desirecore/market
2
0
Fork 0
mirror of https://git.openapi.site/https://github.com/desirecore/market.git synced 2026-10-21 07:04:05 +08:00
Code Issues Packages Projects Releases Wiki Activity
255 Commits 10 Branches 0 Tags
c9c8c564aa10c47c60e4d57e902259adf8b0ae58
Commit Graph

3 Commits

Author SHA1 Message Date
Yige
26a3a4a82a fix: 修复上游健康巡检并同步已审查的市场引用 (#207) 
Upstream health checks could select a different branch ending in `main`,
index internal skills or lowercase reference documents, treat a valid
pinned path as broken after an upstream move, and close the tracking
issue while unpinned or unknown entries remained. Resolve exact refs and
tracked filenames, compare the installed snapshot, and drive issue
decisions from structured results.

Refresh 26 reviewed pointers, pin DingTalk and Matt Pocock collections,
remove the deleted merge-conflict skill, and add the six new public
children with reviewed translations. Synchronize sidecars, observed
release facts, license evidence and external dependency disclosures.
Identical-tree Agent pins and their versions remain unchanged. The
per-entry review is recorded in
`docs/upstream-health-189-remediation.md`.

Validation: 99 unit tests pass; all nine pinned collections reproduce;
catalog/i18n and translation-freshness checks pass; online health checks
all 41 external entries with zero broken, actionable or unknown results.
Existing catalog warnings decrease from 123 to 105 with no new warning
groups. Python/workflow shell syntax and whitespace checks pass.

Closes #189.
 2026-10-05 23:13:13 +08:00
mashagua
6fbd5590a7 fix: dingtalk-cli 上游迁移至 DingTalk-Real-AI/dingtalk-workspace-cli (#187) 
## 概述
`skills/dingtalk-cli` 指向的上游 `open-dingtalk/dingtalk-workspace-cli` 已
404（`git ls-remote` 返回需要认证，仓库已删除或转为私有），客户端按该指针已无法获取内容。本 PR 将指针迁移到项目现在的地址
[DingTalk-Real-AI/dingtalk-workspace-cli](https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli)。

## 为什么认定是同一项目
- 新仓库 README / README_zh、brew tap、Releases、SECURITY 链接全部指向
`DingTalk-Real-AI/dingtalk-workspace-cli`，产品名、`dws` 命令、Apache-2.0 许可一致。
- 新仓库最新提交 `7de51a8`（2026-09-23）是 `v1.0.63-beta.3` 的 formula 更新，与 npm
`dingtalk-workspace-cli` 当前 beta 版本号一致。
- 注意：npm 包元数据的 `repository` 仍写着旧地址，尚未随迁移更新。请 reviewer 确认是否认可新组织为官方来源。

## 变更
- `source.repoUrl`、sidecar `provenance.content.url` → 新地址；`maintainer` /
`upstreamMaintainer` → `DingTalk-Real-AI`（`url` 仍为 npm 包页）。
- 上游子技能目录已从 `multi/` 移到 `skills/multi/`，14 个 `children[].path`
同步修正（已逐一确认新地址下存在 `SKILL.md`）。
- 新增上游新子技能 `dingtalk-tag`（数字员工管理），`childCount` 14 → 15。
- 上游 `skills/mono`（frontmatter `metadata.internal: true` 的合并技能
`dws`）不作为子技能收录。
- 保持原有 `listing-only`、未锁定 `ref` 的状态不变，未改动人工撰写的子技能简介。
- `manifest.json`：version 1.5.2 → 1.5.4（1.5.3 已由 #186 使用；两者合并有先后时需解一次
version 行冲突），lastUpdated → 2026-09-25。

## 验证
```
uv run scripts/i18n/validate-i18n.py                                    # 0 error(s)
uv run scripts/catalog/validate_catalog_metadata.py --require-complete  # 0 error(s)，dingtalk-cli 无警告
uv run scripts/gen-collection-children.py --check dingtalk-cli          # SKIP（未锁定 ref，与改动前一致）
```

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_0191D9g1FhRQzEGTefUn6mTb

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Yige <a@wyr.me>
 2026-09-26 18:08:57 +08:00
Yige
fb6005cd7b feat: 新增钉钉官方 CLI 市场入口（含 14 个官方子技能） (#104) 
## 中文

补齐官方市场里唯一缺失的主流 IM CLI 条目：**钉钉官方命令行工具 `dws`**（npm 包
`dingtalk-workspace-cli`，Apache-2.0，Copyright 2026 Alibaba Group），与已有的
`wecom-cli`、`larksuite-cli` 形成对称。市场此前只有社区的 `dingtalk-api`，覆盖面远小于官方 CLI。

### 变更

| 文件 | 说明 |
| --- | --- |
| `skills/dingtalk-cli/entry.json` | 合集指针条目 + 14 个官方子技能 `children` |
| `skills/dingtalk-cli/catalog-metadata.v1.json` | 治理 sidecar |
| `manifest.json` | `stats.totalSkills` 62 → 63；`version` 1.2.30 →
1.2.31；`lastUpdated` |
| `README.md` | 外部条目计数与清单同步 |

### 14 个子技能


`dingtalk-aisearch`、`dingtalk-aitable`、`dingtalk-calendar`、`dingtalk-chat`、`dingtalk-contact`、`dingtalk-doc`、`dingtalk-drive`、`dingtalk-event`、`dingtalk-mail`、`dingtalk-minutes`、`dingtalk-misc`、`dingtalk-shared`、`dingtalk-todo`、`dingtalk-wiki`

### 外部依赖披露

CLI 是**独立分发的第三方软件**，本条目只是市场登记，四处均已声明：

- **discovery description**（`entry.json#i18n.<locale>.shortDesc`）：需自行用
npm 安装 `dingtalk-workspace-cli`，需完成钉钉 OAuth
授权登录（**不支持账号密码登录**），DesireCore 不打包、不授权、不安装也不代运营钉钉或该 CLI
- **`compatibility.requirements`**（4 条）：CLI 需在 PATH 上、Node.js >=
16.7.0、`dws auth login` 建立的授权会话（缺失时必须在外部调用前停止，禁止编造成功结果）、能力覆盖取决于组织授予的
OAuth 范围与钉钉权益
- **本地化市场文案**：sidecar `presentation.i18n` 与 `entry.json#i18n` 逐字一致，zh-CN
/ en-US 双语
- **执行说明**：随 CLI 分发的上游 `SKILL.md`，不在本仓库

`redistribution: verify-package-terms` 会让客户端在安装响应里带出条款提示。

### 来源与治理的取舍（诚实声明）

上游 git 仓库 `https://github.com/open-dingtalk/dingtalk-workspace-cli`（该
URL 是发布方在 npm `package.json#repository` 里自己声明的）**当前对外返回 404，不可公开访问**，因此：

- `source` 用 `kind: git` + 该声明 URL，**不写 `ref`**——没有可观察的 commit，不编造固定版本
- 相应地 `provenance.content` 不可变，`governance.availability` 只能是
`listing-only`（`validate_catalog_metadata.py` 的 installable 强证据门禁要求不可变
ref + 已知 license + `reviewedAt` + `compliance`，本条目一样都拿不出）
- `governance.license` 保持 `{state: "unknown"}`（`entry.json#license:
"Apache-2.0"` 取自发布方声明与包内 LICENSE/NOTICE，但仓库内没有许可证据文件，只产生既有的
`legacy-license-unverified` warning）
- `timestamps.reviewedAt` / `releasePublishedAt` 保持 `unknown`；只有
`catalogUpdatedAt` 与 `upstreamObservedAt` 写入真实观察时刻
- `branding` 声明 `independent-listing` / `nominative` /
`not-used`：独立登记、名称为指代性使用、未使用对方 Logo（图标是通用终端窗形）
- 因为来源未固定，`gen-collection-children.py --check` 会输出 `SKIP`（与既有的
`mattpocock-skills` 同一路径），`children` 由人工按分发件内实际布局 `multi/<id>/` 撰写

### 校验（已实际执行，全部 exit 0）

```
uv run --quiet scripts/i18n/test_validate_i18n.py                            exit=0
uv run --quiet scripts/catalog/test_validate_catalog_metadata.py             exit=0
uv run --quiet scripts/catalog/test_collection_generator.py                  exit=0
uv run --quiet scripts/catalog/validate_catalog_metadata.py --require-complete
    0 error(s), 117 warning(s). agents=1, builtinSkills=34, pointerSkills=29,
    publishableSkills=63, collections=8, collectionChildren=161, sidecars=64  exit=0
uv run --quiet scripts/i18n/validate-i18n.py            0 error(s)            exit=0
uv run --quiet scripts/i18n/translate.py --check                             exit=0
uv run --quiet scripts/gen-collection-children.py --check                     exit=0
```

本条目产生的唯一 warning 是 `legacy-license-unverified`，与其余全部 pointer
条目一致。`entry.json` 另经客户端 `marketSkillEntrySchema` 的 Ajv 校验通过。

发布前公开信息边界检查已按 `CLAUDE.md` 执行并通过（工作树全量扫描含隐藏文件、路径名、分支名、commit 文案与本 PR
文本，零结果；令牌清单保存在仓库之外）。

---

## English

Adds the one mainstream IM CLI the official market was still missing:
the **official DingTalk CLI `dws`** (npm package
`dingtalk-workspace-cli`, Apache-2.0, Copyright 2026 Alibaba Group),
making it symmetric with the existing `wecom-cli` and `larksuite-cli`
entries. Until now the market only carried the community `dingtalk-api`,
whose surface is far smaller.

### Changes

| File | Purpose |
| --- | --- |
| `skills/dingtalk-cli/entry.json` | Collection pointer entry with 14
official sub-skill `children` |
| `skills/dingtalk-cli/catalog-metadata.v1.json` | Governance sidecar |
| `manifest.json` | `stats.totalSkills` 62 → 63; `version` 1.2.30 →
1.2.31; `lastUpdated` |
| `README.md` | External-entry count and list kept in sync |

### External dependency disclosure

The CLI is **separately distributed third-party software**; this entry
is a marketplace listing only. The dependency is disclosed in all four
required places:

- **Discovery description** (`entry.json#i18n.<locale>.shortDesc`): the
operator installs `dingtalk-workspace-cli` from npm and completes
DingTalk OAuth sign-in (**no username-and-password login**); DesireCore
does not bundle, license, install or operate DingTalk or this CLI.
- **`compatibility.requirements`** (4 entries): the `dws` binary on
PATH, Node.js >= 16.7.0, an operator-authorized session from `dws auth
login` (without it the skills must stop before the external call and
must never fabricate a successful result), and the fact that capability
coverage depends on the organization's granted OAuth scopes and DingTalk
entitlements.
- **Localized marketplace text**: sidecar `presentation.i18n` matches
`entry.json#i18n` verbatim, in both zh-CN and en-US.
- **Execution instructions**: the upstream `SKILL.md` files shipped with
the CLI, outside this repository.

`redistribution: verify-package-terms` makes the client surface a terms
notice on install.

### Source and governance trade-off (stated plainly)

The upstream git repository
`https://github.com/open-dingtalk/dingtalk-workspace-cli` — the URL the
publisher itself declares in the npm `package.json#repository` —
**currently returns 404 and is not publicly readable**. Therefore:

- `source` uses `kind: git` with that declared URL and **no `ref`**:
there is no observable commit, and inventing a pinned one is not
acceptable.
- Content provenance is consequently not immutable, so
`governance.availability` can only be `listing-only` (the installable
evidence gate in `validate_catalog_metadata.py` requires an immutable
ref, a known license, `reviewedAt` and `compliance`; none of these exist
here).
- `governance.license` stays `{state: "unknown"}`. `entry.json#license:
"Apache-2.0"` reflects the publisher's declaration and the
LICENSE/NOTICE shipped in the package, but there is no license evidence
file in this repository, so only the existing
`legacy-license-unverified` warning is produced.
- `timestamps.reviewedAt` and `releasePublishedAt` stay `unknown`; only
`catalogUpdatedAt` and `upstreamObservedAt` carry real observed values.
- `branding` declares `independent-listing` / `nominative` / `not-used`:
an independent listing, nominative use of the product name, and no
third-party logo (the icon is a generic terminal-window glyph).
- Because the source is unpinned, `gen-collection-children.py --check`
reports `SKIP` (the same path the existing `mattpocock-skills` entry
takes). The `children` list was written by hand against the
`multi/<id>/` layout actually observed in the distributed skill bundle.

### Validation (actually executed, all exit 0)

All seven checks from `.github/workflows/i18n-validate.yml` were run
locally and passed; the only warning attributable to this entry is
`legacy-license-unverified`, matching every other pointer entry.
`entry.json` additionally validates against the client's
`marketSkillEntrySchema` under Ajv.

The pre-publication public-information-boundary check in `CLAUDE.md` was
performed and passed with a zero-result scan across the working tree
(hidden files included), path names, branch name, commit text and this
PR text. The search tokens are kept outside the repository.

---------

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: yi-ge <jackyoncode@gmail.com>
 2026-09-02 06:25:24 -04:00