compute`：让平台内智能体能帮用户配置算力供应商与 API Key。
- 完整流程：查看配置 → 创建/更新 provider → 写入密钥（只写端点）→ verify-key 验证 → 启用/同步模型 →
POST /api/compute/reload 刷新
- 安全模型写入技能文本：密钥只写不读，禁止读取 secrets.json 或尝试读回已有 key
- 加入 builtin-skills.json 清单；manifest version 1.2.6 → 1.2.7
依赖 desirecore 主仓库的配套 PR（掩码脱敏 + reload 端点）。
## English
Add the official builtin skill `configuring-compute`: enables
in-platform agents to configure compute providers and API keys for the
user.
- Full flow: inspect config → create/update provider → write key
(write-only endpoint) → verify-key → enable/sync models → POST
/api/compute/reload
- Security model embedded in the skill text: keys are write-only;
reading secrets.json or existing keys is forbidden
- Added to builtin-skills.json manifest; manifest version 1.2.6 → 1.2.7
Depends on the companion PR in the desirecore main repo (key masking +
reload endpoint).
