Add dida365 Plugin: official Dida365 (滴答清单) MCP + task-management Skills

[HopeYin]

Problem

Dida365 (滴答清单, the China version of TickTick) users currently have no hosted Plugin connecting MiniMax Code to the official Dida365 MCP server. This Plugin adds that connection plus two Skills that make task management safe and cover a real batch workflow.

What this Plugin contains

• mcp.json — connects to the official Dida365 MCP endpoint https://mcp.dida365.com (streamable-http). No credentials are shipped.
• Skill dida365 — teaches the agent to operate the 40+ official tools safely: look up before mutating, require explicit confirmation before destructive actions, clarify ambiguous requests, split complex requests, and follow parameter conventions (priority scale 0/1/3/5, ISO 8601 datetimes with colon offsets, batch limits, delete_task requiring both task_id and project_id).
• Skill article2tasks — a scenario workflow that turns a technical newsletter issue (batch) or a single article URL into categorized, tagged Dida365 todos. Categories are resolved dynamically against the user's own lists via list_projects; every write requires a preview table and explicit user confirmation. Pure MCP calls — no local scripts, no URL schemes, so it behaves identically on Windows / macOS / Linux.

Example prompts

我今天有哪些任务？按清单和优先级整理一下。

帮我把这周的高数复习拆成 5 天的任务，放进「学习」清单，每天下午 2 点。

帮我把这期技术周报整理一下，批量添加到滴答清单对应清单里。

Expected result

The agent lists/creates/updates tasks, checks in habits and reviews focus records through the official MCP; for newsletter input it first shows a categorized preview, then batch-creates todos into matching lists after user confirmation.

Dependencies and platforms

• A Dida365 (dida365.com, China) account. International TickTick accounts are a separate system — see the sibling ticktick Plugin (separate PR).
• Authorization: API Token (Bearer) from 网页版 → 头像 → 设置 → 账户与安全 → API 口令, added by the user as an Authorization header in their client MCP config. The endpoint also supports OAuth discovery for clients that provide a native OAuth flow for remote MCP servers.
• No executables, no paid services beyond the user's own Dida365 account, no extra platforms. Windows / macOS / Linux.

Network and data behavior

• Single network destination: https://mcp.dida365.com (HTTPS), the official Dida365 service.
• Reads/creates/updates/deletes only the user's own tasks, lists, habits, focus records and countdowns, only at the user's instruction.
• The Plugin itself collects and uploads nothing; no telemetry, no third-party endpoints.

Test evidence

Automated: npm run check passes (validator green; the 2 failing repo tests are Windows-environment issues unrelated to this Plugin — path separator expectation and symlink privilege).

Manual (MiniMax Code on Windows, Bearer Token, 2026-08-15):

• ✅ Plugin loads; MCP connects and stays stable over streamable-http.
• ✅ Task query, creation (title / dueDate / list) and deletion verified end-to-end.
• ✅ Direct JSON-RPC call to the official endpoint with a JSON-number priority succeeds, confirming the server contract.
• ⚠️ Known issue, documented in README: with the MiniMax-M3 model, integers in tool arguments get stringified ("priority": 5 → "priority": "5") and the server rejects create_task / update_task / batch_update_tasks with must be integer. MiniMax-M2.7 and Kimi-K2.7-Code produce correct types on identical input. The bundled Skill ships parameter rules plus a self-check (inspect Received arguments echo) to mitigate; worst case the user sets the priority flag in the app.

Credits

The article2tasks Skill's organize → preview → confirm → execute workflow and category-mapping idea are adapted from article2ticktick by Mr.H (MIT License). This implementation replaces its URL-scheme + local-script approach with pure MCP writes and dynamic list resolution.

[hetaoBackend]

@HopeYin 官方 Dida365 endpoint 和 Skill 方向都成立，但当前交付模型下安装后无法鉴权：

1. mcp.json 只声明裸 URL，而官方 endpoint 需要 OAuth 或 Bearer。MCode 当前 portable Plugin 不支持 host-side OAuth/secret overlay，Plugin MCP 连接池也与用户全局 MCP 配置分离，所以 README 所说“在 client MCP config 添加 Authorization”不会配置这个 Plugin 的连接。
2. 当前可行修法是改成 Skill-only Plugin，明确要求用户在 MCode 全局 MCP 设置中另行配置官方 server 和 Bearer；或者等待 MCode 提供 Plugin MCP secret/OAuth overlay。
3. article2tasks 还会处理周报正文、文章 URL 和本地文件路径，README 需完整披露这些内容由 Agent/模型处理，并可能写入滴答清单。
4. 最新 head 尚无 CI/CodeQL；当前 workflow 状态是首次贡献待维护者批准，不是测试已通过。

修正鉴权交付模型、数据披露并跑出检查后可复审。

[HopeYin]

@hetaoBackend 感谢详细的 Review，鉴权模型的判断我们完全接受 —— 已按建议 rework 为 Skill-only 插件（d9cc598）：

1. 删除 mcp.json：不再内置无法鉴权的裸 URL 连接。README 改为引导用户在 MCode 全局 MCP 设置中自行添加官方 server（https://mcp.dida365.com）+ Bearer Token，并说明「为什么不自带 MCP 连接」（可移植插件不支持凭据 overlay）。
2. 数据披露已补：README 的 Data and network 章节明确写出 —— 插件自身零网络请求；article2tasks 会处理用户提供的周报正文、文章 URL 和本地文件路径，这些内容由 Agent/模型读取整理，结果可能写入滴答清单；Token 只存在于用户自己的客户端配置中。
3. 测试证据措辞：PR 描述中的自动化测试仅指本地 npm run check，CI/CodeQL 状态以实际 workflow 为准，未声称已通过。

插件现在只含 plugin.json + README.md + LICENSE + 两个 Skill，本地 npm run validate 通过。请批准 workflow 运行并复审，谢谢！

[hetaoBackend]

已复核当前 head d9cc598。已移除无法鉴权的插件内 mcp.json，明确改为用户在全局 MCP 设置中配置官方端点与凭据；写入确认、数据流和能力边界说明完整。候选分支本地完整检查 12/12 通过，当前 CI 与 CodeQL 全绿。批准合入。