## 中文
补齐官方市场里唯一缺失的主流 IM CLI 条目：**钉钉官方命令行工具 `dws`**（npm 包
`dingtalk-workspace-cli`，Apache-2.0，Copyright 2026 Alibaba Group），与已有的
`wecom-cli`、`larksuite-cli` 形成对称。市场此前只有社区的 `dingtalk-api`，覆盖面远小于官方 CLI。
### 变更
| 文件 | 说明 |
| --- | --- |
| `skills/dingtalk-cli/entry.json` | 合集指针条目 + 14 个官方子技能 `children` |
| `skills/dingtalk-cli/catalog-metadata.v1.json` | 治理 sidecar |
| `manifest.json` | `stats.totalSkills` 62 → 63；`version` 1.2.30 →
1.2.31；`lastUpdated` |
| `README.md` | 外部条目计数与清单同步 |
### 14 个子技能
`dingtalk-aisearch`、`dingtalk-aitable`、`dingtalk-calendar`、`dingtalk-chat`、`dingtalk-contact`、`dingtalk-doc`、`dingtalk-drive`、`dingtalk-event`、`dingtalk-mail`、`dingtalk-minutes`、`dingtalk-misc`、`dingtalk-shared`、`dingtalk-todo`、`dingtalk-wiki`
### 外部依赖披露
CLI 是**独立分发的第三方软件**，本条目只是市场登记，四处均已声明：
- **discovery description**（`entry.json#i18n.<locale>.shortDesc`）：需自行用
npm 安装 `dingtalk-workspace-cli`，需完成钉钉 OAuth
授权登录（**不支持账号密码登录**），DesireCore 不打包、不授权、不安装也不代运营钉钉或该 CLI
- **`compatibility.requirements`**（4 条）：CLI 需在 PATH 上、Node.js >=
16.7.0、`dws auth login` 建立的授权会话（缺失时必须在外部调用前停止，禁止编造成功结果）、能力覆盖取决于组织授予的
OAuth 范围与钉钉权益
- **本地化市场文案**：sidecar `presentation.i18n` 与 `entry.json#i18n` 逐字一致，zh-CN
/ en-US 双语
- **执行说明**：随 CLI 分发的上游 `SKILL.md`，不在本仓库
`redistribution: verify-package-terms` 会让客户端在安装响应里带出条款提示。
### 来源与治理的取舍（诚实声明）
上游 git 仓库 `https://github.com/open-dingtalk/dingtalk-workspace-cli`（该
URL 是发布方在 npm `package.json#repository` 里自己声明的）**当前对外返回 404，不可公开访问**，因此：
- `source` 用 `kind: git` + 该声明 URL，**不写 `ref`**——没有可观察的 commit，不编造固定版本
- 相应地 `provenance.content` 不可变，`governance.availability` 只能是
`listing-only`（`validate_catalog_metadata.py` 的 installable 强证据门禁要求不可变
ref + 已知 license + `reviewedAt` + `compliance`，本条目一样都拿不出）
- `governance.license` 保持 `{state: "unknown"}`（`entry.json#license:
"Apache-2.0"` 取自发布方声明与包内 LICENSE/NOTICE，但仓库内没有许可证据文件，只产生既有的
`legacy-license-unverified` warning）
- `timestamps.reviewedAt` / `releasePublishedAt` 保持 `unknown`；只有
`catalogUpdatedAt` 与 `upstreamObservedAt` 写入真实观察时刻
- `branding` 声明 `independent-listing` / `nominative` /
`not-used`：独立登记、名称为指代性使用、未使用对方 Logo（图标是通用终端窗形）
- 因为来源未固定，`gen-collection-children.py --check` 会输出 `SKIP`（与既有的
`mattpocock-skills` 同一路径），`children` 由人工按分发件内实际布局 `multi/<id>/` 撰写
### 校验（已实际执行，全部 exit 0）
```
uv run --quiet scripts/i18n/test_validate_i18n.py exit=0
uv run --quiet scripts/catalog/test_validate_catalog_metadata.py exit=0
uv run --quiet scripts/catalog/test_collection_generator.py exit=0
uv run --quiet scripts/catalog/validate_catalog_metadata.py --require-complete
0 error(s), 117 warning(s). agents=1, builtinSkills=34, pointerSkills=29,
publishableSkills=63, collections=8, collectionChildren=161, sidecars=64 exit=0
uv run --quiet scripts/i18n/validate-i18n.py 0 error(s) exit=0
uv run --quiet scripts/i18n/translate.py --check exit=0
uv run --quiet scripts/gen-collection-children.py --check exit=0
```
本条目产生的唯一 warning 是 `legacy-license-unverified`，与其余全部 pointer
条目一致。`entry.json` 另经客户端 `marketSkillEntrySchema` 的 Ajv 校验通过。
发布前公开信息边界检查已按 `CLAUDE.md` 执行并通过（工作树全量扫描含隐藏文件、路径名、分支名、commit 文案与本 PR
文本，零结果；令牌清单保存在仓库之外）。
---
## English
Adds the one mainstream IM CLI the official market was still missing:
the **official DingTalk CLI `dws`** (npm package
`dingtalk-workspace-cli`, Apache-2.0, Copyright 2026 Alibaba Group),
making it symmetric with the existing `wecom-cli` and `larksuite-cli`
entries. Until now the market only carried the community `dingtalk-api`,
whose surface is far smaller.
### Changes
| File | Purpose |
| --- | --- |
| `skills/dingtalk-cli/entry.json` | Collection pointer entry with 14
official sub-skill `children` |
| `skills/dingtalk-cli/catalog-metadata.v1.json` | Governance sidecar |
| `manifest.json` | `stats.totalSkills` 62 → 63; `version` 1.2.30 →
1.2.31; `lastUpdated` |
| `README.md` | External-entry count and list kept in sync |
### External dependency disclosure
The CLI is **separately distributed third-party software**; this entry
is a marketplace listing only. The dependency is disclosed in all four
required places:
- **Discovery description** (`entry.json#i18n.<locale>.shortDesc`): the
operator installs `dingtalk-workspace-cli` from npm and completes
DingTalk OAuth sign-in (**no username-and-password login**); DesireCore
does not bundle, license, install or operate DingTalk or this CLI.
- **`compatibility.requirements`** (4 entries): the `dws` binary on
PATH, Node.js >= 16.7.0, an operator-authorized session from `dws auth
login` (without it the skills must stop before the external call and
must never fabricate a successful result), and the fact that capability
coverage depends on the organization's granted OAuth scopes and DingTalk
entitlements.
- **Localized marketplace text**: sidecar `presentation.i18n` matches
`entry.json#i18n` verbatim, in both zh-CN and en-US.
- **Execution instructions**: the upstream `SKILL.md` files shipped with
the CLI, outside this repository.
`redistribution: verify-package-terms` makes the client surface a terms
notice on install.
### Source and governance trade-off (stated plainly)
The upstream git repository
`https://github.com/open-dingtalk/dingtalk-workspace-cli` — the URL the
publisher itself declares in the npm `package.json#repository` —
**currently returns 404 and is not publicly readable**. Therefore:
- `source` uses `kind: git` with that declared URL and **no `ref`**:
there is no observable commit, and inventing a pinned one is not
acceptable.
- Content provenance is consequently not immutable, so
`governance.availability` can only be `listing-only` (the installable
evidence gate in `validate_catalog_metadata.py` requires an immutable
ref, a known license, `reviewedAt` and `compliance`; none of these exist
here).
- `governance.license` stays `{state: "unknown"}`. `entry.json#license:
"Apache-2.0"` reflects the publisher's declaration and the
LICENSE/NOTICE shipped in the package, but there is no license evidence
file in this repository, so only the existing
`legacy-license-unverified` warning is produced.
- `timestamps.reviewedAt` and `releasePublishedAt` stay `unknown`; only
`catalogUpdatedAt` and `upstreamObservedAt` carry real observed values.
- `branding` declares `independent-listing` / `nominative` / `not-used`:
an independent listing, nominative use of the product name, and no
third-party logo (the icon is a generic terminal-window glyph).
- Because the source is unpinned, `gen-collection-children.py --check`
reports `SKIP` (the same path the existing `mattpocock-skills` entry
takes). The `children` list was written by hand against the
`multi/<id>/` layout actually observed in the distributed skill bundle.
### Validation (actually executed, all exit 0)
All seven checks from `.github/workflows/i18n-validate.yml` were run
locally and passed; the only warning attributable to this entry is
`legacy-license-unverified`, matching every other pointer entry.
`entry.json` additionally validates against the client's
`marketSkillEntrySchema` under Ajv.
The pre-publication public-information-boundary check in `CLAUDE.md` was
performed and passed with a zero-result scan across the working tree
(hidden files included), path names, branch name, commit text and this
PR text. The search tokens are kept outside the repository.
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: yi-ge <jackyoncode@gmail.com>
Removes the temporary QA-only Agent listing after successful real Market
installation verification. The installed local copy is intentionally
verified separately to ensure delisting does not delete user-owned
installations.
Temporary QA-only Agent pointer for validating the real publish,
install, and delist lifecycle.\n\n- Source repo is public and MIT
licensed\n- Pointer is pinned to immutable commit
dd4abbe342f25d0569dba152ce1be3fb867c3474\n- No user data, credentials,
or third-party content\n- A follow-up PR will remove this entry after
installation verification
## 变更说明 / Summary
### 中文
- 在 `workforce-optimization` 的发现描述、`compatibility`、中英文市场摘要和正文中明确 MindOpt
是需要独立安装/部署并取得有效许可证的外部第三方求解器。
- 明确 `MindOptSolve` 只是受治理的 Connector/Adapter，不包含 MindOpt
求解器软件、许可证、算力托管、采购或运行费用。
- 增加运行前检查：必须确认 Connector ready、capabilities 可用且部署具备当前用途所需的有效许可证；仅注册 Tool
名称不能证明依赖可用。
- 增加安全降级：外部依赖不可用时仍可完成需求澄清和建模制品，但不得调用求解器、伪造 `SolveResult` 或宣称可行/最优/收益。
- 在 `AGENTS.md` 与 `CLAUDE.md` 中固化通用的第三方商业依赖披露规则。
- Skill 版本升级到 `2.3.3`，Market 版本升级到 `1.2.24`。
MindOpt 官方文档说明运行前必须取得有效许可证，并同时提供商业许可和社区许可；适用范围与采购要求以官方条款为准：
https://opt.aliyun.com/doc/mindopt/latest/cn/html/installation/license.html
### English
- Discloses in discovery metadata, `compatibility`, localized
marketplace text, and runtime instructions that MindOpt is separately
installed/deployed third-party solver software requiring a valid
applicable license.
- Clarifies that `MindOptSolve` is only the governed connector/adapter
and does not bundle the solver, license, hosted compute, procurement, or
operating costs.
- Adds a preflight gate for connector readiness, required capabilities,
and applicable licensing.
- Defines safe degraded behavior: requirement and model artifacts may
still be produced, but no solver call or fabricated solution claim is
allowed.
- Adds a generic third-party dependency disclosure rule to both
repository instruction entrypoints.
- Bumps the Skill to `2.3.3` and the Market to `1.2.24`.
The official MindOpt documentation states that a valid license is
required and documents both commercial and community licenses;
eligibility and purchasing remain governed by those official terms:
https://opt.aliyun.com/doc/latest/en/html/installation/license.html
## 验证 / Validation
- `uv run --quiet scripts/i18n/test_validate_i18n.py` — 8 passed
- `uv run --quiet scripts/i18n/validate-i18n.py` — no issues
- `uv run --quiet scripts/i18n/translate.py --check` — current; human
translation hash aligned
- `git diff --check`
- Public-worktree customer-identity/path scan — 0 matches
## Summary / 摘要
Normalize the Configure Compute, Using Services, and Register Services
source SVG icons to pure white.
将“配置算力”、“使用服务”和“注册服务”的源 SVG 图标统一为纯白。
## Version / 版本
- Market: `1.2.16` → `1.2.17`
- Each affected skill: `1.0.2` → `1.0.3`
## Validation / 验证
- `uv run scripts/i18n/validate-i18n.py`
- `uv run scripts/i18n/translate.py --check`
- Parsed all three SVGs and asserted their only hex color is `#FFFFFF`
- `git diff --check`
## 摘要 / Summary
### 中文
在去除机械数字上限（#58）后，进一步删掉技能里追问/展示数量的**软性倾向措辞**——create
的「一次不要问太多以免用户负担」、discover 的「避免一次刷屏过多」。数量与节奏完全交由执行 Agent
自主判断，不带任何倾向暗示。create 2.5.4 / discover 2.6.4，manifest 1.2.15，中英双份同步、重算
source_hash（validate-i18n 通过）。
### English
After removing the mechanical numeric caps (#58), further drop the soft
directional hints on ask/display count — create's "don't ask too many so
as not to burden the user" and discover's "avoid flooding the screen".
Count and pacing are left entirely to the executing Agent's judgment
with no bias. create 2.5.4 / discover 2.6.4, manifest 1.2.15, both
locales synced, hashes recomputed (validate-i18n passes).
## 摘要 / Summary
### 中文
去除技能里束缚执行 Agent 自主判断的**机械数字策略**：create 需求收集的「每轮最多问 2 个」、discover
排序的「最多展示 5 个候选」。改为交由 Agent 按情况自主把握追问节奏与展示数量，保留「别让用户负担 /
别一次刷屏」的原则意图——把控制权交还给判断力更强的执行者，而非用固定上限约束。create 2.5.3 / discover
2.6.3，manifest 1.2.14，中英双份同步、重算 source_hash（validate-i18n 通过）。
### English
Remove mechanical numeric limits that constrain the executing Agent's
judgment: create's "at most 2 questions per turn" and discover's "show
at most 5 candidates". Both become "the Agent decides the pacing/count
by situation", keeping the principle intent (don't burden the user /
don't flood the screen) while handing control back to the more capable
executor instead of a fixed cap. create 2.5.3 / discover 2.6.3, manifest
1.2.14, both locales synced, hashes recomputed (validate-i18n passes).
## 摘要 / Summary
### 中文
#56 的复盘修正。上一轮"强改写压缩"把四技能 L1
的**技术属性、使用场景与交互示范当套话一刀切**，造成实质信息丢失（承诺"意图全保留"但未做到）。本 PR 补回：
- **create**：`创建仓库符合 AgentFS v2 规范、git
管理版本（可治理/可追溯）`定位；`基础创建`形态（name+description，description 自动填充 persona
L0）；需求收集的**引导问题示例**（"起什么名字？/主要负责什么？"…）；企业部署/开发者原型使用场景。
- **update**：`agent 目录 git 管理版本、历史可追溯`定位 + 使用场景。
- **discover**：使用场景（浏览/新用户/找替代）+ `语义匹配而非关键词搜索`。
- **delete**：使用场景（清理/测试/释放存储）。
根因：L1 混着实质技术属性与营销套话、使用场景是触发判据、引导问题是交互示范，不该按"只留独有信息"一刀切。补回后仍保留结构性压缩（zh
正文合计仍降 ~64%）。版本 create 2.5.2 / update 3.1.3 / delete 2.5.2 / discover
2.6.2，manifest 1.2.13，中英双份同步、重算 source_hash（validate-i18n 通过）。
### English
Post-mortem fix for #56. The previous aggressive compression treated the
skills' L1 technical attributes, use cases, and interaction demos as
boilerplate and cut them in a blanket way, dropping substantive
information (the "all intent preserved" claim wasn't fully met). This PR
restores: create's AgentFS-v2 / git-version-management positioning, the
"basic create" form (name+description auto-filling persona L0), the
requirement-gathering prompt questions, and enterprise/developer use
cases; update's git-versioned/traceable positioning and use cases;
discover's use cases and "semantic match, not keyword search"; delete's
use cases. Root cause: L1 mixed real technical attributes with marketing
boilerplate, use cases are trigger cues, and prompt questions are
interaction demos — none should have been blanket-cut. Structural
compression is retained (zh bodies still ~64% smaller). Versions bumped,
manifest 1.2.13, both locales synced, source hashes recomputed
(validate-i18n passes).
## 摘要 / Summary
### 中文
market#52 的修正:update-agent
附录示例使用了错误的字段名(`communicationStyle`/`must`),照示例调用会被 ManageAgent 的 Ajv
校验(additionalProperties: false)直接拒绝;`personality` 示例应为字符串数组。同时把 `get`
的返回示例对齐真实输出格式(`## persona.md` / `## principles.md` 段落含分层 markdown 原文,对应
desirecore#1230),并在附录固定列出结构化字段名清单。update-agent 3.1.1,manifest 1.2.11。
### English
Correction to market#52: the update-agent appendix examples used wrong
field names (`communicationStyle`/`must`) that ManageAgent's Ajv
validation (additionalProperties: false) would reject outright;
`personality` must be a string array. The `get` response example is
aligned with the actual output format (`## persona.md` / `##
principles.md` sections, per desirecore#1230), and the appendix now
lists the fixed structured field names. update-agent 3.1.1, manifest
1.2.11.
## Summary / 摘要
Add inline SVG icons to all 20 external pointer skills, so their cards
no longer fall back to an empty icon. The market catalog version is
bumped from `1.2.8` to `1.2.9`.
为全部 20 个外部 pointer skill 补齐内联 SVG 图标，市场卡片不再显示为空；市场版本由 `1.2.8` 升至
`1.2.9`。
## Compatibility / 兼容性
Depends on desirecore/desirecore#1177, which permits the `icon` field in
strict pointer-entry validation and forwards it through the offline
list/detail responses. That PR must merge first.
## Skill → icon screenshot / Skill 与图标截图
The preview labels every card with its display name and id.
Covered skills: `agent-reach`, `ai-news-radar`, `amap-jsapi-skill`,
`dingtalk-api`, `flyai-skill`, `follow-builders`,
`ian-xiaohei-illustrations`, `karpathy-guidelines`, `khazix-skills`,
`larksuite-cli`, `last30days`, `luckin-my-coffee`, `mattpocock-skills`,
`minimax-image-gen`, `minimax-tts`, `mt-paotui-for-client`,
`netease-skills`, `taste-skill`, `wechatpay-skills`, and `wecom-cli`.
## Validation / 验证
- `uv run scripts/i18n/validate-i18n.py`
- `uv run scripts/i18n/translate.py --check`
- Parsed all 20 `entry.json` icons as SVG XML
- `git diff --check`
- Rendered the committed preview asset locally
## 中文
新增官方内置技能 `configuring-compute`：让平台内智能体能帮用户配置算力供应商与 API Key。
- 完整流程：查看配置 → 创建/更新 provider → 写入密钥（只写端点）→ verify-key 验证 → 启用/同步模型 →
POST /api/compute/reload 刷新
- 安全模型写入技能文本：密钥只写不读，禁止读取 secrets.json 或尝试读回已有 key
- 加入 builtin-skills.json 清单；manifest version 1.2.6 → 1.2.7
依赖 desirecore 主仓库的配套 PR（掩码脱敏 + reload 端点）。
## English
Add the official builtin skill `configuring-compute`: enables
in-platform agents to configure compute providers and API keys for the
user.
- Full flow: inspect config → create/update provider → write key
(write-only endpoint) → verify-key → enable/sync models → POST
/api/compute/reload
- Security model embedded in the skill text: keys are write-only;
reading secrets.json or existing keys is forbidden
- Added to builtin-skills.json manifest; manifest version 1.2.6 → 1.2.7
Depends on the companion PR in the desirecore main repo (key masking +
reload endpoint).
