## 中文
补齐官方市场里唯一缺失的主流 IM CLI 条目：**钉钉官方命令行工具 `dws`**（npm 包
`dingtalk-workspace-cli`，Apache-2.0，Copyright 2026 Alibaba Group），与已有的
`wecom-cli`、`larksuite-cli` 形成对称。市场此前只有社区的 `dingtalk-api`，覆盖面远小于官方 CLI。
### 变更
| 文件 | 说明 |
| --- | --- |
| `skills/dingtalk-cli/entry.json` | 合集指针条目 + 14 个官方子技能 `children` |
| `skills/dingtalk-cli/catalog-metadata.v1.json` | 治理 sidecar |
| `manifest.json` | `stats.totalSkills` 62 → 63；`version` 1.2.30 →
1.2.31；`lastUpdated` |
| `README.md` | 外部条目计数与清单同步 |
### 14 个子技能
`dingtalk-aisearch`、`dingtalk-aitable`、`dingtalk-calendar`、`dingtalk-chat`、`dingtalk-contact`、`dingtalk-doc`、`dingtalk-drive`、`dingtalk-event`、`dingtalk-mail`、`dingtalk-minutes`、`dingtalk-misc`、`dingtalk-shared`、`dingtalk-todo`、`dingtalk-wiki`
### 外部依赖披露
CLI 是**独立分发的第三方软件**，本条目只是市场登记，四处均已声明：
- **discovery description**（`entry.json#i18n.<locale>.shortDesc`）：需自行用
npm 安装 `dingtalk-workspace-cli`，需完成钉钉 OAuth
授权登录（**不支持账号密码登录**），DesireCore 不打包、不授权、不安装也不代运营钉钉或该 CLI
- **`compatibility.requirements`**（4 条）：CLI 需在 PATH 上、Node.js >=
16.7.0、`dws auth login` 建立的授权会话（缺失时必须在外部调用前停止，禁止编造成功结果）、能力覆盖取决于组织授予的
OAuth 范围与钉钉权益
- **本地化市场文案**：sidecar `presentation.i18n` 与 `entry.json#i18n` 逐字一致，zh-CN
/ en-US 双语
- **执行说明**：随 CLI 分发的上游 `SKILL.md`，不在本仓库
`redistribution: verify-package-terms` 会让客户端在安装响应里带出条款提示。
### 来源与治理的取舍（诚实声明）
上游 git 仓库 `https://github.com/open-dingtalk/dingtalk-workspace-cli`（该
URL 是发布方在 npm `package.json#repository` 里自己声明的）**当前对外返回 404，不可公开访问**，因此：
- `source` 用 `kind: git` + 该声明 URL，**不写 `ref`**——没有可观察的 commit，不编造固定版本
- 相应地 `provenance.content` 不可变，`governance.availability` 只能是
`listing-only`（`validate_catalog_metadata.py` 的 installable 强证据门禁要求不可变
ref + 已知 license + `reviewedAt` + `compliance`，本条目一样都拿不出）
- `governance.license` 保持 `{state: "unknown"}`（`entry.json#license:
"Apache-2.0"` 取自发布方声明与包内 LICENSE/NOTICE，但仓库内没有许可证据文件，只产生既有的
`legacy-license-unverified` warning）
- `timestamps.reviewedAt` / `releasePublishedAt` 保持 `unknown`；只有
`catalogUpdatedAt` 与 `upstreamObservedAt` 写入真实观察时刻
- `branding` 声明 `independent-listing` / `nominative` /
`not-used`：独立登记、名称为指代性使用、未使用对方 Logo（图标是通用终端窗形）
- 因为来源未固定，`gen-collection-children.py --check` 会输出 `SKIP`（与既有的
`mattpocock-skills` 同一路径），`children` 由人工按分发件内实际布局 `multi/<id>/` 撰写
### 校验（已实际执行，全部 exit 0）
```
uv run --quiet scripts/i18n/test_validate_i18n.py exit=0
uv run --quiet scripts/catalog/test_validate_catalog_metadata.py exit=0
uv run --quiet scripts/catalog/test_collection_generator.py exit=0
uv run --quiet scripts/catalog/validate_catalog_metadata.py --require-complete
0 error(s), 117 warning(s). agents=1, builtinSkills=34, pointerSkills=29,
publishableSkills=63, collections=8, collectionChildren=161, sidecars=64 exit=0
uv run --quiet scripts/i18n/validate-i18n.py 0 error(s) exit=0
uv run --quiet scripts/i18n/translate.py --check exit=0
uv run --quiet scripts/gen-collection-children.py --check exit=0
```
本条目产生的唯一 warning 是 `legacy-license-unverified`，与其余全部 pointer
条目一致。`entry.json` 另经客户端 `marketSkillEntrySchema` 的 Ajv 校验通过。
发布前公开信息边界检查已按 `CLAUDE.md` 执行并通过（工作树全量扫描含隐藏文件、路径名、分支名、commit 文案与本 PR
文本，零结果；令牌清单保存在仓库之外）。
---
## English
Adds the one mainstream IM CLI the official market was still missing:
the **official DingTalk CLI `dws`** (npm package
`dingtalk-workspace-cli`, Apache-2.0, Copyright 2026 Alibaba Group),
making it symmetric with the existing `wecom-cli` and `larksuite-cli`
entries. Until now the market only carried the community `dingtalk-api`,
whose surface is far smaller.
### Changes
| File | Purpose |
| --- | --- |
| `skills/dingtalk-cli/entry.json` | Collection pointer entry with 14
official sub-skill `children` |
| `skills/dingtalk-cli/catalog-metadata.v1.json` | Governance sidecar |
| `manifest.json` | `stats.totalSkills` 62 → 63; `version` 1.2.30 →
1.2.31; `lastUpdated` |
| `README.md` | External-entry count and list kept in sync |
### External dependency disclosure
The CLI is **separately distributed third-party software**; this entry
is a marketplace listing only. The dependency is disclosed in all four
required places:
- **Discovery description** (`entry.json#i18n.<locale>.shortDesc`): the
operator installs `dingtalk-workspace-cli` from npm and completes
DingTalk OAuth sign-in (**no username-and-password login**); DesireCore
does not bundle, license, install or operate DingTalk or this CLI.
- **`compatibility.requirements`** (4 entries): the `dws` binary on
PATH, Node.js >= 16.7.0, an operator-authorized session from `dws auth
login` (without it the skills must stop before the external call and
must never fabricate a successful result), and the fact that capability
coverage depends on the organization's granted OAuth scopes and DingTalk
entitlements.
- **Localized marketplace text**: sidecar `presentation.i18n` matches
`entry.json#i18n` verbatim, in both zh-CN and en-US.
- **Execution instructions**: the upstream `SKILL.md` files shipped with
the CLI, outside this repository.
`redistribution: verify-package-terms` makes the client surface a terms
notice on install.
### Source and governance trade-off (stated plainly)
The upstream git repository
`https://github.com/open-dingtalk/dingtalk-workspace-cli` — the URL the
publisher itself declares in the npm `package.json#repository` —
**currently returns 404 and is not publicly readable**. Therefore:
- `source` uses `kind: git` with that declared URL and **no `ref`**:
there is no observable commit, and inventing a pinned one is not
acceptable.
- Content provenance is consequently not immutable, so
`governance.availability` can only be `listing-only` (the installable
evidence gate in `validate_catalog_metadata.py` requires an immutable
ref, a known license, `reviewedAt` and `compliance`; none of these exist
here).
- `governance.license` stays `{state: "unknown"}`. `entry.json#license:
"Apache-2.0"` reflects the publisher's declaration and the
LICENSE/NOTICE shipped in the package, but there is no license evidence
file in this repository, so only the existing
`legacy-license-unverified` warning is produced.
- `timestamps.reviewedAt` and `releasePublishedAt` stay `unknown`; only
`catalogUpdatedAt` and `upstreamObservedAt` carry real observed values.
- `branding` declares `independent-listing` / `nominative` / `not-used`:
an independent listing, nominative use of the product name, and no
third-party logo (the icon is a generic terminal-window glyph).
- Because the source is unpinned, `gen-collection-children.py --check`
reports `SKIP` (the same path the existing `mattpocock-skills` entry
takes). The `children` list was written by hand against the
`multi/<id>/` layout actually observed in the distributed skill bundle.
### Validation (actually executed, all exit 0)
All seven checks from `.github/workflows/i18n-validate.yml` were run
locally and passed; the only warning attributable to this entry is
`legacy-license-unverified`, matching every other pointer entry.
`entry.json` additionally validates against the client's
`marketSkillEntrySchema` under Ajv.
The pre-publication public-information-boundary check in `CLAUDE.md` was
performed and passed with a zero-result scan across the working tree
(hidden files included), path names, branch name, commit text and this
PR text. The search tokens are kept outside the repository.
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: yi-ge <jackyoncode@gmail.com>
## Summary
- align the README catalog summary with the current market tree
- report 20 external entries and 50 total publishable skills
## Validation
- `uv run scripts/i18n/validate-i18n.py`
## Summary / 摘要
Add inline SVG icons to all 20 external pointer skills, so their cards
no longer fall back to an empty icon. The market catalog version is
bumped from `1.2.8` to `1.2.9`.
为全部 20 个外部 pointer skill 补齐内联 SVG 图标，市场卡片不再显示为空；市场版本由 `1.2.8` 升至
`1.2.9`。
## Compatibility / 兼容性
Depends on desirecore/desirecore#1177, which permits the `icon` field in
strict pointer-entry validation and forwards it through the offline
list/detail responses. That PR must merge first.
## Skill → icon screenshot / Skill 与图标截图
The preview labels every card with its display name and id.
Covered skills: `agent-reach`, `ai-news-radar`, `amap-jsapi-skill`,
`dingtalk-api`, `flyai-skill`, `follow-builders`,
`ian-xiaohei-illustrations`, `karpathy-guidelines`, `khazix-skills`,
`larksuite-cli`, `last30days`, `luckin-my-coffee`, `mattpocock-skills`,
`minimax-image-gen`, `minimax-tts`, `mt-paotui-for-client`,
`netease-skills`, `taste-skill`, `wechatpay-skills`, and `wecom-cli`.
## Validation / 验证
- `uv run scripts/i18n/validate-i18n.py`
- `uv run scripts/i18n/translate.py --check`
- Parsed all 20 `entry.json` icons as SVG XML
- `git diff --check`
- Rendered the committed preview asset locally
