dingtalk-workspace-cli

326 Commits 183 Branches 115 Tags

3 Commits

Include renames

Author	SHA1	Message	Date
xuanandshangguanxuan.sgx	da2522c8ca	feat(pat)!: A-core loop for host-owned PAT (#142 ) * feat(pat): A-core minimum viable loop for host-owned PAT Enables third-party agents to integrate PAT via the smallest possible contract surface. The flow a host needs to ship end-to-end: 1. Export DINGTALK_DWS_AGENTCODE in the spawned shell. 2. Run any `dws ...` business command. 3. On PAT hit, CLI exits with code 4 and writes a single-line stderr JSON following docs/pat/contract.md §2. 4. Host parses the JSON and invokes `dws pat chmod <scope>... --agentCode ... --grant-type ...` to grant. 5. Host replays the original command. This PR intentionally ships ONLY the chmod path plus the host-owned switch; the async flow (apply / status / scopes + authRequestId registry + PAT_SCOPE_AUTH_REQUIRED active-request branch) lands in a follow-up stacked PR (A-ext). Scope of A-core: - Host-owned PAT trigger: auth.HostOwnsPATFlow() keyed exclusively on DINGTALK_DWS_AGENTCODE (DINGTALK_AGENT / DWS_CHANNEL / claw-type do NOT participate). - claw-type: hard-wired to "openClaw" in pkg/edition/default.go MergeHeaders hook, matching historical main behavior and decoupled from DINGTALK_AGENT. - dws pat chmod: factory-built (newChmodCommand) so the PAT subcommand tree has no shared package-level caller. - stderr JSON classifier: internal/errors/pat.go covers PAT_NO_PERMISSION / PAT_LOW_RISK / PAT_MEDIUM_RISK / PAT_HIGH_RISK / PAT_SCOPE_* selectors and fills data.hostControl for host consumption. - Env contract: DINGTALK_SESSION_ID / DINGTALK_TRACE_ID / DINGTALK_MESSAGE_ID carry HTTP trace headers (Chain B); DWS_SESSION_ID (+ REWIND_SESSION_ID alias) is the lone fallback for `dws pat chmod --session-id` (Chain A). The two chains are independent; aliases do not cross-pollinate. - Docs: docs/pat/{README,contract,host-integration}.md + refreshed docs/architecture.md "PAT Architecture" chapter + docs/reference.md PAT section. error-catalog.md folded into contract.md §6. - Tests: host-owned signal, stderr contract, classifier, chmod factory, retry / poll loop for the CLI-owned chmod path. Compatibility: no breaking changes on main. All non-PAT commands are untouched. Follow-up PRs (in order): - codex/pat-ext : dws pat apply / status / scopes + AsyncRegistry. - codex/pat-oss-refactor (aka PR B) : oauth_helpers / secure_store refactors split out per code review. Made-with: Cursor * fix(pat): unify host-owned stderr contract * revert: drop PAT docs and changelog from pat core PR * fix(pat): pin behavior auth endpoint * fix(pat): recognize legacy tool miss * fix(pat): fallback on gateway diagnostics * fix(pat): treat authorization uri as opaque * fix(pat): accept result envelope in device-flow polling * feat(pat): add browser policy and poll compatibility * fix(pat): keep CLI and host PAT contracts separate * test(pat): isolate opaque uri retry env * fix(pat): harden PAT result routing * fix(pat): harden host-owned flow and runtime fallback * fix(pat): preserve chmod failure on empty grant result * refactor(pat): drop dead doc anchors, dedupe stderr injection helpers Address two reviewer findings on top of the PAT-core series. Fix: - chmod: resolveSessionIDFromEnv silently selects DWS_SESSION_ID; drop the slog.Warn that emitted both raw session ids into stderr / ~/.dws/logs. - Remove every docs/pat/contract.md / error-catalog.md / host-integration.md anchor from comments, help, and tests; those files were never added by this branch. Comments are now self-contained or point to docs/reference.md where applicable. Refactor: - internal/errors/pat.go: extract lookupCodeIn so getPATErrorCode and getDWSGatewayErrorCode share one traversal; have ClassifyPatAuthCheck delegate to getPATErrorCode instead of repeating the enum walk. - internal/errors/pat.go + internal/app/pat_auth_retry.go: extract ApplyHostMutations as the single injection point for data.hostControl + data.openBrowser; cleanPATJSON and enrichPATErrorForHostControl now share it so the two stderr-JSON write paths cannot drift. - internal/app/pat_auth_retry.go: drop buildPATScopeHostJSON and buildHostControlState dead 1-line wrappers. - internal/pat/chmod.go: drop unused patApply/Status/Scopes constants; derive legacyToolArgs from toolArgs by clone + scopes->scope rename so the two payloads stay in lock-step on every other field. Net 15 files, +176 / -193. Verification: env -u DINGTALK_DWS_AGENTCODE go test \ ./internal/errors ./internal/auth ./internal/pat ./test/unit env -u DINGTALK_DWS_AGENTCODE go test ./internal/app \ -run 'Test(IsPat\|ExtractPat\|PrintPat\|PollPat\|HandlePat\|RetryWithPat\|EnrichPAT\|BuildPAT\|DirectRuntime\|ResolveIdentityHeaders)' env -u DINGTALK_DWS_AGENTCODE go test -race \ ./internal/pat ./internal/errors ./test/unit env -u DINGTALK_DWS_AGENTCODE go test -race ./internal/app \ -run 'Test(HandlePat\|RetryWithPat\|EnrichPAT\|BuildPAT\|ResolveIdentityHeaders\|DirectRuntime)' go vet ./... && go build ./... All green. Made-with: Cursor --------- Co-authored-by: shangguanxuan.sgx <shangguanxuan.sgx@alibaba-inc.com>	2026-04-28 21:17:23 +08:00
Ari	7828089081	feat: subcommand merging, schema pretty, IR overlays, v1.0.15 notes (#160 ) * feat(compat): merge same-name subcommands under shared parent When multiple server entries attach to the same parent and their cli.command collides with a subcommand already in the parent tree, the incoming subcommand's children are merged recursively into the existing one instead of producing a duplicate sibling. Leaf-name collisions resolve first-wins. Fixes the duplicate `group` / `message` rows in `dws chat --help` that surfaced when bot capabilities were distributed across chat.group.members and chat.message subtrees. * feat(ir): carry FlagOverlay and ToolAnnotations into canonical catalog FlagOverlay mirrors the per-parameter CLI overlay (alias, transform, transformArgs, env default, default value, hidden) sourced from market.CLIToolOverride.Flags. ToolAnnotations mirrors MCP 2025+ tool annotations with nullable hints (destructive / read-only / idempotent / open-world) so absence means "unknown" rather than "false". BuildCatalog now propagates both through the canonical layer, with tests covering group metadata and flag-overlay passthrough. * feat(output): add -f pretty for schema-aware colored output dws schema now supports -f pretty alongside json / raw. Pretty mode partitions output by product / tool / parameter / enum and applies ANSI color so humans can browse the catalog without piping through jq. json / raw behaviour is unchanged. docs/reference.md gains a Schema Introspection section documenting dws schema and the new pretty format. * feat(skills): refresh 13-product references; add devdoc / drive / oa SKILL.md cli_version bumped to >=1.0.15; product index reordered to match the v1.0.15 command surface. New references: - devdoc.md: Open Platform documentation search - drive.md: DingTalk drive (promoted out of Coming soon) - oa.md: OA approval end-to-end flow Major rewrites for aitable (dashboard / chart share, import/export, attachment flow), chat (bot capabilities merged into chat.message and chat.group.members), calendar (event suggest / attachments), doc (comment subtree, file create, upload/download flow), and minutes (list mine/shared/all unified, record subcommands split). Minor alignment touch-ups for contact / report / todo flag names. * docs(release): sync v1.0.15 notes — 159 commands across 13 products README Key Services fully refreshed: chat 23, calendar 14, aitable 41, doc 21, minutes 19; drive promoted out of Coming soon; workbench and standalone bot rows removed; Quick Start expanded to 7 examples spanning doc / minutes / drive; Coming soon trimmed to mail / conference / aiapp / live / wiki. Adds docs/command-index.md, an auto-generated English listing of all 159 runtime commands with description and when-to-use guidance aimed at AI agents. Replaces the ad-hoc command-index.pre.* / command-index.full.* snapshots used during development. CHANGELOG 1.0.15 records the compat subcommand-merging feature, the new command index, and a flag-naming cleanup across chat / calendar / drive / minutes / contact / devdoc.	2026-04-24 00:01:22 +08:00
qinzeandClaude Opus 4.6	077039bbf3	docs: streamline README layout and add reference manual - Simplify README.md and README_en.md with cleaner structure - Add centralized navigation links (reference, changelog) - Condense co-creation notice and quick-start sections - Add docs/reference.md as a unified command reference manual Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-28 20:26:20 +08:00

Author

SHA1

Message

Date

xuanandshangguanxuan.sgx

da2522c8ca

feat(pat)!: A-core loop for host-owned PAT (#142 )

* feat(pat): A-core minimum viable loop for host-owned PAT

Enables third-party agents to integrate PAT via the smallest possible
contract surface. The flow a host needs to ship end-to-end:

  1. Export DINGTALK_DWS_AGENTCODE in the spawned shell.
  2. Run any `dws ...` business command.
  3. On PAT hit, CLI exits with code 4 and writes a single-line stderr
     JSON following docs/pat/contract.md §2.
  4. Host parses the JSON and invokes `dws pat chmod <scope>...
     --agentCode ... --grant-type ...` to grant.
  5. Host replays the original command.

This PR intentionally ships ONLY the chmod path plus the host-owned
switch; the async flow (apply / status / scopes + authRequestId
registry + PAT_SCOPE_AUTH_REQUIRED active-request branch) lands in a
follow-up stacked PR (A-ext).

Scope of A-core:
- Host-owned PAT trigger: auth.HostOwnsPATFlow() keyed exclusively on
  DINGTALK_DWS_AGENTCODE (DINGTALK_AGENT / DWS_CHANNEL / claw-type do
  NOT participate).
- claw-type: hard-wired to "openClaw" in pkg/edition/default.go
  MergeHeaders hook, matching historical main behavior and decoupled
  from DINGTALK_AGENT.
- dws pat chmod: factory-built (newChmodCommand) so the PAT subcommand
  tree has no shared package-level caller.
- stderr JSON classifier: internal/errors/pat.go covers PAT_NO_PERMISSION
  / PAT_LOW_RISK / PAT_MEDIUM_RISK / PAT_HIGH_RISK / PAT_SCOPE_*
  selectors and fills data.hostControl for host consumption.
- Env contract: DINGTALK_SESSION_ID / DINGTALK_TRACE_ID /
  DINGTALK_MESSAGE_ID carry HTTP trace headers (Chain B);
  DWS_SESSION_ID (+ REWIND_SESSION_ID alias) is the lone fallback for
  `dws pat chmod --session-id` (Chain A). The two chains are
  independent; aliases do not cross-pollinate.
- Docs: docs/pat/{README,contract,host-integration}.md + refreshed
  docs/architecture.md "PAT Architecture" chapter + docs/reference.md
  PAT section. error-catalog.md folded into contract.md §6.
- Tests: host-owned signal, stderr contract, classifier, chmod factory,
  retry / poll loop for the CLI-owned chmod path.

Compatibility: no breaking changes on main. All non-PAT commands are
untouched.

Follow-up PRs (in order):
- codex/pat-ext  : dws pat apply / status / scopes + AsyncRegistry.
- codex/pat-oss-refactor (aka PR B) : oauth_helpers / secure_store
  refactors split out per code review.

Made-with: Cursor

* fix(pat): unify host-owned stderr contract

* revert: drop PAT docs and changelog from pat core PR

* fix(pat): pin behavior auth endpoint

* fix(pat): recognize legacy tool miss

* fix(pat): fallback on gateway diagnostics

* fix(pat): treat authorization uri as opaque

* fix(pat): accept result envelope in device-flow polling

* feat(pat): add browser policy and poll compatibility

* fix(pat): keep CLI and host PAT contracts separate

* test(pat): isolate opaque uri retry env

* fix(pat): harden PAT result routing

* fix(pat): harden host-owned flow and runtime fallback

* fix(pat): preserve chmod failure on empty grant result

* refactor(pat): drop dead doc anchors, dedupe stderr injection helpers

Address two reviewer findings on top of the PAT-core series.

Fix:
- chmod: resolveSessionIDFromEnv silently selects DWS_SESSION_ID; drop
  the slog.Warn that emitted both raw session ids into stderr /
  ~/.dws/logs.
- Remove every docs/pat/contract.md / error-catalog.md /
  host-integration.md anchor from comments, help, and tests; those
  files were never added by this branch. Comments are now self-contained
  or point to docs/reference.md where applicable.

Refactor:
- internal/errors/pat.go: extract lookupCodeIn so getPATErrorCode and
  getDWSGatewayErrorCode share one traversal; have ClassifyPatAuthCheck
  delegate to getPATErrorCode instead of repeating the enum walk.
- internal/errors/pat.go + internal/app/pat_auth_retry.go: extract
  ApplyHostMutations as the single injection point for data.hostControl
  + data.openBrowser; cleanPATJSON and enrichPATErrorForHostControl now
  share it so the two stderr-JSON write paths cannot drift.
- internal/app/pat_auth_retry.go: drop buildPATScopeHostJSON and
  buildHostControlState dead 1-line wrappers.
- internal/pat/chmod.go: drop unused patApply/Status/Scopes constants;
  derive legacyToolArgs from toolArgs by clone + scopes->scope rename so
  the two payloads stay in lock-step on every other field.

Net 15 files, +176 / -193. Verification:

  env -u DINGTALK_DWS_AGENTCODE go test \
    ./internal/errors ./internal/auth ./internal/pat ./test/unit
  env -u DINGTALK_DWS_AGENTCODE go test ./internal/app \
    -run 'Test(IsPat|ExtractPat|PrintPat|PollPat|HandlePat|RetryWithPat|EnrichPAT|BuildPAT|DirectRuntime|ResolveIdentityHeaders)'
  env -u DINGTALK_DWS_AGENTCODE go test -race \
    ./internal/pat ./internal/errors ./test/unit
  env -u DINGTALK_DWS_AGENTCODE go test -race ./internal/app \
    -run 'Test(HandlePat|RetryWithPat|EnrichPAT|BuildPAT|ResolveIdentityHeaders|DirectRuntime)'
  go vet ./... && go build ./...

All green.

Made-with: Cursor

---------

Co-authored-by: shangguanxuan.sgx <shangguanxuan.sgx@alibaba-inc.com>

2026-04-28 21:17:23 +08:00

Ari

7828089081

feat: subcommand merging, schema pretty, IR overlays, v1.0.15 notes (#160 )

* feat(compat): merge same-name subcommands under shared parent

When multiple server entries attach to the same parent and their cli.command
collides with a subcommand already in the parent tree, the incoming subcommand's
children are merged recursively into the existing one instead of producing a
duplicate sibling. Leaf-name collisions resolve first-wins.

Fixes the duplicate `group` / `message` rows in `dws chat --help` that surfaced
when bot capabilities were distributed across chat.group.members and
chat.message subtrees.

* feat(ir): carry FlagOverlay and ToolAnnotations into canonical catalog

FlagOverlay mirrors the per-parameter CLI overlay (alias, transform,
transformArgs, env default, default value, hidden) sourced from
market.CLIToolOverride.Flags.

ToolAnnotations mirrors MCP 2025+ tool annotations with nullable hints
(destructive / read-only / idempotent / open-world) so absence means
"unknown" rather than "false".

BuildCatalog now propagates both through the canonical layer, with tests
covering group metadata and flag-overlay passthrough.

* feat(output): add -f pretty for schema-aware colored output

dws schema now supports -f pretty alongside json / raw. Pretty mode
partitions output by product / tool / parameter / enum and applies ANSI
color so humans can browse the catalog without piping through jq.
json / raw behaviour is unchanged.

docs/reference.md gains a Schema Introspection section documenting
dws schema and the new pretty format.

* feat(skills): refresh 13-product references; add devdoc / drive / oa

SKILL.md cli_version bumped to >=1.0.15; product index reordered to match
the v1.0.15 command surface.

New references:
- devdoc.md: Open Platform documentation search
- drive.md: DingTalk drive (promoted out of Coming soon)
- oa.md: OA approval end-to-end flow

Major rewrites for aitable (dashboard / chart share, import/export,
attachment flow), chat (bot capabilities merged into chat.message and
chat.group.members), calendar (event suggest / attachments), doc (comment
subtree, file create, upload/download flow), and minutes (list
mine/shared/all unified, record subcommands split).

Minor alignment touch-ups for contact / report / todo flag names.

* docs(release): sync v1.0.15 notes — 159 commands across 13 products

README Key Services fully refreshed: chat 23, calendar 14, aitable 41,
doc 21, minutes 19; drive promoted out of Coming soon; workbench and
standalone bot rows removed; Quick Start expanded to 7 examples spanning
doc / minutes / drive; Coming soon trimmed to mail / conference / aiapp /
live / wiki.

Adds docs/command-index.md, an auto-generated English listing of all 159
runtime commands with description and when-to-use guidance aimed at AI
agents. Replaces the ad-hoc command-index.pre.* / command-index.full.*
snapshots used during development.

CHANGELOG 1.0.15 records the compat subcommand-merging feature, the new
command index, and a flag-naming cleanup across chat / calendar / drive /
minutes / contact / devdoc.

2026-04-24 00:01:22 +08:00

qinzeandClaude Opus 4.6

077039bbf3

docs: streamline README layout and add reference manual

- Simplify README.md and README_en.md with cleaner structure
- Add centralized navigation links (reference, changelog)
- Condense co-creation notice and quick-start sections
- Add docs/reference.md as a unified command reference manual

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

2026-03-28 20:26:20 +08:00