DingTalk Workspace CLI: baixar versions anteriors

This release promotes the sealed v1.0.65-beta.2 contents to stable.
Changed
- 汇总两个 beta 版本的改进：支持聊天消息内发送本地图片、跨 MCP 委托身份传递，以及数字员工的 A2UI 回复、群聊权限、引用与图片上下文和送达状态反馈。
Changes since v1.0.65-beta.2
Added
- 数字员工新增 A2UI 回复模式：支持的本地接入先发送占位卡，再将公开进度和最终答案更新到同一卡片。新连接默认使用 A2UI，已有未配置回复模式的连接保持文本回复。
- A2UI 创建和更新命令支持通过 --content - 从标准输入读取消息数组，避免长正文占用命令行参数。
- 审批图片上传 — 新增 oa approval image upload，校验本地图片并自动压缩超出 2MB 的图片，返回 mediaIdV2 供审批图片控件使用；同步修正联系人控件取值格式与部门 ID 核验指引。
- 群公告选项 — 创建和编辑公告支持 --no-card 静默发布及 --must-read 新人必看；显式传入 false 可关闭对应选项。
- 联系人身份查询 — 新增 contact user get-open-dingtalk-id（别名 get-open-id），按手机号或钉钉号查询 openDingTalkId，提供统一结果与 Schema；服务端灰度与频次限制仍适用。
- 登录审批来源 — CLI 授权状态、超级管理员查询及授权申请请求在识别到 Agent 宿主时携带来源标识。
Changed
- AI 表格访问密钥 — 标准命令调整为 dws aitable supabase api-key create/list/revoke。原 dws aitable api-key 三个命令继续兼容，参数、返回结果和权限要求保持不变。
Fixed
- Skill setup staging fail-closed (#1421) — path walks no longer skip read-only sibling directories behind a link entry, and staging identity read failures no longer delete by name or silently degrade to compat install, preventing leftover staging objects and false success reports during dws skill setup.
- Windows Agent skill link readability (#1425) — uses directory junctions with absolute canonical targets for Agent skill adapters on Windows, upgrades legacy directory symlinks, and validates readability before publication, preventing EPERM errors when followed by Node.js and Agent skill loaders.
- 升级版本比较 (#556) — dws upgrade、dws upgrade --check 和 dws doctor 比较版本时按 SemVer 忽略 build metadata（+...）。此前当前或远端版本号带 + 时，可能把更旧或相同的版本误报为可升级，或漏报真正的新版本。
- Prevent publishing a digital employee draft when its available last-editor identity differs from the current operator, while preserving compatibility for legacy drafts without that identity.
- Describe digital employee create and publish workflows as composite Schema interfaces, and publish the exact-one constraint for Skill updates using --enabled or --file.

本版本将已交付的 v1.0.64-beta.1 晋级正式版，汇总该 beta 的变化，并纳入下方列出的 beta 后变更。
Added
- Pi Coding Agent 接入 — 新增 --channel pi，支持官方 JSON 流式文本、模型覆盖、按会话隔离和重启续聊；ask 模式禁用工具。
- 通讯录好友与事件 — 增加好友列表、申请列表、发送和处理申请、删除好友，以及好友申请和添加事件；统一使用 openDingTalkId，提供到 userId 的查询入口，补齐昵称、备注、状态和 Agent 使用说明。写操作要求明确确认，删除好友属于高风险操作。
- OpenHarmony 发布包 — 增加静态自签名的 openharmony/arm64 归档和 SHA256，集成 SafeChat 消息加密；npm 与 Homebrew 的平台范围保持原有配置。
- 版本检查与升级提示 — auth status、version 和 --version 提供限时、可缓存、可关闭的更新检查；未知输入优先给出具体纠错建议，仅在缺少明确建议时检查新版，保留原错误类别、退出码和机器输出。
Changed
- AI 表格契约与公开同步 — 精确登记 24 项幂等性声明纠正，并限定已审查的公开同步补丁；未登记接口及风险、确认要求和执行效果的兼容保护继续生效。
Fixed
- AI 表格写入、等待与筛选 — 保留原始 clientToken，未知写入停止重放并通过只读对账恢复；补齐批次分组与旧回执兼容。建表、建字段提供有时限的结构核对，超时或取消不重复创建；统一查询、批量更新的筛选校验及 Help、Schema、Skill 说明。
- 日历、白板与 AI 卡片 — 修复日历嵌套时区与忙闲字段的写后核验，读回失败时保留写入回执；白板在预览或远端调用前校验 OpenNodes 层级与文本样式。更新 AI 卡片协议索引、兼容预检、预览及业务标识处理，补齐白板和卡片使用说明。
- 升级来源与安装方式 — 开源版默认通过 npm Registry 查询版本；包管理器安装交由对应工具升级，独立二进制校验 npm 包完整性与资产 SHA256 后自更新，无需 npm 或 Node.js。保留备份、回滚和 Skill 更新，修复 npm 强制升级、同版本重装及安装文档中的环境变量传递。
Changes since v1.0.64-beta.1
Removed
- Chat Thread — 下线 chat thread promote，历史调用返回 command_retired，帮助与 Skill 不再推荐该命令。已有消息转为话题暂无等价替代；新建话题使用 chat thread send，回复已有话题使用 chat thread reply。
- 招聘产品下线 — 开源版移除 dws recruit job list、get、create 及整个招聘产品域的内置注册、Schema、MCP 端点和 Skill 入口。招聘能力仅在千问办公专属版维护。
Fixed
- wget-only install of the latest release (#1456) — resolving latest without curl now requests the GitHub releases URL directly, so wget can read the release tag instead of failing before the download.
- 修正 npm 包的问题反馈、仓库和主页链接，统一指向 DingTalk-Real-AI/dingtalk-workspace-cli，避免 npm bugs 打开 404 页面。
- 招聘退役兼容检查 — 精确登记已批准的开源招聘产品退役，避免仍含招聘能力的旧稳定版阻塞后续 PR 和发布兼容检查；其他产品和接口的兼容保护保持生效。

本版本将已交付的 v1.0.63-beta.3 晋级正式版，汇总本版本线三个 beta 的变化，并纳入下方列出的 beta 后变更。
Added
- 数字员工 — 新增管理、能力资源、运行追踪、员工身份登录与本地 Agent/DSH 接入；支持草稿、发布、Skill ZIP 上传与员工域 MCP 配置，使用 agentUuid / userId 身份契约。草稿配置与发布分别执行，事件连接状态区分 IPC、Agent 初始化和实际传输就绪。
- 通讯录与邮箱查人 — 支持通过 dingtalkId 查询 userId，通过企业邮箱单个或批量查询员工；批量查询分别保留已成功、未找到、失败与未知结果，避免把未确认结果报告为未找到。
- 考勤审批与鉴权快照 — 增加审批时长计算、出差/外出配套日程校验及复杂加班设置查询；auth status --readonly 提供不联网、不刷新、不写凭据的本地状态快照。
- 等待能力 — 框架增加声明式轮询、事件与自动回退等待；声明支持的命令提供 --wait / --wait-timeout，超时保留 pending 与最后观察状态，事件与轮询共用截止时间。
- 白板与 AI 表格恢复 — 增加白板 SVG 预览、差异确认、个人/团队及模板中心模板；AI 表格提供只读写入结果查询及保留原 clientToken 的不确定写入恢复路径。
Changed
- Schema 与启动性能 — 每次执行保持完整 Cobra 命令树，减少元数据和初始化分配；支持平台在安装或首次使用时从本机声明生成身份及经过认证的持久缓存。缓存缺失或损坏时修复，运行时插件场景由隔离子进程完成缓存构建与修复。
- 消息读取与国际登录 — 智能消息读取在策略允许时解密第三方加密消息，保留逐项解密台账；MCP 与输出投影保留大整数精度。国际登录默认使用英文，国内登录沿用现有语言设置。
- 数字员工参数与文档 — 主程序类型统一使用 --type，可见范围使用 --user-ids，保留历史参数兼容；支持可选创建提示词、发布本地员工前按需初始化提示词，以及草稿文本的空值校验。更新 OA TableField 二维数组示例、Devapp/Devdoc 流程及文档列表路由。
- 参数错误 — 框架统一参数校验的错误分类与退出码，保留业务错误及取消/超时的原有语义。
- AI 搜问证据 — 丰富搜索结果的证据与解析详情，使用说明要求先核对证据再给出结论或交接后续操作。
Fixed
- 跨平台发布 — 修复 Windows SafeChat CGO 运行库崩溃，以及 Darwin amd64 产物被 dyld 拒绝启动的问题；Darwin 构建固定 macOS 11.0 最低目标，签名资产验收检查 SG_READ_ONLY 并实际启动可执行的 Darwin 产物。
- AI 表格回执与分页 — 表单分享按返回身份、显式请求字段和 CP 同步状态验证结果；未完整确认时保留部分失败证据。未知写入不重放创建；失效游标丢弃旧快照结果，复合流程停止后续写入。配套恢复接口仍依赖对应 MCP 服务与网关部署。
- 登录恢复 — 缺失 DEK 或旧密文不匹配时允许重新登录，取得新凭据后才替换目标；登录中的临时身份查询立即使用本次 MCP 端点覆盖，保留刷新及暂时 Keychain 故障的保护。
- 消息与事件 — 修复单聊引用回复的误拒绝，保留 OA 审批事件业务字段；个人 Stream 正确响应系统控制帧，数字员工连接沿用事件来源默认规则，改进重连及 Windows 正常停止判断。
- 文件与凭据边界 — 数字员工 Skill ZIP 使用同一已打开句柄完成校验与上传，防止路径替换；补充失败清理、绑定回执和日志脱敏验证。
Removed
- 旧合同审查入口 — 隐藏历史 contract review benefit|create|analysis|result 命令并标记不可用；保留历史参数入口，但以 command_retired 拒绝执行，不再调用旧 MCP。
Changes since v1.0.63-beta.3
Added
- Add dws aicard explain <name>, lint, and preview. The embedded DingTalk A2UI protocol supports native offline lookup and structural validation without Python. Preview validates a complete new-card file and sends it to the current user's direct chat; dry-run does not send. Include the DWS authoring Skill and report request acceptance separately from client-rendering evidence.
- Drive & Wiki set-share-scope — add dws drive permission set-share-scope and dws wiki permission set-share-scope for managing node-level and workspace-level share visibility (PRIVATE / ORGANIZATION / PUBLIC) with partial-update semantics, role control, partner inclusion, organization search/recommend toggles, password protection and expiration (drive node only).
- OA 审批模板创建与更新命令 — 新增 dws oa approval template create（oa/create_process_template）与 dws oa approval template update（oa/update_process_template），均为企业钉钉管理员能力。两者支持逐项参数模式（create 必填 --name、--schema-content；update 必填 --process-code、--name、--schema-content、--process-config），也支持 --from-document 传入完整 JSON 文档的绝对路径整体配置，两种模式互斥；--schema-content、--process-config 等对象参数以 JSON 字符串发送给 MCP，--plugin-configs、--visible-range、--manager-user-ids 以数组发送，均支持直接 JSON、@文件 与 - 标准输入。CLI 侧做本地校验：schemaContent 控件 props.id 唯一性检查（递归进 children 嵌套控件）与 processConfig 结构校验，并解析 MCP 返回的 810001（同名模板冲突）/810002（模板数量超限）拒绝码为失败输出而非静默重试；--dry-run 仅做本地校验并展示请求参数（executed=false），成功统一由 data.processCode 返回模板编码。构造 processConfig 时若未显式指定审批人类型，审批节点默认使用部门主管（target_management）而非直属主管。Skill 文档：新增 oa-template-write.md（从 oa.md 拆分模板写入路由，渐进披露）与连接器审批人规则 target_connect_approval.md，并补充 50+ 个控件 schema、流程节点、选人规则子文档；oa.md 增加模板管理路由条目、process-nodes.md 增加连接器审批人条目、SKILL.md 引用 oa-template-write.md。验证状态：变更代码含完整单测（含 schema_oa_template_contract_test.go Schema 契约测试）与 mono-multi-coverage.yaml 的 oa-template-write 注册；模板名称是否可用、数量是否超限由创建 MCP 校验，dry-run 不能证明名称可用，建议创建/更新后再用 template detail 核对实际状态。
- AI 表格访问密钥 — 新增 SQL Sheet API Key 的创建、查询和撤销命令，以及对应的 Agent 使用说明；完整凭据仅创建时返回，创建结果未知时先查询状态。
Changed
- Git hooks 改为通过 make setup-hooks 显式启用，提交前仅检查暂存区格式与空白，不修改工作区。
- 发布辅助脚本在退出时可靠清理临时目录和锁，并为下载增加有界重试、超时和阶段诊断。
Fixed
- 固定 AI 卡片协议 JSON 的 Git 检出换行为 LF，修复 Windows 自动转换 CRLF 后协议哈希校验失败、卡片查询和校验命令无法使用的问题。
- 修复 Windows 鉴权文件替换遇到短暂文件占用时的失败，保留旧文件并对受限错误执行有界重试。
- 修复 Linux Skill 安装期间的目录身份校验，固定目录句柄并在结束后释放。
- 修复产品

This stable release promotes the sealed v1.0.62-beta.8 baseline and adds verified AI Table, document, event, calendar, chat, AISearch, and language-default improvements merged afterwards.
Changes since v1.0.62-beta.8
Added
- Add AI Table shortcuts for exact field/view resolution, bounded record reads and NDJSON export, batch record/field creation with readback and recovery, App pages and widgets, forms, dashboards, aggregation, and attachment downloads. Preserve existing entry points and equivalent aliases; reject incomplete pagination, mismatched write verification, and unverified AI submission receipts instead of reporting success. Downstream capability and permission limitations remain explicit.
- Doc shortcut workflows — add local and online document structure checks with doc +script, verified standalone media upload with doc +media-upload, optional title fallback, and ordered media attachments during document creation.
- Doc reading and editing — add direct-folder search filtering, readable date filters, chapter and regex block-context reads, document comments, and verified same-document block copying and range editing while preserving existing commands and aliases. Range edits remain sequential, not atomic.
- Doc media controls — add clipboard image input, attachment preview/summary selection, vertical cover positioning, persistent preview output, and explicit download overwrite; fix tag filtering and keep upload progress off JSON stdout.
- Doc download confirmation — use doc +download-overwrite --source media|cover for confirmed replacement of local files. Existing media, preview, and cover downloads retain their no-clobber behavior and safety contracts; preserve the preview output shorthand -o.
- Create with media confirmation — use doc +create-with-media --media-files to create a document and upload local images or attachments after confirmation. Plain doc +create retains its published behavior and does not accept media uploads.
Changed
- AITable query routing (#1342) — clarifies routing among raw record queries, server-side statistics, PostgreSQL analysis, and full data export.
- 默认界面语言 — 未设置语言或语言值不受支持时，默认使用简体中文；保留 DWS_LANG 优先于 LANG 的解析顺序及显式英文设置。
Fixed
- Personal events now obtain managed AppKey metadata when it is missing locally in open-source normal mode, without requiring an AppSecret or changing saved credentials. Existing application identities retain precedence, background listeners reuse the resolved AppKey, and metadata failures report actionable retryability.
- Clarify AISearch evidence checks for time, identity, relevance, uniqueness, and same-condition handoffs to native products.
- Guide newly shared AI Table forms to pass their known title through --form-name; require usage-only Agent answers to perform exactly one safe leaf discovery query, then lead with a complete command or an explicit placeholder template without guessing missing IDs, and state that omitted share settings stay unchanged without claiming execution; reject undeclared record-comment rich-content fields before invoking MCP; preserve actionable comment visibility errors; and move AI Table comments, record ID pagination, entity search, and PSQL machine output onto reviewed unified result contracts whose dry-run previews satisfy the published Result Schema and whose comment pagination guidance reads continuation state from meta.pagination.
- Calendar invitation receipts — fixes false readback_attendee_missing failures from calendar +invite and calendar +book --with when participant responses omit user IDs and display names differ from directory names. Invitations require an explicit successful write receipt and report verified=false; +invite adds acknowledged=true, while +book --with adds attendeesAcknowledged=true and retains event readback through eventVerified=true.
- Chat rich-text links — preserve link-item URL targets alongside their labels in message projections, including links without labels.

This release promotes the sealed v1.0.61-beta.3 contents to stable.
Changed
- Agent-ready command contracts — expands reviewed Help, Schema, safety,
selection, result, pagination, and recovery guidance across the CLI, and
moves static MCP authoring and published-tool invocation onto explicit
dws dev mcp and dws mcp published command surfaces.
- Collaboration and event workflows — adds Chat Thread promotion,
conversation-file upload, bounded message pagination, safer quoted replies,
DingTalk task lifecycle events, and VoIP invite event consumption.
- Document and data operations — broadens Sheet batch and CSV controls,
strengthens AI Table routing and composite verification, hardens Drive and
Wiki shortcuts, and adds safer delegated authorization plus URL-only,
optional-output, overwrite-protected, and concurrent-writer-safe downloads.
- Organization and automation commands — adds contact label and custom
field management, tightens attendance date handling and DingTalk task
workflows, and improves login, Windows Skill installation, and executable
doctor recovery guidance.
- Runtime and connector reliability — preserves compatible document,
Markdown, chat, and shortcut result shapes while improving DING, Whiteboard,
Qoder Stream, and cross-product verification and failure evidence.
Changes since v1.0.61-beta.3
Added
- Chat conversation-file upload — adds chat conversation-file upload for local files, returning reusable dentryId and spaceId without sending a chat message while leaving the retired chat file upload path unchanged.
- Chat message list page-all — dws chat message list now accepts --page-all to iterate the time-boundary pagination automatically and return one merged messages array (with pagesFetched, stopReason, nextPage, and per-page failure diagnostics). --page-limit (default 50), --max-items, and --page-delay tune the sweep; without --page-all the command keeps its exact single-page behavior.
- Delegation auth capability options — when --principal-user-id is set, the per-tool check_capability verification now carries a tool-specific options payload so the server can authorize the exact operation. create sends the create action parameters (name/type/target folder or workspace), upload/get_file_upload_info send the upload action parameters (file name and size), import/create_import_session send the target node together with file name, suffix, and size, copy/move send the resolved source node, permission management sends the target members, and drive publish (set_file_publish) sends the share-scope target (shareScopeSetParam) so making a file internet-public (WEB) is pre-checked. Tools without a mapping continue to check without an options key.
- Permission target members mapping — permission-management delegation checks normalize both the new structured member format and the legacy --users list. Legacy user ids are converted into the structured target-member shape using the current logged-in enterprise corpId (resolved through the $corpId runtime default), keeping old and new invocations equivalent.
- Import and upload dry-run delegation parity — doc import and doc upload now run the delegation pre-check on their dry-run previews, matching the execution path. A dry-run combined with --principal-user-id is verified against the command's real first delegated call (create_import_session / get_file_upload_info) before any preview is rendered, and a denied principal blocks the preview.
- Import target folder node resolution — extractNodeId now recognizes targetFolderId (the key doc import --folder uses to carry its destination), so folder-targeted imports resolve a node id and are gated correctly. copy/move remain unaffected because an explicit nodeId still takes precedence over the folder keys.
- Drive download URL-only mode — dws drive download and dws drive download-version accept --url-only, a non-downloading mode that returns the temporary signed download URL and required request headers (downloadUrl/headers, plus op

This release promotes the sealed v1.0.60-beta.3 contents to stable.
Changed
- Document, Drive, and Sheet workflows — adds Drive quota, task polling,
export, permission, comment, public-link, history-version, revision, floating
image, and delegated-access workflows; hardens document import, large
Markdown writes, download handling, and readback verification.
- Collaboration and automation commands — adds dedicated Chat Thread
commands, AITable datasource management, Agoal scorecard search, OA approval
attachment upload, and reviewed Whiteboard workflows.
- Agent-safe CLI contracts (#1161) — publishes stricter pagination, result,
confirmation, routing, and error contracts across report, Sheet, Minutes,
AiSearch, Contact, Task, Wiki, and document commands, plus reviewed argument
aliases for Agoal, DevApp, AITable, and Chat shortcuts.
- DWS OpenAPI escape hatch — supports file-backed parameters and request
bodies, multipart uploads, pagination, and bounded binary downloads while
tightening redirect, credential-pair, Keychain migration, and error-handling
behavior.
- Supported command surface — removes the retired Education and College
vendor extensions and improves command typo guidance, fork admission, and
Reviewer Router merge recovery without weakening protected-main checks.
Changes since v1.0.60-beta.3
Added
- Drive local-file comments (#1151) — adds the complete global comment
lifecycle for Drive files through the shared document comment service,
including create-v2, list-v2, reply, update, delete, batch query,
direct-reply listing, resolve, restore, and reaction replies. The existing
create and list leaves retain their legacy behavior and output contract
with deprecation guidance for an explicit migration.
- Markdown comment reads (#1151) — adds comment listing for native Markdown
files with global, inline, resolution-status, and cursor filters, and exposes
direct-reply listing across the shared Doc and Sheet comment lifecycle.
- Chat Thread commands — adds thirteen chat thread leaves for topic-circle creation, Thread publishing, reading, replying, forwarding, recall, emoji reactions, and text emotions. Parameters keep the original chat group / chat message names, including --conversation-id, --topic-id, and the existing forward flags.
- Doc-business delegation auth — the drive, doc, sheet, wiki, and markdown command groups now accept a persistent --principal-user-id flag. When set, the first invocation of each doc-business tool key per node within a session is gated by a check_capability verification on behalf of the principal; granting the capability is an out-of-band action the principal completes on the server side, and the CLI never calls grant_capability. A denied check surfaces the server's denial message and blocks the original call.
- Dry-run consistency — checkCapability now executes in dry-run mode as well, ensuring preview and execution behaviors are consistent. In dry-run, the check routes through the ReadTool channel (real network request) instead of CallTool (which would go through EchoRunner and always deny).
- Dry-run pre-check in helpers — dry-run mode now invokes the delegation auth validator before rendering the preview, ensuring commands that would be denied at execution time are also blocked at preview time.
- Local rejection for node-less commands — commands that lack a node identifier (e.g. search/list/create without nodeId) now return a clear client-side error (DELEGATION_AUTH_NOT_SUPPORTED, exit code 3) when --principal-user-id is set, instead of forwarding an incomplete request to the server.
- Concurrency safety — the per-session checked map in the delegation auth decorator is now protected by a sync.Mutex, preventing data races under concurrent tool invocations.
- Markdown dry-run parity — the markdown fetch/create/overwrite/patch/diff commands now run the same check_capability delegation gate on their dry-run previews as doc/drive do; a dry-run combined with --principal-user-id is verified again

This release promotes the sealed v1.0.59-beta.5 contents to stable.
Changed
- Chat personal emotions — adds commands to list, send, and favorite the current user's personal favorite emotions.
- Minutes, DingTalk tasks, and Wiki parameter aliases — adds reviewed parameter-name normalization, ambiguity guards, and end-to-end payload coverage.
- Shortcut functional workflows — fixes Drive preview accuracy, AITable write verification and deletion accounting, Wiki feeds, and false-success handling across task, Contact, Minutes, and Wiki operations.

This release promotes the sealed v1.0.58-beta.6 contents to stable.
Changed
- Expanded collaborative workflows — adds full AI Table, Sheet, Minutes,
approval-event, Drive-comment, document export, and CSV workflow support,
including safer validation, explicit confirmation for writes, and
machine-readable completion receipts.
- More capable Chat operations — adds robot image/file messages, toolbar
management, streaming-card mentions, automatic pagination controls, and
clearer post-send ID, Markdown-image, paging, and result-shape guidance.
- Reliable Agent and CLI contracts — expands Agent-visible Chat and
Minutes commands, aligns bundled skills, improves schema/result envelopes,
and hardens parameter, pagination, runtime-token, and write-result
verification so ambiguous or incomplete operations fail closed.
- Multi-skill install and upgrade — makes the multi-skill layout the
default for fresh installs and upgrades while preserving an explicit legacy
mono option.
- Safer release delivery — strengthens release-equivalent compatibility,
sealing, package verification, and evaluation-dispatch checks for more
reliable cross-platform releases.

This stable release promotes the fully delivered v1.0.57-beta.4 baseline.
It includes the v1.0.57 beta-line command-contract, document, chat, OA, Wiki,
and compatibility improvements, plus the multi-skill framework alignment and
expanded calendar, Drive, Markdown, Mail, and Minutes workflows validated in
the final prerelease.
- Promote v1.0.57-beta.4 — publishes the final validated prerelease
baseline as stable v1.0.57 without adding post-beta product changes.

This stable release promotes the fully delivered v1.0.56-beta.4 baseline.
It includes PR #852's resilient multipart Drive download implementation,
together with the v1.0.56 beta-line command, Schema, Skill, and runtime
improvements already validated through the prerelease channel.
Added
- Resilient multipart Drive downloads (#852) — drive download and
drive download-version support parallel chunk transfer, Range probing,
fingerprint-validated checkpoint resume, automatic 401/403 credential
refresh, and graceful interruption with checkpoint preservation.

This release promotes the validated v1.0.55-beta.8 baseline to stable. It
expands the public Workspace command surface and personal event consumption,
makes the full built-in shortcut catalog available to Agents, and hardens
multi-account routing, authentication compatibility, command safety, and
response projection across the CLI.
Added
- Broader Workspace command surface (#621, #676) — adds roughly 30 reviewed Drive, Doc, Sheet, and Chat leaf commands synchronized from Wukong, including Drive version and permission operations, document styling, Sheet comment/version/formula verification, and in-place text-emotion updates. A reusable declarative LeafSpec framework now delivers command identity, safety, selection, and guarded Help metadata consistently.
- Complete Agent-visible shortcut delivery (#802, #815) — publishes all 210 built-in shortcuts as reviewed Runtime Schema leaves across 16 products, including 88 validated Chat shortcuts, with executable paths, parameters, constraints, selection guidance, dry-run capabilities, and runtime-aligned confirmation semantics.
- Expanded enterprise and event capabilities (#790) — adds the HR Brain talent-pool, employee-profile, and structured-search command families; dws mcp url get resolves MCP Market endpoints; personal event consumption supports eight additional IM event keys, multi-key consumers, and targeted shutdown.
- Agent integration identity (#804, #816) — adds validated DWS_AGENT_HOST and DWS_AGENT_PRODUCT labels for observability and product attribution while keeping them separate from authentication and authorization.
Changed
- Progressive multi-Skill guidance and account safety (#621, #821) — reorganizes bundled product guidance for progressive discovery and restores the mandatory rule that Agents must not guess an account when a multi-account organization has no unique current default.
- Supported Chat file delivery — retires the legacy AppKey/AppSecret-backed chat media upload command from discovery and routes local files through chat message send --msg-type file --file-path, while callers with an existing media ID can continue sending images directly.
- Guarded release delivery (#791) — strengthens immutable GitHub, npm, Homebrew, optional mirror, recovery, and version-allocation checks while keeping beta and stable publication role-gated and auditable.
Fixed
- Shortcut and message projection correctness (#706, #783, #795) — prevents successful read shortcuts from silently projecting non-empty backend responses to empty results, renders rich, forwarded, and encrypted message forms safely, and fixes group-bot, bot-search, mail-thread, media-ID alias, and Todo paging response handling.
- Command contract edge cases (#803) — makes approval revocation and document rollback honor dry-run before confirmation or preflight, fixes Drive and Doc rename semantics, restores Drive-specific metadata, and validates Todo reminder rules.
- Authentication and external-contact compatibility (#756, #757) — migrates legacy global and organization-scoped credentials without cross-account token borrowing, preserves contacts that expose only openDingTalkId, and aligns message-resource flags with message-list output fields.

This release promotes the validated v1.0.54-beta.2 baseline to stable. It restores the default transport envelope for personal event output with opt-in flattening, plus Schema CLI path and plugin overlay compatibility fixes.
Changed
- Personal event output compatibility (#743) — event consume once again preserves the transport envelope by default for ndjson/json/pretty, while retaining the existing compact processor. New Agent workflows opt into the event-specific top-level DTO with --flatten, which is mutually exclusive with -f raw and --debug-raw-events; event schema --flatten describes that DTO, while the default schema describes type/event_type/data/headers and points to .data | fromjson.
Fixed
- Schema CLI path compatibility (#738) — user-facing Schema lookups once again accept space-, dot-, and slash-separated CLI paths without weakening strict canonical identity resolution.
- Plugin CLI overlays (#701) — installed plugins register their manifest-authored command trees again for HTTP and stdio servers, and a plugin may now replace a hidden compatibility fallback (for example conference) instead of being skipped as a distribution conflict.

[1.0.52] - 2026-07-14
This release seals the v1.0.52 line with personal event subscriptions, a deterministic 22-product Agent command catalog, local user-operation auditing, expanded Open product commands, safer macOS credentials and release signing, and more reliable Connect and IM delivery.
Added
- Personal event subscriptions (#589) — adds dws event list/schema/consume/status/stop for user @ mentions, selected one-to-one chats, and selected group chats. consume can create or reuse a personal subscription, multiple local consumers share one bus while keeping outputs isolated by event type and subscription, and the mono/multi event Skills ship with the binary.
- Open product command capabilities (#608) — adds Sheet table, pivot-table, and gridline commands; Chat message favorites; Drive statistics and shortcuts; and Doc comment update/delete, with matching mono/multi Skill documentation and command-contract coverage.
- Local user-operation audit log (#555) — operations executed through dws now produce redacted daily JSONL records with actor, command and endpoint, result or error category, duration, CLI/platform metadata, and a SHA-256 previous-hash chain for tamper evidence. Writers coordinate through a cross-process file lock and rotate logs safely; dws audit tail inspects recent records, dws audit export emits date-filtered JSONL or CSV, and dws audit verify reports the first broken link in a file's hash chain.
- Stable Agent command catalog (#598) — dws schema now ships a deterministic 22-product / 564-tool catalog generated from the executable Cobra tree, with progressive product/group/leaf queries, complete parameter contracts, reviewed command identity and aliases, safety/confirmation metadata, field provenance, and final-delivery completeness/drift gates. The catalog is embedded at build time and does not require runtime MCP tools/list discovery.
- Reviewed Schema for local commands (#598, #609) — event consume/list/schema/status/stop and audit export/tail/verify enter the reviewed CommandRegistry, bind to the real Cobra tree at generation time, and ship through the same typed ToolSpec and embedded Catalog path as public MCP-backed commands. Leaf, group, product, and --all queries are projections of that single delivered model.
- Safe macOS Keychain → file-DEK migration (#597) — dws auth migrate-keychain --to file-dek preflights every legacy/profile auth entry before rewriting, ignores unrelated application secrets, supports side-effect-free --dry-run, requires explicit --yes, and lets sandboxed and normal processes share an existing login without exposing tokens.
Changed
- event consume AI-subprocess contract (#609) — emits a fixed ready line and a final controlled-exit summary, supports parent-pipe stdin EOF as graceful shutdown, forwards --profile to the detached bus, surfaces bus startup errors, and cleans up subscriptions according to ownership so orchestrators can drive event streams without sleeps or leaked server-side subscriptions.
- Wukong IM read-result parity (#618) — chat message list preserves quoted merged-forward and image context; message-search entitlement failures retain the server-provided friendly hint and action URL; and ding message list exposes each DING's content alongside its ID and status.
- Developer ID signing for official macOS archives (#605) — official releases now require both Darwin archives to be signed with the configured Apple Developer ID certificate, timestamp, and hardened runtime. The release job validates credentials and signatures and fails closed instead of silently publishing ad-hoc-signed official binaries.
Fixed
- Smart-category mappings and runtime network diagnostics (#591) — chat category create-smart now maps category names, group-name keywords, and member OpenDingTalk IDs to the live MCP contract, rejects blank or empty supplied values locally, and reports runtime tools/call connection failures as actionable API/network errors instead of internal discovery failures.
-

Changelog
- ea6fd16d11b2e4261468cf0eb1da63c43bc87fb7 chore(changelog): prepare v1.0.51 stable (#595)

Changelog
- 818b8b29e382b514f3fcb5b1d167e91c81ec17b8 chore(changelog): add v1.0.50 release notes (#580)
- 91dfc8b926c4e57899a7859ef79f11b2b6db33b7 fix: export command merge helpers
- 109ad138445c43215433b45d315e8cc93bb7332a fix: honor global --jq/--fields on product commands; round-2 QA fixes (#575)

Changelog
- e6c1dfe15cfcd6e9cae651db65099540161fa9fa Merge pull request #570 from DingTalk-Real-AI/fix/release-publish-unblock
- 32d32cd827a3166b3d253434b182ff09cc6b1bed Merge pull request #572 from audanye-sudo/fix/qa-optimize-6products
- a65d6f23ec7995c7a2aff44abed14f4b7871a7ed fix: resolve real-machine QA findings across CLI, scripts and skill docs
- b794d802f2da4b9121d7b70f6d3da77564618b55 release: prepare 1.0.49 stable (#574)

Changelog
- b83e6dc2390fbf76cbf2e855951c858e874a2538 release: prepare 1.0.48 stable

Changelog
- b63e1b446959eddce5ec10c15041f148b83802ac release: cut 1.0.47 — connector supervision + bot-to-bot @-mention (#548)

Changelog
- bba94c0092acd59d6ecd72026640d8821a51e1eb docs(changelog): cut 1.0.46 (#542)
- fe4a79283c5ce18ebe6a16356b4a6cbb95289a67 fix(pat): keep agent code grants aligned (#536)

Changelog
- e32fa1535c53badbccaa210110f86ec79a29b911 feat(auth): support multi-profile login (#500)
- 79b8eda3b6e6251203e860c4717a5da78786bf22 feat(chat): default --ai-tag on so dws-sent messages carry the AI badge

Changelog
- be80790172b678518c8e8d17bdbbc671a4370a49 docs(changelog): add [1.0.44] — phantom guard, report contents-file, @file, sheet parity
- 2dbbca1ec95eb2c2cf6e94b6e4965e95e2ea38a4 docs(skill): align dws skill references with the real CLI
- 49637d982e3f9af97bcb06516b9b2679c53ad32e feat(compat): hide phantom override commands from --help (tool-existence guard)
- d3087d170bc7e8c38cddeec04451b0bf29ced39d feat(compat): native @file / --contents-file input for structured JSON flags
- b214c0a06ccf4a19e40cdfa8d11704e4ba6c7fec fix(sheet): wukong parity for range read/update

Changelog
- 81f5245c8adba5af2d72f8d58ac3079d9d9a7dcb Merge pull request #499 from DingTalk-Real-AI/fix/gitee-release-sync-idempotent
- 78dd4aaa4badf2f06ccfe112f2fdf63b0653599d Merge pull request #501 from DingTalk-Real-AI/fix/gitee-mirror-verify-replace
- 5833e71751f2af2caebbcc44c5d2b384a109a21c ci(mirror): localize README for the Gitee mirror (#513)
- f7e8106a72d10bcd3a6d450f6f7b5ac5f2dc720d docs(devapp): add image-upload recipe + "discovering commands" to dingtalk-dev skill (#508)
- 4c5f1faeb117f85c7308c290d04925c639444232 feat: align open CLI with dws-wukong via cedar discovery version code (#509)
- 97678e6441bc268fca7cac36e05d9dc519dd46ae fix(devapp): drop the fork — repoint dev installer + docs to DingTalk-Real-AI (#505)
- 0e690fbe4e81d2640b6d02d62f093d171f610d0c fix(install): define $LatestUrl in install.ps1 so version resolution works (#512)
- 6f042f9167c2580a6be83b3ed225e216bebc440b fix(release): Gitee mirror reads real attach ids + dedups duplicate assets (#502)
- 088a4d67ae864f063aebc8389a75ec1a0e2988c8 fix(release): Gitee mirror verifies content and replaces stale assets
- c4946c3eaf758d65d400aa626a342f1b1843e8f5 fix(release): make Gitee mirror idempotent + add standalone repair workflow

Changelog
- 9a8157a4cd1ef04641ed0c068d7302ae93a30262 ci(mirror): auto-push code to Gitee via HTTPS token (no SSH key) (#493)
- b8e915edfb0306866894c7268b19bf8ec22d0efe feat(install): auto-fallback to Gitee when GitHub unreachable (#492)
- bd370ed0e904e341a4b4d2d8de1d5312df6aa0a4 fix(doc): strip duplicate title H1 on the JSONML doc-create path (#464)

Changelog
- ed1cbd6f0698ad4f7f066b85dca52c552704e669 feat(install): China mirror via Gitee + npmmirror (#486)
- b175acb48fba4c04dc49c49a786a30afbd369f5d feat(skill): embed skills/ into the binary, default skill setup to it (#488)

Changelog
- 1a7ba01e367a18c6d54dddae11b92a653725ebcd feat(chat): make AI-sent badge opt-in via --ai-tag (default off) (#477)
- 6310dcc39ee4279bd3254acecf07cac648addef1 feat(chat): tag user-identity message sends with edition clawType (#475)

Changelog
- ece91bfa3ca3f35eac2a3d29d6092050bafedc08 feat(agent): accurate agent_code detection + per-channel agentId for stats (#467)
- ff33114b2cde4e694287470ef2e5c0ab7c9ed0ba feat(doc): strip server-rejected unsafe chars on markdown write path (#465)
- 497e4f87d84b153aae2f18d10366c765d2bff92c feat: support to disable auto open browser (#365)
- a8d009aec848dc5c3f48849b81073691f17d4f26 fix(upgrade): honor --dry-run as preview-only instead of silently upgrading (#416)
- 1f413fa322f01e995fcc65ae6b0231a1c4768ef8 fix: pipeline PollUntil case-insensitive comparison to fix sheet export hang (#462)

Changelog
- 2a82d073110d77a4dd6a2423470c34cc76b7f920 fix(pat): support batch agentCode and guarded grants (#455)

Changelog
- eaa60f95b53219003c529bab82b752fbdfc7c3bf feat(devdoc): add rag mcp cli commands (#434)
- 330922cdee8750a32af8892bba15ca2ac6732fc3 fix(cli): degrade to built-in commands when dynamic build panics (#447)
- 31e65dda512c461dfcd225b0eaa5dcd02dbaba1c fix(cli): self-heal a poisoned discovery cache by quarantining it and rebuilding (#452)
- 838e5453d88d41eee759730d2feeb9ec53c9e599 fix(compat): guard envelope-driven flag registration against pflag panics (#449)
- 387ae5ff59e268c60207afb0f95933a5a9773e64 fix(doc): strip leading H1 duplicating --name on doc create (#448)

Changelog
- 5fbf12fe50415178af74090a7a7a2c79e3697754 Revert "fix(cli): JSON errors to stdout; no interactive confirm on piped stdin (#413)" (#415)
- e7ef2c4677d707183570980f0adf668239988110 fix(chat): keep @-mention tokens literal so they render (#433)
- f8263755569952f09f1529f26b0326a4f4e220ba fix(cli): JSON errors to stdout; no interactive confirm on piped stdin (#413)
- cb95207d5a9b9248be389c1220de05caea09c4eb fix(pat): keep auth URLs readable in JSON output (#401)
- dd419ca498aa736ae864e06b4a74042c44f8f00d fix(pat): pass agent code to chmod batch tools (#414)
- 8c2093a41aa79bf58bfba22772ea7fc8313886ec fix(skill): align chat single-chat docs/script with list-direct (#424)

Changelog
- 1e95d0360666eeac0aa7a5df2ec453db32060722 Merge pull request #405 from audanye-sudo/feat/switch-discovery-url
- ce5e919c526d9036a38e57a6d4342ef10a6c45f5 fix(market): version-code discovery path as /cli/discovery/apis/bamboo

Changelog
- 4e58e45d30cd3719c6a5c8b737cf2e0445437a99 feat(auth): add export/import for portable sandbox credentials (#357)
- 56a5edecef9411910e41292989ef6b3ee1bfdbc8 feat(pat): support batch chmod authorization flows (#389)
- 5ce7cb61b0d5aec47e7379be68a27f10827e6f86 feat(skill): dws skill setup with mono/multi modes (#332)
- 539d10f80f9f441c1bb4ec7d715988b111b68551 feat: 合并 pre-mcp-discovery 分支能力到 main（服务发现保持生产） (#391)
- 8c4bd7196425cd02670ac17cf6041ba006e4b884 fix(doc): align export progress output (#392)
- c75ed45c7042fd15316c37a655034b0cafc8b558 fix(keychain): add StorageDir for Windows to unblock v1.0.33 release (#394)
- 4ebc8d0d385f9b5e5fc7662852b45cb5e4a8a27c fix(plugin): silence stdio discovery handshake failures (Warn → Debug) (#380)

Changelog
- 86ff7e2f5074b0733a0b26fb3a65c763413dbb05 docs(changelog): add 1.0.32 release notes (#354)
- 45cb237f749c329ef276fa8f3f51d03e517158ee fix(drive): unblock OSS upload + improve AI-agent discoverability (#347)
- bd711108f9bee6f686efdc3b74603d3398b3c1db fix(upgrade): ad-hoc sign darwin binaries to fix amfid SIGKILL on Apple Silicon (#339)

Changelog
- 754b0df0568f4b69d4d36222827d14da6f7b3b57 docs(changelog): add 1.0.30 release notes (#322)
- 6be124777f0e8eaaee07b2e70a286cad9084f569 feat: align CLI to wukong IM envelope + schema pipeline / transform / market enhancements (#317)

Changelog
- a9de7d3ca4c985c1d4ba879fd8015683aeb88272 chore(readme): refresh community DingTalk group QR (#296)
- 355a1460d9ef9e597dbf5ae027f29c5be7f41f6f docs(changelog): add 1.0.29 release notes (#309)
- 1c200d883f3775c50fdace2e05d9f2334a0ffba6 fix(app): prevent command field from overwriting existing endpoint (#297)
- c6edc84e40ad5ddf9107b2b4c9c0678af4d890e1 fix(auth): partition app.json filename by edition to isolate credentials (#300)
- f497047fffb70d899e3d3fe152cf61e1518084a7 fix(compat): relax envelope leaf cmd Args from NoArgs to ArbitraryArgs (#306)

Changelog
- d26852408457a1a5febd863d12357d36cdba4451 docs(changelog): add 1.0.28 release notes (#295)
- ed4673e7d2a8118b96de9a0154a5336d6f13d389 fix(chat): require --title for group messages, completing #250's symmetric fix (#294)

Changelog
- de723914a52175f508cf55c863de2df4f040aa50 docs(changelog): add 1.0.27 release notes (#293)
- 6707e56f9cb93dae3b41f6a46bcc386a42db2443 feat(cli): schema-aware sticky flag splitting and structured unknown-flag recovery (#272)
- 49c5bea4f39954381c47217a5309b0c952dfc9fc feat(schema): file_read transform + CLIFlagOverride.MapsTo for --content/--content-file (#277 #278 #282 #288) (#291)
- 649801e4799bd65c34d5471a2a2a25407fc09581 fix(transport): suppress noisy WARN on stdio client shutdown (#285)

Changelog
- 2ba1dcdda4ca85396567a8de36cffd17017a1c89 docs(changelog): add 1.0.26 release notes (#271)
- ecf2684f583c233b26c1f10d7e23d3b8fb5e7352 docs(skills): add sheet product reference rewritten against dws schema (#266)
- 9e9b898dd253d9f0a82022e68c3ee410ec8d56ba docs(skills): add wiki product reference + register in SKILL.md/README (#265)
- c4952d0207e7ebd2f846a3f1815e7ee4078ab7c0 feat(output): add -f ndjson and -f csv (#252) (#259)
- 17f692e7f1d081c3a835447f22000db6b31fecd6 fix(chat): require --title for direct messages, fix misleading help (#250)
- 19f7b59ffb0f04169b3e7987723beb1742175c17 fix(doc): preflight axls download (#268)
- 1637ae16c783815dcb9c00b383f626626496912c fix(keychain): add DWS_DISABLE_KEYCHAIN fallback for macOS sandbox (#214) (#267)
- eee19d7347523987753b8635a3824da6576f0c7a fix(pat): preserve auth link on Windows browser open (#242)

Changelog
- 574d9aa2f76e8b2616bed1a902464aea3d657c08 docs(changelog): backfill 1.0.24 + add 1.0.25 release notes (#262)
- 1aaaef0274ce1952e11a1617d765ca11aea375fb feat(schema): add CLIAliases tool override + json_parse_strict transform (#246)
- 00c037b5be7357e7918204a1b4b74a60cb893558 feat(schema): add Pipeline tool override + executor for multi-step workflows (#247)

Changelog
- 9e15115ad4778c2af24e670bd309fbf54055e74d ci(release): add workflow_dispatch trigger as fallback (#261)
- f78cc5c846767d7b41aa7e23498dd963b493a5f9 docs(auth): correct login help to reflect actual default + SSH guidance (#226) (#238)
- 72fe795f3f30c9b321b891868bcd726b4d2a9072 docs(changelog): add 1.0.23 release notes (#241)
- 25bf3d12f23cf5d684f13a63ee7dbac86433ae64 feat(upgrade): block self-upgrade in embedded distributions (#248)

Changelog
- 8995bf65d62f13f8e517405edf1d0a7266d3d74a docs(changelog): backfill 1.0.20 / 1.0.21 / 1.0.22 release notes (#231)
- 0e892c7d75cb6bb5a45d19111159cdd3417d7c5b fix: honour HTTP_PROXY/HTTPS_PROXY in custom HTTP transports (#236) (#237)

Changelog
- e2e8b3bf521d826ae1fa14b48d6b747042399217 fix(attendance): summary 命令新增 --stats-type flag，修复 C0002 报错 (#228)
- 91af2bc3b8c48a9cc30ef844097349a2799c79eb fix(install): add .hermes/skills to AGENT_DIRS (#188) (#221)

A single critical routing fix for dws drive commands. No new commands or behaviour changes elsewhere.
Fixed
- dws drive mkdir / dws drive download silently routed to the doc MCP server (#220, fixes #219) — when two MCP servers register tools with the same name (e.g. both drive and doc expose create_folder), the tool-level endpoint map used last-writer-wins, so drive-side calls landed on the doc endpoint and returned mock-shaped responses (success: true with a fake folderId) without actually creating anything. directRuntimeEndpoint now resolves product-level first when the caller already knows the productID, and only falls back to the tool-level lookup when productID is empty. The wrong-server collision and the resulting "succeeded but didn't" behaviour are gone.

Documentation polish and a login regression fix. No behaviour changes outside the login MCP refresh path.
Fixed
- Login no longer reuses stale clientId from an old MCP cache (#213) — dws login now unconditionally re-fetches the MCP descriptor, so a previously cached client id can't keep producing auth errors after the server rotates it.
Docs
- dws chat message list pagination (#218, fixes #195) — clarifies that nextCursor is opaque and must be passed back as --cursor exactly; warns against parsing or reusing it as an offset.
- dws contact search examples (#209) — switched from the removed --keyword flag to the current --query.
- dws todo help text (#205) — expanded field semantics so MCP wrappers generate accurate schemas.
- chat message send-by-bot and report create help (#217, #106, #107) — --robot-code / --title / --text now carry the (必填) marker; report create --contents documents the key=field_name requirement and rewrites examples as a template detail → create two-step pipeline.
- CHANGELOG backfill for 1.0.19 (#204).

Changelog
- bb5e5a40d9a5ad6109bae10976801f1ddf290aec Merge branch 'DingTalk-Real-AI:main' into main
- 9bedec7ed233f6d26e9702bdb38014bb6dee335f Merge branch 'DingTalk-Real-AI:main' into main
- b247ef1266d253364771706f632f8743f31062c9 Merge branch 'DingTalk-Real-AI:main' into main
- bfe0e310fe63a6c3a568422b239fb2fefe48c059 Merge branch 'DingTalk-Real-AI:main' into main
- 2f935586c89a93fc06f33e4f42792d8bbb381afd Merge branch 'DingTalk-Real-AI:main' into main
- 3046ff8e776eb770ecc060c86ad6a9547873abe0 Merge branch 'DingTalk-Real-AI:main' into main
- 4c44a2b632683ce5caec794de701acca6b5feddd Merge branch 'main' into feat-rawapi
- a2908d2cbf5e151185a05ba84c5d9d370d37a154 Merge branch 'main' of github.com:fantiu/dingtalk-workspace-cli into feat-rawapi feat:unified login system
- fa1ab411e30a121d4f89aa292a79548e2f711ced Merge branch 'main' of github.com:fantiu/dingtalk-workspace-cli into feat-security-hardening fix(auth): attribute CLI auth denial to channel before user scope
- 41396426d02202a2e256da21dacd3c08dc7b0f37 Merge pull request #184 from fantiu/feat-rawapi
- c0468754a49597ff4e70ca9086b9045aa26224bc docs(changelog,readme): backfill v1.0.17 with mail product surface (#181)
- d71031d097795ac1811b551aee8dd71fcd5caa8a feat(api): add raw DingTalk OpenAPI command
- eeb1782f7a6c2bca323e93d569c8d0746d8ce7aa feat(api): add raw DingTalk OpenAPI command with dual-version token support
- 6946929e0bff4b90979db6859dbb9c41a764cdfe feat(api): add raw DingTalk OpenAPI command with dual-version token support
- 9b6174e03ee1501d16ee1e0a9d92abc8a613a55c feat(api): add raw DingTalk OpenAPI command with dual-version token support
- 46192d68ba9eb930bb03cd640bf989dc45e42de0 feat(api):client logic fixed.
- da2522c8caadce46e0995b58618bcdfaff281865 feat(pat)!: A-core loop for host-owned PAT (#142)
- 592749c986ca9528fae5ff882bf25202574d2574 feat: The token retrieval interface is now unified to one.
- e06b1d68ffee5037ad46ec63bb470b56ddca4b8b feat: raw API update README.
- c7ee0491b29a0926dea8bc9b5b38c648403e65f6 fix(auth): attribute CLI auth denial to channel before user scope
- d11aa0f0307f4856377cd0a247e316d8014f1808 fix(chat,cmdutil): restore group @-mentions and explicit members list subcommand (#180)
- 6756ead38a9b7f2552045c42309bf0fa0380675a fix: preserve PAT authorization uri and accept result poll envelope (#182)

Highlights
New Mail product surface (mailbox list, KQL message search, message get, send) brings runtime command count to 163 across 14 products. Plugin command-tree visibility hardening: stdio plugins shipping CLI overlays no longer wait on subprocess discovery to surface their commands, and overlay-registered plugin products are no longer hidden by edition VisibleProducts whitelists. Chat docs clarify that --title is required on dws chat message send.
Added
- mail product (#167) — new top-level service for DingTalk Mail. Four leaf commands across two subgroups:
- dws mail mailbox list — list mailbox addresses available to the current user (list_user_mailboxes)
- dws mail message search — KQL search across folders / sender / date / attachments / read-state (search_emails); supports --cursor pagination
- dws mail message get — fetch full message body + headers + attachments by message ID (get_email_by_message_id)
- dws mail message send — send email to one or more recipients (send_email)
- Skill reference at skills/references/products/mail.md registered in skills/SKILL.md master index and intent decision tree
- Stdio plugin overlay-first command registration (#179) — when a stdio plugin's overlay.json declares toolOverrides, command trees are built from manifest metadata synchronously at startup, no subprocess Initialize / tools/list handshake required. Previously, slow or failing subprocesses left plugin commands invisible in dws --help. Background discovery still runs to refresh the warm cache for richer flag types on subsequent startups.
Changed
- hideNonDirectRuntimeCommands / visibleMCPRootCommands / visibleUtilityRootCommands (#179) — refactored to share a single resolveVisibleProducts() helper that unions the edition's VisibleProducts hook with DirectRuntimeProductIDs(), so plugins registered via AppendDynamicServer stay visible in dws --help even when an edition installs a static product whitelist. Previously the hook fully replaced the dynamic registry, silently hiding plugin commands.
- dws chat message send documentation clarifies --title is required (#174) — the helper command short text and the chat skill reference now state explicitly that --title is mandatory for both group and single-chat sends, matching the runtime validation.
- buildStdioCommands refactored to share helpers with the overlay-first path (#179) — overlay parsing (resolveStdioOverlay) and tools→DetailTool conversion (toolsToDetails) extracted as package-level helpers; the legacy discovery-first stdio path now delegates to them, eliminating duplicated overlay JSON / cache-snapshot logic.
Fixed
- Negative-cache poisoning guard for stdio plugin discovery (#179) — refreshStdioToolsCache now skips SaveTools entirely when discovery returns an empty tool list (transient failure, subprocess not ready, RPC timeout), so a single bad refresh cannot overwrite a previously-good cache and degrade flag enrichment on the next startup.
Tests
- 6 new test cases in internal/app/plugin_stdio_overlay_test.go and internal/app/visibility_test.go cover overlay-first registration without discovery, warm-cache flag enrichment from InputSchema, fallback when overlays lack toolOverrides, the cache-poisoning guard, and integration cases for plugin visibility under restrictive VisibleProducts whitelists.
- Coverage 49.8% → 52.8%.

Full Changelog: https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli/compare/v1.0.16...v1.0.17

Discovery layer abstraction and schema v3 expansion, plus an open-edition completeness fix that restores helper subtrees previously dropped by pickCommands. Also hardens the device-flow login path against credential state left behind by other login methods (OAuth scan, PAT).
Added
- internal/discovery service abstraction (#156) — new Service struct encapsulating market registry fetch, MCP runtime negotiation (initialize → tools/list → detail merge), and multi-level cache fallback.
- DiscoverServers / DiscoverServerRuntime / DiscoverAllRuntime — concurrent per-server discovery with configurable timeout and cache fallback on DeadlineExceeded
- Action version–based cache invalidation via invalidateToolsIfVersionChanged
- EnvironmentLoader (internal/cli/loader.go) implements cache-first startup: a fresh cached catalog returns immediately without blocking on live discovery
- Degraded mode with typed reasons (unauthenticated, market_unreachable, runtime_all_failed) and edition-aware hint messages
- Changed-server detection via UpdatedAt comparison — only re-discovers servers whose registry entry changed
- Portal-side merge warnings surfaced to stderr for configuration drift visibility
- Schema v3 extensions (#156) on internal/market + internal/compat:
- Positional parameters — CLIFlagOverride.Positional / PositionalIndex bind MCP params to positional CLI args with typed coercion (int/float/bool/string), dual-mode (positional + flag alias), and automatic Use line placeholder rendering
- Example strings — CLIToolOverride.Example wired to cobra.Command.Example for the --help Examples section
- Flag defaults — CLIFlagOverride.Default sets cobra default values and injects into the MCP body via defaultInjectEntry when the user omits the flag
- Runtime defaults — CLIFlagOverride.RuntimeDefault with whitelisted placeholders ($currentUserId, $unionId, $corpId, $now, $today) resolved at invocation time
- Body wrapper — CLIToolOverride.BodyWrapper wraps user params under a named key while preserving internal control keys (prefix _)
- Mutually exclusive / require-one-of — MutuallyExclusive and RequireOneOf flag groups wired to cobra validation
- OmitWhen — empty-value handling policy (empty / zero / never) for invocation body construction
- Type override — explicit CLIFlagOverride.Type overrides MCP inputSchema type inference
- Detail schema default — MCP detail schema default field propagated to cobra string flag defaults
- Cobra annotation utilities (pkg/cmdutil) (#170) — OverridePriority / SetOverridePriority / MergeHardcodedLeaves promoted out of internal/cobracmd as the new single source of truth for the merge layer and helpers.
- dws chat message send destination-flag routing (#170) — the open edition gains a hardcoded helper that dispatches by destination flag instead of being limited to the group-only path:
- --group <openConversationId> → send_message_as_user
- --user <userId> / --open-dingtalk-id <openDingTalkId> → send_direct_message_as_user
- Mirrors the closed-source overlay so single-chat sends now work end-to-end on the open edition.
Changed
- pickCommands → cmdutil.MergeHardcodedLeaves for same-named products (#169) — previously, when a top-level product name collided between the dynamic overlay and a hardcoded helper subtree, the entire helper subtree was dropped. The dynamic side still wins every leaf conflict, but helper-only siblings are now grafted into the dynamic tree. Restores commands that had silently vanished from the open edition since pickCommands was introduced:
- dws chat message send-by-bot
- dws chat message recall-by-bot
- dws chat message send-by-webhook
- dws chat group members add-bot
- Hardcoded leaves can opt into overriding the dynamic envelope (#170) via a strictly higher OverridePriority. Default behaviour remains "envelope is authority"; the opt-in covers the narrow case where the envelope exposes a single dispatch path but the helper needs richer flag-based routing (e.g. chat message send using prefer

Compat layer gains subcommand merging under shared parents so multiple server entries can contribute into the same dws <parent> <branch> subtree without producing duplicate --help rows. Ships with a fresh auto-generated command index doc, a README sync to 159 commands across 13 products, and a wide-ranging flag-naming cleanup that standardises CLI flags across chat, calendar, drive, minutes, contact, and devdoc commands.
Added
- internal/compat subcommand merging via attachOrMerge — when two or more server entries attach to the same parent (e.g. parent: "chat") and their cli.command collides with an existing subcommand in the parent's tree, the new subcommand's children are merged recursively into the existing one instead of creating a duplicate sibling. Leaf-name collisions resolve first-wins. Fixes the "double group / message rows in dws chat --help" symptom when bot capabilities are distributed across chat.group.members and chat.message.
- docs/command-index.md — a single, English, auto-generated listing of every runtime command the dws CLI exposes under the pre environment (159 total). Each entry carries a description and a "when to use" column aimed at AI agents. Replaces the earlier command-index.pre.* / command-index.full.* ad-hoc snapshots.
Changed
- README Key Services table (README.md + README_zh.md) fully synced to the shipped command surface:
- Chat: 20 → 23 (bot capabilities merged in; new list-all / list-focused / list-unread-conversations / conversation-info exposed)
- Calendar: 13 → 14
- AI Tables: 37 → 41 (chart / dashboard public-share config rows)
- Doc: 16 → 21 (comment subtree + file create)
- Minutes: 22 → 19 (single-tool record, list query, list-by-keyword-range pruned)
- New Drive row (6 commands) — promoted out of "Coming soon"
- Workbench row and standalone Bot row removed
- Total revised to 159 commands across 13 products
- Quick Start expanded to 7 examples covering doc, minutes, drive in addition to contact, calendar, todo
- Coming soon trimmed to 5: mail, conference, aiapp, live, wiki
- Reference & Docs section now leads with a pointer to the new docs/command-index.md
- Flag naming cleanup — CLI flags across chat, calendar, drive, minutes, contact, and devdoc have been standardised so the names users type match the product-skill documentation. Notable flags:
- dws contact user search / dws contact dept search / dws devdoc article search now take --query (previously --keyword)
- dws chat message list / dws chat message search / dws chat message list-mentions / dws chat conversation-info / dws chat message send now take --group for the target conversation (previously --id) and --open-dingtalk-id (previously --open-id)
- dws chat message list-by-sender now takes --sender-user-id / --sender-open-dingtalk-id (previously --user / --open-id)
- dws chat message list-topic-replies now takes --group / --topic-id / --limit / --time (previously --id / --topic / --size / --start)
- dws chat search-common now takes --match-mode (previously --mode)
- dws drive list now takes --max / --thumbnail (previously --max-results / --with-thumbnail)
- dws calendar event suggest now takes --users / --duration / --timezone (previously --attendee-user-ids / --duration-minutes / --time-zone)
- dws minutes list mine / dws minutes list shared now take --max (previously --max-results) and gain --query / --start / --end
- dws minutes list all no longer exposes the legacy --__scope__ internal alias
- Flag coverage additions — dws calendar event create / update gain --attendees, --open-dingtalk-ids, --timezone; dws chat message send gains file-message flags (--dentry-id, --file-name, --file-size, --file-type, --media-id, --msg-type, --space-id) plus --open-dingtalk-id / --user; dws chat message list gains --open-dingtalk-id / --user; dws aitable table delete gains --reason; dws calendar participant add gains --optional; dws todo task create gains --recurrence.
Tests
- 3 new unit tests in internal/compat/dynamic_commands_test.go:
- 

Changelog
- af000a8dfa10943769994728985ab9d61ad2a705 docs(release): sync v1.0.13 notes for chat IM capability expansion (#153)

Changelog
- ec03b7cca337703e42eaecbe80359b793aecbf73 docs(changelog): backfill 1.0.3 through 1.0.12 release notes (#146)
- f19a3ccfa5f2dfb22660025204265fa9c87ef930 feat(skills): 同步 chat/bot skill 参考 — 补齐消息管理与机器人新能力 (#148)
- e0544579d208b6af396da08f1454922013f5ecc8 fix(auth): attribute CLI auth denial to channel before user scope (#144)
- 89c50384465195cc794bca1f323aa4f301a57b60 fix(auth): restore device_code polling when flowId is absent (#145)
- 4f915e4e2c4ad3474e198aa3fd7626e82ef27869 refactor(plugin): drop managed/ compat layer left by PR #126 (#135)

Changelog
- cfaa6738634150a34676f20930991bf8d6130b5f feat(skills): 同步 aitable skill 参考（对齐 dws-wukong + 二进制验证） (#139)
- 74ca40c1973c832b57035f00ed0473e1e7d1a653 feat(skills): 同步 aitable 参考 — 补充仪表盘/图表与导出数据章节 (#141)
- 3bc6c31a2d34c42871d5182554394c780019ee00 feat(skills): 新增钉钉文档与 AI 听记 skill 参考 (#138)

Changelog
- 5e168c92cf6a6719d3007a43ab72d89f9ef0d129 Codex/remove red box files (#127)
- 42fb25d1509f7582bb67c4004a0a6e2458afa6eb Merge branch 'DingTalk-Real-AI:main' into main
- 4bf300d86252e6aff57431eb6dc6220c3b87aa6a Merge pull request #117 from wxianfeng/main
- 7b7aeadbbef00232a1167fd388f9a6deca27c4c9 Merge pull request #120 from FuShu-Yang/bugfix/plugin-system-fushu
- b0024aa669db788db69523014e95aa30479b8cef Merge pull request #122 from fantiu/feat-claw
- 750b6c04d645c2f71593007c04e7575e27d1cab8 Merge pull request #125 from DingTalk-Real-AI/fix/issue-119-plugin-mcp-timeout
- f762117d4e6de6e6bc440f97141a6f07c9e8eda0 Merge pull request #126 from DingTalk-Real-AI/refactor/remove-managed-plugin-privilege
- 9fc570607fa4aed2e1b97549cc08819c89846d5c Merge remote-tracking branch 'refs/remotes/origin/main'
- 4851d19141641baa4cdda000a0196e7237161e8b Merge remote-tracking branch 'upstream/main'
- c99e228669a6f182ec1fe05d56fbab4b3b46e79a Merge remote-tracking branch 'upstream/main' into feat-claw merge main commit
- c5decb2f9095dec915f2aead6a9615406bc44dea error opt
- fec0347cd6a8fd9ae209e7380428330290447a1c feat(auth):improve login UX for terminal auth denial cases
- a14fd0250c54c384e37718269513c03941af76b1 feat(plugin): inject user identity (UserID, CorpID) into stdio plugin subprocesses
- 725577103da70df3baf70b2f46ebbe82ad031d43 feat: PAT scope error visualization and auto-retry with authorization polling (#113)
- 95d495f290d9ece18699271442c78109bae99523 feat: supports claw-like products.
- 4f1ee375084fce89f9aa43996853995cae8cd2d5 fix(auth): improve login UX for terminal auth denial cases
- 383aeefaf638d3e5aad98e987641f9a051c0ebf7 fix(cli): localize plugin/help command strings via i18n (closes #118) (#134)
- bbf66e23d6d0bfb3bd6b48174b5936b5a354c12d fix(pat): avoid shared PAT command state in root registration (#129)
- 93318f4a8333f4c1bda0542ff05a87871d11edde fix(plugin): stop stdio child processes on exit and before removal
- df01f36442f83624161658e7d453ae8604e06efa fix(transport): cap plugin MCP startup at ~4s when endpoints are unreachable
- a5bede3a19fa6f5277783dd48c2f2bb22fb69c03 fix: -f json 模式下错误 JSON 从 stdout 改为输出到 stderr (#133)
- daf56514f701ec2a7c78f9244566fabd65498de3 perf(plugin): parallelize all plugin discovery and tighten cold timeouts
- 8bcbceb9716d2b0daea8c3584e1198ba3e3b07ff perf(plugin): serve plugin MCP tool list from disk cache on startup
- 59e51c348aec30b8f4a369a9b5d79d0ccfa6e34c perf(plugin): share cache.Store across discovery + relax cold timeouts
- a056a9abfb5d4e25c077c92797128e8b8c37e144 refactor(plugin): purge removed plugin settings instead of merely disabling
- 33ae78010319e0cbcff469d1a2df2aadf0009094 refactor(plugin): remove default/managed plugin privileged mechanism
- 416ad6571dc639ae2abfd38fa1cdd6d7587371ae skill opt
- 94ad422a9f18380ae2f8be2fed43ddfb6c6a84fd style: fix code formatting

Changelog
- 42fb25d1509f7582bb67c4004a0a6e2458afa6eb Merge branch 'DingTalk-Real-AI:main' into main
- 4bf300d86252e6aff57431eb6dc6220c3b87aa6a Merge pull request #117 from wxianfeng/main
- 7b7aeadbbef00232a1167fd388f9a6deca27c4c9 Merge pull request #120 from FuShu-Yang/bugfix/plugin-system-fushu
- 9fc570607fa4aed2e1b97549cc08819c89846d5c Merge remote-tracking branch 'refs/remotes/origin/main'
- 4851d19141641baa4cdda000a0196e7237161e8b Merge remote-tracking branch 'upstream/main'
- 1ea8bad074a83fc88baffeefbc7d9a02a7b886ca Reduce MCP discovery timeouts
- c5decb2f9095dec915f2aead6a9615406bc44dea error opt
- a14fd0250c54c384e37718269513c03941af76b1 feat(plugin): inject user identity (UserID, CorpID) into stdio plugin subprocesses
- 93318f4a8333f4c1bda0542ff05a87871d11edde fix(plugin): stop stdio child processes on exit and before removal
- 416ad6571dc639ae2abfd38fa1cdd6d7587371ae skill opt
- 94ad422a9f18380ae2f8be2fed43ddfb6c6a84fd style: fix code formatting

Changelog
- 88e155dd23909f73250cee0b5d0597ce7df6440a Fix test
- 937404e6df390bb1a6341a6d5d213847d37eb561 Fix test
- da1a0f1299489490a51b6b4f6bd6e1f971b97bd0 Merge branch 'DingTalk-Real-AI:main' into main
- f8c7f012a192d1dc9dd24c8e8226cd14465efc9a Merge branch 'DingTalk-Real-AI:main' into main
- f978e306ccfa605d6976d6bddc3da4a9c1dfa721 Merge branch 'DingTalk-Real-AI:main' into main
- 02633c6bd364d7d8c39ec95589aea24b501dda8a Merge branch 'DingTalk-Real-AI:main' into main
- 26d7d8f946f2fcb3ac39f01b70e7f7f676929a7d Merge branch 'DingTalk-Real-AI:main' into main
- 2e2cea09730663b728f724c3bb42b4e85cd253e2 Merge branch 'DingTalk-Real-AI:main' into main
- a8e1acec09724effe8f55ad58517175655206bc3 Merge branch 'DingTalk-Real-AI:main' into main
- 1f0a75f8365daf23392208b348d20baca0a72219 Merge branch 'main' of github.com:fantiu/dingtalk-workspace-cli into feat-pipeline refactor: extend command execution pipeline from 3 to 5 stages
- f1d160a481989a4d596f1a1dc110759e25c8b031 Merge pull request #100 from wxianfeng/main
- 810985b03a6d8818ad76c9ebebb72ac2cdc46873 Merge pull request #101 from wxianfeng/main
- 83efff21cdedf14cfdb25bdf0644da27470816e2 Merge pull request #102 from fantiu/feat-pipeline
- 05ac342c4b0dbaba9e1e592b55d153715fea0b02 Merge pull request #109 from wxianfeng/main
- 9a119fbd64f2dce6cf4f1160bf8da6ad032f7436 Merge pull request #115 from PeterGuy326/main
- e59c4f30b88d2050512d30b41ea577bf70598a37 Merge pull request #95 from DingTalk-Real-AI/coffeeBigSir-patch-1
- 70e21b58b47f7b32c539560f9a6c45904df9c463 Merge pull request #96 from wxianfeng/main
- 143f7810647fc96a9f9ed85b292ac25e71e16792 Merge pull request #97 from wxianfeng/main
- 9dc8dc706569415b532882680ba056f041321c11 Merge pull request #99 from wxianfeng/main
- fd7ef5edc2ae8b1a458e9ac142206f850fb44f32 Update SKILL.md
- 0e72e89ba30b778602ff2873768d96dae7519f95 auth
- aec852f971beca595f8a379afd676e2f8604e3cb feat(auth): add edition overlay auth credentials and token marker for embedded mode
- c49583836b1001670be7e9e379937aae8b1797ff feat(auth): delegate token persistence to edition hooks with keychain fallback
- 8238cc9f41633399252f94b18ab6c246ddf9e6ee feat(edition): add AfterPersistentPreRun hook and runtime token helpers
- 65b64af21394beda928dba423f6a84740233f9db feat(errors): add ExitCoder/RawStderrError interfaces and ClassifyToolResult hook
- 658ec1676c02299532c9973951af2272ec31d421 feat(plugin): add build lifecycle for binary distribution
- 408098bdc11f3c90b3bf0485517b65a0e5884998 feat(plugin): add command name conflict protection
- efbaf7a49d61cf4d2349b6770552e7e31eddd0df feat(plugin): add create scaffold, dev mode, and skill sync
- 0b9952c58d91d1fee977a314bf6ce9df89d45250 feat(plugin): add persistent plugin config via settings.json
- c4fb1bbd3edb6666434b9e8865fdc1f2d4763bba feat(plugin): add plugin system core framework
- 0fa982fe91caaf471560c436a1596e9aa7f06117 feat(plugin): add updater, stdio transport, git install, and English output
- 8ecbff391c46cf2c3371764bfc66891a1051de44 feat(plugin): bootstrap default managed plugins on first run
- d2752d8b5b700cd9d3f2efadb9f66b8a63157d0b feat(plugin): improve CLI overlay resolution and plugin install robustness
- d7d85c9e671096182379c76f1437ce868d7eb57c feat(plugin): integrate updater and stdio server into startup
- 374a9e9b1339a50cc85c3eaed249f3b7f7c1e9ba feat(plugin): register stdio server tools as CLI commands
- ea5859b92b113ee181967528f8b8911ac37e7171 feat(plugin): support custom auth headers for third-party MCP servers
- 713fdf61880d92015ddc6dac3cd2ffcca5b32d54 feat(schema): return structured degraded errors instead of silent empty catalog
- bc7d19cfd8e557b6ff5180eecd377e9c4d9be19e feat(skill): restore find/get for legacy skill market API
- cc2d97ddbad608716a7fe592990679aa7ba44f47 feat: add dws doctor command for one-stop diagnostics
- b78dd19cf993caa9bfeac37bed247dc92a82a43b feat: centralize scattered configs and add dws config list
- 56af1ea091165113a3edb73672b5d82ec8affc8b feat: parallel service discovery + unit tes

Changelog
- a1f5d97345c931207c79dee599b7c1675b74cf9a Merge branch 'DingTalk-Real-AI:main' into main
- c649d1a7627e5cfe3390f6eed6b60efc97bf1f5b Merge branch 'main' of github.com:fantiu/dingtalk-workspace-cli into feat-cmd-performance perf: optimize command timeout handling, instrumentation, and diagnostics
- c8e3ac21c2a949fad54861b8ab36f02d14d38588 Merge pull request #76 from DingTalk-Real-AI/npm
- 58062515a541a3996490e561b9bd143eea3c01d4 Merge pull request #78 from DingTalk-Real-AI/feat/issue-ai-table-label-change
- afdd47b5a5d7f417e34df46767dbd0a260c1adbb Merge pull request #81 from fantiu/feat-cmd-performance
- 31eb10985e93d9d9f1eece513799567584850be9 Merge pull request #82 from wqyenjoy/main
- 1436b62a8082022004e1eb674a4f2cf0b939866e Merge pull request #86 from DingTalk-Real-AI/install-yh
- 17277446916f65ba524d0fc02e40a418e76cd9cd add command
- ec6a27635bfd8cecc3e1b548cdf5a4ec6cce570a feat(install): align skill dirs with npm and add OpenClaw
- 5614b508f2ea785691d7f87149fad561ac4593ab feat: to #73551688 优化标签在多维表中的展示
- d968e8e55104289957708c62b2cfa4a5dae0dfb5 perf: optimize command timeout handling, instrumentation, and diagnostics

Changelog
- c74f1eeb26e0e8f7cf25a8b25664200ab6de52ad Merge branch 'DingTalk-Real-AI:main' into feature/wk_merge
- 5c0d2b274c63eac98e7bec35b9b4c8e083ab1b6e Merge branch 'DingTalk-Real-AI:main' into feature/wk_merge
- fe5952fe14d69015026de71a30ca45d22751e1af Merge branch 'DingTalk-Real-AI:main' into main
- 110f8871810a06287a01c5915d1e258035818cf7 Merge branch 'DingTalk-Real-AI:main' into main
- 5149f6808fd18017e87cf756e2355422ed68f79f Merge branch 'DingTalk-Real-AI:main' into main
- a0dc5d61833e2adce50e6f991797091419dda246 Merge branch 'main' of github.com:fantiu/dingtalk-workspace-cli into feat-login-upgrade
- 95cbde9187305d0d7f9c29bb608505052e98ba1b Merge branch 'main' of https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli into feat/issue-label
- 0489cd67c8559052ba572f3a611ebb1ec3194d81 Merge pull request #70 from DingTalk-Real-AI/feat-css
- c8148ef2cccb0d36fbb5e350cc61a2a6db4e8f8c Merge pull request #71 from wxianfeng/feature/wk_merge
- 2ab45ffd90d102e261522278c707f145d47414f9 Merge pull request #72 from fantiu/feat-check-enable
- 918db33a8b8372ee99a093478fa3550c68a21ab9 Merge pull request #74 from DingTalk-Real-AI/feat/issue-label
- 57c93243a0714af8ead4f0d609a54d39c32db11a Merge pull request #75 from fantiu/feat-login-upgrade
- 3da572a76a856fc2ec5b57ebc4c23d04c614ef76 Merge remote-tracking branch 'origin/main' into feat-login-upgrade
- e2dbaa7c78e7c324b502d4433c84e6efa78b7e0a feat(auth): unify MCP retry constant and add retry to remaining endpoints
- 11a0dbc84ada5a85c98e8aa8b5ed1dde74197147 feat(auth): unify MCP retry constant and add retry to remaining endpoints
- b89740bad6f77f7563db967c9aeea14a21360052 feat: add self-upgrade command with GitHub Releases as data source
- a18ce2e54dc3ef82b6d021c74acdf79f2b2f4bf1 feat: add self-upgrade command with GitHub Releases, atomic flow, and cross-platform support
- 93d6fdb17e2db5273880168b71794aba1d772df6 feat: edition layer for Wukong overlay; promote shared code to pkg/
- 5e194393ffa53abe2e28a75500000a8985a7395b feat: to #73551688 支持上报用例集标签
- ee441643dd9da482711552e109daac1c15a2cc8c fix(auth): switch CLI auth check from fail-open to fail-closed
- 7c4932154c60eed1cd16995244cefd599b8df1fb fix:auth check test file gofmt.
- 933615003c45268d27cedf194d6e39adb936438a merge upstream main
- 15d495e56e521ad175d4256b7b2d234c25d5a142 style(auth): redesign OAuth authorization pages UI
- 4259336e6dc1c60fb09da254870f3d9f113a477a style: gofmt formatting for upgrade files

Changelog
- e976bd5fc995c014e4b92e2425f52f904d23be29 - release.yml: add DWS_PACKAGE_VERSION=${{ github.ref_name }}
- 077665e27b3a3b307e19733e37659cd445010a47 Merge branch 'DingTalk-Real-AI:main' into main
- 1df56cc99b6c5aba96298e8483b361cb290cf466 Merge branch 'DingTalk-Real-AI:main' into main
- a0bf715ddf2c97a94f765c17eae01925a6328f03 Merge branch 'main' of github.com:fantiu/dingtalk-workspace-cli into feat-performance 解决 Windows issue bug,修改 readme 回调地址格式
- 675ce53c066e2babc87cb849eef924d40b228e61 Merge branch 'main' of github.com:fantiu/dingtalk-workspace-cli into feat-readme-typo docs(readme): combine redirect URLs into single line for easier copy-paste
- 851cf43180fecf83b08a19360ad3098174aabf02 Merge branch 'main' of https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli into xtyh
- 7f0567aa394d7b9babfa64815bdfe0f44354f734 Merge branch 'main' of https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli into xtyh
- 3c83c0cff22c42a264561d0409b2230ee2516118 Merge branch 'xtyh' of https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli into xtyh
- 5c41d2b8f4fc7bab6eda467738bfd2fc5045f3f9 Merge pull request #29 from DingTalk-Real-AI/xtyh
- 8b423b97e8567bca54683c6c7f40aa6c0dbe5960 Merge pull request #39 from fantiu/feat-performance
- 3b8233e6ba9805a7596074e6a4630cfed44a4a51 Merge pull request #40 from fantiu/feat-readme-typo
- a912cbc52b0b0f96d5caf7159d4450814e025334 Merge pull request #43 from audanye-sudo/feat/stability-and-hint-optimization
- 0606762c2923f4481d15e6294c2c0bcc80484d4e Merge pull request #51 from Gyyshen/feature/addskill
- e7677df5419564f795fabcfc997a8ce3922ba453 Merge pull request #53 from DingTalk-Real-AI/feat/support-issue-notification
- 7dbef98dd02581ebddae69b18c61ea67b552ac41 Merge pull request #58 from fantiu/feat-login-upgrade
- fc49f3dc7a5c1be4ddb861342e645ccf1737526f Merge pull request #59 from audanye-sudo/feat/base-experience-upgrade
- 3baadb99cedb5fbea4ea07b63991f8fcd0c2f8de Merge pull request #60 from audanye-sudo/feat/onboarding-official-app-mode
- 35548e4780da14e30d00c0490a69a7a7048d21d0 Merge pull request #62 from DingTalk-Real-AI/feat-login-optimization
- 3c5f40648edeade88d392cc37be48eac5cb882f7 Merge pull request #63 from audanye-sudo/docs/optimize-readme
- f732dcd2ba430dfa68d431affb0fced43ca47124 Merge pull request #64 from DingTalk-Real-AI/feat-auth-improvement
- 0257d1f0844bd8ef444bb5f1c79eca429d29b3c8 Merge pull request #65 from DingTalk-Real-AI/releasescript-yh
- c650afa6eb20f11ef738a4cbe0a313a7c33696da Merge pull request #66 from DingTalk-Real-AI/feat-performance
- 28b775198dd7f99b5d3838963710849e60517283 Merge pull request #69 from DingTalk-Real-AI/version-unify
- 11199e6848379eb6a821ed83e36227a0dd662f79 add interactive confirmation for destructive dynamic commands
- 19c38d4b946dcb25ac36ebcf089ce7a74daefeb7 add report helper with flexible date parsing and defaults
- d51c1ff13102e872149346812e03bda733792f1b docs(readme): combine redirect URLs into single line for easier copy-paste
- 773804ee804c3059eac8970716dc42c9d2be4753 feat(auth): enhance device flow with CLI auth check and admin guidance
- 14f558facf89e8323d709abe5539a43a2f8f3da9 feat(auth): fail-fast for unauthenticated requests before MCP call
- 2a056cc5d0b03044a60a6d51f6a359b3ac30c7fb feat(auth): persist OAuth credentials for reliable token refresh
- 3bb504bb1f20e28a77d8b14b6d0639a14978dfe2 feat(auth): persist client credentials and optimize keychain access
- 26263f8a17196c2d84006118507695c282155e46 feat(auth): persist client credentials and optimize keychain access
- 7fda120d5a13a9a11fe456b629accac82add08ee feat: enhance error diagnostics with trace ID, server error code, and comprehensive logging
- ce6c32bf537b489919fc9bb8cf8700b574b6fba7 feat: enhance error diagnostics with trace ID, server error code, and comprehensive logging
- dda4dacb1c56fa1ec7904db2f97eed894e549557 feat: to #73551688 支持消息通知
- 4742112000766cbc5cece0af39923d075c086a3f feature modified
- 54145b65eceb9de311dfa7d0950ce2a38d94de46 fix test script
- 8406

Changelog
- 077665e Merge branch 'DingTalk-Real-AI:main' into main
- 1df56cc Merge branch 'DingTalk-Real-AI:main' into main
- a0bf715 Merge branch 'main' of github.com:fantiu/dingtalk-workspace-cli into feat-performance 解决 Windows issue bug,修改 readme 回调地址格式
- 675ce53 Merge branch 'main' of github.com:fantiu/dingtalk-workspace-cli into feat-readme-typo docs(readme): combine redirect URLs into single line for easier copy-paste
- 7f0567a Merge branch 'main' of https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli into xtyh
- 851cf43 Merge branch 'main' of https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli into xtyh
- 3c83c0c Merge branch 'xtyh' of https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli into xtyh
- 5c41d2b Merge pull request #29 from DingTalk-Real-AI/xtyh
- 8b423b9 Merge pull request #39 from fantiu/feat-performance
- 3b8233e Merge pull request #40 from fantiu/feat-readme-typo
- a912cbc Merge pull request #43 from audanye-sudo/feat/stability-and-hint-optimization
- 0606762 Merge pull request #51 from Gyyshen/feature/addskill
- e7677df Merge pull request #53 from DingTalk-Real-AI/feat/support-issue-notification
- 7dbef98 Merge pull request #58 from fantiu/feat-login-upgrade
- fc49f3d Merge pull request #59 from audanye-sudo/feat/base-experience-upgrade
- 11199e6 add interactive confirmation for destructive dynamic commands
- 19c38d4 add report helper with flexible date parsing and defaults
- d51c1ff docs(readme): combine redirect URLs into single line for easier copy-paste
- 773804e feat(auth): enhance device flow with CLI auth check and admin guidance
- 26263f8 feat(auth): persist client credentials and optimize keychain access
- 3bb504b feat(auth): persist client credentials and optimize keychain access
- 7fda120 feat: enhance error diagnostics with trace ID, server error code, and comprehensive logging
- ce6c32b feat: enhance error diagnostics with trace ID, server error code, and comprehensive logging
- dda4dac feat: to #73551688 支持消息通知
- 4742112 feature modified
- 54145b6 fix test script
- 345156c fix: correct import path for errors package in skill_command.go
- 8fb0ecb fix: resolve verbosity flag lookup, FileLogger lazy binding, and business error logging
- 2fad9c9 test
- 7d9e592 去除 message history
- 1a6d129 调整回调地址格式

First public release of DingTalk Workspace CLI.
Core
- Discovery-driven CLI pipeline: Market → Discovery → IR → CLI → Transport
- MCP JSON-RPC transport with retries, auth injection, and response size limits
- Disk-based discovery cache with TTL and stale-fallback for offline resilience
- OAuth device flow authentication with PBKDF2 + AES-256-GCM encrypted token storage
- Structured output formats: JSON, table, raw
- Global flags: --format, --verbose, --debug, --dry-run, --yes, --timeout
- Exit codes with structured error payloads (category, reason, hint, actions)
Supported Services
- aitable — AI table: bases, tables, fields, records, templates
- approval — Approval processes, forms, instances
- attendance — Attendance records, shifts, statistics
- calendar — Events, participants, meeting rooms, free-busy
- chat — Bot messaging (group/batch), webhook, bot management
- contact — Users, departments, org structure
- devdoc — Open platform docs search
- ding — DING messages: send, recall
- report — Reports, templates, statistics
- todo — Task management: create, update, complete, delete
- workbench — Workbench app query
Agent Skills
- Bundled SKILL.md with product reference docs, intent routing guide, error codes, and batch scripts
- One-line installer for macOS / Linux / Windows
- Skills installed to ~/.agents/skills/dws (home) or ./.agents/skills/dws (project)
Packaging
- Pre-built binaries for macOS (arm64/amd64), Linux (arm64/amd64), Windows (amd64)
- One-line install scripts (install.sh, install.ps1)
- Project-level skill installer (install-skills.sh)
- Shell completion: Bash, Zsh, Fish