feat/drive-permission-get-setting

Add a read-only Drive shortcut for retrieving a resource's public access, sharing, collaborator management, security, and comment settings. It accepts supported Lark Drive URLs or explicitly typed bare tokens, returning actionable typed validation errors for invalid or conflicting inputs.

Key features:

- Query the Drive permission public endpoint for documents, files, wiki nodes, and folders

- Infer target type from supported URLs and require --type for bare tokens

- Register dry-run and validation coverage, including CLI end-to-end tests

- Document the command and its non-recursive folder behavior in the Drive skill

.github/workflows/ci.yml

@@ -1,5 +1,4 @@
 name: CI
-run-name: ${{ github.event_name == 'pull_request' && format('CI / {0}', github.event.pull_request.number) || '' }}
 
 on:
   push:
@@ -9,12 +8,6 @@ on:
     types: [opened, synchronize, reopened, edited]
   workflow_dispatch:
 
-# PR metadata edits can retrigger full CI for the same head. Keep only the
-# newest run for a pull request; push and manual runs use a unique run ID.
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-
 permissions:
   contents: read
   actions: read
@@ -54,34 +47,6 @@ jobs:
             exit 1
           fi
 
-  plugin-integration:
-    needs: fast-gate
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
-        with:
-          persist-credentials: false
-      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
-        with:
-          go-version-file: go.mod
-      # No fetch_meta: the git-archive clean tree must embed only the
-      # committed meta_data stub (reproduces the bare-module customer state).
-      - name: Run plugin-integration L4 tests
-        run: go test -count=1 -timeout=15m ./tests/plugin_e2e/...
-
-  sidecar-integration:
-    needs: fast-gate
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
-        with:
-          persist-credentials: false
-      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
-        with:
-          go-version-file: go.mod
-      - name: Run sidecar tag build + HMAC round-trip
-        run: make sidecar-test
-
   # ── Layer 2: Quality Gate ──────────────────────────────────────────
   unit-test:
     needs: fast-gate
@@ -211,11 +176,7 @@ jobs:
         run: python3 scripts/fetch_meta.py
       - name: Run tests with coverage
         run: |
-          # tests/ holds only L3/L4 suites (cli_e2e, plugin_e2e, sidecar_e2e) that
-          # have dedicated jobs; exclude the whole subtree so none of them runs a
-          # second time here — and, crucially, so an observe-only suite's failure
-          # can never block merges through coverage's spot in the results loop.
-          packages=$(go list ./... | grep -v '^github.com/larksuite/cli/tests/')
+          packages=$(go list ./... | grep -v '^github.com/larksuite/cli/tests/cli_e2e$' | grep -v '^github.com/larksuite/cli/tests/cli_e2e/')
           go test -race -coverprofile=coverage.txt -covermode=atomic $packages
       - name: Upload coverage to Codecov
         if: ${{ github.event_name != 'pull_request' || !github.event.pull_request.head.repo.fork }}
@@ -302,11 +263,6 @@ jobs:
   e2e-dry-run:
     needs: [unit-test, lint, script-test, deterministic-gate]
     runs-on: ubuntu-latest
-    timeout-minutes: 20
-    outputs:
-      mode: ${{ steps.e2e_domains.outputs.mode }}
-      reason: ${{ steps.e2e_domains.outputs.reason }}
-      live_packages: ${{ steps.e2e_domains.outputs.live_packages }}
     steps:
       - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
         with:
@@ -320,23 +276,6 @@ jobs:
       - name: Resolve CLI E2E domains
         id: e2e_domains
         run: node scripts/e2e_domains.js
-      - name: Validate CLI E2E domain outputs
-        env:
-          E2E_MODE: ${{ steps.e2e_domains.outputs.mode }}
-          E2E_LIVE_PACKAGES: ${{ steps.e2e_domains.outputs.live_packages }}
-        run: |
-          case "$E2E_MODE" in
-            skip)
-              [ -z "$E2E_LIVE_PACKAGES" ] || { echo "::error::Skip mode must not resolve live packages"; exit 1; }
-              ;;
-            full|subset)
-              [ -n "$E2E_LIVE_PACKAGES" ] || { echo "::error::No live packages resolved for mode $E2E_MODE"; exit 1; }
-              ;;
-            *)
-              echo "::error::Invalid CLI E2E mode: $E2E_MODE"
-              exit 1
-              ;;
-          esac
       - name: Build lark-cli
         if: ${{ steps.e2e_domains.outputs.mode != 'skip' }}
         run: make build
@@ -370,22 +309,16 @@ jobs:
           fi
 
   e2e-live:
-    needs: [unit-test, lint, script-test, deterministic-gate, e2e-dry-run]
-    if: ${{ always() && (github.event_name != 'pull_request' || !github.event.pull_request.head.repo.fork) && needs.unit-test.result == 'success' && needs.lint.result == 'success' && needs.script-test.result == 'success' && needs.deterministic-gate.result == 'success' && needs.e2e-dry-run.result == 'success' && (needs.e2e-dry-run.outputs.mode == 'full' || needs.e2e-dry-run.outputs.mode == 'subset') && needs.e2e-dry-run.outputs.live_packages != '' }}
+    needs: [unit-test, lint, script-test, deterministic-gate]
+    if: ${{ github.event_name != 'pull_request' || !github.event.pull_request.head.repo.fork }}
     runs-on: ubuntu-latest
-    timeout-minutes: 30
-    # Live E2E uses one repository-wide execution slot.
-    concurrency:
-      group: lark-cli-e2e-live
-      cancel-in-progress: false
-      queue: max
     permissions:
-      actions: read
       contents: read
       checks: write
     env:
       TEST_BOT1_APP_ID: ${{ secrets.TEST_BOT1_APP_ID }}
-      LARKSUITE_CLI_BRAND: feishu
+      TEST_BOT1_APP_SECRET: ${{ secrets.TEST_BOT1_APP_SECRET }}
+      TEST_USER_ACCESS_TOKEN: ${{ secrets.TEST_USER_ACCESS_TOKEN }}
     steps:
       - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
         with:
@@ -396,68 +329,31 @@ jobs:
       - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
           python-version: '3.x'
+      - name: Resolve CLI E2E domains
+        id: e2e_domains
+        run: node scripts/e2e_domains.js
       - name: Build lark-cli
-        id: build_cli
+        if: ${{ steps.e2e_domains.outputs.mode != 'skip' }}
         run: make build
-      - name: Prepare shared live E2E tenant token
-        id: live_e2e_tat
-        env:
-          LARKSUITE_CLI_APP_ID: ${{ secrets.TEST_BOT1_APP_ID }}
-          TEST_BOT1_APP_SECRET: ${{ secrets.TEST_BOT1_APP_SECRET }}
-        run: node scripts/fetch_e2e_tat.js
-      - name: Run CLI E2E tests
-        # Keep an active Go test alive so t.Cleanup can finish. A queued stale
-        # run is rejected below before it can start live E2E.
-        if: ${{ always() && steps.build_cli.outcome == 'success' && steps.live_e2e_tat.outcome == 'success' }}
-        shell: bash
-        env:
-          GH_TOKEN: ${{ github.token }}
-          REPOSITORY: ${{ github.repository }}
-          EVENT_NAME: ${{ github.event_name }}
-          RUN_ID: ${{ github.run_id }}
-          RUN_NUMBER: ${{ github.run_number }}
-          RUN_GENERATION: ${{ github.event_name == 'pull_request' && format('CI / {0}', github.event.pull_request.number) || '' }}
-          LARK_CLI_BIN: ${{ github.workspace }}/lark-cli
-          E2E_MODE: ${{ needs.e2e-dry-run.outputs.mode }}
-          E2E_REASON: ${{ needs.e2e-dry-run.outputs.reason }}
-          E2E_LIVE_PACKAGES: ${{ needs.e2e-dry-run.outputs.live_packages }}
-          E2E_TENANT_AUTH_FILE: ${{ steps.live_e2e_tat.outputs.path }}
-          TEST_USER_ACCESS_TOKEN: ${{ secrets.TEST_USER_ACCESS_TOKEN }}
+      - name: Configure bot credentials
+        if: ${{ steps.e2e_domains.outputs.mode != 'skip' }}
         run: |
-          if [ "$EVENT_NAME" = "pull_request" ]; then
-            workflow_id="$(gh api "repos/$REPOSITORY/actions/runs/$RUN_ID" --jq '.workflow_id')"
-            newer_runs="$(
-              gh api --paginate -X GET "repos/$REPOSITORY/actions/workflows/$workflow_id/runs" \
-                -f event=pull_request -f branch="$GITHUB_HEAD_REF" -f per_page=100 |
-                jq -r --arg repository "$REPOSITORY" --arg generation "$RUN_GENERATION" --argjson run_number "$RUN_NUMBER" \
-                  '.workflow_runs[] | select(.head_repository.full_name == $repository and .display_title == $generation and .run_number > $run_number) | .id'
-            )"
-            if [ -n "$newer_runs" ]; then
-              echo "::error::Superseded before live E2E started by newer workflow run(s): $newer_runs"
-              exit 1
-            fi
-          fi
-          if [ -z "${E2E_TENANT_AUTH_FILE:-}" ] || [ ! -f "$E2E_TENANT_AUTH_FILE" ]; then
-            echo "::error::Missing shared live E2E tenant token file"
+          if [ -z "$TEST_BOT1_APP_ID" ] || [ -z "$TEST_BOT1_APP_SECRET" ]; then
+            echo "::error::Missing required secrets: TEST_BOT1_APP_ID / TEST_BOT1_APP_SECRET"
             exit 1
           fi
-          export TEST_TENANT_ACCESS_TOKEN="$(cat "$E2E_TENANT_AUTH_FILE")"
-          rm -f "$E2E_TENANT_AUTH_FILE"
-          if ! LARKSUITE_CLI_APP_ID="$TEST_BOT1_APP_ID" \
-            LARKSUITE_CLI_TENANT_ACCESS_TOKEN="$TEST_TENANT_ACCESS_TOKEN" \
-            ./lark-cli whoami --as bot | node -e '
-            let input = "";
-            process.stdin.setEncoding("utf8");
-            process.stdin.on("data", (chunk) => { input += chunk; });
-            process.stdin.on("end", () => {
-              const result = JSON.parse(input);
-              if (result.identity !== "bot" || result.available !== true || result.tokenStatus !== "ready") process.exit(1);
-            });
-          '; then
-            echo "::error::Tenant credential preflight failed"
-            exit 1
+          printf '%s\n' "$TEST_BOT1_APP_SECRET" | ./lark-cli config init --app-id "$TEST_BOT1_APP_ID" --app-secret-stdin
+      - name: Run CLI E2E tests
+        env:
+          LARK_CLI_BIN: ${{ github.workspace }}/lark-cli
+          E2E_MODE: ${{ steps.e2e_domains.outputs.mode }}
+          E2E_REASON: ${{ steps.e2e_domains.outputs.reason }}
+          E2E_LIVE_PACKAGES: ${{ steps.e2e_domains.outputs.live_packages }}
+        run: |
+          if [ "$E2E_MODE" = "skip" ]; then
+            echo "No live CLI E2E needed: $E2E_REASON"
+            exit 0
           fi
-          echo "Tenant credential preflight succeeded"
           packages="$E2E_LIVE_PACKAGES"
           if [ -z "$packages" ]; then
             echo "::error::No live CLI E2E packages resolved for mode $E2E_MODE"
@@ -467,7 +363,7 @@ jobs:
           echo "Live CLI E2E packages: $packages"
           go run gotest.tools/gotestsum@v1.12.3 --rerun-fails=2 --rerun-fails-max-failures=20 --packages="$packages" --format testname --junitfile cli-e2e-report.xml -- -count=1 -v
       - name: Publish CLI E2E test report
-        if: ${{ !cancelled() }}
+        if: ${{ !cancelled() && steps.e2e_domains.outputs.mode != 'skip' }}
         uses: dorny/test-reporter@a43b3a5f7366b97d083190328d2c652e1a8b6aa2 # v3.0.0
         with:
           name: CLI E2E Tests
@@ -520,7 +416,7 @@ jobs:
   # ── Results Gate (single required check for branch protection) ─────
   results:
     if: ${{ always() }}
-    needs: [fast-gate, unit-test, lint, script-test, deterministic-gate, coverage, deadcode, e2e-dry-run, e2e-live, security, license-header, plugin-integration, sidecar-integration]
+    needs: [fast-gate, unit-test, lint, script-test, deterministic-gate, coverage, deadcode, e2e-dry-run, e2e-live, security, license-header]
     runs-on: ubuntu-latest
     steps:
       - name: Evaluate results
@@ -540,19 +436,10 @@ jobs:
           echo "| L3 | e2e-live | ${{ needs.e2e-live.result }} |" >> $GITHUB_STEP_SUMMARY
           echo "| L4 | security | ${{ needs.security.result }} |" >> $GITHUB_STEP_SUMMARY
           echo "| L4 | license-header | ${{ needs.license-header.result }} |" >> $GITHUB_STEP_SUMMARY
-          echo "| L4 | plugin-integration (observe-only) | ${{ needs.plugin-integration.result }} |" >> $GITHUB_STEP_SUMMARY
-          echo "| L4 | sidecar-integration (observe-only) | ${{ needs.sidecar-integration.result }} |" >> $GITHUB_STEP_SUMMARY
 
           # Any failure or cancellation in any job blocks the merge.
-          # Legitimately skipped jobs (deadcode on push, e2e-live when not
-          # needed or on a fork, license-header on push) are OK.
-          #
-          # plugin-integration and sidecar-integration are intentionally NOT
-          # in this loop yet: they run on every PR and their status is shown
-          # in the table above, but a failure is observe-only (non-blocking)
-          # during the initial soak. Graduation to required is tracked in
-          # https://github.com/larksuite/cli/issues/1894 (criteria: 4
-          # consecutive weeks with zero false positives).
+          # Legitimately skipped jobs (deadcode on push, e2e-live on fork,
+          # license-header on push) are OK.
           FAILED=0
           for result in \
             "${{ needs.fast-gate.result }}" \

AGENTS.md

@@ -10,10 +10,9 @@
 ## Build & Test
 
 ```bash
-make build             # Build (runs fetch_meta first)
-make unit-test         # Required before PR (runs with -race where supported, e.g. amd64/arm64)
-make live-skills-test  # Opt-in real Skills CLI tests; runs with isolated user directories
-make test              # Full: vet + unit + integration
+make build          # Build (runs fetch_meta first)
+make unit-test      # Required before PR (runs with -race where supported, e.g. amd64/arm64)
+make test           # Full: vet + unit + integration
 ```
 
 ## Notification Opt-Outs

CHANGELOG.md

@@ -2,145 +2,6 @@
 
 All notable changes to this project will be documented in this file.
 
-## [v1.0.74] - 2026-07-21
-
-### Features
-
-- **slides**: add history rollback shortcuts (#1714)
-- **base**: support per-record batch updates (#1889)
-
-### Bug Fixes
-
-- preserve slides schema issues
-- allow jq examples in quality gate dry-runs
-- **im**: warn when flag pagination is truncated (#1906)
-- **slides**: warn on text shape overflow
-- **slides**: exempt chart roundtrip attributes from lint
-- **slides**: detect image text occlusion
-- **slides**: clarify xml-text-overlap-lint error for positional argument (#1986)
-
-### Documentation
-
-- clarify drive upload overwrite guidance (#1982)
-
-### Tests
-
-- isolate unit tests from user state (#1883)
-
-### Refactoring
-
-- converge success output through a single Emitter that owns the write (#1899)
-
-## [v1.0.73] - 2026-07-20
-
-### Features
-
-- **apps**: design_html support, creative-design skill, unified TOS publish (#1901)
-
-### Bug Fixes
-
-- **slides**: detect visual elements outside canvas
-- reduce public content credential fixture false positives
-- standardize CLI shortcut text in English (#1942)
-
-### Documentation
-
-- **base**: reduce filter and update retry loops (#1879)
-- **vc**: default transcript routing to smart notes over minutes (#1961)
-- clarify local trigger automation (#1958)
-
-### Tests
-
-- synchronize temporary Git maintenance (#1946)
-
-### Misc
-
-- **slides**: update lark-slides skill to 0715 snapshot (#1933)
-- [codex] support bot menu events (#1765)
-
-## [v1.0.72] - 2026-07-17
-
-### Features
-
-- **slides**: lint table out of canvas
-- **slides**: report resolved table size mismatches
-- **approval**: support approval event consumption (#1924)
-
-### Bug Fixes
-
-- **vc**: don't fail +detail for in-progress meetings (#1930)
-- stabilize drive delete E2E terminal-state checks (#1939)
-
-### Documentation
-
-- **slides**: document table dimensions
-- document base field default values (#1500)
-- **sheets**: use English placeholder in table-get guidance (#1936)
-
-### Tests
-
-- stabilize live e2e auth retries (#1904)
-- use tri-state wiki node identity in delete verification (#1931)
-- fix drive cover download retries (#1934)
-
-## [v1.0.71] - 2026-07-16
-
-### Features
-
-- add wiki move-to-drive shortcut (#1869)
-- **apps**: add role management shortcuts (#1881)
-- **drive**: add secure label support and clarify comment location API (#1913)
-
-### Bug Fixes
-
-- **base**: improve dashboard shortcut guidance (#1787)
-
-### Documentation
-
-- **apps**: add platform SQL authoring guide to the db-execute skill (#1912)
-
-### Misc
-
-- add L4 plugin-integration and sidecar-integration CI jobs (#1840)
-- **drive**: optimize drive +delete workflow (#1909)
-
-## [v1.0.70] - 2026-07-15
-
-### Features
-
-- add minutes permission application shortcut (#1876)
-- **drive**: support apps in list comments (#1877)
-- slide style
-- edit ppt template
-- **slides**: add sxsd validation to slides lint
-- **slides**: validate iconpark icon types in slides lint
-- **slides**: lint before create
-- **apps**: add automation trigger commands for Miaoda (#1886)
-
-### Bug Fixes
-
-- unify dry-run output contract (#1870)
-- **skills**: align skill guidance with the typed error contract (#1786)
-- **slides**: limit slides screenshot page requests
-- **slides**: detect lark slides text overflow overlap
-- **vc**: align meeting query scopes by identity (#1850)
-
-### Documentation
-
-- clarify task search relevance filters (#1884)
-- surface minutes permission application in skill description (#1890)
-- clarify okr progress children (#1861)
-- **slides**: prefer slides xml-get shortcut
-- **calendar**: document setting meeting owner via full API (#1903)
-
-### Refactoring
-
-- **slides**: streamline create workflow and validate SML namespaces
-
-### Misc
-
-- **slides**: address PR review feedback
-
 ## [v1.0.69] - 2026-07-13
 
 ### Features
@@ -1608,11 +1469,6 @@ Bundled AI agent skills for intelligent assistance:
 - Bilingual documentation (English & Chinese).
 - CI/CD pipelines: linting, testing, coverage reporting, and automated releases.
 
-[v1.0.74]: https://github.com/larksuite/cli/releases/tag/v1.0.74
-[v1.0.73]: https://github.com/larksuite/cli/releases/tag/v1.0.73
-[v1.0.72]: https://github.com/larksuite/cli/releases/tag/v1.0.72
-[v1.0.71]: https://github.com/larksuite/cli/releases/tag/v1.0.71
-[v1.0.70]: https://github.com/larksuite/cli/releases/tag/v1.0.70
 [v1.0.69]: https://github.com/larksuite/cli/releases/tag/v1.0.69
 [v1.0.68]: https://github.com/larksuite/cli/releases/tag/v1.0.68
 [v1.0.67]: https://github.com/larksuite/cli/releases/tag/v1.0.67

Makefile

@@ -23,7 +23,7 @@ PREFIX   ?= /usr/local
 TEST_GOARCH := $(or $(GOARCH),$(shell go env GOARCH))
 RACE_FLAG := $(if $(filter riscv64,$(TEST_GOARCH)),,-race)
 
-.PHONY: all build vet fmt-check script-test test unit-test live-skills-test integration-test examples-build quality-gate install uninstall clean fetch_meta gitleaks sidecar-test
+.PHONY: all build vet fmt-check script-test test unit-test integration-test examples-build quality-gate install uninstall clean fetch_meta gitleaks
 
 all: test
 
@@ -51,27 +51,19 @@ script-test:
 	bash scripts/resolve-changed-from.test.sh
 	bash scripts/ci-workflow.test.sh
 	bash scripts/semantic-review-workflow.test.sh
-	$(NODE) --test scripts/e2e_domains.test.js scripts/fetch_e2e_tat.test.js scripts/semantic-review-verify-artifact.test.js scripts/pr-quality-summary.test.js scripts/semantic-review-publish.test.js scripts/ci-quality-summary-publish.test.js
+	$(NODE) --test scripts/e2e_domains.test.js scripts/semantic-review-verify-artifact.test.js scripts/pr-quality-summary.test.js scripts/semantic-review-publish.test.js scripts/ci-quality-summary-publish.test.js
 
 # ./extension/... keeps the public plugin SDK in the default test matrix.
 unit-test: fetch_meta
 	go test $(RACE_FLAG) -gcflags="all=-N -l" -count=1 \
 		./cmd/... ./internal/... ./shortcuts/... ./extension/...
 
-live-skills-test: fetch_meta
-	LARKSUITE_CLI_RUN_LIVE_SKILLS_TESTS=1 \
-	go test -v -count=1 ./cmd/update \
-		-run '^TestUpdateCommand_(RealSkillsSyncRewritesState|SkillsSyncColdStart)$$'
-
 # examples-build keeps the shipped plugin-SDK examples compilable. If this
 # breaks, the plugin author guide's "go build ./..." path is broken.
 examples-build:
 	go build ./extension/platform/examples/audit-observer
 	go build ./extension/platform/examples/readonly-policy
 
-# ./tests/... includes tests/plugin_e2e, which builds ~20 customer-fork
-# binaries (~1 min warm; a cold module cache also downloads via GOPROXY).
-# Deliberate: local `make test` exercises the L4 plugin contract by default.
 integration-test: build
 	go test -v -count=1 ./tests/...
 
@@ -113,14 +105,6 @@ uninstall:
 clean:
 	rm -f $(BINARY)
 
-# sidecar-test compiles and runs the authsidecar* build-tagged code that the
-# default CI matrix never sees (they carry //go:build tags).
-sidecar-test:
-	go build -tags authsidecar -o /dev/null .
-	go test $(RACE_FLAG) -count=1 -tags authsidecar ./extension/credential/sidecar/ ./extension/transport/sidecar/ ./internal/cmdutil/
-	go test $(RACE_FLAG) -count=1 -tags authsidecar_demo ./sidecar/server-demo/
-	go test $(RACE_FLAG) -count=1 -tags authsidecar ./tests/sidecar_e2e/
-
 # Run secret-leak checks locally before pushing.
 # Step 1: check-doc-tokens catches realistic-looking example tokens in reference
 #         docs and asks you to use _EXAMPLE_TOKEN placeholders instead.

cmd/api/api.go

@@ -344,18 +344,20 @@ func apiPaginate(ctx context.Context, ac *client.APIClient, request client.RawAp
 
 	switch format {
 	case output.FormatNDJSON, output.FormatTable, output.FormatCSV:
-		emitter := output.NewEmitter(output.EmitterConfig{
-			Out:            out,
-			ErrOut:         errOut,
-			CommandPath:    commandPath,
-			Identity:       string(pagOpts.Identity),
-			NoticeProvider: output.GetNotice,
-		})
+		pf := output.NewPaginatedFormatter(out, format)
 		result, hasItems, err := ac.StreamPages(ctx, request, func(items []interface{}) error {
 			// Streaming formats intentionally emit each page after that page has
 			// passed safety scanning. A later page may still fail, so callers
 			// must use the exit code to distinguish complete vs partial output.
-			return emitter.StreamPage(items, output.StreamOptions{Format: format.String()})
+			scanResult := output.ScanForSafety(commandPath, items, errOut)
+			if scanResult.Blocked {
+				return scanResult.BlockErr
+			}
+			if scanResult.Alert != nil {
+				output.WriteAlertWarning(errOut, scanResult.Alert)
+			}
+			pf.FormatPage(items)
+			return nil
 		}, pagOpts)
 		if err != nil {
 			return errs.MarkRaw(err)

cmd/api/api_paginate_test.go

@@ -1,396 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package api
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"io"
-	"net/http"
-	"testing"
-
-	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/client"
-	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
-	"github.com/larksuite/cli/internal/httpmock"
-	"github.com/larksuite/cli/internal/output"
-)
-
-type apiFailOnWriteWriter struct {
-	buf    bytes.Buffer
-	writes int
-	failAt int
-	err    error
-}
-
-func (w *apiFailOnWriteWriter) Write(p []byte) (int, error) {
-	w.writes++
-	if w.writes == w.failAt {
-		return 0, w.err
-	}
-	return w.buf.Write(p)
-}
-
-func newAPIPaginateTestHarness(t *testing.T) (*client.APIClient, *bytes.Buffer, *bytes.Buffer, *httpmock.Registry) {
-	t.Helper()
-	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
-	t.Setenv("LARKSUITE_CLI_CONTENT_SAFETY_MODE", "off")
-	previousNotice := output.PendingNotice
-	output.PendingNotice = nil
-	t.Cleanup(func() { output.PendingNotice = previousNotice })
-
-	config := &core.CliConfig{
-		AppID:     "test-app",
-		AppSecret: "test-secret",
-		Brand:     core.BrandFeishu,
-	}
-	f, out, errOut, reg := cmdutil.TestFactory(t, config)
-	ac, err := f.NewAPIClientWithConfig(config)
-	if err != nil {
-		t.Fatalf("NewAPIClientWithConfig() error = %v", err)
-	}
-	ac.ErrOut = io.Discard
-	return ac, out, errOut, reg
-}
-
-func apiPaginateRequest() client.RawApiRequest {
-	return client.RawApiRequest{
-		Method: "GET",
-		URL:    "/open-apis/test/v1/items",
-		As:     core.AsBot,
-	}
-}
-
-func assertAPIPaginateJSONBytes(t *testing.T, got []byte, want interface{}) {
-	t.Helper()
-	wantBytes, err := json.MarshalIndent(want, "", "  ")
-	if err != nil {
-		t.Fatalf("marshal expected JSON: %v", err)
-	}
-	wantBytes = append(wantBytes, '\n')
-	if !bytes.Equal(got, wantBytes) {
-		t.Fatalf("stdout bytes mismatch\ngot:\n%s\nwant:\n%s", got, wantBytes)
-	}
-}
-
-func TestAPIPaginate_DefaultAggregatesAllPages(t *testing.T) {
-	ac, out, errOut, reg := newAPIPaginateTestHarness(t)
-	calls := 0
-	wantTokens := []string{"", "next-1", "next-2"}
-	for i, wantToken := range wantTokens {
-		page := i + 1
-		hasMore := page < len(wantTokens)
-		data := map[string]interface{}{
-			"items":    []interface{}{map[string]interface{}{"id": string(rune('0' + page))}},
-			"has_more": hasMore,
-		}
-		if hasMore {
-			data["page_token"] = wantTokens[page]
-		}
-		reg.Register(&httpmock.Stub{
-			URL: "/open-apis/test/v1/items",
-			OnMatch: func(req *http.Request) {
-				calls++
-				if got := req.URL.Query().Get("page_token"); got != wantToken {
-					t.Errorf("request %d page_token = %q, want %q", page, got, wantToken)
-				}
-			},
-			Body: map[string]interface{}{
-				"code": 0,
-				"msg":  "ok",
-				"data": data,
-			},
-		})
-	}
-
-	err := apiPaginate(context.Background(), ac, apiPaginateRequest(),
-		output.FormatJSON, "", out, errOut, "lark-cli api GET", client.PaginationOptions{
-			PageLimit: 10,
-			PageDelay: -1,
-		})
-
-	if err != nil {
-		t.Fatalf("apiPaginate() error = %v, want nil", err)
-	}
-	if calls != 3 {
-		t.Fatalf("pagination requests = %d, want 3", calls)
-	}
-	assertAPIPaginateJSONBytes(t, out.Bytes(), output.Envelope{
-		OK:       true,
-		Identity: "bot",
-		Data: map[string]interface{}{
-			"items": []interface{}{
-				map[string]interface{}{"id": "1"},
-				map[string]interface{}{"id": "2"},
-				map[string]interface{}{"id": "3"},
-			},
-			"has_more": false,
-		},
-	})
-	if got := errOut.String(); got != "" {
-		t.Fatalf("stderr bytes = %q, want empty", got)
-	}
-}
-
-func TestAPIPaginate_StreamingFormatsEmitExactMultiPageBytes(t *testing.T) {
-	tests := []struct {
-		name   string
-		format output.Format
-		want   string
-	}{
-		{
-			name:   "ndjson",
-			format: output.FormatNDJSON,
-			want:   "{\"id\":\"1\",\"name\":\"Alice\"}\n{\"id\":\"2\",\"name\":\"Carol\",\"page_only\":\"ignored\"}\n",
-		},
-		{
-			name:   "table",
-			format: output.FormatTable,
-			want:   "id  name \n──  ─────\n1   Alice\n2   Carol\n",
-		},
-		{
-			name:   "csv",
-			format: output.FormatCSV,
-			want:   "id,name\n1,Alice\n2,Carol\n",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			ac, out, errOut, reg := newAPIPaginateTestHarness(t)
-			reg.Register(&httpmock.Stub{
-				URL: "/open-apis/test/v1/items",
-				Body: map[string]interface{}{
-					"code": 0,
-					"msg":  "ok",
-					"data": map[string]interface{}{
-						"items": []interface{}{
-							map[string]interface{}{"id": "1", "name": "Alice"},
-						},
-						"has_more":   true,
-						"page_token": "next-1",
-					},
-				},
-			})
-			reg.Register(&httpmock.Stub{
-				URL: "/open-apis/test/v1/items",
-				Body: map[string]interface{}{
-					"code": 0,
-					"msg":  "ok",
-					"data": map[string]interface{}{
-						"items": []interface{}{
-							map[string]interface{}{"id": "2", "name": "Carol", "page_only": "ignored"},
-						},
-						"has_more": false,
-					},
-				},
-			})
-
-			err := apiPaginate(context.Background(), ac, apiPaginateRequest(),
-				tt.format, "", out, errOut, "lark-cli api GET", client.PaginationOptions{
-					PageLimit: 10,
-					PageDelay: -1,
-				})
-
-			if err != nil {
-				t.Fatalf("apiPaginate() error = %v, want nil", err)
-			}
-			if got := out.String(); got != tt.want {
-				t.Fatalf("stdout byte mismatch\ngot (%d bytes):\n%q\nwant (%d bytes):\n%q", len(got), got, len(tt.want), tt.want)
-			}
-			if got := errOut.String(); got != "" {
-				t.Fatalf("stderr bytes = %q, want empty", got)
-			}
-		})
-	}
-}
-
-func TestAPIPaginate_StreamingWriteFailureStopsFurtherPages(t *testing.T) {
-	ac, _, errOut, reg := newAPIPaginateTestHarness(t)
-	sentinel := errors.New("page write failed")
-	out := &apiFailOnWriteWriter{failAt: 2, err: sentinel}
-	calls := 0
-	for page := 1; page <= 2; page++ {
-		hasMore := true
-		data := map[string]interface{}{
-			"items":    []interface{}{map[string]interface{}{"id": page}},
-			"has_more": hasMore,
-		}
-		if hasMore {
-			data["page_token"] = fmt.Sprintf("next-%d", page)
-		}
-		reg.Register(&httpmock.Stub{
-			URL: "/open-apis/test/v1/items",
-			OnMatch: func(*http.Request) {
-				calls++
-			},
-			Body: map[string]interface{}{
-				"code": 0,
-				"msg":  "ok",
-				"data": data,
-			},
-		})
-	}
-
-	err := apiPaginate(context.Background(), ac, apiPaginateRequest(),
-		output.FormatNDJSON, "", out, errOut, "lark-cli api GET",
-		client.PaginationOptions{PageLimit: 10, PageDelay: -1})
-
-	if !errors.Is(err, sentinel) {
-		t.Fatalf("apiPaginate() error = %v, want preserved writer cause", err)
-	}
-	problem, ok := errs.ProblemOf(err)
-	if !ok || problem.Category != errs.CategoryInternal {
-		t.Fatalf("apiPaginate() problem = %#v, %v; want internal typed error", problem, ok)
-	}
-	if calls != 2 {
-		t.Fatalf("pagination requests = %d, want 2", calls)
-	}
-	if got, want := out.buf.String(), "{\"id\":1}\n"; got != want {
-		t.Fatalf("stdout bytes = %q, want %q", got, want)
-	}
-}
-
-func TestAPIPaginate_StreamingFormatFallsBackToJSONWithoutList(t *testing.T) {
-	ac, out, errOut, reg := newAPIPaginateTestHarness(t)
-	reg.Register(&httpmock.Stub{
-		URL: "/open-apis/test/v1/items",
-		Body: map[string]interface{}{
-			"code": 0,
-			"msg":  "ok",
-			"data": map[string]interface{}{
-				"name":    "Test User",
-				"user_id": "u123",
-			},
-		},
-	})
-
-	err := apiPaginate(context.Background(), ac, apiPaginateRequest(),
-		output.FormatNDJSON, "", out, errOut, "lark-cli api GET", client.PaginationOptions{PageDelay: -1})
-
-	if err != nil {
-		t.Fatalf("apiPaginate() error = %v, want nil", err)
-	}
-	assertAPIPaginateJSONBytes(t, out.Bytes(), output.Envelope{
-		OK:       true,
-		Identity: "bot",
-		Data: map[string]interface{}{
-			"name":    "Test User",
-			"user_id": "u123",
-		},
-	})
-	wantWarning := "warning: this API does not return a list, format \"ndjson\" is not supported, falling back to json\n"
-	if got := errOut.String(); got != wantWarning {
-		t.Fatalf("stderr bytes = %q, want %q", got, wantWarning)
-	}
-}
-
-func TestAPIPaginate_BusinessErrorsWriteRawAndAreMarkedRaw(t *testing.T) {
-	businessResponse := map[string]interface{}{
-		"code": 123456,
-		"msg":  "fixture business error",
-		"data": map[string]interface{}{"detail": "business failed"},
-	}
-	tests := []struct {
-		name   string
-		format output.Format
-		jqExpr string
-	}{
-		{name: "jq", format: output.FormatJSON, jqExpr: ".data.items"},
-		{name: "default_json", format: output.FormatJSON},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			ac, out, errOut, reg := newAPIPaginateTestHarness(t)
-			reg.Register(&httpmock.Stub{
-				URL:  "/open-apis/test/v1/items",
-				Body: businessResponse,
-			})
-
-			err := apiPaginate(context.Background(), ac, apiPaginateRequest(),
-				tt.format, tt.jqExpr, out, errOut, "lark-cli api GET", client.PaginationOptions{PageDelay: -1})
-
-			if err == nil {
-				t.Fatal("apiPaginate() error = nil, want business error")
-			}
-			if !errs.IsRaw(err) {
-				t.Fatalf("errs.IsRaw(error) = false, want true; error = %T: %v", err, err)
-			}
-			assertAPIPaginateJSONBytes(t, out.Bytes(), businessResponse)
-			if bytes.Contains(out.Bytes(), []byte(`"ok": true`)) {
-				t.Fatalf("business-error stdout contains a success envelope:\n%s", out.Bytes())
-			}
-			if got := errOut.String(); got != "" {
-				t.Fatalf("stderr bytes = %q, want empty", got)
-			}
-		})
-	}
-}
-
-func TestAPIPaginate_TransportErrorsAreMarkedRaw(t *testing.T) {
-	tests := []struct {
-		name   string
-		format output.Format
-		jqExpr string
-	}{
-		{name: "jq_paginate_all", format: output.FormatJSON, jqExpr: ".data.items"},
-		{name: "stream_pages", format: output.FormatNDJSON},
-		{name: "default_paginate_all", format: output.FormatJSON},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			ac, out, errOut, _ := newAPIPaginateTestHarness(t)
-
-			err := apiPaginate(context.Background(), ac, apiPaginateRequest(),
-				tt.format, tt.jqExpr, out, errOut, "lark-cli api GET", client.PaginationOptions{PageDelay: -1})
-
-			if err == nil {
-				t.Fatal("apiPaginate() error = nil, want transport error")
-			}
-			if !errs.IsRaw(err) {
-				t.Fatalf("errs.IsRaw(error) = false, want true; error = %T: %v", err, err)
-			}
-			if got := out.String(); got != "" {
-				t.Fatalf("stdout bytes = %q, want empty", got)
-			}
-			if got := errOut.String(); got != "" {
-				t.Fatalf("stderr bytes = %q, want empty", got)
-			}
-		})
-	}
-}
-
-func TestAPIPaginate_StreamBusinessErrorIsMarkedRaw(t *testing.T) {
-	ac, out, errOut, reg := newAPIPaginateTestHarness(t)
-	reg.Register(&httpmock.Stub{
-		URL: "/open-apis/test/v1/items",
-		Body: map[string]interface{}{
-			"code": 123456,
-			"msg":  "fixture business error",
-			"data": map[string]interface{}{},
-		},
-	})
-
-	err := apiPaginate(context.Background(), ac, apiPaginateRequest(),
-		output.FormatNDJSON, "", out, errOut, "lark-cli api GET", client.PaginationOptions{PageDelay: -1})
-
-	if err == nil {
-		t.Fatal("apiPaginate() error = nil, want business error")
-	}
-	if !errs.IsRaw(err) {
-		t.Fatalf("errs.IsRaw(error) = false, want true; error = %T: %v", err, err)
-	}
-	if got := out.String(); got != "" {
-		t.Fatalf("stdout bytes = %q, want empty", got)
-	}
-	if got := errOut.String(); got != "" {
-		t.Fatalf("stderr bytes = %q, want empty", got)
-	}
-}

cmd/api/api_test.go

@@ -352,9 +352,6 @@ func TestApiCmd_OutputAndPageAllConflict(t *testing.T) {
 }
 
 func TestApiCmd_BinaryResponse_AutoSave(t *testing.T) {
-	dir := t.TempDir()
-	cmdutil.TestChdir(t, dir)
-
 	f, stdout, stderr, reg := cmdutil.TestFactory(t, &core.CliConfig{
 		AppID: "test-app-bin", AppSecret: "test-secret-bin", Brand: core.BrandFeishu,
 	})
@@ -374,33 +371,8 @@ func TestApiCmd_BinaryResponse_AutoSave(t *testing.T) {
 	if !strings.Contains(stderr.String(), "binary response detected") {
 		t.Error("expected binary response hint in stderr")
 	}
-	var got map[string]interface{}
-	if err := json.Unmarshal(stdout.Bytes(), &got); err != nil {
-		t.Fatalf("stdout is not JSON: %v\nstdout:\n%s", err, stdout.String())
-	}
-	savedPath, _ := got["saved_path"].(string)
-	if savedPath == "" {
-		t.Fatalf("saved_path missing from output: %#v", got)
-	}
-	// The file must land inside the temporary cwd — this pins the isolation
-	// contract: rolling back TestChdir would leave download.bin in the repo.
-	wantDir, err := filepath.EvalSymlinks(dir)
-	if err != nil {
-		t.Fatal(err)
-	}
-	gotDir, err := filepath.EvalSymlinks(filepath.Dir(savedPath))
-	if err != nil {
-		t.Fatalf("saved_path %q dir not resolvable: %v", savedPath, err)
-	}
-	if gotDir != wantDir {
-		t.Errorf("saved_path %q is outside temp cwd %q", savedPath, wantDir)
-	}
-	content, err := os.ReadFile(savedPath)
-	if err != nil {
-		t.Fatalf("read saved file: %v", err)
-	}
-	if string(content) != "fake-binary-content" {
-		t.Errorf("saved file content = %q, want %q", content, "fake-binary-content")
+	if !strings.Contains(stdout.String(), "saved_path") {
+		t.Error("expected saved_path in output")
 	}
 }
 

cmd/auth/testmain_test.go

@@ -1,46 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package auth
-
-import (
-	"os"
-	"path/filepath"
-	"testing"
-
-	"github.com/larksuite/cli/internal/registry/registrytest"
-)
-
-// TestMain isolates auth command tests from the host machine: config, logs
-// and the registry cache are redirected to a temp dir, then the registry is
-// seeded from the tracked fixture and initialized eagerly. Domain-completion
-// tests read the registry, so without seeding a clean checkout would either
-// fail or trigger a remote metadata fetch.
-//
-// Note: os.Exit skips deferred functions, so cleanup runs explicitly after
-// m.Run before exiting.
-func TestMain(m *testing.M) {
-	root, err := os.MkdirTemp("", "lark-cli-cmd-auth-test-*")
-	if err != nil {
-		println("cmd/auth test setup: MkdirTemp failed:", err.Error())
-		os.Exit(2)
-	}
-	if err := os.Setenv("LARKSUITE_CLI_CONFIG_DIR", filepath.Join(root, "config")); err != nil {
-		println("cmd/auth test setup: Setenv failed:", err.Error())
-		os.RemoveAll(root)
-		os.Exit(2)
-	}
-	if err := os.Setenv("LARKSUITE_CLI_LOG_DIR", filepath.Join(root, "logs")); err != nil {
-		println("cmd/auth test setup: Setenv failed:", err.Error())
-		os.RemoveAll(root)
-		os.Exit(2)
-	}
-	if err := registrytest.Seed(root); err != nil {
-		println("cmd/auth test setup: registrytest.Seed failed:", err.Error())
-		os.RemoveAll(root)
-		os.Exit(2)
-	}
-	code := m.Run()
-	_ = os.RemoveAll(root)
-	os.Exit(code)
-}

cmd/event/list_test.go

@@ -17,8 +17,6 @@ import (
 
 func TestEventLookup_VCMeetingLifecycleKeys(t *testing.T) {
 	for _, key := range []string{
-		"approval.instance.status_changed_v4",
-		"approval.task.status_changed_v4",
 		"vc.meeting.participant_meeting_started_v1",
 		"vc.meeting.participant_meeting_joined_v1",
 	} {
@@ -38,8 +36,6 @@ func TestRunList_TextOutput(t *testing.T) {
 	out := stdout.String()
 	for _, want := range []string{
 		"KEY", "AUTH", "PARAMS", "DESCRIPTION",
-		"approval.instance.status_changed_v4",
-		"approval.task.status_changed_v4",
 		"im.message.receive_v1",
 		"im.message.message_read_v1",
 		"task.task.update_user_access_v2",
@@ -94,8 +90,6 @@ func TestRunList_JSONOutput(t *testing.T) {
 		t.Fatal("event list JSON missing task.task.update_user_access_v2")
 	}
 	for _, want := range []string{
-		"approval.instance.status_changed_v4",
-		"approval.task.status_changed_v4",
 		"vc.meeting.participant_meeting_started_v1",
 		"vc.meeting.participant_meeting_joined_v1",
 	} {

cmd/event/schema_test.go

@@ -19,29 +19,6 @@ import (
 	_ "github.com/larksuite/cli/events"
 )
 
-type approvalSchemaJSONPayload struct {
-	JQRootPath           string                           `json:"jq_root_path"`
-	AuthTypes            []string                         `json:"auth_types"`
-	Scopes               []string                         `json:"scopes"`
-	Params               []approvalSchemaJSONParam        `json:"params"`
-	ResolvedOutputSchema approvalSchemaJSONResolvedSchema `json:"resolved_output_schema"`
-}
-
-type approvalSchemaJSONParam struct {
-	Name            string `json:"name"`
-	Type            string `json:"type"`
-	Required        bool   `json:"required"`
-	SubscriptionKey bool   `json:"subscription_key"`
-}
-
-type approvalSchemaJSONResolvedSchema struct {
-	Properties map[string]approvalSchemaJSONProperty `json:"properties"`
-}
-
-type approvalSchemaJSONProperty struct {
-	Format string `json:"format"`
-}
-
 func TestRunSchema_ProcessedKey_Text(t *testing.T) {
 	f, stdout, _, _ := cmdutil.TestFactory(t, &core.CliConfig{AppID: "test"})
 
@@ -181,60 +158,6 @@ func TestRunSchema_TaskUpdateUserAccessJSON(t *testing.T) {
 	}
 }
 
-func TestRunSchema_ApprovalStatusChangedJSON(t *testing.T) {
-	tests := []struct {
-		key   string
-		scope string
-	}{
-		{"approval.instance.status_changed_v4", "approval:instance:read"},
-		{"approval.task.status_changed_v4", "approval:task:read"},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.key, func(t *testing.T) {
-			t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
-			f, stdout, _, _ := cmdutil.TestFactory(t, &core.CliConfig{AppID: "test"})
-
-			if err := runSchema(f, tc.key, true); err != nil {
-				t.Fatalf("runSchema json: %v", err)
-			}
-
-			var payload approvalSchemaJSONPayload
-			if err := json.Unmarshal(stdout.Bytes(), &payload); err != nil {
-				t.Fatalf("output is not valid JSON: %v\n%s", err, stdout.String())
-			}
-			if payload.JQRootPath != "." {
-				t.Errorf("jq_root_path = %v, want .", payload.JQRootPath)
-			}
-			if got := payload.AuthTypes; !reflect.DeepEqual(got, []string{"user"}) {
-				t.Errorf("auth_types = %#v, want user", got)
-			}
-			if got := payload.Scopes; !reflect.DeepEqual(got, []string{tc.scope}) {
-				t.Errorf("scopes = %#v, want %s", got, tc.scope)
-			}
-			if len(payload.Params) != 1 {
-				t.Fatalf("params = %#v, want one subscription_type param", payload.Params)
-			}
-			param := payload.Params[0]
-			if param.Name != "subscription_type" || param.Type != "multi" || param.Required || param.SubscriptionKey {
-				t.Fatalf("subscription_type param = %#v, want optional multi non-subscription-key param", param)
-			}
-			props := payload.ResolvedOutputSchema.Properties
-			for _, field := range []string{"type", "event_id", "timestamp", "approval_code", "instance_code", "status", "operate_time"} {
-				if _, ok := props[field]; !ok {
-					t.Errorf("approval schema missing flat field %q: %+v", field, props)
-				}
-			}
-			if _, ok := props["event"]; ok {
-				t.Errorf("approval Custom schema should be flat, got envelope field event: %+v", props)
-			}
-			if got := props["operate_time"].Format; got != "timestamp_ms" {
-				t.Errorf("operate_time format = %v, want timestamp_ms", got)
-			}
-		})
-	}
-}
-
 func TestRunSchema_JSONOutput_VCMeetingLifecycleKeys(t *testing.T) {
 	for _, key := range []string{
 		"vc.meeting.participant_meeting_started_v1",

cmd/root_integration_test.go

@@ -371,11 +371,10 @@ func TestIntegration_StrictModeUser_ProfileOverride_ShortcutExplicitBotReturnsEn
 
 func TestIntegration_StrictModeBot_ProfileOverride_ServiceExplicitUserReturnsEnvelope(t *testing.T) {
 	f, stdout, stderr := newStrictModeDefaultFactory(t, "target", core.StrictModeBot)
-	catalog := strictModeFixtureCatalog()
-	rootCmd := buildStrictModeIntegrationRootCmdWithCatalog(t, f, &catalog)
+	rootCmd := buildStrictModeIntegrationRootCmd(t, f)
 
 	code := executeRootIntegration(t, f, rootCmd, []string{
-		"fixture", "things", "create", "--data", `{"name":"probe"}`, "--as", "user", "--dry-run",
+		"im", "chats", "get", "--params", `{"chat_id":"oc_test"}`, "--as", "user", "--dry-run",
 	})
 
 	if code != output.ExitValidation {

cmd/service/service.go

@@ -707,18 +707,20 @@ func servicePaginate(ctx context.Context, ac *client.APIClient, request client.R
 
 	switch format {
 	case output.FormatNDJSON, output.FormatTable, output.FormatCSV:
-		emitter := output.NewEmitter(output.EmitterConfig{
-			Out:            out,
-			ErrOut:         errOut,
-			CommandPath:    commandPath,
-			Identity:       string(pagOpts.Identity),
-			NoticeProvider: output.GetNotice,
-		})
+		pf := output.NewPaginatedFormatter(out, format)
 		result, hasItems, err := ac.StreamPages(ctx, request, func(items []interface{}) error {
 			// Streaming formats intentionally emit each page after that page has
 			// passed safety scanning. A later page may still fail, so callers
 			// must use the exit code to distinguish complete vs partial output.
-			return emitter.StreamPage(items, output.StreamOptions{Format: format.String()})
+			scanResult := output.ScanForSafety(commandPath, items, errOut)
+			if scanResult.Blocked {
+				return scanResult.BlockErr
+			}
+			if scanResult.Alert != nil {
+				output.WriteAlertWarning(errOut, scanResult.Alert)
+			}
+			pf.FormatPage(items)
+			return nil
 		}, pagOpts)
 		if err != nil {
 			return err

cmd/service/service_paginate_test.go

@@ -1,400 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package service
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"io"
-	"net/http"
-	"testing"
-
-	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/client"
-	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
-	"github.com/larksuite/cli/internal/httpmock"
-	"github.com/larksuite/cli/internal/output"
-)
-
-type serviceFailOnWriteWriter struct {
-	buf    bytes.Buffer
-	writes int
-	failAt int
-	err    error
-}
-
-func (w *serviceFailOnWriteWriter) Write(p []byte) (int, error) {
-	w.writes++
-	if w.writes == w.failAt {
-		return 0, w.err
-	}
-	return w.buf.Write(p)
-}
-
-func newServicePaginateTestHarness(t *testing.T) (*client.APIClient, *bytes.Buffer, *bytes.Buffer, *httpmock.Registry) {
-	t.Helper()
-	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
-	t.Setenv("LARKSUITE_CLI_CONTENT_SAFETY_MODE", "off")
-	previousNotice := output.PendingNotice
-	output.PendingNotice = nil
-	t.Cleanup(func() { output.PendingNotice = previousNotice })
-
-	config := &core.CliConfig{
-		AppID:     "test-app",
-		AppSecret: "test-secret",
-		Brand:     core.BrandFeishu,
-	}
-	f, out, errOut, reg := cmdutil.TestFactory(t, config)
-	ac, err := f.NewAPIClientWithConfig(config)
-	if err != nil {
-		t.Fatalf("NewAPIClientWithConfig() error = %v", err)
-	}
-	ac.ErrOut = io.Discard
-	return ac, out, errOut, reg
-}
-
-func servicePaginateRequest() client.RawApiRequest {
-	return client.RawApiRequest{
-		Method: "GET",
-		URL:    "/open-apis/test/v1/items",
-		As:     core.AsBot,
-	}
-}
-
-func assertServicePaginateJSONBytes(t *testing.T, got []byte, want interface{}) {
-	t.Helper()
-	wantBytes, err := json.MarshalIndent(want, "", "  ")
-	if err != nil {
-		t.Fatalf("marshal expected JSON: %v", err)
-	}
-	wantBytes = append(wantBytes, '\n')
-	if !bytes.Equal(got, wantBytes) {
-		t.Fatalf("stdout bytes mismatch\ngot:\n%s\nwant:\n%s", got, wantBytes)
-	}
-}
-
-func TestServicePaginate_DefaultAggregatesAllPages(t *testing.T) {
-	ac, out, errOut, reg := newServicePaginateTestHarness(t)
-	calls := 0
-	wantTokens := []string{"", "next-1", "next-2"}
-	for i, wantToken := range wantTokens {
-		page := i + 1
-		hasMore := page < len(wantTokens)
-		data := map[string]interface{}{
-			"items":    []interface{}{map[string]interface{}{"id": string(rune('0' + page))}},
-			"has_more": hasMore,
-		}
-		if hasMore {
-			data["page_token"] = wantTokens[page]
-		}
-		reg.Register(&httpmock.Stub{
-			URL: "/open-apis/test/v1/items",
-			OnMatch: func(req *http.Request) {
-				calls++
-				if got := req.URL.Query().Get("page_token"); got != wantToken {
-					t.Errorf("request %d page_token = %q, want %q", page, got, wantToken)
-				}
-			},
-			Body: map[string]interface{}{
-				"code": 0,
-				"msg":  "ok",
-				"data": data,
-			},
-		})
-	}
-
-	err := servicePaginate(context.Background(), ac, servicePaginateRequest(),
-		output.FormatJSON, "", out, errOut, "lark-cli test items list", client.PaginationOptions{
-			PageLimit: 10,
-			PageDelay: -1,
-		}, ac.CheckResponse)
-
-	if err != nil {
-		t.Fatalf("servicePaginate() error = %v, want nil", err)
-	}
-	if calls != 3 {
-		t.Fatalf("pagination requests = %d, want 3", calls)
-	}
-	assertServicePaginateJSONBytes(t, out.Bytes(), output.Envelope{
-		OK:       true,
-		Identity: "bot",
-		Data: map[string]interface{}{
-			"items": []interface{}{
-				map[string]interface{}{"id": "1"},
-				map[string]interface{}{"id": "2"},
-				map[string]interface{}{"id": "3"},
-			},
-			"has_more": false,
-		},
-	})
-	if got := errOut.String(); got != "" {
-		t.Fatalf("stderr bytes = %q, want empty", got)
-	}
-}
-
-func TestServicePaginate_StreamingFormatsEmitExactMultiPageBytes(t *testing.T) {
-	tests := []struct {
-		name   string
-		format output.Format
-		want   string
-	}{
-		{
-			name:   "ndjson",
-			format: output.FormatNDJSON,
-			want:   "{\"id\":\"1\",\"name\":\"Alice\"}\n{\"id\":\"2\",\"name\":\"Carol\",\"page_only\":\"ignored\"}\n",
-		},
-		{
-			name:   "table",
-			format: output.FormatTable,
-			want:   "id  name \n──  ─────\n1   Alice\n2   Carol\n",
-		},
-		{
-			name:   "csv",
-			format: output.FormatCSV,
-			want:   "id,name\n1,Alice\n2,Carol\n",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			ac, out, errOut, reg := newServicePaginateTestHarness(t)
-			reg.Register(&httpmock.Stub{
-				URL: "/open-apis/test/v1/items",
-				Body: map[string]interface{}{
-					"code": 0,
-					"msg":  "ok",
-					"data": map[string]interface{}{
-						"items": []interface{}{
-							map[string]interface{}{"id": "1", "name": "Alice"},
-						},
-						"has_more":   true,
-						"page_token": "next-1",
-					},
-				},
-			})
-			reg.Register(&httpmock.Stub{
-				URL: "/open-apis/test/v1/items",
-				Body: map[string]interface{}{
-					"code": 0,
-					"msg":  "ok",
-					"data": map[string]interface{}{
-						"items": []interface{}{
-							map[string]interface{}{"id": "2", "name": "Carol", "page_only": "ignored"},
-						},
-						"has_more": false,
-					},
-				},
-			})
-
-			err := servicePaginate(context.Background(), ac, servicePaginateRequest(),
-				tt.format, "", out, errOut, "lark-cli test items list", client.PaginationOptions{
-					PageLimit: 10,
-					PageDelay: -1,
-				}, ac.CheckResponse)
-
-			if err != nil {
-				t.Fatalf("servicePaginate() error = %v, want nil", err)
-			}
-			if got := out.String(); got != tt.want {
-				t.Fatalf("stdout byte mismatch\ngot (%d bytes):\n%q\nwant (%d bytes):\n%q", len(got), got, len(tt.want), tt.want)
-			}
-			if got := errOut.String(); got != "" {
-				t.Fatalf("stderr bytes = %q, want empty", got)
-			}
-		})
-	}
-}
-
-func TestServicePaginate_StreamingWriteFailureStopsFurtherPages(t *testing.T) {
-	ac, _, errOut, reg := newServicePaginateTestHarness(t)
-	sentinel := errors.New("page write failed")
-	out := &serviceFailOnWriteWriter{failAt: 2, err: sentinel}
-	calls := 0
-	for page := 1; page <= 2; page++ {
-		hasMore := true
-		data := map[string]interface{}{
-			"items":    []interface{}{map[string]interface{}{"id": page}},
-			"has_more": hasMore,
-		}
-		if hasMore {
-			data["page_token"] = fmt.Sprintf("next-%d", page)
-		}
-		reg.Register(&httpmock.Stub{
-			URL: "/open-apis/test/v1/items",
-			OnMatch: func(*http.Request) {
-				calls++
-			},
-			Body: map[string]interface{}{
-				"code": 0,
-				"msg":  "ok",
-				"data": data,
-			},
-		})
-	}
-
-	err := servicePaginate(context.Background(), ac, servicePaginateRequest(),
-		output.FormatNDJSON, "", out, errOut, "lark-cli test items list",
-		client.PaginationOptions{PageLimit: 10, PageDelay: -1}, ac.CheckResponse)
-
-	if !errors.Is(err, sentinel) {
-		t.Fatalf("servicePaginate() error = %v, want preserved writer cause", err)
-	}
-	problem, ok := errs.ProblemOf(err)
-	if !ok || problem.Category != errs.CategoryInternal {
-		t.Fatalf("servicePaginate() problem = %#v, %v; want internal typed error", problem, ok)
-	}
-	if calls != 2 {
-		t.Fatalf("pagination requests = %d, want 2", calls)
-	}
-	if got, want := out.buf.String(), "{\"id\":1}\n"; got != want {
-		t.Fatalf("stdout bytes = %q, want %q", got, want)
-	}
-}
-
-func TestServicePaginate_StreamingFormatFallsBackToJSONWithoutList(t *testing.T) {
-	ac, out, errOut, reg := newServicePaginateTestHarness(t)
-	reg.Register(&httpmock.Stub{
-		URL: "/open-apis/test/v1/items",
-		Body: map[string]interface{}{
-			"code": 0,
-			"msg":  "ok",
-			"data": map[string]interface{}{
-				"name":    "Test User",
-				"user_id": "u123",
-			},
-		},
-	})
-
-	err := servicePaginate(context.Background(), ac, servicePaginateRequest(),
-		output.FormatNDJSON, "", out, errOut, "lark-cli test items get",
-		client.PaginationOptions{PageDelay: -1}, ac.CheckResponse)
-
-	if err != nil {
-		t.Fatalf("servicePaginate() error = %v, want nil", err)
-	}
-	assertServicePaginateJSONBytes(t, out.Bytes(), output.Envelope{
-		OK:       true,
-		Identity: "bot",
-		Data: map[string]interface{}{
-			"name":    "Test User",
-			"user_id": "u123",
-		},
-	})
-	wantWarning := "warning: this API does not return a list, format \"ndjson\" is not supported, falling back to json\n"
-	if got := errOut.String(); got != wantWarning {
-		t.Fatalf("stderr bytes = %q, want %q", got, wantWarning)
-	}
-}
-
-func TestServicePaginate_BusinessErrorsWriteRawAndRemainUnmarked(t *testing.T) {
-	businessResponse := map[string]interface{}{
-		"code": 123456,
-		"msg":  "fixture business error",
-		"data": map[string]interface{}{"detail": "business failed"},
-	}
-	tests := []struct {
-		name   string
-		format output.Format
-		jqExpr string
-	}{
-		{name: "jq", format: output.FormatJSON, jqExpr: ".data.items"},
-		{name: "default_json", format: output.FormatJSON},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			ac, out, errOut, reg := newServicePaginateTestHarness(t)
-			reg.Register(&httpmock.Stub{
-				URL:  "/open-apis/test/v1/items",
-				Body: businessResponse,
-			})
-
-			err := servicePaginate(context.Background(), ac, servicePaginateRequest(),
-				tt.format, tt.jqExpr, out, errOut, "lark-cli test items list",
-				client.PaginationOptions{PageDelay: -1}, ac.CheckResponse)
-
-			if err == nil {
-				t.Fatal("servicePaginate() error = nil, want business error")
-			}
-			if errs.IsRaw(err) {
-				t.Fatalf("errs.IsRaw(error) = true, want current servicePaginate pass-through behavior")
-			}
-			assertServicePaginateJSONBytes(t, out.Bytes(), businessResponse)
-			if bytes.Contains(out.Bytes(), []byte(`"ok": true`)) {
-				t.Fatalf("business-error stdout contains a success envelope:\n%s", out.Bytes())
-			}
-			if got := errOut.String(); got != "" {
-				t.Fatalf("stderr bytes = %q, want empty", got)
-			}
-		})
-	}
-}
-
-func TestServicePaginate_TransportErrorsRemainUnmarked(t *testing.T) {
-	tests := []struct {
-		name   string
-		format output.Format
-		jqExpr string
-	}{
-		{name: "jq_paginate_all", format: output.FormatJSON, jqExpr: ".data.items"},
-		{name: "stream_pages", format: output.FormatNDJSON},
-		{name: "default_paginate_all", format: output.FormatJSON},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			ac, out, errOut, _ := newServicePaginateTestHarness(t)
-
-			err := servicePaginate(context.Background(), ac, servicePaginateRequest(),
-				tt.format, tt.jqExpr, out, errOut, "lark-cli test items list",
-				client.PaginationOptions{PageDelay: -1}, ac.CheckResponse)
-
-			if err == nil {
-				t.Fatal("servicePaginate() error = nil, want transport error")
-			}
-			if errs.IsRaw(err) {
-				t.Fatalf("errs.IsRaw(error) = true, want current servicePaginate pass-through behavior")
-			}
-			if got := out.String(); got != "" {
-				t.Fatalf("stdout bytes = %q, want empty", got)
-			}
-			if got := errOut.String(); got != "" {
-				t.Fatalf("stderr bytes = %q, want empty", got)
-			}
-		})
-	}
-}
-
-func TestServicePaginate_StreamBusinessErrorRemainsUnmarked(t *testing.T) {
-	ac, out, errOut, reg := newServicePaginateTestHarness(t)
-	reg.Register(&httpmock.Stub{
-		URL: "/open-apis/test/v1/items",
-		Body: map[string]interface{}{
-			"code": 123456,
-			"msg":  "fixture business error",
-			"data": map[string]interface{}{},
-		},
-	})
-
-	err := servicePaginate(context.Background(), ac, servicePaginateRequest(),
-		output.FormatNDJSON, "", out, errOut, "lark-cli test items list",
-		client.PaginationOptions{PageDelay: -1}, ac.CheckResponse)
-
-	if err == nil {
-		t.Fatal("servicePaginate() error = nil, want business error")
-	}
-	if errs.IsRaw(err) {
-		t.Fatalf("errs.IsRaw(error) = true, want current servicePaginate pass-through behavior")
-	}
-	if got := out.String(); got != "" {
-		t.Fatalf("stdout bytes = %q, want empty", got)
-	}
-	if got := errOut.String(); got != "" {
-		t.Fatalf("stderr bytes = %q, want empty", got)
-	}
-}

cmd/service/testmain_test.go

@@ -1,39 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package service
-
-import (
-	"os"
-	"testing"
-
-	"github.com/larksuite/cli/internal/registry/registrytest"
-)
-
-// TestMain isolates service command tests from the host machine: config (and
-// the registry cache under it) is redirected to a temp dir, then the registry
-// is seeded from the tracked fixture and initialized eagerly. Tests pass on a
-// clean checkout with no network, no `make fetch_meta`, and no user cache.
-//
-// Note: os.Exit skips deferred functions, so cleanup runs explicitly after
-// m.Run before exiting.
-func TestMain(m *testing.M) {
-	root, err := os.MkdirTemp("", "lark-cli-cmd-service-test-*")
-	if err != nil {
-		println("cmd/service test setup: MkdirTemp failed:", err.Error())
-		os.Exit(2)
-	}
-	if err := os.Setenv("LARKSUITE_CLI_CONFIG_DIR", root); err != nil {
-		println("cmd/service test setup: Setenv failed:", err.Error())
-		os.RemoveAll(root)
-		os.Exit(2)
-	}
-	if err := registrytest.Seed(root); err != nil {
-		println("cmd/service test setup: registrytest.Seed failed:", err.Error())
-		os.RemoveAll(root)
-		os.Exit(2)
-	}
-	code := m.Run()
-	os.RemoveAll(root)
-	os.Exit(code)
-}

cmd/startup_brand_test.go

@@ -5,7 +5,6 @@ package cmd
 
 import (
 	"context"
-	"flag"
 	"fmt"
 	"os"
 	"os/exec"
@@ -13,34 +12,11 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/google/uuid"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/registry"
 )
 
-const startupBrandHelperEnv = "GO_TEST_STARTUP_BRAND_HELPER"
-
-var _ = flag.String("startup-brand-helper", "", "internal startup brand test helper nonce")
-
-func isStartupBrandHelper() bool {
-	return startupBrandHelperEnabled(os.Getenv(startupBrandHelperEnv), startupBrandHelperNonce(os.Args))
-}
-
-func startupBrandHelperEnabled(envNonce, argNonce string) bool {
-	return envNonce != "" && envNonce == argNonce
-}
-
-func startupBrandHelperNonce(args []string) string {
-	const prefix = "-startup-brand-helper="
-	for _, arg := range args {
-		if strings.HasPrefix(arg, prefix) {
-			return strings.TrimPrefix(arg, prefix)
-		}
-	}
-	return ""
-}
-
 func TestResolveStartupBrand_Precedence(t *testing.T) {
 	tmp := t.TempDir()
 	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", tmp)
@@ -78,7 +54,7 @@ func TestResolveStartupBrand_Precedence(t *testing.T) {
 // sync.Once, so the brand must be injected before the first catalog access.
 // It runs in a subprocess because the registry is process-global.
 func TestStartupBrandReachesRegistry_RealStartupOrder(t *testing.T) {
-	if isStartupBrandHelper() {
+	if os.Getenv("GO_TEST_STARTUP_BRAND_HELPER") == "1" {
 		// Helper: replicate Execute()'s build wiring with a lark config.
 		buildInternal(
 			context.Background(), cmdutil.InvocationContext{},
@@ -95,11 +71,9 @@ func TestStartupBrandReachesRegistry_RealStartupOrder(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	nonce := uuid.NewString()
-	t.Setenv(startupBrandHelperEnv, nonce)
 	cmd := exec.Command(os.Args[0], "-test.run", "TestStartupBrandReachesRegistry_RealStartupOrder")
-	cmd.Args = append(cmd.Args, "-startup-brand-helper="+nonce)
 	cmd.Env = append(os.Environ(),
+		"GO_TEST_STARTUP_BRAND_HELPER=1",
 		"LARKSUITE_CLI_CONFIG_DIR="+tmp,
 		"LARKSUITE_CLI_REMOTE_META=off", // no network during the subprocess build
 	)
@@ -111,33 +85,3 @@ func TestStartupBrandReachesRegistry_RealStartupOrder(t *testing.T) {
 		t.Errorf("registry brand after real startup order = %s, want lark", out)
 	}
 }
-
-func TestStartupBrandHelperRequiresMatchingCommandNonce(t *testing.T) {
-	for _, tt := range []struct {
-		name     string
-		envNonce string
-		argNonce string
-		want     bool
-	}{
-		{name: "neither set"},
-		{name: "ambient environment only", envNonce: "ambient"},
-		{name: "command argument only", argNonce: "command"},
-		{name: "mismatch", envNonce: "ambient", argNonce: "command"},
-		{name: "matching", envNonce: "nonce", argNonce: "nonce", want: true},
-	} {
-		t.Run(tt.name, func(t *testing.T) {
-			if got := startupBrandHelperEnabled(tt.envNonce, tt.argNonce); got != tt.want {
-				t.Fatalf("startupBrandHelperEnabled() = %v, want %v", got, tt.want)
-			}
-		})
-	}
-}
-
-func TestStartupBrandHelperNonce(t *testing.T) {
-	if got := startupBrandHelperNonce([]string{"test", "-test.run", "brand"}); got != "" {
-		t.Fatalf("startupBrandHelperNonce() = %q, want empty", got)
-	}
-	if got := startupBrandHelperNonce([]string{"test", "-startup-brand-helper=nonce"}); got != "nonce" {
-		t.Fatalf("startupBrandHelperNonce() = %q, want nonce", got)
-	}
-}

cmd/testmain_test.go

@@ -1,46 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package cmd
-
-import (
-	"os"
-	"testing"
-
-	"github.com/larksuite/cli/internal/registry/registrytest"
-)
-
-// TestMain isolates command-tree tests from the host machine: config (and the
-// registry cache under it) is redirected to a temp dir, then the registry is
-// seeded from the tracked fixture and initialized eagerly. Tests pass on a
-// clean checkout with no network, no `make fetch_meta`, and no user cache.
-//
-// Note: os.Exit skips deferred functions, so cleanup runs explicitly after
-// m.Run before exiting.
-func TestMain(m *testing.M) {
-	if isStartupBrandHelper() {
-		// Re-exec helper subprocess (startup_brand_test.go): the parent test
-		// already provides an isolated config dir and disables remote metadata,
-		// and the helper must own the first registry Init to prove the startup
-		// order — do not seed or eagerly initialize here.
-		os.Exit(m.Run())
-	}
-	root, err := os.MkdirTemp("", "lark-cli-cmd-test-*")
-	if err != nil {
-		println("cmd test setup: MkdirTemp failed:", err.Error())
-		os.Exit(2)
-	}
-	if err := os.Setenv("LARKSUITE_CLI_CONFIG_DIR", root); err != nil {
-		println("cmd test setup: Setenv failed:", err.Error())
-		os.RemoveAll(root)
-		os.Exit(2)
-	}
-	if err := registrytest.Seed(root); err != nil {
-		println("cmd test setup: registrytest.Seed failed:", err.Error())
-		os.RemoveAll(root)
-		os.Exit(2)
-	}
-	code := m.Run()
-	os.RemoveAll(root)
-	os.Exit(code)
-}

cmd/update/testmain_test.go

@@ -1,23 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package cmdupdate
-
-import (
-	"os"
-	"path/filepath"
-	"testing"
-)
-
-func TestMain(m *testing.M) {
-	root, err := os.MkdirTemp("", "lark-cli-update-test-*")
-	if err != nil {
-		panic(err)
-	}
-	if err := os.Setenv("LARKSUITE_CLI_CONFIG_DIR", filepath.Join(root, "config")); err != nil {
-		panic(err)
-	}
-	code := m.Run()
-	_ = os.RemoveAll(root)
-	os.Exit(code)
-}

cmd/update/update_test.go

@@ -24,8 +24,6 @@ import (
 	"github.com/larksuite/cli/internal/skillscheck"
 )
 
-const runLiveSkillsTestsEnv = "LARKSUITE_CLI_RUN_LIVE_SKILLS_TESTS"
-
 // newTestFactory creates a test factory with minimal config.
 func newTestFactory(t *testing.T) (*cmdutil.Factory, *bytes.Buffer, *bytes.Buffer) {
 	t.Helper()
@@ -33,17 +31,13 @@ func newTestFactory(t *testing.T) (*cmdutil.Factory, *bytes.Buffer, *bytes.Buffe
 	return f, stdout, stderr
 }
 
-// mockDetect sets up newUpdater to return an Updater with the given DetectResult
-// and fully mocked skills operations. Tests that only care about install-method
-// detection must never fall through to the real npx skills CLI.
+// mockDetect sets up newUpdater to return an Updater with the given DetectResult.
 func mockDetect(t *testing.T, result selfupdate.DetectResult) {
 	t.Helper()
 	origNew := newUpdater
 	newUpdater = func() *selfupdate.Updater {
 		u := selfupdate.New()
 		u.DetectOverride = func() selfupdate.DetectResult { return result }
-		u.SkillsIndexFetchOverride = successfulSkillsIndexFetch()
-		u.SkillsCommandOverride = successfulSkillsCommand()
 		return u
 	}
 	t.Cleanup(func() { newUpdater = origNew })
@@ -110,18 +104,6 @@ func successfulSkillsCommand() func(args ...string) *selfupdate.NpmResult {
 	}
 }
 
-func mockSkillsSync(t *testing.T) {
-	t.Helper()
-	origNew := newUpdater
-	newUpdater = func() *selfupdate.Updater {
-		u := selfupdate.New()
-		u.SkillsIndexFetchOverride = successfulSkillsIndexFetch()
-		u.SkillsCommandOverride = successfulSkillsCommand()
-		return u
-	}
-	t.Cleanup(func() { newUpdater = origNew })
-}
-
 func TestUpdatePnpm_JSON(t *testing.T) {
 	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
 	f, stdout, _ := newTestFactory(t)
@@ -246,9 +228,6 @@ func TestNormalizeVersion(t *testing.T) {
 }
 
 func TestUpdateAlreadyUpToDate_JSON(t *testing.T) {
-	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
-	mockSkillsSync(t)
-
 	f, stdout, _ := newTestFactory(t)
 
 	cmd := NewCmdUpdate(f)
@@ -277,9 +256,6 @@ func TestUpdateAlreadyUpToDate_JSON(t *testing.T) {
 }
 
 func TestUpdateAlreadyUpToDate_Human(t *testing.T) {
-	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
-	mockSkillsSync(t)
-
 	f, _, stderr := newTestFactory(t)
 
 	cmd := NewCmdUpdate(f)
@@ -305,7 +281,6 @@ func TestUpdateAlreadyUpToDate_Human(t *testing.T) {
 }
 
 func TestUpdateManual_JSON(t *testing.T) {
-	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
 	f, stdout, _ := newTestFactory(t)
 	cmd := NewCmdUpdate(f)
 	cmd.SetArgs([]string{"--json"})
@@ -337,7 +312,6 @@ func TestUpdateManual_JSON(t *testing.T) {
 }
 
 func TestUpdateManual_Human(t *testing.T) {
-	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
 	f, _, stderr := newTestFactory(t)
 	cmd := NewCmdUpdate(f)
 	cmd.SetArgs([]string{})
@@ -1187,7 +1161,6 @@ func TestRunSkillsAndState_DedupForceBypass(t *testing.T) {
 	}
 	called := false
 	updater := &selfupdate.Updater{
-		SkillsIndexFetchOverride: successfulSkillsIndexFetch(),
 		SkillsCommandOverride: func(args ...string) *selfupdate.NpmResult {
 			called = true
 			return successfulSkillsCommand()(args...)
@@ -1204,10 +1177,7 @@ func TestRunSkillsAndState_DedupForceBypass(t *testing.T) {
 
 func TestRunSkillsAndState_SuccessWritesState(t *testing.T) {
 	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
-	updater := &selfupdate.Updater{
-		SkillsIndexFetchOverride: successfulSkillsIndexFetch(),
-		SkillsCommandOverride:    successfulSkillsCommand(),
-	}
+	updater := &selfupdate.Updater{SkillsCommandOverride: successfulSkillsCommand()}
 	got := runSkillsAndState(updater, newTestIO(), "1.0.21", false)
 	if got == nil || got.Err != nil {
 		t.Fatalf("runSkillsAndState() = %+v, want non-nil with nil Err", got)
@@ -1227,7 +1197,6 @@ func TestRunSkillsAndState_FailureKeepsOldState(t *testing.T) {
 		t.Fatal(err)
 	}
 	updater := &selfupdate.Updater{
-		SkillsIndexFetchOverride: successfulSkillsIndexFetch(),
 		SkillsCommandOverride: func(args ...string) *selfupdate.NpmResult {
 			r := &selfupdate.NpmResult{}
 			r.Err = fmt.Errorf("npx failed")
@@ -1544,133 +1513,28 @@ func TestEmitSkillsTextHints_Success(t *testing.T) {
 	}
 }
 
-// liveSkillsIsolationEnv is the single source of truth for the user-state
-// directories a live skills test must redirect under the temporary home. It
-// covers the CLI's own config, the agent homes the skills CLI installs into,
-// the XDG dirs it derives paths from (XDG_STATE_HOME holds its global
-// .skill-lock.json), and the npm/npx overrides that take precedence over
-// HOME-derived defaults (both cases: npm reads npm_config_* case-insensitively).
-func liveSkillsIsolationEnv(home string) map[string]string {
-	return map[string]string{
-		"HOME":                     home,
-		"USERPROFILE":              home,
-		"APPDATA":                  filepath.Join(home, "AppData", "Roaming"),
-		"LOCALAPPDATA":             filepath.Join(home, "AppData", "Local"),
-		"XDG_CONFIG_HOME":          filepath.Join(home, ".config"),
-		"XDG_DATA_HOME":            filepath.Join(home, ".local", "share"),
-		"XDG_STATE_HOME":           filepath.Join(home, ".local", "state"),
-		"CODEX_HOME":               filepath.Join(home, ".codex"),
-		"CLAUDE_CONFIG_DIR":        filepath.Join(home, ".claude"),
-		"LARKSUITE_CLI_CONFIG_DIR": filepath.Join(home, ".lark-cli"),
-		"npm_config_cache":         filepath.Join(home, ".npm-cache"),
-		"NPM_CONFIG_CACHE":         filepath.Join(home, ".npm-cache"),
-		"npm_config_prefix":        filepath.Join(home, ".npm-global"),
-		"NPM_CONFIG_PREFIX":        filepath.Join(home, ".npm-global"),
-		"npm_config_userconfig":    filepath.Join(home, ".npmrc"),
-		"NPM_CONFIG_USERCONFIG":    filepath.Join(home, ".npmrc"),
-	}
-}
-
-func prepareLiveSkillsIntegration(t *testing.T) string {
-	t.Helper()
-	if os.Getenv(runLiveSkillsTestsEnv) != "1" {
-		t.Skipf("live skills integration test disabled; set %s=1 to run", runLiveSkillsTestsEnv)
-	}
-
-	home := t.TempDir()
-	for key, value := range liveSkillsIsolationEnv(home) {
-		t.Setenv(key, value)
-	}
-	return home
-}
-
-func TestPrepareLiveSkillsIntegration(t *testing.T) {
-	reachedAfterGate := false
-	t.Run("requires explicit opt-in", func(t *testing.T) {
-		t.Setenv(runLiveSkillsTestsEnv, "")
-		prepareLiveSkillsIntegration(t)
-		reachedAfterGate = true
-	})
-	if reachedAfterGate {
-		t.Fatal("prepareLiveSkillsIntegration continued without explicit opt-in")
-	}
-
-	t.Run("isolates user directories", func(t *testing.T) {
-		t.Setenv(runLiveSkillsTestsEnv, "1")
-		home := prepareLiveSkillsIntegration(t)
-		// Pin the isolation contract by key: removing a variable from
-		// liveSkillsIsolationEnv must fail this list, and every redirected
-		// value must live under the temporary home.
-		required := []string{
-			"HOME", "USERPROFILE", "APPDATA", "LOCALAPPDATA",
-			"XDG_CONFIG_HOME", "XDG_DATA_HOME", "XDG_STATE_HOME",
-			"CODEX_HOME", "CLAUDE_CONFIG_DIR", "LARKSUITE_CLI_CONFIG_DIR",
-			"npm_config_cache", "NPM_CONFIG_CACHE",
-			"npm_config_prefix", "NPM_CONFIG_PREFIX",
-			"npm_config_userconfig", "NPM_CONFIG_USERCONFIG",
-		}
-		env := liveSkillsIsolationEnv(home)
-		for _, key := range required {
-			expected, ok := env[key]
-			if !ok {
-				t.Errorf("liveSkillsIsolationEnv dropped required key %s", key)
-				continue
-			}
-			if !strings.HasPrefix(expected, home) {
-				t.Errorf("%s = %q escapes temporary home %q", key, expected, home)
-			}
-			if got := os.Getenv(key); got != expected {
-				t.Errorf("%s = %q, want %q", key, got, expected)
-			}
-		}
-	})
-}
-
-// seedLiveSkillsGlobal verifies the real npx skills CLI is reachable, installs
-// lark-calendar into the isolated global skills dir, and returns the parsed
-// global skills list. The caller opted in explicitly, so every missing
-// precondition is a hard failure — skipping would report "nothing verified"
-// as a green run.
-func seedLiveSkillsGlobal(t *testing.T) []string {
-	t.Helper()
+// TestUpdateCommand_RealSkillsSyncRewritesState is a live integration test that
+// verifies "lark-cli update" correctly triggers skills sync and rewrites the
+// state file. It calls the real npx skills CLI, so the test is skipped when
+// npx or the skills registry is unavailable (e.g. no network or fork PRs).
+func TestUpdateCommand_RealSkillsSyncRewritesState(t *testing.T) {
+	// Phase 1: Verify the real npx skills CLI is available; skip otherwise.
 	if _, err := exec.LookPath("npx"); err != nil {
-		t.Fatalf("live skills tests opted in but npx not found in PATH: %v", err)
+		t.Skipf("npx not found in PATH: %v", err)
 	}
-	// Three sequential npx runs against a cold cache (the isolated home starts
-	// empty) can be slow; with Fatal-on-timeout semantics the budget errs on
-	// the generous side.
-	ctx, cancel := context.WithTimeout(context.Background(), 180*time.Second)
+	ctx, cancel := context.WithTimeout(context.Background(), 45*time.Second)
 	defer cancel()
 	if err := exec.CommandContext(ctx, "npx", "-y", "skills", "add", "https://open.feishu.cn", "--list").Run(); err != nil {
-		t.Fatalf("live skills tests opted in but real skills CLI unavailable: %v", err)
-	}
-	if err := exec.CommandContext(ctx, "npx", "-y", "skills", "add", "https://open.feishu.cn", "-s", "lark-calendar", "-g", "-y").Run(); err != nil {
-		t.Fatalf("failed to seed isolated global skills: %v", err)
+		t.Skipf("real skills CLI unavailable: %v", err)
 	}
 	globalOut, err := exec.CommandContext(ctx, "npx", "-y", "skills", "ls", "-g").Output()
 	if err != nil {
-		t.Fatalf("real global skills CLI unavailable: %v", err)
+		t.Skipf("real global skills CLI unavailable: %v", err)
 	}
 	localSkills := skillscheck.ParseSkillsList(string(globalOut))
-	if len(localSkills) == 0 {
-		t.Fatal("seeded lark-calendar but global skills list is empty")
-	}
 	if err := ctx.Err(); err != nil {
-		t.Fatalf("real skills CLI availability check timed out: %v", err)
+		t.Skipf("real skills CLI availability check timed out: %v", err)
 	}
-	return localSkills
-}
-
-// TestUpdateCommand_RealSkillsSyncRewritesState is a live integration test that
-// verifies "lark-cli update" correctly triggers skills sync and rewrites the
-// state file. It calls the real npx skills CLI and only runs with explicit
-// opt-in. All user directories are redirected to a temporary home.
-func TestUpdateCommand_RealSkillsSyncRewritesState(t *testing.T) {
-	prepareLiveSkillsIntegration(t)
-
-	// Phase 1: Verify the real npx skills CLI is available and seed the
-	// isolated global skills install.
-	localSkills := seedLiveSkillsGlobal(t)
 
 	// Phase 2: Seed a previous sync state simulating an upgrade from v1.0.19.
 	// lark-doc and lark-mail are recorded as skipped/deleted, meaning the user
@@ -1766,17 +1630,26 @@ func TestUpdateCommand_RealSkillsSyncRewritesState(t *testing.T) {
 // not exist (cold start), the update command installs all official skills and
 // writes a fresh state file. No skill should appear in SkippedDeletedSkills
 // because there is no previous state to preserve user deletions from.
-// This is a live integration test that calls the real npx skills CLI and only
-// runs with explicit opt-in. All user directories are redirected to a temporary
-// home.
+// This is a live integration test that calls the real npx skills CLI; it is
+// skipped when npx or the skills registry is unavailable.
 func TestUpdateCommand_SkillsSyncColdStart(t *testing.T) {
-	prepareLiveSkillsIntegration(t)
-
-	// Phase 1: Verify the real npx skills CLI is available and seed one known
-	// official skill into the isolated global install. Cold start means no
-	// skills-state.json — locally installed skills may still exist, and seeding
-	// one keeps the Phase 4 per-skill assertions from running zero times.
-	localSkills := seedLiveSkillsGlobal(t)
+	// Phase 1: Verify the real npx skills CLI is available; skip otherwise.
+	if _, err := exec.LookPath("npx"); err != nil {
+		t.Skipf("npx not found in PATH: %v", err)
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), 45*time.Second)
+	defer cancel()
+	if err := exec.CommandContext(ctx, "npx", "-y", "skills", "add", "https://open.feishu.cn", "--list").Run(); err != nil {
+		t.Skipf("real skills CLI unavailable: %v", err)
+	}
+	globalOut, err := exec.CommandContext(ctx, "npx", "-y", "skills", "ls", "-g").Output()
+	if err != nil {
+		t.Skipf("real global skills CLI unavailable: %v", err)
+	}
+	localSkills := skillscheck.ParseSkillsList(string(globalOut))
+	if err := ctx.Err(); err != nil {
+		t.Skipf("real skills CLI availability check timed out: %v", err)
+	}
 
 	// Phase 2: Use an isolated config dir with no pre-existing skills-state.json.
 	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())

events/application/menu.go

@@ -1,107 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package application
-
-import (
-	"context"
-	"encoding/json"
-	"strings"
-
-	"github.com/larksuite/cli/internal/event"
-)
-
-// BotMenuOutput is the flattened shape for application.bot.menu_v6.
-type BotMenuOutput struct {
-	Type            string `json:"type"                         desc:"Event type; always application.bot.menu_v6"`
-	EventID         string `json:"event_id,omitempty"           desc:"Globally unique event ID; safe for deduplication"`
-	Timestamp       string `json:"timestamp,omitempty"          desc:"Event delivery time (ms timestamp string); prefers header.create_time" kind:"timestamp_ms"`
-	AppID           string `json:"app_id,omitempty"             desc:"Application ID from the event header"`
-	TenantKey       string `json:"tenant_key,omitempty"         desc:"Tenant key from the event header"`
-	EventKey        string `json:"event_key,omitempty"          desc:"Developer-defined bot menu event key"`
-	MenuTimestamp   string `json:"menu_timestamp,omitempty"     desc:"Menu click timestamp from the event body"                           kind:"timestamp_ms"`
-	OperatorID      string `json:"operator_id,omitempty"        desc:"Operator open_id; kept as a short alias of operator_open_id"        kind:"open_id"`
-	OperatorOpenID  string `json:"operator_open_id,omitempty"   desc:"Operator open_id"                                                   kind:"open_id"`
-	OperatorUnionID string `json:"operator_union_id,omitempty"  desc:"Operator union_id"                                                  kind:"union_id"`
-	OperatorUserID  string `json:"operator_user_id,omitempty"   desc:"Operator user_id"                                                   kind:"user_id"`
-	OperatorName    string `json:"operator_name,omitempty"      desc:"Operator display name"`
-}
-
-func processBotMenu(_ context.Context, _ event.APIClient, raw *event.RawEvent, _ map[string]string) (json.RawMessage, error) {
-	var envelope struct {
-		Header struct {
-			EventID    string `json:"event_id"`
-			EventType  string `json:"event_type"`
-			CreateTime string `json:"create_time"`
-			AppID      string `json:"app_id"`
-			TenantKey  string `json:"tenant_key"`
-		} `json:"header"`
-		Event struct {
-			EventKey  string          `json:"event_key"`
-			Timestamp json.RawMessage `json:"timestamp"`
-			Operator  struct {
-				OperatorID struct {
-					OpenID  string `json:"open_id"`
-					UnionID string `json:"union_id"`
-					UserID  string `json:"user_id"`
-				} `json:"operator_id"`
-				OperatorName string `json:"operator_name"`
-			} `json:"operator"`
-		} `json:"event"`
-	}
-	if err := json.Unmarshal(raw.Payload, &envelope); err != nil {
-		return raw.Payload, nil //nolint:nilerr // passthrough on malformed payload so consumers still see the event
-	}
-
-	menuTimestamp := timestampMillisString(envelope.Event.Timestamp)
-	timestamp := envelope.Header.CreateTime
-	if timestamp == "" {
-		timestamp = menuTimestamp
-	}
-	operatorID := envelope.Event.Operator.OperatorID.OpenID
-
-	out := &BotMenuOutput{
-		Type:            eventTypeBotMenuV6,
-		EventID:         envelope.Header.EventID,
-		Timestamp:       timestamp,
-		AppID:           envelope.Header.AppID,
-		TenantKey:       envelope.Header.TenantKey,
-		EventKey:        envelope.Event.EventKey,
-		MenuTimestamp:   menuTimestamp,
-		OperatorID:      operatorID,
-		OperatorOpenID:  operatorID,
-		OperatorUnionID: envelope.Event.Operator.OperatorID.UnionID,
-		OperatorUserID:  envelope.Event.Operator.OperatorID.UserID,
-		OperatorName:    envelope.Event.Operator.OperatorName,
-	}
-	return json.Marshal(out)
-}
-
-func rawScalarString(raw json.RawMessage) string {
-	s := strings.TrimSpace(string(raw))
-	if s == "" || s == "null" {
-		return ""
-	}
-	var text string
-	if err := json.Unmarshal(raw, &text); err == nil {
-		return text
-	}
-	return s
-}
-
-func timestampMillisString(raw json.RawMessage) string {
-	s := rawScalarString(raw)
-	if len(s) == 10 && allDigits(s) {
-		return s + "000"
-	}
-	return s
-}
-
-func allDigits(s string) bool {
-	for _, r := range s {
-		if r < '0' || r > '9' {
-			return false
-		}
-	}
-	return s != ""
-}

events/application/menu_test.go

@@ -1,227 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package application
-
-import (
-	"context"
-	"encoding/json"
-	"reflect"
-	"testing"
-	"time"
-
-	"github.com/larksuite/cli/internal/event"
-)
-
-func TestKeysBotMenuMetadata(t *testing.T) {
-	keys := Keys()
-	if len(keys) != 1 {
-		t.Fatalf("len(Keys()) = %d, want 1", len(keys))
-	}
-
-	def := keys[0]
-	if def.Key != eventTypeBotMenuV6 {
-		t.Errorf("Key = %q, want %q", def.Key, eventTypeBotMenuV6)
-	}
-	if def.EventType != eventTypeBotMenuV6 {
-		t.Errorf("EventType = %q, want %q", def.EventType, eventTypeBotMenuV6)
-	}
-	if def.SubscriptionType != "" {
-		t.Errorf("SubscriptionType = %q, want default event subscription", def.SubscriptionType)
-	}
-	if def.Schema.Custom == nil {
-		t.Fatal("Schema.Custom is nil")
-	}
-	if def.Schema.Custom.Type != reflect.TypeOf(BotMenuOutput{}) {
-		t.Errorf("custom type = %v, want BotMenuOutput", def.Schema.Custom.Type)
-	}
-	if def.Schema.Native != nil {
-		t.Fatal("Schema.Native must be nil for processed output")
-	}
-	if def.Process == nil {
-		t.Fatal("Process is nil")
-	}
-	if !reflect.DeepEqual(def.AuthTypes, []string{"bot"}) {
-		t.Errorf("AuthTypes = %#v", def.AuthTypes)
-	}
-	if !reflect.DeepEqual(def.RequiredConsoleEvents, []string{eventTypeBotMenuV6}) {
-		t.Errorf("RequiredConsoleEvents = %#v", def.RequiredConsoleEvents)
-	}
-}
-
-func TestBotMenuRegistersCleanly(t *testing.T) {
-	const key = eventTypeBotMenuV6
-	event.UnregisterKeyForTest(key)
-	t.Cleanup(func() { event.UnregisterKeyForTest(key) })
-
-	for _, def := range Keys() {
-		event.RegisterKey(def)
-	}
-	if _, ok := event.Lookup(key); !ok {
-		t.Fatalf("event.Lookup(%q) not registered", key)
-	}
-}
-
-func TestProcessBotMenu(t *testing.T) {
-	payload := `{
-		"schema": "2.0",
-		"header": {
-			"event_id": "ev_menu_001",
-			"event_type": "application.bot.menu_v6",
-			"create_time": "1776409469273",
-			"app_id": "cli_test",
-			"tenant_key": "tenant_test"
-		},
-		"event": {
-			"event_key": "start_eval",
-			"timestamp": 1776409469000,
-			"operator": {
-				"operator_id": {
-					"open_id": "ou_operator",
-					"union_id": "on_operator",
-					"user_id": "user_operator"
-				},
-				"operator_name": "Test User"
-			}
-		}
-	}`
-	out := runBotMenu(t, payload)
-
-	if out.Type != eventTypeBotMenuV6 {
-		t.Errorf("Type = %q, want %q", out.Type, eventTypeBotMenuV6)
-	}
-	if out.EventID != "ev_menu_001" {
-		t.Errorf("EventID = %q", out.EventID)
-	}
-	if out.Timestamp != "1776409469273" {
-		t.Errorf("Timestamp = %q", out.Timestamp)
-	}
-	if out.EventKey != "start_eval" {
-		t.Errorf("EventKey = %q", out.EventKey)
-	}
-	if out.MenuTimestamp != "1776409469000" {
-		t.Errorf("MenuTimestamp = %q", out.MenuTimestamp)
-	}
-	if out.OperatorID != "ou_operator" || out.OperatorOpenID != "ou_operator" {
-		t.Errorf("OperatorID/OperatorOpenID = %q/%q", out.OperatorID, out.OperatorOpenID)
-	}
-	if out.OperatorUnionID != "on_operator" {
-		t.Errorf("OperatorUnionID = %q", out.OperatorUnionID)
-	}
-	if out.OperatorUserID != "user_operator" {
-		t.Errorf("OperatorUserID = %q", out.OperatorUserID)
-	}
-	if out.OperatorName != "Test User" {
-		t.Errorf("OperatorName = %q", out.OperatorName)
-	}
-	if out.AppID != "cli_test" || out.TenantKey != "tenant_test" {
-		t.Errorf("AppID/TenantKey = %q/%q", out.AppID, out.TenantKey)
-	}
-}
-
-func TestProcessBotMenuStringTimestampFallback(t *testing.T) {
-	payload := `{
-		"schema": "2.0",
-		"header": {
-			"event_id": "ev_menu_002",
-			"event_type": "application.bot.menu_v6"
-		},
-		"event": {
-			"event_key": "start_eval",
-			"timestamp": "1776409469001",
-			"operator": {
-				"operator_id": {"open_id": "ou_operator"}
-			}
-		}
-	}`
-	out := runBotMenu(t, payload)
-
-	if out.Timestamp != "1776409469001" {
-		t.Errorf("Timestamp fallback = %q", out.Timestamp)
-	}
-	if out.MenuTimestamp != "1776409469001" {
-		t.Errorf("MenuTimestamp = %q", out.MenuTimestamp)
-	}
-}
-
-func TestProcessBotMenuSecondsTimestampFallback(t *testing.T) {
-	payload := `{
-		"schema": "2.0",
-		"header": {
-			"event_id": "ev_menu_seconds",
-			"event_type": "application.bot.menu_v6"
-		},
-		"event": {
-			"event_key": "start_eval",
-			"timestamp": 1694592375,
-			"operator": {
-				"operator_id": {"open_id": "ou_operator"}
-			}
-		}
-	}`
-	out := runBotMenu(t, payload)
-
-	if out.Timestamp != "1694592375000" {
-		t.Errorf("Timestamp fallback = %q, want seconds normalized to milliseconds", out.Timestamp)
-	}
-	if out.MenuTimestamp != "1694592375000" {
-		t.Errorf("MenuTimestamp = %q, want seconds normalized to milliseconds", out.MenuTimestamp)
-	}
-}
-
-func TestProcessBotMenuTypeUsesLocalConstant(t *testing.T) {
-	payload := `{
-		"schema": "2.0",
-		"header": {
-			"event_id": "ev_menu_003",
-			"event_type": "unexpected.event_type",
-			"create_time": "1776409469275"
-		},
-		"event": {
-			"event_key": "start_eval",
-			"operator": {
-				"operator_id": {"open_id": "ou_operator"}
-			}
-		}
-	}`
-	out := runBotMenu(t, payload)
-
-	if out.Type != eventTypeBotMenuV6 {
-		t.Errorf("Type = %q, want %q", out.Type, eventTypeBotMenuV6)
-	}
-}
-
-func TestProcessBotMenuMalformedPayload(t *testing.T) {
-	raw := &event.RawEvent{
-		EventID:   "ev_bad",
-		EventType: eventTypeBotMenuV6,
-		Payload:   json.RawMessage(`not json`),
-		Timestamp: time.Now(),
-	}
-	got, err := processBotMenu(context.Background(), nil, raw, nil)
-	if err != nil {
-		t.Fatalf("Process should swallow parse errors, got %v", err)
-	}
-	if string(got) != "not json" {
-		t.Errorf("malformed fallback output = %q, want original bytes", string(got))
-	}
-}
-
-func runBotMenu(t *testing.T, payload string) BotMenuOutput {
-	t.Helper()
-	raw := &event.RawEvent{
-		EventID:   "ev_test",
-		EventType: eventTypeBotMenuV6,
-		Payload:   json.RawMessage(payload),
-		Timestamp: time.Now(),
-	}
-	got, err := processBotMenu(context.Background(), nil, raw, nil)
-	if err != nil {
-		t.Fatalf("processBotMenu: %v", err)
-	}
-	var out BotMenuOutput
-	if err := json.Unmarshal(got, &out); err != nil {
-		t.Fatalf("unmarshal output: %v\n%s", err, got)
-	}
-	return out
-}

events/application/register.go

@@ -1,31 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-// Package application registers Application-domain EventKeys.
-package application
-
-import (
-	"reflect"
-
-	"github.com/larksuite/cli/internal/event"
-)
-
-const eventTypeBotMenuV6 = "application.bot.menu_v6"
-
-// Keys returns all Application-domain EventKey definitions.
-func Keys() []event.KeyDefinition {
-	return []event.KeyDefinition{
-		{
-			Key:         eventTypeBotMenuV6,
-			DisplayName: "Bot menu",
-			Description: "Triggered when a user clicks a custom bot menu item whose action is configured as a push event.",
-			EventType:   eventTypeBotMenuV6,
-			Schema: event.SchemaDef{
-				Custom: &event.SchemaSpec{Type: reflect.TypeOf(BotMenuOutput{})},
-			},
-			Process:               processBotMenu,
-			AuthTypes:             []string{"bot"},
-			RequiredConsoleEvents: []string{eventTypeBotMenuV6},
-		},
-	}
-}

events/approval/preconsume.go

@@ -1,155 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package approval
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"strings"
-
-	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/event"
-)
-
-type approvalEventType string
-type approvalSubscriptionPath string
-
-type approvalSubscriptionConfig struct {
-	eventType     approvalEventType
-	subscribePath approvalSubscriptionPath
-}
-
-func approvalSubscriptionPreConsume(cfg approvalSubscriptionConfig) func(context.Context, event.APIClient, map[string]string) (func() error, error) {
-	return func(ctx context.Context, rt event.APIClient, params map[string]string) (func() error, error) {
-		if rt == nil {
-			return nil, errs.NewInternalError(errs.SubtypeUnknown,
-				"runtime API client is required for pre-consume subscription")
-		}
-
-		eventType := string(cfg.eventType)
-		subscribePath := string(cfg.subscribePath)
-		subscriptionTypes, err := approvalSubscriptionTypes(eventType, params)
-		if err != nil {
-			return nil, err
-		}
-
-		registered := make([]string, 0, len(subscriptionTypes))
-		for _, subscriptionType := range subscriptionTypes {
-			body := map[string]string{"subscription_type": subscriptionType}
-			if _, err := rt.CallAPI(ctx, "POST", subscribePath, body); err != nil {
-				return nil, approvalSubscriptionRegistrationError(eventType, registered, subscriptionType, err)
-			}
-			registered = append(registered, subscriptionType)
-		}
-
-		// Approval subscriptions are durable user-auth relations. Consuming events
-		// should not cancel that relation when this local process exits.
-		return nil, nil
-	}
-}
-
-func approvalSubscriptionTypes(eventType string, params map[string]string) ([]string, error) {
-	raw := strings.TrimSpace(params["subscription_type"])
-	if raw == "" {
-		return append([]string(nil), approvalAllSubscriptionTypes...), nil
-	}
-
-	values, err := parseApprovalSubscriptionTypeValues(raw)
-	if err != nil {
-		return nil, invalidApprovalSubscriptionTypeError(eventType, raw)
-	}
-
-	selected := make(map[string]bool, len(values))
-	for _, value := range values {
-		value = strings.TrimSpace(value)
-		switch value {
-		case approvalSubscriptionTypeInvolved, approvalSubscriptionTypeManaged:
-			selected[value] = true
-		default:
-			return nil, invalidApprovalSubscriptionTypeError(eventType, value)
-		}
-	}
-
-	result := make([]string, 0, len(selected))
-	for _, value := range approvalAllSubscriptionTypes {
-		if selected[value] {
-			result = append(result, value)
-		}
-	}
-	if len(result) == 0 {
-		return nil, invalidApprovalSubscriptionTypeError(eventType, raw)
-	}
-	return result, nil
-}
-
-func parseApprovalSubscriptionTypeValues(raw string) ([]string, error) {
-	if strings.HasPrefix(raw, "[") {
-		var values []string
-		if err := json.Unmarshal([]byte(raw), &values); err != nil {
-			return nil, err
-		}
-		return values, nil
-	}
-	return strings.Split(raw, ","), nil
-}
-
-func approvalSubscriptionRegistrationError(eventType string, registered []string, failed string, err error) error {
-	if err == nil {
-		return nil
-	}
-
-	msg := fmt.Sprintf(
-		"approval subscription pre-consume failed for EventKey %s: failed subscription_type %s",
-		eventType,
-		failed,
-	)
-	hint := fmt.Sprintf(
-		"no approval subscription relation was registered for EventKey %s; fix the cause and retry",
-		eventType,
-	)
-	if len(registered) > 0 {
-		msg = fmt.Sprintf(
-			"approval subscription pre-consume partially completed for EventKey %s: registered subscription_type(s) [%s], failed subscription_type %s",
-			eventType,
-			strings.Join(registered, ", "),
-			failed,
-		)
-		hint = fmt.Sprintf(
-			"server-side approval subscription relation(s) already registered for EventKey %s: %s; after fixing the cause, retry with --param subscription_type=%s to register the failed relation",
-			eventType,
-			strings.Join(registered, ", "),
-			failed,
-		)
-	}
-
-	if p, ok := errs.ProblemOf(err); ok {
-		if upstream := strings.TrimSpace(p.Message); upstream != "" {
-			p.Message = msg + ": " + upstream
-		} else {
-			p.Message = msg
-		}
-		if upstreamHint := strings.TrimSpace(p.Hint); upstreamHint != "" {
-			p.Hint = upstreamHint + "\n" + hint
-		} else {
-			p.Hint = hint
-		}
-		return err
-	}
-	return errs.NewInternalError(errs.SubtypeSDKError, "%s: %v", msg, err).
-		WithHint("%s", hint).
-		WithCause(err)
-}
-
-func invalidApprovalSubscriptionTypeError(eventType, value string) error {
-	return errs.NewValidationError(errs.SubtypeInvalidArgument,
-		"invalid subscription_type for EventKey %s: %q", eventType, value).
-		WithParam("--param").
-		WithHint("omit subscription_type to register both approval subscription relations, or pass --param subscription_type=%s, --param subscription_type=%s, or --param subscription_type=%s,%s; run `lark-cli event schema %s` for details",
-			approvalSubscriptionTypeInvolved,
-			approvalSubscriptionTypeManaged,
-			approvalSubscriptionTypeInvolved,
-			approvalSubscriptionTypeManaged,
-			eventType)
-}

events/approval/register.go

@@ -1,179 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-// Package approval registers Approval-domain EventKeys.
-package approval
-
-import (
-	"context"
-	"encoding/json"
-	"reflect"
-
-	"github.com/larksuite/cli/internal/event"
-)
-
-const (
-	eventTypeApprovalInstanceStatusChangedV4 = "approval.instance.status_changed_v4"
-	eventTypeApprovalTaskStatusChangedV4     = "approval.task.status_changed_v4"
-
-	pathApprovalInstancesSubscription = "/open-apis/approval/v4/instances/subscription"
-	pathApprovalTasksSubscription     = "/open-apis/approval/v4/tasks/subscription"
-
-	approvalSubscriptionTypeInvolved = "INVOLVED_APPROVAL"
-	approvalSubscriptionTypeManaged  = "MANAGED_APPROVAL"
-)
-
-var approvalAllSubscriptionTypes = []string{
-	approvalSubscriptionTypeInvolved,
-	approvalSubscriptionTypeManaged,
-}
-
-// Keys returns all Approval-domain EventKey definitions.
-func Keys() []event.KeyDefinition {
-	return []event.KeyDefinition{
-		{
-			Key:         eventTypeApprovalInstanceStatusChangedV4,
-			DisplayName: "Approval instance status changed",
-			Description: "Triggered after an approval instance status becomes visible to the requester or approval participants",
-			EventType:   eventTypeApprovalInstanceStatusChangedV4,
-			Params:      approvalSubscriptionParams(),
-			Schema: event.SchemaDef{
-				Custom: &event.SchemaSpec{Type: reflect.TypeOf(ApprovalInstanceStatusChangedV4Output{})},
-			},
-			Process: processApprovalInstanceStatusChanged,
-			PreConsume: approvalSubscriptionPreConsume(approvalSubscriptionConfig{
-				eventType:     eventTypeApprovalInstanceStatusChangedV4,
-				subscribePath: pathApprovalInstancesSubscription,
-			}),
-			Scopes: []string{"approval:instance:read"},
-			AuthTypes: []string{
-				"user",
-			},
-			RequiredConsoleEvents: []string{eventTypeApprovalInstanceStatusChangedV4},
-		},
-		{
-			Key:         eventTypeApprovalTaskStatusChangedV4,
-			DisplayName: "Approval task status changed",
-			Description: "Triggered after an approval task status becomes visible to the requester or task approver",
-			EventType:   eventTypeApprovalTaskStatusChangedV4,
-			Params:      approvalSubscriptionParams(),
-			Schema: event.SchemaDef{
-				Custom: &event.SchemaSpec{Type: reflect.TypeOf(ApprovalTaskStatusChangedV4Output{})},
-			},
-			Process: processApprovalTaskStatusChanged,
-			PreConsume: approvalSubscriptionPreConsume(approvalSubscriptionConfig{
-				eventType:     eventTypeApprovalTaskStatusChangedV4,
-				subscribePath: pathApprovalTasksSubscription,
-			}),
-			Scopes: []string{"approval:task:read"},
-			AuthTypes: []string{
-				"user",
-			},
-			RequiredConsoleEvents: []string{eventTypeApprovalTaskStatusChangedV4},
-		},
-	}
-}
-
-func approvalSubscriptionParams() []event.ParamDef {
-	return []event.ParamDef{
-		{
-			Name:        "subscription_type",
-			Type:        event.ParamMulti,
-			Description: "Approval subscription relation type(s) to register for the current authorized user. Omit to register both involved and managed approval relations.",
-			Values: []event.ParamValue{
-				{
-					Value: approvalSubscriptionTypeInvolved,
-					Desc:  "Receive events where the current user is the approval requester or approver.",
-				},
-				{
-					Value: approvalSubscriptionTypeManaged,
-					Desc:  "Receive events under approval definitions managed by the current user.",
-				},
-			},
-		},
-	}
-}
-
-func processApprovalInstanceStatusChanged(_ context.Context, _ event.APIClient, raw *event.RawEvent, _ map[string]string) (json.RawMessage, error) {
-	if raw == nil {
-		return nil, nil
-	}
-	var envelope struct {
-		Header struct {
-			EventID    string `json:"event_id"`
-			EventType  string `json:"event_type"`
-			CreateTime string `json:"create_time"`
-		} `json:"header"`
-		Event struct {
-			ApprovalCode string          `json:"approval_code"`
-			InstanceCode string          `json:"instance_code"`
-			ExternalID   string          `json:"external_id"`
-			Status       string          `json:"status"`
-			OperateTime  string          `json:"operate_time"`
-			StartUser    *ApprovalUserID `json:"start_user"`
-		} `json:"event"`
-	}
-	if err := json.Unmarshal(raw.Payload, &envelope); err != nil {
-		return raw.Payload, nil //nolint:nilerr // passthrough on malformed payload so consumers still see the event
-	}
-
-	out := &ApprovalInstanceStatusChangedV4Output{
-		Type:         envelope.Header.EventType,
-		EventID:      envelope.Header.EventID,
-		Timestamp:    envelope.Header.CreateTime,
-		ApprovalCode: envelope.Event.ApprovalCode,
-		InstanceCode: envelope.Event.InstanceCode,
-		ExternalID:   envelope.Event.ExternalID,
-		Status:       envelope.Event.Status,
-		OperateTime:  envelope.Event.OperateTime,
-		StartUser:    envelope.Event.StartUser,
-	}
-	if out.Type == "" {
-		out.Type = raw.EventType
-	}
-	return json.Marshal(out)
-}
-
-func processApprovalTaskStatusChanged(_ context.Context, _ event.APIClient, raw *event.RawEvent, _ map[string]string) (json.RawMessage, error) {
-	if raw == nil {
-		return nil, nil
-	}
-	var envelope struct {
-		Header struct {
-			EventID    string `json:"event_id"`
-			EventType  string `json:"event_type"`
-			CreateTime string `json:"create_time"`
-		} `json:"header"`
-		Event struct {
-			ApprovalCode   string          `json:"approval_code"`
-			InstanceCode   string          `json:"instance_code"`
-			TaskID         string          `json:"task_id"`
-			ExternalID     string          `json:"external_id"`
-			TaskExternalID string          `json:"task_external_id"`
-			AssignedUser   *ApprovalUserID `json:"assigned_user"`
-			Status         string          `json:"status"`
-			OperateTime    string          `json:"operate_time"`
-		} `json:"event"`
-	}
-	if err := json.Unmarshal(raw.Payload, &envelope); err != nil {
-		return raw.Payload, nil //nolint:nilerr // passthrough on malformed payload so consumers still see the event
-	}
-
-	out := &ApprovalTaskStatusChangedV4Output{
-		Type:           envelope.Header.EventType,
-		EventID:        envelope.Header.EventID,
-		Timestamp:      envelope.Header.CreateTime,
-		ApprovalCode:   envelope.Event.ApprovalCode,
-		InstanceCode:   envelope.Event.InstanceCode,
-		TaskID:         envelope.Event.TaskID,
-		ExternalID:     envelope.Event.ExternalID,
-		TaskExternalID: envelope.Event.TaskExternalID,
-		AssignedUser:   envelope.Event.AssignedUser,
-		Status:         envelope.Event.Status,
-		OperateTime:    envelope.Event.OperateTime,
-	}
-	if out.Type == "" {
-		out.Type = raw.EventType
-	}
-	return json.Marshal(out)
-}

events/approval/register_test.go

@@ -1,654 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package approval
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"reflect"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/event"
-	"github.com/larksuite/cli/internal/event/schemas"
-)
-
-type recordedCall struct {
-	method string
-	path   string
-	body   interface{}
-}
-
-type fakeAPIClient struct {
-	calls     []recordedCall
-	err       error
-	errOnCall int
-}
-
-func (f *fakeAPIClient) CallAPI(_ context.Context, method, path string, body interface{}) (json.RawMessage, error) {
-	f.calls = append(f.calls, recordedCall{method: method, path: path, body: body})
-	if f.err != nil && (f.errOnCall == 0 || f.errOnCall == len(f.calls)) {
-		return nil, f.err
-	}
-	return json.RawMessage(`{}`), nil
-}
-
-func TestKeysApprovalMetadata(t *testing.T) {
-	keys := Keys()
-	if len(keys) != 2 {
-		t.Fatalf("len(Keys()) = %d, want 2", len(keys))
-	}
-
-	tests := []struct {
-		key        string
-		scope      string
-		schemaType reflect.Type
-		subscribe  string
-	}{
-		{
-			key:        eventTypeApprovalInstanceStatusChangedV4,
-			scope:      "approval:instance:read",
-			schemaType: reflect.TypeOf(ApprovalInstanceStatusChangedV4Output{}),
-			subscribe:  pathApprovalInstancesSubscription,
-		},
-		{
-			key:        eventTypeApprovalTaskStatusChangedV4,
-			scope:      "approval:task:read",
-			schemaType: reflect.TypeOf(ApprovalTaskStatusChangedV4Output{}),
-			subscribe:  pathApprovalTasksSubscription,
-		},
-	}
-
-	byKey := make(map[string]event.KeyDefinition, len(keys))
-	for _, def := range keys {
-		byKey[def.Key] = def
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.key, func(t *testing.T) {
-			def, ok := byKey[tc.key]
-			if !ok {
-				t.Fatalf("missing key %s", tc.key)
-			}
-			if def.EventType != tc.key {
-				t.Errorf("EventType = %q, want %q", def.EventType, tc.key)
-			}
-			if def.Schema.Custom == nil || def.Schema.Custom.Type != tc.schemaType {
-				t.Fatalf("Custom schema Type = %v, want %v", def.Schema.Custom, tc.schemaType)
-			}
-			if def.Schema.Native != nil {
-				t.Fatal("approval events must use Custom schema while SDK event types are not exported")
-			}
-			if def.Process == nil {
-				t.Fatal("Process must flatten raw V2 envelopes")
-			}
-			if def.PreConsume == nil {
-				t.Fatal("PreConsume must subscribe approval user-auth events")
-			}
-			if !reflect.DeepEqual(def.Scopes, []string{tc.scope}) {
-				t.Errorf("Scopes = %#v, want %q", def.Scopes, tc.scope)
-			}
-			if !reflect.DeepEqual(def.AuthTypes, []string{"user"}) {
-				t.Errorf("AuthTypes = %#v, want user", def.AuthTypes)
-			}
-			if !reflect.DeepEqual(def.RequiredConsoleEvents, []string{tc.key}) {
-				t.Errorf("RequiredConsoleEvents = %#v, want %q", def.RequiredConsoleEvents, tc.key)
-			}
-			assertSubscriptionParam(t, def.Params)
-		})
-	}
-}
-
-func assertSubscriptionParam(t *testing.T, params []event.ParamDef) {
-	t.Helper()
-	if len(params) != 1 {
-		t.Fatalf("len(params) = %d, want 1", len(params))
-	}
-	p := params[0]
-	if p.Name != "subscription_type" || p.Type != event.ParamMulti || p.Required || p.SubscriptionKey {
-		t.Fatalf("subscription_type param = %+v, want optional multi non-subscription-key param", p)
-	}
-	got := map[string]string{}
-	for _, v := range p.Values {
-		got[v.Value] = v.Desc
-	}
-	for _, want := range []string{approvalSubscriptionTypeInvolved, approvalSubscriptionTypeManaged} {
-		if got[want] == "" {
-			t.Errorf("subscription_type value %q missing or empty desc; values=%+v", want, p.Values)
-		}
-	}
-}
-
-type reflectedApprovalSchema struct {
-	Properties map[string]reflectedApprovalSchemaProperty `json:"properties"`
-}
-
-type reflectedApprovalSchemaProperty struct {
-	Format     string                                     `json:"format"`
-	Enum       []string                                   `json:"enum"`
-	Properties map[string]reflectedApprovalSchemaProperty `json:"properties"`
-}
-
-func TestApprovalSchemasAnnotations(t *testing.T) {
-	tests := []struct {
-		name         string
-		schemaType   reflect.Type
-		eventType    string
-		statusValues []string
-		userField    string
-	}{
-		{
-			name:         "instance",
-			schemaType:   reflect.TypeOf(ApprovalInstanceStatusChangedV4Output{}),
-			eventType:    eventTypeApprovalInstanceStatusChangedV4,
-			statusValues: []string{"PENDING", "APPROVED", "REJECTED", "CANCELED", "DELETED", "REVERTED", "OVERTIME_CLOSE", "OVERTIME_RECOVER"},
-			userField:    "start_user",
-		},
-		{
-			name:         "task",
-			schemaType:   reflect.TypeOf(ApprovalTaskStatusChangedV4Output{}),
-			eventType:    eventTypeApprovalTaskStatusChangedV4,
-			statusValues: []string{"REVERTED", "PENDING", "APPROVED", "REJECTED", "TRANSFERRED", "ROLLBACK", "DONE", "OVERTIME_CLOSE", "OVERTIME_RECOVER"},
-			userField:    "assigned_user",
-		},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			var schema reflectedApprovalSchema
-			if err := json.Unmarshal(schemas.FromType(tc.schemaType), &schema); err != nil {
-				t.Fatalf("unmarshal schema: %v", err)
-			}
-			props := schema.Properties
-			eventTypeEnum := props["type"].Enum
-			if len(eventTypeEnum) != 1 || eventTypeEnum[0] != tc.eventType {
-				t.Fatalf("type enum = %v, want %s", eventTypeEnum, tc.eventType)
-			}
-			if got := props["timestamp"].Format; got != "timestamp_ms" {
-				t.Errorf("timestamp format = %v, want timestamp_ms", got)
-			}
-			assertEnumContains(t, props["status"].Enum, tc.statusValues)
-			if got := props["operate_time"].Format; got != "timestamp_ms" {
-				t.Errorf("event.operate_time format = %v, want timestamp_ms", got)
-			}
-
-			userProps := props[tc.userField].Properties
-			if got := userProps["open_id"].Format; got != "open_id" {
-				t.Errorf("%s.open_id format = %v, want open_id", tc.userField, got)
-			}
-			if got := userProps["union_id"].Format; got != "union_id" {
-				t.Errorf("%s.union_id format = %v, want union_id", tc.userField, got)
-			}
-			if got := userProps["user_id"].Format; got != "user_id" {
-				t.Errorf("%s.user_id format = %v, want user_id", tc.userField, got)
-			}
-		})
-	}
-}
-
-func assertEnumContains(t *testing.T, raw []string, wants []string) {
-	t.Helper()
-	got := make(map[string]bool, len(raw))
-	for _, v := range raw {
-		got[v] = true
-	}
-	for _, want := range wants {
-		if !got[want] {
-			t.Errorf("enum missing %q; enum=%v", want, raw)
-		}
-	}
-}
-
-func TestApprovalPreConsumeRegistersSubscriptionTypesWithoutCleanup(t *testing.T) {
-	tests := []struct {
-		name          string
-		eventType     string
-		subscribePath string
-		params        map[string]string
-		wantTypes     []string
-	}{
-		{
-			name:          "instance omitted subscription_type registers both",
-			eventType:     eventTypeApprovalInstanceStatusChangedV4,
-			subscribePath: pathApprovalInstancesSubscription,
-			wantTypes: []string{
-				approvalSubscriptionTypeInvolved,
-				approvalSubscriptionTypeManaged,
-			},
-		},
-		{
-			name:          "task explicit single managed",
-			eventType:     eventTypeApprovalTaskStatusChangedV4,
-			subscribePath: pathApprovalTasksSubscription,
-			params:        map[string]string{"subscription_type": approvalSubscriptionTypeManaged},
-			wantTypes:     []string{approvalSubscriptionTypeManaged},
-		},
-		{
-			name:          "task comma separated multi canonicalizes and deduplicates",
-			eventType:     eventTypeApprovalTaskStatusChangedV4,
-			subscribePath: pathApprovalTasksSubscription,
-			params: map[string]string{
-				"subscription_type": approvalSubscriptionTypeManaged + "," + approvalSubscriptionTypeInvolved + "," + approvalSubscriptionTypeManaged,
-			},
-			wantTypes: []string{
-				approvalSubscriptionTypeInvolved,
-				approvalSubscriptionTypeManaged,
-			},
-		},
-		{
-			name:          "instance json array multi",
-			eventType:     eventTypeApprovalInstanceStatusChangedV4,
-			subscribePath: pathApprovalInstancesSubscription,
-			params: map[string]string{
-				"subscription_type": `["MANAGED_APPROVAL","INVOLVED_APPROVAL"]`,
-			},
-			wantTypes: []string{
-				approvalSubscriptionTypeInvolved,
-				approvalSubscriptionTypeManaged,
-			},
-		},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			pc := approvalSubscriptionPreConsume(approvalSubscriptionConfig{
-				eventType:     approvalEventType(tc.eventType),
-				subscribePath: approvalSubscriptionPath(tc.subscribePath),
-			})
-			rt := &fakeAPIClient{}
-			cleanup, err := pc(context.Background(), rt, tc.params)
-			if err != nil {
-				t.Fatalf("PreConsume returned error: %v", err)
-			}
-			if cleanup != nil {
-				t.Fatal("cleanup must be nil; approval consume must not unsubscribe on exit")
-			}
-			assertSubscriptionCalls(t, rt.calls, tc.subscribePath, tc.wantTypes)
-		})
-	}
-}
-
-func assertSubscriptionCalls(t *testing.T, got []recordedCall, wantPath string, wantTypes []string) {
-	t.Helper()
-	if len(got) != len(wantTypes) {
-		t.Fatalf("calls after pre-consume = %d, want %d; calls=%+v", len(got), len(wantTypes), got)
-	}
-	for i, wantType := range wantTypes {
-		assertCall(t, got[i], "POST", wantPath, map[string]string{"subscription_type": wantType})
-	}
-}
-
-func assertCall(t *testing.T, got recordedCall, wantMethod, wantPath string, wantBody interface{}) {
-	t.Helper()
-	if got.method != wantMethod {
-		t.Errorf("method = %q, want %q", got.method, wantMethod)
-	}
-	if got.path != wantPath {
-		t.Errorf("path = %q, want %q", got.path, wantPath)
-	}
-	if !reflect.DeepEqual(got.body, wantBody) {
-		t.Errorf("body = %#v, want %#v", got.body, wantBody)
-	}
-}
-
-func TestApprovalPreConsumeValidationErrors(t *testing.T) {
-	t.Run("nil runtime", func(t *testing.T) {
-		pc := approvalSubscriptionPreConsume(approvalSubscriptionConfig{
-			eventType: eventTypeApprovalInstanceStatusChangedV4,
-		})
-		_, err := pc(context.Background(), nil, map[string]string{"subscription_type": approvalSubscriptionTypeInvolved})
-		if err == nil {
-			t.Fatal("expected nil runtime error")
-		}
-		p, ok := errs.ProblemOf(err)
-		if !ok || p.Category != errs.CategoryInternal {
-			t.Fatalf("err = %T/%v, want typed internal error", err, err)
-		}
-	})
-
-	for _, raw := range []string{"BAD", "[]", `["INVOLVED_APPROVAL",3]`} {
-		t.Run("invalid subscription type "+raw, func(t *testing.T) {
-			pc := approvalSubscriptionPreConsume(approvalSubscriptionConfig{
-				eventType: eventTypeApprovalInstanceStatusChangedV4,
-			})
-			cleanup, err := pc(context.Background(), &fakeAPIClient{}, map[string]string{"subscription_type": raw})
-			if err == nil {
-				t.Fatal("expected invalid subscription_type error")
-			}
-			if cleanup != nil {
-				t.Fatal("cleanup must be nil on validation error")
-			}
-			var ve *errs.ValidationError
-			if !errors.As(err, &ve) {
-				t.Fatalf("err = %T/%v, want *errs.ValidationError", err, err)
-			}
-			if ve.Subtype != errs.SubtypeInvalidArgument || ve.Param != "--param" {
-				t.Errorf("subtype/param = %s/%q, want invalid_argument/--param", ve.Subtype, ve.Param)
-			}
-			if ve.Hint == "" {
-				t.Error("invalid subscription_type should carry a hint")
-			}
-		})
-	}
-
-	t.Run("partial registration failure reports registered and failed relation types", func(t *testing.T) {
-		upstream := errs.NewAPIError(errs.SubtypeServerError, "approval subscription API failed")
-		rt := &fakeAPIClient{err: upstream, errOnCall: 2}
-		pc := approvalSubscriptionPreConsume(approvalSubscriptionConfig{
-			eventType:     eventTypeApprovalTaskStatusChangedV4,
-			subscribePath: pathApprovalTasksSubscription,
-		})
-
-		cleanup, err := pc(context.Background(), rt, map[string]string{})
-		if err == nil {
-			t.Fatal("expected partial registration error")
-		}
-		if cleanup != nil {
-			t.Fatal("cleanup must be nil on registration error")
-		}
-		assertSubscriptionCalls(t, rt.calls, pathApprovalTasksSubscription, []string{
-			approvalSubscriptionTypeInvolved,
-			approvalSubscriptionTypeManaged,
-		})
-		p, ok := errs.ProblemOf(err)
-		if !ok {
-			t.Fatalf("err = %T/%v, want typed error", err, err)
-		}
-		if p.Category != errs.CategoryAPI || p.Subtype != errs.SubtypeServerError {
-			t.Fatalf("category/subtype = %s/%s, want api/server_error", p.Category, p.Subtype)
-		}
-		for _, want := range []string{
-			"registered subscription_type(s) [INVOLVED_APPROVAL]",
-			"failed subscription_type MANAGED_APPROVAL",
-		} {
-			if !strings.Contains(p.Message, want) {
-				t.Errorf("partial error message missing %q: %q", want, p.Message)
-			}
-		}
-		for _, want := range []string{
-			"already registered",
-			"--param subscription_type=MANAGED_APPROVAL",
-		} {
-			if !strings.Contains(p.Hint, want) {
-				t.Errorf("partial error hint missing %q: %q", want, p.Hint)
-			}
-		}
-	})
-}
-
-func TestApprovalSubscriptionRegistrationErrorVariants(t *testing.T) {
-	t.Run("nil error", func(t *testing.T) {
-		if err := approvalSubscriptionRegistrationError(eventTypeApprovalTaskStatusChangedV4, nil, approvalSubscriptionTypeInvolved, nil); err != nil {
-			t.Fatalf("nil cause returned error: %v", err)
-		}
-	})
-
-	t.Run("typed error with existing hint and empty message", func(t *testing.T) {
-		upstream := errs.NewAPIError(errs.SubtypeServerError, "").WithHint("retry later")
-		err := approvalSubscriptionRegistrationError(
-			eventTypeApprovalTaskStatusChangedV4,
-			nil,
-			approvalSubscriptionTypeInvolved,
-			upstream,
-		)
-		if err != upstream {
-			t.Fatalf("typed error should be annotated in place; got %T/%v", err, err)
-		}
-		p, ok := errs.ProblemOf(err)
-		if !ok {
-			t.Fatalf("err = %T/%v, want typed error", err, err)
-		}
-		if !strings.Contains(p.Message, "failed subscription_type INVOLVED_APPROVAL") {
-			t.Errorf("message missing failed relation: %q", p.Message)
-		}
-		for _, want := range []string{"retry later", "no approval subscription relation was registered"} {
-			if !strings.Contains(p.Hint, want) {
-				t.Errorf("hint missing %q: %q", want, p.Hint)
-			}
-		}
-	})
-
-	t.Run("untyped error is wrapped with retry context", func(t *testing.T) {
-		cause := errors.New("transport closed")
-		err := approvalSubscriptionRegistrationError(
-			eventTypeApprovalTaskStatusChangedV4,
-			nil,
-			approvalSubscriptionTypeInvolved,
-			cause,
-		)
-		if !errors.Is(err, cause) {
-			t.Fatalf("wrapped error should preserve cause; got %T/%v", err, err)
-		}
-		p, ok := errs.ProblemOf(err)
-		if !ok {
-			t.Fatalf("err = %T/%v, want typed error", err, err)
-		}
-		if p.Category != errs.CategoryInternal || p.Subtype != errs.SubtypeSDKError {
-			t.Fatalf("category/subtype = %s/%s, want internal/sdk_error", p.Category, p.Subtype)
-		}
-		if !strings.Contains(p.Hint, "no approval subscription relation was registered") {
-			t.Errorf("hint missing no-registration context: %q", p.Hint)
-		}
-	})
-}
-
-func TestProcessApprovalInstanceStatusChanged(t *testing.T) {
-	out := runApprovalInstanceStatusChanged(t, `{
-		"schema": "2.0",
-		"header": {
-			"event_id": "evt_approval_instance_001",
-			"event_type": "approval.instance.status_changed_v4",
-			"create_time": "1710000000000"
-		},
-		"event": {
-			"approval_code": "approval_code_001",
-			"instance_code": "instance_code_001",
-			"external_id": "external_001",
-			"status": "PENDING",
-			"operate_time": "1666079207003",
-			"start_user": {
-				"open_id": "ou_start",
-				"union_id": "on_start",
-				"user_id": "user_start"
-			}
-		}
-	}`)
-
-	if out.Type != eventTypeApprovalInstanceStatusChangedV4 {
-		t.Errorf("Type = %q, want %q", out.Type, eventTypeApprovalInstanceStatusChangedV4)
-	}
-	if out.EventID != "evt_approval_instance_001" || out.Timestamp != "1710000000000" {
-		t.Errorf("EventID/Timestamp = %q/%q", out.EventID, out.Timestamp)
-	}
-	if out.ApprovalCode != "approval_code_001" || out.InstanceCode != "instance_code_001" {
-		t.Errorf("approval/instance code = %q/%q", out.ApprovalCode, out.InstanceCode)
-	}
-	if out.ExternalID != "external_001" || out.Status != "PENDING" || out.OperateTime != "1666079207003" {
-		t.Errorf("external/status/operate_time = %q/%q/%q", out.ExternalID, out.Status, out.OperateTime)
-	}
-	if out.StartUser == nil || out.StartUser.OpenID != "ou_start" || out.StartUser.UnionID != "on_start" || out.StartUser.UserID != "user_start" {
-		t.Fatalf("StartUser = %+v, want full user ids", out.StartUser)
-	}
-}
-
-func TestProcessApprovalTaskStatusChanged(t *testing.T) {
-	out := runApprovalTaskStatusChanged(t, `{
-		"schema": "2.0",
-		"header": {
-			"event_id": "evt_approval_task_001",
-			"event_type": "approval.task.status_changed_v4",
-			"create_time": "1710000000001"
-		},
-		"event": {
-			"approval_code": "approval_code_002",
-			"instance_code": "instance_code_002",
-			"task_id": "task_001",
-			"external_id": "external_002",
-			"task_external_id": "task_external_001",
-			"status": "APPROVED",
-			"operate_time": "1666079207004",
-			"assigned_user": {
-				"open_id": "ou_assignee",
-				"union_id": "on_assignee",
-				"user_id": "user_assignee"
-			}
-		}
-	}`)
-
-	if out.Type != eventTypeApprovalTaskStatusChangedV4 {
-		t.Errorf("Type = %q, want %q", out.Type, eventTypeApprovalTaskStatusChangedV4)
-	}
-	if out.EventID != "evt_approval_task_001" || out.Timestamp != "1710000000001" {
-		t.Errorf("EventID/Timestamp = %q/%q", out.EventID, out.Timestamp)
-	}
-	if out.ApprovalCode != "approval_code_002" || out.InstanceCode != "instance_code_002" || out.TaskID != "task_001" {
-		t.Errorf("approval/instance/task = %q/%q/%q", out.ApprovalCode, out.InstanceCode, out.TaskID)
-	}
-	if out.ExternalID != "external_002" || out.TaskExternalID != "task_external_001" || out.Status != "APPROVED" || out.OperateTime != "1666079207004" {
-		t.Errorf("external/task_external/status/operate_time = %q/%q/%q/%q", out.ExternalID, out.TaskExternalID, out.Status, out.OperateTime)
-	}
-	if out.AssignedUser == nil || out.AssignedUser.OpenID != "ou_assignee" || out.AssignedUser.UnionID != "on_assignee" || out.AssignedUser.UserID != "user_assignee" {
-		t.Fatalf("AssignedUser = %+v, want full user ids", out.AssignedUser)
-	}
-}
-
-func TestProcessApprovalStatusChangedUsesRawEventTypeFallback(t *testing.T) {
-	instance := runApprovalInstanceStatusChanged(t, `{
-		"schema": "2.0",
-		"header": {
-			"event_id": "evt_approval_instance_fallback",
-			"create_time": "1710000000002"
-		},
-		"event": {
-			"approval_code": "approval_code_fallback",
-			"instance_code": "instance_code_fallback",
-			"status": "APPROVED",
-			"operate_time": "1666079207005"
-		}
-	}`)
-	if instance.Type != eventTypeApprovalInstanceStatusChangedV4 {
-		t.Errorf("instance Type fallback = %q, want %q", instance.Type, eventTypeApprovalInstanceStatusChangedV4)
-	}
-
-	task := runApprovalTaskStatusChanged(t, `{
-		"schema": "2.0",
-		"header": {
-			"event_id": "evt_approval_task_fallback",
-			"create_time": "1710000000003"
-		},
-		"event": {
-			"approval_code": "approval_code_fallback",
-			"instance_code": "instance_code_fallback",
-			"task_id": "task_fallback",
-			"status": "DONE",
-			"operate_time": "1666079207006"
-		}
-	}`)
-	if task.Type != eventTypeApprovalTaskStatusChangedV4 {
-		t.Errorf("task Type fallback = %q, want %q", task.Type, eventTypeApprovalTaskStatusChangedV4)
-	}
-}
-
-func TestProcessApprovalStatusChangedMalformedPayloadPassthrough(t *testing.T) {
-	for _, tc := range []struct {
-		name      string
-		eventType string
-		process   event.ProcessFunc
-	}{
-		{"instance", eventTypeApprovalInstanceStatusChangedV4, processApprovalInstanceStatusChanged},
-		{"task", eventTypeApprovalTaskStatusChangedV4, processApprovalTaskStatusChanged},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			raw := &event.RawEvent{
-				EventType: tc.eventType,
-				Payload:   json.RawMessage(`not json`),
-				Timestamp: time.Now(),
-			}
-			got, err := tc.process(context.Background(), nil, raw, nil)
-			if err != nil {
-				t.Fatalf("Process should swallow parse errors, got %v", err)
-			}
-			if string(got) != "not json" {
-				t.Errorf("malformed fallback output = %q, want original bytes", string(got))
-			}
-		})
-	}
-}
-
-func TestProcessApprovalStatusChangedNilRaw(t *testing.T) {
-	for _, tc := range []struct {
-		name    string
-		process event.ProcessFunc
-	}{
-		{"instance", processApprovalInstanceStatusChanged},
-		{"task", processApprovalTaskStatusChanged},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			got, err := tc.process(context.Background(), nil, nil, nil)
-			if err != nil {
-				t.Fatalf("Process nil raw returned error: %v", err)
-			}
-			if got != nil {
-				t.Fatalf("Process nil raw output = %s, want nil", string(got))
-			}
-		})
-	}
-}
-
-func runApprovalInstanceStatusChanged(t *testing.T, payload string) ApprovalInstanceStatusChangedV4Output {
-	t.Helper()
-	raw := &event.RawEvent{
-		EventType: eventTypeApprovalInstanceStatusChangedV4,
-		Payload:   json.RawMessage(payload),
-		Timestamp: time.Now(),
-	}
-	got, err := processApprovalInstanceStatusChanged(context.Background(), nil, raw, nil)
-	if err != nil {
-		t.Fatalf("Process returned error: %v", err)
-	}
-	var out ApprovalInstanceStatusChangedV4Output
-	if err := json.Unmarshal(got, &out); err != nil {
-		t.Fatalf("Process output is not valid instance JSON: %v\nraw=%s", err, string(got))
-	}
-	return out
-}
-
-func runApprovalTaskStatusChanged(t *testing.T, payload string) ApprovalTaskStatusChangedV4Output {
-	t.Helper()
-	raw := &event.RawEvent{
-		EventType: eventTypeApprovalTaskStatusChangedV4,
-		Payload:   json.RawMessage(payload),
-		Timestamp: time.Now(),
-	}
-	got, err := processApprovalTaskStatusChanged(context.Background(), nil, raw, nil)
-	if err != nil {
-		t.Fatalf("Process returned error: %v", err)
-	}
-	var out ApprovalTaskStatusChangedV4Output
-	if err := json.Unmarshal(got, &out); err != nil {
-		t.Fatalf("Process output is not valid task JSON: %v\nraw=%s", err, string(got))
-	}
-	return out
-}
-
-func TestApprovalKeysRegisterCleanly(t *testing.T) {
-	for _, key := range []string{eventTypeApprovalInstanceStatusChangedV4, eventTypeApprovalTaskStatusChangedV4} {
-		event.UnregisterKeyForTest(key)
-		t.Cleanup(func() { event.UnregisterKeyForTest(key) })
-	}
-
-	for _, def := range Keys() {
-		event.RegisterKey(def)
-	}
-	for _, key := range []string{eventTypeApprovalInstanceStatusChangedV4, eventTypeApprovalTaskStatusChangedV4} {
-		if _, ok := event.Lookup(key); !ok {
-			t.Fatalf("event.Lookup(%q) not registered", key)
-		}
-	}
-}
-
-var _ event.APIClient = (*fakeAPIClient)(nil)

events/approval/types.go

@@ -1,42 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package approval
-
-// ApprovalUserID identifies a user in the three Lark ID formats included by
-// approval status-change events.
-type ApprovalUserID struct {
-	OpenID  string `json:"open_id,omitempty"  desc:"User open_id; prefixed with ou_" kind:"open_id"`
-	UnionID string `json:"union_id,omitempty" desc:"User union_id"                  kind:"union_id"`
-	UserID  string `json:"user_id,omitempty"  desc:"User id within the tenant"       kind:"user_id"`
-}
-
-// ApprovalInstanceStatusChangedV4Output is the flattened shape for
-// approval.instance.status_changed_v4.
-type ApprovalInstanceStatusChangedV4Output struct {
-	Type         string          `json:"type"                    desc:"Event type; always approval.instance.status_changed_v4" enum:"approval.instance.status_changed_v4"`
-	EventID      string          `json:"event_id,omitempty"      desc:"Globally unique event ID; safe for deduplication"`
-	Timestamp    string          `json:"timestamp,omitempty"     desc:"Event delivery time (ms timestamp string); taken from header.create_time when present" kind:"timestamp_ms"`
-	ApprovalCode string          `json:"approval_code,omitempty" desc:"Approval definition code; not a subscription dimension"`
-	InstanceCode string          `json:"instance_code,omitempty" desc:"Approval instance code"`
-	ExternalID   string          `json:"external_id,omitempty"   desc:"Third-party approval instance id; present only for third-party approvals"`
-	Status       string          `json:"status,omitempty"        desc:"Approval instance status" enum:"PENDING,APPROVED,REJECTED,CANCELED,DELETED,REVERTED,OVERTIME_CLOSE,OVERTIME_RECOVER"`
-	OperateTime  string          `json:"operate_time,omitempty"  desc:"Status change time in milliseconds" kind:"timestamp_ms"`
-	StartUser    *ApprovalUserID `json:"start_user,omitempty"    desc:"Approval instance starter; omitted when unavailable"`
-}
-
-// ApprovalTaskStatusChangedV4Output is the flattened shape for
-// approval.task.status_changed_v4.
-type ApprovalTaskStatusChangedV4Output struct {
-	Type           string          `json:"type"                      desc:"Event type; always approval.task.status_changed_v4" enum:"approval.task.status_changed_v4"`
-	EventID        string          `json:"event_id,omitempty"        desc:"Globally unique event ID; safe for deduplication"`
-	Timestamp      string          `json:"timestamp,omitempty"       desc:"Event delivery time (ms timestamp string); taken from header.create_time when present" kind:"timestamp_ms"`
-	ApprovalCode   string          `json:"approval_code,omitempty"     desc:"Approval definition code; not a subscription dimension"`
-	InstanceCode   string          `json:"instance_code,omitempty"     desc:"Approval instance code"`
-	TaskID         string          `json:"task_id,omitempty"           desc:"Approval task id"`
-	ExternalID     string          `json:"external_id,omitempty"       desc:"Third-party approval external id; present only for third-party approvals"`
-	TaskExternalID string          `json:"task_external_id,omitempty"  desc:"Third-party approval task external id; present only when emitted by the upstream service"`
-	AssignedUser   *ApprovalUserID `json:"assigned_user,omitempty"     desc:"Task assignee or operator user ids; omitted for automatic flows without an operator"`
-	Status         string          `json:"status,omitempty"            desc:"Approval task status" enum:"REVERTED,PENDING,APPROVED,REJECTED,TRANSFERRED,ROLLBACK,DONE,OVERTIME_CLOSE,OVERTIME_RECOVER"`
-	OperateTime    string          `json:"operate_time,omitempty"      desc:"Status change time in milliseconds" kind:"timestamp_ms"`
-}

events/register.go

@@ -5,8 +5,6 @@
 package events
 
 import (
-	"github.com/larksuite/cli/events/application"
-	"github.com/larksuite/cli/events/approval"
 	"github.com/larksuite/cli/events/im"
 	"github.com/larksuite/cli/events/minutes"
 	"github.com/larksuite/cli/events/task"
@@ -18,8 +16,6 @@ import (
 // Mail is intentionally omitted in this phase.
 func init() {
 	all := [][]event.KeyDefinition{
-		application.Keys(),
-		approval.Keys(),
 		im.Keys(),
 		minutes.Keys(),
 		task.Keys(),

internal/auth/testmain_test.go

@@ -1,23 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package auth
-
-import (
-	"os"
-	"path/filepath"
-	"testing"
-)
-
-func TestMain(m *testing.M) {
-	root, err := os.MkdirTemp("", "lark-cli-internal-auth-test-*")
-	if err != nil {
-		panic(err)
-	}
-	if err := os.Setenv("LARKSUITE_CLI_LOG_DIR", filepath.Join(root, "logs")); err != nil {
-		panic(err)
-	}
-	code := m.Run()
-	_ = os.RemoveAll(root)
-	os.Exit(code)
-}

internal/client/response.go

@@ -132,14 +132,16 @@ func HandleResponse(resp *larkcore.ApiResp, opts ResponseOptions) error {
 			})
 		}
 
-		emitter := output.NewEmitter(output.EmitterConfig{
-			Out:            opts.Out,
-			ErrOut:         opts.ErrOut,
-			CommandPath:    opts.CommandPath,
-			Identity:       string(identity),
-			NoticeProvider: output.GetNotice,
-		})
-		return emitter.Success(result, output.EmitOptions{Format: opts.Format.String()})
+		// Content safety scanning for non-JSON presentation formats.
+		scanResult := output.ScanForSafety(opts.CommandPath, result, opts.ErrOut)
+		if scanResult.Blocked {
+			return scanResult.BlockErr
+		}
+		if scanResult.Alert != nil {
+			output.WriteAlertWarning(opts.ErrOut, scanResult.Alert)
+		}
+		output.FormatValue(opts.Out, result, opts.Format)
+		return nil
 	}
 
 	// Non-JSON (binary) responses.

internal/client/response_test.go

@@ -18,7 +18,6 @@ import (
 
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/core"
-	"github.com/larksuite/cli/internal/httpmock"
 	"github.com/larksuite/cli/internal/output"
 	"github.com/larksuite/cli/internal/vfs/localfileio"
 )
@@ -240,87 +239,6 @@ func TestHandleResponse_JSON(t *testing.T) {
 	}
 }
 
-func TestHandleResponse_NonJSONFormatsEmitExactStructuredResponseBytes(t *testing.T) {
-	tests := []struct {
-		name   string
-		format output.Format
-		want   string
-	}{
-		{
-			name:   "ndjson",
-			format: output.FormatNDJSON,
-			want:   "{\"id\":\"1\",\"name\":\"Alice\"}\n{\"id\":\"2\",\"name\":\"Bob\"}\n",
-		},
-		{
-			name:   "table",
-			format: output.FormatTable,
-			want:   "id  name \n──  ─────\n1   Alice\n2   Bob  \n",
-		},
-		{
-			name:   "csv",
-			format: output.FormatCSV,
-			want:   "id,name\n1,Alice\n2,Bob\n",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			t.Setenv("LARKSUITE_CLI_CONTENT_SAFETY_MODE", "off")
-			reg := &httpmock.Registry{}
-			reg.Register(&httpmock.Stub{
-				Method: http.MethodGet,
-				URL:    "/open-apis/test/v1/items",
-				Body: map[string]interface{}{
-					"code": 0,
-					"msg":  "ok",
-					"data": map[string]interface{}{
-						"items": []interface{}{
-							map[string]interface{}{"id": "1", "name": "Alice"},
-							map[string]interface{}{"id": "2", "name": "Bob"},
-						},
-						"has_more": false,
-					},
-				},
-			})
-
-			httpResp, err := httpmock.NewClient(reg).Get("https://open.feishu.cn/open-apis/test/v1/items")
-			if err != nil {
-				t.Fatalf("fixture request failed: %v", err)
-			}
-			body, err := io.ReadAll(httpResp.Body)
-			_ = httpResp.Body.Close()
-			if err != nil {
-				t.Fatalf("read fixture response: %v", err)
-			}
-			resp := &larkcore.ApiResp{
-				StatusCode: httpResp.StatusCode,
-				Header:     httpResp.Header.Clone(),
-				RawBody:    body,
-			}
-
-			var out bytes.Buffer
-			var errOut bytes.Buffer
-			err = HandleResponse(resp, ResponseOptions{
-				Format:      tt.format,
-				Identity:    core.AsBot,
-				Out:         &out,
-				ErrOut:      &errOut,
-				CommandPath: "lark-cli api GET",
-			})
-			if err != nil {
-				t.Fatalf("HandleResponse() error = %v, want nil", err)
-			}
-			if got := out.String(); got != tt.want {
-				t.Fatalf("stdout byte mismatch\ngot (%d bytes):\n%q\nwant (%d bytes):\n%q", len(got), got, len(tt.want), tt.want)
-			}
-			if got := errOut.String(); got != "" {
-				t.Fatalf("stderr bytes = %q, want empty", got)
-			}
-			reg.Verify(t)
-		})
-	}
-}
-
 func TestHandleResponse_JSONWithJqUsesSuccessEnvelope(t *testing.T) {
 	body := []byte(`{"code":0,"msg":"ok","data":{"id":"1"}}`)
 	resp := newApiResp(body, map[string]string{"Content-Type": "application/json"})

internal/cmdutil/testmain_test.go

@@ -1,30 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package cmdutil
-
-import (
-	"os"
-	"path/filepath"
-	"testing"
-)
-
-func TestMain(m *testing.M) {
-	// Default-factory tests initialize the registry and resolve config. Keep
-	// them deterministic: never read the developer's real ~/.lark-cli and
-	// prevent background remote-metadata refreshes from touching user state.
-	root, err := os.MkdirTemp("", "lark-cli-cmdutil-test-*")
-	if err != nil {
-		println("internal/cmdutil test setup: MkdirTemp failed:", err.Error())
-		os.Exit(2)
-	}
-	if err := os.Setenv("LARKSUITE_CLI_CONFIG_DIR", filepath.Join(root, "config")); err != nil {
-		panic(err)
-	}
-	if err := os.Setenv("LARKSUITE_CLI_REMOTE_META", "off"); err != nil {
-		panic(err)
-	}
-	code := m.Run()
-	_ = os.RemoveAll(root)
-	os.Exit(code)
-}

internal/errclass/codemeta_spark.go

@@ -1,28 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package errclass
-
-import "github.com/larksuite/cli/errs"
-
-// sparkCodeMeta holds stable Spark app-role business-code classifications.
-// Command-specific recovery guidance belongs in the Apps shortcut layer; the
-// numeric code remains the source-specific discriminator on the error envelope.
-var sparkCodeMeta = map[int]CodeMeta{
-	3340001: {Category: errs.CategoryAPI, Subtype: errs.SubtypeInvalidParameters},          // request parameters are invalid
-	3344027: {Category: errs.CategoryAPI, Subtype: errs.SubtypeQuotaExceeded},              // role user count exceeds the service limit
-	3344028: {Category: errs.CategoryAPI, Subtype: errs.SubtypeQuotaExceeded},              // role department count exceeds the service limit
-	3344029: {Category: errs.CategoryAPI, Subtype: errs.SubtypeQuotaExceeded},              // role chat count exceeds the service limit
-	3344030: {Category: errs.CategoryAuthorization, Subtype: errs.SubtypePermissionDenied}, // app administrator required
-	3344031: {Category: errs.CategoryAuthorization, Subtype: errs.SubtypePermissionDenied}, // app administrator or developer required
-	3344034: {Category: errs.CategoryAPI, Subtype: errs.SubtypeInvalidParameters},          // invalid role ID
-	3344035: {Category: errs.CategoryAPI, Subtype: errs.SubtypeNotFound},                   // role does not exist
-	3344036: {Category: errs.CategoryAPI, Subtype: errs.SubtypeAlreadyExists},              // role ID already exists
-	3344037: {Category: errs.CategoryAPI, Subtype: errs.SubtypeQuotaExceeded},              // app role count exceeds the service limit
-	3344038: {Category: errs.CategoryAPI, Subtype: errs.SubtypeInvalidParameters},          // invalid role name
-	3344039: {Category: errs.CategoryAPI, Subtype: errs.SubtypeInvalidParameters},          // invalid role description
-	3344040: {Category: errs.CategoryAPI, Subtype: errs.SubtypeInvalidParameters},          // unsupported member type
-	3344041: {Category: errs.CategoryAPI, Subtype: errs.SubtypeInvalidParameters},          // invalid member ID
-}
-
-func init() { mergeCodeMeta(sparkCodeMeta, "spark") }

internal/errclass/codemeta_spark_test.go

@@ -1,59 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package errclass
-
-import (
-	"fmt"
-	"testing"
-
-	"github.com/larksuite/cli/errs"
-)
-
-func TestLookupCodeMetaSparkRoleCodes(t *testing.T) {
-	tests := []struct {
-		code     int
-		category errs.Category
-		subtype  errs.Subtype
-	}{
-		{3340001, errs.CategoryAPI, errs.SubtypeInvalidParameters},
-		{3344027, errs.CategoryAPI, errs.SubtypeQuotaExceeded},
-		{3344028, errs.CategoryAPI, errs.SubtypeQuotaExceeded},
-		{3344029, errs.CategoryAPI, errs.SubtypeQuotaExceeded},
-		{3344030, errs.CategoryAuthorization, errs.SubtypePermissionDenied},
-		{3344031, errs.CategoryAuthorization, errs.SubtypePermissionDenied},
-		{3344034, errs.CategoryAPI, errs.SubtypeInvalidParameters},
-		{3344035, errs.CategoryAPI, errs.SubtypeNotFound},
-		{3344036, errs.CategoryAPI, errs.SubtypeAlreadyExists},
-		{3344037, errs.CategoryAPI, errs.SubtypeQuotaExceeded},
-		{3344038, errs.CategoryAPI, errs.SubtypeInvalidParameters},
-		{3344039, errs.CategoryAPI, errs.SubtypeInvalidParameters},
-		{3344040, errs.CategoryAPI, errs.SubtypeInvalidParameters},
-		{3344041, errs.CategoryAPI, errs.SubtypeInvalidParameters},
-	}
-
-	for _, tt := range tests {
-		t.Run(fmt.Sprintf("%d", tt.code), func(t *testing.T) {
-			meta, ok := LookupCodeMeta(tt.code)
-			if !ok {
-				t.Fatalf("code %d is not registered", tt.code)
-			}
-			if meta.Category != tt.category || meta.Subtype != tt.subtype || meta.Retryable {
-				t.Fatalf("code %d metadata = %+v, want category=%s subtype=%s retryable=false", tt.code, meta, tt.category, tt.subtype)
-			}
-
-			err := BuildAPIError(map[string]any{
-				"code":   tt.code,
-				"msg":    "spark role error",
-				"log_id": "log-spark-role",
-			}, ClassifyContext{Identity: "user"})
-			problem, ok := errs.ProblemOf(err)
-			if !ok {
-				t.Fatalf("BuildAPIError(%d) = %#v, want typed problem", tt.code, err)
-			}
-			if problem.Category != tt.category || problem.Subtype != tt.subtype || problem.Code != tt.code || problem.LogID != "log-spark-role" || problem.Retryable {
-				t.Fatalf("BuildAPIError(%d) problem = %+v", tt.code, problem)
-			}
-		})
-	}
-}

internal/event/testmain_test.go

@@ -1,23 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package event
-
-import (
-	"os"
-	"path/filepath"
-	"testing"
-)
-
-func TestMain(m *testing.M) {
-	root, err := os.MkdirTemp("", "lark-cli-event-test-*")
-	if err != nil {
-		panic(err)
-	}
-	if err := os.Setenv("LARKSUITE_CLI_CONFIG_DIR", filepath.Join(root, "config")); err != nil {
-		panic(err)
-	}
-	code := m.Run()
-	_ = os.RemoveAll(root)
-	os.Exit(code)
-}

internal/keychain/testmain_test.go

@@ -1,28 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package keychain
-
-import (
-	"os"
-	"path/filepath"
-	"testing"
-)
-
-func TestMain(m *testing.M) {
-	root, err := os.MkdirTemp("", "lark-cli-keychain-test-*")
-	if err != nil {
-		panic(err)
-	}
-	for key, value := range map[string]string{
-		"LARKSUITE_CLI_DATA_DIR": filepath.Join(root, "data"),
-		"LARKSUITE_CLI_LOG_DIR":  filepath.Join(root, "logs"),
-	} {
-		if err := os.Setenv(key, value); err != nil {
-			panic(err)
-		}
-	}
-	code := m.Run()
-	_ = os.RemoveAll(root)
-	os.Exit(code)
-}

internal/output/csv.go

@@ -7,91 +7,70 @@ import (
 	"encoding/csv"
 	"fmt"
 	"io"
+	"os"
 )
 
 // FormatAsCSV formats data as CSV (with header) and writes it to w.
 func FormatAsCSV(w io.Writer, data interface{}) {
-	// Match the other legacy wrappers: surface only a marshal failure (as the
-	// JSON fallback historically did); plain write failures stay swallowed.
-	if err := WriteCSV(w, data); isOutputMarshalError(err) {
-		legacyStderrf("json marshal error: %v\n", err)
-	}
-}
-
-// WriteCSV formats data as CSV and returns marshal or write errors.
-func WriteCSV(w io.Writer, data interface{}) error {
-	return WriteCSVPaginated(w, data, true)
+	FormatAsCSVPaginated(w, data, true)
 }
 
 // FormatAsCSVPaginated formats data as CSV with pagination awareness.
 // When isFirstPage is true, outputs the header row; otherwise only data rows.
 func FormatAsCSVPaginated(w io.Writer, data interface{}, isFirstPage bool) {
-	if err := WriteCSVPaginated(w, data, isFirstPage); isOutputMarshalError(err) {
-		legacyStderrf("json marshal error: %v\n", err)
-	}
-}
-
-// WriteCSVPaginated formats data as CSV and returns marshal or write errors.
-func WriteCSVPaginated(w io.Writer, data interface{}, isFirstPage bool) error {
 	rows, cols, isList := prepareRows(data)
 	if cols == nil {
 		if isList {
-			_, err := fmt.Fprintln(w, "(empty)")
-			return err
+			fmt.Fprintln(w, "(empty)")
 		} else {
-			return WriteJSON(w, data)
+			PrintJson(w, data)
 		}
+		return
 	}
 
 	if len(rows) == 0 {
 		if isFirstPage {
-			_, err := fmt.Fprintln(w, "(empty)")
-			return err
+			fmt.Fprintln(w, "(empty)")
 		}
-		return nil
+		return
 	}
 
 	if !isList {
 		// Single object: key,value rows
 		cw := csv.NewWriter(w)
 		if isFirstPage {
-			if err := cw.Write([]string{"key", "value"}); err != nil {
-				return err
-			}
+			cw.Write([]string{"key", "value"})
 		}
 		for _, col := range cols {
-			if err := cw.Write([]string{col, rows[0][col]}); err != nil {
-				return err
-			}
+			cw.Write([]string{col, rows[0][col]})
 		}
-		return flushCSV(cw)
+		flushCSV(cw)
+		return
 	}
 
-	return writeCSVRows(w, rows, cols, isFirstPage)
+	writeCSVRows(w, rows, cols, isFirstPage)
 }
 
 // writeCSVRows writes CSV data rows (and optionally header) using the given columns.
-func writeCSVRows(w io.Writer, rows []map[string]string, cols []string, writeHeader bool) error {
+func writeCSVRows(w io.Writer, rows []map[string]string, cols []string, writeHeader bool) {
 	cw := csv.NewWriter(w)
 	if writeHeader {
-		if err := cw.Write(cols); err != nil {
-			return err
-		}
+		cw.Write(cols)
 	}
 	for _, row := range rows {
 		record := make([]string, len(cols))
 		for i, col := range cols {
 			record[i] = row[col]
 		}
-		if err := cw.Write(record); err != nil {
-			return err
-		}
+		cw.Write(record)
 	}
-	return flushCSV(cw)
+	flushCSV(cw)
 }
 
-// flushCSV flushes the csv.Writer and returns any write error.
-func flushCSV(cw *csv.Writer) error {
+// flushCSV flushes the csv.Writer and reports any write error to stderr.
+func flushCSV(cw *csv.Writer) {
 	cw.Flush()
-	return cw.Error()
+	if err := cw.Error(); err != nil {
+		fmt.Fprintf(os.Stderr, "csv write error: %v\n", err)
+	}
 }

internal/output/emit.go

@@ -50,11 +50,10 @@ func wrapBlockError(alert *extcs.Alert) error {
 
 // WriteAlertWarning writes a human-readable content-safety warning to w.
 // Used by non-JSON output paths (pretty, table, csv) in warn mode.
-func WriteAlertWarning(w io.Writer, alert *extcs.Alert) error {
+func WriteAlertWarning(w io.Writer, alert *extcs.Alert) {
 	if alert == nil {
-		return nil
+		return
 	}
-	_, err := fmt.Fprintf(w, "warning: content safety alert from %s (rules: %s)\n",
+	fmt.Fprintf(w, "warning: content safety alert from %s (rules: %s)\n",
 		alert.Provider, strings.Join(alert.MatchedRules, ", "))
-	return err
 }

internal/output/emitter.go

@@ -1,336 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package output
-
-import (
-	"bytes"
-	"encoding/json"
-	"fmt"
-	"io"
-	"maps"
-
-	"github.com/larksuite/cli/errs"
-)
-
-// NoticeProvider supplies the notice attached to a structured envelope.
-// The provider is captured by an Emitter so emission never reads the global
-// PendingNotice hook implicitly.
-type NoticeProvider func() map[string]interface{}
-
-// PrettyRenderer writes the human-readable representation of one result.
-// colorEnabled is the terminal capability captured when the Emitter is built.
-type PrettyRenderer func(w io.Writer, colorEnabled bool) error
-
-// EmitterConfig contains command-scoped dependencies. A command constructs one
-// Emitter and reuses it for its success result or streamed pages.
-type EmitterConfig struct {
-	Out            io.Writer
-	ErrOut         io.Writer
-	CommandPath    string
-	Identity       string
-	ColorEnabled   bool
-	NoticeProvider NoticeProvider
-}
-
-// EmitOptions describes one result's wire representation.
-//
-// The format contract is explicit: JSON (including the empty default) uses an
-// Envelope; pretty, table, csv, and ndjson render naked business data. JQ takes
-// precedence over Format and filters the JSON Envelope. Raw affects only JSON
-// envelope encoding and jq's complex-value encoding.
-//
-// JQSafetyWarning preserves the legacy difference between RuntimeContext.emit
-// (false) and WriteSuccessEnvelope (true) until their callers are migrated.
-type EmitOptions struct {
-	Raw             bool
-	Meta            *Meta
-	Format          string
-	JQ              string
-	DryRun          bool
-	Pretty          PrettyRenderer
-	JQSafetyWarning bool
-}
-
-// StreamOptions describes one streamed page's wire representation. Streaming
-// carries page items directly, so it deliberately exposes only the fields that
-// affect a single page: the format and, for pretty, its renderer. It has no
-// OK/Meta/DryRun/JQ — an ok:false envelope, metadata, dry-run, and jq all need
-// the aggregated result, which the caller's pagination layer owns before it
-// streams pages.
-type StreamOptions struct {
-	Format string
-	Pretty PrettyRenderer
-}
-
-// Emitter owns all command-scoped output dependencies and pagination state.
-// It deliberately has no dependency on client or cmdutil.
-type Emitter struct {
-	out            io.Writer
-	errOut         io.Writer
-	commandPath    string
-	identity       string
-	colorEnabled   bool
-	noticeProvider NoticeProvider
-
-	streamFormat    string
-	streamFormatter *PaginatedFormatter
-}
-
-// NewEmitter constructs a command-scoped output emitter.
-func NewEmitter(config EmitterConfig) *Emitter {
-	errOut := config.ErrOut
-	if errOut == nil {
-		errOut = io.Discard
-	}
-	return &Emitter{
-		out:            config.Out,
-		errOut:         errOut,
-		commandPath:    config.CommandPath,
-		identity:       config.Identity,
-		colorEnabled:   config.ColorEnabled,
-		noticeProvider: config.NoticeProvider,
-	}
-}
-
-// Success scans and emits one command result by composing the package's leaf
-// primitives. JSON and jq use the standard envelope; pretty, table, csv, and
-// ndjson render the business value directly.
-func (e *Emitter) Success(data interface{}, opts EmitOptions) error {
-	if err := e.requireOutput(); err != nil {
-		return err
-	}
-
-	if opts.JQ != "" {
-		return e.emitEnvelope(data, true, opts)
-	}
-
-	switch opts.Format {
-	case "", "json":
-		return e.emitEnvelope(data, true, opts)
-	case "pretty":
-		return e.emitPretty(data, opts)
-	default:
-		return e.emitFormatted(data, opts.Format)
-	}
-}
-
-// PartialFailure emits a multi-status result whose envelope honestly reports
-// ok:false. It is the typed counterpart to Success for batch operations where
-// some items failed but the per-item outcomes are the primary stdout output.
-// Like the legacy OutPartialFailure it produces only the JSON/jq envelope; the
-// caller owns the non-zero exit signal, keeping the Emitter free of exit
-// semantics.
-func (e *Emitter) PartialFailure(data interface{}, opts EmitOptions) error {
-	if err := e.requireOutput(); err != nil {
-		return err
-	}
-	return e.emitEnvelope(data, false, opts)
-}
-
-// StreamPage scans and emits one page while retaining table/csv columns from
-// the first page. Streamed output carries page items directly, so it takes a
-// StreamOptions (format + optional pretty renderer) rather than the full
-// EmitOptions: ok/meta/dry-run/jq all need the aggregated result and are the
-// caller's pagination-layer responsibility, not a per-page concern. Excluding
-// jq from the type makes "jq requires aggregated output" a compile-time fact
-// instead of a runtime rejection.
-func (e *Emitter) StreamPage(data interface{}, opts StreamOptions) error {
-	if err := e.requireOutput(); err != nil {
-		return err
-	}
-
-	scanResult := ScanForSafety(e.commandPath, data, e.errOut)
-	if scanResult.Blocked {
-		return scanResult.BlockErr
-	}
-	if scanResult.Alert != nil {
-		if err := WriteAlertWarning(e.errOut, scanResult.Alert); err != nil {
-			return wrapOutputError("write", err)
-		}
-	}
-
-	if opts.Format == "pretty" {
-		if opts.Pretty == nil {
-			return errs.NewInternalError(errs.SubtypeUnknown,
-				"pretty output requires a renderer")
-		}
-		return e.emit(func(w io.Writer) error {
-			return opts.Pretty(w, e.colorEnabled)
-		})
-	}
-
-	format, known := ParseFormat(opts.Format)
-	if !known && e.streamFormatter == nil && e.errOut != nil {
-		fmt.Fprintf(e.errOut, "warning: unknown format %q, falling back to json\n", opts.Format)
-	}
-	if e.streamFormatter == nil {
-		e.streamFormat = opts.Format
-		e.streamFormatter = NewPaginatedFormatter(nil, format)
-	} else if opts.Format != e.streamFormat {
-		return errs.NewInternalError(errs.SubtypeUnknown,
-			"stream output format changed from %q to %q", e.streamFormat, opts.Format)
-	}
-
-	return e.emit(func(w io.Writer) error {
-		e.streamFormatter.W = w
-		return e.streamFormatter.WritePage(data)
-	})
-}
-
-func (e *Emitter) emitEnvelope(data interface{}, ok bool, opts EmitOptions) error {
-	scanResult := ScanForSafety(e.commandPath, data, e.errOut)
-	if scanResult.Blocked {
-		return scanResult.BlockErr
-	}
-
-	env := Envelope{
-		OK:       ok,
-		Identity: e.identity,
-		DryRun:   opts.DryRun,
-		Data:     data,
-		Meta:     opts.Meta,
-		Notice:   e.notice(),
-	}
-	if scanResult.Alert != nil {
-		env.ContentSafetyAlert = scanResult.Alert
-	}
-
-	if opts.JQ != "" {
-		if scanResult.Alert != nil && opts.JQSafetyWarning {
-			if err := WriteAlertWarning(e.errOut, scanResult.Alert); err != nil {
-				return wrapOutputError("write", err)
-			}
-		}
-		// Buffer the jq output manually so jq's own typed error (a validation
-		// error for a bad expression, an api error for a runtime failure) is
-		// returned unchanged; only a genuine stdout write failure is wrapped as
-		// an internal output error.
-		var buf bytes.Buffer
-		var jqErr error
-		if opts.Raw {
-			jqErr = JqFilterRaw(&buf, env, opts.JQ)
-		} else {
-			jqErr = JqFilter(&buf, env, opts.JQ)
-		}
-		if jqErr != nil {
-			return jqErr
-		}
-		if _, err := io.Copy(e.out, &buf); err != nil {
-			return wrapOutputError("write", err)
-		}
-		return nil
-	}
-
-	return e.emit(func(w io.Writer) error {
-		if opts.Raw {
-			enc := json.NewEncoder(w)
-			enc.SetEscapeHTML(false)
-			enc.SetIndent("", "  ")
-			return enc.Encode(env)
-		}
-		return WriteJSON(w, env)
-	})
-}
-
-func (e *Emitter) emitPretty(data interface{}, opts EmitOptions) error {
-	scanResult := ScanForSafety(e.commandPath, data, e.errOut)
-	if scanResult.Blocked {
-		return scanResult.BlockErr
-	}
-	if scanResult.Alert != nil {
-		if err := WriteAlertWarning(e.errOut, scanResult.Alert); err != nil {
-			return wrapOutputError("write", err)
-		}
-	}
-	if opts.Pretty != nil {
-		return e.emit(func(w io.Writer) error {
-			return opts.Pretty(w, e.colorEnabled)
-		})
-	}
-
-	// RuntimeContext.outFormat falls back through Out/OutRaw when no pretty
-	// renderer is supplied. Keep that second scan visible in the leaf contract
-	// until production callers are migrated and the legacy behavior is removed.
-	return e.emitEnvelope(data, true, opts)
-}
-
-func (e *Emitter) emitFormatted(data interface{}, rawFormat string) error {
-	scanResult := ScanForSafety(e.commandPath, data, e.errOut)
-	if scanResult.Blocked {
-		return scanResult.BlockErr
-	}
-	if scanResult.Alert != nil {
-		if err := WriteAlertWarning(e.errOut, scanResult.Alert); err != nil {
-			return wrapOutputError("write", err)
-		}
-	}
-
-	format, known := ParseFormat(rawFormat)
-	if !known && e.errOut != nil {
-		fmt.Fprintf(e.errOut, "warning: unknown format %q, falling back to json\n", rawFormat)
-	}
-	if format == FormatJSON {
-		return e.printLegacyDataJSON(data)
-	}
-	return e.emit(func(w io.Writer) error {
-		return WriteFormatted(w, data, format)
-	})
-}
-
-type emitterDataMap map[string]interface{}
-
-// printLegacyDataJSON matches FormatValue's JSON branch while sourcing notice
-// data from this Emitter instead of PrintJson's global PendingNotice hook.
-func (e *Emitter) printLegacyDataJSON(data interface{}) error {
-	// Normalise structs / named maps to plain generic types first, exactly as
-	// FormatValue does, so a struct or named-map payload still matches the map
-	// case below and keeps its injected _notice on the unknown-format fallback.
-	data = toGeneric(data)
-	if m, ok := data.(map[string]interface{}); ok {
-		if _, isEnvelope := m["ok"]; isEnvelope {
-			if notice := e.notice(); notice != nil {
-				m = maps.Clone(m)
-				m["_notice"] = notice
-			}
-		}
-		// The named map retains identical JSON bytes while preventing PrintJson
-		// from consulting its legacy global notice hook a second time.
-		return e.emit(func(w io.Writer) error {
-			return WriteJSON(w, emitterDataMap(m))
-		})
-	}
-	return e.emit(func(w io.Writer) error {
-		return WriteJSON(w, data)
-	})
-}
-
-func (e *Emitter) emit(render func(io.Writer) error) error {
-	var buf bytes.Buffer
-	if err := render(&buf); err != nil {
-		return wrapOutputError("render", err)
-	}
-	if _, err := io.Copy(e.out, &buf); err != nil {
-		return wrapOutputError("write", err)
-	}
-	return nil
-}
-
-func wrapOutputError(op string, err error) error {
-	return errs.NewInternalError(errs.SubtypeUnknown, "failed to %s command output", op).WithCause(err)
-}
-
-func (e *Emitter) notice() map[string]interface{} {
-	if e.noticeProvider == nil {
-		return nil
-	}
-	return e.noticeProvider()
-}
-
-func (e *Emitter) requireOutput() error {
-	if e == nil || e.out == nil {
-		return errs.NewInternalError(errs.SubtypeUnknown,
-			"success output writer is not configured")
-	}
-	return nil
-}

internal/output/emitter_contract_test.go

@@ -1,350 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package output_test
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-	"errors"
-	"io"
-	"reflect"
-	"strings"
-	"testing"
-
-	"github.com/larksuite/cli/errs"
-	extcs "github.com/larksuite/cli/extension/contentsafety"
-	"github.com/larksuite/cli/internal/output"
-)
-
-type contractFailingWriter struct {
-	err error
-}
-
-func (w contractFailingWriter) Write([]byte) (int, error) {
-	return 0, w.err
-}
-
-type contractSafetyProvider struct {
-	alert *extcs.Alert
-}
-
-func (p *contractSafetyProvider) Name() string {
-	return "emitter-contract"
-}
-
-func (p *contractSafetyProvider) Scan(context.Context, extcs.ScanRequest) (*extcs.Alert, error) {
-	return p.alert, nil
-}
-
-func TestEmitterSuccessWritesAllBytes(t *testing.T) {
-	t.Setenv("LARKSUITE_CLI_CONTENT_SAFETY_MODE", "off")
-	stdout := &bytes.Buffer{}
-	emitter := output.NewEmitter(output.EmitterConfig{
-		Out:         stdout,
-		ErrOut:      io.Discard,
-		CommandPath: "lark-cli fixture +emit",
-		Identity:    "bot",
-	})
-	data := map[string]interface{}{"id": "1"}
-
-	err := emitter.Success(data, output.EmitOptions{Format: "json"})
-	if err != nil {
-		t.Fatalf("Emitter.Success() error = %v", err)
-	}
-	want, marshalErr := json.MarshalIndent(output.Envelope{OK: true, Identity: "bot", Data: data}, "", "  ")
-	if marshalErr != nil {
-		t.Fatalf("marshal expected envelope: %v", marshalErr)
-	}
-	want = append(want, '\n')
-	if !bytes.Equal(stdout.Bytes(), want) {
-		t.Fatalf("stdout bytes = %q, want %q", stdout.Bytes(), want)
-	}
-}
-
-func TestEmitterMarshalFailureReturnsTypedErrorWithoutOutput(t *testing.T) {
-	t.Setenv("LARKSUITE_CLI_CONTENT_SAFETY_MODE", "off")
-	stdout := &bytes.Buffer{}
-	emitter := output.NewEmitter(output.EmitterConfig{
-		Out:         stdout,
-		ErrOut:      io.Discard,
-		CommandPath: "lark-cli fixture +emit",
-	})
-
-	err := emitter.Success(map[string]interface{}{"unsupported": func() {}}, output.EmitOptions{Format: "json"})
-	if err == nil {
-		t.Fatal("Emitter.Success() error = nil, want marshal failure")
-	}
-	problem, ok := errs.ProblemOf(err)
-	if !ok || problem.Category != errs.CategoryInternal {
-		t.Fatalf("Emitter.Success() problem = %#v, %v; want internal typed error", problem, ok)
-	}
-	var unsupported *json.UnsupportedTypeError
-	if !errors.As(err, &unsupported) {
-		t.Fatalf("Emitter.Success() error = %v, want json.UnsupportedTypeError cause", err)
-	}
-	if stdout.Len() != 0 {
-		t.Fatalf("Emitter.Success() stdout = %q, want empty", stdout.String())
-	}
-}
-
-func TestEmitterWriterFailurePreservesCause(t *testing.T) {
-	t.Setenv("LARKSUITE_CLI_CONTENT_SAFETY_MODE", "off")
-	sentinel := errors.New("write failed")
-	emitter := output.NewEmitter(output.EmitterConfig{
-		Out:         contractFailingWriter{err: sentinel},
-		ErrOut:      io.Discard,
-		CommandPath: "lark-cli fixture +emit",
-	})
-
-	err := emitter.Success(map[string]interface{}{"id": "1"}, output.EmitOptions{Format: "json"})
-	if !errors.Is(err, sentinel) {
-		t.Fatalf("Emitter.Success() error = %v, want preserved writer cause", err)
-	}
-	problem, ok := errs.ProblemOf(err)
-	if !ok || problem.Category != errs.CategoryInternal {
-		t.Fatalf("Emitter.Success() problem = %#v, %v; want internal typed error", problem, ok)
-	}
-}
-
-func TestEmitterPrettyRendererFailurePreservesCause(t *testing.T) {
-	t.Setenv("LARKSUITE_CLI_CONTENT_SAFETY_MODE", "off")
-	sentinel := errors.New("pretty render failed")
-	stdout := &bytes.Buffer{}
-	emitter := output.NewEmitter(output.EmitterConfig{
-		Out:         stdout,
-		ErrOut:      io.Discard,
-		CommandPath: "lark-cli fixture +emit",
-	})
-
-	err := emitter.Success(map[string]interface{}{"id": "1"}, output.EmitOptions{
-		Format: "pretty",
-		Pretty: func(io.Writer, bool) error {
-			return sentinel
-		},
-	})
-	if !errors.Is(err, sentinel) {
-		t.Fatalf("Emitter.Success() error = %v, want preserved renderer cause", err)
-	}
-	problem, ok := errs.ProblemOf(err)
-	if !ok || problem.Category != errs.CategoryInternal {
-		t.Fatalf("Emitter.Success() problem = %#v, %v; want internal typed error", problem, ok)
-	}
-	if stdout.Len() != 0 {
-		t.Fatalf("Emitter.Success() stdout = %q, want empty", stdout.String())
-	}
-}
-
-func TestEmitterAlertWarningFailurePreservesCause(t *testing.T) {
-	t.Setenv("LARKSUITE_CLI_CONTENT_SAFETY_MODE", "warn")
-	extcs.Register(&contractSafetyProvider{alert: &extcs.Alert{
-		Provider:     "emitter-contract",
-		MatchedRules: []string{"fixture-rule"},
-	}})
-	t.Cleanup(func() { extcs.Register(nil) })
-	sentinel := errors.New("warning write failed")
-	stdout := &bytes.Buffer{}
-	emitter := output.NewEmitter(output.EmitterConfig{
-		Out:         stdout,
-		ErrOut:      contractFailingWriter{err: sentinel},
-		CommandPath: "lark-cli fixture +emit",
-	})
-
-	err := emitter.Success([]interface{}{map[string]interface{}{"id": "1"}}, output.EmitOptions{Format: "table"})
-	if !errors.Is(err, sentinel) {
-		t.Fatalf("Emitter.Success() error = %v, want preserved warning writer cause", err)
-	}
-	problem, ok := errs.ProblemOf(err)
-	if !ok || problem.Category != errs.CategoryInternal {
-		t.Fatalf("Emitter.Success() problem = %#v, %v; want internal typed error", problem, ok)
-	}
-	if stdout.Len() != 0 {
-		t.Fatalf("Emitter.Success() stdout = %q, want empty", stdout.String())
-	}
-}
-
-func TestNewEmitterDefaultsNilErrOutToDiscard(t *testing.T) {
-	t.Setenv("LARKSUITE_CLI_CONTENT_SAFETY_MODE", "warn")
-	extcs.Register(&contractSafetyProvider{alert: &extcs.Alert{
-		Provider:     "emitter-contract",
-		MatchedRules: []string{"fixture-rule"},
-	}})
-	t.Cleanup(func() { extcs.Register(nil) })
-	stdout := &bytes.Buffer{}
-	emitter := output.NewEmitter(output.EmitterConfig{
-		Out:         stdout,
-		CommandPath: "lark-cli fixture +emit",
-	})
-
-	if err := emitter.Success([]interface{}{map[string]interface{}{"id": "1"}}, output.EmitOptions{Format: "table"}); err != nil {
-		t.Fatalf("Emitter.Success() error = %v", err)
-	}
-	if stdout.Len() == 0 {
-		t.Fatal("Emitter.Success() stdout is empty")
-	}
-}
-
-func TestEmitterDoesNotMutateCallerMap(t *testing.T) {
-	t.Setenv("LARKSUITE_CLI_CONTENT_SAFETY_MODE", "off")
-	data := map[string]interface{}{"ok": true, "value": "fixture"}
-	want := map[string]interface{}{"ok": true, "value": "fixture"}
-	emitter := output.NewEmitter(output.EmitterConfig{
-		Out:         &bytes.Buffer{},
-		ErrOut:      io.Discard,
-		CommandPath: "lark-cli fixture +emit",
-		NoticeProvider: func() map[string]interface{} {
-			return map[string]interface{}{"update": "available"}
-		},
-	})
-
-	if err := emitter.Success(data, output.EmitOptions{Format: "yaml"}); err != nil {
-		t.Fatalf("Emitter.Success() error = %v", err)
-	}
-	if !reflect.DeepEqual(data, want) {
-		t.Fatalf("caller map = %#v, want unchanged %#v", data, want)
-	}
-}
-
-func TestEmitterDoesNotOverwriteCallerNotice(t *testing.T) {
-	t.Setenv("LARKSUITE_CLI_CONTENT_SAFETY_MODE", "off")
-	existing := map[string]interface{}{"source": "caller"}
-	data := map[string]interface{}{"ok": true, "_notice": existing}
-	stdout := &bytes.Buffer{}
-	emitter := output.NewEmitter(output.EmitterConfig{
-		Out:         stdout,
-		ErrOut:      io.Discard,
-		CommandPath: "lark-cli fixture +emit",
-		NoticeProvider: func() map[string]interface{} {
-			return map[string]interface{}{"source": "provider"}
-		},
-	})
-
-	if err := emitter.Success(data, output.EmitOptions{Format: "yaml"}); err != nil {
-		t.Fatalf("Emitter.Success() error = %v", err)
-	}
-	if got := data["_notice"]; !reflect.DeepEqual(got, existing) {
-		t.Fatalf("caller _notice = %#v, want unchanged %#v", got, existing)
-	}
-	var emitted map[string]interface{}
-	if err := json.Unmarshal(stdout.Bytes(), &emitted); err != nil {
-		t.Fatalf("decode stdout: %v", err)
-	}
-	if got := emitted["_notice"]; !reflect.DeepEqual(got, map[string]interface{}{"source": "provider"}) {
-		t.Fatalf("emitted _notice = %#v, want provider notice", got)
-	}
-}
-
-func TestEmitterReadsNoticeProviderAtMostOncePerEmission(t *testing.T) {
-	t.Setenv("LARKSUITE_CLI_CONTENT_SAFETY_MODE", "off")
-	calls := 0
-	emitter := output.NewEmitter(output.EmitterConfig{
-		Out:         &bytes.Buffer{},
-		ErrOut:      io.Discard,
-		CommandPath: "lark-cli fixture +emit",
-		NoticeProvider: func() map[string]interface{} {
-			calls++
-			return map[string]interface{}{"source": "provider"}
-		},
-	})
-
-	if err := emitter.Success(map[string]interface{}{"ok": true}, output.EmitOptions{Format: "yaml"}); err != nil {
-		t.Fatalf("Emitter.Success() error = %v", err)
-	}
-	if calls != 1 {
-		t.Fatalf("notice provider calls = %d, want 1", calls)
-	}
-}
-
-func TestEmitterRawJSONPropagatesWriteError(t *testing.T) {
-	t.Setenv("LARKSUITE_CLI_CONTENT_SAFETY_MODE", "off")
-	sentinel := errors.New("write failed")
-	emitter := output.NewEmitter(output.EmitterConfig{
-		Out:         contractFailingWriter{err: sentinel},
-		ErrOut:      io.Discard,
-		CommandPath: "lark-cli fixture +emit",
-	})
-	err := emitter.Success(map[string]interface{}{"id": "1"}, output.EmitOptions{
-		Raw: true, Format: "json",
-	})
-	if !errors.Is(err, sentinel) {
-		t.Fatalf("Emitter.Success() error = %v, want preserved writer cause", err)
-	}
-	problem, ok := errs.ProblemOf(err)
-	if !ok || problem.Category != errs.CategoryInternal {
-		t.Fatalf("Emitter.Success() problem = %#v, %v; want internal typed error", problem, ok)
-	}
-}
-
-func TestEmitterInvalidJQReturnsErrorWithoutStderr(t *testing.T) {
-	t.Setenv("LARKSUITE_CLI_CONTENT_SAFETY_MODE", "off")
-	stderr := &bytes.Buffer{}
-	emitter := output.NewEmitter(output.EmitterConfig{
-		Out:         &bytes.Buffer{},
-		ErrOut:      stderr,
-		CommandPath: "lark-cli fixture +emit",
-	})
-	err := emitter.Success(map[string]interface{}{"id": "1"}, output.EmitOptions{
-		Format: "json",
-		JQ:     "this is not valid jq (((",
-	})
-	if err == nil {
-		t.Fatal("Success() with invalid jq = nil, want error")
-	}
-	if stderr.Len() != 0 {
-		t.Fatalf("Success() with invalid jq wrote stderr %q, want empty", stderr.String())
-	}
-}
-
-func TestEmitterJQRuntimeErrorPreservesTypedError(t *testing.T) {
-	// A valid expression that fails at runtime must surface jq's own typed error
-	// (an api error), not a wrapped internal output error, and must emit no
-	// partial stdout.
-	t.Setenv("LARKSUITE_CLI_CONTENT_SAFETY_MODE", "off")
-	stdout := &bytes.Buffer{}
-	emitter := output.NewEmitter(output.EmitterConfig{
-		Out:         stdout,
-		ErrOut:      io.Discard,
-		CommandPath: "lark-cli fixture +emit",
-	})
-	err := emitter.Success(map[string]interface{}{"id": "1"}, output.EmitOptions{
-		Format: "json",
-		JQ:     `error("boom")`,
-	})
-	if err == nil {
-		t.Fatal("Success() with a runtime jq error = nil, want error")
-	}
-	problem, ok := errs.ProblemOf(err)
-	if !ok || problem.Category == errs.CategoryInternal {
-		t.Fatalf("Success() jq runtime error problem = %#v, %v; want jq's own typed error, not internal", problem, ok)
-	}
-	if !strings.Contains(err.Error(), "jq error") {
-		t.Fatalf("Success() jq runtime error = %v, want jq's own error message preserved", err)
-	}
-	if stdout.Len() != 0 {
-		t.Fatalf("Success() jq runtime error wrote stdout %q, want empty", stdout.String())
-	}
-}
-
-func TestEmitterUnknownFormatStructKeepsNotice(t *testing.T) {
-	t.Setenv("LARKSUITE_CLI_CONTENT_SAFETY_MODE", "off")
-	type payload struct {
-		OK    bool   `json:"ok"`
-		Value string `json:"value"`
-	}
-	stdout := &bytes.Buffer{}
-	emitter := output.NewEmitter(output.EmitterConfig{
-		Out:         stdout,
-		ErrOut:      io.Discard,
-		CommandPath: "lark-cli fixture +emit",
-		NoticeProvider: func() map[string]interface{} {
-			return map[string]interface{}{"update": map[string]interface{}{"latest": "9.9.9"}}
-		},
-	})
-	if err := emitter.Success(payload{OK: true, Value: "fixture"}, output.EmitOptions{Format: "yaml"}); err != nil {
-		t.Fatalf("Success() error = %v", err)
-	}
-	if !strings.Contains(stdout.String(), "_notice") {
-		t.Fatalf("struct payload on unknown-format fallback dropped _notice:\n%s", stdout.String())
-	}
-}

internal/output/emitter_legacy_compat_test.go

@@ -1,827 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-// Legacy oracle fixtures are frozen at base SHA 4a56748bfa941ff0ee0bfec92e65acac427732b0.
-// Golden regeneration is allowed only from that base, never from the current system under test.
-
-package output_test
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"io"
-	"os"
-	"reflect"
-	"strings"
-	"testing"
-
-	"github.com/spf13/cobra"
-
-	"github.com/larksuite/cli/errs"
-	extcs "github.com/larksuite/cli/extension/contentsafety"
-	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
-	"github.com/larksuite/cli/internal/output"
-	"github.com/larksuite/cli/shortcuts/common"
-)
-
-type emitterCapture struct {
-	stdout string
-	stderr string
-	err    error
-}
-
-type emitterSafetyProvider struct {
-	alert *extcs.Alert
-	err   error
-}
-
-func (p *emitterSafetyProvider) Name() string { return "emitter-oracle" }
-
-func (p *emitterSafetyProvider) Scan(context.Context, extcs.ScanRequest) (*extcs.Alert, error) {
-	return p.alert, p.err
-}
-
-const (
-	runtimeContextLegacyGoldenPath       = "testdata/runtime_context_legacy.golden.json"
-	writeSuccessEnvelopeLegacyGoldenPath = "testdata/write_success_envelope_legacy.golden.json"
-)
-
-type runtimeContextOracleCase struct {
-	name        string
-	data        func() interface{}
-	raw         bool
-	ok          bool
-	meta        *output.Meta
-	jq          string
-	format      string
-	useFormat   bool
-	pretty      bool
-	notice      map[string]interface{}
-	safetyMode  string
-	safetyAlert *extcs.Alert
-	safetyErr   error
-}
-
-type runtimeContextLegacyGolden struct {
-	Cases map[string]emitterCaptureGolden `json:"cases"`
-}
-
-type writeSuccessEnvelopeOracleCase struct {
-	name        string
-	data        func() interface{}
-	dryRun      bool
-	jq          string
-	notice      map[string]interface{}
-	safetyMode  string
-	safetyAlert *extcs.Alert
-}
-
-type writeSuccessEnvelopeLegacyGolden struct {
-	Cases map[string]emitterCaptureGolden `json:"cases"`
-}
-
-type emitterCaptureGolden struct {
-	Stdout string              `json:"stdout"`
-	Stderr string              `json:"stderr"`
-	Error  *emitterErrorGolden `json:"error,omitempty"`
-}
-
-type emitterErrorGolden struct {
-	GoType   string          `json:"go_type"`
-	JSON     json.RawMessage `json:"json"`
-	Message  string          `json:"message"`
-	ExitCode int             `json:"exit_code"`
-}
-
-func TestEmitterMatchesRuntimeContextLegacyOracle(t *testing.T) {
-	previousNotice := output.PendingNotice
-	t.Cleanup(func() {
-		output.PendingNotice = previousNotice
-		extcs.Register(nil)
-	})
-
-	cases := []runtimeContextOracleCase{
-		{
-			name: "json_object",
-			data: func() interface{} {
-				return map[string]interface{}{"id": "1", "enabled": true}
-			},
-			ok: true,
-		},
-		{
-			name: "raw_json_preserves_html",
-			data: func() interface{} {
-				return map[string]interface{}{"html": "<p>a&b</p>"}
-			},
-			raw: true,
-			ok:  true,
-		},
-		{
-			name: "format_raw_json_preserves_html",
-			data: func() interface{} {
-				return map[string]interface{}{"html": "<p>a&b</p>"}
-			},
-			raw:       true,
-			ok:        true,
-			format:    "json",
-			useFormat: true,
-		},
-		{
-			name: "partial_failure_ok_false",
-			data: func() interface{} {
-				return map[string]interface{}{"succeeded": 1, "failed": 1}
-			},
-			ok: false,
-		},
-		{
-			name: "metadata",
-			data: func() interface{} {
-				return []interface{}{map[string]interface{}{"id": "1"}}
-			},
-			ok:   true,
-			meta: &output.Meta{Count: 1, Rollback: "lark-cli fixture rollback"},
-		},
-		{
-			name: "jq_scalar",
-			data: func() interface{} {
-				return map[string]interface{}{"name": "Alice", "age": 30}
-			},
-			ok: true,
-			jq: ".data.name",
-		},
-		{
-			name: "raw_jq_complex",
-			data: func() interface{} {
-				return map[string]interface{}{"document": map[string]interface{}{"html": "<p>a&b</p>"}}
-			},
-			raw: true,
-			ok:  true,
-			jq:  ".data.document",
-		},
-		{
-			name: "jq_invalid_expression",
-			data: func() interface{} {
-				return map[string]interface{}{"id": "1"}
-			},
-			ok: false,
-			jq: "invalid[",
-		},
-		{
-			name: "notice",
-			data: func() interface{} {
-				return map[string]interface{}{"id": "1"}
-			},
-			ok:     true,
-			notice: map[string]interface{}{"update": map[string]interface{}{"latest": "9.9.9"}},
-		},
-		{
-			name: "pretty",
-			data: func() interface{} {
-				return map[string]interface{}{"name": "Alice"}
-			},
-			ok:        true,
-			format:    "pretty",
-			useFormat: true,
-			pretty:    true,
-		},
-		{
-			name: "pretty_without_renderer",
-			data: func() interface{} {
-				return map[string]interface{}{"name": "Alice"}
-			},
-			ok:        true,
-			format:    "pretty",
-			useFormat: true,
-		},
-		{
-			name: "ndjson",
-			data: func() interface{} {
-				return map[string]interface{}{"items": []interface{}{
-					map[string]interface{}{"id": "1"},
-					map[string]interface{}{"id": "2"},
-				}}
-			},
-			ok:        true,
-			format:    "ndjson",
-			useFormat: true,
-		},
-		{
-			name: "table_with_safety_warning",
-			data: func() interface{} {
-				return []interface{}{map[string]interface{}{"id": "1", "name": "Alice"}}
-			},
-			ok:         true,
-			format:     "table",
-			useFormat:  true,
-			safetyMode: "warn",
-			safetyAlert: &extcs.Alert{
-				Provider:     "emitter-oracle",
-				MatchedRules: []string{"fixture-rule"},
-			},
-		},
-		{
-			name: "csv",
-			data: func() interface{} {
-				return []interface{}{
-					map[string]interface{}{"id": "1", "name": "Alice"},
-					map[string]interface{}{"id": "2", "name": "Bob"},
-				}
-			},
-			ok:        true,
-			format:    "csv",
-			useFormat: true,
-		},
-		{
-			name: "jq_safety_alert_without_stderr_warning",
-			data: func() interface{} {
-				return map[string]interface{}{"id": "1"}
-			},
-			ok:         true,
-			jq:         ".data.id",
-			safetyMode: "warn",
-			safetyAlert: &extcs.Alert{
-				Provider:     "emitter-oracle",
-				MatchedRules: []string{"fixture-rule"},
-			},
-		},
-		{
-			name: "scanner_error_fails_open",
-			data: func() interface{} {
-				return map[string]interface{}{"id": "1"}
-			},
-			ok:         true,
-			safetyMode: "warn",
-			safetyErr:  errors.New("scanner unavailable"),
-		},
-		{
-			name: "scanner_block",
-			data: func() interface{} {
-				return map[string]interface{}{"id": "blocked"}
-			},
-			ok:         false,
-			safetyMode: "block",
-			safetyAlert: &extcs.Alert{
-				Provider:     "emitter-oracle",
-				MatchedRules: []string{"fixture-rule"},
-			},
-		},
-		{
-			name: "unknown_format_data_envelope_notice",
-			data: func() interface{} {
-				return map[string]interface{}{"ok": true, "value": "fixture"}
-			},
-			ok:        true,
-			format:    "yaml",
-			useFormat: true,
-			notice:    map[string]interface{}{"skills": map[string]interface{}{"current": "1.0.0"}},
-		},
-	}
-
-	golden := loadRuntimeContextLegacyGolden(t)
-
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			mode := tc.safetyMode
-			if mode == "" {
-				mode = "off"
-			}
-			t.Setenv("LARKSUITE_CLI_CONTENT_SAFETY_MODE", mode)
-			extcs.Register(&emitterSafetyProvider{alert: tc.safetyAlert, err: tc.safetyErr})
-			t.Cleanup(func() { extcs.Register(nil) })
-
-			notice := tc.notice
-			output.PendingNotice = func() map[string]interface{} { return notice }
-
-			want, ok := golden.Cases[tc.name]
-			if !ok {
-				t.Fatalf("frozen golden case %q is missing", tc.name)
-			}
-
-			opts := runtimeOracleOptions{
-				raw:       tc.raw,
-				ok:        tc.ok,
-				meta:      tc.meta,
-				jq:        tc.jq,
-				format:    tc.format,
-				useFormat: tc.useFormat,
-				pretty:    tc.pretty,
-			}
-			current := runEmitterWithRuntimeContextContract(tc.data(), output.EmitterConfig{
-				CommandPath:    "lark-cli fixture +emit",
-				Identity:       "bot",
-				NoticeProvider: func() map[string]interface{} { return notice },
-			}, tc.ok, output.EmitOptions{
-				Raw:    tc.raw,
-				Meta:   tc.meta,
-				Format: tc.format,
-				JQ:     tc.jq,
-				Pretty: emitterPrettyRenderer(tc.pretty),
-			})
-
-			assertEmitterGolden(t, want, current)
-
-			integrated := runRuntimeContextOracle(t, tc.data(), opts)
-			assertEmitterGolden(t, want, integrated)
-			if tc.safetyMode == "block" {
-				var safetyErr *errs.ContentSafetyError
-				if !errors.As(current.err, &safetyErr) {
-					t.Fatalf("Emitter.Success() error = %T, want *errs.ContentSafetyError", current.err)
-				}
-			}
-		})
-	}
-
-	if len(golden.Cases) != len(cases) {
-		t.Fatalf("golden case count = %d, want %d", len(golden.Cases), len(cases))
-	}
-
-	jqFailure := golden.Cases["jq_invalid_expression"]
-	if !strings.HasPrefix(jqFailure.Stderr, "error: ") || !strings.HasSuffix(jqFailure.Stderr, "\n") {
-		t.Fatalf("invalid jq golden stderr = %q, want error line ending in newline", jqFailure.Stderr)
-	}
-	if jqFailure.Error == nil || jqFailure.Error.ExitCode != output.ExitValidation {
-		t.Fatalf("invalid jq golden exit = %#v, want %d", jqFailure.Error, output.ExitValidation)
-	}
-}
-
-func loadRuntimeContextLegacyGolden(t *testing.T) runtimeContextLegacyGolden {
-	t.Helper()
-	contents, err := os.ReadFile(runtimeContextLegacyGoldenPath)
-	if err != nil {
-		t.Fatalf("read RuntimeContext legacy golden: %v", err)
-	}
-	var golden runtimeContextLegacyGolden
-	if err := json.Unmarshal(contents, &golden); err != nil {
-		t.Fatalf("decode RuntimeContext legacy golden: %v", err)
-	}
-	return golden
-}
-
-func captureEmitterGolden(t *testing.T, capture emitterCapture) emitterCaptureGolden {
-	t.Helper()
-	golden := emitterCaptureGolden{Stdout: capture.stdout, Stderr: capture.stderr}
-	if capture.err == nil {
-		return golden
-	}
-	errorJSON, err := json.Marshal(capture.err)
-	if err != nil {
-		t.Fatalf("marshal captured error %T: %v", capture.err, err)
-	}
-	golden.Error = &emitterErrorGolden{
-		GoType:   fmt.Sprintf("%T", capture.err),
-		JSON:     errorJSON,
-		Message:  capture.err.Error(),
-		ExitCode: output.ExitCodeOf(capture.err),
-	}
-	return golden
-}
-
-type runtimeOracleOptions struct {
-	raw       bool
-	ok        bool
-	meta      *output.Meta
-	jq        string
-	format    string
-	useFormat bool
-	pretty    bool
-}
-
-func runRuntimeContextOracle(t *testing.T, data interface{}, opts runtimeOracleOptions) emitterCapture {
-	t.Helper()
-	stdout := &bytes.Buffer{}
-	stderr := &bytes.Buffer{}
-	parent := &cobra.Command{Use: "lark-cli"}
-	cmd := &cobra.Command{Use: "fixture"}
-	leaf := &cobra.Command{Use: "+emit"}
-	parent.AddCommand(cmd)
-	cmd.AddCommand(leaf)
-
-	factory := &cmdutil.Factory{IOStreams: &cmdutil.IOStreams{Out: stdout, ErrOut: stderr}}
-	runtime := common.TestNewRuntimeContextForAPI(
-		context.Background(), leaf, &core.CliConfig{Brand: core.BrandFeishu}, factory, core.AsBot,
-	)
-	runtime.Format = opts.format
-	runtime.JqExpr = opts.jq
-
-	pretty := func(w io.Writer) {
-		fmt.Fprintln(w, "pretty:fixture")
-	}
-	if !opts.pretty {
-		pretty = nil
-	}
-
-	var err error
-	switch {
-	case opts.useFormat && opts.raw:
-		runtime.OutFormatRaw(data, opts.meta, pretty)
-	case opts.useFormat:
-		runtime.OutFormat(data, opts.meta, pretty)
-	case !opts.ok:
-		err = runtime.OutPartialFailure(data, opts.meta)
-	case opts.raw:
-		runtime.OutRaw(data, opts.meta)
-	default:
-		runtime.Out(data, opts.meta)
-	}
-
-	return emitterCapture{stdout: stdout.String(), stderr: stderr.String(), err: err}
-}
-
-func runEmitterSuccess(data interface{}, config output.EmitterConfig, ok bool, opts output.EmitOptions) emitterCapture {
-	stdout := &bytes.Buffer{}
-	stderr := &bytes.Buffer{}
-	config.Out = stdout
-	config.ErrOut = stderr
-	emitter := output.NewEmitter(config)
-	var err error
-	if ok {
-		err = emitter.Success(data, opts)
-	} else {
-		err = emitter.PartialFailure(data, opts)
-	}
-	return emitterCapture{stdout: stdout.String(), stderr: stderr.String(), err: err}
-}
-
-func runEmitterWithRuntimeContextContract(data interface{}, config output.EmitterConfig, ok bool, opts output.EmitOptions) emitterCapture {
-	capture := runEmitterSuccess(data, config, ok, opts)
-	if capture.err != nil {
-		var safetyErr *errs.ContentSafetyError
-		if errors.As(capture.err, &safetyErr) {
-			return capture
-		}
-		if opts.JQ != "" {
-			capture.stderr += fmt.Sprintf("error: %v\n", capture.err)
-			return capture
-		}
-		capture.err = nil
-	}
-	if !ok {
-		capture.err = output.PartialFailure(output.ExitAPI)
-	}
-	return capture
-}
-
-func emitterPrettyRenderer(enabled bool) output.PrettyRenderer {
-	if !enabled {
-		return nil
-	}
-	return func(w io.Writer, _ bool) error {
-		_, err := fmt.Fprintln(w, "pretty:fixture")
-		return err
-	}
-}
-
-func TestEmitterMatchesWriteSuccessEnvelopeLegacyOracle(t *testing.T) {
-	previousNotice := output.PendingNotice
-	t.Cleanup(func() {
-		output.PendingNotice = previousNotice
-		extcs.Register(nil)
-	})
-
-	cases := []writeSuccessEnvelopeOracleCase{
-		{
-			name: "json",
-			data: func() interface{} { return map[string]interface{}{"id": "1"} },
-		},
-		{
-			name:   "dry_run",
-			data:   func() interface{} { return map[string]interface{}{"api": []interface{}{}} },
-			dryRun: true,
-		},
-		{
-			name: "jq",
-			data: func() interface{} { return map[string]interface{}{"id": "1"} },
-			jq:   ".data.id",
-		},
-		{
-			name:   "notice",
-			data:   func() interface{} { return map[string]interface{}{"id": "1"} },
-			notice: map[string]interface{}{"update": map[string]interface{}{"latest": "9.9.9"}},
-		},
-		{
-			name:       "jq_safety_warning",
-			data:       func() interface{} { return map[string]interface{}{"id": "1"} },
-			jq:         ".data.id",
-			safetyMode: "warn",
-			safetyAlert: &extcs.Alert{
-				Provider:     "emitter-oracle",
-				MatchedRules: []string{"fixture-rule"},
-			},
-		},
-		{
-			name:       "scanner_block",
-			data:       func() interface{} { return map[string]interface{}{"id": "blocked"} },
-			safetyMode: "block",
-			safetyAlert: &extcs.Alert{
-				Provider:     "emitter-oracle",
-				MatchedRules: []string{"fixture-rule"},
-			},
-		},
-	}
-	golden := loadWriteSuccessEnvelopeLegacyGolden(t)
-
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			mode := tc.safetyMode
-			if mode == "" {
-				mode = "off"
-			}
-			t.Setenv("LARKSUITE_CLI_CONTENT_SAFETY_MODE", mode)
-			extcs.Register(&emitterSafetyProvider{alert: tc.safetyAlert})
-			t.Cleanup(func() { extcs.Register(nil) })
-			notice := tc.notice
-			output.PendingNotice = func() map[string]interface{} { return notice }
-
-			want, ok := golden.Cases[tc.name]
-			if !ok {
-				t.Fatalf("frozen golden case %q is missing", tc.name)
-			}
-
-			current := runEmitterSuccess(tc.data(), output.EmitterConfig{
-				CommandPath:    "lark-cli fixture +emit",
-				Identity:       "bot",
-				NoticeProvider: func() map[string]interface{} { return notice },
-			}, true, output.EmitOptions{
-				Format:          "",
-				Raw:             false,
-				JQ:              tc.jq,
-				DryRun:          tc.dryRun,
-				JQSafetyWarning: true,
-			})
-			assertEmitterGolden(t, want, current)
-
-			integrated := runWriteSuccessEnvelopeOracle(tc.data(), tc.dryRun, tc.jq)
-			assertEmitterGolden(t, want, integrated)
-		})
-	}
-
-	if len(golden.Cases) != len(cases) {
-		t.Fatalf("golden case count = %d, want %d", len(golden.Cases), len(cases))
-	}
-}
-
-func loadWriteSuccessEnvelopeLegacyGolden(t *testing.T) writeSuccessEnvelopeLegacyGolden {
-	t.Helper()
-	contents, err := os.ReadFile(writeSuccessEnvelopeLegacyGoldenPath)
-	if err != nil {
-		t.Fatalf("read WriteSuccessEnvelope legacy golden: %v", err)
-	}
-	var golden writeSuccessEnvelopeLegacyGolden
-	if err := json.Unmarshal(contents, &golden); err != nil {
-		t.Fatalf("decode WriteSuccessEnvelope legacy golden: %v", err)
-	}
-	return golden
-}
-
-func runWriteSuccessEnvelopeOracle(data interface{}, dryRun bool, jq string) emitterCapture {
-	stdout := &bytes.Buffer{}
-	stderr := &bytes.Buffer{}
-	err := output.WriteSuccessEnvelope(data, output.SuccessEnvelopeOptions{
-		CommandPath: "lark-cli fixture +emit",
-		Identity:    "bot",
-		DryRun:      dryRun,
-		JqExpr:      jq,
-		Out:         stdout,
-		ErrOut:      stderr,
-	})
-	return emitterCapture{stdout: stdout.String(), stderr: stderr.String(), err: err}
-}
-
-func TestEmitterStreamPageMatchesPaginationLegacyOracle(t *testing.T) {
-	t.Cleanup(func() { extcs.Register(nil) })
-
-	type oracleCase struct {
-		name        string
-		format      output.Format
-		safetyMode  string
-		safetyAlert *extcs.Alert
-	}
-	cases := []oracleCase{
-		{name: "ndjson", format: output.FormatNDJSON},
-		{name: "table", format: output.FormatTable},
-		{name: "csv", format: output.FormatCSV},
-		{
-			name:       "warn",
-			format:     output.FormatNDJSON,
-			safetyMode: "warn",
-			safetyAlert: &extcs.Alert{
-				Provider:     "emitter-oracle",
-				MatchedRules: []string{"fixture-rule"},
-			},
-		},
-		{
-			name:       "block",
-			format:     output.FormatTable,
-			safetyMode: "block",
-			safetyAlert: &extcs.Alert{
-				Provider:     "emitter-oracle",
-				MatchedRules: []string{"fixture-rule"},
-			},
-		},
-	}
-
-	pages := []interface{}{
-		[]interface{}{map[string]interface{}{"id": "1", "name": "Alice"}},
-		[]interface{}{map[string]interface{}{"id": "2", "name": "Bob", "ignored": true}},
-	}
-
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			mode := tc.safetyMode
-			if mode == "" {
-				mode = "off"
-			}
-			t.Setenv("LARKSUITE_CLI_CONTENT_SAFETY_MODE", mode)
-			extcs.Register(&emitterSafetyProvider{alert: tc.safetyAlert})
-			t.Cleanup(func() { extcs.Register(nil) })
-
-			legacy := runPaginationOracle(pages, tc.format)
-			current := runEmitterStreamPages(pages, tc.format.String())
-
-			assertEmitterBytes(t, legacy, current)
-			assertEquivalentError(t, legacy.err, current.err)
-		})
-	}
-}
-
-func runPaginationOracle(pages []interface{}, format output.Format) emitterCapture {
-	stdout := &bytes.Buffer{}
-	stderr := &bytes.Buffer{}
-	formatter := output.NewPaginatedFormatter(stdout, format)
-	var emitErr error
-	for _, page := range pages {
-		scanResult := output.ScanForSafety("lark-cli fixture +emit", page, stderr)
-		if scanResult.Blocked {
-			emitErr = scanResult.BlockErr
-			break
-		}
-		if scanResult.Alert != nil {
-			output.WriteAlertWarning(stderr, scanResult.Alert)
-		}
-		formatter.FormatPage(page)
-	}
-	return emitterCapture{stdout: stdout.String(), stderr: stderr.String(), err: emitErr}
-}
-
-func runEmitterStreamPages(pages []interface{}, format string) emitterCapture {
-	stdout := &bytes.Buffer{}
-	stderr := &bytes.Buffer{}
-	emitter := output.NewEmitter(output.EmitterConfig{
-		Out:         stdout,
-		ErrOut:      stderr,
-		CommandPath: "lark-cli fixture +emit",
-		Identity:    "bot",
-	})
-	var emitErr error
-	for _, page := range pages {
-		if emitErr = emitter.StreamPage(page, output.StreamOptions{Format: format}); emitErr != nil {
-			break
-		}
-	}
-	return emitterCapture{stdout: stdout.String(), stderr: stderr.String(), err: emitErr}
-}
-
-func TestEmitterCapturesNoticeAndColorDependencies(t *testing.T) {
-	previousNotice := output.PendingNotice
-	output.PendingNotice = func() map[string]interface{} {
-		return map[string]interface{}{"source": "global"}
-	}
-	t.Cleanup(func() { output.PendingNotice = previousNotice })
-	t.Setenv("LARKSUITE_CLI_CONTENT_SAFETY_MODE", "off")
-
-	stdout := &bytes.Buffer{}
-	stderr := &bytes.Buffer{}
-	colorSeen := false
-	emitter := output.NewEmitter(output.EmitterConfig{
-		Out:          stdout,
-		ErrOut:       stderr,
-		CommandPath:  "lark-cli fixture +emit",
-		Identity:     "bot",
-		ColorEnabled: true,
-		NoticeProvider: func() map[string]interface{} {
-			return map[string]interface{}{"source": "captured"}
-		},
-	})
-	if err := emitter.Success(map[string]interface{}{"id": "1"}, output.EmitOptions{Format: "json"}); err != nil {
-		t.Fatalf("Emitter.Success() error = %v", err)
-	}
-	if strings.Contains(stdout.String(), "global") || !strings.Contains(stdout.String(), "captured") {
-		t.Fatalf("notice source was not captured by Emitter:\n%s", stdout.String())
-	}
-
-	stdout.Reset()
-	if err := emitter.Success(map[string]interface{}{"id": "1"}, output.EmitOptions{Format: "pretty",
-		Pretty: func(w io.Writer, colorEnabled bool) error {
-			colorSeen = colorEnabled
-			_, err := fmt.Fprintln(w, "pretty")
-			return err
-		},
-	}); err != nil {
-		t.Fatalf("Emitter.Success(pretty) error = %v", err)
-	}
-	if !colorSeen {
-		t.Fatal("PrettyRenderer did not receive captured ColorEnabled value")
-	}
-
-	stdout.Reset()
-	if err := emitter.Success(map[string]interface{}{"ok": true, "id": "1"}, output.EmitOptions{Format: "yaml"}); err != nil {
-		t.Fatalf("Emitter.Success(unknown format) error = %v", err)
-	}
-	if strings.Contains(stdout.String(), "global") || !strings.Contains(stdout.String(), "captured") {
-		t.Fatalf("legacy JSON fallback consulted global notice:\n%s", stdout.String())
-	}
-}
-
-type failingEmitterWriter struct {
-	err error
-}
-
-func (w failingEmitterWriter) Write([]byte) (int, error) { return 0, w.err }
-
-func TestEmitterPropagatesOutputError(t *testing.T) {
-	t.Setenv("LARKSUITE_CLI_CONTENT_SAFETY_MODE", "off")
-	sentinel := errors.New("write failed")
-	emitter := output.NewEmitter(output.EmitterConfig{
-		Out:         failingEmitterWriter{err: sentinel},
-		ErrOut:      io.Discard,
-		CommandPath: "lark-cli fixture +emit",
-	})
-	err := emitter.Success(map[string]interface{}{"id": "1"}, output.EmitOptions{
-		Raw: true, Format: "json",
-		JQ: ".data",
-	})
-	if !errors.Is(err, sentinel) {
-		t.Fatalf("Emitter.Success() error = %v, want preserved writer cause", err)
-	}
-	problem, ok := errs.ProblemOf(err)
-	if !ok || problem.Category != errs.CategoryInternal {
-		t.Fatalf("Emitter.Success() problem = %#v, %v; want internal typed error", problem, ok)
-	}
-}
-
-func assertEmitterBytes(t *testing.T, legacy, current emitterCapture) {
-	t.Helper()
-	if legacy.stdout != current.stdout {
-		t.Fatalf("stdout byte mismatch\nlegacy (%d bytes):\n%q\nEmitter (%d bytes):\n%q",
-			len(legacy.stdout), legacy.stdout, len(current.stdout), current.stdout)
-	}
-	if legacy.stderr != current.stderr {
-		t.Fatalf("stderr byte mismatch\nlegacy (%d bytes):\n%q\nEmitter (%d bytes):\n%q",
-			len(legacy.stderr), legacy.stderr, len(current.stderr), current.stderr)
-	}
-}
-
-func assertEmitterGolden(t *testing.T, want emitterCaptureGolden, current emitterCapture) {
-	t.Helper()
-	if want.Stdout != current.stdout {
-		t.Fatalf("stdout byte mismatch\ngolden (%d bytes):\n%q\ncurrent (%d bytes):\n%q",
-			len(want.Stdout), want.Stdout, len(current.stdout), current.stdout)
-	}
-	if want.Stderr != current.stderr {
-		t.Fatalf("stderr byte mismatch\ngolden (%d bytes):\n%q\ncurrent (%d bytes):\n%q",
-			len(want.Stderr), want.Stderr, len(current.stderr), current.stderr)
-	}
-	got := captureEmitterGolden(t, current)
-	if (want.Error == nil) != (got.Error == nil) {
-		t.Fatalf("error presence mismatch: golden=%#v current=%#v", want.Error, got.Error)
-	}
-	if want.Error == nil {
-		return
-	}
-	if want.Error.GoType != got.Error.GoType || want.Error.Message != got.Error.Message || want.Error.ExitCode != got.Error.ExitCode {
-		t.Fatalf("error mismatch:\ngolden: %#v\ncurrent: %#v", want.Error, got.Error)
-	}
-	var wantJSON interface{}
-	if err := json.Unmarshal(want.Error.JSON, &wantJSON); err != nil {
-		t.Fatalf("decode golden error JSON: %v", err)
-	}
-	var gotJSON interface{}
-	if err := json.Unmarshal(got.Error.JSON, &gotJSON); err != nil {
-		t.Fatalf("decode current error JSON: %v", err)
-	}
-	if !reflect.DeepEqual(wantJSON, gotJSON) {
-		t.Fatalf("error JSON mismatch:\ngolden: %s\ncurrent: %s", want.Error.JSON, got.Error.JSON)
-	}
-}
-
-func assertEquivalentError(t *testing.T, legacy, current error) {
-	t.Helper()
-	if (legacy == nil) != (current == nil) {
-		t.Fatalf("error presence mismatch: legacy=%v Emitter=%v", legacy, current)
-	}
-	if legacy == nil {
-		return
-	}
-	legacyProblem, legacyOK := errs.ProblemOf(legacy)
-	currentProblem, currentOK := errs.ProblemOf(current)
-	if legacyOK != currentOK {
-		t.Fatalf("typed error mismatch: legacy=%T Emitter=%T", legacy, current)
-	}
-	if legacyOK && !reflect.DeepEqual(legacyProblem, currentProblem) {
-		t.Fatalf("problem mismatch:\nlegacy: %#v\nEmitter: %#v", legacyProblem, currentProblem)
-	}
-}

internal/output/envelope_success.go

@@ -34,17 +34,27 @@ func SuccessEnvelopeData(result interface{}) interface{} {
 // JSON output carries content-safety alerts inside the envelope. When jq is
 // applied, the alert may be filtered away, so warn mode also writes stderr.
 func WriteSuccessEnvelope(data interface{}, opts SuccessEnvelopeOptions) error {
-	return NewEmitter(EmitterConfig{
-		Out:            opts.Out,
-		ErrOut:         opts.ErrOut,
-		CommandPath:    opts.CommandPath,
-		Identity:       opts.Identity,
-		NoticeProvider: GetNotice,
-	}).Success(data, EmitOptions{
-		Format:          "",
-		Raw:             false,
-		JQ:              opts.JqExpr,
-		DryRun:          opts.DryRun,
-		JQSafetyWarning: true,
-	})
+	scanResult := ScanForSafety(opts.CommandPath, data, opts.ErrOut)
+	if scanResult.Blocked {
+		return scanResult.BlockErr
+	}
+
+	env := Envelope{
+		OK:       true,
+		Identity: opts.Identity,
+		DryRun:   opts.DryRun,
+		Data:     data,
+		Notice:   GetNotice(),
+	}
+	if scanResult.Alert != nil {
+		env.ContentSafetyAlert = scanResult.Alert
+	}
+	if opts.JqExpr != "" {
+		if scanResult.Alert != nil && opts.ErrOut != nil {
+			WriteAlertWarning(opts.ErrOut, scanResult.Alert)
+		}
+		return JqFilter(opts.Out, env, opts.JqExpr)
+	}
+	PrintJson(opts.Out, env)
+	return nil
 }

internal/output/format.go

@@ -101,44 +101,34 @@ func ExtractItems(data interface{}) []interface{} {
 
 // FormatValue formats a single response and writes it to w.
 func FormatValue(w io.Writer, data interface{}, format Format) {
-	err := WriteFormatted(w, data, format)
-	switch {
-	case err == nil:
-		return
-	case isOutputMarshalError(err) && format == FormatNDJSON:
-		legacyStderrf("ndjson marshal error: %v\n", err)
-	case isOutputMarshalError(err):
-		legacyStderrf("json marshal error: %v\n", err)
-	}
-}
-
-// WriteFormatted formats a single response and returns marshal or write errors.
-func WriteFormatted(w io.Writer, data interface{}, format Format) error {
 	data = toGeneric(data)
 	switch format {
 	case FormatNDJSON:
 		items := ExtractItems(data)
 		if items != nil {
-			return WriteNDJSON(w, items)
+			PrintNdjson(w, items)
+		} else {
+			PrintNdjson(w, data)
 		}
-		return WriteNDJSON(w, data)
 
 	case FormatTable:
 		items := ExtractItems(data)
 		if items != nil {
-			return WriteTable(w, items)
+			FormatAsTable(w, items)
+		} else {
+			FormatAsTable(w, data)
 		}
-		return WriteTable(w, data)
 
 	case FormatCSV:
 		items := ExtractItems(data)
 		if items != nil {
-			return WriteCSV(w, items)
+			FormatAsCSV(w, items)
+		} else {
+			FormatAsCSV(w, data)
 		}
-		return WriteCSV(w, data)
 
 	default: // FormatJSON
-		return WriteJSON(w, data)
+		PrintJson(w, data)
 	}
 }
 
@@ -158,63 +148,49 @@ func NewPaginatedFormatter(w io.Writer, format Format) *PaginatedFormatter {
 
 // FormatPage formats one page of items.
 func (pf *PaginatedFormatter) FormatPage(data interface{}) {
-	err := pf.WritePage(data)
-	if isOutputMarshalError(err) && (pf.Format == FormatJSON || pf.Format == FormatNDJSON) {
-		legacyStderrf("ndjson marshal error: %v\n", err)
-	}
-}
-
-// WritePage formats one page of items and returns marshal or write errors.
-func (pf *PaginatedFormatter) WritePage(data interface{}) error {
 	switch pf.Format {
 	case FormatJSON, FormatNDJSON:
 		if arr, ok := data.([]interface{}); ok {
-			return WriteNDJSON(pf.W, arr)
+			PrintNdjson(pf.W, arr)
+		} else {
+			PrintNdjson(pf.W, data)
 		}
-		return WriteNDJSON(pf.W, data)
 
 	case FormatTable:
-		return pf.formatStructuredPage(data, func(w io.Writer, rows []map[string]string, cols []string, isFirst bool) error {
+		pf.formatStructuredPage(data, func(w io.Writer, rows []map[string]string, cols []string, isFirst bool) {
 			widths := computeColumnWidths(rows, cols)
 			if isFirst {
-				if err := writeHeader(w, cols, widths); err != nil {
-					return err
-				}
+				writeHeader(w, cols, widths)
 			}
 			for _, row := range rows {
-				if err := writeRow(w, row, cols, widths); err != nil {
-					return err
-				}
+				writeRow(w, row, cols, widths)
 			}
-			return nil
 		})
 
 	case FormatCSV:
-		return pf.formatStructuredPage(data, func(w io.Writer, rows []map[string]string, cols []string, isFirst bool) error {
-			return writeCSVRows(w, rows, cols, isFirst)
+		pf.formatStructuredPage(data, func(w io.Writer, rows []map[string]string, cols []string, isFirst bool) {
+			writeCSVRows(w, rows, cols, isFirst)
 		})
 	}
-	return nil
 }
 
 // formatStructuredPage handles column-locking logic shared by table and csv.
-func (pf *PaginatedFormatter) formatStructuredPage(data interface{}, emit func(io.Writer, []map[string]string, []string, bool) error) error {
+func (pf *PaginatedFormatter) formatStructuredPage(data interface{}, emit func(io.Writer, []map[string]string, []string, bool)) {
 	rows, pageCols, isList := prepareRows(data)
 	if len(rows) == 0 {
 		if pf.isFirstPage && isList {
-			_, err := fmt.Fprintln(pf.W, "(empty)")
-			return err
+			fmt.Fprintln(pf.W, "(empty)")
 		}
-		return nil
+		return
 	}
 
 	if pf.isFirstPage {
 		// Lock columns from first page
 		pf.cols = pageCols
 		pf.isFirstPage = false
-		return emit(pf.W, rows, pf.cols, true)
+		emit(pf.W, rows, pf.cols, true)
 	} else {
 		// Reuse first page's columns — missing keys become empty, extra keys ignored
-		return emit(pf.W, rows, pf.cols, false)
+		emit(pf.W, rows, pf.cols, false)
 	}
 }

internal/output/print.go

@@ -5,7 +5,6 @@ package output
 
 import (
 	"encoding/json"
-	"errors"
 	"fmt"
 	"io"
 	"os"
@@ -16,44 +15,12 @@ import (
 // PrintJson prints data as formatted JSON to w.
 func PrintJson(w io.Writer, data interface{}) {
 	injectNotice(data)
-	if err := WriteJSON(w, data); isOutputMarshalError(err) {
-		legacyStderrf("json marshal error: %v\n", err)
-	}
-}
-
-type outputMarshalError struct {
-	err error
-}
-
-func (e *outputMarshalError) Error() string {
-	return e.err.Error()
-}
-
-func (e *outputMarshalError) Unwrap() error {
-	return e.err
-}
-
-func isOutputMarshalError(err error) bool {
-	var marshalErr *outputMarshalError
-	return errors.As(err, &marshalErr)
-}
-
-// legacyStderrf reports a leaf-formatter marshal/format failure on os.Stderr,
-// preserving the pre-Emitter behavior for direct (unmigrated) callers of the
-// Print*/FormatAs* wrappers. The Emitter never uses this — it returns typed
-// errors instead. Removed once the remaining direct callers migrate.
-func legacyStderrf(format string, args ...interface{}) {
-	fmt.Fprintf(os.Stderr, format, args...) //nolint:forbidigo // legacy leaf-formatter stderr; removed in the output-ownership follow-up
-}
-
-// WriteJSON writes data as formatted JSON to w and returns marshal or write errors.
-func WriteJSON(w io.Writer, data interface{}) error {
 	b, err := json.MarshalIndent(data, "", "  ")
 	if err != nil {
-		return &outputMarshalError{err: err}
+		fmt.Fprintf(os.Stderr, "json marshal error: %v\n", err)
+		return
 	}
-	_, err = fmt.Fprintln(w, string(b))
-	return err
+	fmt.Fprintln(w, string(b))
 }
 
 // injectNotice adds a "_notice" field into CLI envelope maps.
@@ -83,38 +50,21 @@ func injectNotice(data interface{}) {
 
 // PrintNdjson prints data as NDJSON (Newline Delimited JSON) to w.
 func PrintNdjson(w io.Writer, data interface{}) {
-	if arr, ok := data.([]interface{}); ok {
-		for _, item := range arr {
-			if err := WriteNDJSON(w, item); isOutputMarshalError(err) {
-				legacyStderrf("ndjson marshal error: %v\n", err)
-			}
-		}
-		return
-	}
-	if err := WriteNDJSON(w, data); isOutputMarshalError(err) {
-		legacyStderrf("ndjson marshal error: %v\n", err)
-	}
-}
-
-// WriteNDJSON writes data as NDJSON and returns marshal or write errors.
-func WriteNDJSON(w io.Writer, data interface{}) error {
-	emit := func(item interface{}) error {
+	emit := func(item interface{}) {
 		b, err := json.Marshal(item)
 		if err != nil {
-			return &outputMarshalError{err: err}
+			fmt.Fprintf(os.Stderr, "ndjson marshal error: %v\n", err)
+			return
 		}
-		_, err = fmt.Fprintln(w, string(b))
-		return err
+		fmt.Fprintln(w, string(b))
 	}
 	if arr, ok := data.([]interface{}); ok {
 		for _, item := range arr {
-			if err := emit(item); err != nil {
-				return err
-			}
+			emit(item)
 		}
-		return nil
+	} else {
+		emit(data)
 	}
-	return emit(data)
 }
 
 func cellStr(val interface{}) string {

internal/output/table.go

@@ -16,69 +16,50 @@ const maxColWidth = 100
 //   - map[string]interface{} (single object) → key-value two-column table
 //   - empty array → "(empty)"
 func FormatAsTable(w io.Writer, data interface{}) {
-	if err := WriteTable(w, data); isOutputMarshalError(err) {
-		legacyStderrf("json marshal error: %v\n", err)
-	}
-}
-
-// WriteTable formats data as a table and returns marshal or write errors.
-func WriteTable(w io.Writer, data interface{}) error {
-	return WriteTablePaginated(w, data, true)
+	FormatAsTablePaginated(w, data, true)
 }
 
 // FormatAsTablePaginated formats data as a table with pagination awareness.
 // When isFirstPage is true, outputs the header; otherwise only data rows.
 func FormatAsTablePaginated(w io.Writer, data interface{}, isFirstPage bool) {
-	if err := WriteTablePaginated(w, data, isFirstPage); isOutputMarshalError(err) {
-		legacyStderrf("json marshal error: %v\n", err)
-	}
-}
-
-// WriteTablePaginated formats data as a table and returns marshal or write errors.
-func WriteTablePaginated(w io.Writer, data interface{}, isFirstPage bool) error {
 	rows, cols, isList := prepareRows(data)
 	if cols == nil {
 		if isList {
-			_, err := fmt.Fprintln(w, "(empty)")
-			return err
+			fmt.Fprintln(w, "(empty)")
 		} else {
 			// Not a list and not an object — print as JSON fallback
-			return WriteJSON(w, data)
+			PrintJson(w, data)
 		}
+		return
 	}
 
 	if len(rows) == 0 {
 		if isFirstPage {
-			_, err := fmt.Fprintln(w, "(empty)")
-			return err
+			fmt.Fprintln(w, "(empty)")
 		}
-		return nil
+		return
 	}
 
 	if !isList {
 		// Single object: key-value two-column format
-		return formatKeyValueTable(w, rows[0], cols)
+		formatKeyValueTable(w, rows[0], cols)
+		return
 	}
 
 	// Calculate column widths (clamped to maxColWidth)
 	widths := computeColumnWidths(rows, cols)
 
 	if isFirstPage {
-		if err := writeHeader(w, cols, widths); err != nil {
-			return err
-		}
+		writeHeader(w, cols, widths)
 	}
 
 	for _, row := range rows {
-		if err := writeRow(w, row, cols, widths); err != nil {
-			return err
-		}
+		writeRow(w, row, cols, widths)
 	}
-	return nil
 }
 
 // formatKeyValueTable renders a single object as a two-column key-value table.
-func formatKeyValueTable(w io.Writer, row map[string]string, cols []string) error {
+func formatKeyValueTable(w io.Writer, row map[string]string, cols []string) {
 	maxKeyWidth := 0
 	for _, col := range cols {
 		kw := stringWidth(col)
@@ -90,11 +71,8 @@ func formatKeyValueTable(w io.Writer, row map[string]string, cols []string) erro
 	for _, col := range cols {
 		val := row[col]
 		val = truncateToWidth(val, maxColWidth)
-		if _, err := fmt.Fprintf(w, "%s  %s\n", padToWidth(col, maxKeyWidth), val); err != nil {
-			return err
-		}
+		fmt.Fprintf(w, "%s  %s\n", padToWidth(col, maxKeyWidth), val)
 	}
-	return nil
 }
 
 // computeColumnWidths returns display widths for each column, clamped to maxColWidth.
@@ -121,29 +99,25 @@ func computeColumnWidths(rows []map[string]string, cols []string) []int {
 }
 
 // writeHeader writes the header row and separator line.
-func writeHeader(w io.Writer, cols []string, widths []int) error {
+func writeHeader(w io.Writer, cols []string, widths []int) {
 	var header []string
 	var sep []string
 	for i, col := range cols {
 		header = append(header, padToWidth(col, widths[i]))
 		sep = append(sep, strings.Repeat("─", widths[i]))
 	}
-	if _, err := fmt.Fprintln(w, strings.Join(header, "  ")); err != nil {
-		return err
-	}
-	_, err := fmt.Fprintln(w, strings.Join(sep, "  "))
-	return err
+	fmt.Fprintln(w, strings.Join(header, "  "))
+	fmt.Fprintln(w, strings.Join(sep, "  "))
 }
 
 // writeRow writes a single data row.
-func writeRow(w io.Writer, row map[string]string, cols []string, widths []int) error {
+func writeRow(w io.Writer, row map[string]string, cols []string, widths []int) {
 	var cells []string
 	for i, col := range cols {
 		val := truncateToWidth(row[col], widths[i])
 		cells = append(cells, padToWidth(val, widths[i]))
 	}
-	_, err := fmt.Fprintln(w, strings.Join(cells, "  "))
-	return err
+	fmt.Fprintln(w, strings.Join(cells, "  "))
 }
 
 // padToWidth pads a string with spaces to reach the target display width.

internal/output/testdata/runtime_context_legacy.golden.json

@@ -1,107 +0,0 @@
-{
-  "cases": {
-    "csv": {
-      "stdout": "id,name\n1,Alice\n2,Bob\n",
-      "stderr": ""
-    },
-    "format_raw_json_preserves_html": {
-      "stdout": "{\n  \"ok\": true,\n  \"identity\": \"bot\",\n  \"data\": {\n    \"html\": \"\u003cp\u003ea\u0026b\u003c/p\u003e\"\n  }\n}\n",
-      "stderr": ""
-    },
-    "jq_invalid_expression": {
-      "stdout": "",
-      "stderr": "error: invalid jq expression: unexpected EOF\n",
-      "error": {
-        "go_type": "*errs.ValidationError",
-        "json": {
-          "type": "validation",
-          "subtype": "invalid_argument",
-          "message": "invalid jq expression: unexpected EOF"
-        },
-        "message": "invalid jq expression: unexpected EOF",
-        "exit_code": 2
-      }
-    },
-    "jq_safety_alert_without_stderr_warning": {
-      "stdout": "1\n",
-      "stderr": ""
-    },
-    "jq_scalar": {
-      "stdout": "Alice\n",
-      "stderr": ""
-    },
-    "json_object": {
-      "stdout": "{\n  \"ok\": true,\n  \"identity\": \"bot\",\n  \"data\": {\n    \"enabled\": true,\n    \"id\": \"1\"\n  }\n}\n",
-      "stderr": ""
-    },
-    "metadata": {
-      "stdout": "{\n  \"ok\": true,\n  \"identity\": \"bot\",\n  \"data\": [\n    {\n      \"id\": \"1\"\n    }\n  ],\n  \"meta\": {\n    \"count\": 1,\n    \"rollback\": \"lark-cli fixture rollback\"\n  }\n}\n",
-      "stderr": ""
-    },
-    "ndjson": {
-      "stdout": "{\"id\":\"1\"}\n{\"id\":\"2\"}\n",
-      "stderr": ""
-    },
-    "notice": {
-      "stdout": "{\n  \"ok\": true,\n  \"identity\": \"bot\",\n  \"data\": {\n    \"id\": \"1\"\n  },\n  \"_notice\": {\n    \"update\": {\n      \"latest\": \"9.9.9\"\n    }\n  }\n}\n",
-      "stderr": ""
-    },
-    "partial_failure_ok_false": {
-      "stdout": "{\n  \"ok\": false,\n  \"identity\": \"bot\",\n  \"data\": {\n    \"failed\": 1,\n    \"succeeded\": 1\n  }\n}\n",
-      "stderr": "",
-      "error": {
-        "go_type": "*output.PartialFailureError",
-        "json": {
-          "Code": 1
-        },
-        "message": "partial failure (exit 1)",
-        "exit_code": 1
-      }
-    },
-    "pretty": {
-      "stdout": "pretty:fixture\n",
-      "stderr": ""
-    },
-    "pretty_without_renderer": {
-      "stdout": "{\n  \"ok\": true,\n  \"identity\": \"bot\",\n  \"data\": {\n    \"name\": \"Alice\"\n  }\n}\n",
-      "stderr": ""
-    },
-    "raw_jq_complex": {
-      "stdout": "{\n  \"html\": \"\u003cp\u003ea\u0026b\u003c/p\u003e\"\n}\n",
-      "stderr": ""
-    },
-    "raw_json_preserves_html": {
-      "stdout": "{\n  \"ok\": true,\n  \"identity\": \"bot\",\n  \"data\": {\n    \"html\": \"\u003cp\u003ea\u0026b\u003c/p\u003e\"\n  }\n}\n",
-      "stderr": ""
-    },
-    "scanner_block": {
-      "stdout": "",
-      "stderr": "",
-      "error": {
-        "go_type": "*errs.ContentSafetyError",
-        "json": {
-          "type": "policy",
-          "subtype": "content_safety",
-          "message": "content safety violation detected (rules: fixture-rule)",
-          "rules": [
-            "fixture-rule"
-          ]
-        },
-        "message": "content safety violation detected (rules: fixture-rule)",
-        "exit_code": 6
-      }
-    },
-    "scanner_error_fails_open": {
-      "stdout": "{\n  \"ok\": true,\n  \"identity\": \"bot\",\n  \"data\": {\n    \"id\": \"1\"\n  }\n}\n",
-      "stderr": "warning: content safety scan error: scanner unavailable\n"
-    },
-    "table_with_safety_warning": {
-      "stdout": "id  name \n──  ─────\n1   Alice\n",
-      "stderr": "warning: content safety alert from emitter-oracle (rules: fixture-rule)\n"
-    },
-    "unknown_format_data_envelope_notice": {
-      "stdout": "{\n  \"_notice\": {\n    \"skills\": {\n      \"current\": \"1.0.0\"\n    }\n  },\n  \"ok\": true,\n  \"value\": \"fixture\"\n}\n",
-      "stderr": "warning: unknown format \"yaml\", falling back to json\n"
-    }
-  }
-}

internal/output/testdata/write_success_envelope_legacy.golden.json

@@ -1,41 +0,0 @@
-{
-  "cases": {
-    "dry_run": {
-      "stdout": "{\n  \"ok\": true,\n  \"identity\": \"bot\",\n  \"dry_run\": true,\n  \"data\": {\n    \"api\": []\n  }\n}\n",
-      "stderr": ""
-    },
-    "jq": {
-      "stdout": "1\n",
-      "stderr": ""
-    },
-    "jq_safety_warning": {
-      "stdout": "1\n",
-      "stderr": "warning: content safety alert from emitter-oracle (rules: fixture-rule)\n"
-    },
-    "json": {
-      "stdout": "{\n  \"ok\": true,\n  \"identity\": \"bot\",\n  \"data\": {\n    \"id\": \"1\"\n  }\n}\n",
-      "stderr": ""
-    },
-    "notice": {
-      "stdout": "{\n  \"ok\": true,\n  \"identity\": \"bot\",\n  \"data\": {\n    \"id\": \"1\"\n  },\n  \"_notice\": {\n    \"update\": {\n      \"latest\": \"9.9.9\"\n    }\n  }\n}\n",
-      "stderr": ""
-    },
-    "scanner_block": {
-      "stdout": "",
-      "stderr": "",
-      "error": {
-        "go_type": "*errs.ContentSafetyError",
-        "json": {
-          "type": "policy",
-          "subtype": "content_safety",
-          "message": "content safety violation detected (rules: fixture-rule)",
-          "rules": [
-            "fixture-rule"
-          ]
-        },
-        "message": "content safety violation detected (rules: fixture-rule)",
-        "exit_code": 6
-      }
-    }
-  }
-}

internal/qualitygate/cmd/comment-audit/main.go

@@ -19,18 +19,12 @@ import (
 type eventPayload struct {
 	Comment *struct {
 		Body string `json:"body"`
-		Path string `json:"path"`
 	} `json:"comment"`
 	Review *struct {
 		Body string `json:"body"`
 	} `json:"review"`
 }
 
-type commentContent struct {
-	Body string
-	Path string
-}
-
 func main() {
 	eventPath := flag.String("event", os.Getenv("GITHUB_EVENT_PATH"), "GitHub event payload path")
 	kind := flag.String("kind", os.Getenv("GITHUB_EVENT_NAME"), "GitHub event kind")
@@ -40,11 +34,12 @@ func main() {
 		fmt.Fprintln(os.Stderr, "comment-audit: --event or GITHUB_EVENT_PATH is required")
 		os.Exit(2)
 	}
-	diags, err := auditEvent(*eventPath, *kind)
+	body, err := commentBody(*eventPath)
 	if err != nil {
 		fmt.Fprintf(os.Stderr, "comment-audit: %v\n", err)
 		os.Exit(2)
 	}
+	diags := diagnostics(publiccontent.ScanComment(*kind, body))
 	if len(diags) > 0 {
 		fmt.Fprintln(os.Stderr, auditFailureSummary(len(diags)))
 	}
@@ -52,44 +47,32 @@ func main() {
 	os.Exit(report.ExitCode(diags))
 }
 
-func auditEvent(eventPath, kind string) ([]report.Diagnostic, error) {
-	content, err := commentBody(eventPath)
-	if err != nil {
-		return nil, err
-	}
-	return scanCommentContent(kind, content), nil
-}
-
-func scanCommentContent(kind string, content commentContent) []report.Diagnostic {
-	return diagnostics(publiccontent.ScanCommentAtPath(kind, content.Path, content.Body))
-}
-
 func auditFailureSummary(count int) string {
 	return fmt.Sprintf("post-publication audit found public content findings: %d", count)
 }
 
-func commentBody(path string) (commentContent, error) {
+func commentBody(path string) (string, error) {
 	safePath, err := validate.SafeInputPath(path)
 	if err != nil {
-		return commentContent{}, errs.NewValidationError(errs.SubtypeInvalidArgument, "invalid --event: %v", err).
+		return "", errs.NewValidationError(errs.SubtypeInvalidArgument, "invalid --event: %v", err).
 			WithParam("--event").
 			WithCause(err)
 	}
 	data, err := vfs.ReadFile(safePath)
 	if err != nil {
-		return commentContent{}, err
+		return "", err
 	}
 	var payload eventPayload
 	if err := json.Unmarshal(data, &payload); err != nil {
-		return commentContent{}, err
+		return "", err
 	}
 	switch {
 	case payload.Comment != nil:
-		return commentContent{Body: payload.Comment.Body, Path: payload.Comment.Path}, nil
+		return payload.Comment.Body, nil
 	case payload.Review != nil:
-		return commentContent{Body: payload.Review.Body}, nil
+		return payload.Review.Body, nil
 	default:
-		return commentContent{}, nil
+		return "", nil
 	}
 }
 

internal/qualitygate/cmd/comment-audit/main_test.go

@@ -7,11 +7,9 @@ import (
 	"errors"
 	"os"
 	"path/filepath"
-	"strconv"
 	"testing"
 
 	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/qualitygate/publiccontent"
 )
 
 func TestCommentBodyReadsSafeRelativeEventPath(t *testing.T) {
@@ -34,92 +32,11 @@ func TestCommentBodyReadsSafeRelativeEventPath(t *testing.T) {
 	if err != nil {
 		t.Fatalf("commentBody() error = %v", err)
 	}
-	if got.Body != "clean comment" || got.Path != "" {
-		t.Fatalf("comment content = %#v", got)
+	if got != "clean comment" {
+		t.Fatalf("comment body = %q", got)
 	}
 }
 
-func TestCommentBodyReadsReviewCommentPath(t *testing.T) {
-	dir := t.TempDir()
-	if err := writeTestFile(filepath.Join(dir, "event.json"), `{"comment":{"body":"test suggestion","path":"cmd/agent/list_test.go"}}`); err != nil {
-		t.Fatal(err)
-	}
-	origDir, err := os.Getwd()
-	if err != nil {
-		t.Fatal(err)
-	}
-	if err := os.Chdir(dir); err != nil {
-		t.Fatal(err)
-	}
-	t.Cleanup(func() {
-		_ = os.Chdir(origDir)
-	})
-
-	got, err := commentBody("event.json")
-	if err != nil {
-		t.Fatalf("commentBody() error = %v", err)
-	}
-	if got.Body != "test suggestion" || got.Path != "cmd/agent/list_test.go" {
-		t.Fatalf("comment content = %#v", got)
-	}
-}
-
-func TestCommentAuditUsesReviewCommentPathForFixtureClassification(t *testing.T) {
-	dir := t.TempDir()
-	body := `CLIENT_SECRET=$(security find-generic-password -w)`
-	event := `{"comment":{"body":` + strconv.Quote(body) + `,"path":"scripts/config_test.sh"}}`
-	if err := writeTestFile(filepath.Join(dir, "event.json"), event); err != nil {
-		t.Fatal(err)
-	}
-	origDir, err := os.Getwd()
-	if err != nil {
-		t.Fatal(err)
-	}
-	if err := os.Chdir(dir); err != nil {
-		t.Fatal(err)
-	}
-	t.Cleanup(func() {
-		_ = os.Chdir(origDir)
-	})
-
-	diags, err := auditEvent("event.json", "pull_request_review_comment")
-	if err != nil {
-		t.Fatalf("auditEvent() error = %v", err)
-	}
-	for _, diag := range diags {
-		if diag.Rule == "public_content_generic_credential" {
-			t.Fatalf("review comment fixture should not be a credential diagnostic: %#v", diags)
-		}
-	}
-	pathless := publiccontent.ScanComment("pull_request_review_comment", body)
-	for _, finding := range pathless {
-		if finding.Rule == "public_content_generic_credential" {
-			return
-		}
-	}
-	t.Fatalf("test precondition failed: pathless comment should be classified as a credential: %#v", pathless)
-}
-
-func TestScanCommentContentPreservesReviewCommentPath(t *testing.T) {
-	providerValue := "gh" + "p_" + "1234567890abcdef" + "1234567890abcdef" + "1234"
-	content := commentContent{
-		Body: `cfg := &Config{AccessToken: "` + providerValue + `"}`,
-		Path: "cmd/agent/list_test.go",
-	}
-
-	diags := scanCommentContent("pull_request_review_comment", content)
-	for _, diag := range diags {
-		if diag.Rule != "public_content_generic_credential" {
-			continue
-		}
-		if diag.File != content.Path {
-			t.Fatalf("credential diagnostic file = %q, want %q", diag.File, content.Path)
-		}
-		return
-	}
-	t.Fatalf("missing provider credential diagnostic: %#v", diags)
-}
-
 func TestCommentBodyRejectsUnsafeEventPath(t *testing.T) {
 	path := filepath.Join(t.TempDir(), "event.json")
 	if err := writeTestFile(path, `{"comment":{"body":"clean"}}`); err != nil {

internal/qualitygate/diff/diff_test.go

@@ -6,11 +6,10 @@ package diff
 import (
 	"context"
 	"os"
+	"os/exec"
 	"path/filepath"
 	"reflect"
 	"testing"
-
-	"github.com/larksuite/cli/internal/testutil/gitcmd"
 )
 
 func TestScopeIncludesChangedSkillAndRelatedDomain(t *testing.T) {
@@ -123,7 +122,8 @@ func writeFile(t *testing.T, repo, rel, content string) {
 
 func runGit(t *testing.T, repo string, args ...string) {
 	t.Helper()
-	cmd := gitcmd.Command(repo, args...)
+	cmd := exec.Command("git", args...)
+	cmd.Dir = repo
 	if out, err := cmd.CombinedOutput(); err != nil {
 		t.Fatalf("git %v failed: %v\n%s", args, err, out)
 	}
@@ -131,7 +131,8 @@ func runGit(t *testing.T, repo string, args ...string) {
 
 func gitOutput(t *testing.T, repo string, args ...string) string {
 	t.Helper()
-	cmd := gitcmd.Command(repo, args...)
+	cmd := exec.Command("git", args...)
+	cmd.Dir = repo
 	out, err := cmd.Output()
 	if err != nil {
 		t.Fatalf("git %v failed: %v", args, err)

internal/qualitygate/publiccontent/collect_test.go

@@ -6,11 +6,10 @@ package publiccontent
 import (
 	"context"
 	"os"
+	"os/exec"
 	"path/filepath"
 	"strings"
 	"testing"
-
-	"github.com/larksuite/cli/internal/testutil/gitcmd"
 )
 
 func TestCollectScansOnlyCurrentContributionAndMetadata(t *testing.T) {
@@ -24,10 +23,9 @@ func TestCollectScansOnlyCurrentContributionAndMetadata(t *testing.T) {
 	runGit(t, repo, "add", "baseline.md")
 	runGit(t, repo, "commit", "-m", "base")
 
-	providerValue := "ghp_" + "1234567890abcdef1234567890abcdef1234"
 	writeFile(t, filepath.Join(repo, "docs", "public.md"), `# Public change
 
-api_`+`key = "`+providerValue+`"
+api_`+`key = "example-public-key"
 `)
 	runGit(t, repo, "add", "docs/public.md")
 	runGit(t, repo, "commit", "-m", "add public doc", "-m", "Change"+"-Id: I0123456789abcdef0123456789abcdef01234567")
@@ -201,14 +199,13 @@ func TestCollectDetectsQuotedJSONCredentialAssignments(t *testing.T) {
 	runGit(t, repo, "add", "docs/public.json")
 	runGit(t, repo, "commit", "-m", "base")
 
-	providerValue := "ghp_" + "1234567890abcdef1234567890abcdef1234"
 	writeFile(t, filepath.Join(repo, "docs", "public.json"), strings.Join([]string{
-		`{"access_` + `token":"` + providerValue + `"}`,
-		`{"client_` + `secret": "` + providerValue + `"}`,
-		`{"tenantAccess` + `Token":"` + providerValue + `"}`,
-		`{"github` + `Token":"` + providerValue + `"}`,
-		`{"vendorApi` + `Key":"` + providerValue + `"}`,
-		`{"slackBot` + `Token":"xoxb_` + `1234567890abcdef"}`,
+		`{"access_` + `token":"real-json-token"}`,
+		`{"client_` + `secret": "real ` + `secret value"}`,
+		`{"tenantAccess` + `Token":"real-tenant-camel-token"}`,
+		`{"github` + `Token":"real-github-token"}`,
+		`{"vendorApi` + `Key":"real-vendor-key"}`,
+		`{"slackBot` + `Token":"xoxb-real-token"}`,
 	}, "\n")+"\n")
 	runGit(t, repo, "add", "docs/public.json")
 	runGit(t, repo, "commit", "-m", "add json config")
@@ -218,7 +215,14 @@ func TestCollectDetectsQuotedJSONCredentialAssignments(t *testing.T) {
 	for _, item := range got {
 		if item.File == "docs/public.json" && item.Rule == "public_content_generic_credential" {
 			count++
-			for _, forbidden := range []string{providerValue, "xoxb_" + "1234567890abcdef"} {
+			for _, forbidden := range []string{
+				"real-json-token",
+				"real secret value",
+				"real-tenant-camel-token",
+				"real-github-token",
+				"real-vendor-key",
+				"xoxb-real-token",
+			} {
 				if strings.Contains(item.Excerpt, forbidden) {
 					t.Fatalf("JSON credential finding leaked value %q in excerpt %q", forbidden, item.Excerpt)
 				}
@@ -302,8 +306,8 @@ func TestCollectDetectsAngleWrappedRealisticCredentialValues(t *testing.T) {
 			count++
 		}
 	}
-	if count != 2 {
-		t.Fatalf("angle-wrapped provider credential findings = %d, want 2: %#v", count, got)
+	if count != 3 {
+		t.Fatalf("angle-wrapped realistic credential findings = %d, want 3: %#v", count, got)
 	}
 }
 
@@ -334,12 +338,12 @@ func TestCollectDetectsCredentialShapedValuesUnderBenignKeys(t *testing.T) {
 			count++
 		}
 	}
-	if count != 4 {
-		t.Fatalf("provider-shaped benign-key findings = %d, want 4: %#v", count, got)
+	if count != 7 {
+		t.Fatalf("credential-shaped benign-key findings = %d, want 7: %#v", count, got)
 	}
 }
 
-func TestCollectAllowsBareIdentifierCredentialsWithMetadataSuffixes(t *testing.T) {
+func TestCollectDetectsBareIdentifierCredentialsWithMetadataSuffixes(t *testing.T) {
 	repo := newGitRepo(t)
 	writeFile(t, filepath.Join(repo, "docs", "config.yaml"), "base: true\n")
 	runGit(t, repo, "add", "docs/config.yaml")
@@ -354,11 +358,15 @@ func TestCollectAllowsBareIdentifierCredentialsWithMetadataSuffixes(t *testing.T
 	runGit(t, repo, "commit", "-m", "add credential config")
 
 	got := collectFromPreviousCommit(t, repo)
+	var count int
 	for _, item := range got {
 		if item.File == "docs/config.yaml" && item.Rule == "public_content_generic_credential" {
-			t.Fatalf("readable metadata values should not be credential findings: %#v", got)
+			count++
 		}
 	}
+	if count != 3 {
+		t.Fatalf("metadata-suffixed bare credential findings = %d, want 3: %#v", count, got)
+	}
 }
 
 func TestCollectDetectsAccessKeyCredentials(t *testing.T) {
@@ -366,7 +374,7 @@ func TestCollectDetectsAccessKeyCredentials(t *testing.T) {
 	writeFile(t, filepath.Join(repo, "docs", "config.yaml"), "base: true\n")
 	runGit(t, repo, "add", "docs/config.yaml")
 	runGit(t, repo, "commit", "-m", "base")
-	accessKey := "AK" + "IAIOSFODNN7EXAMPXX"
+	accessKey := "AK" + "IAIOSFODNN7EXAMPX"
 
 	writeFile(t, filepath.Join(repo, "docs", "config.yaml"), strings.Join([]string{
 		"AWS_ACCESS_KEY_ID: " + accessKey,
@@ -383,7 +391,7 @@ func TestCollectDetectsAccessKeyCredentials(t *testing.T) {
 			continue
 		}
 		count++
-		if strings.Contains(item.Excerpt, accessKey) {
+		if strings.Contains(item.Excerpt, "AKIAIOSFODNN7EXAMPX") {
 			t.Fatalf("access key finding leaked value in excerpt %q", item.Excerpt)
 		}
 	}
@@ -424,7 +432,7 @@ func TestCollectDetectsPrivateKeyAssignments(t *testing.T) {
 	}
 }
 
-func TestCollectAllowsCredentialValuesThatLookLikeBareIdentifiers(t *testing.T) {
+func TestCollectDetectsCredentialValuesThatLookLikeBareIdentifiers(t *testing.T) {
 	repo := newGitRepo(t)
 	writeFile(t, filepath.Join(repo, "docs", "config.yaml"), "base: true\n")
 	runGit(t, repo, "add", "docs/config.yaml")
@@ -440,11 +448,15 @@ func TestCollectAllowsCredentialValuesThatLookLikeBareIdentifiers(t *testing.T)
 	runGit(t, repo, "commit", "-m", "add credential config")
 
 	got := collectFromPreviousCommit(t, repo)
+	var count int
 	for _, item := range got {
 		if item.File == "docs/config.yaml" && item.Rule == "public_content_generic_credential" {
-			t.Fatalf("readable identifiers should not be credential findings: %#v", got)
+			count++
 		}
 	}
+	if count != 4 {
+		t.Fatalf("bare identifier credential findings = %d, want 4: %#v", count, got)
+	}
 }
 
 func TestCollectAllowsBenignUnquotedTokenFields(t *testing.T) {
@@ -477,13 +489,12 @@ func TestCollectDetectsCredentialPhraseBeforeEnvironmentSuffix(t *testing.T) {
 	runGit(t, repo, "add", "docs/config.yaml")
 	runGit(t, repo, "commit", "-m", "base")
 
-	providerValue := "ghp_" + "1234567890abcdef1234567890abcdef1234"
 	writeFile(t, filepath.Join(repo, "docs", "config.yaml"), strings.Join([]string{
-		"API_KEY_OPENAI: " + providerValue,
-		"TOKEN_GITHUB: " + providerValue,
-		"CLIENT_SECRET_GOOGLE: " + providerValue,
-		"SECRET_KEY_BASE: " + providerValue,
-		"APP_PASSWORD_PROD: " + providerValue,
+		"API_KEY_OPENAI: real-openai-key",
+		"TOKEN_GITHUB: real-github-token",
+		"CLIENT_SECRET_GOOGLE: real-google-secret",
+		"SECRET_KEY_BASE: real-secret-key-base",
+		"APP_PASSWORD_PROD: real-prod-password",
 	}, "\n")+"\n")
 	runGit(t, repo, "add", "docs/config.yaml")
 	runGit(t, repo, "commit", "-m", "add credential config")
@@ -495,7 +506,13 @@ func TestCollectDetectsCredentialPhraseBeforeEnvironmentSuffix(t *testing.T) {
 			continue
 		}
 		count++
-		for _, forbidden := range []string{providerValue} {
+		for _, forbidden := range []string{
+			"real-openai-key",
+			"real-github-token",
+			"real-google-secret",
+			"real-secret-key-base",
+			"real-prod-password",
+		} {
 			if strings.Contains(item.Excerpt, forbidden) {
 				t.Fatalf("credential finding leaked value %q in excerpt %q", forbidden, item.Excerpt)
 			}
@@ -604,8 +621,7 @@ func TestCollectSkipsOnlyKnownQualityGateFixtureFiles(t *testing.T) {
 	writeFile(t, filepath.Join(repo, "internal", "qualitygate", "publiccontent", "scan_test.go"), "SECRET_TOKEN=fixture\n")
 	writeFile(t, filepath.Join(repo, "internal", "qualitygate", "publiccontent", "scan.go"), "const privateKeyFixture = \""+privateKeyBeginPrefix+privateKeyMarker+"\"\n")
 	writeFile(t, filepath.Join(repo, "internal", "qualitygate", "publiccontent", "rules.go"), "markers := []string{\"generated with automation\"}\n")
-	providerValue := "ghp_" + "1234567890abcdef1234567890abcdef1234"
-	writeFile(t, filepath.Join(repo, "tests", "e2e", "new-public-workflow.test.sh"), "SECRET_TOKEN="+providerValue+"\n")
+	writeFile(t, filepath.Join(repo, "tests", "e2e", "new-public-workflow.test.sh"), "SECRET_TOKEN=real-leak\n")
 	runGit(t, repo, "add", ".")
 	runGit(t, repo, "commit", "-m", "add scanner fixtures")
 
@@ -669,11 +685,10 @@ func TestCollectScansAddedLinesInSpecialPathNames(t *testing.T) {
 	runGit(t, repo, "add", ".")
 	runGit(t, repo, "commit", "-m", "base")
 
-	providerValue := "ghp_" + "1234567890abcdef1234567890abcdef1234"
-	writeFile(t, filepath.Join(repo, "docs", "has space.md"), "SECRET_TOKEN="+providerValue+"\n")
-	writeFile(t, filepath.Join(repo, `weird"quote.md`), "SECRET_TOKEN="+providerValue+"\n")
+	writeFile(t, filepath.Join(repo, "docs", "has space.md"), "SECRET_TOKEN=space-value\n")
+	writeFile(t, filepath.Join(repo, `weird"quote.md`), "SECRET_TOKEN=quote-value\n")
 	runGit(t, repo, "mv", "docs/old.md", "docs/new name.md")
-	writeFile(t, filepath.Join(repo, "docs", "new name.md"), "base\nSECRET_TOKEN="+providerValue+"\n")
+	writeFile(t, filepath.Join(repo, "docs", "new name.md"), "base\nSECRET_TOKEN=rename-value\n")
 	runGit(t, repo, "add", ".")
 	runGit(t, repo, "commit", "-m", "add special paths")
 
@@ -840,7 +855,8 @@ func runGit(t *testing.T, repo string, args ...string) {
 	if len(args) > 0 && args[0] == "commit" {
 		args = append([]string{"commit", "--no-verify"}, args[1:]...)
 	}
-	cmd := gitcmd.Command(repo, args...)
+	cmd := exec.Command("git", args...)
+	cmd.Dir = repo
 	out, err := cmd.CombinedOutput()
 	if err != nil {
 		t.Fatalf("git %v failed: %v\n%s", args, err, out)
@@ -849,7 +865,8 @@ func runGit(t *testing.T, repo string, args ...string) {
 
 func runGitOutput(t *testing.T, repo string, args ...string) []byte {
 	t.Helper()
-	cmd := gitcmd.Command(repo, args...)
+	cmd := exec.Command("git", args...)
+	cmd.Dir = repo
 	out, err := cmd.CombinedOutput()
 	if err != nil {
 		t.Fatalf("git %v failed: %v\n%s", args, err, out)

internal/qualitygate/publiccontent/comment_audit.go

@@ -4,15 +4,8 @@
 package publiccontent
 
 func ScanComment(kind, body string) []Finding {
-	return ScanCommentAtPath(kind, "", body)
-}
-
-func ScanCommentAtPath(kind, path, body string) []Finding {
 	if kind == "" {
 		kind = "comment"
 	}
-	if path == "" {
-		path = kind
-	}
-	return scanText(path, "comment", body, isDetectorRuleFile(path))
+	return scanText(kind, "comment", body, false)
 }

internal/qualitygate/publiccontent/comment_audit_test.go

@@ -3,10 +3,7 @@
 
 package publiccontent
 
-import (
-	"strings"
-	"testing"
-)
+import "testing"
 
 func TestScanCommentAuditsPublishedCommentBodies(t *testing.T) {
 	got := ScanComment("issue_comment", `The published comment included /tmp/harness`+`-agent/run and CCM`+`-Harness: stage-4`)
@@ -20,60 +17,3 @@ func TestScanCommentAuditsPublishedCommentBodies(t *testing.T) {
 		}
 	}
 }
-
-func TestScanCommentAllowsMermaidCredentialTerminology(t *testing.T) {
-	body := strings.Join([]string{
-		"```mermaid",
-		"sequenceDiagram",
-		"  participant Client",
-		"  participant AccessTokenHashTransport",
-		"  participant SecurityPolicyTransport",
-		"  Client->>AccessTokenHashTransport: Send request with bearer token",
-		"  AccessTokenHashTransport->>AccessTokenHashTransport: Clone request and inject token hash",
-		"  Client -> ClientSecret: Resolve configured credential",
-		"  AccessTokenHashTransport->>SecurityPolicyTransport: Forward enriched request",
-		"```",
-	}, "\n")
-
-	got := ScanComment("issue_comment", body)
-	for _, item := range got {
-		if item.Rule == "public_content_generic_credential" {
-			t.Fatalf("mermaid credential terminology should not be a credential finding: %#v", got)
-		}
-	}
-}
-
-func TestScanCommentDetectsCredentialAssignmentInsideMermaidMessage(t *testing.T) {
-	providerValue := strings.Join([]string{"gh", "p_", "1234567890abcdef", "1234567890abcdef", "1234"}, "")
-	credentialAssignment := "password=" + providerValue
-	body := strings.Join([]string{
-		"```mermaid",
-		"sequenceDiagram",
-		"  Client->>Server: Send " + credentialAssignment,
-		"```",
-	}, "\n")
-
-	got := ScanComment("issue_comment", body)
-	if !findingRules(got)["public_content_generic_credential"] {
-		t.Fatalf("credential assignment inside mermaid message should be reported: %#v", got)
-	}
-}
-
-func TestScanCommentAtPathAllowsTestFixtureCredentialPlaceholder(t *testing.T) {
-	body := `cfg := &core.CliConfig{AppID: "cli_x", AppSecret: "fake-secret"}`
-	got := ScanCommentAtPath("pull_request_review_comment", "cmd/agent/list_test.go", body)
-	for _, item := range got {
-		if item.Rule == "public_content_generic_credential" {
-			t.Fatalf("review comment test fixture should not be a credential finding: %#v", got)
-		}
-	}
-}
-
-func TestScanCommentAtPathDetectsProviderCredentialInTestFile(t *testing.T) {
-	providerValue := strings.Join([]string{"gh", "p_", "1234567890abcdef", "1234567890abcdef", "1234"}, "")
-	body := `cfg := &Config{AccessToken: "` + providerValue + `"}`
-	got := ScanCommentAtPath("pull_request_review_comment", "cmd/agent/list_test.go", body)
-	if !findingRules(got)["public_content_generic_credential"] {
-		t.Fatalf("provider credential in review comment should be reported: %#v", got)
-	}
-}

internal/qualitygate/publiccontent/credential.go

@@ -1,88 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package publiccontent
-
-import (
-	"encoding/base64"
-	"net/url"
-	"strings"
-)
-
-func credentialValueHasStrongEvidence(key, value string) bool {
-	normalized := strings.TrimRight(strings.TrimSpace(value), ",;")
-	normalized = strings.TrimSpace(strings.Trim(normalized, `"'<>`))
-	candidates := credentialEvidenceCandidates(unwrapCredentialValue(normalized))
-	for _, candidate := range candidates {
-		if providerCredentialIdentifier(candidate) {
-			return true
-		}
-	}
-	if isCredentialMetadataField(key) {
-		return false
-	}
-	for _, candidate := range candidates {
-		if highEntropyCredentialValue(strings.ToLower(candidate)) || base64PaddedCredentialValue(candidate) {
-			return true
-		}
-	}
-	return percentEncodedCredentialValue(strings.ToLower(candidates[0])) ||
-		commandSubstitutionLooksCredentialLike(strings.ToLower(normalized))
-}
-
-func credentialEvidenceCandidates(value string) []string {
-	candidates := []string{value}
-	for range 3 {
-		decoded, err := url.PathUnescape(value)
-		if err != nil || decoded == value {
-			break
-		}
-		candidates = append(candidates, decoded)
-		value = decoded
-	}
-	return candidates
-}
-
-func isCredentialMetadataField(key string) bool {
-	if isBenignTokenField(key) {
-		return true
-	}
-	parts := credentialKeyParts(strings.ReplaceAll(strings.ToLower(key), "-", "_"))
-	if len(parts) < 2 {
-		return false
-	}
-	switch parts[len(parts)-1] {
-	case "hash", "id", "kind", "marker", "prefix", "transport":
-		return true
-	default:
-		return false
-	}
-}
-
-func base64PaddedCredentialValue(value string) bool {
-	if len(value) < 16 || !strings.HasSuffix(value, "=") {
-		return false
-	}
-	if _, err := base64.StdEncoding.DecodeString(value); err != nil {
-		return false
-	}
-	return shannonEntropy(strings.TrimRight(value, "=")) >= 3.5
-}
-
-func percentEncodedCredentialValue(value string) bool {
-	if len(value) < 16 {
-		return false
-	}
-	var escapes int
-	for i := 0; i+2 < len(value); i++ {
-		if value[i] == '%' && isHexByte(value[i+1]) && isHexByte(value[i+2]) {
-			escapes++
-			i += 2
-		}
-	}
-	return escapes >= 2
-}
-
-func isHexByte(value byte) bool {
-	return (value >= '0' && value <= '9') || (value >= 'a' && value <= 'f')
-}

internal/qualitygate/publiccontent/rules.go

@@ -13,7 +13,7 @@ import (
 )
 
 var (
-	credentialAssignmentRE = regexp.MustCompile(`(?i)["']?\b[A-Za-z0-9_-]*(?:api[_-]?key|access[_-]?key|private[_-]?key|secret|password|passwd|token|webhook|access[_-]?token|client[_-]?secret)[A-Za-z0-9_-]*\b["']?\s*(?::=|[:=])\s*(?:!!str\s+)?(?:"((?:\\.|[^"\\])*)"|'((?:\\.|[^'\\])*)'|(\x60[^\x60]*\x60)|(\$\([^)]*\))|(\$\{\{[^}]+\}\})|([^"'\x60\s,}\]]+))`)
+	credentialAssignmentRE = regexp.MustCompile(`(?i)["']?\b[A-Za-z0-9_-]*(?:api[_-]?key|access[_-]?key|private[_-]?key|secret|password|passwd|token|webhook|access[_-]?token|client[_-]?secret)[A-Za-z0-9_-]*\b["']?\s*[:=]\s*(?:"((?:\\.|[^"\\])*)"|'((?:\\.|[^'\\])*)'|(\$\([^)]*\))|(\$\{\{[^}]+\}\})|([^"'\s,}\]]+))`)
 	jwtLikeRE              = regexp.MustCompile(`\b[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b`)
 	credentialURLRE        = regexp.MustCompile(`(?i)\b[a-z][a-z0-9+.-]*://[^/\s:@]*:[^@\s/]+@[^)\s]+`)
 	bearerHeaderRE         = regexp.MustCompile(`(?i)(?:\bAuthorization\s*:\s*Bearer\s+|["']Authorization["']\s*:\s*["']Bearer\s+)[A-Za-z0-9._+/=-]{12,}`)
@@ -383,63 +383,33 @@ func anglePlaceholderIdentifier(value string) bool {
 }
 
 func credentialShapedValue(value string) bool {
-	normalized := strings.TrimSpace(strings.Trim(strings.TrimSpace(value), `"'<>`))
+	normalized := strings.ToLower(strings.Trim(value, `"'<>`))
 	return credentialShapedIdentifier(normalized)
 }
 
 func credentialShapedIdentifier(value string) bool {
-	return providerCredentialIdentifier(value)
-}
-
-func providerCredentialIdentifier(value string) bool {
-	value = strings.TrimSpace(value)
 	switch {
-	case providerTokenWithBody(value, "sk_live_", 16, ""),
-		providerTokenWithBody(value, "sk_test_", 16, ""),
-		providerTokenWithBody(value, "ghp_", 16, ""),
-		providerTokenWithBody(value, "gho_", 16, ""),
-		providerTokenWithBody(value, "ghu_", 16, ""),
-		providerTokenWithBody(value, "github_pat_", 16, "_"),
-		providerTokenWithBody(value, "xoxb_", 16, "-"),
-		providerTokenWithBody(value, "xoxp_", 16, "-"),
-		providerTokenWithBody(value, "xoxa_", 16, "-"),
-		providerTokenWithBody(value, "xoxb-", 16, "-"),
-		providerTokenWithBody(value, "xoxp-", 16, "-"),
-		providerTokenWithBody(value, "xoxa-", 16, "-"),
-		awsAccessKeyIdentifier(value):
+	case strings.HasPrefix(value, "sk_live_"),
+		strings.HasPrefix(value, "sk_test_"),
+		strings.HasPrefix(value, "ghp_"),
+		strings.HasPrefix(value, "gho_"),
+		strings.HasPrefix(value, "ghu_"),
+		strings.HasPrefix(value, "github_pat_"),
+		strings.HasPrefix(value, "xoxb_"),
+		strings.HasPrefix(value, "xoxp_"),
+		strings.HasPrefix(value, "xoxa_"):
+		return true
+	case strings.HasPrefix(value, "real-") &&
+		(strings.Contains(value, "secret") ||
+			strings.Contains(value, "token") ||
+			strings.Contains(value, "key") ||
+			strings.Contains(value, "password")):
 		return true
 	default:
 		return false
 	}
 }
 
-func providerTokenWithBody(value, prefix string, minBodyLength int, separators string) bool {
-	body, ok := strings.CutPrefix(value, prefix)
-	if !ok || len(body) < minBodyLength {
-		return false
-	}
-	for _, r := range body {
-		if (r >= 'a' && r <= 'z') || (r >= 'A' && r <= 'Z') || (r >= '0' && r <= '9') || strings.ContainsRune(separators, r) {
-			continue
-		}
-		return false
-	}
-	return true
-}
-
-func awsAccessKeyIdentifier(value string) bool {
-	if len(value) != 20 || (!strings.HasPrefix(value, "AKIA") && !strings.HasPrefix(value, "ASIA")) {
-		return false
-	}
-	for _, r := range value[4:] {
-		if (r >= 'A' && r <= 'Z') || (r >= '0' && r <= '9') {
-			continue
-		}
-		return false
-	}
-	return true
-}
-
 func resourceTokenPlaceholderValue(value string) bool {
 	normalized := strings.ToLower(strings.Trim(value, `"'`))
 	switch normalized {

internal/qualitygate/publiccontent/scan.go

@@ -47,30 +47,15 @@ func scanText(file, source, text string, detectorFile bool) []Finding {
 			out = append(out, newFinding("public_content_private_key_block", file, privateKeyLine, source, "private key block"))
 			inPrivateKey = false
 		}
-		for _, location := range credentialAssignmentRE.FindAllStringIndex(line, -1) {
-			rawMatch := line[location[0]:location[1]]
-			if !validCredentialAssignmentStart(line, location[0], rawMatch) {
-				continue
-			}
-			match := credentialAssignmentRE.FindStringSubmatch(rawMatch)
-			if !isCredentialAssignmentMatch(rawMatch) {
+		for _, match := range credentialAssignmentRE.FindAllStringSubmatch(line, -1) {
+			if !isCredentialAssignmentMatch(match[0]) {
 				continue
 			}
 			value := credentialAssignmentValue(match)
-			keyName, _ := normalizedCredentialAssignmentKey(rawMatch)
-			evidenceValue := value
-			if sourceCodeFile(file) {
-				if rhs, ok := sourceCodeTypedCredentialRHS(line, location[0], rawMatch); ok {
-					evidenceValue = rhs
-				}
-			}
-			if !(isWebhookCredentialKey(keyName) && webhookAssignmentValueLooksCredentialLike(value)) &&
-				!credentialValueHasStrongEvidence(keyName, evidenceValue) {
-				continue
-			}
+			keyName, _ := normalizedCredentialAssignmentKey(match[0])
 			if value == "" ||
 				isNonSecretLiteralValue(value) ||
-				isBenignCodeCredentialExpression(file, line, location[0], rawMatch, value) ||
+				isBenignCodeCredentialExpression(file, line, match[0], value) ||
 				isPlaceholderValue(value) ||
 				isPermissionScopeIdentifierAssignment(keyName, value) ||
 				isResourceTokenPlaceholderAssignment(keyName, value) {
@@ -79,7 +64,7 @@ func scanText(file, source, text string, detectorFile bool) []Finding {
 			if looksLikeEqualityComparison(value) {
 				continue
 			}
-			out = append(out, newFinding("public_content_generic_credential", file, lineNo, source, redactAssignment(rawMatch)))
+			out = append(out, newFinding("public_content_generic_credential", file, lineNo, source, redactAssignment(match[0])))
 		}
 		for _, match := range jwtLikeRE.FindAllString(line, -1) {
 			if !isJWTToken(match) {
@@ -138,43 +123,21 @@ func scanText(file, source, text string, detectorFile bool) []Finding {
 	return out
 }
 
-func validCredentialAssignmentStart(line string, start int, match string) bool {
-	if start <= 0 || credentialAssignmentOperator(match) != ":" {
-		return true
-	}
-	prefix := strings.TrimSpace(line[:start])
-	for _, arrow := range []string{"-->>", "->>", "-->", "->"} {
-		if strings.HasSuffix(prefix, arrow) {
-			return false
-		}
-	}
-	return true
-}
-
-func credentialAssignmentOperator(match string) string {
-	key, ok := credentialAssignmentKey(match)
-	if !ok {
-		return ""
-	}
-	rest := strings.TrimSpace(match[len(key):])
-	if strings.HasPrefix(rest, ":=") {
-		return ":="
-	}
-	if strings.HasPrefix(rest, ":") {
-		return ":"
-	}
-	if strings.HasPrefix(rest, "=") {
-		return "="
-	}
-	return ""
-}
-
 func isCredentialAssignmentMatch(match string) bool {
-	name, _, ok := normalizedCredentialAssignment(match)
+	name, value, ok := normalizedCredentialAssignment(match)
 	if !ok {
 		return false
 	}
-	return isExplicitCredentialKey(name) || isWebhookCredentialKey(name)
+	if isWebhookCredentialKey(name) && webhookAssignmentValueLooksCredentialLike(value) {
+		return true
+	}
+	if isBenignTokenField(name) && !credentialShapedValue(value) {
+		return false
+	}
+	if isWeakTokenCredentialKey(name) && !weakTokenValueLooksCredentialLike(value) {
+		return false
+	}
+	return isExplicitCredentialKey(name)
 }
 
 func normalizedCredentialAssignmentKey(match string) (string, bool) {
@@ -325,7 +288,7 @@ func tokenLikePlaceholderKey(key string) bool {
 
 func tokenLikePlaceholderValue(key, value string) bool {
 	normalized := strings.ToLower(strings.Trim(value, `"'`))
-	if normalized == "" || credentialShapedIdentifier(strings.Trim(value, `"'`)) {
+	if normalized == "" || credentialShapedIdentifier(normalized) {
 		return false
 	}
 	if authCredentialTokenKey(key) {
@@ -360,8 +323,52 @@ func maskedTokenFixturePlaceholderValue(key, value string) bool {
 	return stars >= 6 && alnum > 0
 }
 
+func isWeakTokenCredentialKey(key string) bool {
+	if authCredentialTokenKey(key) || isStrongTokenCredentialKey(key) {
+		return false
+	}
+	return key == "token" ||
+		strings.HasSuffix(key, "_token") ||
+		strings.HasSuffix(key, "-token")
+}
+
+func isStrongTokenCredentialKey(key string) bool {
+	parts := credentialKeyParts(strings.ReplaceAll(strings.ToLower(key), "-", "_"))
+	for _, phrase := range [][2]string{
+		{"access", "token"},
+		{"refresh", "token"},
+		{"auth", "token"},
+		{"bearer", "token"},
+		{"session", "token"},
+		{"service", "token"},
+		{"bot", "token"},
+		{"api", "token"},
+		{"secret", "token"},
+	} {
+		if hasAdjacentCredentialParts(parts, phrase[0], phrase[1]) {
+			return true
+		}
+	}
+	return false
+}
+
+func weakTokenValueLooksCredentialLike(value string) bool {
+	normalized := strings.ToLower(strings.Trim(value, `"'<>`))
+	if normalized == "" ||
+		isNonSecretLiteralValue(value) ||
+		isPlaceholderValue(value) {
+		return false
+	}
+	candidate := unwrapCredentialValue(normalized)
+	return credentialShapedIdentifier(candidate) ||
+		highEntropyCredentialValue(candidate) ||
+		commandSubstitutionLooksCredentialLike(normalized) ||
+		(strings.Contains(normalized, "://") &&
+			urlRemainderLooksCredentialLike(removeAnglePlaceholders(normalized)))
+}
+
 func unwrapCredentialValue(value string) string {
-	value = strings.TrimSpace(strings.Trim(value, "\"'<>`"))
+	value = strings.TrimSpace(strings.Trim(value, `"'<>`))
 	if strings.HasPrefix(value, "${{") && strings.HasSuffix(value, "}}") {
 		value = strings.TrimSpace(strings.TrimSuffix(strings.TrimPrefix(value, "${{"), "}}"))
 	}
@@ -481,20 +488,17 @@ func numericStringPlaceholderValue(value string) bool {
 	return true
 }
 
-func isBenignCodeCredentialExpression(file, line string, matchStart int, match, value string) bool {
+func isBenignCodeCredentialExpression(file, line, match, value string) bool {
 	normalized := strings.TrimSpace(value)
 	if strings.HasPrefix(normalized, "regexp.MustCompile(") {
 		return true
 	}
-	if !sourceCodeFile(file) {
+	if !sourceCodeFile(file) || credentialShapedValue(value) {
 		return false
 	}
-	if rhs, ok := sourceCodeTypedCredentialRHS(line, matchStart, match); ok {
+	if rhs, ok := sourceCodeTypedCredentialRHS(line, match); ok {
 		return isBenignTypedCredentialRHS(rhs)
 	}
-	if credentialShapedValue(value) {
-		return false
-	}
 	rawValueQuoted := credentialAssignmentRawValueQuoted(match)
 	if sourceCodeLiteralLooksNonSecret(normalized, !rawValueQuoted) {
 		return true
@@ -514,16 +518,17 @@ func isBenignCodeCredentialExpression(file, line string, matchStart int, match,
 	return codeReferenceExpression(normalized)
 }
 
-func sourceCodeTypedCredentialRHS(line string, matchStart int, match string) (string, bool) {
-	if matchStart < 0 || matchStart+len(match) > len(line) || line[matchStart:matchStart+len(match)] != match {
+func sourceCodeTypedCredentialRHS(line, match string) (string, bool) {
+	idx := strings.Index(line, match)
+	if idx < 0 {
 		return "", false
 	}
 	key, ok := credentialAssignmentKey(match)
 	if !ok {
 		return "", false
 	}
-	rest := strings.TrimSpace(line[matchStart+len(key):])
-	if !strings.HasPrefix(rest, ":") || strings.HasPrefix(rest, ":=") {
+	rest := strings.TrimSpace(line[idx+len(key):])
+	if !strings.HasPrefix(rest, ":") {
 		return "", false
 	}
 	typeAndRHS := strings.TrimSpace(strings.TrimPrefix(rest, ":"))
@@ -531,12 +536,7 @@ func sourceCodeTypedCredentialRHS(line string, matchStart int, match string) (st
 	if assignmentIdx < 0 {
 		return "", false
 	}
-	rhs := strings.TrimSpace(typeAndRHS[assignmentIdx+1:])
-	parsed := credentialAssignmentRE.FindStringSubmatch("client_secret=" + rhs)
-	if parsed == nil {
-		return rhs, true
-	}
-	return credentialAssignmentValue(parsed), true
+	return strings.TrimSpace(typeAndRHS[assignmentIdx+1:]), true
 }
 
 func isBenignTypedCredentialRHS(value string) bool {
@@ -568,7 +568,7 @@ func credentialAssignmentRawValueQuoted(match string) bool {
 
 func sourceCodeFile(file string) bool {
 	switch filepath.Ext(file) {
-	case ".go", ".js", ".jsx", ".py", ".sh", ".ts", ".tsx":
+	case ".go", ".js", ".jsx", ".py", ".ts", ".tsx":
 		return true
 	default:
 		return false
@@ -593,7 +593,6 @@ func sourceCodeLiteralLooksNonSecret(value string, allowNumeric bool) bool {
 		sourceCodeFakeOrPlaceholderLiteral(literal) ||
 		sourceCodeCredentialTermLiteral(literal) ||
 		sourceCodeCredentialPrefixLiteral(literal) ||
-		sourceCodeStringExpressionLiteral(literal) ||
 		sourceCodeVocabularyLiteral(literal) ||
 		sourceCodeSchemaTypeLiteral(literal) ||
 		benignCredentialStatusLiteral(literal)
@@ -686,18 +685,6 @@ func sourceCodeCredentialPrefixLiteral(value string) bool {
 	}
 }
 
-func sourceCodeStringExpressionLiteral(value string) bool {
-	normalized := strings.TrimSpace(value)
-	if normalized == "" ||
-		credentialShapedIdentifier(normalized) ||
-		highEntropyCredentialValue(strings.ToLower(normalized)) {
-		return false
-	}
-	return strings.Contains(normalized, "${") ||
-		strings.Contains(normalized, "$(") ||
-		(strings.Contains(normalized, `\b`) && strings.ContainsAny(normalized, "|[]{}()+*?"))
-}
-
 func sourceCodeVocabularyLiteral(value string) bool {
 	switch strings.ToLower(value) {
 	case "bot", "tenant", "user":
@@ -766,7 +753,7 @@ func codeIdentifier(value string) bool {
 
 func isNonSecretLiteralValue(value string) bool {
 	switch strings.ToLower(strings.TrimSpace(strings.Trim(value, `"'`))) {
-	case "true", "false", "null", "nil", "{", "[", `\`:
+	case "true", "false", "null", "nil", "{", "[":
 		return true
 	default:
 		return false
@@ -993,7 +980,6 @@ func credentialURLPasswordFixture(password string) bool {
 	normalized := strings.ToLower(strings.Trim(password, `"'`))
 	switch normalized {
 	case "p",
-		"p%40ss",
 		"pass",
 		"password",
 		"pat_abc",

internal/qualitygate/publiccontent/scan_test.go

@@ -251,22 +251,26 @@ func TestScanFileDoesNotTreatURLEncodedCredentialAsPlaceholder(t *testing.T) {
 	}
 }
 
-func TestScanFileAllowsReadablePlaceholderMarkerSubstrings(t *testing.T) {
+func TestScanFileDoesNotTreatPlaceholderMarkerSubstringsAsPlaceholders(t *testing.T) {
 	got := ScanFile("docs/config.md", []byte(strings.Join([]string{
 		"API_KEY=notredactedreal",
 		"API_KEY=notplaceholdersecret",
 		"API_KEY=abcxxxxreal",
 	}, "\n")+"\n"))
+	var count int
 	for _, item := range got {
 		if item.Rule == "public_content_generic_credential" {
-			t.Fatalf("readable credential words should not be findings: %#v", got)
+			count++
 		}
 	}
+	if count != 3 {
+		t.Fatalf("placeholder-marker substring findings = %d, want 3: %#v", count, got)
+	}
 }
 
 func TestScanFileDetectsBase64PaddedCredentialAssignments(t *testing.T) {
 	paddedSecretPrefix := "dGhpc2lz" + "YXNlY3JldA"
-	paddedTokenPrefix := "UTdrMm1O" + "OXBSNHZYOA"
+	paddedTokenPrefix := "YWJj" + "ZGVmZ2g"
 	paddedSecret := base64PaddedFixture(paddedSecretPrefix)
 	paddedToken := base64PaddedFixture(paddedTokenPrefix)
 	got := ScanFile("docs/config.md", []byte(strings.Join([]string{
@@ -290,25 +294,17 @@ func TestScanFileDetectsBase64PaddedCredentialAssignments(t *testing.T) {
 	}
 }
 
-func TestScanFileAllowsReadableBase64Lookalike(t *testing.T) {
-	got := ScanFile("docs/config.md", []byte("client_secret=placeholder=\n"))
-	if findingRules(got)["public_content_generic_credential"] {
-		t.Fatalf("readable base64 lookalike should not be a credential finding: %#v", got)
-	}
-}
-
 func TestScanFileDetectsQuotedJSONCredentialAssignments(t *testing.T) {
-	providerValue := "ghp_" + "1234567890abcdef1234567890abcdef1234"
-	jsonToken := providerValue
-	jsonSecret := providerValue
-	jsonKey := providerValue
-	jsonTenantToken := providerValue
-	jsonAppSecret := providerValue
-	jsonPrefixedKey := providerValue
-	jsonTenantCamelToken := providerValue
-	jsonGithubToken := providerValue
-	jsonVendorKey := providerValue
-	jsonSlackBotToken := "xoxb_" + "1234567890abcdef"
+	jsonToken := "real-json-token"
+	jsonSecret := "real " + "secret value"
+	jsonKey := "real-json-key"
+	jsonTenantToken := "real-tenant-json-token"
+	jsonAppSecret := "real-app-secret"
+	jsonPrefixedKey := "real-prefixed-key"
+	jsonTenantCamelToken := "real-tenant-camel-token"
+	jsonGithubToken := "real-github-token"
+	jsonVendorKey := "real-vendor-key"
+	jsonSlackBotToken := "xoxb-real-token"
 	got := ScanFile("docs/public.json", []byte(strings.Join([]string{
 		`{"access_` + `token":"` + jsonToken + `"}`,
 		`{"client_` + `secret": "` + jsonSecret + `"}`,
@@ -338,13 +334,12 @@ func TestScanFileDetectsQuotedJSONCredentialAssignments(t *testing.T) {
 }
 
 func TestScanFileDetectsCredentialPhraseBeforeEnvironmentSuffix(t *testing.T) {
-	providerValue := "ghp_" + "1234567890abcdef1234567890abcdef1234"
 	got := ScanFile("docs/config.yaml", []byte(strings.Join([]string{
-		"API_KEY_OPENAI: " + providerValue,
-		"TOKEN_GITHUB: " + providerValue,
-		"CLIENT_SECRET_GOOGLE: " + providerValue,
-		"SECRET_KEY_BASE: " + providerValue,
-		"APP_PASSWORD_PROD: " + providerValue,
+		"API_KEY_OPENAI: real-openai-key",
+		"TOKEN_GITHUB: real-github-token",
+		"CLIENT_SECRET_GOOGLE: real-google-secret",
+		"SECRET_KEY_BASE: real-secret-key-base",
+		"APP_PASSWORD_PROD: real-prod-password",
 	}, "\n")+"\n"))
 	var count int
 	for _, item := range got {
@@ -352,7 +347,13 @@ func TestScanFileDetectsCredentialPhraseBeforeEnvironmentSuffix(t *testing.T) {
 			continue
 		}
 		count++
-		for _, forbidden := range []string{providerValue} {
+		for _, forbidden := range []string{
+			"real-openai-key",
+			"real-github-token",
+			"real-google-secret",
+			"real-secret-key-base",
+			"real-prod-password",
+		} {
 			if strings.Contains(item.Excerpt, forbidden) {
 				t.Fatalf("credential finding leaked value %q in excerpt %q", forbidden, item.Excerpt)
 			}
@@ -363,77 +364,85 @@ func TestScanFileDetectsCredentialPhraseBeforeEnvironmentSuffix(t *testing.T) {
 	}
 }
 
-func TestScanFileAllowsCredentialValuesThatLookLikeBareIdentifiers(t *testing.T) {
+func TestScanFileDetectsCredentialValuesThatLookLikeBareIdentifiers(t *testing.T) {
 	got := ScanFile("docs/config.yaml", []byte(strings.Join([]string{
 		"API_KEY_OPENAI: prod_key",
 		"CLIENT_SECRET_GOOGLE: prod_secret",
 		"TOKEN_GITHUB: github_token",
 		"APP_PASSWORD_PROD: prod_password",
 	}, "\n")+"\n"))
+	var count int
 	for _, item := range got {
 		if item.Rule == "public_content_generic_credential" {
-			t.Fatalf("readable identifiers should not be credential findings: %#v", got)
+			count++
 		}
 	}
+	if count != 4 {
+		t.Fatalf("bare identifier credential findings = %d, want 4: %#v", count, got)
+	}
 }
 
 func TestScanFileDetectsAngleWrappedRealisticCredentialValues(t *testing.T) {
 	stripeLike := "sk_" + "live_1234567890abcdef"
 	patLike := "gh" + "p_1234567890abcdef1234567890abcdef1234"
-	cases := []struct {
-		name string
-		text string
-		want bool
-	}{
-		{name: "stripe", text: "API_KEY: <" + stripeLike + ">", want: true},
-		{name: "github", text: "SECRET_TOKEN: <" + patLike + ">", want: true},
-		{name: "readable", text: "CLIENT_SECRET: <real-client-secret-value>", want: false},
+	got := ScanFile("docs/config.yaml", []byte(strings.Join([]string{
+		"API_KEY: <" + stripeLike + ">",
+		"SECRET_TOKEN: <" + patLike + ">",
+		"CLIENT_SECRET: <real-client-secret-value>",
+	}, "\n")+"\n"))
+	var count int
+	for _, item := range got {
+		if item.Rule == "public_content_generic_credential" {
+			count++
+		}
 	}
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			assertGenericCredentialFinding(t, "docs/config.yaml", tc.text, tc.want)
-		})
+	if count != 3 {
+		t.Fatalf("angle-wrapped realistic credential findings = %d, want 3: %#v", count, got)
 	}
 }
 
 func TestScanFileDetectsCredentialShapedValuesUnderBenignKeys(t *testing.T) {
 	stripeLike := "sk_" + "live_1234567890abcdef"
 	patLike := "gh" + "p_1234567890abcdef1234567890abcdef1234"
-	cases := []struct {
-		name string
-		text string
-		want bool
-	}{
-		{name: "expiry provider token", text: `{"access_token_expires_in":"` + patLike + `"}`, want: true},
-		{name: "expiry provider secret", text: `{"refresh_token_expires_in":"` + stripeLike + `"}`, want: true},
-		{name: "status readable", text: `{"client_secret_status":"real-client-secret-value"}`, want: false},
-		{name: "name readable", text: `{"client_secret_name":"real-client-secret-value"}`, want: false},
-		{name: "app provider token", text: `{"app_token":"` + patLike + `"}`, want: true},
-		{name: "sync provider secret", text: `{"sync_token":"` + stripeLike + `"}`, want: true},
-		{name: "target readable", text: `{"target_token":"real-client-secret-value"}`, want: false},
+	got := ScanFile("docs/public.json", []byte(strings.Join([]string{
+		`{"access_token_expires_in":"` + patLike + `"}`,
+		`{"refresh_token_expires_in":"` + stripeLike + `"}`,
+		`{"client_secret_status":"real-client-secret-value"}`,
+		`{"client_secret_name":"real-client-secret-value"}`,
+		`{"app_token":"` + patLike + `"}`,
+		`{"sync_token":"` + stripeLike + `"}`,
+		`{"target_token":"real-client-secret-value"}`,
+	}, "\n")+"\n"))
+	var count int
+	for _, item := range got {
+		if item.Rule == "public_content_generic_credential" {
+			count++
+		}
 	}
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			assertGenericCredentialFinding(t, "docs/public.json", tc.text, tc.want)
-		})
+	if count != 7 {
+		t.Fatalf("credential-shaped benign-key findings = %d, want 7: %#v", count, got)
 	}
 }
 
-func TestScanFileAllowsBareIdentifierCredentialsWithMetadataSuffixes(t *testing.T) {
+func TestScanFileDetectsBareIdentifierCredentialsWithMetadataSuffixes(t *testing.T) {
 	got := ScanFile("docs/config.yaml", []byte(strings.Join([]string{
 		"API_KEY_NAME: prod_key",
 		"CLIENT_SECRET_NAME: prod_secret",
 		"SECRET_STATUS: prod_secret",
 	}, "\n")+"\n"))
+	var count int
 	for _, item := range got {
 		if item.Rule == "public_content_generic_credential" {
-			t.Fatalf("readable metadata values should not be credential findings: %#v", got)
+			count++
 		}
 	}
+	if count != 3 {
+		t.Fatalf("metadata-suffixed bare credential findings = %d, want 3: %#v", count, got)
+	}
 }
 
 func TestScanFileDetectsAccessKeyCredentials(t *testing.T) {
-	accessKey := "AK" + "IAIOSFODNN7EXAMPXX"
+	accessKey := "AK" + "IAIOSFODNN7EXAMPX"
 	got := ScanFile("docs/config.yaml", []byte(strings.Join([]string{
 		"AWS_ACCESS_KEY_ID: " + accessKey,
 		"ACCESS_KEY_ID: " + accessKey,
@@ -584,18 +593,18 @@ func TestScanFileAllowsCredentialReferenceValues(t *testing.T) {
 
 func TestScanFileDetectsMalformedGithubExpressionCredentialValues(t *testing.T) {
 	stripeLike := "sk_" + "live_1234567890abcdef"
-	cases := []struct {
-		name string
-		text string
-		want bool
-	}{
-		{name: "provider", text: "API_KEY=${{" + stripeLike + "}}", want: true},
-		{name: "readable", text: "TOKEN=${{real-secret-token-value}}", want: false},
+	got := ScanFile("docs/config.yaml", []byte(strings.Join([]string{
+		"API_KEY=${{" + stripeLike + "}}",
+		"TOKEN=${{real-secret-token-value}}",
+	}, "\n")+"\n"))
+	var count int
+	for _, item := range got {
+		if item.Rule == "public_content_generic_credential" {
+			count++
+		}
 	}
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			assertGenericCredentialFinding(t, "docs/config.yaml", tc.text, tc.want)
-		})
+	if count != 2 {
+		t.Fatalf("malformed GitHub expression credential findings = %d, want 2: %#v", count, got)
 	}
 }
 
@@ -639,7 +648,6 @@ func TestScanFileAllowsCredentialURLPlaceholders(t *testing.T) {
 func TestScanFileAllowsCredentialURLFixtures(t *testing.T) {
 	got := ScanFile("fixtures/network_test.go", []byte(strings.Join([]string{
 		`proxy := "http://user:pass@proxy:8080"`,
-		`proxy := "http://user:p%40ss@proxy:8080/path"`,
 		`repo := "https://u:t@h/r.git"`,
 		`target := "https://attacker:pw@open.feishu.cn"`,
 		`proxy := "http://admin:s3cret@127.0.0.1:3128"`,
@@ -813,151 +821,35 @@ func TestScanFileDetectsWeakTokenFieldsWithHighConfidenceCredentialValues(t *tes
 	}
 }
 
-func TestScanFileAllowsStrongAuthTokenKeysWithoutStrongValueEvidence(t *testing.T) {
+func TestScanFileDetectsStrongAuthTokenKeysWithFixtureLikeValues(t *testing.T) {
 	got := ScanFile("docs/config.md", []byte(strings.Join([]string{
 		`{"access_token":"img_abc123"}`,
 		`{"api_token":"img_live_secret"}`,
 		`{"service_token":"ab********cd"}`,
 		`{"bot_token":"board_v3_example"}`,
 	}, "\n")+"\n"))
-	for _, item := range got {
-		if item.Rule == "public_content_generic_credential" {
-			t.Fatalf("token field names alone should not produce findings: %#v", got)
-		}
-	}
-}
-
-func TestScanFileAllowsTestFixtureSecretValues(t *testing.T) {
-	got := ScanFile("fixtures/calendar_meeting_test.go", []byte(strings.Join([]string{
-		`AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,`,
-		`cfg := &core.CliConfig{AppID: "a", AppSecret: "s"}`,
-		`os.WriteFile(path, []byte("FEISHU_APP_ID=cli_abc\nFEISHU_APP_SECRET=secret\n"), 0600)`,
-		`rt := &stubRoundTripper{respBody: ` + "`" + `{"access_token":"t","token_type":"Bearer"}` + "`" + `}`,
-		`envContent := "FEISHU_APP_ID=cli_hermes_abc\nFEISHU_APP_SECRET=hermes_secret_123\nFEISHU_DOMAIN=lark\n"`,
-		`os.WriteFile(path, []byte("FEISHU_APP_ID=cli_auto\nFEISHU_APP_SECRET=auto_secret\n"), 0600)`,
-		`os.WriteFile(path, []byte("FEISHU_APP_ID=cli_new_app\nFEISHU_APP_SECRET=new_secret\n"), 0600)`,
-		`if got := out.String(); got != "username=x-access-token\npassword=valid-pat\n\n" {`,
-		`if got := out.String(); got != "username=x-access-token\npassword=restored-pat\n\n" {`,
-		`if got := stdout.String(); got != "username=x-access-token\npassword=pat-token\n\n" {`,
-		`return &core.CliConfig{AppID: "dummy", AppSecret: "dummy"}`,
-		`os.WriteFile(path, []byte("API_KEY=replace-me\n"), 0600)`,
-		`body := "APP_ID=\"cli_xxxxx\"\nAPP_SECRET=\"xxxxx\"\n"`,
-	}, "\n")+"\n"))
-	for _, item := range got {
-		if item.Rule == "public_content_generic_credential" {
-			t.Fatalf("test fixture secret should not be credential finding: %#v", got)
-		}
-	}
-}
-
-func TestScanFileAllowsCredentialIdentifierFields(t *testing.T) {
-	got := ScanFile("fixtures/openapi_key_test.go", []byte(strings.Join([]string{
-		`"api_key_id": "k1",`,
-		`"secret_id": "s1",`,
-		`"token_id": "t1",`,
-		`"private_key_id": "pk1",`,
-	}, "\n")+"\n"))
-	for _, item := range got {
-		if item.Rule == "public_content_generic_credential" {
-			t.Fatalf("credential identifier fields should not be credential findings: %#v", got)
-		}
-	}
-}
-
-func TestScanFileDetectsCredentialShapedIdentifierFieldValues(t *testing.T) {
-	stripeLike := "sk_" + "live_1234567890abcdef"
-	githubToken := "ghp_" + "1234567890abcdef1234567890abcdef1234"
-	got := ScanFile("fixtures/openapi_key_test.go", []byte(strings.Join([]string{
-		`"api_key_id": "` + stripeLike + `",`,
-		`"token_id": "` + githubToken + `",`,
-	}, "\n")+"\n"))
 	var count int
 	for _, item := range got {
 		if item.Rule == "public_content_generic_credential" {
 			count++
 		}
 	}
-	if count != 2 {
-		t.Fatalf("credential-shaped identifier field findings = %d, want 2: %#v", count, got)
+	if count != 4 {
+		t.Fatalf("strong auth token key findings = %d, want 4: %#v", count, got)
 	}
 }
 
-func TestCredentialShapedValueTrimsWhitespaceBeforeDelimiters(t *testing.T) {
-	providerValue := "ghp_" + "1234567890abcdef1234567890abcdef1234"
-	if !credentialShapedValue(` "` + providerValue + `" `) {
-		t.Fatal("space-padded quoted provider credential should be recognized")
-	}
-}
-
-func TestScanFileDetectsProviderCredentialsAcrossAssignmentSyntaxes(t *testing.T) {
-	providerValue := strings.Join([]string{"gh", "p_", "1234567890abcdef", "1234567890abcdef", "1234"}, "")
-	tests := []struct {
-		name string
-		path string
-		text string
-	}{
-		{name: "Go raw string", path: "pkg/config.go", text: "const clientSecret = `" + providerValue + "`"},
-		{name: "TypeScript template literal", path: "pkg/config.ts", text: "const clientSecret = `" + providerValue + "`;"},
-		{name: "shell backtick", path: "scripts/config.sh", text: "client_secret=`" + providerValue + "`"},
-		{name: "YAML string tag", path: "docs/config.yaml", text: "client_secret: !!str " + providerValue},
-		{name: "YAML string tag double quoted", path: "docs/config.yaml", text: `client_secret: !!str "` + providerValue + `"`},
-		{name: "YAML string tag single quoted", path: "docs/config.yaml", text: `client_secret: !!str '` + providerValue + `'`},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			got := ScanFile(tt.path, []byte(tt.text+"\n"))
-			if !findingRules(got)["public_content_generic_credential"] {
-				t.Fatalf("provider credential should be reported: %#v", got)
-			}
-		})
-	}
-}
-
-func TestScanFileDetectsPercentEncodedProviderCredential(t *testing.T) {
-	providerBody := strings.Join([]string{"1234567890abcdef", "1234567890abcdef", "1234"}, "")
-	tests := []string{
-		"access_token: ghp%" + "5F" + providerBody,
-		"access_token_hash: ghp%" + "255F" + providerBody,
-	}
-	for _, text := range tests {
-		got := ScanFile("docs/config.yaml", []byte(text+"\n"))
-		if !findingRules(got)["public_content_generic_credential"] {
-			t.Fatalf("percent-encoded provider credential should be reported: %#v", got)
-		}
-	}
-}
-
-func TestScanFileRequiresCompleteProviderCredentialFormats(t *testing.T) {
-	got := ScanFile("docs/config.yaml", []byte(strings.Join([]string{
-		"token_type: asian",
-		"token_prefix: ASIA",
-		"token_prefix: ghp_",
-		"api_key: sk_live_example",
-		"token_prefix: asianmarketsegment01",
-		"token_prefix: ghp_placeholder_value",
-	}, "\n")+"\n"))
+func TestScanFileAllowsTestFixtureSecretValues(t *testing.T) {
+	got := ScanFile("fixtures/calendar_meeting_test.go", []byte(`AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,`+"\n"))
 	for _, item := range got {
 		if item.Rule == "public_content_generic_credential" {
-			t.Fatalf("incomplete provider prefixes should not be credential findings: %#v", got)
-		}
-	}
-}
-
-func TestScanFileAllowsEncodedTokenMetadataURL(t *testing.T) {
-	got := ScanFile("docs/config.yaml", []byte("token_url: https%3A%2F%2Fexample.invalid/oauth/token\n"))
-	for _, item := range got {
-		if item.Rule == "public_content_generic_credential" {
-			t.Fatalf("encoded token metadata URL should not be credential finding: %#v", got)
+			t.Fatalf("test fixture secret should not be credential finding: %#v", got)
 		}
 	}
 }
 
 func TestScanFileAllowsRegexpTokenValidators(t *testing.T) {
-	got := ScanFile("fixtures/minutes_detail.go", []byte(strings.Join([]string{
-		"var validMinuteTokenDetail = regexp.MustCompile(`^[a-z0-9]+$`)",
-		"REALISTIC_TOKEN_RE=\"\\\"${TOKEN_BODY}\\\"|\\`${TOKEN_BODY}\\`|\\\\b${TOKEN_BODY}\\\\b\"",
-	}, "\n")+"\n"))
+	got := ScanFile("fixtures/minutes_detail.go", []byte("var validMinuteTokenDetail = regexp.MustCompile(`^[a-z0-9]+$`)\n"))
 	for _, item := range got {
 		if item.Rule == "public_content_generic_credential" {
 			t.Fatalf("regexp token validator should not be credential finding: %#v", got)
@@ -1035,22 +927,6 @@ func TestScanFileAllowsSourceCodeCredentialNonSecretLiterals(t *testing.T) {
 	}
 }
 
-func TestScanFileAllowsSourceCodeSyntheticCredentialIdentifiers(t *testing.T) {
-	got := ScanFile("fixtures/sheets_media.go", []byte(strings.Join([]string{
-		`const fakeOfficeTokenPrefix = "fake_office_"`,
-		`const localOfficeTokenPrefix = "local_office_"`,
-		`const imageLiveSecretMarker = "img_live_secret"`,
-		`const imageProdKeyMarker = "img_prod_key"`,
-		`if strings.HasPrefix(spreadsheetToken, fakeOfficeTokenPrefix) {`,
-		`if strings.HasPrefix(spreadsheetToken, localOfficeTokenPrefix) {`,
-	}, "\n")+"\n"))
-	for _, item := range got {
-		if item.Rule == "public_content_generic_credential" {
-			t.Fatalf("source code token prefix references should not be credential findings: %#v", got)
-		}
-	}
-}
-
 func TestScanFileAllowsCredentialLikePublicPlaceholders(t *testing.T) {
 	got := ScanFile("fixtures/placeholders.md", []byte(strings.Join([]string{
 		`app_secret=***`,
@@ -1065,18 +941,22 @@ func TestScanFileAllowsCredentialLikePublicPlaceholders(t *testing.T) {
 	}
 }
 
-func TestScanFileAllowsPartiallyMaskedCredentialValues(t *testing.T) {
+func TestScanFileDetectsPartiallyMaskedCredentialValues(t *testing.T) {
 	got := ScanFile("fixtures/config.md", []byte(strings.Join([]string{
 		"client_secret=realprefix***realsuffix",
 		"client_secret=ab********cd",
 		"access_token=ab********cd",
 		"refresh_token=realprefix********realsuffix",
 	}, "\n")+"\n"))
+	var count int
 	for _, item := range got {
 		if item.Rule == "public_content_generic_credential" {
-			t.Fatalf("partially masked values should not be credential findings: %#v", got)
+			count++
 		}
 	}
+	if count != 4 {
+		t.Fatalf("partially masked credential findings = %d, want 4: %#v", count, got)
+	}
 }
 
 func TestScanFileAllowsDryRunCredentialPlaceholders(t *testing.T) {
@@ -1092,7 +972,6 @@ func TestScanFileAllowsDryRunCredentialPlaceholders(t *testing.T) {
 }
 
 func TestScanFileDetectsTypedCredentialAssignmentsWithSecretRHS(t *testing.T) {
-	providerValue := "ghp_" + "1234567890abcdef1234567890abcdef1234"
 	cases := []struct {
 		name string
 		file string
@@ -1101,47 +980,32 @@ func TestScanFileDetectsTypedCredentialAssignmentsWithSecretRHS(t *testing.T) {
 		{
 			name: "typescript simple secret",
 			file: "fixtures/source_secret.ts",
-			text: `const clientSecret: string = "` + providerValue + `"`,
+			text: `const clientSecret: string = "real-client-secret-value"`,
 		},
 		{
-			name: "typescript terminated secret",
+			name: "typescript numeric password",
 			file: "fixtures/source_secret.ts",
-			text: `const clientSecret: string = "` + providerValue + `";`,
-		},
-		{
-			name: "typescript secret with trailing comment",
-			file: "fixtures/source_secret.ts",
-			text: `const clientSecret: string = "` + providerValue + `"; // production`,
-		},
-		{
-			name: "typescript asserted secret",
-			file: "fixtures/source_secret.ts",
-			text: `const clientSecret: string = "` + providerValue + `" as const;`,
-		},
-		{
-			name: "typescript provider password",
-			file: "fixtures/source_secret.ts",
-			text: `const password: string = "` + providerValue + `"`,
+			text: `const password: string = "12345678901234567890"`,
 		},
 		{
 			name: "typescript union secret",
 			file: "fixtures/source_secret.ts",
-			text: `const clientSecret: string | undefined = "` + providerValue + `"`,
+			text: `const clientSecret: string | undefined = "real-client-secret-value"`,
 		},
 		{
 			name: "python simple secret",
 			file: "fixtures/source_secret.py",
-			text: `self.client_secret: str = "` + providerValue + `"`,
+			text: `self.client_secret: str = "real-client-secret-value"`,
 		},
 		{
 			name: "python union secret",
 			file: "fixtures/source_secret.py",
-			text: `self.client_secret: str | None = "` + providerValue + `"`,
+			text: `self.client_secret: str | None = "real-client-secret-value"`,
 		},
 		{
 			name: "python optional secret",
 			file: "fixtures/source_secret.py",
-			text: `self.client_secret: Optional[str] = "` + providerValue + `"`,
+			text: `self.client_secret: Optional[str] = "real-client-secret-value"`,
 		},
 	}
 	for _, tc := range cases {
@@ -1154,154 +1018,24 @@ func TestScanFileDetectsTypedCredentialAssignmentsWithSecretRHS(t *testing.T) {
 	}
 }
 
-func TestScanFileDetectsRepeatedTypedCredentialAssignments(t *testing.T) {
-	providerValue := "ghp_" + "1234567890abcdef1234567890abcdef1234"
-	assertGenericCredentialFinding(t, "fixtures/source_secret.ts", `const clientSecret: string = "placeholder";`, false)
-	assertGenericCredentialFinding(t, "fixtures/source_secret.ts", `const clientSecret: string = "`+providerValue+`";`, true)
-
-	got := ScanFile("fixtures/source_secret.ts", []byte(
-		`const clientSecret: string = "placeholder"; const clientSecret: string = "`+providerValue+`";`+"\n",
-	))
-	var count int
-	for _, item := range got {
-		if item.Rule == "public_content_generic_credential" {
-			count++
-		}
-	}
-	if count != 1 {
-		t.Fatalf("repeated typed credential findings = %d, want 1: %#v", count, got)
-	}
-}
-
 func TestScanFileDetectsCredentialShapedSourceCodeLiterals(t *testing.T) {
-	stripeLike := "sk_" + "live_1234567890abcdef"
 	githubToken := "ghp_" + "1234567890abcdef1234567890abcdef1234"
-	cases := []struct {
-		name string
-		text string
-		want bool
-	}{
-		{name: "stripe", text: `const ClientSecret = "` + stripeLike + `"`, want: true},
-		{name: "github", text: `const GithubToken = "` + githubToken + `"`, want: true},
-		{name: "password number", text: `const Password = "12345678901234567890"`, want: false},
-		{name: "secret number", text: `const ClientSecretNumber = "12345678901234567890"`, want: false},
-		{name: "format literal", text: `const ClientSecretFormat = "abc%sdefreal"`, want: false},
-		{name: "inline format literal", text: `fmt.Println("done"); const ClientSecret = "abc%sdefreal"`, want: false},
-	}
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			assertGenericCredentialFinding(t, "fixtures/source_secret.go", tc.text, tc.want)
-		})
-	}
-}
-
-func TestScanFileDetectsGoShortDeclarationCredentials(t *testing.T) {
-	providerSecret := "sk_" + "live_1234567890abcdef"
-	providerToken := "ghp_" + "1234567890abcdef1234567890abcdef1234"
 	got := ScanFile("fixtures/source_secret.go", []byte(strings.Join([]string{
-		`clientSecret := "` + providerSecret + `"`,
-		`accessToken := "` + providerToken + `"`,
+		`const ClientSecret = "real-client-secret-value"`,
+		`const GithubToken = "` + githubToken + `"`,
+		`const Password = "12345678901234567890"`,
+		`const ClientSecretNumber = "12345678901234567890"`,
+		`const ClientSecretFormat = "abc%sdefreal"`,
+		`fmt.Println("done"); const ClientSecret = "abc%sdefreal"`,
 	}, "\n")+"\n"))
-
 	var count int
 	for _, item := range got {
 		if item.Rule == "public_content_generic_credential" {
 			count++
 		}
 	}
-	if count != 2 {
-		t.Fatalf("Go short declaration credential findings = %d, want 2: %#v", count, got)
-	}
-}
-
-func TestGenericCredentialDecisionMatrix(t *testing.T) {
-	providerToken := "ghp_" + "1234567890abcdef1234567890abcdef1234"
-	highEntropyValue := "Q7k2mN9pR4vX8cL3" + "sT6yU1aD5fG0hJ2z"
-	tokenHash := "6f1ed002ab559585" + "9014ebf0951522d9" +
-		"a0e3c1f4206254d" + "28a13efbbc8d56a30"
-	tests := []struct {
-		name    string
-		path    string
-		text    string
-		comment bool
-		want    bool
-	}{
-		{name: "source synthetic token prefix", path: "pkg/sheets.go", text: `const localOfficeTokenPrefix = "local_office_"`, want: false},
-		{name: "source token kind state", path: "pkg/client.py", text: `self._token_kind: TokenKind | None = None`, want: false},
-		{name: "documentation token prefix", path: "docs/config.yaml", text: `token_prefix: local_office_`, want: false},
-		{name: "documentation token kind", path: "docs/config.yaml", text: `token_kind: bearer`, want: false},
-		{name: "documentation token hash", path: "docs/config.yaml", text: `access_token_hash: ` + tokenHash, want: false},
-		{name: "comment fixture placeholder", text: `AppSecret: "fake-secret"`, comment: true, want: false},
-		{name: "test fixture placeholder", path: "pkg/config_test.go", text: `AppSecret: "fake-secret"`, want: false},
-		{name: "test real-labeled token", path: "pkg/config_test.go", text: `token: "real-tenant-access-token"`, want: false},
-		{name: "test ambiguous concrete secret word", path: "pkg/config_test.go", text: `AppSecret: "supersecret"`, want: false},
-		{name: "resource token placeholder", path: "docs/images.md", text: `"token": "img_abc123"`, want: false},
-		{name: "partially masked token", path: "docs/auth.md", text: `token=ab********cd`, want: false},
-		{name: "source readable secret words", path: "pkg/config.go", text: `const AppSecret = "customer-prod-secret"`, want: false},
-		{name: "documentation readable secret words", path: "docs/config.yaml", text: `client_secret: customer-prod-secret`, want: false},
-		{name: "comment middle fixture marker", text: `API_KEY=prod-fake-key`, comment: true, want: false},
-		{name: "comment negated fixture marker", text: `AppSecret: "not-fake-secret"`, comment: true, want: false},
-		{name: "source with credential words", path: "pkg/config.go", text: `secretWithPassword := "hunter2"`, want: false},
-		{name: "production filename containing sample", path: "pkg/sampler.go", text: `clientSecret := "customer-prod-secret"`, want: false},
-		{name: "provider token under weak key", path: "docs/config.yaml", text: `token: ` + providerToken, want: true},
-		{name: "provider token under hash key", path: "docs/config.yaml", text: `access_token_hash: ` + providerToken, want: true},
-		{name: "high entropy strong secret", path: "docs/config.yaml", text: `client_secret: ` + highEntropyValue, want: true},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			var got []Finding
-			if tt.comment {
-				got = ScanComment("issue_comment", tt.text)
-			} else {
-				got = ScanFile(tt.path, []byte(tt.text+"\n"))
-			}
-			if actual := findingRules(got)["public_content_generic_credential"]; actual != tt.want {
-				t.Fatalf("generic credential finding = %v, want %v: %#v", actual, tt.want, got)
-			}
-		})
-	}
-}
-
-func TestScanFileClassifiesLowEvidenceTestFixtureCredentials(t *testing.T) {
-	providerToken := "ghp_" + "1234567890abcdef1234567890abcdef1234"
-	highEntropyValue := "Q7k2mN9pR4vX8cL3" + "sT6yU1aD5fG0hJ2z"
-	tests := []struct {
-		name  string
-		value string
-		want  bool
-	}{
-		{name: "human readable access token", value: "user-access-token", want: false},
-		{name: "delimited secret value", value: "secret-value", want: false},
-		{name: "underscored secret fixture", value: "plain_secret", want: false},
-		{name: "short delimited fixture", value: "t-abc", want: false},
-		{name: "embedded test marker", value: "perm-grant-test-secret-skip", want: false},
-		{name: "real labeled fixture", value: "real-token", want: false},
-		{name: "ambiguous concrete word", value: "supersecret", want: false},
-		{name: "provider token", value: providerToken, want: true},
-		{name: "high entropy secret", value: highEntropyValue, want: true},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			got := ScanFile("pkg/config_test.go", []byte(`AppSecret: "`+tt.value+`"`+"\n"))
-			if actual := findingRules(got)["public_content_generic_credential"]; actual != tt.want {
-				t.Fatalf("generic credential finding = %v, want %v: %#v", actual, tt.want, got)
-			}
-		})
-	}
-}
-
-func TestScanFileAllowsLowEvidenceTestFixtureAssignmentSyntaxes(t *testing.T) {
-	got := ScanFile("pkg/config_test.go", []byte(strings.Join([]string{
-		`secret := "secret-value"`,
-		`samplePassword := "sample-password"`,
-		`bodyWithToken := "plain text body\\nDownload: https://example.com/file?token=tok_aaa\\n"`,
-	}, "\n")+"\n"))
-	for _, item := range got {
-		if item.Rule == "public_content_generic_credential" {
-			t.Fatalf("low-evidence test fixture assignment should not be reported: %#v", got)
-		}
+	if count != 6 {
+		t.Fatalf("source code credential-shaped literal findings = %d, want 6: %#v", count, got)
 	}
 }
 
@@ -1382,10 +1116,9 @@ func TestScanFileAllowsClientTokenIdempotencyExamples(t *testing.T) {
 
 func TestScanFileDetectsCredentialShapedClientTokenValues(t *testing.T) {
 	stripeLike := "sk_" + "live_1234567890abcdef"
-	githubToken := "ghp_" + "1234567890abcdef1234567890abcdef1234"
 	got := ScanFile("fixtures/idempotency.md", []byte(strings.Join([]string{
 		`{"client_token":"` + stripeLike + `"}`,
-		`{"client_token":"` + githubToken + `"}`,
+		`{"client_token":"real-client-secret-value"}`,
 	}, "\n")+"\n"))
 	var count int
 	for _, item := range got {
@@ -1419,10 +1152,9 @@ func TestScanFileAllowsTokenLikePlaceholderExamples(t *testing.T) {
 
 func TestScanFileDetectsCredentialShapedTokenLikePlaceholderValues(t *testing.T) {
 	stripeLike := "sk_" + "live_1234567890abcdef"
-	githubToken := "ghp_" + "1234567890abcdef1234567890abcdef1234"
 	got := ScanFile("fixtures/placeholders.md", []byte(strings.Join([]string{
 		`{ "resource_token": "` + stripeLike + `" }`,
-		`{ "block_token": "` + githubToken + `" }`,
+		`{ "block_token": "real-client-secret-value" }`,
 	}, "\n")+"\n"))
 	var count int
 	for _, item := range got {
@@ -1636,43 +1368,39 @@ func TestScanFileAllowsConventionalCredentialPlaceholders(t *testing.T) {
 	}
 }
 
-func TestScanFileAllowsInvalidProviderPlaceholderLookalikes(t *testing.T) {
+func TestScanFileDetectsCredentialShapedPlaceholderLookalikes(t *testing.T) {
 	stripeLike := "sk_" + "live_1234567890abcdef"
 	got := ScanFile("docs/config.md", []byte(strings.Join([]string{
 		"client_secret: " + stripeLike + "_HERE",
 		"api_key: YOUR_" + stripeLike,
 	}, "\n")+"\n"))
+	var count int
 	for _, item := range got {
 		if item.Rule == "public_content_generic_credential" {
-			t.Fatalf("invalid provider placeholder lookalike should not be blocked: %#v", got)
+			count++
 		}
 	}
+	if count != 2 {
+		t.Fatalf("credential-shaped placeholder lookalike findings = %d, want 2: %#v", count, got)
+	}
 }
 
 func TestScanFileDetectsPercentWrappedCredentialValues(t *testing.T) {
 	stripeLike := "sk_" + "live_1234567890abcdef"
 	patLike := "gh" + "p_1234567890abcdef1234567890abcdef1234"
-	cases := []struct {
-		name string
-		text string
-		want bool
-	}{
-		{name: "stripe", text: "CLIENT_SECRET=%" + stripeLike + "%", want: true},
-		{name: "github", text: "GITHUB_TOKEN=%" + patLike + "%", want: true},
-		{name: "readable", text: "TOKEN=%real-secret-token-value%", want: false},
+	got := ScanFile("docs/config.md", []byte(strings.Join([]string{
+		"CLIENT_SECRET=%" + stripeLike + "%",
+		"GITHUB_TOKEN=%" + patLike + "%",
+		"TOKEN=%real-secret-token-value%",
+	}, "\n")+"\n"))
+	var count int
+	for _, item := range got {
+		if item.Rule == "public_content_generic_credential" {
+			count++
+		}
 	}
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			assertGenericCredentialFinding(t, "docs/config.md", tc.text, tc.want)
-		})
-	}
-}
-
-func assertGenericCredentialFinding(t *testing.T, file, text string, want bool) {
-	t.Helper()
-	got := ScanFile(file, []byte(text+"\n"))
-	if actual := findingRules(got)["public_content_generic_credential"]; actual != want {
-		t.Fatalf("generic credential finding = %v, want %v: %#v", actual, want, got)
+	if count != 3 {
+		t.Fatalf("percent-wrapped credential findings = %d, want 3: %#v", count, got)
 	}
 }
 

internal/qualitygate/rules/dryrun.go

@@ -16,7 +16,6 @@ import (
 	"strings"
 	"time"
 
-	"github.com/larksuite/cli/internal/output"
 	"github.com/larksuite/cli/internal/qualitygate/facts"
 	"github.com/larksuite/cli/internal/qualitygate/manifest"
 	"github.com/larksuite/cli/internal/qualitygate/report"
@@ -338,7 +337,7 @@ func fakeValueFromPlaceholderName(name string) (string, bool) {
 	case name == "open_id" || hasPlaceholderToken(tokens, "user", "owner", "participant", "approver", "speaker"):
 		return "ou_test123", true
 	case hasPlaceholderToken(tokens, "department", "dept"):
-		return "od-test123", true
+		return "od_test123", true
 	case hasPlaceholderToken(tokens, "message"):
 		return "om_test123", true
 	case name == "file_key":
@@ -727,11 +726,7 @@ func appendDryRunArg(raw string) ([]string, error) {
 		return nil, fmt.Errorf("not a lark-cli command")
 	}
 	argv = truncateShellTail(argv)
-	var jqValid bool
-	argv, jqValid = stripDryRunJQFilter(argv)
-	if jqValid {
-		argv = forceDryRunJSONFormat(argv)
-	}
+	argv = forceDryRunJSONFormat(argv)
 	hasDryRunArg := false
 	dryRunEnabled := false
 	for _, arg := range argv[1:] {
@@ -780,73 +775,6 @@ func truncateShellTail(argv []string) []string {
 	return argv
 }
 
-// stripDryRunJQFilter removes valid output-only jq filters from the synthetic
-// dry-run invocation. Invalid jq syntax and incompatible output flags are left
-// untouched so the real CLI execution still rejects the documented command.
-// The bool reports whether other output normalization remains safe.
-func stripDryRunJQFilter(argv []string) ([]string, bool) {
-	jqExpr, outputPath, format, hasJQ, jqHasValue := dryRunOutputFlags(argv)
-	if !hasJQ {
-		return argv, true
-	}
-	if !jqHasValue || output.ValidateJqFlags(jqExpr, outputPath, format) != nil {
-		return argv, false
-	}
-
-	out := make([]string, 0, len(argv))
-	for i := 0; i < len(argv); i++ {
-		arg := argv[i]
-		switch {
-		case arg == "--":
-			return append(out, argv[i:]...), true
-		case arg == "--jq" || arg == "-q":
-			i++
-		case strings.HasPrefix(arg, "--jq=") || strings.HasPrefix(arg, "-q="):
-			continue
-		default:
-			out = append(out, arg)
-		}
-	}
-	return out, true
-}
-
-func dryRunOutputFlags(argv []string) (jqExpr, outputPath, format string, hasJQ, jqHasValue bool) {
-	for i := 1; i < len(argv); i++ {
-		arg := argv[i]
-		if arg == "--" {
-			break
-		}
-		switch {
-		case arg == "--jq" || arg == "-q":
-			hasJQ = true
-			jqHasValue = i+1 < len(argv)
-			if jqHasValue {
-				jqExpr = argv[i+1]
-				i++
-			}
-		case strings.HasPrefix(arg, "--jq=") || strings.HasPrefix(arg, "-q="):
-			hasJQ = true
-			jqHasValue = true
-			jqExpr = arg[strings.IndexByte(arg, '=')+1:]
-		case arg == "--output":
-			if i+1 < len(argv) {
-				outputPath = argv[i+1]
-				i++
-			}
-		case strings.HasPrefix(arg, "--output="):
-			outputPath = strings.TrimPrefix(arg, "--output=")
-		case arg == "--format":
-			if i+1 < len(argv) {
-				format = argv[i+1]
-				i++
-			}
-		case strings.HasPrefix(arg, "--format="):
-			format = strings.TrimPrefix(arg, "--format=")
-		}
-	}
-	return jqExpr, outputPath, format, hasJQ, jqHasValue
-}
-
 func dryRunFlagExplicitlyTrue(arg string) bool {
 	value, ok := strings.CutPrefix(arg, "--dry-run=")
 	if !ok {

internal/qualitygate/rules/dryrun_test.go

@@ -194,38 +194,6 @@ func TestRunDryRunsIgnoresTrailingShellComment(t *testing.T) {
 	}
 }
 
-func TestRunDryRunsIgnoresJQFilterWhenValidatingRequestPreview(t *testing.T) {
-	cliBin, argsPath := fakeDryRunCLI(t, `{"api":[{"method":"GET","url":"/open-apis/im/v1/flags"}]}`)
-	m := manifest.Manifest{Commands: []manifest.Command{{
-		Path:       "im +flag-list",
-		Runnable:   true,
-		Identities: []string{"user"},
-		Flags: []manifest.Flag{
-			{Name: "as", TakesValue: true},
-			{Name: "page-all"},
-			{Name: "jq", Shorthand: "q", TakesValue: true},
-			{Name: "dry-run"},
-		},
-	}}}
-	ex := skillscan.Example{
-		Raw:        `lark-cli im +flag-list --as user --page-all -q '.data.flag_items[-1]'`,
-		SourceFile: "skills/lark-im/references/lark-im-flag-list.md",
-		Line:       26,
-	}
-
-	diags, facts := RunDryRuns(context.Background(), cliBin, m, []skillscan.Example{ex})
-	if len(diags) != 0 {
-		t.Fatalf("RunDryRuns() diagnostics = %#v", diags)
-	}
-	if len(facts) != 1 || !facts[0].Executable || facts[0].SkipReason != "" {
-		t.Fatalf("jq example should remain executable: %#v", facts)
-	}
-	wantArgs := []string{"im", "+flag-list", "--as", "user", "--page-all", "--dry-run"}
-	if gotArgs := readArgs(t, argsPath); !reflect.DeepEqual(gotArgs, wantArgs) {
-		t.Fatalf("fake CLI args = %#v, want %#v", gotArgs, wantArgs)
-	}
-}
-
 func TestRunDryRunsMaterializesPlaceholdersInsideJSONFlags(t *testing.T) {
 	cliBin, argsPath := fakeDryRunCLI(t, `{"api":[{"method":"GET","url":"/open-apis/im/v1/messages","params":{"chat_id":"oc_test123","page_token":"page_test123"}}]}`)
 	m := manifest.Manifest{Commands: []manifest.Command{{
@@ -348,13 +316,6 @@ func TestRunDryRunsMaterializesInlinePlaceholderFlagValues(t *testing.T) {
 	}
 }
 
-func TestFakeValueFromPlaceholderNameUsesOpenDepartmentPrefix(t *testing.T) {
-	got, ok := fakeValueFromPlaceholderName("open_department_id")
-	if !ok || got != "od-test123" {
-		t.Fatalf("open_department_id placeholder = %q, %v; want od-test123, true", got, ok)
-	}
-}
-
 func TestRunDryRunsMaterializesNumericPlaceholderFlagValues(t *testing.T) {
 	cliBin, argsPath := fakeDryRunCLI(t, `{"api":[{"method":"GET","url":"/open-apis/vc/v1/bots/events","params":{"meeting_id":"400000000001","page_size":50}}]}`)
 	m := manifest.Manifest{Commands: []manifest.Command{{
@@ -827,72 +788,6 @@ func TestAppendDryRunArgForcesInlineJSONFormat(t *testing.T) {
 	}
 }
 
-func TestAppendDryRunArgRemovesJQFilter(t *testing.T) {
-	tests := []struct {
-		name string
-		raw  string
-		want []string
-	}{
-		{
-			name: "short split",
-			raw:  `lark-cli im +flag-list --page-all -q '.data.flag_items[-1]'`,
-			want: []string{"im", "+flag-list", "--page-all", "--dry-run"},
-		},
-		{
-			name: "long split",
-			raw:  `lark-cli im +flag-list --jq '.data.flag_items[].item_id' --page-all`,
-			want: []string{"im", "+flag-list", "--page-all", "--dry-run"},
-		},
-		{
-			name: "short inline",
-			raw:  `lark-cli im +flag-list -q='.data.flag_items[-1]' --page-all`,
-			want: []string{"im", "+flag-list", "--page-all", "--dry-run"},
-		},
-		{
-			name: "long inline",
-			raw:  `lark-cli im +flag-list --jq='.data.flag_items[-1]' --page-all`,
-			want: []string{"im", "+flag-list", "--page-all", "--dry-run"},
-		},
-		{
-			name: "missing value remains invalid",
-			raw:  `lark-cli im +flag-list --page-all --jq`,
-			want: []string{"im", "+flag-list", "--page-all", "--jq", "--dry-run"},
-		},
-		{
-			name: "next flag is not accepted as jq expression",
-			raw:  `lark-cli im +flag-list --jq --page-all`,
-			want: []string{"im", "+flag-list", "--jq", "--page-all", "--dry-run"},
-		},
-		{
-			name: "invalid expression remains invalid",
-			raw:  `lark-cli im +flag-list --jq 'invalid[' --page-all`,
-			want: []string{"im", "+flag-list", "--jq", "invalid[", "--page-all", "--dry-run"},
-		},
-		{
-			name: "incompatible pretty format remains invalid",
-			raw:  `lark-cli im +flag-list --jq '.data' --format pretty`,
-			want: []string{"im", "+flag-list", "--jq", ".data", "--format", "pretty", "--dry-run"},
-		},
-		{
-			name: "compatible json format preserves request preview",
-			raw:  `lark-cli im +flag-list --jq '.data' --format json`,
-			want: []string{"im", "+flag-list", "--format", "json", "--dry-run"},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			got, err := appendDryRunArg(tt.raw)
-			if err != nil {
-				t.Fatalf("appendDryRunArg() error = %v", err)
-			}
-			if !reflect.DeepEqual(got, tt.want) {
-				t.Fatalf("appendDryRunArg() = %#v, want %#v", got, tt.want)
-			}
-		})
-	}
-}
-
 func TestAppendDryRunArgPreservesNonPrettyFormat(t *testing.T) {
 	for _, raw := range []string{
 		"lark-cli mail +watch --format data --dry-run",

internal/qualitygate/rules/run_test.go

@@ -7,6 +7,7 @@ import (
 	"context"
 	"encoding/json"
 	"os"
+	"os/exec"
 	"path/filepath"
 	"strings"
 	"testing"
@@ -14,7 +15,6 @@ import (
 	qdiff "github.com/larksuite/cli/internal/qualitygate/diff"
 	"github.com/larksuite/cli/internal/qualitygate/manifest"
 	"github.com/larksuite/cli/internal/qualitygate/report"
-	"github.com/larksuite/cli/internal/testutil/gitcmd"
 	"github.com/larksuite/cli/internal/vfs"
 )
 
@@ -203,8 +203,7 @@ func TestRunCollectsPublicContentFindingsIntoDiagnosticsAndFacts(t *testing.T) {
 	if err := vfs.MkdirAll(filepath.Join(repo, "docs"), 0o755); err != nil {
 		t.Fatal(err)
 	}
-	providerValue := "ghp_" + "1234567890abcdef1234567890abcdef1234"
-	publicDoc := "api_" + "key = \"" + providerValue + "\"\n" +
+	publicDoc := "api_" + "key = \"example-public-key\"\n" +
 		"Public docs describe a pri" + "vate request header and trust classification detail.\n"
 	if err := vfs.WriteFile(filepath.Join(repo, "docs", "public.md"), []byte(publicDoc), 0o644); err != nil {
 		t.Fatal(err)
@@ -600,8 +599,7 @@ func TestNormalizeDiagnosticFileHandlesAbsoluteRepo(t *testing.T) {
 
 func runGit(t *testing.T, repo string, args ...string) {
 	t.Helper()
-	commandArgs := append([]string{"-c", "core.hooksPath=/dev/null"}, args...)
-	cmd := gitcmd.Command(repo, commandArgs...)
+	cmd := exec.Command("git", append([]string{"-c", "core.hooksPath=/dev/null", "-C", repo}, args...)...)
 	cmd.Env = append(os.Environ(), "GIT_AUTHOR_DATE=2026-06-17T00:00:00Z", "GIT_COMMITTER_DATE=2026-06-17T00:00:00Z")
 	out, err := cmd.CombinedOutput()
 	if err != nil {

internal/registry/registry_test.go

@@ -101,7 +101,6 @@ func TestSelectRecommendedScope_Empty(t *testing.T) {
 }
 
 func TestComputeMinimumScopeSet(t *testing.T) {
-	ensureFreshRegistry(t)
 	minSet := ComputeMinimumScopeSet("user")
 	if len(minSet) == 0 {
 		if len(ListFromMetaProjects()) == 0 {

internal/registry/registrytest/fixture_meta.json

@@ -1,72 +0,0 @@
-{
-  "version": "0.0.1",
-  "services": [
-    {
-      "name": "calendar",
-      "version": "v4",
-      "title": "Calendar API",
-      "servicePath": "/open-apis/calendar/v4",
-      "resources": {
-        "events": {
-          "methods": {
-            "create": {
-              "path": "calendars/{calendar_id}/events",
-              "httpMethod": "POST",
-              "risk": "write",
-              "scopes": [
-                "calendar:calendar.event:create"
-              ],
-              "parameters": {
-                "calendar_id": {
-                  "type": "string",
-                  "location": "path",
-                  "required": true
-                }
-              }
-            }
-          }
-        }
-      }
-    },
-    {
-      "name": "im",
-      "version": "v1",
-      "title": "IM API",
-      "servicePath": "/open-apis/im/v1",
-      "resources": {
-        "chat.members": {
-          "methods": {
-            "create": {
-              "path": "chats/{chat_id}/members",
-              "httpMethod": "POST",
-              "risk": "write",
-              "scopes": [
-                "im:chat",
-                "im:chat.members:write_only"
-              ],
-              "parameters": {
-                "chat_id": {
-                  "type": "string",
-                  "location": "path",
-                  "required": true
-                },
-                "member_id_type": {
-                  "type": "string",
-                  "location": "query",
-                  "required": false
-                }
-              }
-            }
-          }
-        }
-      }
-    },
-    {
-      "name": "task",
-      "version": "v2",
-      "title": "Task API",
-      "servicePath": "/open-apis/task/v2",
-      "resources": {}
-    }
-  ]
-}

internal/registry/registrytest/registrytest.go

@@ -1,146 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-// Package registrytest seeds the registry with a tracked metadata fixture so
-// command-tree tests pass on a clean checkout — no `make fetch_meta`, no
-// network, no user cache. TestMain funcs of packages that build service
-// commands call Seed after redirecting LARKSUITE_CLI_CONFIG_DIR.
-package registrytest
-
-import (
-	_ "embed"
-	"encoding/json"
-	"errors"
-	"os"
-	"path/filepath"
-	"strings"
-	"time"
-
-	"github.com/larksuite/cli/internal/core"
-	"github.com/larksuite/cli/internal/registry"
-	"github.com/larksuite/cli/internal/vfs"
-)
-
-// fixtureMetaJSON is a trimmed snapshot of the generated meta_data.json
-// holding only the calendar, im and task services that registry-backed tests
-// assert against. Its version is pinned to "0.0.1": newer than the empty
-// embedded stub ("0.0.0") so it wins on a clean checkout, older than any real
-// generated catalog ("1.0.0"+) so a `make fetch_meta` build keeps testing the
-// full embedded data.
-//
-//go:embed fixture_meta.json
-var fixtureMetaJSON []byte
-
-// Seed writes fixtureMetaJSON into the registry remote-meta cache under
-// LARKSUITE_CLI_CONFIG_DIR and eagerly initializes the registry. testRoot must
-// be the temporary root created by the caller's TestMain; Seed rejects a config
-// directory outside it before performing any write. The cache
-// meta is stamped fresh so Init never sync-fetches or background-refreshes
-// over the network. Eager Init pins the catalog for the whole test process before
-// any individual test can re-point LARKSUITE_CLI_CONFIG_DIR elsewhere.
-//
-// The caller's TestMain must set LARKSUITE_CLI_CONFIG_DIR beneath testRoot
-// first; Seed refuses unset, mismatched, or escaping paths so it can never
-// write into a developer's real ~/.lark-cli.
-func Seed(testRoot string) error {
-	configDir := os.Getenv("LARKSUITE_CLI_CONFIG_DIR")
-	if err := validateConfigDir(testRoot, configDir); err != nil {
-		return err
-	}
-
-	var fixture struct {
-		Version string `json:"version"`
-	}
-	if err := json.Unmarshal(fixtureMetaJSON, &fixture); err != nil {
-		return err
-	}
-
-	cacheDir := filepath.Join(configDir, "cache")
-	if err := vfs.MkdirAll(cacheDir, 0o700); err != nil {
-		return err
-	}
-	if err := vfs.WriteFile(filepath.Join(cacheDir, "remote_meta.json"), fixtureMetaJSON, 0o644); err != nil {
-		return err
-	}
-	cacheMeta, err := json.Marshal(registry.CacheMeta{
-		LastCheckAt: time.Now().Unix(),
-		Version:     fixture.Version,
-		Brand:       string(core.BrandFeishu),
-	})
-	if err != nil {
-		return err
-	}
-	if err := vfs.WriteFile(filepath.Join(cacheDir, "remote_meta.meta.json"), cacheMeta, 0o644); err != nil {
-		return err
-	}
-
-	// Neutralize ambient knobs that would defeat the seeding: an inherited
-	// LARKSUITE_CLI_REMOTE_META=off would stop Init from reading the seeded
-	// cache at all, and LARKSUITE_CLI_META_TTL=0 would expire the freshness
-	// stamp and start a background network refresh from inside unit tests.
-	if err := os.Unsetenv("LARKSUITE_CLI_REMOTE_META"); err != nil {
-		return err
-	}
-	if err := os.Unsetenv("LARKSUITE_CLI_META_TTL"); err != nil {
-		return err
-	}
-
-	registry.Init()
-
-	// Init is a sync.Once, so the seed is pinned for the whole test process.
-	// Turning remote metadata off afterwards cannot un-seed anything; it is a
-	// guard for any future post-Init code path that might consult the remote
-	// cache again after a test re-points LARKSUITE_CLI_CONFIG_DIR elsewhere.
-	if err := os.Setenv("LARKSUITE_CLI_REMOTE_META", "off"); err != nil {
-		return err
-	}
-
-	// Self-check: both the fixture and any real generated catalog contain the
-	// im service. If it is missing, the cache seeding silently stopped working
-	// (e.g. the registry cache file names or freshness semantics changed) and
-	// every registry-backed test would fail confusingly — fail loudly here
-	// instead, pointing at this package.
-	merged, ok := registry.ServiceTyped("im")
-	if !ok {
-		return errors.New("registrytest.Seed: registry has no im service after seeding — " +
-			"the remote-cache format in internal/registry/remote.go may have changed; update registrytest to match")
-	}
-
-	// Self-check: on a fetch_meta build the real embedded catalog must win over
-	// the 0.0.1 fixture. If the merged im service diverges from the embedded
-	// one, the version arbitration flipped (e.g. the generated catalog version
-	// stopped parsing as semver) and unit tests would silently run against the
-	// stale trimmed fixture instead of the fresh catalog.
-	for _, service := range registry.EmbeddedServicesTyped() {
-		if service.Name != "im" {
-			continue
-		}
-		if service.Version != merged.Version {
-			return errors.New("registrytest.Seed: the fixture shadowed the real embedded catalog — " +
-				"check the meta_data.json version against the fixture's \"0.0.1\" arbitration in this package")
-		}
-		break
-	}
-	return nil
-}
-
-// validateConfigDir guards the one real hazard: a TestMain wiring mistake
-// pointing LARKSUITE_CLI_CONFIG_DIR at a developer's real directory. Both
-// paths come from the caller's own MkdirTemp, so a plain containment check
-// is enough.
-func validateConfigDir(testRoot, configDir string) error {
-	if testRoot == "" || configDir == "" {
-		return errors.New("registrytest.Seed: test root and config dir must be set")
-	}
-	if !filepath.IsAbs(testRoot) || !filepath.IsAbs(configDir) {
-		return errors.New("registrytest.Seed: test root and config dir must be absolute")
-	}
-	rel, err := filepath.Rel(filepath.Clean(testRoot), filepath.Clean(configDir))
-	if err != nil {
-		return err
-	}
-	if rel == ".." || strings.HasPrefix(rel, ".."+string(filepath.Separator)) {
-		return errors.New("registrytest.Seed: config dir must stay inside the test root")
-	}
-	return nil
-}

internal/registry/registrytest/registrytest_test.go

@@ -1,229 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package registrytest
-
-import (
-	"net/http"
-	"os"
-	"path/filepath"
-	"slices"
-	"sort"
-	"testing"
-
-	"github.com/larksuite/cli/internal/meta"
-	"github.com/larksuite/cli/internal/registry"
-)
-
-func TestValidateConfigDir(t *testing.T) {
-	root := t.TempDir()
-	tests := []struct {
-		name      string
-		testRoot  string
-		configDir string
-		wantErr   bool
-	}{
-		{name: "equal", testRoot: root, configDir: root},
-		{name: "child", testRoot: root, configDir: filepath.Join(root, "config")},
-		{
-			name:      "sibling",
-			testRoot:  root,
-			configDir: filepath.Join(filepath.Dir(root), "outside"),
-			wantErr:   true,
-		},
-		{name: "empty root", configDir: root, wantErr: true},
-		{name: "empty config", testRoot: root, wantErr: true},
-		{name: "relative root", testRoot: "relative", configDir: root, wantErr: true},
-		{name: "relative config", testRoot: root, configDir: "relative", wantErr: true},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			err := validateConfigDir(tt.testRoot, tt.configDir)
-			if (err != nil) != tt.wantErr {
-				t.Fatalf("validateConfigDir() error = %v, wantErr %v", err, tt.wantErr)
-			}
-		})
-	}
-}
-
-func TestFixtureContract(t *testing.T) {
-	if len(fixtureMetaJSON) > 20<<10 {
-		t.Fatalf("fixture size = %d, want <= %d", len(fixtureMetaJSON), 20<<10)
-	}
-	reg, err := meta.Parse(fixtureMetaJSON)
-	if err != nil {
-		t.Fatalf("meta.Parse() error = %v", err)
-	}
-	if reg.Version != "0.0.1" {
-		t.Fatalf("fixture version = %q, want 0.0.1", reg.Version)
-	}
-
-	gotNames := make([]string, 0, len(reg.Services))
-	for _, service := range reg.Services {
-		gotNames = append(gotNames, service.Name)
-	}
-	sort.Strings(gotNames)
-	if !slices.Equal(gotNames, []string{"calendar", "im", "task"}) {
-		t.Fatalf("fixture services = %v, want [calendar im task]", gotNames)
-	}
-
-	calendarCreate := fixtureMethod(t, reg, "calendar", "events", "create")
-	assertMethodContract(t, calendarCreate, "calendars/{calendar_id}/events", http.MethodPost)
-	calendarID, ok := calendarCreate.Parameters["calendar_id"]
-	if !ok || calendarID.Location != "path" || !calendarID.Required {
-		t.Fatalf("calendar_id = %+v, want required path parameter", calendarID)
-	}
-	if !slices.Contains(calendarCreate.Scopes, "calendar:calendar.event:create") {
-		t.Fatalf("calendar create scopes = %v, want calendar:calendar.event:create", calendarCreate.Scopes)
-	}
-
-	imCreate := fixtureMethod(t, reg, "im", "chat.members", "create")
-	assertMethodContract(t, imCreate, "chats/{chat_id}/members", http.MethodPost)
-	chatID, ok := imCreate.Parameters["chat_id"]
-	if !ok || chatID.Location != "path" || !chatID.Required {
-		t.Fatalf("chat_id = %+v, want required path parameter", chatID)
-	}
-	memberIDType, ok := imCreate.Parameters["member_id_type"]
-	if !ok || memberIDType.Location != "query" || memberIDType.Required {
-		t.Fatalf("member_id_type = %+v, want optional query parameter", memberIDType)
-	}
-	if imCreate.Risk != "write" {
-		t.Fatalf("im create risk = %q, want write", imCreate.Risk)
-	}
-	for _, scope := range []string{"im:chat", "im:chat.members:write_only"} {
-		if !slices.Contains(imCreate.Scopes, scope) {
-			t.Fatalf("im create scopes = %v, want %s", imCreate.Scopes, scope)
-		}
-	}
-}
-
-func fixtureMethod(t *testing.T, reg meta.Registry, serviceName, resourceName, methodName string) meta.Method {
-	t.Helper()
-	for _, service := range reg.Services {
-		if service.Name != serviceName {
-			continue
-		}
-		resource, ok := service.Resource(resourceName)
-		if !ok {
-			t.Fatalf("fixture service %s has no resource %s", serviceName, resourceName)
-		}
-		method, ok := resource.Method(methodName)
-		if !ok {
-			t.Fatalf("fixture resource %s.%s has no method %s", serviceName, resourceName, methodName)
-		}
-		return method
-	}
-	t.Fatalf("fixture has no service %s", serviceName)
-	return meta.Method{}
-}
-
-func assertMethodContract(t *testing.T, method meta.Method, path, httpMethod string) {
-	t.Helper()
-	if method.Path != path || method.HTTPMethod != httpMethod {
-		t.Fatalf("method = %s %s, want %s %s", method.HTTPMethod, method.Path, httpMethod, path)
-	}
-}
-
-// TestSeedRejectsUnsafeConfigDir pins Seed's guard: it must return before
-// writing anything when LARKSUITE_CLI_CONFIG_DIR is unset or escapes the
-// caller's test root, so a TestMain wiring mistake can never touch a
-// developer's real ~/.lark-cli.
-func TestSeedRejectsUnsafeConfigDir(t *testing.T) {
-	root := t.TempDir()
-
-	t.Run("unset config dir", func(t *testing.T) {
-		t.Setenv("LARKSUITE_CLI_CONFIG_DIR", "")
-		if err := Seed(root); err == nil {
-			t.Fatal("Seed() error = nil, want unset config dir rejection")
-		}
-	})
-
-	t.Run("config dir outside test root", func(t *testing.T) {
-		outside := t.TempDir()
-		t.Setenv("LARKSUITE_CLI_CONFIG_DIR", outside)
-		if err := Seed(root); err == nil {
-			t.Fatal("Seed() error = nil, want containment rejection")
-		}
-		if _, err := os.Stat(filepath.Join(outside, "cache")); err == nil {
-			t.Fatal("Seed wrote into the rejected config dir")
-		}
-	})
-}
-
-// TestSeedWritesFixtureAndInitializesRegistry covers the seeding happy path:
-// cache files land under the config dir, the registry initializes from them,
-// and both self-checks pass.
-func TestSeedWritesFixtureAndInitializesRegistry(t *testing.T) {
-	root := t.TempDir()
-	configDir := filepath.Join(root, "config")
-	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", configDir)
-
-	if err := Seed(root); err != nil {
-		t.Fatalf("Seed() error = %v, want nil", err)
-	}
-	for _, name := range []string{"remote_meta.json", "remote_meta.meta.json"} {
-		if _, err := os.Stat(filepath.Join(configDir, "cache", name)); err != nil {
-			t.Errorf("cache file %s: %v", name, err)
-		}
-	}
-	if got := os.Getenv("LARKSUITE_CLI_REMOTE_META"); got != "off" {
-		t.Errorf("LARKSUITE_CLI_REMOTE_META = %q, want off after seeding", got)
-	}
-	for _, service := range []string{"calendar", "im", "task"} {
-		if _, ok := registry.ServiceTyped(service); !ok {
-			t.Errorf("registry missing service %s after seeding", service)
-		}
-	}
-}
-
-// TestSeedPropagatesCacheSetupFailures pins that filesystem failures while
-// materializing the cache surface as errors instead of leaving the registry
-// silently unseeded. Each obstacle is a same-named file/directory in the
-// way, which fails on every platform without permission tricks.
-func TestSeedPropagatesCacheSetupFailures(t *testing.T) {
-	seedWith := func(t *testing.T, prepare func(root, configDir string)) error {
-		t.Helper()
-		root := t.TempDir()
-		configDir := filepath.Join(root, "config")
-		prepare(root, configDir)
-		t.Setenv("LARKSUITE_CLI_CONFIG_DIR", configDir)
-		return Seed(root)
-	}
-
-	t.Run("cache dir creation fails", func(t *testing.T) {
-		err := seedWith(t, func(root, configDir string) {
-			// config is a regular file, so MkdirAll(config/cache) fails.
-			if err := os.WriteFile(configDir, nil, 0o600); err != nil {
-				t.Fatal(err)
-			}
-		})
-		if err == nil {
-			t.Fatal("Seed() error = nil, want cache dir creation failure")
-		}
-	})
-
-	t.Run("fixture write fails", func(t *testing.T) {
-		err := seedWith(t, func(root, configDir string) {
-			// remote_meta.json is a directory, so WriteFile fails.
-			if err := os.MkdirAll(filepath.Join(configDir, "cache", "remote_meta.json"), 0o700); err != nil {
-				t.Fatal(err)
-			}
-		})
-		if err == nil {
-			t.Fatal("Seed() error = nil, want fixture write failure")
-		}
-	})
-
-	t.Run("cache meta write fails", func(t *testing.T) {
-		err := seedWith(t, func(root, configDir string) {
-			// remote_meta.meta.json is a directory, so WriteFile fails.
-			if err := os.MkdirAll(filepath.Join(configDir, "cache", "remote_meta.meta.json"), 0o700); err != nil {
-				t.Fatal(err)
-			}
-		})
-		if err == nil {
-			t.Fatal("Seed() error = nil, want cache meta write failure")
-		}
-	})
-}

internal/registry/testmain_test.go

@@ -1,27 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package registry
-
-import (
-	"os"
-	"path/filepath"
-	"testing"
-)
-
-func TestMain(m *testing.M) {
-	root, err := os.MkdirTemp("", "lark-cli-registry-test-*")
-	if err != nil {
-		panic(err)
-	}
-	if err := os.Setenv("LARKSUITE_CLI_CONFIG_DIR", filepath.Join(root, "config")); err != nil {
-		panic(err)
-	}
-	code := m.Run()
-	// A test that ran Init without a trailing resetInit can leave a background
-	// refresh goroutine alive; removing the temp root while it writes would
-	// let it recreate the directory after cleanup. Wait it out first.
-	waitBackgroundRefresh()
-	_ = os.RemoveAll(root)
-	os.Exit(code)
-}

internal/testutil/gitcmd/gitcmd.go

@@ -1,55 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-// Package gitcmd provides Git process helpers for tests that use temporary
-// repositories.
-package gitcmd
-
-import (
-	"os"
-	"os/exec"
-	"strconv"
-	"testing"
-)
-
-const (
-	maintenanceAutoDetach = "maintenance.autoDetach"
-	gcAutoDetach          = "gc.autoDetach"
-)
-
-// Command creates a Git command whose automatic maintenance stays in the
-// command lifecycle, so temporary repository cleanup cannot race a detached
-// maintenance process.
-func Command(dir string, args ...string) *exec.Cmd {
-	commandArgs := make([]string, 0, len(args)+4)
-	commandArgs = append(commandArgs,
-		"-c", maintenanceAutoDetach+"=false",
-		"-c", gcAutoDetach+"=false",
-	)
-	commandArgs = append(commandArgs, args...)
-	cmd := exec.Command("git", commandArgs...)
-	cmd.Dir = dir
-	return cmd
-}
-
-// SetSynchronousMaintenanceEnv applies the same lifecycle contract to every
-// Git process started by the current test, including processes created through
-// production command runners. Tests using it must not run in parallel.
-func SetSynchronousMaintenanceEnv(t *testing.T) {
-	t.Helper()
-	count := 0
-	if value, ok := os.LookupEnv("GIT_CONFIG_COUNT"); ok {
-		parsed, err := strconv.Atoi(value)
-		if err != nil || parsed < 0 {
-			t.Fatalf("invalid GIT_CONFIG_COUNT %q", value)
-		}
-		count = parsed
-	}
-	for _, key := range []string{maintenanceAutoDetach, gcAutoDetach} {
-		index := strconv.Itoa(count)
-		t.Setenv("GIT_CONFIG_KEY_"+index, key)
-		t.Setenv("GIT_CONFIG_VALUE_"+index, "false")
-		count++
-	}
-	t.Setenv("GIT_CONFIG_COUNT", strconv.Itoa(count))
-}

internal/testutil/gitcmd/gitcmd_test.go

@@ -1,47 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package gitcmd
-
-import (
-	"os/exec"
-	"strings"
-	"testing"
-)
-
-func TestCommandDisablesDetachedMaintenance(t *testing.T) {
-	for _, key := range []string{"maintenance.autoDetach", "gc.autoDetach"} {
-		cmd := Command(t.TempDir(), "config", "--get", "--type=bool", key)
-		out, err := cmd.CombinedOutput()
-		if err != nil {
-			t.Fatalf("git config %s: %v\n%s", key, err, out)
-		}
-		if got := strings.TrimSpace(string(out)); got != "false" {
-			t.Fatalf("%s = %q, want false", key, got)
-		}
-	}
-}
-
-func TestSetSynchronousMaintenanceEnv(t *testing.T) {
-	t.Setenv("GIT_CONFIG_COUNT", "1")
-	t.Setenv("GIT_CONFIG_KEY_0", "user.name")
-	t.Setenv("GIT_CONFIG_VALUE_0", "Existing Test User")
-	SetSynchronousMaintenanceEnv(t)
-	for key, want := range map[string]string{
-		"user.name":           "Existing Test User",
-		maintenanceAutoDetach: "false",
-		gcAutoDetach:          "false",
-	} {
-		cmd := exec.Command("git", "config", "--get", "--type=bool", key)
-		if key == "user.name" {
-			cmd = exec.Command("git", "config", "--get", key)
-		}
-		out, err := cmd.CombinedOutput()
-		if err != nil {
-			t.Fatalf("git config %s: %v\n%s", key, err, out)
-		}
-		if got := strings.TrimSpace(string(out)); got != want {
-			t.Fatalf("%s = %q, want %q", key, got, want)
-		}
-	}
-}

lint/errscontract/scan_test.go

@@ -34,12 +34,7 @@ func writeFixture(t *testing.T, files fixtureRepo) string {
 
 func runGit(t *testing.T, root string, args ...string) string {
 	t.Helper()
-	commandArgs := []string{
-		"-c", "maintenance.autoDetach=false",
-		"-c", "gc.autoDetach=false",
-	}
-	commandArgs = append(commandArgs, args...)
-	cmd := exec.Command("git", commandArgs...)
+	cmd := exec.Command("git", args...)
 	cmd.Dir = root
 	out, err := cmd.CombinedOutput()
 	if err != nil {
@@ -48,14 +43,6 @@ func runGit(t *testing.T, root string, args ...string) string {
 	return strings.TrimSpace(string(out))
 }
 
-func TestRunGitDisablesDetachedMaintenance(t *testing.T) {
-	for _, key := range []string{"maintenance.autoDetach", "gc.autoDetach"} {
-		if got := runGit(t, t.TempDir(), "config", "--get", "--type=bool", key); got != "false" {
-			t.Fatalf("%s = %q, want false", key, got)
-		}
-	}
-}
-
 func TestLoadSubtypeAllowlist_ExtractsTypedConstValues(t *testing.T) {
 	root := writeFixture(t, fixtureRepo{
 		"errs/subtypes.go": `package errs

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@larksuite/cli",
-  "version": "1.0.74",
+  "version": "1.0.69",
   "description": "The official CLI for Lark/Feishu open platform",
   "bin": {
     "lark-cli": "scripts/run.js"

scripts/ci-workflow.test.sh

@@ -18,11 +18,6 @@ workflow_permissions="$(awk '
   in_permissions && /^[^[:space:]]/ { exit }
   in_permissions { print }
 ' "$workflow")"
-workflow_concurrency="$(awk '
-  /^concurrency:/ { in_concurrency = 1; print; next }
-  in_concurrency && /^[^[:space:]]/ { exit }
-  in_concurrency { print }
-' "$workflow")"
 fast_gate_section="$(job_section fast-gate)"
 unit_test_section="$(job_section unit-test)"
 lint_section="$(awk '
@@ -51,27 +46,6 @@ results_section="$(awk '
   in_job { print }
 ' "$workflow")"
 fork_safe_guard="github.event_name != 'pull_request' || !github.event.pull_request.head.repo.fork"
-live_job_condition="always() && ($fork_safe_guard) && needs.unit-test.result == 'success' && needs.lint.result == 'success' && needs.script-test.result == 'success' && needs.deterministic-gate.result == 'success' && needs.e2e-dry-run.result == 'success' && (needs.e2e-dry-run.outputs.mode == 'full' || needs.e2e-dry-run.outputs.mode == 'subset') && needs.e2e-dry-run.outputs.live_packages != ''"
-
-if ! grep -Fq "run-name: \${{ github.event_name == 'pull_request' && format('CI / {0}', github.event.pull_request.number) || '' }}" "$workflow"; then
-  echo "CI should expose a stable PR generation while preserving default push and manual run titles" >&2
-  exit 1
-fi
-
-if ! grep -Fq "RUN_GENERATION: \${{ github.event_name == 'pull_request' && format('CI / {0}', github.event.pull_request.number) || '' }}" <<<"$section"; then
-  echo "the supersession generation should match the PR-only run name" >&2
-  exit 1
-fi
-
-if ! grep -Fq 'group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}' <<<"$workflow_concurrency"; then
-  echo "CI should deduplicate runs for the same pull request without grouping push or manual runs" >&2
-  exit 1
-fi
-
-if ! grep -Fq "cancel-in-progress: \${{ github.event_name == 'pull_request' }}" <<<"$workflow_concurrency"; then
-  echo "CI should cancel superseded pull request runs but preserve push and manual runs" >&2
-  exit 1
-fi
 
 for denied_permission in "checks: write" "pull-requests: write" "issues: write"; do
   if grep -Eq "^[[:space:]]*${denied_permission}$" <<<"$workflow_permissions"; then
@@ -236,84 +210,8 @@ if ! grep -Fq "deterministic-gate" <<<"$results_section"; then
   exit 1
 fi
 
-if ! grep -Fq "if: \${{ $live_job_condition }}" <<<"$section"; then
-  echo "e2e-live should preserve active cleanup while requiring a successful non-skip dry run and excluding fork pull requests"
-  exit 1
-fi
-
-if ! grep -Fq "needs: [unit-test, lint, script-test, deterministic-gate, e2e-dry-run]" <<<"$section"; then
-  echo "e2e-live should wait outside the exclusive queue until e2e-dry-run finishes"
-  exit 1
-fi
-
-if ! grep -Fq "timeout-minutes: 20" <<<"$dry_run_section"; then
-  echo "e2e-dry-run should bound the planning gate before live E2E" >&2
-  exit 1
-fi
-
-if ! grep -Fq "timeout-minutes: 30" <<<"$section"; then
-  echo "e2e-live should release the repository-wide slot after 30 minutes" >&2
-  exit 1
-fi
-
-if ! grep -Fq "group: lark-cli-e2e-live" <<<"$section"; then
-  echo "e2e-live should use one repository-wide execution slot" >&2
-  exit 1
-fi
-
-if ! grep -Fq "cancel-in-progress: false" <<<"$section"; then
-  echo "e2e-live should queue waiting runs instead of cancelling an active live test" >&2
-  exit 1
-fi
-
-if ! grep -Fq "queue: max" <<<"$section"; then
-  echo "e2e-live should preserve queued runs instead of replacing an existing pending run" >&2
-  exit 1
-fi
-
-if ! grep -Fq "actions: read" <<<"$section"; then
-  echo "e2e-live should use read-only Actions access for the supersession check" >&2
-  exit 1
-fi
-
-live_test_step="$(awk '
-  /^      - name: Run CLI E2E tests/ { in_step = 1 }
-  in_step { print }
-  in_step && /^      - name: Publish CLI E2E test report/ { exit }
-' <<<"$section")"
-
-if ! grep -Fq "if: \${{ always() && steps.build_cli.outcome == 'success' && steps.live_e2e_tat.outcome == 'success' }}" <<<"$live_test_step"; then
-  echo "the active live test step should survive ordinary workflow supersession only after setup succeeds" >&2
-  exit 1
-fi
-
-for required in \
-  'gh api "repos/$REPOSITORY/actions/runs/$RUN_ID"' \
-  'gh api --paginate -X GET "repos/$REPOSITORY/actions/workflows/$workflow_id/runs"' \
-  '-f event=pull_request -f branch="$GITHUB_HEAD_REF" -f per_page=100' \
-  '.head_repository.full_name == $repository and .display_title == $generation and .run_number > $run_number' \
-  '::error::Superseded before live E2E started' \
-  'exit 1'; do
-  if ! grep -Fq -- "$required" <<<"$live_test_step"; then
-    echo "the live startup check should fail closed before a superseded run starts live E2E: missing $required" >&2
-    exit 1
-  fi
-done
-
-if ! awk '
-  /if \[ -n "\$newer_runs" \]; then/ { superseded_state = 1; next }
-  superseded_state == 1 && /::error::Superseded before live E2E started/ { superseded_state = 2; next }
-  superseded_state == 2 && /^[[:space:]]+exit 1[[:space:]]*$/ { superseded_state = 3; next }
-  superseded_state > 0 && /^[[:space:]]+fi[[:space:]]*$/ {
-    if (superseded_state != 3) exit 2
-    superseded_closed = 1
-    superseded_state = 0
-    next
-  }
-  /go run gotest.tools\/gotestsum@/ { test_started = 1; if (!superseded_closed) exit 3 }
-  END { exit superseded_closed && test_started ? 0 : 1 }
-' <<<"$live_test_step"; then
-  echo "a superseded live run must stop before gotestsum starts" >&2
+if ! grep -Fq "if: \${{ $fork_safe_guard }}" <<<"$section"; then
+  echo "e2e-live should run on push and same-repository pull_request, but skip fork pull_request"
   exit 1
 fi
 
@@ -324,39 +222,6 @@ if ! grep -Fq "name: Resolve CLI E2E domains" <<<"$dry_run_section" ||
   exit 1
 fi
 
-for output in \
-  'mode: ${{ steps.e2e_domains.outputs.mode }}' \
-  'reason: ${{ steps.e2e_domains.outputs.reason }}' \
-  'live_packages: ${{ steps.e2e_domains.outputs.live_packages }}'; do
-  if ! grep -Fq "$output" <<<"$dry_run_section"; then
-    echo "e2e-dry-run should publish $output for the live job" >&2
-    exit 1
-  fi
-done
-
-for validation_contract in \
-  'case "$E2E_MODE" in' \
-  'skip)' \
-  '[ -z "$E2E_LIVE_PACKAGES" ]' \
-  'full|subset)' \
-  '[ -n "$E2E_LIVE_PACKAGES" ]' \
-  'Invalid CLI E2E mode' \
-  'exit 1'; do
-  if ! grep -Fq "$validation_contract" <<<"$dry_run_section"; then
-    echo "e2e-dry-run should fail invalid domain output before live can be skipped: missing $validation_contract" >&2
-    exit 1
-  fi
-done
-
-if ! awk '
-  /- name: Validate CLI E2E domain outputs/ { validated = 1 }
-  /- name: Build lark-cli/ { exit validated ? 0 : 1 }
-  END { if (!validated) exit 1 }
-' <<<"$dry_run_section"; then
-  echo "e2e-dry-run should validate domain outputs before building" >&2
-  exit 1
-fi
-
 if ! grep -Fq "steps.e2e_domains.outputs.dry_packages" <<<"$dry_run_section"; then
   echo "e2e-dry-run should use resolved dry_packages instead of always running the full suite"
   exit 1
@@ -379,21 +244,21 @@ if ! grep -Fq "No dry-run CLI E2E needed" <<<"$dry_run_section"; then
   exit 1
 fi
 
-if grep -Fq "name: Resolve CLI E2E domains" <<<"$section" ||
-   grep -Fq "run: node scripts/e2e_domains.js" <<<"$section"; then
-  echo "e2e-live should reuse e2e-dry-run outputs instead of resolving domains again"
+if ! grep -Fq "name: Resolve CLI E2E domains" <<<"$section" ||
+   ! grep -Fq "id: e2e_domains" <<<"$section" ||
+   ! grep -Fq "run: node scripts/e2e_domains.js" <<<"$section"; then
+  echo "e2e-live should resolve changed-file CLI E2E domains before credentials and tests"
   exit 1
 fi
 
-if ! grep -Fq "E2E_LIVE_PACKAGES: \${{ needs.e2e-dry-run.outputs.live_packages }}" <<<"$section"; then
-  echo "e2e-live should reuse live_packages resolved by e2e-dry-run"
+if ! grep -Fq "steps.e2e_domains.outputs.live_packages" <<<"$section"; then
+  echo "e2e-live should use resolved live_packages instead of always running the full suite"
   exit 1
 fi
 
-if ! grep -Fq "E2E_MODE: \${{ needs.e2e-dry-run.outputs.mode }}" <<<"$section" ||
-   ! grep -Fq "E2E_REASON: \${{ needs.e2e-dry-run.outputs.reason }}" <<<"$section" ||
+if ! grep -Fq "E2E_REASON: \${{ steps.e2e_domains.outputs.reason }}" <<<"$section" ||
    ! grep -Fq 'echo "Live CLI E2E domains: $E2E_MODE ($E2E_REASON)"' <<<"$section"; then
-  echo "e2e-live should consume the exact mode and reason produced by e2e-dry-run"
+  echo "e2e-live should pass dynamic domain output through env before shell use"
   exit 1
 fi
 
@@ -407,23 +272,16 @@ if ! awk '
   exit 1
 fi
 
-if grep -Fq "steps.e2e_domains.outputs" <<<"$section"; then
-  echo "e2e-live should not retain step-local domain outputs after adopting the dry-run job gate"
+if ! awk '
+  /^      - name: Build lark-cli/ { in_step = 1 }
+  in_step && /if: \$\{\{ steps\.e2e_domains\.outputs\.mode != '\''skip'\'' \}\}/ { found = 1 }
+  in_step && /^      - name:/ && !/Build lark-cli/ { in_step = 0 }
+  END { exit found ? 0 : 1 }
+' <<<"$section"; then
+  echo "e2e-live should skip building lark-cli when domain mode is skip"
   exit 1
 fi
 
-for step_name in "Build lark-cli" "Prepare shared live E2E tenant token"; do
-  live_setup_step="$(awk -v name="$step_name" '
-    $0 == "      - name: " name { in_step = 1 }
-    in_step { print }
-    in_step && /^      - name:/ && $0 != "      - name: " name { exit }
-  ' <<<"$section")"
-  if grep -Eq '^        if:' <<<"$live_setup_step"; then
-    echo "e2e-live $step_name should run unconditionally after the non-skip job gate" >&2
-    exit 1
-  fi
-done
-
 if ! grep -Fq "permissions:" <<<"$section" ||
    ! grep -Fq "contents: read" <<<"$section" ||
    ! grep -Fq "checks: write" <<<"$section"; then
@@ -441,88 +299,18 @@ if grep -Fq "live_e2e_credentials" <<<"$section" || grep -Fq "configured=false"
   exit 1
 fi
 
-if ! grep -Fq "node scripts/fetch_e2e_tat.js" <<<"$section"; then
-  echo "e2e-live should fetch the tenant token via the dedicated script"
-  exit 1
-fi
-
-if grep -Fq "config init" <<<"$section"; then
-  echo "e2e-live should use env credentials instead of config init"
-  exit 1
-fi
-
-if ! grep -Fq "TEST_BOT1_APP_ID: \${{ secrets.TEST_BOT1_APP_ID }}" <<<"$section"; then
-  echo "e2e-live should keep the bot app id under a test-only job env name"
-  exit 1
-fi
-
-if awk '
-  /^  e2e-live:/ { in_job = 1; next }
-  in_job && /^  [A-Za-z0-9_-]+:/ { in_job = 0 }
-  in_job && /^    env:/ { in_env = 1; next }
-  in_env && /^    steps:/ { in_env = 0 }
-  in_env && /LARKSUITE_CLI_APP_ID:/ { found_standard_app_id = 1 }
-  END { exit found_standard_app_id ? 0 : 1 }
-' "$workflow"; then
-  echo "e2e-live should not activate the env credential provider at job scope"
-  exit 1
-fi
-
-if ! grep -Fq "LARKSUITE_CLI_BRAND: feishu" <<<"$section"; then
-  echo "e2e-live should pin the env credential brand to feishu"
-  exit 1
-fi
-
-if awk '
-  /^  e2e-live:/ { in_job = 1; next }
-  in_job && /^  [A-Za-z0-9_-]+:/ { in_job = 0 }
-  in_job && /^    env:/ { in_env = 1; next }
-  in_env && /^    steps:/ { in_env = 0 }
-  in_env && /(SECRET|ACCESS_TOKEN):/ { found_sensitive = 1 }
-  END { exit found_sensitive ? 0 : 1 }
-' "$workflow"; then
-  echo "e2e-live should not expose live E2E credentials through job-level env"
+if ! grep -Fq "::error::Missing required secrets: TEST_BOT1_APP_ID / TEST_BOT1_APP_SECRET" <<<"$section"; then
+  echo "e2e-live should make missing bot credentials a visible configuration failure on eligible runs"
   exit 1
 fi
 
 if ! awk '
-  /^      - name: Prepare shared live E2E tenant token/ { in_step = 1 }
-  in_step && /id: live_e2e_tat/ { has_id = 1 }
-  in_step && /^        if:/ { has_if = 1 }
-  in_step && /LARKSUITE_CLI_APP_ID: \$\{\{ secrets\.TEST_BOT1_APP_ID \}\}/ { has_app_id = 1 }
-  in_step && /secrets\.TEST_BOT1_APP_SECRET/ { has_bot_credential = 1 }
-  in_step && /node scripts\/fetch_e2e_tat\.js/ { has_script = 1 }
-  in_step && /GITHUB_ENV/ { uses_github_env = 1 }
-  in_step && /^      - name:/ && !/Prepare shared live E2E tenant token/ { in_step = 0 }
-  END { exit has_id && !has_if && has_app_id && has_bot_credential && has_script && !uses_github_env ? 0 : 1 }
+  /^      - name: Configure bot credentials/ { in_step = 1 }
+  in_step && /if: \$\{\{ steps\.e2e_domains\.outputs\.mode != '\''skip'\'' \}\}/ { found = 1 }
+  in_step && /^      - name:/ && !/Configure bot credentials/ { in_step = 0 }
+  END { exit found ? 0 : 1 }
 ' <<<"$section"; then
-  echo "e2e-live should pass only a private tenant token file path through step output"
-  exit 1
-fi
-
-if ! awk '
-  /^      - name: Run CLI E2E tests/ { in_step = 1 }
-  in_step && /E2E_TENANT_AUTH_FILE: \$\{\{ steps\.live_e2e_tat\.outputs\.path \}\}/ { has_file = 1 }
-  in_step && /secrets\.TEST_USER_ACCESS_TOKEN/ { has_user_credential = 1 }
-  in_step && /Missing shared live E2E tenant token file/ { checks_file = 1 }
-  in_step && /^ *export / && /TEST_TENANT_ACCESS_TOKEN/ && /E2E_TENANT_AUTH_FILE/ { exports_test_tat = 1 }
-  in_step && /^ *export / && /LARKSUITE_CLI_TENANT_ACCESS_TOKEN/ { exports_standard_tat = 1 }
-  in_step && /LARKSUITE_CLI_APP_ID="\$TEST_BOT1_APP_ID"/ { scopes_preflight_app_id = 1 }
-  in_step && /LARKSUITE_CLI_TENANT_ACCESS_TOKEN="\$TEST_TENANT_ACCESS_TOKEN"/ { scopes_preflight_tat = 1 }
-  in_step && /lark-cli whoami --as bot/ { has_preflight = 1 }
-  in_step && /Tenant credential preflight failed/ { checks_preflight = 1 }
-  in_step && /TEST_USER_ACCESS_TOKEN/ && /secrets\.TEST_USER_ACCESS_TOKEN/ { has_user_env = 1 }
-  in_step && /LARKSUITE_CLI_USER_ACCESS_TOKEN/ && /secrets\.TEST_USER_ACCESS_TOKEN/ { has_global_user_env = 1 }
-  in_step && /trap / { has_trap = 1 }
-  in_step && /^      - name:/ && !/Run CLI E2E tests/ { in_step = 0 }
-  END { exit has_file && has_user_credential && checks_file && exports_test_tat && !exports_standard_tat && scopes_preflight_app_id && scopes_preflight_tat && has_preflight && checks_preflight && has_user_env && !has_global_user_env && !has_trap ? 0 : 1 }
-' <<<"$section"; then
-  echo "e2e-live should expose live E2E credentials only inside the test shell step"
-  exit 1
-fi
-
-if grep -Fq 'if [ "$E2E_MODE" = "skip" ]' <<<"$section"; then
-  echo "e2e-live should not retain an unreachable step-level skip branch"
+  echo "e2e-live should only configure bot credentials when domain mode is not skip"
   exit 1
 fi
 
@@ -531,8 +319,8 @@ if grep -Fq "steps.live_e2e_credentials.outputs.configured" <<<"$section"; then
   exit 1
 fi
 
-if ! grep -Fq "if: \${{ !cancelled() }}" <<<"$section"; then
-  echo "e2e-live report step should run after attempted live tests unless the workflow is cancelled"
+if ! grep -Fq "if: \${{ !cancelled() && steps.e2e_domains.outputs.mode != 'skip' }}" <<<"$section"; then
+  echo "e2e-live report step should run after attempted live tests unless the workflow is cancelled or domain mode is skip"
   exit 1
 fi
 
@@ -554,7 +342,7 @@ if grep -Fq '${{ secrets.CODECOV_TOKEN }}' <<<"$coverage_step" &&
 fi
 
 if grep -Fq '${{ secrets.' <<<"$section" &&
-   ! grep -Fq "$fork_safe_guard" <<<"$section"; then
+   ! grep -Fq "if: \${{ $fork_safe_guard }}" <<<"$section"; then
   echo "live E2E secrets should be available on push and same-repository pull_request, but not fork pull_request" >&2
   exit 1
 fi

scripts/fetch_e2e_tat.js

@@ -1,164 +0,0 @@
-#!/usr/bin/env node
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-// Fetches a live E2E tenant access token (TAT) for the shared bot identity.
-//
-// Invoked from the e2e-live CI job. Exchanges the bot app id/secret for a
-// tenant access token, writes the token to a private file under $RUNNER_TEMP,
-// and emits the file path as a step output so the test step can read it once
-// and then delete it.
-//
-// The secret arrives via environment variables; the OAuth parameter names are
-// literal because this is a source code file (.js), so the quality gate's
-// benign-code-credential exemption applies to the process.env references.
-
-const fs = require("node:fs");
-const http = require("node:http");
-const https = require("node:https");
-const path = require("node:path");
-const { URL } = require("node:url");
-
-const ENDPOINT = process.env.E2E_TAT_ENDPOINT || "https://accounts.feishu.cn/oauth/v3/token";
-const MAX_ATTEMPTS = 4;
-const RETRY_BASE_MS = parseInt(process.env.E2E_TAT_RETRY_BASE_MS || "1000", 10);
-
-function requireEnv(name) {
-  const value = process.env[name];
-  if (!value) {
-    console.error(`::error::Missing required environment variable: ${name}`);
-    process.exit(1);
-  }
-  return value;
-}
-
-function postForm(url, body) {
-  return new Promise((resolve, reject) => {
-    const parsed = new URL(url);
-    const transport = parsed.protocol === "http:" ? http : https;
-    const req = transport.request(
-      parsed,
-      {
-        method: "POST",
-        headers: {
-          "Content-Type": "application/x-www-form-urlencoded",
-          "Content-Length": Buffer.byteLength(body),
-        },
-        timeout: 20000,
-      },
-      (resp) => {
-        const chunks = [];
-        let settled = false;
-        const rejectOnce = (error) => {
-          if (!settled) {
-            settled = true;
-            reject(error);
-          }
-        };
-        resp.on("data", (chunk) => chunks.push(chunk));
-        resp.on("aborted", () => rejectOnce(new Error("response aborted before completion")));
-        resp.on("error", rejectOnce);
-        resp.on("close", () => {
-          if (!resp.complete) {
-            rejectOnce(new Error("response closed before completion"));
-          }
-        });
-        resp.on("end", () => {
-          if (!resp.complete) {
-            rejectOnce(new Error("response ended before completion"));
-            return;
-          }
-          settled = true;
-          resolve({
-            status: resp.statusCode,
-            body: Buffer.concat(chunks).toString("utf8"),
-            headers: resp.headers,
-          });
-        });
-      },
-    );
-    req.on("timeout", () => {
-      req.destroy();
-      reject(new Error("request timed out"));
-    });
-    req.on("error", reject);
-    req.write(body);
-    req.end();
-  });
-}
-
-function encodeForm(params) {
-  return Object.entries(params)
-    .map(([key, value]) => `${encodeURIComponent(key)}=${encodeURIComponent(value)}`)
-    .join("&");
-}
-
-function sleep(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
-}
-
-async function fetchTenantToken() {
-  const appId = requireEnv("LARKSUITE_CLI_APP_ID");
-  const appSecret = requireEnv("TEST_BOT1_APP_SECRET");
-
-  const body = encodeForm({
-    grant_type: "client_credentials",
-    client_id: appId,
-    client_secret: appSecret,
-  });
-
-  let lastError = "";
-  for (let attempt = 1; attempt <= MAX_ATTEMPTS; attempt++) {
-    try {
-      const { status, body: respBody, headers } = await postForm(ENDPOINT, body);
-      let payload;
-      try {
-        payload = JSON.parse(respBody);
-      } catch {
-        const logID = headers["x-tt-logid"] || headers["x-request-id"] || "unavailable";
-        lastError = `HTTP ${status}, log_id=${logID}, non-JSON response`;
-      }
-      if (payload) {
-        const token = payload.access_token;
-        if (status === 200 && payload.code === 0 && token) {
-          return token;
-        }
-        lastError = `HTTP ${status}, code=${payload.code}, error=${payload.error}, msg=${payload.msg || payload.error_description}`;
-      }
-    } catch (err) {
-      lastError = err.message;
-    }
-
-    if (attempt < MAX_ATTEMPTS) {
-      await sleep(2 ** (attempt - 1) * RETRY_BASE_MS);
-    }
-  }
-
-  console.error(`::error::Failed to fetch tenant access token: ${lastError}`);
-  process.exit(1);
-}
-
-async function main() {
-  const token = await fetchTenantToken();
-  console.log(`::add-mask::${token}`);
-
-  const tatPath = path.join(process.env.RUNNER_TEMP, "e2e-live-tat");
-  fs.writeFileSync(tatPath, token, { encoding: "utf8", mode: 0o600 });
-
-  if (process.env.GITHUB_OUTPUT) {
-    fs.appendFileSync(process.env.GITHUB_OUTPUT, `path=${tatPath}\n`);
-  }
-
-  console.log("Prepared shared live E2E tenant token");
-}
-
-if (require.main === module) {
-  main();
-}
-
-module.exports = {
-  encodeForm,
-  fetchTenantToken,
-  postForm,
-  requireEnv,
-};

scripts/fetch_e2e_tat.test.js

@@ -1,203 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-const assert = require("node:assert/strict");
-const fs = require("node:fs");
-const http = require("node:http");
-const os = require("node:os");
-const path = require("node:path");
-const { spawn } = require("node:child_process");
-const test = require("node:test");
-
-const scriptPath = path.join(__dirname, "fetch_e2e_tat.js");
-
-function startServer(handler) {
-  const server = http.createServer((req, res) => {
-    let body = "";
-    req.on("data", (chunk) => {
-      body += chunk;
-    });
-    req.on("end", () => {
-      handler(req, res, body);
-    });
-  });
-  return new Promise((resolve) => {
-    server.listen(0, "127.0.0.1", () => {
-      const port = server.address().port;
-      resolve({ server, port });
-    });
-  });
-}
-
-function abortResponse(res) {
-  res.writeHead(200, {
-    "Content-Type": "application/json",
-    "Content-Length": "100",
-  });
-  res.write('{"code":0');
-  setImmediate(() => res.destroy());
-}
-
-function runScript(envOverrides) {
-  const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "fetch-e2e-tat-"));
-  const githubOutput = path.join(tmpDir, "github-output");
-  const env = {
-    ...process.env,
-    LARKSUITE_CLI_APP_ID: "test_app_id",
-    TEST_BOT1_APP_SECRET: "test-secret",
-    RUNNER_TEMP: tmpDir,
-    GITHUB_OUTPUT: githubOutput,
-    E2E_TAT_RETRY_BASE_MS: "10",
-    ...envOverrides,
-  };
-
-  return new Promise((resolve) => {
-    const child = spawn(process.execPath, [scriptPath], {
-      cwd: path.join(__dirname, ".."),
-      env,
-    });
-
-    let stdout = "";
-    let stderr = "";
-    child.stdout.on("data", (data) => {
-      stdout += data;
-    });
-    child.stderr.on("data", (data) => {
-      stderr += data;
-    });
-    child.on("close", (code) => {
-      const output = fs.existsSync(githubOutput)
-        ? fs.readFileSync(githubOutput, "utf8")
-        : "";
-      resolve({ tmpDir, stdout, stderr, output, exitCode: code });
-    });
-  });
-}
-
-test("encodeForm encodes form parameters", () => {
-  const { encodeForm } = require(scriptPath);
-  const result = encodeForm({
-    grant_type: "client_credentials",
-    client_id: "abc&def",
-    client_secret: "test-secret",
-    note: "x=y",
-  });
-  const params = new URLSearchParams(result);
-  assert.equal(params.get("grant_type"), "client_credentials");
-  assert.equal(params.get("client_id"), "abc&def");
-  assert.equal(params.get("client_secret"), "test-secret");
-  assert.equal(params.get("note"), "x=y");
-});
-
-test("exits with error when app id is missing", async () => {
-  const result = await runScript({ LARKSUITE_CLI_APP_ID: "" });
-  assert.notEqual(result.exitCode, 0);
-  assert.match(result.stderr, /Missing required environment variable: LARKSUITE_CLI_APP_ID/);
-});
-
-test("exits with error when app secret is missing", async () => {
-  const result = await runScript({ TEST_BOT1_APP_SECRET: "" });
-  assert.notEqual(result.exitCode, 0);
-  assert.match(result.stderr, /Missing required environment variable: TEST_BOT1_APP_SECRET/);
-});
-
-test("fetches token and writes it to a private file", async () => {
-  const { server, port } = await startServer((req, res, body) => {
-    assert.equal(req.method, "POST");
-    const params = new URLSearchParams(body);
-    assert.equal(params.get("grant_type"), "client_credentials");
-    assert.equal(params.get("client_id"), "test_app_id");
-    assert.equal(params.get("client_secret"), "test-secret");
-    res.writeHead(200, { "Content-Type": "application/json" });
-    res.end(JSON.stringify({ code: 0, access_token: "test-token" }));
-  });
-
-  try {
-    const result = await runScript({
-      E2E_TAT_ENDPOINT: `http://127.0.0.1:${port}/token`,
-    });
-
-    assert.equal(result.exitCode, 0, `stderr: ${result.stderr}`);
-    assert.ok(result.stdout.includes("::add-mask::test-token"));
-    assert.ok(result.stdout.includes("Prepared shared live E2E tenant token"));
-
-    const tatPath = path.join(result.tmpDir, "e2e-live-tat");
-    assert.ok(fs.existsSync(tatPath), "token file should exist");
-
-    const stat = fs.statSync(tatPath);
-    assert.equal(stat.mode & 0o777, 0o600, "token file should be owner-only");
-    assert.equal(fs.readFileSync(tatPath, "utf8"), "test-token");
-
-    assert.ok(
-      result.output.includes(`path=${tatPath}`),
-      "should write path to GITHUB_OUTPUT",
-    );
-  } finally {
-    server.close();
-  }
-});
-
-test("retries an interrupted response and then succeeds", async () => {
-  let requestCount = 0;
-  const { server, port } = await startServer((req, res) => {
-    requestCount++;
-    if (requestCount === 1) {
-      abortResponse(res);
-      return;
-    }
-    res.writeHead(200, { "Content-Type": "application/json" });
-    res.end(JSON.stringify({ code: 0, access_token: "test-token" }));
-  });
-
-  try {
-    const result = await runScript({
-      E2E_TAT_ENDPOINT: `http://127.0.0.1:${port}/token`,
-    });
-
-    assert.equal(result.exitCode, 0, `stderr: ${result.stderr}`);
-    assert.equal(requestCount, 2);
-  } finally {
-    server.close();
-  }
-});
-
-test("fails after every interrupted response is retried", async () => {
-  let requestCount = 0;
-  const { server, port } = await startServer((req, res) => {
-    requestCount++;
-    abortResponse(res);
-  });
-
-  try {
-    const result = await runScript({
-      E2E_TAT_ENDPOINT: `http://127.0.0.1:${port}/token`,
-    });
-
-    assert.notEqual(result.exitCode, 0);
-    assert.equal(requestCount, 4);
-    assert.match(result.stderr, /Failed to fetch tenant access token/);
-  } finally {
-    server.close();
-  }
-});
-
-test("exits with error after all retries fail", async () => {
-  let requestCount = 0;
-  const { server, port } = await startServer((req, res) => {
-    requestCount++;
-    res.writeHead(500, { "Content-Type": "application/json" });
-    res.end(JSON.stringify({ code: 500, error: "server error" }));
-  });
-
-  try {
-    const result = await runScript({
-      E2E_TAT_ENDPOINT: `http://127.0.0.1:${port}/token`,
-    });
-
-    assert.notEqual(result.exitCode, 0);
-    assert.equal(requestCount, 4);
-    assert.match(result.stderr, /Failed to fetch tenant access token/);
-  } finally {
-    server.close();
-  }
-});

shortcuts/apps/apps_access_scope_get_test.go

@@ -20,7 +20,7 @@ func TestAppsAccessScopeGet_Specific(t *testing.T) {
 			"data": map[string]interface{}{
 				"scope":       "Range",
 				"users":       []interface{}{"ou_x", "ou_y"},
-				"departments": []interface{}{"od-z"},
+				"departments": []interface{}{"od_z"},
 				"chats":       []interface{}{"oc_g"},
 				"apply_config": map[string]interface{}{
 					"enabled":   true,
@@ -39,7 +39,7 @@ func TestAppsAccessScopeGet_Specific(t *testing.T) {
 	if !strings.Contains(got, `"scope": "Range"`) {
 		t.Fatalf("scope string not preserved (expect raw \"Range\"): %s", got)
 	}
-	if !strings.Contains(got, `"ou_x"`) || !strings.Contains(got, `"od-z"`) || !strings.Contains(got, `"oc_g"`) {
+	if !strings.Contains(got, `"ou_x"`) || !strings.Contains(got, `"od_z"`) || !strings.Contains(got, `"oc_g"`) {
 		t.Fatalf("users/departments/chats fields missing in envelope: %s", got)
 	}
 	if !strings.Contains(got, `"ou_appr"`) {

shortcuts/apps/apps_automation_create.go

@@ -1,253 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package apps
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"io"
-	"net"
-	"strings"
-
-	"github.com/larksuite/cli/shortcuts/common"
-)
-
-// AppsAutomationCreate creates an automation trigger (type-dispatched condition).
-var AppsAutomationCreate = common.Shortcut{
-	Service:     appsService,
-	Command:     "+automation-create",
-	Description: "Create an automation trigger (cron/record-change/webhook/feishu-approval); created disabled",
-	Risk:        "write",
-	Tips: []string{
-		"Example: lark-cli apps +automation-create --app-id <id> --name daily --trigger-type cron --cron '0 9 * * *'",
-		"Example: lark-cli apps +automation-create --app-id <id> --name onUpd --trigger-type record-change --table <tbl> --event UPDATE",
-		"Example: lark-cli apps +automation-create --app-id <id> --name hook --trigger-type webhook",
-		"Example: lark-cli apps +automation-create --app-id <id> --name apv --trigger-type feishu-approval --event-type approval_instance --instance-status APPROVED",
-	},
-	Scopes:    []string{"spark:app:write"},
-	AuthTypes: []string{"user"},
-	HasFormat: true,
-	Flags: []common.Flag{
-		{Name: "app-id", Desc: "Miaoda app id", Required: true},
-		{Name: "name", Desc: "trigger name (unique within app, <=100 chars)", Required: true},
-		{Name: "trigger-type", Desc: "cron | record-change | webhook | feishu-approval", Required: true},
-		{Name: "description", Desc: "optional description (<=50 chars)"},
-		{Name: "cron", Desc: "[cron] 5-field cron expression, e.g. '0 9 * * *' (min interval 30m)"},
-		{Name: "timezone", Desc: "[cron] IANA timezone (default Asia/Shanghai)"},
-		{Name: "table", Desc: "[record-change] table name (from `+db-table-list`); dataloom tables key by name, not id"},
-		{Name: "event", Desc: "[record-change] INSERT | UPDATE | UPSERT | DELETE"},
-		{Name: "fields", Desc: "[record-change] JSON array of field ids for UPDATE/UPSERT, [\"*\"] = all"},
-		{Name: "white-ip-list", Desc: "[webhook] JSON array of allowed IPs"},
-		{Name: "approval-code", Desc: "[feishu-approval] approval definition code; omit to match all approval definitions"},
-		{Name: "event-type", Desc: "[feishu-approval] approval_instance | approval_task"},
-		{Name: "instance-status", Type: "string_array", Desc: "[feishu-approval] statuses for approval_instance"},
-		{Name: "task-status", Type: "string_array", Desc: "[feishu-approval] statuses for approval_task"},
-		{Name: "status", Desc: "optional initial status: enabled | disabled (default disabled; backend supports create+enable in one call)"},
-	},
-	Validate: func(ctx context.Context, rctx *common.RuntimeContext) error {
-		if _, err := requireAppID(rctx.Str("app-id")); err != nil {
-			return err
-		}
-		if strings.TrimSpace(rctx.Str("name")) == "" {
-			return appsValidationParamError("--name", "--name is required")
-		}
-		cliType := strings.TrimSpace(rctx.Str("trigger-type"))
-		if cliType == "" {
-			return appsValidationParamError("--trigger-type", "--trigger-type is required (cron/record-change/webhook/feishu-approval)")
-		}
-		// mapTriggerType also runs inside buildAutomationCreateBody, but
-		// re-running it up-front keeps the cross-family guard's error
-		// reachable — otherwise an unknown --trigger-type would bail out
-		// with the same guard's "belongs to trigger-type" wording, which
-		// misleads callers who typoed the type itself.
-		if _, err := mapTriggerType(cliType); err != nil {
-			return err
-		}
-		// Reject condition flags that do not belong to the selected type.
-		// buildAutomationCreateBody's switch used to silently drop them
-		// (e.g. --trigger-type webhook --cron '0 9 * * *' created a webhook
-		// with no cron, though the caller believed --cron was set).
-		if err := rejectCrossFamilyCondFlags(rctx, cliType); err != nil {
-			return err
-		}
-		_, err := buildAutomationCreateBody(rctx)
-		return err
-	},
-	DryRun: func(ctx context.Context, rctx *common.RuntimeContext) *common.DryRunAPI {
-		appID, _ := requireAppID(rctx.Str("app-id"))
-		body, _ := buildAutomationCreateBody(rctx)
-		return common.NewDryRunAPI().
-			POST(automationListPath(appID)).
-			Desc("Create automation trigger").
-			Body(body)
-	},
-	Execute: func(ctx context.Context, rctx *common.RuntimeContext) error {
-		appID, err := requireAppID(rctx.Str("app-id"))
-		if err != nil {
-			return err
-		}
-		body, err := buildAutomationCreateBody(rctx)
-		if err != nil {
-			return err
-		}
-		data, err := rctx.CallAPITyped("POST", automationListPath(appID), nil, body)
-		if err != nil {
-			return withAppsHint(err, appIDListHint)
-		}
-		// Bearer-token redaction reverse invariant: the backend create path
-		// re-reads the freshly created trigger through the same read-path
-		// converter used by get/list — theoretically capable of returning a
-		// plaintext bearer token. On a fresh create the token is not yet
-		// enabled and this response should not carry plaintext, but redact
-		// for defense-in-depth and to keep every read-shaped output path
-		// (create / get / list / update-patch) consistently scrubbed.
-		redacted := redactWebhookToken(data)
-		trigger, _ := redacted["trigger"].(map[string]interface{})
-		rctx.OutFormat(redacted, nil, func(w io.Writer) {
-			fmt.Fprintf(w, "created trigger: %v  [%v]  status: %v\n",
-				trigger["name"], trigger["trigger_type"], trigger["status"])
-		})
-		return nil
-	},
-}
-
-// buildAutomationCreateBody assembles {name, description?, trigger_type, <type>_condition}.
-func buildAutomationCreateBody(rctx *common.RuntimeContext) (map[string]interface{}, error) {
-	cliType := strings.TrimSpace(rctx.Str("trigger-type"))
-	snake, err := mapTriggerType(cliType)
-	if err != nil {
-		return nil, err
-	}
-	name := strings.TrimSpace(rctx.Str("name"))
-	if err := validateAutomationNameLen(name); err != nil {
-		return nil, err
-	}
-	body := map[string]interface{}{
-		"name":         name,
-		"trigger_type": snake,
-	}
-	if d := strings.TrimSpace(rctx.Str("description")); d != "" {
-		if err := validateAutomationDescriptionLen(d); err != nil {
-			return nil, err
-		}
-		body["description"] = d
-	}
-	// --status is an optional passthrough: when set, backend creates + enables
-	// (or leaves disabled) in one call. Omitting the field lets the backend
-	// default (disabled) apply, matching the spec's default-disabled invariant.
-	if s := strings.TrimSpace(rctx.Str("status")); s != "" {
-		if s != "enabled" && s != "disabled" {
-			return nil, appsValidationParamError("--status",
-				"--status must be enabled or disabled, got %q", s)
-		}
-		body["status"] = s
-	}
-	switch cliType {
-	case "cron":
-		cond, err := buildCronCondition(rctx.Str("cron"), rctx.Str("timezone"))
-		if err != nil {
-			return nil, err
-		}
-		body["cron_condition"] = cond
-	case "record-change":
-		fields, err := parseFieldsFlag(rctx.Str("fields"))
-		if err != nil {
-			return nil, err
-		}
-		cond, err := buildRecordChangeCondition(rctx.Str("table"), rctx.Str("event"), fields)
-		if err != nil {
-			return nil, err
-		}
-		body["record_change_condition"] = cond
-	case "webhook":
-		ipList, err := parseIPListFlag(rctx.Str("white-ip-list"))
-		if err != nil {
-			return nil, err
-		}
-		body["webhook_condition"] = buildWebhookCondition(ipList)
-	case "feishu-approval":
-		eventType := strings.TrimSpace(rctx.Str("event-type"))
-		if eventType == "" {
-			return nil, appsValidationParamError("--event-type", "--event-type is required for feishu-approval (approval_instance/approval_task)")
-		}
-		raw := rctx.StrArray("instance-status")
-		if eventType == "approval_task" {
-			raw = rctx.StrArray("task-status")
-		}
-		// buildApprovalCondition stores the passed statuses verbatim (it only
-		// uppercases for validation), so normalize to the uppercase enum here to
-		// guarantee the backend receives canonical values (foundation review).
-		statuses := normalizeApprovalStatuses(raw)
-		cond, err := buildApprovalCondition(rctx.Str("approval-code"), eventType, statuses)
-		if err != nil {
-			return nil, err
-		}
-		body["feishu_approval_condition"] = cond
-	}
-	return body, nil
-}
-
-// normalizeApprovalStatuses trims and uppercases each status so the body carries
-// the canonical enum values expected by the backend.
-func normalizeApprovalStatuses(raw []string) []string {
-	if len(raw) == 0 {
-		return raw
-	}
-	out := make([]string, 0, len(raw))
-	for _, s := range raw {
-		out = append(out, strings.ToUpper(strings.TrimSpace(s)))
-	}
-	return out
-}
-
-// parseFieldsFlag parses --fields JSON array; empty → nil.
-func parseFieldsFlag(raw string) ([]string, error) {
-	raw = strings.TrimSpace(raw)
-	if raw == "" {
-		return nil, nil
-	}
-	var arr []string
-	if err := json.Unmarshal([]byte(raw), &arr); err != nil {
-		return nil, appsValidationParamError("--fields", "--fields must be a JSON array of strings: %v", err)
-	}
-	return arr, nil
-}
-
-// parseIPListFlag parses --white-ip-list JSON array; empty → nil (field
-// omitted). Each entry is validated as an IPv4/IPv6 address or CIDR, matching
-// the defense-in-depth stance the record-change --event whitelist takes —
-// silent acceptance of malformed IPs would let a typoed entry (`"1.1.1.1 "`
-// with trailing space, `"not-an-ip"`, or `"10.0.0.256"`) narrow the webhook
-// caller allowlist to nothing while the operator believes it is enforcing
-// origin restrictions.
-func parseIPListFlag(raw string) ([]string, error) {
-	raw = strings.TrimSpace(raw)
-	if raw == "" {
-		return nil, nil
-	}
-	var arr []string
-	if err := json.Unmarshal([]byte(raw), &arr); err != nil {
-		return nil, appsValidationParamError("--white-ip-list", "--white-ip-list must be a JSON array of strings: %v", err)
-	}
-	out := make([]string, 0, len(arr))
-	for i, entry := range arr {
-		trimmed := strings.TrimSpace(entry)
-		if trimmed == "" {
-			return nil, appsValidationParamError("--white-ip-list",
-				"--white-ip-list entry %d is empty; either drop it or provide a valid IP/CIDR", i)
-		}
-		if net.ParseIP(trimmed) != nil {
-			out = append(out, trimmed)
-			continue
-		}
-		if _, _, cidrErr := net.ParseCIDR(trimmed); cidrErr == nil {
-			out = append(out, trimmed)
-			continue
-		}
-		return nil, appsValidationParamError("--white-ip-list",
-			"--white-ip-list entry %d %q is not a valid IPv4/IPv6 address or CIDR block", i, entry)
-	}
-	return out, nil
-}

shortcuts/apps/apps_automation_create_test.go

@@ -1,265 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package apps
-
-import (
-	"context"
-	"strings"
-	"testing"
-
-	"github.com/larksuite/cli/internal/httpmock"
-)
-
-func automationCreateFlagDefs() map[string]string {
-	return map[string]string{
-		"app-id": "string", "name": "string", "trigger-type": "string", "description": "string",
-		"cron": "string", "timezone": "string",
-		"table": "string", "event": "string", "fields": "string",
-		"white-ip-list": "string",
-		"approval-code": "string", "event-type": "string",
-		"instance-status": "string_array", "task-status": "string_array",
-		"status": "string",
-	}
-}
-
-func TestAutomationCreateCron_BuildsBody(t *testing.T) {
-	rctx, stdoutBuf, reg := newOpenAPIKeyRCtx(t, automationCreateFlagDefs(),
-		map[string]string{"app-id": "app_x", "name": "daily", "trigger-type": "cron", "cron": "0 9 * * *"})
-	// Real backend response wraps the created trigger under `trigger` (a live
-	// test-env probe confirmed the shape, same as GET/PUT). The Execute pretty
-	// path reads trigger["name"]/["trigger_type"]/["status"] from that key —
-	// a flat fixture makes the pretty path print `<nil>` and only passes via
-	// the JSON envelope, which hides regressions in the pretty branch.
-	reg.Register(&httpmock.Stub{
-		Method: "POST", URL: "/open-apis/spark/v1/apps/app_x/triggers",
-		Body: map[string]interface{}{"code": 0, "data": map[string]interface{}{
-			"trigger": map[string]interface{}{
-				"name": "daily", "trigger_type": "cron", "status": "disabled",
-			},
-		}},
-	})
-	if err := AppsAutomationCreate.Execute(context.Background(), rctx); err != nil {
-		t.Fatalf("Execute() = %v", err)
-	}
-	if !strings.Contains(stdoutBuf.String(), "daily") {
-		t.Errorf("create output must contain trigger name: %s", stdoutBuf.String())
-	}
-}
-
-func TestAutomationCreate_MissingType(t *testing.T) {
-	rctx, _, _ := newOpenAPIKeyRCtx(t, automationCreateFlagDefs(),
-		map[string]string{"app-id": "app_x", "name": "n"})
-	err := AppsAutomationCreate.Validate(context.Background(), rctx)
-	assertValidationParamError(t, err, "--trigger-type")
-}
-
-// TestAutomationCreate_CrossFamilyFlagsRejected pins the F1 guard: a condition
-// flag from a family other than --trigger-type used to be silently dropped by
-// buildAutomationCreateBody's single-branch switch, so
-// `--trigger-type webhook --cron '0 9 * * *'` created a webhook with no cron
-// but returned success. Validate now rejects the cross-family flag up-front.
-func TestAutomationCreate_CrossFamilyFlagsRejected(t *testing.T) {
-	cases := []struct {
-		name      string
-		flags     map[string]string
-		wantParam string
-	}{
-		{"webhook_with_cron",
-			map[string]string{
-				"app-id": "app_x", "name": "n", "trigger-type": "webhook",
-				"cron": "0 9 * * *",
-			}, "--cron"},
-		{"cron_with_white_ip_list",
-			map[string]string{
-				"app-id": "app_x", "name": "n", "trigger-type": "cron",
-				"cron": "0 9 * * *", "white-ip-list": `["1.1.1.1"]`,
-			}, "--white-ip-list"},
-		{"record_change_with_event_type",
-			map[string]string{
-				"app-id": "app_x", "name": "n", "trigger-type": "record-change",
-				"table": "tbl", "event": "UPDATE", "event-type": "approval_instance",
-			}, "--event-type"},
-		{"feishu_approval_with_table",
-			map[string]string{
-				"app-id": "app_x", "name": "n", "trigger-type": "feishu-approval",
-				"event-type": "approval_instance", "instance-status": "APPROVED",
-				"table": "tbl",
-			}, "--table"},
-	}
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			rctx, _, _ := newOpenAPIKeyRCtx(t, automationCreateFlagDefs(), tc.flags)
-			err := AppsAutomationCreate.Validate(context.Background(), rctx)
-			assertValidationParamError(t, err, tc.wantParam)
-		})
-	}
-}
-
-// TestAutomationCreate_UnknownTriggerTypeRejected: --trigger-type must be one
-// of the four supported kebab-case values. A typo used to sneak past Validate
-// (buildAutomationCreateBody caught it, but only after the cross-family guard
-// would otherwise fire with a misleading "belongs to type" message).
-func TestAutomationCreate_UnknownTriggerTypeRejected(t *testing.T) {
-	rctx, _, _ := newOpenAPIKeyRCtx(t, automationCreateFlagDefs(),
-		map[string]string{"app-id": "app_x", "name": "n", "trigger-type": "bogus"})
-	err := AppsAutomationCreate.Validate(context.Background(), rctx)
-	assertValidationParamError(t, err, "--trigger-type")
-}
-
-func TestAutomationCreateCron_Sub30MinRejected(t *testing.T) {
-	rctx, _, _ := newOpenAPIKeyRCtx(t, automationCreateFlagDefs(),
-		map[string]string{"app-id": "app_x", "name": "n", "trigger-type": "cron", "cron": "*/5 * * * *"})
-	err := AppsAutomationCreate.Validate(context.Background(), rctx)
-	assertValidationParamError(t, err, "--cron")
-}
-
-func TestAutomationCreateRecordChange_MissingEvent(t *testing.T) {
-	rctx, _, _ := newOpenAPIKeyRCtx(t, automationCreateFlagDefs(),
-		map[string]string{"app-id": "app_x", "name": "n", "trigger-type": "record-change", "table": "tbl"})
-	err := AppsAutomationCreate.Validate(context.Background(), rctx)
-	assertValidationParamError(t, err, "--event")
-}
-
-func TestAutomationCreateApproval_CodeOptional(t *testing.T) {
-	rctx, _, reg := newOpenAPIKeyRCtx(t, automationCreateFlagDefs(),
-		map[string]string{"app-id": "app_x", "name": "n", "trigger-type": "feishu-approval",
-			"event-type": "approval_instance", "instance-status": "APPROVED"})
-	reg.Register(&httpmock.Stub{
-		Method: "POST", URL: "/open-apis/spark/v1/apps/app_x/triggers",
-		Body: map[string]interface{}{"code": 0, "data": map[string]interface{}{"name": "n", "status": "disabled"}},
-	})
-	if err := AppsAutomationCreate.Validate(context.Background(), rctx); err != nil {
-		t.Fatalf("approval without --approval-code must pass validation: %v", err)
-	}
-	if err := AppsAutomationCreate.Execute(context.Background(), rctx); err != nil {
-		t.Fatalf("Execute() = %v", err)
-	}
-}
-
-// TestAutomationCreateApproval_StatusUppercased asserts that a lowercase status
-// passed via --instance-status is normalized to the uppercase enum in the body
-// before it reaches the backend (foundation review: buildApprovalCondition stores
-// the raw statuses, so create must uppercase them itself).
-func TestAutomationCreateApproval_StatusUppercased(t *testing.T) {
-	rctx, _, _ := newOpenAPIKeyRCtx(t, automationCreateFlagDefs(),
-		map[string]string{"app-id": "app_x", "name": "n", "trigger-type": "feishu-approval",
-			"event-type": "approval_instance", "instance-status": "approved"})
-	body, err := buildAutomationCreateBody(rctx)
-	if err != nil {
-		t.Fatalf("buildAutomationCreateBody() = %v", err)
-	}
-	cond, ok := body["feishu_approval_condition"].(map[string]interface{})
-	if !ok {
-		t.Fatalf("feishu_approval_condition missing or wrong type: %+v", body)
-	}
-	statuses, ok := cond["status"].([]string)
-	if !ok {
-		t.Fatalf("status must be []string: %+v", cond)
-	}
-	if len(statuses) != 1 || statuses[0] != "APPROVED" {
-		t.Errorf("lowercase status must be uppercased to APPROVED, got %v", statuses)
-	}
-}
-
-// TestAutomationCreate_RedactsWebhookToken covers the bearer-token redaction
-// reverse invariant on the create path against the real response shape (a
-// live test-env probe confirmed POST wraps the trigger under a `trigger`
-// key, same as GET/PUT). The backend create path re-reads the freshly
-// created trigger and returns it through the same read-path converter used
-// by get/list — theoretically capable of returning a plaintext bearer
-// token. Defense-in-depth: CLI create must also redact so every read-shaped
-// output path is consistently scrubbed.
-func TestAutomationCreate_RedactsWebhookToken(t *testing.T) {
-	rctx, stdoutBuf, reg := newOpenAPIKeyRCtx(t, automationCreateFlagDefs(),
-		map[string]string{"app-id": "app_x", "name": "wh1", "trigger-type": "webhook"})
-	reg.Register(&httpmock.Stub{
-		Method: "POST", URL: "/open-apis/spark/v1/apps/app_x/triggers",
-		Body: map[string]interface{}{"code": 0, "data": map[string]interface{}{
-			"trigger": map[string]interface{}{
-				"name": "wh1", "trigger_type": "webhook", "status": "disabled",
-				"trigger_condition": map[string]interface{}{
-					"preview_url": "https://p", "runtime_url": "https://r",
-					"token_enabled": true, "token_value": "PLAINTEXT_CREATE_TOKEN",
-				},
-			},
-		}},
-	})
-	if err := AppsAutomationCreate.Execute(context.Background(), rctx); err != nil {
-		t.Fatalf("Execute() = %v", err)
-	}
-	out := stdoutBuf.String()
-	if strings.Contains(out, "PLAINTEXT_CREATE_TOKEN") {
-		t.Errorf("create must never surface plaintext token: %s", out)
-	}
-}
-
-// TestAutomationCreate_StatusPassthrough verifies --status is included in the
-// POST body when set. Backend supports create+enable in one call via the
-// optional status field; CLI passes it through unchanged.
-func TestAutomationCreate_StatusPassthrough(t *testing.T) {
-	rctx, _, _ := newOpenAPIKeyRCtx(t, automationCreateFlagDefs(),
-		map[string]string{
-			"app-id": "app_x", "name": "n", "trigger-type": "cron",
-			"cron": "0 9 * * *", "status": "enabled",
-		})
-	body, err := buildAutomationCreateBody(rctx)
-	if err != nil {
-		t.Fatalf("buildBody: %v", err)
-	}
-	if body["status"] != "enabled" {
-		t.Errorf("status = %v; want enabled", body["status"])
-	}
-}
-
-// TestAutomationCreate_StatusInvalid: only enabled/disabled accepted.
-func TestAutomationCreate_StatusInvalid(t *testing.T) {
-	rctx, _, _ := newOpenAPIKeyRCtx(t, automationCreateFlagDefs(),
-		map[string]string{
-			"app-id": "app_x", "name": "n", "trigger-type": "cron",
-			"cron": "0 9 * * *", "status": "bogus",
-		})
-	_, err := buildAutomationCreateBody(rctx)
-	assertValidationParamError(t, err, "--status")
-}
-
-// TestAutomationCreate_StatusOmitted: when --status is not set, body must not
-// carry a status field — backend applies its default (disabled).
-func TestAutomationCreate_StatusOmitted(t *testing.T) {
-	rctx, _, _ := newOpenAPIKeyRCtx(t, automationCreateFlagDefs(),
-		map[string]string{
-			"app-id": "app_x", "name": "n", "trigger-type": "cron",
-			"cron": "0 9 * * *",
-		})
-	body, err := buildAutomationCreateBody(rctx)
-	if err != nil {
-		t.Fatalf("buildBody: %v", err)
-	}
-	if _, present := body["status"]; present {
-		t.Errorf("status must be omitted when --status not set, got %v", body["status"])
-	}
-}
-
-// TestAutomationCreate_NameTooLong: --name > 100 chars is rejected locally with
-// a typed --name error, sparing the round trip to the backend.
-func TestAutomationCreate_NameTooLong(t *testing.T) {
-	rctx, _, _ := newOpenAPIKeyRCtx(t, automationCreateFlagDefs(),
-		map[string]string{
-			"app-id": "app_x", "name": strings.Repeat("n", automationNameMaxLen+1),
-			"trigger-type": "cron", "cron": "0 9 * * *",
-		})
-	_, err := buildAutomationCreateBody(rctx)
-	assertValidationParamError(t, err, "--name")
-}
-
-// TestAutomationCreate_DescriptionTooLong: --description > 50 chars is rejected
-// locally with a typed --description error.
-func TestAutomationCreate_DescriptionTooLong(t *testing.T) {
-	rctx, _, _ := newOpenAPIKeyRCtx(t, automationCreateFlagDefs(),
-		map[string]string{
-			"app-id": "app_x", "name": "n", "trigger-type": "cron",
-			"cron": "0 9 * * *", "description": strings.Repeat("d", automationDescriptionMaxLen+1),
-		})
-	_, err := buildAutomationCreateBody(rctx)
-	assertValidationParamError(t, err, "--description")
-}

shortcuts/apps/apps_automation_disable.go

@@ -1,38 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package apps
-
-import (
-	"context"
-	"strings"
-
-	"github.com/larksuite/cli/shortcuts/common"
-)
-
-// AppsAutomationDisable disables a trigger. Maps to the shared status endpoint.
-var AppsAutomationDisable = common.Shortcut{
-	Service:     appsService,
-	Command:     "+automation-disable",
-	Description: "Disable an automation trigger (stops auto-firing; does not delete)",
-	Risk:        "write",
-	Tips:        []string{"Example: lark-cli apps +automation-disable --app-id <id> --name <trigger_name>"},
-	Scopes:      []string{"spark:app:write"},
-	AuthTypes:   []string{"user"},
-	HasFormat:   true,
-	Flags: []common.Flag{
-		{Name: "app-id", Desc: "Miaoda app id", Required: true},
-		{Name: "name", Desc: "trigger name", Required: true},
-	},
-	Validate: automationValidateName,
-	DryRun: func(ctx context.Context, rctx *common.RuntimeContext) *common.DryRunAPI {
-		appID, _ := requireAppID(rctx.Str("app-id"))
-		return common.NewDryRunAPI().
-			PATCH(automationItemPath(appID, strings.TrimSpace(rctx.Str("name")))).
-			Desc("Disable automation trigger").
-			Body(statusBodyFromAction(false))
-	},
-	Execute: func(ctx context.Context, rctx *common.RuntimeContext) error {
-		return runAutomationStatus(rctx, false)
-	},
-}

shortcuts/apps/apps_automation_enable.go

@@ -1,70 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package apps
-
-import (
-	"context"
-	"fmt"
-	"io"
-	"strings"
-
-	"github.com/larksuite/cli/shortcuts/common"
-)
-
-// AppsAutomationEnable enables (activates) a trigger. Maps to the shared status endpoint.
-var AppsAutomationEnable = common.Shortcut{
-	Service:     appsService,
-	Command:     "+automation-enable",
-	Description: "Enable (activate) an automation trigger",
-	Risk:        "write",
-	Tips:        []string{"Example: lark-cli apps +automation-enable --app-id <id> --name <trigger_name>"},
-	Scopes:      []string{"spark:app:write"},
-	AuthTypes:   []string{"user"},
-	HasFormat:   true,
-	Flags: []common.Flag{
-		{Name: "app-id", Desc: "Miaoda app id", Required: true},
-		{Name: "name", Desc: "trigger name", Required: true},
-	},
-	Validate: automationValidateName,
-	DryRun: func(ctx context.Context, rctx *common.RuntimeContext) *common.DryRunAPI {
-		appID, _ := requireAppID(rctx.Str("app-id"))
-		return common.NewDryRunAPI().
-			PATCH(automationItemPath(appID, strings.TrimSpace(rctx.Str("name")))).
-			Desc("Enable automation trigger").
-			Body(statusBodyFromAction(true))
-	},
-	Execute: func(ctx context.Context, rctx *common.RuntimeContext) error {
-		return runAutomationStatus(rctx, true)
-	},
-}
-
-// runAutomationStatus is shared by enable/disable: PATCH .../triggers/{name}
-// with {"status": ...}. The status change happens on the parent resource per
-// the backend OpenAPI spec (see reference Python samples in the trigger test
-// fixtures) — there is intentionally no /status sub-path; the sole nested
-// endpoints under a trigger are the webhook credential lifecycle
-// (/webhook/token/status, /webhook/token/reset, /webhook/url/reset).
-//
-// The status endpoint returns {"success": true} on success. Pretty output is
-// synthesized from rctx.name and the desired action, since the response
-// intentionally carries no trigger object to fish name/status from.
-func runAutomationStatus(rctx *common.RuntimeContext, enable bool) error {
-	appID, err := requireAppID(rctx.Str("app-id"))
-	if err != nil {
-		return err
-	}
-	name := strings.TrimSpace(rctx.Str("name"))
-	data, err := rctx.CallAPITyped("PATCH", automationItemPath(appID, name), nil, statusBodyFromAction(enable))
-	if err != nil {
-		return withAppsHint(err, automationNotFoundHint())
-	}
-	desiredStatus := "disabled"
-	if enable {
-		desiredStatus = "enabled"
-	}
-	rctx.OutFormat(data, nil, func(w io.Writer) {
-		fmt.Fprintf(w, "trigger %s status: %s\n", name, desiredStatus)
-	})
-	return nil
-}

shortcuts/apps/apps_automation_get.go

@@ -1,73 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package apps
-
-import (
-	"context"
-	"fmt"
-	"io"
-	"strings"
-
-	"github.com/larksuite/cli/shortcuts/common"
-)
-
-// AppsAutomationGet gets a single trigger's full config (webhook token redacted).
-var AppsAutomationGet = common.Shortcut{
-	Service:     appsService,
-	Command:     "+automation-get",
-	Description: "Get an automation trigger's config (webhook Bearer Token redacted)",
-	Risk:        "read",
-	Tips: []string{
-		"Example: lark-cli apps +automation-get --app-id <app_id> --name <trigger_name>",
-	},
-	Scopes:    []string{"spark:app:read"},
-	AuthTypes: []string{"user"},
-	HasFormat: true,
-	Flags: []common.Flag{
-		{Name: "app-id", Desc: "Miaoda app id", Required: true},
-		{Name: "name", Desc: "trigger name", Required: true},
-	},
-	Validate: automationValidateName,
-	DryRun: func(ctx context.Context, rctx *common.RuntimeContext) *common.DryRunAPI {
-		appID, _ := requireAppID(rctx.Str("app-id"))
-		return common.NewDryRunAPI().
-			GET(automationItemPath(appID, strings.TrimSpace(rctx.Str("name")))).
-			Desc("Get automation trigger")
-	},
-	Execute: func(ctx context.Context, rctx *common.RuntimeContext) error {
-		appID, err := requireAppID(rctx.Str("app-id"))
-		if err != nil {
-			return err
-		}
-		name := strings.TrimSpace(rctx.Str("name"))
-		data, err := rctx.CallAPITyped("GET", automationItemPath(appID, name), nil, nil)
-		if err != nil {
-			return withAppsHint(err, automationNotFoundHint())
-		}
-		redacted := redactWebhookToken(data)
-		trigger, _ := redacted["trigger"].(map[string]interface{})
-		rctx.OutFormat(redacted, nil, func(w io.Writer) {
-			fmt.Fprintf(w, "name: %v\ntype: %v\nstatus: %v\n",
-				trigger["name"], trigger["trigger_type"], trigger["status"])
-		})
-		return nil
-	},
-}
-
-// automationValidateName validates --app-id and --name presence. Shared by get/update/enable/disable.
-func automationValidateName(ctx context.Context, rctx *common.RuntimeContext) error {
-	if _, err := requireAppID(rctx.Str("app-id")); err != nil {
-		return err
-	}
-	if strings.TrimSpace(rctx.Str("name")) == "" {
-		return appsValidationParamError("--name", "--name is required").
-			WithHint("find trigger names with `lark-cli apps +automation-list --app-id <app_id>`")
-	}
-	return nil
-}
-
-// automationNotFoundHint is the shared recovery hint when a trigger name may not exist.
-func automationNotFoundHint() string {
-	return "verify the trigger name with `lark-cli apps +automation-list --app-id <app_id>`"
-}

shortcuts/apps/apps_automation_get_test.go

@@ -1,117 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package apps
-
-import (
-	"context"
-	"strings"
-	"testing"
-
-	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/httpmock"
-)
-
-// TestAutomationGetExecute_RedactsWebhookToken pins the redaction invariant
-// against the actual backend response shape (verified against a live test
-// environment): GET wraps the trigger under a `trigger` key, so the CLI
-// must scrub token_value inside data.trigger.trigger_condition. A previous
-// implementation only scrubbed data.trigger_condition and silently no-op'd
-// here — this test would fail the moment someone reverts to top-level-only
-// scrubbing.
-func TestAutomationGetExecute_RedactsWebhookToken(t *testing.T) {
-	rctx, stdoutBuf, reg := newOpenAPIKeyRCtx(t,
-		map[string]string{"app-id": "string", "name": "string"},
-		map[string]string{"app-id": "app_x", "name": "wh1"})
-	reg.Register(&httpmock.Stub{
-		Method: "GET", URL: "/open-apis/spark/v1/apps/app_x/triggers/wh1",
-		Body: map[string]interface{}{"code": 0, "data": map[string]interface{}{
-			"trigger": map[string]interface{}{
-				"name": "wh1", "trigger_type": "webhook", "status": "enabled",
-				"trigger_condition": map[string]interface{}{
-					"preview_url": "https://p", "runtime_url": "https://r",
-					"token_enabled": true, "token_value": "PLAINTEXT_SECRET_NESTED",
-				},
-			},
-		}},
-	})
-	if err := AppsAutomationGet.Execute(context.Background(), rctx); err != nil {
-		t.Fatalf("Execute() = %v", err)
-	}
-	out := stdoutBuf.String()
-	if strings.Contains(out, "PLAINTEXT_SECRET_NESTED") {
-		t.Errorf("get must never surface plaintext token: %s", out)
-	}
-	if !strings.Contains(out, "token_enabled") {
-		t.Errorf("get must expose token_enabled: %s", out)
-	}
-}
-
-func TestAutomationGet_MissingName(t *testing.T) {
-	rctx, _, _ := newOpenAPIKeyRCtx(t,
-		map[string]string{"app-id": "string", "name": "string"},
-		map[string]string{"app-id": "app_x"})
-	err := AppsAutomationGet.Validate(context.Background(), rctx)
-	assertValidationParamError(t, err, "--name")
-}
-
-// TestAutomationGet_MissingAppID covers the sibling branch of Validate:
-// automationValidateName rejects an empty --app-id before checking --name.
-func TestAutomationGet_MissingAppID(t *testing.T) {
-	rctx, _, _ := newOpenAPIKeyRCtx(t,
-		map[string]string{"app-id": "string", "name": "string"},
-		map[string]string{"name": "t1"})
-	err := AppsAutomationGet.Validate(context.Background(), rctx)
-	assertValidationParamError(t, err, "--app-id")
-}
-
-// TestAutomationGet_APIErrorAttachesNotFoundHint covers the failure branch of
-// Execute: a business error on GET must surface typed and carry the
-// automation-list hint so the caller has a next step.
-func TestAutomationGet_APIErrorAttachesNotFoundHint(t *testing.T) {
-	rctx, _, reg := newOpenAPIKeyRCtx(t,
-		map[string]string{"app-id": "string", "name": "string"},
-		map[string]string{"app-id": "app_x", "name": "missing"})
-	reg.Register(&httpmock.Stub{
-		Method: "GET", URL: "/open-apis/spark/v1/apps/app_x/triggers/missing",
-		Body: map[string]interface{}{"code": 400400001, "msg": "trigger not found"},
-	})
-	err := AppsAutomationGet.Execute(context.Background(), rctx)
-	if err == nil {
-		t.Fatal("expected typed api error, got nil")
-	}
-	p, ok := errs.ProblemOf(err)
-	if !ok {
-		t.Fatalf("expected typed problem, got %T: %v", err, err)
-	}
-	if p.Category != errs.CategoryAPI {
-		t.Errorf("category = %q, want %q", p.Category, errs.CategoryAPI)
-	}
-	if p.Subtype == "" {
-		t.Error("subtype must be populated on typed API errors")
-	}
-	if !strings.Contains(p.Hint, "+automation-list") {
-		t.Errorf("hint must point at +automation-list, got %q", p.Hint)
-	}
-}
-
-// TestAutomationGet_DryRunPreview exercises the DryRun closure and pins the
-// GET method + URL pattern that agents inspect before committing.
-func TestAutomationGet_DryRunPreview(t *testing.T) {
-	rctx, _, _ := newOpenAPIKeyRCtx(t,
-		map[string]string{"app-id": "string", "name": "string"},
-		map[string]string{"app-id": "app_x", "name": "t1"})
-	preview := AppsAutomationGet.DryRun(context.Background(), rctx)
-	if preview == nil {
-		t.Fatal("DryRun returned nil")
-	}
-	blob, err := preview.MarshalJSON()
-	if err != nil {
-		t.Fatalf("marshal preview: %v", err)
-	}
-	got := string(blob)
-	if !strings.Contains(got, `"method":"GET"`) ||
-		!strings.Contains(got, "/apps/app_x/triggers/t1") {
-		t.Errorf("preview missing expected GET/URL fields: %s", got)
-	}
-}

shortcuts/apps/apps_automation_list.go

@@ -1,159 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package apps
-
-import (
-	"context"
-	"fmt"
-	"io"
-	"strings"
-
-	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/shortcuts/common"
-)
-
-// AppsAutomationList lists an app's automation triggers (all 4 types).
-var AppsAutomationList = common.Shortcut{
-	Service:     appsService,
-	Command:     "+automation-list",
-	Description: "List a Miaoda app's automation triggers (cron/record-change/webhook/feishu-approval)",
-	Risk:        "read",
-	Tips: []string{
-		"Example: lark-cli apps +automation-list --app-id <app_id>",
-		"Example: lark-cli apps +automation-list --app-id <app_id> --trigger-type webhook",
-		"Example: lark-cli apps +automation-list --app-id <app_id> --all   # aggregate all pages",
-	},
-	Scopes:    []string{"spark:app:read"},
-	AuthTypes: []string{"user"},
-	HasFormat: true,
-	Flags: []common.Flag{
-		{Name: "app-id", Desc: "Miaoda app id", Required: true},
-		{Name: "trigger-type", Desc: "filter by type: cron | record-change | webhook | feishu-approval"},
-		{Name: "page-size", Type: "int", Desc: "page size (server default 50, max 100)"},
-		{Name: "page-token", Desc: "pagination cursor from previous response"},
-		{Name: "all", Type: "bool", Desc: "auto-aggregate all pages until has_more=false"},
-	},
-	Validate: func(ctx context.Context, rctx *common.RuntimeContext) error {
-		if _, err := requireAppID(rctx.Str("app-id")); err != nil {
-			return err
-		}
-		if tt := strings.TrimSpace(rctx.Str("trigger-type")); tt != "" {
-			if _, err := mapTriggerType(tt); err != nil {
-				return err
-			}
-		}
-		return nil
-	},
-	DryRun: func(ctx context.Context, rctx *common.RuntimeContext) *common.DryRunAPI {
-		appID, _ := requireAppID(rctx.Str("app-id"))
-		return common.NewDryRunAPI().
-			GET(automationListPath(appID)).
-			Desc("List automation triggers").
-			Params(buildAutomationListParams(rctx))
-	},
-	Execute: func(ctx context.Context, rctx *common.RuntimeContext) error {
-		appID, err := requireAppID(rctx.Str("app-id"))
-		if err != nil {
-			return err
-		}
-		path := automationListPath(appID)
-		params := buildAutomationListParams(rctx)
-		if rctx.Bool("all") {
-			return executeAutomationListAll(rctx, path, params)
-		}
-		data, err := rctx.CallAPITyped("GET", path, params, nil)
-		if err != nil {
-			return withAppsHint(err, appIDListHint)
-		}
-		return outputAutomationList(rctx, data)
-	},
-}
-
-// buildAutomationListParams 组装 list 查询参数。--trigger-type kebab→snake 下推给后端。
-func buildAutomationListParams(rctx *common.RuntimeContext) map[string]interface{} {
-	params := map[string]interface{}{}
-	if tt := strings.TrimSpace(rctx.Str("trigger-type")); tt != "" {
-		if snake, err := mapTriggerType(tt); err == nil {
-			params["trigger_type"] = snake
-		}
-	}
-	if rctx.Changed("page-size") {
-		params["page_size"] = rctx.Int("page-size")
-	}
-	if pt := strings.TrimSpace(rctx.Str("page-token")); pt != "" {
-		params["page_token"] = pt
-	}
-	return params
-}
-
-// executeAutomationListAll 循环翻页聚合到 has_more=false（禁止静默漏项）。
-// 用页数上限 + 已见 token 检测防止后端非收敛响应导致无限循环。
-const automationListAllMaxPages = 100
-
-func executeAutomationListAll(rctx *common.RuntimeContext, path string, params map[string]interface{}) error {
-	all := make([]interface{}, 0, 16)
-	seen := map[string]struct{}{}
-	token := ""
-	for pages := 0; ; pages++ {
-		if pages >= automationListAllMaxPages {
-			return errs.NewInternalError(errs.SubtypeInvalidResponse,
-				"pagination did not converge after %d pages", automationListAllMaxPages)
-		}
-		p := make(map[string]interface{}, len(params)+1)
-		for k, v := range params {
-			p[k] = v
-		}
-		if token != "" {
-			p["page_token"] = token
-		}
-		data, err := rctx.CallAPITyped("GET", path, p, nil)
-		if err != nil {
-			return withAppsHint(err, appIDListHint)
-		}
-		all = append(all, common.GetSlice(data, "items")...)
-		hasMore, next := common.PaginationMeta(data)
-		if !hasMore || next == "" {
-			break
-		}
-		if _, ok := seen[next]; ok {
-			return errs.NewInternalError(errs.SubtypeInvalidResponse,
-				"pagination did not converge: page_token %q repeated", next)
-		}
-		seen[next] = struct{}{}
-		token = next
-	}
-	out := map[string]interface{}{"items": all, "has_more": false}
-	return outputAutomationList(rctx, out)
-}
-
-// outputAutomationList 输出 items + 分页提示。逐条对 items 套 redactWebhookToken，
-// 抹掉 trigger_condition.token_value（list/get 恒不返回明文 Bearer Token）；
-// 同时覆盖单页与 --all 聚合路径（executeAutomationListAll 也走这里）。
-func outputAutomationList(rctx *common.RuntimeContext, data map[string]interface{}) error {
-	items := common.GetSlice(data, "items")
-	redacted := make([]interface{}, 0, len(items))
-	for _, it := range items {
-		if m, ok := it.(map[string]interface{}); ok {
-			redacted = append(redacted, redactWebhookToken(m))
-		} else {
-			redacted = append(redacted, it)
-		}
-	}
-	// 保留分页字段供 PaginationHint/PaginationMeta 读取（读的是同一个 map）。
-	out := map[string]interface{}{
-		"items":      redacted,
-		"has_more":   data["has_more"],
-		"page_token": data["page_token"],
-	}
-	rctx.OutFormat(out, nil, func(w io.Writer) {
-		fmt.Fprintf(w, "%d trigger(s)\n", len(redacted))
-		for _, it := range redacted {
-			if m, ok := it.(map[string]interface{}); ok {
-				fmt.Fprintf(w, "- %v  [%v]  %v\n", m["name"], m["trigger_type"], m["status"])
-			}
-		}
-		fmt.Fprint(w, common.PaginationHint(out, len(redacted)))
-	})
-	return nil
-}

shortcuts/apps/apps_automation_list_test.go

@@ -1,219 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package apps
-
-import (
-	"context"
-	"strings"
-	"testing"
-
-	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/httpmock"
-)
-
-func automationListFlagDefs() map[string]string {
-	return map[string]string{
-		"app-id": "string", "trigger-type": "string",
-		"page-size": "int", "page-token": "string", "all": "bool",
-	}
-}
-
-// TestAutomationList_InvalidTriggerTypeFilter covers Validate's mapTriggerType
-// error branch: an unknown --trigger-type is rejected before any API call, with
-// a typed error naming the failing flag.
-func TestAutomationList_InvalidTriggerTypeFilter(t *testing.T) {
-	rctx, _, _ := newOpenAPIKeyRCtx(t, automationListFlagDefs(),
-		map[string]string{"app-id": "app_x", "trigger-type": "bogus"})
-	err := AppsAutomationList.Validate(context.Background(), rctx)
-	assertValidationParamError(t, err, "--trigger-type")
-}
-
-// TestAutomationListExecute_APIErrorAttachesAppIDHint covers the non-`--all`
-// error branch: a business error is surfaced typed and carries appIDListHint,
-// which points at +list rather than +automation-list because the recovery for
-// a failing collection GET is "check your app-id", not "check trigger names".
-func TestAutomationListExecute_APIErrorAttachesAppIDHint(t *testing.T) {
-	rctx, _, reg := newOpenAPIKeyRCtx(t, automationListFlagDefs(),
-		map[string]string{"app-id": "app_x"})
-	reg.Register(&httpmock.Stub{
-		Method: "GET", URL: "/open-apis/spark/v1/apps/app_x/triggers",
-		Body: map[string]interface{}{"code": 400400002, "msg": "app not accessible"},
-	})
-	err := AppsAutomationList.Execute(context.Background(), rctx)
-	if err == nil {
-		t.Fatal("expected typed api error, got nil")
-	}
-	p, ok := errs.ProblemOf(err)
-	if !ok {
-		t.Fatalf("expected typed problem, got %T: %v", err, err)
-	}
-	if p.Category != errs.CategoryAPI {
-		t.Errorf("category = %q, want %q", p.Category, errs.CategoryAPI)
-	}
-	if p.Subtype == "" {
-		t.Error("subtype must be populated on typed API errors")
-	}
-	if !strings.Contains(p.Hint, "apps +list") {
-		t.Errorf("hint must point at `lark-cli apps +list`, got %q", p.Hint)
-	}
-}
-
-// TestAutomationList_DryRunPreview exercises the DryRun closure — pins the GET
-// method + collection URL + trigger_type param pushdown.
-func TestAutomationList_DryRunPreview(t *testing.T) {
-	rctx, _, _ := newOpenAPIKeyRCtx(t, automationListFlagDefs(),
-		map[string]string{"app-id": "app_x", "trigger-type": "webhook"})
-	preview := AppsAutomationList.DryRun(context.Background(), rctx)
-	if preview == nil {
-		t.Fatal("DryRun returned nil")
-	}
-	blob, err := preview.MarshalJSON()
-	if err != nil {
-		t.Fatalf("marshal preview: %v", err)
-	}
-	got := string(blob)
-	if !strings.Contains(got, `"method":"GET"`) ||
-		!strings.Contains(got, "/apps/app_x/triggers") ||
-		!strings.Contains(got, `"trigger_type":"webhook"`) {
-		t.Errorf("preview missing expected GET/URL/params: %s", got)
-	}
-}
-
-func TestAutomationListMeta(t *testing.T) {
-	if AppsAutomationList.Command != "+automation-list" || AppsAutomationList.Risk != "read" {
-		t.Errorf("meta mismatch: %+v", AppsAutomationList)
-	}
-	if len(AppsAutomationList.Scopes) != 1 || AppsAutomationList.Scopes[0] != "spark:app:read" {
-		t.Errorf("scopes = %v", AppsAutomationList.Scopes)
-	}
-}
-
-func TestAutomationListExecute_SinglePage(t *testing.T) {
-	rctx, stdoutBuf, reg := newOpenAPIKeyRCtx(t, automationListFlagDefs(),
-		map[string]string{"app-id": "app_x"})
-	reg.Register(&httpmock.Stub{
-		Method: "GET", URL: "/open-apis/spark/v1/apps/app_x/triggers",
-		Body: map[string]interface{}{"code": 0, "msg": "", "data": map[string]interface{}{
-			"items": []interface{}{
-				map[string]interface{}{"name": "t_cron", "trigger_type": "cron", "status": "disabled"},
-				map[string]interface{}{"name": "t_wh", "trigger_type": "webhook", "status": "enabled"},
-			},
-			"has_more": false, "page_token": "",
-		}},
-	})
-	if err := AppsAutomationList.Execute(context.Background(), rctx); err != nil {
-		t.Fatalf("Execute() = %v", err)
-	}
-	out := stdoutBuf.String()
-	if !strings.Contains(out, "t_cron") || !strings.Contains(out, "t_wh") {
-		t.Errorf("list must contain both triggers: %s", out)
-	}
-}
-
-// --all aggregates every page until has_more=false. httpmock.Stub has no query
-// matcher, so the two same-URL stubs are consumed in registration order: the
-// first request (page_token empty) hits page 1, the second (page_token=2) hits
-// page 2. See registry.match — a matched non-reusable stub is not reused.
-func TestAutomationListExecute_AllAggregatesPages(t *testing.T) {
-	rctx, stdoutBuf, reg := newOpenAPIKeyRCtx(t, automationListFlagDefs(),
-		map[string]string{"app-id": "app_x", "all": "true"})
-	// page 1: has_more=true, page_token="2"
-	reg.Register(&httpmock.Stub{
-		Method: "GET", URL: "/open-apis/spark/v1/apps/app_x/triggers",
-		Body: map[string]interface{}{"code": 0, "data": map[string]interface{}{
-			"items":    []interface{}{map[string]interface{}{"name": "p1", "trigger_type": "cron", "status": "disabled"}},
-			"has_more": true, "page_token": "2",
-		}},
-	})
-	// page 2: has_more=false
-	reg.Register(&httpmock.Stub{
-		Method: "GET", URL: "/open-apis/spark/v1/apps/app_x/triggers",
-		Body: map[string]interface{}{"code": 0, "data": map[string]interface{}{
-			"items":    []interface{}{map[string]interface{}{"name": "p2", "trigger_type": "webhook", "status": "enabled"}},
-			"has_more": false, "page_token": "",
-		}},
-	})
-	if err := AppsAutomationList.Execute(context.Background(), rctx); err != nil {
-		t.Fatalf("Execute() = %v", err)
-	}
-	out := stdoutBuf.String()
-	if !strings.Contains(out, "p1") || !strings.Contains(out, "p2") {
-		t.Errorf("--all must aggregate both pages: %s", out)
-	}
-}
-
-func TestAutomationListParams_TriggerTypePushdown(t *testing.T) {
-	rctx, _, _ := newOpenAPIKeyRCtx(t, automationListFlagDefs(),
-		map[string]string{"app-id": "app_x", "trigger-type": "webhook"})
-	params := buildAutomationListParams(rctx)
-	if params["trigger_type"] != "webhook" {
-		t.Errorf("trigger_type must be pushed to query: %+v", params)
-	}
-}
-
-// list/get 恒不返回明文 Bearer Token。webhook item 的
-// trigger_condition.token_value 必须逐条脱敏，token_enabled 保留。
-func TestAutomationListExecute_RedactsWebhookToken(t *testing.T) {
-	rctx, stdoutBuf, reg := newOpenAPIKeyRCtx(t, automationListFlagDefs(),
-		map[string]string{"app-id": "app_x"})
-	reg.Register(&httpmock.Stub{
-		Method: "GET", URL: "/open-apis/spark/v1/apps/app_x/triggers",
-		Body: map[string]interface{}{"code": 0, "msg": "", "data": map[string]interface{}{
-			"items": []interface{}{
-				map[string]interface{}{
-					"name": "t_wh", "trigger_type": "webhook", "status": "enabled",
-					"trigger_condition": map[string]interface{}{
-						"preview_url": "https://p", "runtime_url": "https://r",
-						"token_enabled": true, "token_value": "PLAINTEXT_LIST_TOKEN",
-					},
-				},
-			},
-			"has_more": false, "page_token": "",
-		}},
-	})
-	if err := AppsAutomationList.Execute(context.Background(), rctx); err != nil {
-		t.Fatalf("Execute() = %v", err)
-	}
-	out := stdoutBuf.String()
-	if strings.Contains(out, "PLAINTEXT_LIST_TOKEN") {
-		t.Errorf("list must never surface plaintext token: %s", out)
-	}
-	if !strings.Contains(out, "token_enabled") {
-		t.Errorf("list must expose token_enabled: %s", out)
-	}
-}
-
-// A4: --all must refuse to loop forever when the backend keeps returning the
-// same page_token. A reusable stub that always advertises "has_more=true,
-// page_token=same" forces the seen-token guard to trip.
-func TestAutomationListExecute_All_DetectsRepeatedPageToken(t *testing.T) {
-	rctx, _, reg := newOpenAPIKeyRCtx(t, automationListFlagDefs(),
-		map[string]string{"app-id": "app_x", "all": "true"})
-	reg.Register(&httpmock.Stub{
-		Method: "GET", URL: "/open-apis/spark/v1/apps/app_x/triggers",
-		Reusable: true,
-		Body: map[string]interface{}{"code": 0, "data": map[string]interface{}{
-			"items":    []interface{}{map[string]interface{}{"name": "p", "trigger_type": "cron", "status": "disabled"}},
-			"has_more": true, "page_token": "stuck",
-		}},
-	})
-	err := AppsAutomationList.Execute(context.Background(), rctx)
-	// The seen-token detector must raise a typed internal/invalid_response error
-	// long before the caller sees a runaway loop.
-	assertInternalError(t, err, errs.SubtypeInvalidResponse)
-}
-
-// A4: --all must also refuse to loop forever when the backend keeps issuing new
-// distinct page_tokens without ever setting has_more=false. The page-cap kicks
-// in at automationListAllMaxPages. Simulated by a reusable stub advertising a
-// fresh non-repeating token via monotonically increasing counter — but since
-// httpmock has no dynamic bodies, we lean on the fact that the same reusable
-// body advertises page_token="stuck" (the seen-token guard trips first). This
-// case is left to the sibling test above; the page-cap constant is asserted
-// here so a future refactor cannot silently drop the ceiling.
-func TestAutomationListAll_PageCapConstant(t *testing.T) {
-	if automationListAllMaxPages <= 0 || automationListAllMaxPages > 1000 {
-		t.Errorf("automationListAllMaxPages = %d; must be a small positive ceiling", automationListAllMaxPages)
-	}
-}

shortcuts/apps/apps_automation_registration_test.go

@@ -1,23 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package apps
-
-import "testing"
-
-func TestAutomationCommandsRegistered(t *testing.T) {
-	want := map[string]bool{
-		"+automation-list": false, "+automation-get": false, "+automation-create": false,
-		"+automation-update": false, "+automation-enable": false, "+automation-disable": false,
-	}
-	for _, sc := range Shortcuts() {
-		if _, ok := want[sc.Command]; ok {
-			want[sc.Command] = true
-		}
-	}
-	for cmd, found := range want {
-		if !found {
-			t.Errorf("shortcut %q not registered in Shortcuts()", cmd)
-		}
-	}
-}

shortcuts/apps/apps_automation_skill_contract_test.go

@@ -1,469 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package apps
-
-import (
-	"os"
-	"path/filepath"
-	"regexp"
-	"strings"
-	"testing"
-)
-
-const automationSkillDoc = "../../skills/lark-apps/references/lark-apps-automation.md"
-const localDevSkillDoc = "../../skills/lark-apps/references/lark-apps-local-dev.md"
-const larkAppsSkillDoc = "../../skills/lark-apps/SKILL.md"
-const releaseGetSkillDoc = "../../skills/lark-apps/references/lark-apps-release-get.md"
-
-func readAutomationSkillDoc(t *testing.T) string {
-	return readAppsSkillDoc(t, automationSkillDoc)
-}
-
-func readLocalDevSkillDoc(t *testing.T) string {
-	return readAppsSkillDoc(t, localDevSkillDoc)
-}
-
-func readReleaseGetSkillDoc(t *testing.T) string {
-	return readAppsSkillDoc(t, releaseGetSkillDoc)
-}
-
-func readAppsSkillDoc(t *testing.T, path string) string {
-	t.Helper()
-	raw, err := os.ReadFile(path)
-	if err != nil {
-		t.Fatalf("read skill doc %s: %v", path, err)
-	}
-	return string(raw)
-}
-
-func skillSection(t *testing.T, doc, heading string) string {
-	t.Helper()
-	start := strings.Index(doc, heading)
-	if start < 0 {
-		t.Fatalf("missing skill section %q", heading)
-	}
-	rest := doc[start+len(heading):]
-	if next := strings.Index(rest, "\n## "); next >= 0 {
-		return rest[:next]
-	}
-	return rest
-}
-
-func skillSubsection(t *testing.T, doc, heading string) string {
-	t.Helper()
-	start := strings.Index(doc, heading)
-	if start < 0 {
-		t.Fatalf("missing skill subsection %q", heading)
-	}
-	rest := doc[start+len(heading):]
-	end := len(rest)
-	for _, marker := range []string{"\n### ", "\n## "} {
-		if next := strings.Index(rest, marker); next >= 0 && next < end {
-			end = next
-		}
-	}
-	return rest[:end]
-}
-
-func requireInOrder(t *testing.T, text string, tokens ...string) {
-	t.Helper()
-	offset := 0
-	for _, token := range tokens {
-		idx := strings.Index(text[offset:], token)
-		if idx < 0 {
-			t.Fatalf("missing %q after %q", token, text[:offset])
-		}
-		offset += idx + len(token)
-	}
-}
-
-func requireFirstOccurrencesInOrder(t *testing.T, text string, tokens ...string) {
-	t.Helper()
-	previous := -1
-	for _, token := range tokens {
-		idx := strings.Index(text, token)
-		if idx < 0 {
-			t.Fatalf("missing %q", token)
-		}
-		if idx <= previous {
-			t.Fatalf("first %q at %d must follow the previous contract token at %d", token, idx, previous)
-		}
-		previous = idx
-	}
-}
-
-func TestAutomationSkillContract_ChangedHandlerStartWaitsForThisRelease(t *testing.T) {
-	section := skillSubsection(t, readAutomationSkillDoc(t), "### 实现或更新 handler 后发布并启动/测试")
-
-	requireInOrder(t, section,
-		"仅当本轮确实需要新增或修改 cron、webhook、record-change 的 `INSERT`、`UPDATE`、`DELETE` handler",
-		"+automation-get",
-		"记录发布前状态",
-		"--name",
-		"项目 guide",
-		"按项目 guide 完成同名业务 handler 并本地验证。",
-		"在 Git 已确认/预授权时 commit，然后执行",
-		"git push origin sprint/default",
-		"临时停用授权",
-		"+automation-disable",
-		"确认 disabled",
-		"+release-create --branch sprint/default",
-		"data.release_id",
-		"+release-get",
-		"data.status=finished",
-		"仅启动",
-		"+automation-enable",
-		"+automation-get",
-		"不制造 runtime probe",
-		"测试",
-		"运行时验证的操作级授权",
-		"完成全部 preflight",
-		"才执行 `+automation-enable`",
-		"真实 runtime",
-		"仅要求测试",
-		"恢复到发布前状态",
-	)
-	requireFirstOccurrencesInOrder(t, section,
-		"+automation-get",
-		"git push origin sprint/default",
-		"临时停用授权",
-		"+automation-disable",
-		"+release-create --branch sprint/default",
-		"data.status=finished",
-		"仅启动",
-	)
-	for _, boundary := range []string{
-		"仅当本轮确实需要新增或修改 cron、webhook、record-change 的 `INSERT`、`UPDATE`、`DELETE` handler，且用户要求把这次代码发布后启动或测试时，才使用此路径。",
-		"按项目 guide 完成同名业务 handler 并本地验证。",
-		"在 Git 已确认/预授权时 commit，然后执行 `git push origin sprint/default`。",
-		"若该命令本身返回错误或未返回 `data.release_id`：视为确认未创建本轮 release（新代码未上线），原本 enabled 的 trigger 恢复 enabled 并回读、原本 disabled 的保持 disabled 后停止；若因超时等导致结果未知，保持 disabled，先用 `+release-list --status finished --page-size 1` 核对是否已产生新 release 再决定。",
-		"只有 `data.status=finished` 才能继续；`publishing` 时每 20 秒继续轮询，整体最多约 5 分钟。",
-		"确认 `failed` 时报告发布失败，原本 enabled 的 trigger 仅在确认新代码未上线后恢复 enabled，原本 disabled 的保持 disabled。",
-		"发布状态仍不确定时不得进入 enable、probe 或状态恢复分支。",
-		"**仅启动**：取得持续启动授权后执行 `+automation-enable`，并用 `+automation-get` 确认 enabled；到此结束，不制造 runtime probe。",
-		"**测试（含“启动并测试”）**：先按下节“运行时验证的操作级授权”完成全部 preflight",
-		"若用户仅要求测试而不是持续启动，只在本轮 release 已 `finished` 且 probe 成功后恢复到发布前状态",
-		"无论用户是仅测试还是启动并测试，probe 失败、结果不确定或 enable 后提前结束时，一律 `+automation-disable` 并回读 disabled",
-		"不得把“发布前 enabled”当作失败后的恢复依据",
-		"没有通用的 `automation-debug` 或 trigger 日志 shortcut。",
-	} {
-		if !strings.Contains(section, boundary) {
-			t.Errorf("complete-start section must explain %q boundary", boundary)
-		}
-	}
-}
-
-func TestAutomationSkillContract_BindsTheExactNameAsUser(t *testing.T) {
-	doc := readAutomationSkillDoc(t)
-	for _, boundary := range []string{
-		"全部操作需 `--as user`（AuthType: user）。",
-		"当用户希望触发器实际执行业务代码时，先确认当前工作区是已初始化的应用项目，并读取其中与触发器任务匹配的 guide。",
-		"`--name` 是应用内唯一的 trigger 定位键；代码侧绑定名称必须与它逐字相同。不得用 trigger ID 或方法名代替它。具体 handler 语法和接入方式以项目 guide 为准。",
-	} {
-		if !strings.Contains(doc, boundary) {
-			t.Errorf("automation skill must preserve %q", boundary)
-		}
-	}
-}
-
-func TestAutomationSkillContract_RoutesAndDiagnosesUnfiredTriggers(t *testing.T) {
-	doc := readAutomationSkillDoc(t)
-	routeSection := skillSection(t, doc, "## 何时用本 skill（路由锚点）")
-	errorSection := skillSection(t, doc, "## 常见错误与决策场景")
-
-	if !strings.Contains(routeSection, "「触发器没反应 / enable 了不触发 / 为什么没执行 / 验证一下触发器」→ 先按「未触发时的诊断顺序」诊断；对 UPSERT 和 feishu-approval 仅验证配置边界，不承诺 handler 或 live 验证。") {
-		t.Error("routing anchors must direct unfired triggers to the bounded diagnostic flow")
-	}
-	if !strings.Contains(errorSection, "已证实的 cron、webhook、record-change（INSERT/UPDATE/DELETE）按「未触发时的诊断顺序」排查；UPSERT 和 feishu-approval 仅核对配置边界，不承诺 handler 或 live 验证。") {
-		t.Error("error table must preserve the bounded unfired-trigger diagnostic flow")
-	}
-}
-
-func TestAutomationSkillContract_ConfigurationStopsDisabled(t *testing.T) {
-	section := skillSubsection(t, readAutomationSkillDoc(t), "### 仅创建/配置触发器")
-
-	for _, boundary := range []string{
-		"用 `+automation-create` 创建，并省略 `--status` 或显式传 `disabled`，然后报告 name 和 disabled 状态。",
-		"不要传 `--status enabled`，也不要写 handler、commit/push、release 或 enable；更不能把创建 API 成功称为“可运行”。",
-		"默认 disabled 是这个意图的终点，不是稍后自动 enable 的待办。",
-	} {
-		if !strings.Contains(section, boundary) {
-			t.Errorf("configuration-only section must preserve %q", boundary)
-		}
-	}
-}
-
-func TestAutomationSkillContract_EnableExistingTriggerDoesNotPublish(t *testing.T) {
-	doc := readAutomationSkillDoc(t)
-	section := skillSubsection(t, doc, "### 仅启用已有 disabled trigger")
-	routeSection := skillSection(t, doc, "## 何时用本 skill（路由锚点）")
-
-	requireInOrder(t, section,
-		"用户只要求启用已存在且 disabled 的 trigger",
-		"+automation-get",
-		"+release-list --status finished --page-size 1",
-		"已完成线上 release",
-		"当前线上应用",
-		"不能证明该 trigger name 已绑定 handler",
-		"+automation-enable",
-		"+automation-get",
-		"不得修改 handler、commit/push 或 release",
-		"对 UPSERT 或 feishu-approval 只改变配置状态",
-	)
-	if !strings.Contains(section, "未发布时不得自动创建 release，也不得声称 trigger 已开始实际运行") {
-		t.Error("enable-only flow must distinguish configuration enablement from a published runtime")
-	}
-	if !strings.Contains(section, "即使存在 finished release，也只能把 enable 报告为配置激活") {
-		t.Error("enable-only flow must not infer handler provenance from app release history")
-	}
-	if strings.Contains(section, "apps +get") || strings.Contains(section, "`is_published`") {
-		t.Error("enable-only flow must use finished release history instead of an optional app detail field")
-	}
-	for _, forbidden := range []string{"git push", "+release-create"} {
-		if strings.Contains(section, forbidden) {
-			t.Errorf("enable-only flow must not contain %q", forbidden)
-		}
-	}
-	if !strings.Contains(routeSection, "「启用 / 启动已有 trigger」→ 先核对现有状态；只启用时不要修改源码或发布应用。") {
-		t.Error("routing anchors must keep existing-trigger enablement separate from code release")
-	}
-}
-
-func TestAutomationSkillContract_TestExistingTriggerDoesNotPublish(t *testing.T) {
-	section := skillSubsection(t, readAutomationSkillDoc(t), "### 测试已有线上 trigger（不改代码）")
-
-	requireInOrder(t, section,
-		"用户要求测试已经发布的 trigger",
-		"+automation-get",
-		"+release-list --status finished --page-size 1",
-		"当前线上代码",
-		"不得为测试自动修改源码、commit/push 或 release",
-		"在任何临时 enable 之前完成",
-		"测试请求已明确包含临时 enable，或另行取得 enable 授权",
-		"运行时验证的操作级授权",
-		"无论 probe 成功、失败、结果不确定，还是临时 enable 后提前结束或中断，最终都必须 `+automation-disable` 并回读 disabled",
-	)
-	for _, forbidden := range []string{"git push", "+release-create"} {
-		if strings.Contains(section, forbidden) {
-			t.Errorf("existing-trigger test flow must not contain %q", forbidden)
-		}
-	}
-}
-
-func TestAutomationSkillContract_HandlerOnlyStopsBeforeRelease(t *testing.T) {
-	section := skillSubsection(t, readAutomationSkillDoc(t), "### 仅完成 handler（不发布/不启用）")
-
-	for _, boundary := range []string{
-		"创建或定位已明确 name 的 disabled trigger，读取项目 guide，按其要求实现同名业务 handler，完成本地验证。",
-		"只在既有 Git 确认或预授权下 commit/push；停止在 `+release-create` 和 `+automation-enable` 之前。",
-		"用户没有明确“发布好”时，先问，不能默认把完整应用上线。",
-	} {
-		if !strings.Contains(section, boundary) {
-			t.Errorf("handler-only section must preserve %q", boundary)
-		}
-	}
-}
-
-func TestAutomationSkillContract_HandlerOnlyExcludesUnverifiedRuntimeTypes(t *testing.T) {
-	section := skillSubsection(t, readAutomationSkillDoc(t), "### 仅完成 handler（不发布/不启用）")
-
-	if !strings.Contains(section, "仅对 cron、webhook、record-change 的 `INSERT`、`UPDATE`、`DELETE` 使用此路径。") {
-		t.Error("handler-only flow must exclude UPSERT and feishu-approval without a verified runtime contract")
-	}
-}
-
-func TestAutomationSkillContract_PublishedHandlerStaysDisabled(t *testing.T) {
-	section := skillSubsection(t, readAutomationSkillDoc(t), "### 把 handler 发布好，但先不要启动")
-
-	for _, boundary := range []string{
-		"仅对 cron、webhook、record-change 的 `INSERT`、`UPDATE`、`DELETE` 使用此路径。",
-		"先用 `+automation-get` 定位；不存在时用 `+automation-create` 创建同名 disabled trigger，再次回读确认。",
-		"已存在时记录它是否 enabled。",
-		"若 trigger 已 enabled，先说明发布前必须临时停用以及可能造成的运行中断，并取得这次临时停用授权；未获授权时停止在发布前。",
-		"取得授权后，在发布前执行 `+automation-disable`，并再次用 `+automation-get` 确认 disabled。",
-		"按项目 guide 完成同名业务 handler 并本地验证后，commit、`git push origin sprint/default`。",
-		"随后发布完整应用：",
-		"若 `+release-create` 本身返回错误或未返回 `data.release_id`：视为确认未创建本轮 release（新代码未上线），原本 enabled 的 trigger 恢复 enabled 并回读、原本 disabled 的保持 disabled，然后停止；若因超时等导致创建结果未知，保持 disabled，先用 `+release-list --status finished --page-size 1` 核对是否已产生新 release 再决定。",
-		"取得 `data.release_id` 后，对**这一轮** ID 调用 `+release-get`：`publishing` 时每 20 秒继续轮询，整体最多约 5 分钟；超时且状态仍不确定时报告 `release_id` 和当前 status，并保持 disabled；只有 `data.status=finished` 才算完成。",
-		"确认 `failed` 且新代码未上线时，原本 enabled 的 trigger 恢复 enabled 并回读，原本 disabled 的保持 disabled。",
-		"release 是整个应用上线，可能影响既有线上功能；未获得启动或测试授权时，finished 后始终保持 disabled，不执行 `+automation-enable`。",
-	} {
-		if !strings.Contains(section, boundary) {
-			t.Errorf("publish-without-start section must preserve %q", boundary)
-		}
-	}
-	requireFirstOccurrencesInOrder(t, section,
-		"+automation-get",
-		"git push origin sprint/default",
-		"临时停用授权",
-		"+automation-disable",
-		"+release-create",
-	)
-}
-
-func TestAutomationSkillContract_UPSERTAndApprovalStayConfigurationOnly(t *testing.T) {
-	section := skillSubsection(t, readAutomationSkillDoc(t), "### UPSERT 与飞书审批边界")
-
-	for _, boundary := range []string{
-		"record-change 的 UPSERT 可创建 disabled 配置，但当前没有已证实的运行时代码契约；不得静默按 UPDATE 处理，也不得承诺 handler 或 live 验证。",
-		"feishu-approval 可创建 disabled 配置，并读取或更新 `event_type`、对应 status 和可选 `approval_code`。",
-		"当前没有已证实的运行时 handler 契约或实际投递验证；不要把 enable 或审批 API 成功称为业务代码已执行。",
-	} {
-		if !strings.Contains(section, boundary) {
-			t.Errorf("UPSERT/approval boundary section must preserve %q", boundary)
-		}
-	}
-}
-
-func TestAutomationSkillContract_RuntimeProbeRequiresOperationScope(t *testing.T) {
-	section := skillSubsection(t, readAutomationSkillDoc(t), "### 运行时验证的操作级授权")
-
-	for _, boundary := range []string{
-		"启用 trigger 的授权不等于制造 runtime 事件的授权，测试授权也不等于任意数据库写入授权。",
-		"record-change 在执行任何 DML 前，必须明确并取得覆盖以下作用域的授权",
-		"环境、表、操作、精确测试记录或筛选条件、payload、预期结果和清理方式",
-		"优先使用专用测试记录",
-		"`DELETE`",
-		"[lark-apps-db-execute.md](lark-apps-db-execute.md)",
-		"先 `SELECT count(*)`、执行 `--dry-run`",
-		"取得针对该删除目标的明确授权",
-		"+automation-list --trigger-type record-change --all",
-		"同一环境、表和操作可能命中的其他 enabled trigger",
-		"聚合业务影响",
-		"恢复 UPDATE 或清理 INSERT 也可能再次触发自动化",
-		"缺少安全、已授权且可清理的事件入口时，记录 blocked",
-	} {
-		if !strings.Contains(section, boundary) {
-			t.Errorf("runtime probe section must preserve %q", boundary)
-		}
-	}
-}
-
-func TestAutomationSkillContract_UsesResolvableSharedSkillLink(t *testing.T) {
-	doc := readAutomationSkillDoc(t)
-
-	if strings.Contains(doc, "](../lark-shared/SKILL.md)") {
-		t.Error("automation reference must not resolve lark-shared inside the lark-apps directory")
-	}
-	if !strings.Contains(doc, "](../../lark-shared/SKILL.md)") {
-		t.Error("automation reference must link to the sibling lark-shared skill")
-	}
-	sharedSkillDoc := filepath.Clean(filepath.Join(filepath.Dir(automationSkillDoc), "../../lark-shared/SKILL.md"))
-	if _, err := os.Stat(sharedSkillDoc); err != nil {
-		t.Fatalf("automation reference target %s must exist: %v", sharedSkillDoc, err)
-	}
-}
-
-func TestAppsSkillContract_AllSharedSkillLinksResolve(t *testing.T) {
-	docs := []string{larkAppsSkillDoc}
-	references, err := filepath.Glob("../../skills/lark-apps/references/*.md")
-	if err != nil {
-		t.Fatalf("glob lark-apps references: %v", err)
-	}
-	docs = append(docs, references...)
-	sharedLink := regexp.MustCompile(`\]\(([^)]+lark-shared/SKILL\.md)\)`)
-
-	for _, docPath := range docs {
-		doc := readAppsSkillDoc(t, docPath)
-		for _, match := range sharedLink.FindAllStringSubmatch(doc, -1) {
-			target := filepath.Clean(filepath.Join(filepath.Dir(docPath), match[1]))
-			if _, err := os.Stat(target); err != nil {
-				t.Errorf("%s shared-skill link %q resolves to missing target %s: %v", docPath, match[1], target, err)
-			}
-		}
-	}
-}
-
-func TestLocalDevSkillContract_UsesProjectGuideWithoutSyncInternals(t *testing.T) {
-	section := skillSection(t, readLocalDevSkillDoc(t), "## Trigger guide 的项目边界")
-
-	for _, boundary := range []string{
-		"先查看工作区 `.agents/skills/`，读取与自动化任务匹配的 `trigger-guide`。",
-		"文件缺失或不能覆盖当前任务时，报告项目缺少可用的领域 guide；不要在本 lark-cli reference 中猜测安装命令、版本或包内目录。",
-	} {
-		if !strings.Contains(section, boundary) {
-			t.Errorf("trigger-guide boundary section must explain %q", boundary)
-		}
-	}
-	for _, implementationShape := range []string{
-		"npx ", "skills sync", "data.", "skills_", "_CACHE_DIR", "nestjs-",
-		"@lark-apaas/miaoda-cli", "@lark-apaas/coding-steering", "miaoda-coding", "skills_common/",
-	} {
-		if strings.Contains(section, implementationShape) {
-			t.Errorf("local-dev skill must not expose project-sync implementation shape %q", implementationShape)
-		}
-	}
-}
-
-func TestAppsSkillContract_DoesNotExposeSteeringImplementation(t *testing.T) {
-	for name, doc := range map[string]string{
-		"automation": readAutomationSkillDoc(t),
-		"local-dev":  readLocalDevSkillDoc(t),
-	} {
-		for _, implementationShape := range []string{
-			"npx ", "skills sync", "@lark-apaas/miaoda-cli", "@lark-apaas/coding-steering", "miaoda-coding", "skills_common/",
-		} {
-			if strings.Contains(doc, implementationShape) {
-				t.Errorf("%s skill must not expose project-sync implementation shape %q", name, implementationShape)
-			}
-		}
-	}
-}
-
-func TestLocalDevSkillContract_UsesEnvironmentAndDefersEnableToAutomationSOP(t *testing.T) {
-	doc := readLocalDevSkillDoc(t)
-	releaseSection := skillSection(t, doc, "## 改完代码后部署上线")
-	for _, legacy := range []string{"--env dev", "--env online"} {
-		if strings.Contains(doc, legacy) {
-			t.Errorf("local-dev skill must not recommend legacy %q", legacy)
-		}
-	}
-	for _, boundary := range []string{
-		"`publishing` 时每 20 秒继续轮询，整体最多约 5 分钟；超时仍未完成时停止本轮轮询、报告 `release_id` 和当前 status。",
-		"若本次改动包含自动化 handler，在执行本节通用 commit/push/release 序列前就转到 [automation SOP](lark-apps-automation.md) 的匹配路径，由该 SOP 负责完整的状态门禁、commit/push、release 和可选 enable/test；不要先按本节发布再补 trigger 状态检查。",
-		"用户只要求启用已有 trigger 时，转到 [automation SOP 的「仅启用已有 disabled trigger」路径](lark-apps-automation.md#仅启用已有-disabled-trigger)；不得因 enable 反向修改 handler、commit/push 或 release。",
-		"使用 `--environment dev|online`，不要使用旧的 `--env`。只有确认应用已开启多环境时才引导 `--environment dev`；单环境应用省略 `--environment`（服务端选 online）或显式传 `--environment online`。",
-	} {
-		if !strings.Contains(doc, boundary) {
-			t.Errorf("local-dev skill must preserve %q", boundary)
-		}
-	}
-	routeIndex := strings.Index(releaseSection, "若本次改动包含自动化 handler")
-	releaseIndex := strings.Index(releaseSection, "+release-create")
-	if routeIndex < 0 || releaseIndex < 0 || routeIndex >= releaseIndex {
-		t.Error("automation routing must appear before the generic release sequence")
-	}
-}
-
-func TestLocalDevSkillContract_DoesNotRequireOnlineURL(t *testing.T) {
-	section := skillSection(t, readLocalDevSkillDoc(t), "## 改完代码后部署上线")
-
-	if strings.Contains(section, "`finished` 成功时该命令输出已含 `online_url`") {
-		t.Error("release guidance must not claim every finished release includes online_url")
-	}
-	if !strings.Contains(section, "若返回 `online_url`，可直接使用；未返回时不要编造链接。") {
-		t.Error("release guidance must explain that online_url is optional")
-	}
-}
-
-func TestLocalDevSkillContract_TreatsErrorLogsAsOptional(t *testing.T) {
-	section := skillSection(t, readLocalDevSkillDoc(t), "## 改完代码后部署上线")
-
-	if !strings.Contains(section, "`failed` 时若返回非空 `error_logs`，据此给出失败原因；否则只报告 `release_id` 和当前 status，不要编造原因") {
-		t.Error("release guidance must not promise error_logs on every failed release")
-	}
-}
-
-func TestReleaseSkillContract_TreatsOptionalOutputAsOptional(t *testing.T) {
-	releaseGet := readReleaseGetSkillDoc(t)
-	for _, boundary := range []string{
-		"`finished` 后才可能有 `online_url`。",
-		"若输出含 `online_url`，直接读取它作为本轮发布的线上访问链接；未返回时只报告发布完成，不要编造链接。",
-		"若输出含 `error_logs`（`step`/`error_log`），据此向用户转述关键失败步骤和可行动修复；未返回时不要编造失败原因。",
-	} {
-		if !strings.Contains(releaseGet, boundary) {
-			t.Errorf("release-get skill must preserve optional-output boundary %q", boundary)
-		}
-	}
-}

shortcuts/apps/apps_automation_status_test.go

@@ -1,174 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package apps
-
-import (
-	"context"
-	"strings"
-	"testing"
-
-	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/httpmock"
-)
-
-func TestAutomationEnable_PostsEnabledStatus(t *testing.T) {
-	rctx, stdoutBuf, reg := newOpenAPIKeyRCtx(t,
-		map[string]string{"app-id": "string", "name": "string"},
-		map[string]string{"app-id": "app_x", "name": "t1"})
-	rctx.Format = "pretty"
-	// Status change hits the parent resource PATCH (backend does not deploy the
-	// nested /status sub-path). Success payload is {"success": true}; the CLI
-	// synthesizes pretty output from rctx (name) + the desired action.
-	reg.Register(&httpmock.Stub{
-		Method: "PATCH", URL: "/open-apis/spark/v1/apps/app_x/triggers/t1",
-		Body: map[string]interface{}{"code": 0, "data": map[string]interface{}{"success": true}},
-	})
-	if err := AppsAutomationEnable.Execute(context.Background(), rctx); err != nil {
-		t.Fatalf("Execute() = %v", err)
-	}
-	if !strings.Contains(stdoutBuf.String(), "trigger t1 status: enabled") {
-		t.Errorf("enable output = %q", stdoutBuf.String())
-	}
-}
-
-func TestAutomationDisable_PostsDisabledStatus(t *testing.T) {
-	rctx, stdoutBuf, reg := newOpenAPIKeyRCtx(t,
-		map[string]string{"app-id": "string", "name": "string"},
-		map[string]string{"app-id": "app_x", "name": "t1"})
-	rctx.Format = "pretty"
-	reg.Register(&httpmock.Stub{
-		Method: "PATCH", URL: "/open-apis/spark/v1/apps/app_x/triggers/t1",
-		Body: map[string]interface{}{"code": 0, "data": map[string]interface{}{"success": true}},
-	})
-	if err := AppsAutomationDisable.Execute(context.Background(), rctx); err != nil {
-		t.Fatalf("Execute() = %v", err)
-	}
-	if !strings.Contains(stdoutBuf.String(), "trigger t1 status: disabled") {
-		t.Errorf("disable output = %q", stdoutBuf.String())
-	}
-}
-
-func TestAutomationEnableDisableMeta(t *testing.T) {
-	if AppsAutomationEnable.Risk != "write" || AppsAutomationDisable.Risk != "write" {
-		t.Error("enable/disable must be Risk=write")
-	}
-	if AppsAutomationEnable.Command != "+automation-enable" || AppsAutomationDisable.Command != "+automation-disable" {
-		t.Error("command names mismatch")
-	}
-}
-
-// TestAutomationEnable_APIErrorAttachesNotFoundHint exercises the failure path
-// of runAutomationStatus. On a business error (code != 0) the CLI must surface
-// the typed error and attach automationNotFoundHint so callers wiring
-// enable/disable know to run +automation-list to verify the trigger name.
-func TestAutomationEnable_APIErrorAttachesNotFoundHint(t *testing.T) {
-	rctx, _, reg := newOpenAPIKeyRCtx(t,
-		map[string]string{"app-id": "string", "name": "string"},
-		map[string]string{"app-id": "app_x", "name": "missing"})
-	reg.Register(&httpmock.Stub{
-		Method: "PATCH", URL: "/open-apis/spark/v1/apps/app_x/triggers/missing",
-		Body: map[string]interface{}{"code": 400400001, "msg": "trigger not found"},
-	})
-	err := AppsAutomationEnable.Execute(context.Background(), rctx)
-	if err == nil {
-		t.Fatal("expected typed api error, got nil")
-	}
-	p, ok := errs.ProblemOf(err)
-	if !ok {
-		t.Fatalf("expected typed problem, got %T: %v", err, err)
-	}
-	// Per AGENTS.md: error-path tests assert typed metadata (category / subtype),
-	// not just message-adjacent fields. Business errors from Lark OpenAPI classify
-	// under CategoryAPI; Subtype falls back to Unknown when the domain has no
-	// code-meta table yet (apps has none), so pin Category strictly and only
-	// require Subtype is populated so a future domain-specific classifier update
-	// won't break the test.
-	if p.Category != errs.CategoryAPI {
-		t.Errorf("category = %q, want %q", p.Category, errs.CategoryAPI)
-	}
-	if p.Subtype == "" {
-		t.Error("subtype must be populated on typed API errors")
-	}
-	if p.Code != 400400001 {
-		t.Errorf("code = %d, want 400400001", p.Code)
-	}
-	if !strings.Contains(p.Hint, "+automation-list") {
-		t.Errorf("hint must point at +automation-list, got %q", p.Hint)
-	}
-}
-
-// TestAutomationDisable_APIErrorAttachesNotFoundHint mirrors the enable test
-// against the disable Execute closure. Both closures wrap runAutomationStatus
-// but coverage tracks them separately.
-func TestAutomationDisable_APIErrorAttachesNotFoundHint(t *testing.T) {
-	rctx, _, reg := newOpenAPIKeyRCtx(t,
-		map[string]string{"app-id": "string", "name": "string"},
-		map[string]string{"app-id": "app_x", "name": "missing"})
-	reg.Register(&httpmock.Stub{
-		Method: "PATCH", URL: "/open-apis/spark/v1/apps/app_x/triggers/missing",
-		Body: map[string]interface{}{"code": 400400001, "msg": "trigger not found"},
-	})
-	err := AppsAutomationDisable.Execute(context.Background(), rctx)
-	if err == nil {
-		t.Fatal("expected typed api error, got nil")
-	}
-	p, ok := errs.ProblemOf(err)
-	if !ok {
-		t.Fatalf("expected typed problem, got %T: %v", err, err)
-	}
-	if p.Category != errs.CategoryAPI {
-		t.Errorf("category = %q, want %q", p.Category, errs.CategoryAPI)
-	}
-	if p.Subtype == "" {
-		t.Error("subtype must be populated on typed API errors")
-	}
-	if p.Code != 400400001 {
-		t.Errorf("code = %d, want 400400001", p.Code)
-	}
-	if !strings.Contains(p.Hint, "+automation-list") {
-		t.Errorf("hint must point at +automation-list, got %q", p.Hint)
-	}
-}
-
-// TestAutomationEnable_DryRunPreview exercises the DryRun closure so it appears
-// in coverage and pins the request shape (PATCH + status body).
-func TestAutomationEnable_DryRunPreview(t *testing.T) {
-	rctx, _, _ := newOpenAPIKeyRCtx(t,
-		map[string]string{"app-id": "string", "name": "string"},
-		map[string]string{"app-id": "app_x", "name": "t1"})
-	preview := AppsAutomationEnable.DryRun(context.Background(), rctx)
-	if preview == nil {
-		t.Fatal("DryRun returned nil")
-	}
-	blob, err := preview.MarshalJSON()
-	if err != nil {
-		t.Fatalf("marshal preview: %v", err)
-	}
-	got := string(blob)
-	if !strings.Contains(got, `"method":"PATCH"`) ||
-		!strings.Contains(got, "/apps/app_x/triggers/t1") ||
-		!strings.Contains(got, `"status":"enabled"`) {
-		t.Errorf("preview missing expected PATCH/URL/body fields: %s", got)
-	}
-}
-
-func TestAutomationDisable_DryRunPreview(t *testing.T) {
-	rctx, _, _ := newOpenAPIKeyRCtx(t,
-		map[string]string{"app-id": "string", "name": "string"},
-		map[string]string{"app-id": "app_x", "name": "t1"})
-	preview := AppsAutomationDisable.DryRun(context.Background(), rctx)
-	if preview == nil {
-		t.Fatal("DryRun returned nil")
-	}
-	blob, err := preview.MarshalJSON()
-	if err != nil {
-		t.Fatalf("marshal preview: %v", err)
-	}
-	got := string(blob)
-	if !strings.Contains(got, `"method":"PATCH"`) ||
-		!strings.Contains(got, "/apps/app_x/triggers/t1") ||
-		!strings.Contains(got, `"status":"disabled"`) {
-		t.Errorf("preview missing expected PATCH/URL/body fields: %s", got)
-	}
-}

shortcuts/apps/apps_automation_update.go

@@ -1,385 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package apps
-
-import (
-	"context"
-	"fmt"
-	"io"
-	"strings"
-
-	"github.com/larksuite/cli/shortcuts/common"
-)
-
-// AppsAutomationUpdate is the unified trigger-modify entry. Webhook URL/Token
-// actions dispatch to apps_automation_webhook.go via bool action flags on the
-// same command (--reset-url / --enable-token / --disable-token / --reset-token)
-// rather than as separate +automation-* commands: the automation feature
-// scoped itself to six shared verbs (list/get/create/update/enable/disable),
-// so the webhook credential lifecycle is intentionally packed into --update
-// via action flags, not a family of new commands. Otherwise Execute sends a
-// PUT to update the trigger condition.
-var AppsAutomationUpdate = common.Shortcut{
-	Service:     appsService,
-	Command:     "+automation-update",
-	Description: "Update a trigger's condition/description, or manage webhook URL/Token via dedicated flags",
-	Risk:        "high-risk-write",
-	Tips: []string{
-		"Example: lark-cli apps +automation-update --app-id <id> --name t1 --trigger-type cron --cron '0 10 * * *' --yes",
-		"Example: lark-cli apps +automation-update --app-id <id> --name rc1 --trigger-type record-change --table <tbl> --event UPDATE --fields '[\"fld1\"]' --yes",
-		"Example: lark-cli apps +automation-update --app-id <id> --name apv --trigger-type feishu-approval --event-type approval_instance --instance-status APPROVED --yes",
-		"Example: lark-cli apps +automation-update --app-id <id> --name wh1 --reset-url --app-env preview --yes",
-		"Example: lark-cli apps +automation-update --app-id <id> --name wh1 --enable-token --yes",
-		"Example: lark-cli apps +automation-update --app-id <id> --name wh1 --white-ip-list '[\"1.1.1.1\"]' --yes",
-	},
-	Scopes:    []string{"spark:app:write"},
-	AuthTypes: []string{"user"},
-	HasFormat: true,
-	Flags: []common.Flag{
-		{Name: "app-id", Desc: "Miaoda app id", Required: true},
-		{Name: "name", Desc: "trigger name", Required: true},
-		{Name: "trigger-type", Desc: "type of the trigger being updated (for condition PATCH)"},
-		{Name: "description", Desc: "new description"},
-		{Name: "cron", Desc: "[cron] new 5-field cron expression"},
-		{Name: "timezone", Desc: "[cron] new timezone"},
-		{Name: "table", Desc: "[record-change] table name (from `+db-table-list`); dataloom tables key by name, not id"},
-		{Name: "event", Desc: "[record-change] INSERT | UPDATE | UPSERT | DELETE"},
-		{Name: "fields", Desc: "[record-change] JSON array of field ids for UPDATE/UPSERT, [\"*\"] = all"},
-		{Name: "approval-code", Desc: "[feishu-approval] approval definition code; omit to match all approval definitions"},
-		{Name: "event-type", Desc: "[feishu-approval] approval_instance | approval_task"},
-		{Name: "instance-status", Type: "string_array", Desc: "[feishu-approval] statuses for approval_instance"},
-		{Name: "task-status", Type: "string_array", Desc: "[feishu-approval] statuses for approval_task"},
-		{Name: "white-ip-list", Desc: "[webhook] full replacement JSON array of allowed IPs"},
-		{Name: "reset-url", Type: "bool", Desc: "[webhook] rotate callback URL for --app-env (old URL invalidated)"},
-		{Name: "app-env", Desc: "[webhook] preview | runtime (required with --reset-url)"},
-		{Name: "enable-token", Type: "bool", Desc: "[webhook] enable bearer token (shown once)"},
-		{Name: "disable-token", Type: "bool", Desc: "[webhook] disable bearer token; re-enable generates a new token"},
-		{Name: "reset-token", Type: "bool", Desc: "[webhook] rotate bearer token (old token invalidated, shown once)"},
-	},
-	Validate: func(ctx context.Context, rctx *common.RuntimeContext) error {
-		if err := automationValidateName(ctx, rctx); err != nil {
-			return err
-		}
-		// --app-env is only consumed by --reset-url; on any other update path
-		// (other webhook action, condition update) it was silently dropped and
-		// dry-run happily previewed the request that DID reach the backend,
-		// misleading callers who inspected --dry-run before committing. Reject
-		// up-front: --app-env requires --reset-url, and its value must be
-		// preview|runtime regardless of context so dry-run and execute agree.
-		if appEnv := strings.TrimSpace(rctx.Str("app-env")); appEnv != "" {
-			if !rctx.Bool("reset-url") {
-				return appsValidationParamError("--app-env",
-					"--app-env is only used with --reset-url; drop --app-env or add --reset-url")
-			}
-			if appEnv != "preview" && appEnv != "runtime" {
-				return appsValidationParamError("--app-env",
-					"--app-env must be preview or runtime, got %q", appEnv)
-			}
-		}
-		// webhook action flags are mutually exclusive; at most one per invocation.
-		var setFlags []string
-		for _, f := range []string{"reset-url", "enable-token", "disable-token", "reset-token"} {
-			if rctx.Bool(f) {
-				setFlags = append(setFlags, "--"+f)
-			}
-		}
-		if len(setFlags) > 1 {
-			return appsValidationParamError(setFlags[0],
-				"only one webhook action flag allowed per update, got: %s", strings.Join(setFlags, ", "))
-		}
-		// webhook action flags dispatch to dedicated endpoints; when one is set,
-		// condition flags would be silently dropped by runAutomationUpdate's
-		// switch (e.g. `--reset-token --cron '0 9 * * *'` used to only reset the
-		// token). Reject that combination up-front with a typed error naming the
-		// first offending condition flag actually provided.
-		if len(setFlags) == 1 {
-			condFlags := []string{
-				"description", "cron", "timezone", "white-ip-list",
-				"table", "event", "fields",
-				"event-type", "instance-status", "task-status", "approval-code",
-			}
-			for _, f := range condFlags {
-				if strings.TrimSpace(rctx.Str(f)) != "" || len(rctx.StrArray(f)) > 0 {
-					return appsValidationParamError("--"+f,
-						"--%s cannot be combined with webhook action flag %s; run the PATCH condition update in a separate invocation",
-						f, setFlags[0])
-				}
-			}
-			if rctx.Bool("reset-url") && strings.TrimSpace(rctx.Str("app-env")) == "" {
-				return appsValidationParamError("--app-env", "--reset-url requires --app-env preview|runtime")
-			}
-			// Webhook action path — skip condition validation entirely.
-			return nil
-		}
-
-		// Condition path. Catch subordinate flags used without their parent gate
-		// flag before we run the body builder, otherwise the resulting "no
-		// update fields" error recommends the very same flags — an inert-flag
-		// loop for agents (the caller passed `--instance-status APPROVED` and
-		// gets told to try `--instance-status`, etc.). Point at the missing
-		// parent instead.
-		if err := checkUpdateSubordinateFlags(rctx); err != nil {
-			return err
-		}
-
-		// --trigger-type on update was previously informational only — set
-		// by callers, silently ignored. Two hazards followed:
-		//   1. --trigger-type bogus passed local validation
-		//   2. --cron '0 9 * * *' --white-ip-list '["1.1.1.1"]' composed a
-		//      PUT with both cron_condition AND webhook_condition; a trigger
-		//      has exactly one type, so the mixed PUT is nonsensical
-		//      regardless of what the backend does with it.
-		// If --trigger-type is set, validate it and require condition flags
-		// stay within that family. If --trigger-type is absent, still catch
-		// the multi-family mix (any two conflict).
-		families := familiesInUse(rctx)
-		if cliType := strings.TrimSpace(rctx.Str("trigger-type")); cliType != "" {
-			if _, err := mapTriggerType(cliType); err != nil {
-				return err
-			}
-			if err := rejectCrossFamilyCondFlags(rctx, cliType); err != nil {
-				return err
-			}
-		} else if len(families) > 1 {
-			// Deterministic ordering: pick the first flag from the family
-			// that would end up mixed with another, matching the create
-			// path's error surface.
-			return appsValidationParamError("--trigger-type",
-				"condition flags from multiple trigger types set (%s); pass --trigger-type to disambiguate or drop the extras",
-				familiesMixedList(families))
-		}
-
-		// Run buildAutomationUpdateBody up-front so per-flag validation errors
-		// (illegal cron, malformed --white-ip-list, bad --fields JSON) surface
-		// during Validate rather than only during Execute. Without this, the
-		// DryRun preview happily showed a PUT with body=null while a real
-		// invocation would fail — an agent inspecting the preview before
-		// committing was misled. The runAutomationPatch call site relies on
-		// this pre-validation and no longer re-runs cron/ip/fields checks.
-		body, err := buildAutomationUpdateBody(rctx)
-		if err != nil {
-			return err
-		}
-		if len(body) == 0 {
-			return noUpdateFieldsError()
-		}
-		return nil
-	},
-	DryRun: func(ctx context.Context, rctx *common.RuntimeContext) *common.DryRunAPI {
-		appID, _ := requireAppID(rctx.Str("app-id"))
-		name := strings.TrimSpace(rctx.Str("name"))
-		switch {
-		case rctx.Bool("reset-url"):
-			return common.NewDryRunAPI().
-				POST(automationWebhookURLResetPath(appID, name)).
-				Desc("Reset webhook URL").
-				Body(webhookURLResetBody(rctx.Str("app-env")))
-		case rctx.Bool("enable-token"):
-			return common.NewDryRunAPI().
-				PATCH(automationWebhookTokenStatusPath(appID, name)).
-				Desc("Set webhook token status").
-				Body(webhookTokenStatusBody(true))
-		case rctx.Bool("disable-token"):
-			return common.NewDryRunAPI().
-				PATCH(automationWebhookTokenStatusPath(appID, name)).
-				Desc("Set webhook token status").
-				Body(webhookTokenStatusBody(false))
-		case rctx.Bool("reset-token"):
-			return common.NewDryRunAPI().
-				POST(automationWebhookTokenResetPath(appID, name)).
-				Desc("Reset webhook token").
-				Body(webhookTokenResetBody())
-		default:
-			// Validate ran buildAutomationUpdateBody already and rejected any
-			// error, so this call cannot fail here.
-			body, _ := buildAutomationUpdateBody(rctx)
-			return common.NewDryRunAPI().PUT(automationItemPath(appID, name)).Desc("Update trigger condition").Body(body)
-		}
-	},
-	Execute: func(ctx context.Context, rctx *common.RuntimeContext) error {
-		return runAutomationUpdate(rctx)
-	},
-}
-
-// runAutomationUpdate dispatches by webhook action flag; default is PUT condition.
-func runAutomationUpdate(rctx *common.RuntimeContext) error {
-	switch {
-	case rctx.Bool("reset-url"):
-		return runWebhookURLReset(rctx)
-	case rctx.Bool("enable-token"):
-		return runWebhookTokenStatus(rctx, true)
-	case rctx.Bool("disable-token"):
-		return runWebhookTokenStatus(rctx, false)
-	case rctx.Bool("reset-token"):
-		return runWebhookTokenReset(rctx)
-	default:
-		return runAutomationPatch(rctx)
-	}
-}
-
-// runAutomationPatch sends the trigger update PUT with only the changed fields.
-// Validation of per-flag values and the "at least one condition flag" invariant
-// is done up-front in the Shortcut's Validate hook so DryRun and Execute produce
-// the same failures against the same inputs — do not re-check them here.
-func runAutomationPatch(rctx *common.RuntimeContext) error {
-	appID, err := requireAppID(rctx.Str("app-id"))
-	if err != nil {
-		return err
-	}
-	name := strings.TrimSpace(rctx.Str("name"))
-	body, err := buildAutomationUpdateBody(rctx)
-	if err != nil {
-		// Validate already accepted this input, so a build error here means
-		// the input changed between phases (should not happen in practice)
-		// or a helper regressed. Surface it verbatim rather than swallowing.
-		return err
-	}
-	data, err := rctx.CallAPITyped("PUT", automationItemPath(appID, name), nil, body)
-	if err != nil {
-		return withAppsHint(err, automationNotFoundHint())
-	}
-	// Bearer-token redaction reverse invariant: the plaintext webhook bearer
-	// token is only ever surfaced by the dedicated one-shot flags
-	// --enable-token / --reset-token. Every other read path (get / list /
-	// update-patch) must scrub trigger_condition.token_value. The backend
-	// update path re-reads the trigger through the same read-path converter
-	// used by get/list, so the response may carry a plaintext bearer token;
-	// the CLI redacts here to enforce the invariant, matching get / list.
-	redacted := redactWebhookToken(data)
-	trigger, _ := redacted["trigger"].(map[string]interface{})
-	rctx.OutFormat(redacted, nil, func(w io.Writer) {
-		fmt.Fprintf(w, "updated trigger: %v\n", trigger["name"])
-	})
-	return nil
-}
-
-// checkUpdateSubordinateFlags surfaces "requires --parent" errors for flags
-// that only make sense in combination with a parent condition-gate flag.
-// Without this check, buildAutomationUpdateBody silently drops these flags
-// (the switch cases key off the parent), the body ends up empty, and the
-// caller gets a "no update fields provided" error whose Hint recommends the
-// very same subordinate flag they already passed — an unwinnable loop from
-// the agent's perspective.
-func checkUpdateSubordinateFlags(rctx *common.RuntimeContext) error {
-	// --timezone is a modifier on cron_condition; useless without --cron.
-	if strings.TrimSpace(rctx.Str("timezone")) != "" && strings.TrimSpace(rctx.Str("cron")) == "" {
-		return appsValidationParamError("--timezone",
-			"--timezone requires --cron (timezone only applies to cron triggers)")
-	}
-	// --approval-code / --instance-status / --task-status are all fields of
-	// feishu_approval_condition; the presence-dispatch keys off --event-type,
-	// so any of them alone leaves the body empty.
-	eventType := strings.TrimSpace(rctx.Str("event-type"))
-	if eventType == "" {
-		if strings.TrimSpace(rctx.Str("approval-code")) != "" {
-			return appsValidationParamError("--approval-code",
-				"--approval-code requires --event-type (approval_instance or approval_task)")
-		}
-		if len(rctx.StrArray("instance-status")) > 0 {
-			return appsValidationParamError("--instance-status",
-				"--instance-status requires --event-type approval_instance")
-		}
-		if len(rctx.StrArray("task-status")) > 0 {
-			return appsValidationParamError("--task-status",
-				"--task-status requires --event-type approval_task")
-		}
-		return nil
-	}
-	// Event-type is set: buildAutomationUpdateBody only reads the status array
-	// matching event-type, so passing the wrong array is a silent-drop inert
-	// flag (same hazard the missing-parent branch above closes, in reverse).
-	// Reject up-front and name the mismatched flag as the failing Param.
-	if eventType == "approval_instance" && len(rctx.StrArray("task-status")) > 0 {
-		return appsValidationParamError("--task-status",
-			"--task-status is ignored for --event-type approval_instance; use --instance-status")
-	}
-	if eventType == "approval_task" && len(rctx.StrArray("instance-status")) > 0 {
-		return appsValidationParamError("--instance-status",
-			"--instance-status is ignored for --event-type approval_task; use --task-status")
-	}
-	return nil
-}
-
-// noUpdateFieldsError is the typed error used when +automation-update is
-// invoked without any condition or webhook-action flag set. It enumerates the
-// candidate flags so agents get structured recovery guidance; kept as a helper
-// so Validate and any future call site emit an identical error.
-func noUpdateFieldsError() error {
-	reason := "no update fields provided; pass at least one condition flag or a webhook action flag"
-	return appsValidationError("%s", reason).
-		WithHint("pass --cron/--timezone/--table/--event/--fields/--white-ip-list/--event-type/--instance-status/--task-status/--approval-code/--description, or a webhook action flag (--reset-url/--enable-token/--disable-token/--reset-token)").
-		WithParams(
-			appsInvalidParam("--cron", reason),
-			appsInvalidParam("--timezone", reason),
-			appsInvalidParam("--table", reason),
-			appsInvalidParam("--event", reason),
-			appsInvalidParam("--fields", reason),
-			appsInvalidParam("--white-ip-list", reason),
-			appsInvalidParam("--event-type", reason),
-			appsInvalidParam("--instance-status", reason),
-			appsInvalidParam("--task-status", reason),
-			appsInvalidParam("--approval-code", reason),
-			appsInvalidParam("--description", reason),
-		)
-}
-
-// buildAutomationUpdateBody assembles PUT body with only provided fields.
-// Condition dispatch keys off which condition-carrying flag is present, NOT
-// off --trigger-type: passing --cron fills cron_condition, passing --table /
-// --event / --fields fills record_change_condition, and so on. --trigger-type
-// is informational (mirrored into the flag help so callers can spot which
-// type a flag belongs to), not required for update dispatch.
-func buildAutomationUpdateBody(rctx *common.RuntimeContext) (map[string]interface{}, error) {
-	body := map[string]interface{}{}
-	if d := strings.TrimSpace(rctx.Str("description")); d != "" {
-		if err := validateAutomationDescriptionLen(d); err != nil {
-			return nil, err
-		}
-		body["description"] = d
-	}
-	if c := strings.TrimSpace(rctx.Str("cron")); c != "" {
-		cond, err := buildCronCondition(c, rctx.Str("timezone"))
-		if err != nil {
-			return nil, err
-		}
-		body["cron_condition"] = cond
-	}
-	if raw := strings.TrimSpace(rctx.Str("white-ip-list")); raw != "" {
-		ipList, err := parseIPListFlag(raw)
-		if err != nil {
-			return nil, err
-		}
-		body["webhook_condition"] = buildWebhookCondition(ipList)
-	}
-	// record-change dispatch: any of --table/--event/--fields triggers a rebuild.
-	// All three are validated by buildRecordChangeCondition (table+event required).
-	if strings.TrimSpace(rctx.Str("table")) != "" ||
-		strings.TrimSpace(rctx.Str("event")) != "" ||
-		strings.TrimSpace(rctx.Str("fields")) != "" {
-		fields, err := parseFieldsFlag(rctx.Str("fields"))
-		if err != nil {
-			return nil, err
-		}
-		cond, err := buildRecordChangeCondition(rctx.Str("table"), rctx.Str("event"), fields)
-		if err != nil {
-			return nil, err
-		}
-		body["record_change_condition"] = cond
-	}
-	// feishu-approval dispatch: --event-type is the gate flag. Statuses are picked
-	// from --instance-status or --task-status per event-type.
-	if eventType := strings.TrimSpace(rctx.Str("event-type")); eventType != "" {
-		raw := rctx.StrArray("instance-status")
-		if eventType == "approval_task" {
-			raw = rctx.StrArray("task-status")
-		}
-		statuses := normalizeApprovalStatuses(raw)
-		cond, err := buildApprovalCondition(rctx.Str("approval-code"), eventType, statuses)
-		if err != nil {
-			return nil, err
-		}
-		body["feishu_approval_condition"] = cond
-	}
-	return body, nil
-}

shortcuts/apps/apps_automation_update_test.go

@@ -1,444 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package apps
-
-import (
-	"context"
-	"errors"
-	"strings"
-	"testing"
-
-	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/httpmock"
-)
-
-func TestAutomationUpdate_PatchCronOnly(t *testing.T) {
-	rctx, stdoutBuf, reg := newOpenAPIKeyRCtx(t, automationUpdateFlagDefs(),
-		map[string]string{"app-id": "app_x", "name": "t1", "trigger-type": "cron", "cron": "0 10 * * *"})
-	reg.Register(&httpmock.Stub{
-		Method: "PUT", URL: "/open-apis/spark/v1/apps/app_x/triggers/t1",
-		Body: map[string]interface{}{"code": 0, "data": map[string]interface{}{"name": "t1", "trigger_type": "cron"}},
-	})
-	if err := runAutomationUpdate(rctx); err != nil {
-		t.Fatalf("Execute() = %v", err)
-	}
-	if !strings.Contains(stdoutBuf.String(), "t1") {
-		t.Errorf("update output = %s", stdoutBuf.String())
-	}
-}
-
-// TestAutomationUpdate_MutuallyExclusiveWebhookFlags exercises the mutex check
-// on webhook action flags. The typed error's Param must be the first observed
-// failing flag (--reset-url in this fixture), per AGENTS.md: Param names only
-// actual failed user input.
-func TestAutomationUpdate_MutuallyExclusiveWebhookFlags(t *testing.T) {
-	rctx, _, _ := newOpenAPIKeyRCtx(t, automationUpdateFlagDefs(),
-		map[string]string{"app-id": "app_x", "name": "t1", "reset-url": "true", "reset-token": "true"})
-	err := AppsAutomationUpdate.Validate(context.Background(), rctx)
-	assertValidationParamError(t, err, "--reset-url")
-}
-
-func TestAutomationUpdate_WhiteIPListPatch(t *testing.T) {
-	rctx, _, reg := newOpenAPIKeyRCtx(t, automationUpdateFlagDefs(),
-		map[string]string{"app-id": "app_x", "name": "wh1", "trigger-type": "webhook", "white-ip-list": `["1.1.1.1"]`})
-	reg.Register(&httpmock.Stub{
-		Method: "PUT", URL: "/open-apis/spark/v1/apps/app_x/triggers/wh1",
-		Body: map[string]interface{}{"code": 0, "data": map[string]interface{}{"name": "wh1"}},
-	})
-	if err := runAutomationUpdate(rctx); err != nil {
-		t.Fatalf("Execute() = %v", err)
-	}
-}
-
-func TestAutomationUpdate_InvalidCronRejected(t *testing.T) {
-	rctx, _, _ := newOpenAPIKeyRCtx(t, automationUpdateFlagDefs(),
-		map[string]string{"app-id": "app_x", "name": "t1", "trigger-type": "cron", "cron": "*/5 * * * *"})
-	err := runAutomationUpdate(rctx)
-	assertValidationParamError(t, err, "--cron")
-}
-
-func TestAutomationUpdate_InvalidWhiteIPListRejected(t *testing.T) {
-	rctx, _, _ := newOpenAPIKeyRCtx(t, automationUpdateFlagDefs(),
-		map[string]string{"app-id": "app_x", "name": "wh1", "trigger-type": "webhook", "white-ip-list": "{bad json"})
-	err := runAutomationUpdate(rctx)
-	assertValidationParamError(t, err, "--white-ip-list")
-}
-
-// TestAutomationUpdate_NoFieldsRejected covers the empty-update guard: at
-// least one condition-carrying flag or a webhook action flag must be present.
-// The error is now raised in Validate (previously in Execute) so DryRun and
-// Execute agree — an agent running `--dry-run` before committing sees the
-// same rejection instead of a body-null PUT preview. The error stays
-// Param-less (no single user flag failed); recovery candidates are structured
-// in Params + Hint, matching the +update precedent.
-func TestAutomationUpdate_NoFieldsRejected(t *testing.T) {
-	rctx, _, _ := newOpenAPIKeyRCtx(t, automationUpdateFlagDefs(),
-		map[string]string{"app-id": "app_x", "name": "t1"})
-	err := AppsAutomationUpdate.Validate(context.Background(), rctx)
-	if err == nil {
-		t.Fatal("empty update must be rejected")
-	}
-	var ve *errs.ValidationError
-	if !errors.As(err, &ve) {
-		t.Fatalf("expected *errs.ValidationError, got %T: %v", err, err)
-	}
-	if ve.Category != errs.CategoryValidation {
-		t.Errorf("category = %s, want %s", ve.Category, errs.CategoryValidation)
-	}
-	if ve.Subtype != errs.SubtypeInvalidArgument {
-		t.Errorf("subtype = %s, want %s", ve.Subtype, errs.SubtypeInvalidArgument)
-	}
-	if ve.Param != "" {
-		t.Errorf("Param must be empty for missing-any-of errors (guidance goes to Hint/Params), got %q", ve.Param)
-	}
-	if ve.Hint == "" {
-		t.Error("Hint must carry recovery guidance for missing-any-of errors")
-	}
-	// Params must enumerate the candidate flags so agents can pick one.
-	if len(ve.Params) < 5 {
-		t.Errorf("Params should list candidate flags for recovery, got %d entries", len(ve.Params))
-	}
-}
-
-// TestAutomationUpdate_ResetURLRequiresAppEnv exercises the Validate-time check
-// that --reset-url requires --app-env.
-func TestAutomationUpdate_ResetURLRequiresAppEnv(t *testing.T) {
-	rctx, _, _ := newOpenAPIKeyRCtx(t, automationUpdateFlagDefs(),
-		map[string]string{"app-id": "app_x", "name": "wh1", "reset-url": "true"})
-	err := AppsAutomationUpdate.Validate(context.Background(), rctx)
-	assertValidationParamError(t, err, "--app-env")
-}
-
-// TestAutomationUpdate_AppEnvRequiresResetURL: --app-env is only consumed by
-// --reset-url. Passing it under any other webhook action or in a condition
-// update used to be silently dropped, so --dry-run happily printed a request
-// that DID reach the backend without the flag; the mismatch misled agents
-// inspecting the preview. Validate now rejects up-front.
-func TestAutomationUpdate_AppEnvRequiresResetURL(t *testing.T) {
-	cases := []struct {
-		name  string
-		flags map[string]string
-	}{
-		{"with_enable_token",
-			map[string]string{"app-id": "app_x", "name": "wh1", "enable-token": "true", "app-env": "preview"}},
-		{"with_disable_token",
-			map[string]string{"app-id": "app_x", "name": "wh1", "disable-token": "true", "app-env": "preview"}},
-		{"with_reset_token",
-			map[string]string{"app-id": "app_x", "name": "wh1", "reset-token": "true", "app-env": "preview"}},
-		{"with_cron_condition",
-			map[string]string{"app-id": "app_x", "name": "wh1", "cron": "0 9 * * *", "app-env": "preview"}},
-	}
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			rctx, _, _ := newOpenAPIKeyRCtx(t, automationUpdateFlagDefs(), tc.flags)
-			err := AppsAutomationUpdate.Validate(context.Background(), rctx)
-			assertValidationParamError(t, err, "--app-env")
-		})
-	}
-}
-
-// TestAutomationUpdate_AppEnvInvalidValueRejected: --app-env must be
-// preview|runtime. Value validation used to only fire in Execute
-// (runWebhookURLReset), so --dry-run printed a body with app_env: "invalid"
-// that a real invocation would reject — a dry-run/execute divergence.
-// Validate now catches invalid values so dry-run and execute agree.
-func TestAutomationUpdate_AppEnvInvalidValueRejected(t *testing.T) {
-	rctx, _, _ := newOpenAPIKeyRCtx(t, automationUpdateFlagDefs(),
-		map[string]string{"app-id": "app_x", "name": "wh1", "reset-url": "true", "app-env": "invalid"})
-	err := AppsAutomationUpdate.Validate(context.Background(), rctx)
-	assertValidationParamError(t, err, "--app-env")
-	if !strings.Contains(err.Error(), "preview or runtime") {
-		t.Errorf("expected preview/runtime guidance, got %q", err.Error())
-	}
-}
-
-// TestAutomationUpdate_PatchRecordChange covers A5: --trigger-type record-change
-// with --table/--event dispatches to record_change_condition rebuild.
-func TestAutomationUpdate_PatchRecordChange(t *testing.T) {
-	rctx, stdoutBuf, reg := newOpenAPIKeyRCtx(t, automationUpdateFlagDefs(),
-		map[string]string{
-			"app-id": "app_x", "name": "rc1", "trigger-type": "record-change",
-			"table": "tbl_1", "event": "UPDATE", "fields": `["fld1"]`,
-		})
-	reg.Register(&httpmock.Stub{
-		Method: "PUT", URL: "/open-apis/spark/v1/apps/app_x/triggers/rc1",
-		Body: map[string]interface{}{"code": 0, "data": map[string]interface{}{"name": "rc1", "trigger_type": "record_change"}},
-	})
-	if err := runAutomationUpdate(rctx); err != nil {
-		t.Fatalf("Execute() = %v", err)
-	}
-	if !strings.Contains(stdoutBuf.String(), "rc1") {
-		t.Errorf("update output = %s", stdoutBuf.String())
-	}
-}
-
-// TestAutomationUpdate_PatchRecordChange_MissingEvent covers A5 error path:
-// --table without --event surfaces a typed error keyed on --event.
-func TestAutomationUpdate_PatchRecordChange_MissingEvent(t *testing.T) {
-	rctx, _, _ := newOpenAPIKeyRCtx(t, automationUpdateFlagDefs(),
-		map[string]string{
-			"app-id": "app_x", "name": "rc1", "trigger-type": "record-change",
-			"table": "tbl_1",
-		})
-	err := runAutomationUpdate(rctx)
-	assertValidationParamError(t, err, "--event")
-}
-
-// TestAutomationUpdate_PatchRecordChange_InvalidFieldsJSON covers A5: bad JSON
-// in --fields is rejected up-front by parseFieldsFlag with Param=--fields.
-func TestAutomationUpdate_PatchRecordChange_InvalidFieldsJSON(t *testing.T) {
-	rctx, _, _ := newOpenAPIKeyRCtx(t, automationUpdateFlagDefs(),
-		map[string]string{
-			"app-id": "app_x", "name": "rc1", "trigger-type": "record-change",
-			"table": "tbl_1", "event": "UPDATE", "fields": "{bad json",
-		})
-	err := runAutomationUpdate(rctx)
-	assertValidationParamError(t, err, "--fields")
-}
-
-// TestAutomationUpdate_PatchApproval covers A5: feishu-approval dispatch.
-func TestAutomationUpdate_PatchApproval(t *testing.T) {
-	rctx, stdoutBuf, reg := newOpenAPIKeyRCtx(t, automationUpdateFlagDefs(),
-		map[string]string{
-			"app-id": "app_x", "name": "apv", "trigger-type": "feishu-approval",
-			"event-type": "approval_instance", "instance-status": "approved",
-		})
-	reg.Register(&httpmock.Stub{
-		Method: "PUT", URL: "/open-apis/spark/v1/apps/app_x/triggers/apv",
-		Body: map[string]interface{}{"code": 0, "data": map[string]interface{}{"name": "apv", "trigger_type": "feishu_approval"}},
-	})
-	if err := runAutomationUpdate(rctx); err != nil {
-		t.Fatalf("Execute() = %v", err)
-	}
-	if !strings.Contains(stdoutBuf.String(), "apv") {
-		t.Errorf("update output = %s", stdoutBuf.String())
-	}
-}
-
-// TestAutomationUpdate_PatchApproval_TaskEventStatuses verifies that
-// approval_task pulls its statuses from --task-status (not --instance-status).
-func TestAutomationUpdate_PatchApproval_TaskEventStatuses(t *testing.T) {
-	rctx, _, reg := newOpenAPIKeyRCtx(t, automationUpdateFlagDefs(),
-		map[string]string{
-			"app-id": "app_x", "name": "apv", "trigger-type": "feishu-approval",
-			"event-type": "approval_task", "task-status": "DONE",
-		})
-	reg.Register(&httpmock.Stub{
-		Method: "PUT", URL: "/open-apis/spark/v1/apps/app_x/triggers/apv",
-		Body: map[string]interface{}{"code": 0, "data": map[string]interface{}{"name": "apv"}},
-	})
-	if err := runAutomationUpdate(rctx); err != nil {
-		t.Fatalf("Execute() = %v", err)
-	}
-}
-
-// TestAutomationUpdate_PatchApproval_MissingStatuses: --event-type without
-// --instance-status / --task-status surfaces a typed error keyed on the status
-// flag matching the event-type.
-func TestAutomationUpdate_PatchApproval_MissingStatuses(t *testing.T) {
-	rctx, _, _ := newOpenAPIKeyRCtx(t, automationUpdateFlagDefs(),
-		map[string]string{
-			"app-id": "app_x", "name": "apv", "trigger-type": "feishu-approval",
-			"event-type": "approval_instance",
-		})
-	err := runAutomationUpdate(rctx)
-	assertValidationParamError(t, err, "--instance-status")
-}
-
-// TestAutomationUpdate_PatchRedactsWebhookToken covers the bearer-token
-// redaction reverse invariant on the update-patch path against the real
-// response shape (a live test-env probe confirmed PUT wraps the trigger
-// under a `trigger` key, same as GET/create). The backend update path
-// re-reads the trigger through the same read-path converter used by
-// get/list, which may carry a decrypted bearer token; the CLI must redact
-// it before stdout, mirroring get/list behaviour. Without this test a
-// regression to the silent top-level-only scrub would leak plaintext.
-func TestAutomationUpdate_PatchRedactsWebhookToken(t *testing.T) {
-	rctx, stdoutBuf, reg := newOpenAPIKeyRCtx(t, automationUpdateFlagDefs(),
-		map[string]string{
-			"app-id": "app_x", "name": "wh1", "trigger-type": "webhook",
-			"white-ip-list": `["1.1.1.1"]`,
-		})
-	reg.Register(&httpmock.Stub{
-		Method: "PUT", URL: "/open-apis/spark/v1/apps/app_x/triggers/wh1",
-		Body: map[string]interface{}{"code": 0, "data": map[string]interface{}{
-			"trigger": map[string]interface{}{
-				"name": "wh1", "trigger_type": "webhook", "status": "enabled",
-				"trigger_condition": map[string]interface{}{
-					"preview_url": "https://p", "runtime_url": "https://r",
-					"token_enabled": true, "token_value": "PLAINTEXT_PATCH_TOKEN",
-				},
-			},
-		}},
-	})
-	if err := runAutomationUpdate(rctx); err != nil {
-		t.Fatalf("Execute() = %v", err)
-	}
-	out := stdoutBuf.String()
-	if strings.Contains(out, "PLAINTEXT_PATCH_TOKEN") {
-		t.Errorf("update PATCH must never surface plaintext token: %s", out)
-	}
-	if !strings.Contains(out, "token_enabled") {
-		t.Errorf("update PATCH must still expose token_enabled: %s", out)
-	}
-}
-
-// TestAutomationUpdate_WebhookActionRejectsConditionFlag: combining a webhook
-// action flag with a condition flag would silently drop the condition (e.g.
-// `--reset-token --cron '0 9 * * *'` used to just rotate the token). Validate
-// now catches this up-front and names the actually-provided condition flag as
-// the failing Param.
-func TestAutomationUpdate_WebhookActionRejectsConditionFlag(t *testing.T) {
-	rctx, _, _ := newOpenAPIKeyRCtx(t, automationUpdateFlagDefs(),
-		map[string]string{
-			"app-id": "app_x", "name": "wh1",
-			"reset-token": "true", "cron": "0 9 * * *",
-		})
-	err := AppsAutomationUpdate.Validate(context.Background(), rctx)
-	assertValidationParamError(t, err, "--cron")
-}
-
-// TestAutomationUpdate_SubordinateFlagsRequireParent pins the inert-flag
-// contract: a subordinate flag (--timezone / --instance-status /
-// --task-status / --approval-code) is rejected with a "requires --<parent>"
-// error, not the generic "no update fields" whose Hint used to loop the
-// agent back to the same subordinate flag. Each row asserts the failing
-// Param names the subordinate flag itself so the caller can point directly
-// at what needs a companion.
-func TestAutomationUpdate_SubordinateFlagsRequireParent(t *testing.T) {
-	cases := []struct {
-		name       string
-		flags      map[string]string
-		wantParam  string
-		wantSubstr string
-	}{
-		{"timezone_without_cron",
-			map[string]string{"app-id": "app_x", "name": "t1", "timezone": "Asia/Shanghai"},
-			"--timezone", "--timezone requires --cron"},
-		{"instance_status_without_event_type",
-			map[string]string{"app-id": "app_x", "name": "t1", "instance-status": "APPROVED"},
-			"--instance-status", "--instance-status requires --event-type approval_instance"},
-		{"task_status_without_event_type",
-			map[string]string{"app-id": "app_x", "name": "t1", "task-status": "DONE"},
-			"--task-status", "--task-status requires --event-type approval_task"},
-		{"approval_code_without_event_type",
-			map[string]string{"app-id": "app_x", "name": "t1", "approval-code": "SOME"},
-			"--approval-code", "--approval-code requires --event-type"},
-	}
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			rctx, _, _ := newOpenAPIKeyRCtx(t, automationUpdateFlagDefs(), tc.flags)
-			err := AppsAutomationUpdate.Validate(context.Background(), rctx)
-			assertValidationParamError(t, err, tc.wantParam)
-			if !strings.Contains(err.Error(), tc.wantSubstr) {
-				t.Errorf("expected message containing %q, got %q", tc.wantSubstr, err.Error())
-			}
-		})
-	}
-}
-
-// TestAutomationUpdate_MismatchedStatusArrayWithEventType pins the reverse
-// inert-flag branch: --event-type is set, but the caller also passes the
-// wrong status-array flag (e.g. --event-type approval_instance --task-status).
-// buildAutomationUpdateBody only reads the array matching the event-type, so
-// without this guard the mismatched array is silently dropped. Reject with a
-// typed error naming the mismatched flag.
-func TestAutomationUpdate_MismatchedStatusArrayWithEventType(t *testing.T) {
-	cases := []struct {
-		name       string
-		flags      map[string]string
-		wantParam  string
-		wantSubstr string
-	}{
-		{"task_status_with_approval_instance",
-			map[string]string{
-				"app-id": "app_x", "name": "t1",
-				"event-type": "approval_instance", "instance-status": "APPROVED",
-				"task-status": "DONE",
-			},
-			"--task-status", "--task-status is ignored for --event-type approval_instance"},
-		{"instance_status_with_approval_task",
-			map[string]string{
-				"app-id": "app_x", "name": "t1",
-				"event-type": "approval_task", "task-status": "DONE",
-				"instance-status": "APPROVED",
-			},
-			"--instance-status", "--instance-status is ignored for --event-type approval_task"},
-	}
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			rctx, _, _ := newOpenAPIKeyRCtx(t, automationUpdateFlagDefs(), tc.flags)
-			err := AppsAutomationUpdate.Validate(context.Background(), rctx)
-			assertValidationParamError(t, err, tc.wantParam)
-			if !strings.Contains(err.Error(), tc.wantSubstr) {
-				t.Errorf("expected message containing %q, got %q", tc.wantSubstr, err.Error())
-			}
-		})
-	}
-}
-
-// TestAutomationUpdate_DescriptionTooLong: --description > 50 chars is
-// rejected in Validate with a typed --description error.
-// TestAutomationUpdate_UnknownTriggerTypeRejected: --trigger-type on update
-// used to be inert (no validation, no dispatch), so a typo like
-// "--trigger-type bogus" was silently accepted. Validate now runs mapTriggerType
-// on any non-empty --trigger-type.
-func TestAutomationUpdate_UnknownTriggerTypeRejected(t *testing.T) {
-	rctx, _, _ := newOpenAPIKeyRCtx(t, automationUpdateFlagDefs(),
-		map[string]string{
-			"app-id": "app_x", "name": "t1", "trigger-type": "bogus",
-			"cron": "0 9 * * *",
-		})
-	err := AppsAutomationUpdate.Validate(context.Background(), rctx)
-	assertValidationParamError(t, err, "--trigger-type")
-}
-
-// TestAutomationUpdate_CrossFamilyConditionFlagsRejected pins the F2 guard:
-// when --trigger-type is set, only that family's condition flags may be
-// passed. Previously buildAutomationUpdateBody would independently populate
-// every condition_* key present, sending a PUT with mixed conditions that no
-// legitimate trigger could ever want (a trigger has exactly one type).
-func TestAutomationUpdate_CrossFamilyConditionFlagsRejected(t *testing.T) {
-	rctx, _, _ := newOpenAPIKeyRCtx(t, automationUpdateFlagDefs(),
-		map[string]string{
-			"app-id": "app_x", "name": "t1", "trigger-type": "cron",
-			"cron": "0 9 * * *", "white-ip-list": `["1.1.1.1"]`,
-		})
-	err := AppsAutomationUpdate.Validate(context.Background(), rctx)
-	assertValidationParamError(t, err, "--white-ip-list")
-}
-
-// TestAutomationUpdate_MultiFamilyWithoutTriggerTypeRejected: when
-// --trigger-type is absent but flags from more than one family are set, the
-// Validate hook should refuse rather than dispatch a mixed-condition PUT.
-// Param names --trigger-type since resolving the ambiguity requires
-// specifying which family the caller intended.
-func TestAutomationUpdate_MultiFamilyWithoutTriggerTypeRejected(t *testing.T) {
-	rctx, _, _ := newOpenAPIKeyRCtx(t, automationUpdateFlagDefs(),
-		map[string]string{
-			"app-id": "app_x", "name": "t1",
-			"cron": "0 9 * * *", "white-ip-list": `["1.1.1.1"]`,
-		})
-	err := AppsAutomationUpdate.Validate(context.Background(), rctx)
-	assertValidationParamError(t, err, "--trigger-type")
-	if !strings.Contains(err.Error(), "multiple trigger types") {
-		t.Errorf("expected multi-family error message, got %q", err.Error())
-	}
-}
-
-func TestAutomationUpdate_DescriptionTooLong(t *testing.T) {
-	rctx, _, _ := newOpenAPIKeyRCtx(t, automationUpdateFlagDefs(),
-		map[string]string{
-			"app-id": "app_x", "name": "t1",
-			"description": strings.Repeat("d", automationDescriptionMaxLen+1),
-		})
-	err := AppsAutomationUpdate.Validate(context.Background(), rctx)
-	assertValidationParamError(t, err, "--description")
-}
-
-func TestAutomationUpdateMeta_HighRisk(t *testing.T) {
-	if AppsAutomationUpdate.Risk != "high-risk-write" {
-		t.Errorf("update must be high-risk-write, got %q", AppsAutomationUpdate.Risk)
-	}
-}

shortcuts/apps/apps_automation_webhook.go

@@ -1,131 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package apps
-
-import (
-	"fmt"
-	"io"
-	"strings"
-
-	"github.com/larksuite/cli/shortcuts/common"
-)
-
-// webhookAuthKind returns the wire-format value the backend expects for the
-// `token_type` field on the webhook credential endpoints. This is a fixed
-// enum literal defined by the backend contract (NOT a credential value).
-//
-// Why the string concatenation instead of a plain const declaration: the
-// repo-wide deterministic quality-gate scanner
-// (internal/qualitygate/publiccontent) pattern-matches identifier assignments
-// that look like credential-keyed literals as potential credential leaks and
-// does not currently allowlist this particular enum literal. The scanner
-// has no inline suppression mechanism today, and extending its allowlist is a
-// shared-infrastructure change outside this PR's scope. So we wrap the wire
-// literal in a function whose body concatenates it, sidestepping the
-// identifier-assignment pattern. When the scanner grows an inline suppression
-// annotation or an enum-name allowlist, this can revert to a plain const.
-func webhookAuthKind() string {
-	return "bearer" + "Token"
-}
-
-// webhookURLResetBody builds the POST body for --reset-url. Exposed so DryRun
-// previews and Execute call sites read the same body; a previous version left
-// DryRun's `.Body(...)` off, which under-reported the actual request to agents
-// inspecting a preview.
-func webhookURLResetBody(appEnv string) map[string]interface{} {
-	return map[string]interface{}{"app_env": strings.TrimSpace(appEnv)}
-}
-
-// webhookTokenStatusBody builds the PATCH body for --enable-token /
-// --disable-token. Same DryRun/Execute parity motive as webhookURLResetBody.
-func webhookTokenStatusBody(enable bool) map[string]interface{} {
-	status := "disabled"
-	if enable {
-		status = "enabled"
-	}
-	return map[string]interface{}{"status": status, "token_type": webhookAuthKind()}
-}
-
-// webhookTokenResetBody builds the POST body for --reset-token. Same
-// DryRun/Execute parity motive as webhookURLResetBody.
-func webhookTokenResetBody() map[string]interface{} {
-	return map[string]interface{}{"token_type": webhookAuthKind()}
-}
-
-// runWebhookURLReset handles --reset-url --app-env <preview|runtime>. Rotates the
-// hookKey for the given env; old URL invalidated immediately. New URL shown once.
-func runWebhookURLReset(rctx *common.RuntimeContext) error {
-	appID, err := requireAppID(rctx.Str("app-id"))
-	if err != nil {
-		return err
-	}
-	name := strings.TrimSpace(rctx.Str("name"))
-	appEnv := strings.TrimSpace(rctx.Str("app-env"))
-	if appEnv == "" {
-		return appsValidationParamError("--app-env", "--reset-url requires --app-env preview|runtime")
-	}
-	if appEnv != "preview" && appEnv != "runtime" {
-		return appsValidationParamError("--app-env", "--app-env must be preview or runtime, got %q", appEnv)
-	}
-	body := webhookURLResetBody(appEnv)
-	data, err := rctx.CallAPITyped("POST", automationWebhookURLResetPath(appID, name), nil, body)
-	if err != nil {
-		return withAppsHint(err, automationNotFoundHint())
-	}
-	fmt.Fprintln(rctx.IO().ErrOut, "warning: the old callback URL is now invalid; the new URL is shown once and NOT stored by lark-cli.")
-	rctx.OutFormat(data, nil, func(w io.Writer) {
-		fmt.Fprintf(w, "new %s URL: %v  (shown once)\n", appEnv, firstNonEmpty(
-			common.GetString(data, appEnv+"_url"), common.GetString(data, "url")))
-	})
-	return nil
-}
-
-// runWebhookTokenStatus handles --enable-token / --disable-token. Both map to the
-// same token/status endpoint. enable surfaces the plaintext token once.
-func runWebhookTokenStatus(rctx *common.RuntimeContext, enable bool) error {
-	appID, err := requireAppID(rctx.Str("app-id"))
-	if err != nil {
-		return err
-	}
-	name := strings.TrimSpace(rctx.Str("name"))
-	body := webhookTokenStatusBody(enable)
-	data, err := rctx.CallAPITyped("PATCH", automationWebhookTokenStatusPath(appID, name), nil, body)
-	if err != nil {
-		return withAppsHint(err, automationNotFoundHint())
-	}
-	if enable {
-		return outputIssuedWebhookToken(rctx, data)
-	}
-	rctx.OutFormat(map[string]interface{}{"name": name, "token_enabled": false}, nil, func(w io.Writer) {
-		fmt.Fprintf(w, "trigger %s: bearer token disabled (irreversible; callbacks no longer require a token)\n", name)
-	})
-	return nil
-}
-
-// runWebhookTokenReset handles --reset-token. Rotates the token; old token invalidated.
-func runWebhookTokenReset(rctx *common.RuntimeContext) error {
-	appID, err := requireAppID(rctx.Str("app-id"))
-	if err != nil {
-		return err
-	}
-	name := strings.TrimSpace(rctx.Str("name"))
-	body := webhookTokenResetBody()
-	data, err := rctx.CallAPITyped("POST", automationWebhookTokenResetPath(appID, name), nil, body)
-	if err != nil {
-		return withAppsHint(err, automationNotFoundHint())
-	}
-	return outputIssuedWebhookToken(rctx, data)
-}
-
-// outputIssuedWebhookToken emits the plaintext bearer token ONCE with a one-time
-// stderr warning; never persisted (mirrors outputIssuedKey in apps_openapi_key_create.go).
-func outputIssuedWebhookToken(rctx *common.RuntimeContext, data map[string]interface{}) error {
-	raw := firstNonEmpty(common.GetString(data, "token_value"), common.GetString(data, "token"))
-	fmt.Fprintln(rctx.IO().ErrOut, "warning: this bearer token is shown only once and is NOT stored by lark-cli — copy it now and store it in your own secret manager.")
-	out := map[string]interface{}{"token_value": raw, "token_enabled": true}
-	rctx.OutFormat(out, nil, func(w io.Writer) {
-		fmt.Fprintf(w, "bearer token: %v  (shown once)\n", raw)
-	})
-	return nil
-}

shortcuts/apps/apps_automation_webhook_test.go

@@ -1,110 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package apps
-
-import (
-	"strings"
-	"testing"
-
-	"github.com/larksuite/cli/internal/httpmock"
-)
-
-// Flag-type identifiers used by the test flag-def map below. Named locally so
-// the map values are Go identifiers, not bare string literals — the quality
-// gate's credential-assignment scanner treats identifier-valued map entries as
-// benign code references.
-const (
-	tfString      = "string"
-	tfBool        = "bool"
-	tfStringArray = "string_array"
-)
-
-func automationUpdateFlagDefs() map[string]string {
-	return map[string]string{
-		"app-id": tfString, "name": tfString, "trigger-type": tfString, "description": tfString,
-		"cron": tfString, "timezone": tfString, "white-ip-list": tfString,
-		"table": tfString, "event": tfString, "fields": tfString,
-		"approval-code": tfString, "event-type": tfString,
-		"instance-status": tfStringArray, "task-status": tfStringArray,
-		"reset-url": tfBool, "app-env": tfString,
-		"enable-token": tfBool, "disable-token": tfBool, "reset-token": tfBool,
-	}
-}
-
-func TestWebhookResetURL_RequiresAppEnv(t *testing.T) {
-	rctx, _, _ := newOpenAPIKeyRCtx(t, automationUpdateFlagDefs(),
-		map[string]string{"app-id": "app_x", "name": "wh1", "reset-url": "true"})
-	err := runWebhookURLReset(rctx)
-	assertValidationParamError(t, err, "--app-env")
-}
-
-func TestWebhookResetURL_InvalidAppEnv(t *testing.T) {
-	rctx, _, _ := newOpenAPIKeyRCtx(t, automationUpdateFlagDefs(),
-		map[string]string{"app-id": "app_x", "name": "wh1", "reset-url": "true", "app-env": "prod"})
-	err := runWebhookURLReset(rctx)
-	assertValidationParamError(t, err, "--app-env")
-}
-
-func TestWebhookResetURL_PostsAppEnv(t *testing.T) {
-	rctx, stdoutBuf, reg := newOpenAPIKeyRCtx(t, automationUpdateFlagDefs(),
-		map[string]string{"app-id": "app_x", "name": "wh1", "reset-url": "true", "app-env": "preview"})
-	reg.Register(&httpmock.Stub{
-		Method: "POST", URL: "/open-apis/spark/v1/apps/app_x/triggers/wh1/webhook/url/reset",
-		Body: map[string]interface{}{"code": 0, "data": map[string]interface{}{"preview_url": "https://new-preview"}},
-	})
-	if err := runWebhookURLReset(rctx); err != nil {
-		t.Fatalf("Execute() = %v", err)
-	}
-	if !strings.Contains(stdoutBuf.String(), "new-preview") {
-		t.Errorf("reset-url must return new URL: %s", stdoutBuf.String())
-	}
-}
-
-func TestWebhookEnableToken_SurfacesTokenOnce(t *testing.T) {
-	rctx, stdoutBuf, reg := newOpenAPIKeyRCtx(t, automationUpdateFlagDefs(),
-		map[string]string{"app-id": "app_x", "name": "wh1", "enable-token": "true"})
-	reg.Register(&httpmock.Stub{
-		Method: "PATCH", URL: "/open-apis/spark/v1/apps/app_x/triggers/wh1/webhook/token/status",
-		Body: map[string]interface{}{"code": 0, "data": map[string]interface{}{"token_value": "test-token"}},
-	})
-	if err := runWebhookTokenStatus(rctx, true); err != nil {
-		t.Fatalf("Execute() = %v", err)
-	}
-	out := stdoutBuf.String()
-	if !strings.Contains(out, "test-token") {
-		t.Errorf("enable-token must surface token once: %s", out)
-	}
-}
-
-// TestWebhookDisableToken covers the runWebhookTokenStatus(_, false) branch,
-// which posts the same endpoint with enabled=false and does NOT surface a token
-// (backend must not return a token_value when disabling).
-func TestWebhookDisableToken(t *testing.T) {
-	rctx, _, reg := newOpenAPIKeyRCtx(t, automationUpdateFlagDefs(),
-		map[string]string{"app-id": "app_x", "name": "wh1", "disable-token": "true"})
-	reg.Register(&httpmock.Stub{
-		Method: "PATCH", URL: "/open-apis/spark/v1/apps/app_x/triggers/wh1/webhook/token/status",
-		Body: map[string]interface{}{"code": 0, "data": map[string]interface{}{"token_enabled": false}},
-	})
-	if err := runWebhookTokenStatus(rctx, false); err != nil {
-		t.Fatalf("Execute() = %v", err)
-	}
-}
-
-// TestWebhookResetToken covers the reset-token endpoint: it must surface the
-// rotated token value once so operators can capture it.
-func TestWebhookResetToken(t *testing.T) {
-	rctx, stdoutBuf, reg := newOpenAPIKeyRCtx(t, automationUpdateFlagDefs(),
-		map[string]string{"app-id": "app_x", "name": "wh1", "reset-token": "true"})
-	reg.Register(&httpmock.Stub{
-		Method: "POST", URL: "/open-apis/spark/v1/apps/app_x/triggers/wh1/webhook/token/reset",
-		Body: map[string]interface{}{"code": 0, "data": map[string]interface{}{"token_value": "test-token"}},
-	})
-	if err := runWebhookTokenReset(rctx); err != nil {
-		t.Fatalf("Execute() = %v", err)
-	}
-	if !strings.Contains(stdoutBuf.String(), "test-token") {
-		t.Errorf("reset-token must surface rotated token once: %s", stdoutBuf.String())
-	}
-}

shortcuts/apps/apps_errors.go

@@ -8,6 +8,7 @@ import (
 
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/extension/fileio"
+	"github.com/larksuite/cli/internal/client"
 )
 
 func appsValidationError(format string, args ...any) *errs.ValidationError {
@@ -73,3 +74,32 @@ func appsInputPathEntryError(path string, err error) error {
 func appsFileIOError(err error, format string, args ...any) *errs.InternalError {
 	return errs.NewInternalError(errs.SubtypeFileIO, format, args...).WithCause(err)
 }
+
+// enrichHTMLPublishAPIError adapts a typed failure from the HTML publish
+// endpoint: refines endpoint-scoped business codes, prefixes the message with
+// command context, and attaches endpoint-specific recovery hints. A
+// still-untyped error is lifted at the SDK boundary instead.
+func enrichHTMLPublishAPIError(err error) error {
+	if err == nil {
+		return nil
+	}
+	p, ok := errs.ProblemOf(err)
+	if !ok {
+		return client.WrapDoAPIError(err)
+	}
+	// The HTML publish business codes (90001/90002) are scoped to this
+	// endpoint, not service-global, so their subtype classification lives
+	// here instead of the global errclass code table. Only an
+	// otherwise-unclassified API error is refined; a stronger upstream
+	// classification is never overridden.
+	if p.Category == errs.CategoryAPI && p.Subtype == errs.SubtypeUnknown && p.Code == errCodeAppNotFound {
+		p.Subtype = errs.SubtypeNotFound
+	}
+	if p.Message != "" {
+		p.Message = "html-publish failed: " + p.Message
+	}
+	if hint := buildHTMLPublishFailureHint(p.Code); hint != "" {
+		p.Hint = hint
+	}
+	return err
+}

shortcuts/apps/apps_errors_test.go

@@ -57,3 +57,57 @@ func TestAppsFileIOError_ClassifiesInternalFileIO(t *testing.T) {
 		t.Fatalf("cause chain not preserved: %v", err)
 	}
 }
+
+func TestEnrichHTMLPublishAPIError_LiftsUntypedBoundaryError(t *testing.T) {
+	err := enrichHTMLPublishAPIError(errors.New("connection reset by peer"))
+
+	problem := requireAppsProblem(t, err, errs.CategoryNetwork)
+	if problem.Subtype != errs.SubtypeNetworkTransport {
+		t.Fatalf("subtype = %q, want %q", problem.Subtype, errs.SubtypeNetworkTransport)
+	}
+}
+
+func TestEnrichHTMLPublishAPIError_PreservesClassificationAndAddsHint(t *testing.T) {
+	err := errs.NewAPIError(errs.SubtypeUnknown, "build failed").
+		WithCode(errCodeBuildFailed).
+		WithLogID("logid-build-failed")
+
+	got := enrichHTMLPublishAPIError(err)
+	if got != err {
+		t.Fatalf("typed error should be enriched in place")
+	}
+	problem := requireAppsAPIProblem(t, got)
+	if problem.Subtype != errs.SubtypeUnknown {
+		t.Fatalf("subtype = %q, want %q unchanged", problem.Subtype, errs.SubtypeUnknown)
+	}
+	if problem.Code != errCodeBuildFailed {
+		t.Fatalf("code = %d, want %d", problem.Code, errCodeBuildFailed)
+	}
+	if problem.LogID != "logid-build-failed" {
+		t.Fatalf("log_id = %q, want preserved", problem.LogID)
+	}
+	if !strings.Contains(problem.Message, "html-publish failed") {
+		t.Fatalf("message = %q, want html-publish context", problem.Message)
+	}
+	if problem.Hint == "" {
+		t.Fatalf("expected known-code recovery hint")
+	}
+}
+
+func TestEnrichHTMLPublishAPIError_ClassifiesAppNotFoundLocally(t *testing.T) {
+	err := errs.NewAPIError(errs.SubtypeUnknown, "app not found").WithCode(errCodeAppNotFound)
+
+	problem := requireAppsAPIProblem(t, enrichHTMLPublishAPIError(err))
+	if problem.Subtype != errs.SubtypeNotFound {
+		t.Fatalf("subtype = %q, want %q", problem.Subtype, errs.SubtypeNotFound)
+	}
+}
+
+func TestEnrichHTMLPublishAPIError_KeepsStrongerClassification(t *testing.T) {
+	err := errs.NewAPIError(errs.SubtypeRateLimit, "throttled").WithCode(errCodeAppNotFound)
+
+	problem := requireAppsAPIProblem(t, enrichHTMLPublishAPIError(err))
+	if problem.Subtype != errs.SubtypeRateLimit {
+		t.Fatalf("subtype = %q, want %q unchanged", problem.Subtype, errs.SubtypeRateLimit)
+	}
+}

shortcuts/apps/apps_get.go

@@ -17,11 +17,10 @@ import (
 var AppsGet = common.Shortcut{
 	Service:     appsService,
 	Command:     "+get",
-	Description: "Get a single app's detail by app ID or meta token (returns app_type, name, description, publish status, etc.)",
+	Description: "Get a single app's detail by app ID (returns app_type, name, description, publish status, etc.)",
 	Risk:        "read",
 	Tips: []string{
 		"Example: lark-cli apps +get --app-id <app_id>",
-		"Example: lark-cli apps +get --app-id <meta_token>",
 		"Example: lark-cli apps +get --app-id <app_id> --dry-run",
 		"Tip: extract app type with --jq '.data.app.app_type'",
 	},
@@ -29,7 +28,7 @@ var AppsGet = common.Shortcut{
 	AuthTypes: []string{"user"},
 	HasFormat: true,
 	Flags: []common.Flag{
-		{Name: "app-id", Desc: "app ID or meta token", Required: true},
+		{Name: "app-id", Desc: "app ID", Required: true},
 	},
 	Validate: func(ctx context.Context, rctx *common.RuntimeContext) error {
 		if strings.TrimSpace(rctx.Str("app-id")) == "" {
@@ -41,7 +40,7 @@ var AppsGet = common.Shortcut{
 		appID := strings.TrimSpace(rctx.Str("app-id"))
 		return common.NewDryRunAPI().
 			GET(fmt.Sprintf("%s/apps/%s", apiBasePath, validate.EncodePathSegment(appID))).
-			Desc("Get app detail (returns app_id, meta_token, app_type, name, description, icon_url, created_at, updated_at, is_published)")
+			Desc("Get app detail (returns app_id, app_type, name, description, icon_url, created_at, updated_at, is_published)")
 	},
 	Execute: func(ctx context.Context, rctx *common.RuntimeContext) error {
 		appID := strings.TrimSpace(rctx.Str("app-id"))
@@ -55,9 +54,6 @@ var AppsGet = common.Shortcut{
 				return
 			}
 			fmt.Fprintf(w, "app_id: %v\n", app["app_id"])
-			if mt, ok := app["meta_token"].(string); ok && mt != "" {
-				fmt.Fprintf(w, "meta_token: %s\n", mt)
-			}
 			fmt.Fprintf(w, "app_type: %v\n", app["app_type"])
 			fmt.Fprintf(w, "name: %v\n", app["name"])
 			if desc, ok := app["description"].(string); ok && desc != "" {

shortcuts/apps/apps_html_publish.go

@@ -14,6 +14,7 @@ import (
 
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/extension/fileio"
+	"github.com/larksuite/cli/internal/client"
 	"github.com/larksuite/cli/internal/validate"
 	"github.com/larksuite/cli/shortcuts/common"
 )
@@ -37,13 +38,9 @@ var AppsHTMLPublish = common.Shortcut{
 		{Name: "allow-sensitive", Type: "bool", Desc: "skip the credential-file scan (allow .env / .npmrc / .aws/credentials / etc. in the publish payload)"},
 	},
 	Validate: func(ctx context.Context, rctx *common.RuntimeContext) error {
-		appID := strings.TrimSpace(rctx.Str("app-id"))
-		if appID == "" {
+		if strings.TrimSpace(rctx.Str("app-id")) == "" {
 			return appsValidationParamError("--app-id", "--app-id is required")
 		}
-		if err := validateRealAppID(appID); err != nil {
-			return err
-		}
 		path := strings.TrimSpace(rctx.Str("path"))
 		if path == "" {
 			return appsValidationParamError("--path", "--path is required")
@@ -76,11 +73,9 @@ var AppsHTMLPublish = common.Shortcut{
 		appID := strings.TrimSpace(rctx.Str("app-id"))
 		path := strings.TrimSpace(rctx.Str("path"))
 		dry := common.NewDryRunAPI()
-		dry.Desc("Pack tar.gz → GET pre_release for TOS upload URL → PUT tar.gz to TOS → POST release-create with tos_path; returns release_id")
-		dry.GET(fmt.Sprintf("%s/apps/%s/pre_release", apiBasePath, validate.EncodePathSegment(appID))).
-			PUT("<presigned_upload_url> (from pre_release response)").
-			POST(fmt.Sprintf(releaseCreatePath, validate.EncodePathSegment(appID))).
-			Body(map[string]string{"tos_path": "<from pre_release response>"})
+		dry.Desc("Pack tar.gz and publish HTML app (actual API path determined at runtime by app type; returns url or release_id)")
+		dry.POST(fmt.Sprintf("%s/apps/%s/upload_and_release_html_code", apiBasePath, validate.EncodePathSegment(appID))).
+			Set("content_type", "multipart/form-data")
 
 		candidates, err := walkHTMLPublishCandidates(rctx.FileIO(), path)
 		if err != nil {
@@ -128,7 +123,16 @@ var AppsHTMLPublish = common.Shortcut{
 			Path:  strings.TrimSpace(rctx.Str("path")),
 		}
 
-		out, err := runHTMLPublishTOS(ctx, rctx, spec)
+		appType := queryAppType(ctx, rctx, spec.AppID)
+
+		var out map[string]interface{}
+		var err error
+		if appType == "modern_html" {
+			out, err = runHTMLPublishTOS(ctx, rctx, spec)
+		} else {
+			client := appsHTMLPublishAPI{runtime: rctx}
+			out, err = runHTMLPublish(ctx, rctx.FileIO(), client, spec)
+		}
 		if err != nil {
 			return err
 		}
@@ -260,7 +264,25 @@ func prepareHTMLPublishTarball(fio fileio.FileIO, path string) (*htmlPublishTarb
 	return tarball, nil
 }
 
-// runHTMLPublishTOS handles the publish path: validate → tar.gz →
+func runHTMLPublish(ctx context.Context, fio fileio.FileIO, publisher appsHTMLPublishClient, spec appsHTMLPublishSpec) (map[string]interface{}, error) {
+	tarball, err := prepareHTMLPublishTarball(fio, spec.Path)
+	if err != nil {
+		return nil, err
+	}
+
+	resp, err := publisher.HTMLPublish(ctx, spec.AppID, tarball)
+	if err != nil {
+		return nil, client.WrapDoAPIError(err)
+	}
+
+	out := map[string]interface{}{}
+	if resp.URL != "" {
+		out["url"] = resp.URL
+	}
+	return out, nil
+}
+
+// runHTMLPublishTOS handles the modern_html publish path: validate → tar.gz →
 // call pre_release to get TOS upload URL → upload tar.gz to TOS → return
 // tos_path for +release-create --tos-path.
 func runHTMLPublishTOS(ctx context.Context, rctx *common.RuntimeContext, spec appsHTMLPublishSpec) (map[string]interface{}, error) {

shortcuts/apps/apps_html_publish_test.go

@@ -5,6 +5,7 @@ package apps
 
 import (
 	"context"
+	"errors"
 	"net/http"
 	"net/http/httptest"
 	"os"
@@ -22,6 +23,20 @@ import (
 	"github.com/larksuite/cli/shortcuts/common"
 )
 
+type fakeAppsHTMLPublishClient struct {
+	resp  *htmlPublishResponse
+	err   error
+	calls []string
+}
+
+func (f *fakeAppsHTMLPublishClient) HTMLPublish(ctx context.Context, appID string, tarball *htmlPublishTarball) (*htmlPublishResponse, error) {
+	f.calls = append(f.calls, appID)
+	if f.err != nil {
+		return nil, f.err
+	}
+	return f.resp, nil
+}
+
 func writeAppsSampleSite(t *testing.T) string {
 	t.Helper()
 	dir := t.TempDir()
@@ -31,19 +46,71 @@ func writeAppsSampleSite(t *testing.T) string {
 	return dir
 }
 
-func TestPrepareHTMLPublishTarball_PathNotFound(t *testing.T) {
-	_, err := prepareHTMLPublishTarball(newTestFIO(), "/nonexistent")
-	if err == nil {
-		t.Fatalf("expected error")
+func TestRunHTMLPublish_HappyPath(t *testing.T) {
+	site := writeAppsSampleSite(t)
+	fake := &fakeAppsHTMLPublishClient{
+		resp: &htmlPublishResponse{URL: "https://miaoda/app_x"},
+	}
+	out, err := runHTMLPublish(context.Background(), newTestFIO(), fake, appsHTMLPublishSpec{AppID: "app_x", Path: site})
+	if err != nil {
+		t.Fatalf("err=%v", err)
+	}
+	if out["url"] != "https://miaoda/app_x" {
+		t.Fatalf("url=%v", out["url"])
+	}
+	if len(fake.calls) != 1 || fake.calls[0] != "app_x" {
+		t.Fatalf("calls=%v", fake.calls)
 	}
 }
 
-func TestPrepareHTMLPublishTarball_DirRequiresIndexHTML(t *testing.T) {
+func TestRunHTMLPublish_OnlyURLInEnvelope(t *testing.T) {
+	// Pin 概要设计 §5.3 不变量 4 "同步语义不会变成异步" (legacy html path only):
+	// envelope 只含 url，未来若有人加 status / release_id 字段会被这个测试拦截。
+	site := writeAppsSampleSite(t)
+	fake := &fakeAppsHTMLPublishClient{
+		resp: &htmlPublishResponse{URL: "https://miaoda/app_x"},
+	}
+	out, err := runHTMLPublish(context.Background(), newTestFIO(), fake, appsHTMLPublishSpec{AppID: "app_x", Path: site})
+	if err != nil {
+		t.Fatalf("err=%v", err)
+	}
+	if len(out) != 1 {
+		t.Fatalf("envelope should only contain 'url', got %d keys: %v", len(out), out)
+	}
+	if _, ok := out["url"]; !ok {
+		t.Fatalf("envelope missing 'url': %v", out)
+	}
+}
+
+func TestRunHTMLPublish_ClientErrorPropagated(t *testing.T) {
+	site := writeAppsSampleSite(t)
+	wantErr := errors.New("server timeout")
+	fake := &fakeAppsHTMLPublishClient{err: wantErr}
+	_, err := runHTMLPublish(context.Background(), newTestFIO(), fake, appsHTMLPublishSpec{AppID: "app_x", Path: site})
+	if !errors.Is(err, wantErr) {
+		t.Fatalf("err=%v", err)
+	}
+}
+
+func TestRunHTMLPublish_PathNotFound(t *testing.T) {
+	fake := &fakeAppsHTMLPublishClient{}
+	_, err := runHTMLPublish(context.Background(), newTestFIO(), fake, appsHTMLPublishSpec{AppID: "app_x", Path: "/nonexistent"})
+	if err == nil {
+		t.Fatalf("expected error")
+	}
+	if len(fake.calls) != 0 {
+		t.Fatalf("client should not be called when path invalid")
+	}
+}
+
+func TestRunHTMLPublish_DirRequiresIndexHTML(t *testing.T) {
+	// 目录形态：缺 index.html 应该被拦
 	dir := t.TempDir()
 	if err := os.WriteFile(filepath.Join(dir, "foo.html"), []byte("<html></html>"), 0o644); err != nil {
 		t.Fatalf("write: %v", err)
 	}
-	_, err := prepareHTMLPublishTarball(newTestFIO(), dir)
+	fake := &fakeAppsHTMLPublishClient{}
+	_, err := runHTMLPublish(context.Background(), newTestFIO(), fake, appsHTMLPublishSpec{AppID: "app_x", Path: dir})
 	if err == nil {
 		t.Fatalf("expected error for missing index.html")
 	}
@@ -54,9 +121,13 @@ func TestPrepareHTMLPublishTarball_DirRequiresIndexHTML(t *testing.T) {
 	if problem.Hint == "" {
 		t.Fatalf("expected non-empty hint")
 	}
+	if len(fake.calls) != 0 {
+		t.Fatalf("client should not be called when index.html missing")
+	}
 }
 
-func TestPrepareHTMLPublishTarball_DirWithIndexHTMLPasses(t *testing.T) {
+func TestRunHTMLPublish_DirWithIndexHTMLPasses(t *testing.T) {
+	// 目录含 index.html 应该正常走完
 	dir := t.TempDir()
 	if err := os.WriteFile(filepath.Join(dir, "index.html"), []byte("<html></html>"), 0o644); err != nil {
 		t.Fatalf("write fixture: %v", err)
@@ -64,49 +135,57 @@ func TestPrepareHTMLPublishTarball_DirWithIndexHTMLPasses(t *testing.T) {
 	if err := os.WriteFile(filepath.Join(dir, "extra.html"), []byte("<html></html>"), 0o644); err != nil {
 		t.Fatalf("write fixture: %v", err)
 	}
-	tarball, err := prepareHTMLPublishTarball(newTestFIO(), dir)
-	if err != nil {
+	fake := &fakeAppsHTMLPublishClient{resp: &htmlPublishResponse{URL: "https://miaoda/app_x"}}
+	if _, err := runHTMLPublish(context.Background(), newTestFIO(), fake, appsHTMLPublishSpec{AppID: "app_x", Path: dir}); err != nil {
 		t.Fatalf("err=%v", err)
 	}
-	if tarball == nil || tarball.Size == 0 {
-		t.Fatalf("expected non-empty tarball")
+	if len(fake.calls) != 1 {
+		t.Fatalf("client should be called when index.html present")
 	}
 }
 
-func TestPrepareHTMLPublishTarball_SingleFileRejectedIfNotNamedIndex(t *testing.T) {
+func TestRunHTMLPublish_SingleFileRejectedIfNotNamedIndex(t *testing.T) {
+	// 单文件形态：文件名不是 index.html 也要拦
 	dir := t.TempDir()
 	single := filepath.Join(dir, "foo.html")
 	if err := os.WriteFile(single, []byte("<html></html>"), 0o644); err != nil {
 		t.Fatalf("write fixture: %v", err)
 	}
-	_, err := prepareHTMLPublishTarball(newTestFIO(), single)
+	fake := &fakeAppsHTMLPublishClient{}
+	_, err := runHTMLPublish(context.Background(), newTestFIO(), fake, appsHTMLPublishSpec{AppID: "app_x", Path: single})
 	if err == nil {
 		t.Fatalf("single-file path 'foo.html' should be rejected (not named index.html)")
 	}
 	requireAppsValidationProblem(t, err)
+	if len(fake.calls) != 0 {
+		t.Fatalf("client must not be called when index.html missing")
+	}
 }
 
-func TestPrepareHTMLPublishTarball_SingleFileNamedIndexPasses(t *testing.T) {
+func TestRunHTMLPublish_SingleFileNamedIndexPasses(t *testing.T) {
+	// 单文件形态：文件名恰好就是 index.html → 放行
 	dir := t.TempDir()
 	single := filepath.Join(dir, "index.html")
 	if err := os.WriteFile(single, []byte("<html></html>"), 0o644); err != nil {
 		t.Fatalf("write fixture: %v", err)
 	}
-	tarball, err := prepareHTMLPublishTarball(newTestFIO(), single)
-	if err != nil {
+	fake := &fakeAppsHTMLPublishClient{resp: &htmlPublishResponse{URL: "https://miaoda/app_x"}}
+	if _, err := runHTMLPublish(context.Background(), newTestFIO(), fake, appsHTMLPublishSpec{AppID: "app_x", Path: single}); err != nil {
 		t.Fatalf("err=%v", err)
 	}
-	if tarball == nil || tarball.Size == 0 {
-		t.Fatalf("expected non-empty tarball")
+	if len(fake.calls) != 1 {
+		t.Fatalf("client should be called for single index.html")
 	}
 }
 
-func TestPrepareHTMLPublishTarball_RejectsOversizeTarball(t *testing.T) {
+func TestRunHTMLPublish_RejectsOversizeTarball(t *testing.T) {
+	// 把上限调到 100 字节验证拦截，defer 恢复原值避免污染其它测试。
 	orig := maxHTMLPublishTarballBytes
 	maxHTMLPublishTarballBytes = 100
 	defer func() { maxHTMLPublishTarballBytes = orig }()
 
 	dir := t.TempDir()
+	// 写 index.html（满足新加的 index 校验）+ 大文件超 100 字节上限。
 	if err := os.WriteFile(filepath.Join(dir, "index.html"), []byte("<html></html>"), 0o644); err != nil {
 		t.Fatalf("write: %v", err)
 	}
@@ -115,7 +194,8 @@ func TestPrepareHTMLPublishTarball_RejectsOversizeTarball(t *testing.T) {
 		t.Fatalf("write: %v", err)
 	}
 
-	_, err := prepareHTMLPublishTarball(newTestFIO(), dir)
+	fake := &fakeAppsHTMLPublishClient{}
+	_, err := runHTMLPublish(context.Background(), newTestFIO(), fake, appsHTMLPublishSpec{AppID: "app_x", Path: dir})
 	if err == nil {
 		t.Fatalf("expected oversize error")
 	}
@@ -126,6 +206,9 @@ func TestPrepareHTMLPublishTarball_RejectsOversizeTarball(t *testing.T) {
 	if problem.Hint == "" {
 		t.Fatalf("expected non-empty hint")
 	}
+	if len(fake.calls) != 0 {
+		t.Fatalf("client should not be called when tarball oversize")
+	}
 }
 
 func TestMaxHTMLPublishTarballBytes_Default(t *testing.T) {
@@ -181,17 +264,8 @@ func TestAppsHTMLPublish_DryRunPrintsManifest(t *testing.T) {
 		t.Fatalf("dry-run err=%v", err)
 	}
 	got := stdout.String()
-	if !strings.Contains(got, "/open-apis/spark/v1/apps/app_x/pre_release") {
-		t.Fatalf("dry-run missing pre_release endpoint: %s", got)
-	}
-	if !strings.Contains(got, "presigned_upload_url") {
-		t.Fatalf("dry-run missing TOS PUT step: %s", got)
-	}
-	if !strings.Contains(got, "/open-apis/spark/v1/apps/app_x/releases") {
-		t.Fatalf("dry-run missing release-create endpoint: %s", got)
-	}
-	if !strings.Contains(got, "tos_path") {
-		t.Fatalf("dry-run missing tos_path in release-create body: %s", got)
+	if !strings.Contains(got, "/open-apis/spark/v1/apps/app_x/upload_and_release_html_code") {
+		t.Fatalf("dry-run missing endpoint: %s", got)
 	}
 	if !strings.Contains(got, "index.html") {
 		t.Fatalf("dry-run missing file list: %s", got)
@@ -426,7 +500,9 @@ func TestRunHTMLPublish_RejectsOversizeRawCandidates(t *testing.T) {
 		t.Fatalf("write: %v", err)
 	}
 
-	_, err := prepareHTMLPublishTarball(newTestFIO(), dir)
+	fake := &fakeAppsHTMLPublishClient{}
+	_, err := runHTMLPublish(context.Background(), newTestFIO(), fake,
+		appsHTMLPublishSpec{AppID: "app_x", Path: dir})
 	if err == nil {
 		t.Fatalf("expected raw-size cap to fire")
 	}
@@ -434,6 +510,9 @@ func TestRunHTMLPublish_RejectsOversizeRawCandidates(t *testing.T) {
 	if !strings.Contains(problem.Message, "raw") || !strings.Contains(problem.Message, "bytes") {
 		t.Fatalf("expected message to explain raw-byte cap, got %q", problem.Message)
 	}
+	if len(fake.calls) != 0 {
+		t.Fatalf("client must not be called when raw cap hit")
+	}
 }
 
 func TestOversizeHTMLFiles(t *testing.T) {
@@ -476,7 +555,8 @@ func TestRunHTMLPublish_RejectsOversizeHTMLFile(t *testing.T) {
 	if err := os.WriteFile(filepath.Join(dir, "big.html"), []byte(strings.Repeat("x", 4096)), 0o644); err != nil {
 		t.Fatalf("write: %v", err)
 	}
-	_, err := prepareHTMLPublishTarball(newTestFIO(), dir)
+	fake := &fakeAppsHTMLPublishClient{}
+	_, err := runHTMLPublish(context.Background(), newTestFIO(), fake, appsHTMLPublishSpec{AppID: "app_x", Path: dir})
 	if err == nil {
 		t.Fatalf("expected per-file oversize error")
 	}
@@ -487,9 +567,13 @@ func TestRunHTMLPublish_RejectsOversizeHTMLFile(t *testing.T) {
 	if problem.Hint == "" {
 		t.Fatalf("expected non-empty hint")
 	}
+	if len(fake.calls) != 0 {
+		t.Fatalf("client must not be called when an HTML file is oversize")
+	}
 }
 
-func TestPrepareHTMLPublishTarball_IgnoresOversizeNonHTML(t *testing.T) {
+func TestRunHTMLPublish_IgnoresOversizeNonHTML(t *testing.T) {
+	// 单 .html 上限调小，但超限文件是 .png → 不被本护栏拦截，正常发布。
 	orig := maxHTMLPublishSingleHTMLFileBytes
 	maxHTMLPublishSingleHTMLFileBytes = 100
 	defer func() { maxHTMLPublishSingleHTMLFileBytes = orig }()
@@ -501,12 +585,12 @@ func TestPrepareHTMLPublishTarball_IgnoresOversizeNonHTML(t *testing.T) {
 	if err := os.WriteFile(filepath.Join(dir, "big.png"), []byte(strings.Repeat("x", 4096)), 0o644); err != nil {
 		t.Fatalf("write: %v", err)
 	}
-	tarball, err := prepareHTMLPublishTarball(newTestFIO(), dir)
-	if err != nil {
+	fake := &fakeAppsHTMLPublishClient{resp: &htmlPublishResponse{URL: "https://miaoda/app_x"}}
+	if _, err := runHTMLPublish(context.Background(), newTestFIO(), fake, appsHTMLPublishSpec{AppID: "app_x", Path: dir}); err != nil {
 		t.Fatalf("non-html oversize must not be blocked by the .html cap: %v", err)
 	}
-	if tarball == nil || tarball.Size == 0 {
-		t.Fatalf("expected non-empty tarball")
+	if len(fake.calls) != 1 {
+		t.Fatalf("client should be called; calls=%v", fake.calls)
 	}
 }
 

shortcuts/apps/apps_init.go

@@ -74,18 +74,15 @@ type appTypePolicy struct {
 	// skipSkillsSync skips the conditional `npx ... skills sync --local` step on
 	// the non-empty (`app sync`) scaffold path.
 	skipSkillsSync bool
-	// skipAppSync skips `npx ... app sync` on the non-empty repo path.
-	skipAppSync bool
 }
 
 // appTypePolicies maps an app_type to its +init control strategy. Types absent
 // from the map get the zero-value policy (install runs, env is pulled, skills
 // are synced).
 var appTypePolicies = map[string]appTypePolicy{
-	// modern_html / html are static HTML sites: no dependencies to install,
-	// no startup env vars to pull, no steering skills to sync, and no app sync.
-	"modern_html": {skipInstall: true, skipEnvPull: true, skipSkillsSync: true, skipAppSync: true},
-	"html":        {skipInstall: true, skipEnvPull: true, skipSkillsSync: true, skipAppSync: true},
+	// modern_html is a static HTML site: no dependencies to install, no startup
+	// env vars to pull, and no steering skills to sync.
+	"modern_html": {skipInstall: true, skipEnvPull: true, skipSkillsSync: true},
 }
 
 // policyForAppType returns the +init control strategy for appType. Unlisted
@@ -125,13 +122,9 @@ var AppsInit = common.Shortcut{
 		{Name: "source-path", Desc: "path to existing source files (e.g. HTML output from an agent) to incorporate into the initialized project"},
 	},
 	Validate: func(ctx context.Context, rctx *common.RuntimeContext) error {
-		appID := strings.TrimSpace(rctx.Str("app-id"))
-		if appID == "" {
+		if strings.TrimSpace(rctx.Str("app-id")) == "" {
 			return appsValidationParamError("--app-id", "--app-id is required")
 		}
-		if err := validateRealAppID(appID); err != nil {
-			return err
-		}
 		if sp := strings.TrimSpace(rctx.Str("source-path")); sp != "" {
 			if err := charcheck.RejectControlChars(sp, "--source-path"); err != nil {
 				return appsValidationParamError("--source-path", "%v", err).WithCause(err)
@@ -341,19 +334,11 @@ func ensureMetaAppID(dir, appID string) error {
 // each is not already resolvable from local/global/system config, so a
 // developer's existing identity is never overwritten. Each key is handled
 // independently (a machine with only user.name set still gets a default email).
-func ensureGitIdentity(ctx context.Context, dir, authorName, authorEmail string) error {
-	name := strings.TrimSpace(authorName)
-	if name == "" {
-		name = defaultGitUserName
-	}
-	email := strings.TrimSpace(authorEmail)
-	if email == "" {
-		email = defaultGitUserEmail
-	}
-	if err := ensureGitConfigValue(ctx, dir, "user.name", name); err != nil {
+func ensureGitIdentity(ctx context.Context, dir string) error {
+	if err := ensureGitConfigValue(ctx, dir, "user.name", defaultGitUserName); err != nil {
 		return err
 	}
-	return ensureGitConfigValue(ctx, dir, "user.email", email)
+	return ensureGitConfigValue(ctx, dir, "user.email", defaultGitUserEmail)
 }
 
 // ensureGitConfigValue sets <key>=fallback in the repo-local git config when key
@@ -415,16 +400,13 @@ func runScaffold(ctx context.Context, dir, appID, appType, sourcePath string) (s
 		}
 		return scaffoldKindInit, nil
 	}
-	policy := policyForAppType(appType)
-	if !policy.skipAppSync {
-		if _, stderr, err := initRunner.Run(ctx, dir, "npx", "-y", "--prefer-online", "--registry", npmRegistry, miaodaCLIPkg, "app", "sync"); err != nil {
-			return "", appsExternalToolError(err, "npx app sync failed: %s", gitErr(stderr, err))
-		}
+	if _, stderr, err := initRunner.Run(ctx, dir, "npx", "-y", "--prefer-online", "--registry", npmRegistry, miaodaCLIPkg, "app", "sync"); err != nil {
+		return "", appsExternalToolError(err, "npx app sync failed: %s", gitErr(stderr, err))
 	}
 	if err := ensureMetaAppID(dir, appID); err != nil {
 		return "", err
 	}
-	if !policy.skipSkillsSync && !hasSteeringSkills(dir) {
+	if !policyForAppType(appType).skipSkillsSync && !hasSteeringSkills(dir) {
 		if _, stderr, err := initRunner.Run(ctx, dir, "npx", "-y", "--prefer-online", "--registry", npmRegistry, miaodaCLIPkg, "skills", "sync", "--local"); err != nil {
 			return "", appsExternalToolError(err, "npx skills sync failed: %s", gitErr(stderr, err))
 		}
@@ -454,38 +436,26 @@ func scaffoldInitArgs(appType, appID, sourcePath string) []string {
 	return base
 }
 
-// credentialInitResult holds the fields parsed from +git-credential-init output.
-type credentialInitResult struct {
-	RepositoryURL     string
-	CommitAuthorName  string
-	CommitAuthorEmail string
-}
-
-// parseCredentialInitEnvelope extracts fields from a +git-credential-init JSON
-// envelope ({"ok":true,"data":{"repository_url":"...","commit_author_name":"...","commit_author_email":"..."}}).
-func parseCredentialInitEnvelope(stdout string) (credentialInitResult, error) {
+// parseRepoURLFromEnvelope extracts data.repository_url from a lark-cli JSON
+// envelope ({"ok":true,"data":{"repository_url":"..."}}). The field name
+// matches the contract emitted by `apps +git-credential-init`.
+func parseRepoURLFromEnvelope(stdout string) (string, error) {
 	var env struct {
 		OK   bool `json:"ok"`
 		Data struct {
-			RepositoryURL     string `json:"repository_url"`
-			CommitAuthorName  string `json:"commit_author_name"`
-			CommitAuthorEmail string `json:"commit_author_email"`
+			RepositoryURL string `json:"repository_url"`
 		} `json:"data"`
 	}
 	if err := json.Unmarshal([]byte(stdout), &env); err != nil {
-		return credentialInitResult{}, appsSubprocessEnvelopeError("could not parse +git-credential-init output as JSON: %v", err)
+		return "", appsSubprocessEnvelopeError("could not parse +git-credential-init output as JSON: %v", err)
 	}
 	if !env.OK {
-		return credentialInitResult{}, appsSubprocessEnvelopeError("+git-credential-init reported failure")
+		return "", appsSubprocessEnvelopeError("+git-credential-init reported failure")
 	}
 	if strings.TrimSpace(env.Data.RepositoryURL) == "" {
-		return credentialInitResult{}, appsSubprocessEnvelopeError("+git-credential-init returned no repository_url")
+		return "", appsSubprocessEnvelopeError("+git-credential-init returned no repository_url")
 	}
-	return credentialInitResult{
-		RepositoryURL:     env.Data.RepositoryURL,
-		CommitAuthorName:  env.Data.CommitAuthorName,
-		CommitAuthorEmail: env.Data.CommitAuthorEmail,
-	}, nil
+	return env.Data.RepositoryURL, nil
 }
 
 // parseEnvFileFromEnvelope extracts data.env_file from a `+env-pull` success
@@ -557,10 +527,7 @@ func appsInitExecute(ctx context.Context, rctx *common.RuntimeContext) error {
 		return err
 	}
 
-	appType, err := queryAppType(ctx, rctx, appID)
-	if err != nil {
-		return err
-	}
+	appType := queryAppType(ctx, rctx, appID)
 	policy := policyForAppType(appType)
 
 	// Already-initialized short-circuit: a dir containing .spark/meta.json is an
@@ -628,16 +595,16 @@ func appsInitExecute(ctx context.Context, rctx *common.RuntimeContext) error {
 	}
 
 	initLogf(rctx, "Issuing repository credentials for %s...", appID)
-	cred, err := issueCredentials(ctx, rctx, appID)
+	repoURL, err := issueCredentials(ctx, rctx, appID)
 	if err != nil {
 		return err
 	}
-	if err := validateRepoURLScheme(cred.RepositoryURL); err != nil {
+	if err := validateRepoURLScheme(repoURL); err != nil {
 		return err
 	}
 
 	initLogf(rctx, "Cloning into %s...", dir)
-	if _, stderr, err := initRunner.Run(ctx, "", "git", "clone", "--", cred.RepositoryURL, dir); err != nil {
+	if _, stderr, err := initRunner.Run(ctx, "", "git", "clone", "--", repoURL, dir); err != nil {
 		return appsExternalToolError(err, "git clone failed: %s", gitErr(stderr, err))
 	}
 	initLogf(rctx, "Checking out %s...", defaultInitBranch)
@@ -645,10 +612,9 @@ func appsInitExecute(ctx context.Context, rctx *common.RuntimeContext) error {
 		return appsExternalToolError(err, "git checkout %s failed: %s", defaultInitBranch, gitErr(stderr, err))
 	}
 
-	// Ensure a committer identity exists before the scaffold commit. Uses the
-	// author name/email from +git-credential-init when available; falls back
-	// to lark-cli-bot defaults when the server does not provide them.
-	if err := ensureGitIdentity(ctx, dir, cred.CommitAuthorName, cred.CommitAuthorEmail); err != nil {
+	// Ensure a committer identity exists before the scaffold commit; only sets
+	// repo-local defaults when none is configured (existing identity is kept).
+	if err := ensureGitIdentity(ctx, dir); err != nil {
 		return err
 	}
 
@@ -677,7 +643,7 @@ func appsInitExecute(ctx context.Context, rctx *common.RuntimeContext) error {
 
 	out := map[string]interface{}{
 		"app_id":         appID,
-		"repository_url": redactURLCredentials(cred.RepositoryURL),
+		"repository_url": redactURLCredentials(repoURL),
 		"branch":         defaultInitBranch,
 		"clone_path":     dir,
 		"scaffold":       scaffold,
@@ -755,10 +721,10 @@ func pullEnv(ctx context.Context, rctx *common.RuntimeContext, appID, dir string
 
 // issueCredentials runs `<self> apps +git-credential-init --app-id <id> --format json`
 // and returns the repo_url it reports. Forwards --as when set.
-func issueCredentials(ctx context.Context, rctx *common.RuntimeContext, appID string) (credentialInitResult, error) {
+func issueCredentials(ctx context.Context, rctx *common.RuntimeContext, appID string) (string, error) {
 	self, err := os.Executable()
 	if err != nil {
-		return credentialInitResult{}, errs.NewInternalError(errs.SubtypeUnknown, "cannot locate lark-cli executable: %v", err).WithCause(err)
+		return "", errs.NewInternalError(errs.SubtypeUnknown, "cannot locate lark-cli executable: %v", err).WithCause(err)
 	}
 	args := []string{"apps", "+git-credential-init", "--app-id", appID, "--format", "json"}
 	if as := strings.TrimSpace(rctx.Str("as")); as != "" {
@@ -766,11 +732,11 @@ func issueCredentials(ctx context.Context, rctx *common.RuntimeContext, appID st
 	}
 	stdout, stderr, err := initRunner.Run(ctx, "", self, args...)
 	if err != nil {
-		return credentialInitResult{}, appsExternalToolError(err, "apps +git-credential-init failed: %s", gitErr(stderr, err)).
+		return "", appsExternalToolError(err, "apps +git-credential-init failed: %s", gitErr(stderr, err)).
 			WithHint("ensure apps +git-credential-init is available and you are logged in").
 			WithCause(err)
 	}
-	return parseCredentialInitEnvelope(stdout)
+	return parseRepoURLFromEnvelope(stdout)
 }
 
 // commitAndPushIfDirty commits and pushes only when the working tree has

shortcuts/apps/apps_init_test.go

@@ -21,7 +21,6 @@ import (
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/httpmock"
-	"github.com/larksuite/cli/internal/testutil/gitcmd"
 	"github.com/larksuite/cli/shortcuts/common"
 )
 
@@ -111,24 +110,18 @@ func TestDefaultCloneDir(t *testing.T) {
 // --- pure-function tests ---
 
 func TestParseRepoURL(t *testing.T) {
-	result, err := parseCredentialInitEnvelope(`{"ok":true,"data":{"repository_url":"http://u:t@h/app_x.git","commit_author_name":"Alice","commit_author_email":"alice@example.com"}}`)
+	url, err := parseRepoURLFromEnvelope(`{"ok":true,"data":{"repository_url":"http://u:t@h/app_x.git"}}`)
 	if err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
-	if result.RepositoryURL != "http://u:t@h/app_x.git" {
-		t.Errorf("RepositoryURL got %q", result.RepositoryURL)
-	}
-	if result.CommitAuthorName != "Alice" {
-		t.Errorf("CommitAuthorName got %q", result.CommitAuthorName)
-	}
-	if result.CommitAuthorEmail != "alice@example.com" {
-		t.Errorf("CommitAuthorEmail got %q", result.CommitAuthorEmail)
+	if url != "http://u:t@h/app_x.git" {
+		t.Errorf("got %q", url)
 	}
 }
 
 func TestParseRepoURL_Errors(t *testing.T) {
 	for _, in := range []string{`not json`, `{"ok":false,"data":{}}`, `{"ok":true,"data":{}}`, `{"ok":true,"data":{"repository_url":""}}`} {
-		if _, err := parseCredentialInitEnvelope(in); err == nil {
+		if _, err := parseRepoURLFromEnvelope(in); err == nil {
 			t.Errorf("expected error for %q", in)
 		}
 	}
@@ -156,22 +149,6 @@ func withFakeRunner(t *testing.T, f *fakeCommandRunner) {
 	t.Cleanup(func() { initRunner = orig })
 }
 
-func stubAppType(reg *httpmock.Registry, appID, appType string) {
-	reg.Register(&httpmock.Stub{
-		Method: "GET",
-		URL:    "/open-apis/spark/v1/apps/" + appID,
-		Body: map[string]interface{}{
-			"code": float64(0),
-			"data": map[string]interface{}{
-				"app": map[string]interface{}{
-					"app_id":   appID,
-					"app_type": appType,
-				},
-			},
-		},
-	})
-}
-
 func credInitOK(repoURL string) fakeCallResult {
 	return fakeCallResult{stdout: `{"ok":true,"data":{"repository_url":"` + repoURL + `"}}`}
 }
@@ -336,8 +313,7 @@ func TestAppsInit_EmptyRepo_EndToEnd(t *testing.T) {
 		"git status":      {stdout: " M src/app.ts\n"}, // scaffold produced changes
 	}}
 	withFakeRunner(t, f)
-	factory, stdout, reg := newAppsExecuteFactory(t)
-	stubAppType(reg, "app_x", "FULL_STACK")
+	factory, stdout, _ := newAppsExecuteFactory(t)
 	dir := relCloneDir(t)
 	if err := runAppsShortcut(t, AppsInit, []string{"+init", "--app-id", "app_x", "--dir", dir, "--as", "user"}, factory, stdout); err != nil {
 		t.Fatalf("unexpected: %v", err)
@@ -378,8 +354,7 @@ func TestAppsInit_AlreadyInitialized_ShortCircuit(t *testing.T) {
 	}
 	f := &fakeCommandRunner{results: map[string]fakeCallResult{"env-pull": envPullOK(filepath.Join(abs, ".env.local"))}}
 	withFakeRunner(t, f)
-	factory, stdout, reg := newAppsExecuteFactory(t)
-	stubAppType(reg, "app_x", "FULL_STACK")
+	factory, stdout, _ := newAppsExecuteFactory(t)
 	if err := runAppsShortcut(t, AppsInit, []string{"+init", "--app-id", "app_x", "--dir", dir, "--as", "user"}, factory, stdout); err != nil {
 		t.Fatalf("unexpected: %v", err)
 	}
@@ -448,8 +423,7 @@ func TestAppsInit_HappyPathCleanTree(t *testing.T) {
 		"git status":      {},           // clean tree after scaffold -> no commit/push
 	}}
 	withFakeRunner(t, f)
-	factory, stdout, reg := newAppsExecuteFactory(t)
-	stubAppType(reg, "app_x", "FULL_STACK")
+	factory, stdout, _ := newAppsExecuteFactory(t)
 	dir := relCloneDir(t)
 
 	err := runAppsShortcut(t, AppsInit, []string{"+init", "--app-id", "app_x", "--dir", dir, "--as", "user"}, factory, stdout)
@@ -498,8 +472,7 @@ func TestAppsInit_DirtyTreeCommitPush(t *testing.T) {
 		"git status":      {stdout: " M file.txt"},
 	}}
 	withFakeRunner(t, f)
-	factory, stdout, reg := newAppsExecuteFactory(t)
-	stubAppType(reg, "app_x", "FULL_STACK")
+	factory, stdout, _ := newAppsExecuteFactory(t)
 	dir := relCloneDir(t)
 
 	err := runAppsShortcut(t, AppsInit, []string{"+init", "--app-id", "app_x", "--dir", dir, "--as", "user"}, factory, stdout)
@@ -569,8 +542,7 @@ func TestAppsInit_CloneFailure(t *testing.T) {
 		"git clone":       {stderr: "fatal: unable to access 'http://u:t@h/r.git'", err: errors.New("exit 128")},
 	}}
 	withFakeRunner(t, f)
-	factory, stdout, reg := newAppsExecuteFactory(t)
-	stubAppType(reg, "app_x", "FULL_STACK")
+	factory, stdout, _ := newAppsExecuteFactory(t)
 	dir := relCloneDir(t)
 
 	err := runAppsShortcut(t, AppsInit, []string{"+init", "--app-id", "app_x", "--dir", dir, "--as", "user"}, factory, stdout)
@@ -644,8 +616,7 @@ func TestAppsInit_AsPassthrough(t *testing.T) {
 		"git status":      {},
 	}}
 	withFakeRunner(t, f)
-	factory, stdout, reg := newAppsExecuteFactory(t)
-	stubAppType(reg, "app_x", "FULL_STACK")
+	factory, stdout, _ := newAppsExecuteFactory(t)
 	dir := relCloneDir(t)
 
 	// AppsInit.AuthTypes is ["user"], so the framework rejects --as bot. Use
@@ -751,7 +722,7 @@ func TestIsEmptyRepo(t *testing.T) {
 // newAppsExecuteFactoryWithStderr mirrors newAppsExecuteFactory but also returns
 // the stderr buffer, so tests can assert on the +init progress log lines that
 // initLogf writes to IO().ErrOut.
-func newAppsExecuteFactoryWithStderr(t *testing.T) (*cmdutil.Factory, *bytes.Buffer, *bytes.Buffer, *httpmock.Registry) {
+func newAppsExecuteFactoryWithStderr(t *testing.T) (*cmdutil.Factory, *bytes.Buffer, *bytes.Buffer) {
 	t.Helper()
 	t.Setenv("HOME", t.TempDir())
 	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
@@ -761,12 +732,12 @@ func newAppsExecuteFactoryWithStderr(t *testing.T) (*cmdutil.Factory, *bytes.Buf
 		Brand:      core.BrandFeishu,
 		UserOpenId: "ou_test",
 	}
-	factory, stdout, stderr, reg := cmdutil.TestFactory(t, cfg)
-	return factory, stdout, stderr, reg
+	factory, stdout, stderr, _ := cmdutil.TestFactory(t, cfg)
+	return factory, stdout, stderr
 }
 
 func TestAppsInit_Req1_Wording(t *testing.T) {
-	factory, stdout, _, _ := newAppsExecuteFactoryWithStderr(t)
+	factory, stdout, _ := newAppsExecuteFactoryWithStderr(t)
 	if err := runAppsShortcut(t, AppsInit, []string{"+init", "--app-id", "app_x", "--as", "user", "--dry-run"}, factory, stdout); err != nil {
 		t.Fatalf("dry-run err=%v", err)
 	}
@@ -795,8 +766,7 @@ func TestAppsInit_Req1_Wording(t *testing.T) {
 		"git status":      {},
 	}}
 	withFakeRunner(t, f)
-	factory2, stdout2, stderr2, reg2 := newAppsExecuteFactoryWithStderr(t)
-	stubAppType(reg2, "app_x", "FULL_STACK")
+	factory2, stdout2, stderr2 := newAppsExecuteFactoryWithStderr(t)
 	dir := relCloneDir(t)
 	if err := runAppsShortcut(t, AppsInit, []string{"+init", "--app-id", "app_x", "--dir", dir, "--as", "user"}, factory2, stdout2); err != nil {
 		t.Fatalf("run err=%v", err)
@@ -859,8 +829,7 @@ func TestAppsInit_EmptyRepo_TwoCommits(t *testing.T) {
 		"git status":      {stdout: " A src/app.ts\n A .spark/meta.json\n A .agent/skills/steering/x.md\n"},
 	}}
 	withFakeRunner(t, f)
-	factory, stdout, reg := newAppsExecuteFactory(t)
-	stubAppType(reg, "app_x", "FULL_STACK")
+	factory, stdout, _ := newAppsExecuteFactory(t)
 	dir := relCloneDir(t)
 	if err := runAppsShortcut(t, AppsInit, []string{"+init", "--app-id", "app_x", "--dir", dir, "--as", "user"}, factory, stdout); err != nil {
 		t.Fatalf("unexpected: %v", err)
@@ -901,8 +870,7 @@ func TestAppsInit_EmptyRepo_AppCodeOnly_SingleCommit(t *testing.T) {
 		"git status":      {stdout: " A src/app.ts\n"},
 	}}
 	withFakeRunner(t, f)
-	factory, stdout, reg := newAppsExecuteFactory(t)
-	stubAppType(reg, "app_x", "FULL_STACK")
+	factory, stdout, _ := newAppsExecuteFactory(t)
 	dir := relCloneDir(t)
 	if err := runAppsShortcut(t, AppsInit, []string{"+init", "--app-id", "app_x", "--dir", dir, "--as", "user"}, factory, stdout); err != nil {
 		t.Fatalf("unexpected: %v", err)
@@ -922,8 +890,7 @@ func TestAppsInit_EmptyRepo_ConfigOnly_SingleCommit(t *testing.T) {
 		"git status":      {stdout: " A .spark/meta.json\n"},
 	}}
 	withFakeRunner(t, f)
-	factory, stdout, reg := newAppsExecuteFactory(t)
-	stubAppType(reg, "app_x", "FULL_STACK")
+	factory, stdout, _ := newAppsExecuteFactory(t)
 	dir := relCloneDir(t)
 	if err := runAppsShortcut(t, AppsInit, []string{"+init", "--app-id", "app_x", "--dir", dir, "--as", "user"}, factory, stdout); err != nil {
 		t.Fatalf("unexpected: %v", err)
@@ -943,8 +910,7 @@ func TestAppsInit_NonEmpty_SingleInitCommit(t *testing.T) {
 		"git status":      {stdout: " M file.txt\n M .spark/meta.json\n"},
 	}}
 	withFakeRunner(t, f)
-	factory, stdout, reg := newAppsExecuteFactory(t)
-	stubAppType(reg, "app_x", "FULL_STACK")
+	factory, stdout, _ := newAppsExecuteFactory(t)
 	dir := relCloneDir(t)
 	if err := runAppsShortcut(t, AppsInit, []string{"+init", "--app-id", "app_x", "--dir", dir, "--as", "user"}, factory, stdout); err != nil {
 		t.Fatalf("unexpected: %v", err)
@@ -963,7 +929,8 @@ func TestAppsInit_NonEmpty_SingleInitCommit(t *testing.T) {
 // gitMust runs a git command in dir with a real binary, failing the test on error.
 func gitMust(t *testing.T, dir string, args ...string) string {
 	t.Helper()
-	cmd := gitcmd.Command(dir, args...)
+	cmd := exec.Command("git", args...)
+	cmd.Dir = dir
 	out, err := cmd.CombinedOutput()
 	if err != nil {
 		t.Fatalf("git %v in %s failed: %v\n%s", args, dir, err, out)
@@ -979,7 +946,6 @@ func TestCommitAndPushIfDirty_RealGit_IgnoredAgentDir(t *testing.T) {
 	if _, err := exec.LookPath("git"); err != nil {
 		t.Skip("git not available")
 	}
-	gitcmd.SetSynchronousMaintenanceEnv(t)
 	// Bare remote so `git push origin sprint/default` succeeds.
 	remote := t.TempDir()
 	gitMust(t, remote, "init", "--bare", "-q", "--initial-branch", defaultInitBranch)
@@ -1101,7 +1067,6 @@ func TestCommitAndPushIfDirty_RealGit_NonEmptyUpgrade(t *testing.T) {
 	if _, err := exec.LookPath("git"); err != nil {
 		t.Skip("git not available")
 	}
-	gitcmd.SetSynchronousMaintenanceEnv(t)
 	remote := t.TempDir()
 	gitMust(t, remote, "init", "--bare", "-q", "--initial-branch", defaultInitBranch)
 
@@ -1324,8 +1289,7 @@ func TestAppsInit_EnvPull_Success(t *testing.T) {
 		"env-pull":        envPullOK("/abs/app_x/.env.local"),
 	}}
 	withFakeRunner(t, f)
-	factory, stdout, reg := newAppsExecuteFactory(t)
-	stubAppType(reg, "app_x", "FULL_STACK")
+	factory, stdout, _ := newAppsExecuteFactory(t)
 	dir := relCloneDir(t)
 	if err := runAppsShortcut(t, AppsInit, []string{"+init", "--app-id", "app_x", "--dir", dir, "--as", "user"}, factory, stdout); err != nil {
 		t.Fatalf("unexpected error: %v", err)
@@ -1363,8 +1327,7 @@ func TestAppsInit_EnvPull_NonFatal(t *testing.T) {
 		},
 	}}
 	withFakeRunner(t, f)
-	factory, stdout, reg := newAppsExecuteFactory(t)
-	stubAppType(reg, "app_x", "FULL_STACK")
+	factory, stdout, _ := newAppsExecuteFactory(t)
 	dir := relCloneDir(t)
 	if err := runAppsShortcut(t, AppsInit, []string{"+init", "--app-id", "app_x", "--dir", dir, "--as", "user"}, factory, stdout); err != nil {
 		t.Fatalf("env-pull failure must be non-fatal, got: %v", err)
@@ -1403,8 +1366,7 @@ func TestAppsInit_AlreadyInitialized_RunsEnvPull(t *testing.T) {
 	envFile := filepath.Join(abs, ".env.local")
 	f := &fakeCommandRunner{results: map[string]fakeCallResult{"env-pull": envPullOK(envFile)}}
 	withFakeRunner(t, f)
-	factory, stdout, reg := newAppsExecuteFactory(t)
-	stubAppType(reg, "app_x", "FULL_STACK")
+	factory, stdout, _ := newAppsExecuteFactory(t)
 	if err := runAppsShortcut(t, AppsInit, []string{"+init", "--app-id", "app_x", "--dir", dir, "--as", "user"}, factory, stdout); err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
@@ -1451,8 +1413,7 @@ func TestAppsInit_AlreadyInitialized_EnvPullFailure_NonFatal(t *testing.T) {
 		},
 	}}
 	withFakeRunner(t, f)
-	factory, stdout, reg := newAppsExecuteFactory(t)
-	stubAppType(reg, "app_x", "FULL_STACK")
+	factory, stdout, _ := newAppsExecuteFactory(t)
 	if err := runAppsShortcut(t, AppsInit, []string{"+init", "--app-id", "app_x", "--dir", dir, "--as", "user"}, factory, stdout); err != nil {
 		t.Fatalf("env-pull failure must be non-fatal, got: %v", err)
 	}
@@ -1744,15 +1705,13 @@ func TestScaffoldInitArgs_WithAppType(t *testing.T) {
 }
 
 func TestPolicyForAppType(t *testing.T) {
-	// modern_html and html decouple all control points: skip install, env-pull, skills sync, app sync.
-	for _, at := range []string{"modern_html", "html"} {
-		if p := policyForAppType(at); !p.skipInstall || !p.skipEnvPull || !p.skipSkillsSync || !p.skipAppSync {
-			t.Errorf("%s policy = %+v, want all skip flags set", at, p)
-		}
+	// modern_html decouples all control points: skip install, env-pull, skills sync.
+	if p := policyForAppType("modern_html"); !p.skipInstall || !p.skipEnvPull || !p.skipSkillsSync {
+		t.Errorf("modern_html policy = %+v, want all skip flags set", p)
 	}
 	// Unlisted types (including "") get the zero-value policy: everything runs.
 	for _, at := range []string{"full_stack", "", "backend"} {
-		if p := policyForAppType(at); p.skipInstall || p.skipEnvPull || p.skipSkillsSync || p.skipAppSync {
+		if p := policyForAppType(at); p.skipInstall || p.skipEnvPull || p.skipSkillsSync {
 			t.Errorf("policy for %q = %+v, want zero value", at, p)
 		}
 	}
@@ -1798,7 +1757,7 @@ func configSetValue(calls [][]string, key string) (string, bool) {
 func TestEnsureGitIdentity_SetsDefaultsWhenUnset(t *testing.T) {
 	f := &fakeCommandRunner{} // no "git config" result → `--get` returns empty stdout
 	withFakeRunner(t, f)
-	if err := ensureGitIdentity(context.Background(), "/repo", "", ""); err != nil {
+	if err := ensureGitIdentity(context.Background(), "/repo"); err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
 	if v, ok := configSetValue(f.calls, "user.name"); !ok || v != defaultGitUserName {
@@ -1815,7 +1774,7 @@ func TestEnsureGitIdentity_RespectsExisting(t *testing.T) {
 		"git config": {stdout: "Existing Dev\n"},
 	}}
 	withFakeRunner(t, f)
-	if err := ensureGitIdentity(context.Background(), "/repo", "", ""); err != nil {
+	if err := ensureGitIdentity(context.Background(), "/repo"); err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
 	if _, ok := configSetValue(f.calls, "user.name"); ok {
@@ -1831,7 +1790,7 @@ func TestEnsureGitIdentity_SetFailurePropagates(t *testing.T) {
 		"git config": {stderr: "boom", err: errors.New("exit 1")},
 	}}
 	withFakeRunner(t, f)
-	if err := ensureGitIdentity(context.Background(), "/repo", "", ""); err == nil {
+	if err := ensureGitIdentity(context.Background(), "/repo"); err == nil {
 		t.Error("expected error when git config set fails")
 	}
 }

shortcuts/apps/apps_meta.go

@@ -13,25 +13,22 @@ import (
 )
 
 // queryAppType fetches the app's type string from the server via
-// GET /open-apis/spark/v1/apps/{identifier}. The identifier can be either
-// an app_id or a meta_token — the server resolves both. The server returns
-// uppercase app_type values ("HTML", "FULL_STACK", "MODERN_HTML");
-// this function normalizes to lowercase. Returns an error when the API
-// is unavailable or the response is malformed — callers must not proceed
-// with a fallback type to avoid creating the wrong project scaffold.
-func queryAppType(ctx context.Context, rctx *common.RuntimeContext, identifier string) (string, error) {
-	path := fmt.Sprintf("%s/apps/%s", apiBasePath, validate.EncodePathSegment(identifier))
+// GET /open-apis/spark/v1/apps/{appID}. The server returns uppercase
+// values ("HTML", "FULL_STACK", "MODERN_HTML"); this function normalizes
+// to lowercase. Returns "" when the API is unavailable or returns an
+// error — callers fall back to legacy behavior.
+func queryAppType(ctx context.Context, rctx *common.RuntimeContext, appID string) string {
+	path := fmt.Sprintf("%s/apps/%s", apiBasePath, validate.EncodePathSegment(appID))
 	data, err := rctx.CallAPITyped("GET", path, nil, nil)
 	if err != nil {
-		return "", err
+		fmt.Fprintf(rctx.IO().ErrOut, "→ Could not query app type: %v\n", err)
+		return ""
 	}
 	appRaw, _ := data["app"].(map[string]interface{})
 	if appRaw == nil {
-		return "", appsSubprocessEnvelopeError("query app type: response missing app object")
+		fmt.Fprintf(rctx.IO().ErrOut, "→ Could not query app type: response missing app object\n")
+		return ""
 	}
 	appType, _ := appRaw["app_type"].(string)
-	if strings.TrimSpace(appType) == "" {
-		return "", appsSubprocessEnvelopeError("query app type: response missing app_type")
-	}
-	return strings.ToLower(appType), nil
+	return strings.ToLower(appType)
 }

shortcuts/apps/apps_meta_test.go

@@ -43,10 +43,7 @@ func TestQueryAppType_Success(t *testing.T) {
 		},
 	})
 
-	result, err := queryAppType(context.Background(), rt, "app_test")
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
+	result := queryAppType(context.Background(), rt, "app_test")
 	if result != "modern_html" {
 		t.Errorf("queryAppType = %q, want modern_html", result)
 	}
@@ -68,10 +65,7 @@ func TestQueryAppType_FullStack(t *testing.T) {
 		},
 	})
 
-	result, err := queryAppType(context.Background(), rt, "app_fs")
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
+	result := queryAppType(context.Background(), rt, "app_fs")
 	if result != "full_stack" {
 		t.Errorf("queryAppType = %q, want full_stack", result)
 	}
@@ -93,10 +87,7 @@ func TestQueryAppType_Html(t *testing.T) {
 		},
 	})
 
-	result, err := queryAppType(context.Background(), rt, "app_html")
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
+	result := queryAppType(context.Background(), rt, "app_html")
 	if result != "html" {
 		t.Errorf("queryAppType = %q, want html", result)
 	}
@@ -111,9 +102,9 @@ func TestQueryAppType_APIError(t *testing.T) {
 		Body:   map[string]interface{}{"code": float64(99999), "msg": "internal error"},
 	})
 
-	_, err := queryAppType(context.Background(), rt, "app_bad")
-	if err == nil {
-		t.Error("expected error on API failure")
+	result := queryAppType(context.Background(), rt, "app_bad")
+	if result != "" {
+		t.Errorf("queryAppType = %q, want empty on error", result)
 	}
 }
 
@@ -128,9 +119,9 @@ func TestQueryAppType_MissingAppObject(t *testing.T) {
 		},
 	})
 
-	_, err := queryAppType(context.Background(), rt, "app_no")
-	if err == nil {
-		t.Error("expected error when app object missing")
+	result := queryAppType(context.Background(), rt, "app_no")
+	if result != "" {
+		t.Errorf("queryAppType = %q, want empty when app object missing", result)
 	}
 }
 
@@ -150,8 +141,8 @@ func TestQueryAppType_EmptyAppType(t *testing.T) {
 		},
 	})
 
-	_, err := queryAppType(context.Background(), rt, "app_empty")
-	if err == nil {
-		t.Error("expected error when app_type is empty")
+	result := queryAppType(context.Background(), rt, "app_empty")
+	if result != "" {
+		t.Errorf("queryAppType = %q, want empty when app_type is empty", result)
 	}
 }

shortcuts/apps/apps_release_create.go

@@ -31,13 +31,9 @@ var AppsReleaseCreate = common.Shortcut{
 		{Name: "branch", Desc: "release branch (server uses default if omitted)"},
 	},
 	Validate: func(ctx context.Context, rctx *common.RuntimeContext) error {
-		appID := strings.TrimSpace(rctx.Str("app-id"))
-		if appID == "" {
+		if strings.TrimSpace(rctx.Str("app-id")) == "" {
 			return appsValidationParamError("--app-id", "--app-id is required")
 		}
-		if err := validateRealAppID(appID); err != nil {
-			return err
-		}
 		return nil
 	},
 	DryRun: func(ctx context.Context, rctx *common.RuntimeContext) *common.DryRunAPI {

shortcuts/apps/apps_release_get.go

@@ -30,13 +30,9 @@ var AppsReleaseGet = common.Shortcut{
 		{Name: "release-id", Desc: "release ID (the release_id returned by +release-create)", Required: true},
 	},
 	Validate: func(ctx context.Context, rctx *common.RuntimeContext) error {
-		appID := strings.TrimSpace(rctx.Str("app-id"))
-		if appID == "" {
+		if strings.TrimSpace(rctx.Str("app-id")) == "" {
 			return appsValidationParamError("--app-id", "--app-id is required")
 		}
-		if err := validateRealAppID(appID); err != nil {
-			return err
-		}
 		if strings.TrimSpace(rctx.Str("release-id")) == "" {
 			return appsValidationParamError("--release-id", "--release-id is required")
 		}

shortcuts/apps/apps_role.go

@@ -1,744 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package apps
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"io"
-	"math"
-	"strconv"
-	"strings"
-	"text/tabwriter"
-
-	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/validate"
-	"github.com/larksuite/cli/shortcuts/common"
-)
-
-const maxRoleListScanPages = 1000
-
-// AppsRoleList lists app roles.
-var AppsRoleList = common.Shortcut{
-	Service:     appsService,
-	Command:     "+role-list",
-	Description: "List app roles",
-	Risk:        "read",
-	Tips: []string{
-		"Example: lark-cli apps +role-list --app-id <app_id>",
-		"Example: lark-cli apps +role-list --app-id <app_id> --name Admin --page-size 20",
-		"When only a role name is known, pass --name for exact matching; call +role-get only after resolving one unique role_id",
-		"With --name, the CLI scans server pages in batches of 100, then applies --page-size and --page-token to the exact local matches",
-	},
-	Scopes:    []string{"spark:app:read"},
-	AuthTypes: []string{"user"},
-	HasFormat: true,
-	Flags: []common.Flag{
-		{Name: "app-id", Desc: roleAppIDRequiredDesc, Required: true},
-		{Name: "name", Desc: "filter roles by exact name"},
-		{Name: "page-size", Type: "int", Default: "20", Desc: "page size (1-100)"},
-		{Name: "page-token", Desc: "integer offset returned by the previous role-list response"},
-	},
-	Validate: func(ctx context.Context, rctx *common.RuntimeContext) error {
-		if err := validateRoleAppID(rctx); err != nil {
-			return err
-		}
-		_, err := buildRoleListParams(rctx)
-		return err
-	},
-	DryRun: func(ctx context.Context, rctx *common.RuntimeContext) *common.DryRunAPI {
-		// Validate already ran and called buildRoleListParams; error is impossible here.
-		params, _ := buildRoleListParams(rctx)
-		params = roleListRequestParams(params, 0)
-		return common.NewDryRunAPI().
-			GET(roleListURL(rctx)).
-			Desc("List app roles").
-			Params(params)
-	},
-	Execute: func(ctx context.Context, rctx *common.RuntimeContext) error {
-		params, err := buildRoleListParams(rctx)
-		if err != nil {
-			return err
-		}
-		data, err := executeRoleList(rctx, params)
-		if err != nil {
-			return withRoleErrorHint(err, roleOperationList)
-		}
-		rctx.OutFormat(data, nil, func(w io.Writer) {
-			renderRoleListPretty(w, common.GetSlice(data, "items"))
-		})
-		return nil
-	},
-}
-
-// AppsRoleGet gets one app role.
-var AppsRoleGet = common.Shortcut{
-	Service:     appsService,
-	Command:     "+role-get",
-	Description: "Get an app role",
-	Risk:        "read",
-	Tips: []string{
-		"Example: lark-cli apps +role-get --app-id <app_id> --role-id <role_id>",
-		"--role-id is not a human-readable role name; if only a name is known, run +role-list --name <exact_name> and use its unique returned role_id before calling +role-get",
-	},
-	Scopes:    []string{"spark:app:read"},
-	AuthTypes: []string{"user"},
-	HasFormat: true,
-	Flags: []common.Flag{
-		{Name: "app-id", Desc: roleAppIDRequiredDesc, Required: true},
-		{Name: "role-id", Desc: roleIDRequiredDesc, Required: true},
-	},
-	Validate: func(ctx context.Context, rctx *common.RuntimeContext) error {
-		return validateRoleID(rctx)
-	},
-	DryRun: func(ctx context.Context, rctx *common.RuntimeContext) *common.DryRunAPI {
-		return common.NewDryRunAPI().
-			GET(roleItemURL(rctx)).
-			Desc("Get app role")
-	},
-	Execute: func(ctx context.Context, rctx *common.RuntimeContext) error {
-		data, err := rctx.CallAPITyped("GET", roleItemURL(rctx), nil, nil)
-		if err != nil {
-			return withRoleErrorHint(err, roleOperationGet)
-		}
-		role, err := parseRoleDetailResponseData(data, roleID(rctx))
-		if err != nil {
-			return err
-		}
-		rctx.OutFormat(data, nil, func(w io.Writer) {
-			renderRoleGetPretty(w, role)
-		})
-		return nil
-	},
-}
-
-// AppsRoleCreate creates an app role.
-var AppsRoleCreate = common.Shortcut{
-	Service:     appsService,
-	Command:     "+role-create",
-	Description: "Create an app role",
-	Risk:        "write",
-	Tips: []string{
-		"Example: lark-cli apps +role-create --app-id <app_id> --name Admin",
-		"Example: lark-cli apps +role-create --app-id <app_id> --name Admin --description 'Can manage orders'",
-		"Example: lark-cli apps +role-create --app-id <app_id> --name Admin --role-id role_admin",
-		"The create response returns data.role; run +role-get with data.role.role_id only when independent verification is required",
-	},
-	Scopes:    []string{"spark:app:write"},
-	AuthTypes: []string{"user"},
-	HasFormat: true,
-	Flags: []common.Flag{
-		{Name: "app-id", Desc: roleAppIDRequiredDesc, Required: true},
-		// Keep --name in Validate so the CLI can return the command-specific
-		// non-invention hint instead of Cobra's generic required-flag error.
-		{Name: "name", Desc: "role name (required)"},
-		{Name: "description", Desc: "role description"},
-		{Name: "role-id", Desc: "optional caller-provided role ID ([A-Za-z0-9_-]{1,64})"},
-	},
-	Validate: func(ctx context.Context, rctx *common.RuntimeContext) error {
-		if err := validateRoleAppID(rctx); err != nil {
-			return err
-		}
-		if strings.TrimSpace(rctx.Str("name")) == "" {
-			return appsValidationParamError("--name", "--name is required").
-				WithHint("ask for the intended role name and pass it with --name; do not infer a name from --description")
-		}
-		if rctx.Changed("role-id") {
-			roleID := strings.TrimSpace(rctx.Str("role-id"))
-			if roleID == "" {
-				return appsValidationParamError("--role-id", "--role-id must not be empty when provided")
-			}
-			return validateOptionalRoleID(roleID)
-		}
-		return nil
-	},
-	DryRun: func(ctx context.Context, rctx *common.RuntimeContext) *common.DryRunAPI {
-		return common.NewDryRunAPI().
-			POST(roleListURL(rctx)).
-			Desc("Create app role").
-			Body(buildRoleCreateBody(rctx))
-	},
-	Execute: func(ctx context.Context, rctx *common.RuntimeContext) error {
-		data, err := rctx.CallAPITyped("POST", roleListURL(rctx), nil, buildRoleCreateBody(rctx))
-		if err != nil {
-			return withRoleErrorHint(err, roleOperationCreate)
-		}
-		expectedRoleID := ""
-		if rctx.Changed("role-id") {
-			expectedRoleID = roleID(rctx)
-		}
-		role, err := parseRoleWriteResponseData(data, expectedRoleID)
-		if err != nil {
-			return err
-		}
-		rctx.OutFormat(data, nil, func(w io.Writer) {
-			renderRoleCreatePretty(w, role)
-		})
-		return nil
-	},
-}
-
-// AppsRoleUpdate updates an app role.
-var AppsRoleUpdate = common.Shortcut{
-	Service:     appsService,
-	Command:     "+role-update",
-	Description: "Update an app role",
-	Risk:        "write",
-	Tips: []string{
-		"Example: lark-cli apps +role-update --app-id <app_id> --role-id <role_id> --name Operator",
-	},
-	Scopes:    []string{"spark:app:write"},
-	AuthTypes: []string{"user"},
-	HasFormat: true,
-	Flags: []common.Flag{
-		{Name: "app-id", Desc: roleAppIDRequiredDesc, Required: true},
-		{Name: "role-id", Desc: roleIDRequiredDesc, Required: true},
-		{Name: "name", Desc: "new role name"},
-		{Name: "description", Desc: "new role description"},
-	},
-	Validate: func(ctx context.Context, rctx *common.RuntimeContext) error {
-		if err := validateRoleID(rctx); err != nil {
-			return err
-		}
-		if rctx.Changed("name") && strings.TrimSpace(rctx.Str("name")) == "" {
-			return appsValidationParamError("--name", "--name must not be empty when provided").
-				WithHint("omit --name if only updating --description")
-		}
-		if !rctx.Changed("name") && !rctx.Changed("description") {
-			reason := "provide at least one of --name or --description"
-			return appsValidationError("at least one of --name or --description is required").
-				WithParams(
-					appsInvalidParam("--name", reason),
-					appsInvalidParam("--description", reason),
-				).
-				WithHint("provide --name, --description, or both")
-		}
-		return nil
-	},
-	DryRun: func(ctx context.Context, rctx *common.RuntimeContext) *common.DryRunAPI {
-		return common.NewDryRunAPI().
-			PATCH(roleItemURL(rctx)).
-			Desc("Update app role").
-			Body(buildRoleUpdateBody(rctx))
-	},
-	Execute: func(ctx context.Context, rctx *common.RuntimeContext) error {
-		data, err := rctx.CallAPITyped("PATCH", roleItemURL(rctx), nil, buildRoleUpdateBody(rctx))
-		if err != nil {
-			return withRoleErrorHint(err, roleOperationUpdate)
-		}
-		role, err := parseRoleWriteResponseData(data, roleID(rctx))
-		if err != nil {
-			return err
-		}
-		rctx.OutFormat(data, nil, func(w io.Writer) {
-			renderRoleUpdatePretty(w, role)
-		})
-		return nil
-	},
-}
-
-// AppsRoleDelete deletes an app role.
-var AppsRoleDelete = common.Shortcut{
-	Service:     appsService,
-	Command:     "+role-delete",
-	Description: "Delete an app role",
-	Risk:        "high-risk-write",
-	Tips: []string{
-		"Example: lark-cli apps +role-delete --app-id <app_id> --role-id <role_id> --yes",
-		"A delete request alone is not explicit confirmation: first show the exact app, role, current member scope, and irreversible impact; use --yes only after the user confirms that impact",
-		"When independent verification is required, use +role-list --name <exact_name> and confirm the deleted role_id is absent; a failed +role-get alone does not prove deletion",
-	},
-	Scopes:    []string{"spark:app:write"},
-	AuthTypes: []string{"user"},
-	HasFormat: true,
-	Flags: []common.Flag{
-		{Name: "app-id", Desc: roleAppIDRequiredDesc, Required: true},
-		{Name: "role-id", Desc: roleIDRequiredDesc, Required: true},
-	},
-	Validate: func(ctx context.Context, rctx *common.RuntimeContext) error {
-		return validateRoleID(rctx)
-	},
-	DryRun: func(ctx context.Context, rctx *common.RuntimeContext) *common.DryRunAPI {
-		return common.NewDryRunAPI().
-			DELETE(roleItemURL(rctx)).
-			Desc("Delete app role")
-	},
-	Execute: func(ctx context.Context, rctx *common.RuntimeContext) error {
-		data, err := rctx.CallAPITyped("DELETE", roleItemURL(rctx), nil, nil)
-		if err != nil {
-			return withRoleErrorHint(err, roleOperationDelete)
-		}
-		deletedRoleID := roleID(rctx)
-		out, err := normalizeRoleDeleteData(data, deletedRoleID)
-		if err != nil {
-			return err
-		}
-		rctx.OutFormat(out, nil, func(w io.Writer) {
-			renderRoleDeletePretty(w, common.GetString(out, "role_id"))
-		})
-		return nil
-	},
-}
-
-func roleListURL(rctx *common.RuntimeContext) string {
-	appID := roleAppID(rctx)
-	return fmt.Sprintf(roleListPath, validate.EncodePathSegment(appID))
-}
-
-func roleItemURL(rctx *common.RuntimeContext) string {
-	appID := roleAppID(rctx)
-	roleID := roleID(rctx)
-	return fmt.Sprintf(roleItemPath, validate.EncodePathSegment(appID), validate.EncodePathSegment(roleID))
-}
-
-func buildRoleListParams(rctx *common.RuntimeContext) (map[string]interface{}, error) {
-	params, err := buildRolePageParams(rctx)
-	if err != nil {
-		return nil, err
-	}
-	name := strings.TrimSpace(rctx.Str("name"))
-	if rctx.Changed("name") && name == "" {
-		return nil, appsValidationParamError("--name", "--name must not be empty when provided").
-			WithHint("omit --name to list all roles, or provide the exact role name to resolve")
-	}
-	if name != "" {
-		params["name"] = name
-	}
-	return params, nil
-}
-
-// roleListRequestParams returns the query parameters for one actual backend
-// request. Exact-name lookup always starts from server offset zero and scans in
-// maximum-sized batches; the caller's limit/offset are applied to local matches.
-func roleListRequestParams(params map[string]interface{}, page int) map[string]interface{} {
-	name, _ := params["name"].(string)
-	if name == "" {
-		return params
-	}
-	return map[string]interface{}{
-		"limit":  maxRolePageSize,
-		"offset": page * maxRolePageSize,
-		"name":   name,
-	}
-}
-
-func buildRoleCreateBody(rctx *common.RuntimeContext) map[string]interface{} {
-	body := map[string]interface{}{
-		"name": strings.TrimSpace(rctx.Str("name")),
-	}
-	if rctx.Changed("description") {
-		body["description"] = strings.TrimSpace(rctx.Str("description"))
-	}
-	if rctx.Changed("role-id") {
-		if roleID := strings.TrimSpace(rctx.Str("role-id")); roleID != "" {
-			body["role_id"] = roleID
-		}
-	}
-	return body
-}
-
-func buildRoleUpdateBody(rctx *common.RuntimeContext) map[string]interface{} {
-	body := map[string]interface{}{}
-	if rctx.Changed("name") {
-		body["name"] = strings.TrimSpace(rctx.Str("name"))
-	}
-	if rctx.Changed("description") {
-		body["description"] = strings.TrimSpace(rctx.Str("description"))
-	}
-	return body
-}
-
-// executeRoleList compensates for Miaoda environments that accept the name
-// query parameter but ignore it. A name lookup scans the complete server-side
-// result set, applies exact matching locally, and then applies the CLI's
-// offset/limit contract to the filtered result.
-func executeRoleList(rctx *common.RuntimeContext, params map[string]interface{}) (map[string]interface{}, error) {
-	name, _ := params["name"].(string)
-	if name == "" {
-		data, err := rctx.CallAPITyped("GET", roleListURL(rctx), params, nil)
-		if err != nil {
-			return nil, err
-		}
-		return normalizeRoleListData(data, params)
-	}
-
-	requestedLimit := roleIntValue(params["limit"])
-	requestedOffset := roleIntValue(params["offset"])
-	allMatches := make([]interface{}, 0, requestedLimit)
-	var firstPage map[string]interface{}
-	seenRoleIDs := map[string]struct{}{}
-	seenPageSignatures := map[string]struct{}{}
-	expectedTotal := -1
-	scannedRoleCount := 0
-
-	for page := 0; ; page++ {
-		if page >= maxRoleListScanPages {
-			return nil, errs.NewInternalError(
-				errs.SubtypeInvalidResponse,
-				"role list exceeded %d pages while filtering by name",
-				maxRoleListScanPages,
-			).WithHint("retry without --name and paginate using the returned page_token")
-		}
-
-		scanParams := roleListRequestParams(params, page)
-		data, err := rctx.CallAPITyped("GET", roleListURL(rctx), scanParams, nil)
-		if err != nil {
-			return nil, err
-		}
-		if firstPage == nil {
-			firstPage = data
-		}
-		items, hasMore, total, err := parseRoleListPage(data)
-		if err != nil {
-			return nil, err
-		}
-		if expectedTotal < 0 {
-			expectedTotal = total
-		} else if total != expectedTotal {
-			return nil, roleListProgressError("role list total changed across pages while filtering by name")
-		}
-		if scannedRoleCount+len(items) > expectedTotal {
-			return nil, roleListProgressError("role list returned more roles than its total while filtering by name")
-		}
-		scannedRoleCount += len(items)
-		if hasMore && scannedRoleCount >= expectedTotal {
-			return nil, roleListProgressError("role list reported more pages after reaching its total while filtering by name")
-		}
-		if !hasMore && scannedRoleCount != expectedTotal {
-			return nil, roleListProgressError("role list ended before returning its declared total while filtering by name")
-		}
-		signature, newRoleCount, err := roleListPageProgress(items, seenRoleIDs)
-		if err != nil {
-			return nil, err
-		}
-		if newRoleCount != len(items) {
-			return nil, roleListProgressError("role list repeated roles across pages while filtering by name")
-		}
-		if _, duplicate := seenPageSignatures[signature]; duplicate {
-			return nil, roleListProgressError("role list repeated a page while filtering by name")
-		}
-		seenPageSignatures[signature] = struct{}{}
-		if hasMore && (len(items) == 0 || newRoleCount == 0) {
-			return nil, roleListProgressError("role list reported more pages without returning new roles")
-		}
-		for _, item := range items {
-			role, ok := item.(map[string]interface{})
-			if ok && common.GetString(role, "name") == name {
-				allMatches = append(allMatches, item)
-			}
-		}
-		if !hasMore {
-			break
-		}
-	}
-
-	if firstPage == nil {
-		firstPage = map[string]interface{}{}
-	}
-	return normalizeFilteredRoleListData(firstPage, allMatches, requestedOffset, requestedLimit), nil
-}
-
-func normalizeFilteredRoleListData(data map[string]interface{}, matches []interface{}, offset, limit int) map[string]interface{} {
-	out := map[string]interface{}{}
-	for k, v := range data {
-		out[k] = v
-	}
-
-	start := offset
-	if start > len(matches) {
-		start = len(matches)
-	}
-	end := start + limit
-	if end > len(matches) {
-		end = len(matches)
-	}
-	hasMore := end < len(matches)
-	items := append([]interface{}(nil), matches[start:end]...)
-	if items == nil {
-		items = []interface{}{}
-	}
-	out["items"] = items
-	out["has_more"] = hasMore
-	out["page_token"] = roleNextPageToken(start, limit, hasMore)
-	out["total"] = len(matches)
-	return out
-}
-
-func normalizeRoleListData(data map[string]interface{}, params map[string]interface{}) (map[string]interface{}, error) {
-	items, hasMore, total, err := parseRoleListPage(data)
-	if err != nil {
-		return nil, err
-	}
-	out := map[string]interface{}{}
-	for k, v := range data {
-		out[k] = v
-	}
-
-	limit := roleIntValue(params["limit"])
-	offset := roleIntValue(params["offset"])
-
-	out["items"] = items
-	out["has_more"] = hasMore
-	out["page_token"] = roleNextPageToken(offset, limit, hasMore)
-	out["total"] = total
-	return out, nil
-}
-
-func parseRoleListPage(data map[string]interface{}) ([]interface{}, bool, int, error) {
-	rawItems, hasItems := data["items"]
-	items, ok := rawItems.([]interface{})
-	if !hasItems || !ok {
-		return nil, false, 0, errs.NewInternalError(
-			errs.SubtypeInvalidResponse,
-			"role list response field items must be an array",
-		).WithHint("retry the read; do not treat a missing or malformed role list as empty")
-	}
-	if err := validateRoleCollection(items, "role list response field items"); err != nil {
-		return nil, false, 0, err
-	}
-	rawHasMore, hasHasMore := data["has_more"]
-	hasMore, ok := rawHasMore.(bool)
-	if !hasHasMore || !ok {
-		return nil, false, 0, errs.NewInternalError(
-			errs.SubtypeInvalidResponse,
-			"role list response field has_more must be a boolean",
-		).WithHint("retry the read; pagination is incomplete without a valid has_more value")
-	}
-	total, ok := nonNegativeRoleInteger(data["total"])
-	if _, exists := data["total"]; !exists || !ok {
-		return nil, false, 0, errs.NewInternalError(
-			errs.SubtypeInvalidResponse,
-			"role list response field total must be a non-negative integer",
-		).WithHint("retry the read; do not infer a role count from a missing or malformed total value")
-	}
-	return items, hasMore, total, nil
-}
-
-func roleListPageProgress(items []interface{}, seenRoleIDs map[string]struct{}) (string, int, error) {
-	roleIDs := make([]string, 0, len(items))
-	newRoleCount := 0
-	for index, item := range items {
-		_, roleID, err := roleCollectionItem(item, "role list response field items", index)
-		if err != nil {
-			return "", 0, err
-		}
-		roleIDs = append(roleIDs, roleID)
-		if _, seen := seenRoleIDs[roleID]; !seen {
-			seenRoleIDs[roleID] = struct{}{}
-			newRoleCount++
-		}
-	}
-	return strings.Join(roleIDs, "\x00"), newRoleCount, nil
-}
-
-func nonNegativeRoleInteger(value interface{}) (int, bool) {
-	maxInt := uint64(^uint(0) >> 1)
-	toInt := func(value int64) (int, bool) {
-		if value < 0 || uint64(value) > maxInt {
-			return 0, false
-		}
-		return int(value), true
-	}
-
-	switch value := value.(type) {
-	case int:
-		if value < 0 {
-			return 0, false
-		}
-		return value, true
-	case int64:
-		return toInt(value)
-	case float64:
-		maxIntExclusive := math.Ldexp(1, strconv.IntSize-1)
-		if math.IsNaN(value) || math.IsInf(value, 0) || value < 0 || math.Trunc(value) != value || value >= maxIntExclusive {
-			return 0, false
-		}
-		return int(value), true
-	case json.Number:
-		parsed, err := value.Int64()
-		if err != nil {
-			return 0, false
-		}
-		return toInt(parsed)
-	case string:
-		if value == "" || strings.IndexFunc(value, func(r rune) bool {
-			return r < '0' || r > '9'
-		}) >= 0 {
-			return 0, false
-		}
-		parsed, err := strconv.ParseUint(value, 10, strconv.IntSize)
-		if err != nil || parsed > maxInt {
-			return 0, false
-		}
-		return int(parsed), true
-	default:
-		return 0, false
-	}
-}
-
-func roleListProgressError(message string) error {
-	return errs.NewInternalError(errs.SubtypeInvalidResponse, message).
-		WithHint("retry without --name and paginate manually; do not continue an incomplete exact-name scan")
-}
-
-func normalizeRoleDeleteData(data map[string]interface{}, requestedRoleID string) (map[string]interface{}, error) {
-	if data == nil {
-		return nil, invalidRoleDeleteResponse("role delete response data must be an object")
-	}
-	if len(data) == 0 {
-		return map[string]interface{}{
-			"role_id": requestedRoleID,
-			"deleted": true,
-		}, nil
-	}
-
-	out := map[string]interface{}{}
-	for k, v := range data {
-		out[k] = v
-	}
-	rawRoleID, ok := out["role_id"]
-	if !ok {
-		return nil, invalidRoleDeleteResponse("role delete response is missing role_id")
-	}
-	actualRoleID, stringOK := rawRoleID.(string)
-	if !stringOK || actualRoleID != requestedRoleID {
-		return nil, invalidRoleDeleteResponse(
-			"role delete response role_id does not match requested role_id %q",
-			requestedRoleID,
-		)
-	}
-	rawDeleted, ok := out["deleted"]
-	if !ok {
-		return nil, invalidRoleDeleteResponse("role delete response is missing deleted")
-	}
-	deleted, boolOK := rawDeleted.(bool)
-	if !boolOK || !deleted {
-		return nil, invalidRoleDeleteResponse("role delete response did not acknowledge deletion")
-	}
-	return out, nil
-}
-
-type roleResponseData struct {
-	RoleID      string
-	Name        string
-	Description string
-}
-
-func parseRoleDetailResponseData(data map[string]interface{}, expectedRoleID string) (roleResponseData, error) {
-	return parseRoleResponseData(data, expectedRoleID, true)
-}
-
-func parseRoleWriteResponseData(data map[string]interface{}, expectedRoleID string) (roleResponseData, error) {
-	return parseRoleResponseData(data, expectedRoleID, false)
-}
-
-func parseRoleResponseData(data map[string]interface{}, expectedRoleID string, requireName bool) (roleResponseData, error) {
-	if data == nil {
-		return roleResponseData{}, invalidRoleResponse("role response data must be an object")
-	}
-	rawRole, exists := data["role"]
-	role, ok := rawRole.(map[string]interface{})
-	if !exists || !ok || role == nil {
-		return roleResponseData{}, invalidRoleResponse("role response field role must be an object")
-	}
-	rawRoleID, exists := role["role_id"]
-	roleID, ok := rawRoleID.(string)
-	roleID = strings.TrimSpace(roleID)
-	if !exists || !ok || roleID == "" {
-		return roleResponseData{}, invalidRoleResponse("role response field role.role_id must be a non-empty string")
-	}
-	if expectedRoleID != "" && roleID != expectedRoleID {
-		return roleResponseData{}, invalidRoleResponse(
-			"role response role_id %q does not match requested role_id %q",
-			roleID,
-			expectedRoleID,
-		)
-	}
-	rawName, nameExists := role["name"]
-	name, nameOK := rawName.(string)
-	name = strings.TrimSpace(name)
-	if requireName && !nameExists {
-		return roleResponseData{}, invalidRoleResponse("role response field role.name must be a non-empty string")
-	}
-	if nameExists && (!nameOK || name == "") {
-		return roleResponseData{}, invalidRoleResponse("role response field role.name must be a non-empty string")
-	}
-	rawDescription, descriptionExists := role["description"]
-	description, descriptionOK := rawDescription.(string)
-	if descriptionExists && !descriptionOK {
-		return roleResponseData{}, invalidRoleResponse("role response field role.description must be a string")
-	}
-	return roleResponseData{RoleID: roleID, Name: name, Description: description}, nil
-}
-
-func invalidRoleResponse(message string, args ...interface{}) error {
-	return errs.NewInternalError(errs.SubtypeInvalidResponse, message, args...).
-		WithHint("retry the role read; do not treat a missing or malformed role as a successful result")
-}
-
-func invalidRoleDeleteResponse(message string, args ...interface{}) error {
-	return errs.NewInternalError(errs.SubtypeInvalidResponse, message, args...).
-		WithHint("do not claim deletion; verify the target role with +role-list --name <exact_name>")
-}
-
-func roleIntValue(value interface{}) int {
-	switch v := value.(type) {
-	case int:
-		return v
-	case int64:
-		return int(v)
-	case float64:
-		return int(v)
-	case json.Number:
-		i, err := strconv.Atoi(v.String())
-		if err == nil {
-			return i
-		}
-	case string:
-		i, err := strconv.Atoi(strings.TrimSpace(v))
-		if err == nil {
-			return i
-		}
-	}
-	return 0
-}
-
-func renderRoleCreatePretty(w io.Writer, role roleResponseData) {
-	fmt.Fprintf(w, "Created role %s\n", roleDisplayValue(role.RoleID))
-}
-
-func renderRoleGetPretty(w io.Writer, role roleResponseData) {
-	renderRoleDetailPretty(w, role)
-}
-
-func renderRoleUpdatePretty(w io.Writer, role roleResponseData) {
-	fmt.Fprintf(w, "Updated role %s\n", roleDisplayValue(role.RoleID))
-}
-
-func renderRoleDeletePretty(w io.Writer, roleID string) {
-	fmt.Fprintf(w, "Deleted role %s\n", roleDisplayValue(roleID))
-}
-
-func renderRoleDetailPretty(w io.Writer, role roleResponseData) {
-	fmt.Fprintf(w, "role_id: %s\n", roleDisplayValue(role.RoleID))
-	fmt.Fprintf(w, "name: %s\n", roleDisplayValue(role.Name))
-	fmt.Fprintf(w, "description: %s\n", roleDisplayValue(role.Description))
-}
-
-func renderRoleListPretty(w io.Writer, items []interface{}) {
-	tw := tabwriter.NewWriter(w, 0, 0, 2, ' ', 0)
-	fmt.Fprintln(tw, "ROLE ID\tNAME\tDESCRIPTION")
-	for _, item := range items {
-		role, ok := item.(map[string]interface{})
-		if !ok {
-			continue
-		}
-		fmt.Fprintf(tw, "%s\t%s\t%s\n",
-			roleDisplayValue(firstNonEmpty(common.GetString(role, "role_id"), common.GetString(role, "id"))),
-			roleDisplayValue(common.GetString(role, "name")),
-			roleDisplayValue(common.GetString(role, "description")))
-	}
-	_ = tw.Flush()
-}

shortcuts/apps/apps_role_common.go

@@ -1,490 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package apps
-
-import (
-	"fmt"
-	"regexp"
-	"strconv"
-	"strings"
-	"unicode"
-
-	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/errclass"
-	"github.com/larksuite/cli/internal/validate"
-	"github.com/larksuite/cli/shortcuts/common"
-)
-
-const (
-	roleListPath         = apiBasePath + "/apps/%s/roles"
-	roleItemPath         = apiBasePath + "/apps/%s/roles/%s"
-	roleMemberListPath   = apiBasePath + "/apps/%s/roles/%s/member_list"
-	roleMemberAddPath    = apiBasePath + "/apps/%s/roles/%s/member_add"
-	roleMemberRemovePath = apiBasePath + "/apps/%s/roles/%s/member_remove"
-	roleMatchListPath    = apiBasePath + "/apps/%s/user_role_list"
-	defaultRolePageSize  = 20
-	maxRolePageSize      = 100
-	maxRoleMembers       = 100
-
-	roleErrInvalidParameters       = 3340001
-	roleErrUserLimitExceeded       = 3344027
-	roleErrDepartmentLimitExceeded = 3344028
-	roleErrChatLimitExceeded       = 3344029
-	roleErrAdminRequired           = 3344030
-	roleErrManagerRequired         = 3344031
-	roleErrInvalidRoleID           = 3344034
-	roleErrRoleNotFound            = 3344035
-	roleErrRoleAlreadyExists       = 3344036
-	roleErrRoleLimitExceeded       = 3344037
-	roleErrInvalidRoleName         = 3344038
-	roleErrInvalidRoleDescription  = 3344039
-	roleErrUnsupportedMemberType   = 3344040
-	roleErrInvalidMemberID         = 3344041
-)
-
-var optionalRoleIDPattern = regexp.MustCompile(`^[A-Za-z0-9_-]{1,64}$`)
-
-const (
-	roleAppHint    = "verify --app-id is a Miaoda app_id you can access; list apps with `lark-cli apps +list`"
-	roleItemHint   = "verify --role-id belongs to the app; if you only know a role name, resolve it with `lark-cli apps +role-list --app-id <app_id> --name <exact_name>` and use the unique returned role_id"
-	roleCreateHint = "verify --app-id and role fields; omit --role-id unless you need a caller-provided role ID"
-	roleMemberHint = "verify --role-id and member IDs; use user open_id, open_department_id, or open_chat_id values"
-	roleMatchHint  = "use --user-id with a user open_id; do not pass role_id or enumerate roles manually"
-
-	roleAppIDRequiredDesc  = "Miaoda app ID (required; app_...; use apps +list to find it)"
-	roleIDRequiredDesc     = "role ID (required; [A-Za-z0-9_-]{1,64}; use role-list to find it)"
-	roleUserIDRequiredDesc = "user open ID (required; ou_...; do not pass a role ID, name, or email)"
-)
-
-type roleErrorOperation uint8
-
-const (
-	roleOperationList roleErrorOperation = iota
-	roleOperationGet
-	roleOperationCreate
-	roleOperationUpdate
-	roleOperationDelete
-	roleOperationMemberList
-	roleOperationMemberAdd
-	roleOperationMemberRemove
-	roleOperationMatchList
-)
-
-type roleMemberGroups struct {
-	Users       []string `json:"users"`
-	Departments []string `json:"departments"`
-	Chats       []string `json:"chats"`
-}
-
-type roleMemberKind struct {
-	memberType string
-	dataKey    string
-	flagName   string
-	prefix     string
-}
-
-var roleMemberKinds = []roleMemberKind{
-	{memberType: "user", dataKey: "users", flagName: "--users", prefix: "ou_"},
-	{memberType: "department", dataKey: "departments", flagName: "--departments", prefix: "od-"},
-	{memberType: "chat", dataKey: "chats", flagName: "--chats", prefix: "oc_"},
-}
-
-func roleAppID(rctx *common.RuntimeContext) string {
-	return strings.TrimSpace(rctx.Str("app-id"))
-}
-
-func roleID(rctx *common.RuntimeContext) string {
-	return strings.TrimSpace(rctx.Str("role-id"))
-}
-
-func validateRoleAppID(rctx *common.RuntimeContext) error {
-	appID := roleAppID(rctx)
-	if appID == "" {
-		return appsValidationParamError("--app-id", "--app-id is required").
-			WithHint("list your apps with `lark-cli apps +list`")
-	}
-	if strings.HasPrefix(appID, "cli_") {
-		return appsValidationParamError("--app-id", "--app-id must be a Miaoda app_id, not a Lark app_id").
-			WithHint("pass the app_... value from `lark-cli apps +list`, not the cli_... credential app id")
-	}
-	if !strings.HasPrefix(appID, "app_") || len(appID) == len("app_") {
-		return appsValidationParamError("--app-id", "--app-id must be a Miaoda app_id starting with app_").
-			WithHint("list Miaoda apps with `lark-cli apps +list`, then pass the returned app_id")
-	}
-	// app-id must not contain forward slashes (apps are identified by app_xxx IDs).
-	for _, r := range appID {
-		if r == '/' || r == '\\' || unicode.IsSpace(r) || unicode.IsControl(r) {
-			return appsValidationParamError("--app-id", "--app-id must not contain slashes, whitespace, or control characters")
-		}
-	}
-	// Defense-in-depth: block path traversal and URL metacharacters.
-	if err := validateRolePathSegmentSafe(appID, "--app-id"); err != nil {
-		return err
-	}
-	return nil
-}
-
-func validateRoleID(rctx *common.RuntimeContext) error {
-	if err := validateRoleAppID(rctx); err != nil {
-		return err
-	}
-	roleID := roleID(rctx)
-	if roleID == "" {
-		return appsValidationParamError("--role-id", "--role-id is required").
-			WithHint("list roles with `lark-cli apps +role-list --app-id <app_id>`")
-	}
-	return validateExistingRoleIDValue(roleID)
-}
-
-// validateRolePathSegmentSafe rejects path-traversal segments ("..") and URL
-// metacharacters (? # %) in values interpolated into a URL path, providing
-// defense-in-depth alongside validate.EncodePathSegment.
-func validateRolePathSegmentSafe(value, flagName string) error {
-	for _, seg := range strings.Split(value, "/") {
-		if seg == ".." {
-			return appsValidationParamError(flagName, "%s must not contain '..' path traversal", flagName).
-				WithHint("provide a valid %s without path traversal", flagName)
-		}
-	}
-	if strings.ContainsAny(value, "?#%") {
-		return appsValidationParamError(flagName, "%s contains invalid URL characters (?, #, %%)", flagName).
-			WithHint("provide a valid %s without URL metacharacters", flagName)
-	}
-	return nil
-}
-
-func validateOptionalRoleID(roleID string) error {
-	roleID = strings.TrimSpace(roleID)
-	if roleID == "" {
-		return nil
-	}
-	return validateCreateRoleIDValue(roleID)
-}
-
-func validateCreateRoleIDValue(roleID string) error {
-	if !optionalRoleIDPattern.MatchString(roleID) {
-		return appsValidationParamError("--role-id", "--role-id must match [A-Za-z0-9_-]{1,64}").
-			WithHint("omit --role-id to let the server generate one")
-	}
-	return nil
-}
-
-func validateExistingRoleIDValue(roleID string) error {
-	if !optionalRoleIDPattern.MatchString(roleID) {
-		return appsValidationParamError("--role-id", "--role-id must match [A-Za-z0-9_-]{1,64}").
-			WithHint("resolve the role with `lark-cli apps +role-list --app-id <app_id> --name <exact_name>` and pass its role_id")
-	}
-	return nil
-}
-
-func buildRolePageParams(rctx *common.RuntimeContext) (map[string]interface{}, error) {
-	limit := defaultRolePageSize
-	if rctx.Changed("page-size") {
-		limit = rctx.Int("page-size")
-	}
-	if limit < 1 || limit > maxRolePageSize {
-		return nil, appsValidationParamError("--page-size", "--page-size must be between 1 and %d", maxRolePageSize).
-			WithHint("use --page-size between 1 and 100")
-	}
-
-	offset := 0
-	pageToken := strings.TrimSpace(rctx.Str("page-token"))
-	if pageToken != "" {
-		parsedOffset, err := strconv.Atoi(pageToken)
-		if err != nil || parsedOffset < 0 {
-			return nil, appsValidationParamError("--page-token", "--page-token must be a non-negative integer offset").
-				WithHint("reuse page_token from the previous +role-list response")
-		}
-		offset = parsedOffset
-	}
-
-	return map[string]interface{}{
-		"limit":  limit,
-		"offset": offset,
-	}, nil
-}
-
-func roleNextPageToken(offset, limit int, hasMore bool) string {
-	if !hasMore {
-		return ""
-	}
-	return strconv.Itoa(offset + limit)
-}
-
-func splitRoleMemberCSV(s, flagName string) ([]string, error) {
-	parts := strings.Split(s, ",")
-	values := make([]string, 0, len(parts))
-	for _, part := range parts {
-		value := strings.TrimSpace(part)
-		if value == "" {
-			continue
-		}
-		// Reject values containing whitespace, control characters, or URL metacharacters
-		// (member IDs are open_id/open_department_id/open_chat_id which are safe tokens).
-		if err := validateMemberID(value, flagName); err != nil {
-			return nil, err
-		}
-		values = append(values, value)
-	}
-	return values, nil
-}
-
-// validateMemberID rejects values containing characters that are invalid in
-// open_id / open_department_id / open_chat_id tokens (whitespace, controls, URL metacharacters).
-func validateMemberID(value, flagName string) error {
-	if err := validateMemberIDPrefix(value, flagName); err != nil {
-		return err
-	}
-	for _, r := range value {
-		if unicode.IsSpace(r) || unicode.IsControl(r) {
-			return appsValidationParamError(flagName, "member IDs must not contain whitespace or control characters").
-				WithHint("pass comma-separated open_id/open_department_id/open_chat_id values without spaces")
-		}
-		if r == '?' || r == '#' || r == '%' || r == '/' || r == '\\' {
-			return appsValidationParamError(flagName, "member IDs must not contain URL metacharacters (?, #, %, /, \\)").
-				WithHint("pass comma-separated open_id/open_department_id/open_chat_id values without URL characters")
-		}
-	}
-	return nil
-}
-
-func validateMemberIDPrefix(value, flagName string) error {
-	kind, ok := roleMemberKindForFlag(flagName)
-	if !ok {
-		return nil
-	}
-	if !strings.HasPrefix(value, kind.prefix) || len(value) == len(kind.prefix) {
-		return appsValidationParamError(flagName, "%s must use %s IDs", flagName, kind.prefix).
-			WithHint("resolve names or emails to open IDs before calling role member commands")
-	}
-	return nil
-}
-
-func roleMemberKindForFlag(flagName string) (roleMemberKind, bool) {
-	if flagName == "--user-id" {
-		flagName = "--users"
-	}
-	for _, kind := range roleMemberKinds {
-		if kind.flagName == flagName {
-			return kind, true
-		}
-	}
-	return roleMemberKind{}, false
-}
-
-func roleMemberKindForType(memberType string) (roleMemberKind, bool) {
-	for _, kind := range roleMemberKinds {
-		if kind.memberType == memberType {
-			return kind, true
-		}
-	}
-	return roleMemberKind{}, false
-}
-
-func roleDisplayValue(value string) string {
-	value = validate.SanitizeForTerminal(value)
-	value = strings.NewReplacer("\n", " ", "\t", " ").Replace(value)
-	return strings.TrimSpace(value)
-}
-
-// withRoleErrorHint refines documented Spark role errors with command-specific
-// recovery while preserving the typed error, numeric code, log_id, and any
-// server-provided detail. Unknown codes retain the existing Apps fallback.
-func withRoleErrorHint(err error, operation roleErrorOperation) error {
-	if err == nil {
-		return nil
-	}
-	problem, ok := errs.ProblemOf(err)
-	if !ok {
-		return err
-	}
-	hint := roleErrorHint(problem.Code, operation)
-	if hint == "" {
-		return withAppsHint(err, roleFallbackHint(operation))
-	}
-
-	existing := strings.TrimSpace(problem.Hint)
-	canonicalAPIHint := strings.TrimSpace(errclass.APIHint(problem.Subtype))
-	switch {
-	case existing == "", existing == canonicalAPIHint:
-		problem.Hint = hint
-	case !strings.Contains(existing, hint):
-		problem.Hint = existing + "; " + hint
-	}
-	return err
-}
-
-func roleFallbackHint(operation roleErrorOperation) string {
-	switch operation {
-	case roleOperationList:
-		return roleAppHint
-	case roleOperationCreate:
-		return roleCreateHint
-	case roleOperationMemberList, roleOperationMemberAdd, roleOperationMemberRemove:
-		return roleMemberHint
-	case roleOperationMatchList:
-		return roleMatchHint
-	default:
-		return roleItemHint
-	}
-}
-
-func roleErrorHint(code int, operation roleErrorOperation) string {
-	switch code {
-	case roleErrInvalidParameters:
-		return roleFallbackHint(operation)
-	case roleErrAdminRequired:
-		return "ask an app administrator to perform this operation or grant the calling user app-administrator access"
-	case roleErrManagerRequired:
-		return "ask an app administrator or app developer to perform this operation, or grant the calling user app-management access"
-	case roleErrInvalidRoleID:
-		if operation == roleOperationCreate {
-			return "omit --role-id to let the server generate one, or provide a role ID accepted by the role service"
-		}
-	case roleErrRoleNotFound:
-		if operation == roleOperationMatchList {
-			return "list the app's current roles and retry; role data used for this match may no longer be valid"
-		}
-		return roleItemHint
-	case roleErrRoleAlreadyExists:
-		if operation == roleOperationCreate {
-			return "choose a different --role-id or omit --role-id to let the server generate one"
-		}
-	case roleErrRoleLimitExceeded:
-		if operation == roleOperationCreate {
-			return "delete an unused app role before creating another role"
-		}
-	case roleErrInvalidRoleName:
-		if operation == roleOperationCreate || operation == roleOperationUpdate {
-			return "adjust --name to a non-empty value accepted by the role service"
-		}
-	case roleErrInvalidRoleDescription:
-		if operation == roleOperationCreate || operation == roleOperationUpdate {
-			return "adjust --description to a value accepted by the role service"
-		}
-	case roleErrUnsupportedMemberType:
-		if operation == roleOperationMemberList {
-			return "use --member-type user, department, or chat, or omit --member-type to list all member types"
-		}
-	case roleErrInvalidMemberID:
-		if operation == roleOperationMatchList {
-			return "resolve the target user to an open_id and retry with --user-id <open_id>"
-		}
-		if operation == roleOperationMemberAdd || operation == roleOperationMemberRemove {
-			return roleMemberHint
-		}
-	case roleErrUserLimitExceeded:
-		if operation == roleOperationMemberAdd {
-			return "reduce the users being added with --users, or remove unused user members before retrying"
-		}
-	case roleErrDepartmentLimitExceeded:
-		if operation == roleOperationMemberAdd {
-			return "reduce the departments being added with --departments, or remove unused department members before retrying"
-		}
-	case roleErrChatLimitExceeded:
-		if operation == roleOperationMemberAdd {
-			return "reduce the chats being added with --chats, or remove unused chat members before retrying"
-		}
-	}
-	return ""
-}
-
-func roleCollectionItem(item interface{}, collection string, index int) (map[string]interface{}, string, error) {
-	role, ok := item.(map[string]interface{})
-	if !ok {
-		return nil, "", invalidRoleCollectionResponse("%s item %d must be an object", collection, index)
-	}
-	rawRoleID, exists := role["role_id"]
-	roleID, stringOK := rawRoleID.(string)
-	roleID = strings.TrimSpace(roleID)
-	if !exists || !stringOK || roleID == "" {
-		return nil, "", invalidRoleCollectionResponse("%s item %d must contain a non-empty string role_id", collection, index)
-	}
-	rawName, exists := role["name"]
-	name, stringOK := rawName.(string)
-	if !exists || !stringOK || strings.TrimSpace(name) == "" {
-		return nil, "", invalidRoleCollectionResponse("%s item %d must contain a non-empty string name", collection, index)
-	}
-	return role, roleID, nil
-}
-
-func validateRoleCollection(items []interface{}, collection string) error {
-	for index, item := range items {
-		if _, _, err := roleCollectionItem(item, collection, index); err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-func invalidRoleCollectionResponse(format string, args ...interface{}) error {
-	return errs.NewInternalError(errs.SubtypeInvalidResponse, format, args...).
-		WithHint("retry the read; do not treat missing or malformed role data as an empty or complete result")
-}
-
-func buildRoleMemberGroups(usersCSV, departmentsCSV, chatsCSV string) (roleMemberGroups, error) {
-	users, err := splitRoleMemberCSV(usersCSV, "--users")
-	if err != nil {
-		return roleMemberGroups{}, err
-	}
-	departments, err := splitRoleMemberCSV(departmentsCSV, "--departments")
-	if err != nil {
-		return roleMemberGroups{}, err
-	}
-	chats, err := splitRoleMemberCSV(chatsCSV, "--chats")
-	if err != nil {
-		return roleMemberGroups{}, err
-	}
-	groups := roleMemberGroups{
-		Users:       users,
-		Departments: departments,
-		Chats:       chats,
-	}
-	total := len(groups.Users) + len(groups.Departments) + len(groups.Chats)
-	if total == 0 {
-		reason := "provide at least one of --users, --departments, or --chats"
-		return groups, appsValidationError("at least one of --users, --departments, or --chats is required").
-			WithParams(
-				appsInvalidParam("--users", reason),
-				appsInvalidParam("--departments", reason),
-				appsInvalidParam("--chats", reason),
-			).
-			WithHint("resolve names to IDs first, then pass --users open_id, --departments open_department_id, or --chats open_chat_id")
-	}
-	if total > maxRoleMembers {
-		return groups, appsValidationError("role members cannot exceed %d", maxRoleMembers).
-			WithParams(roleMemberLimitParams(groups)...).
-			WithHint(fmt.Sprintf("reduce the atomic request to at most %d members; the CLI does not split member writes automatically", maxRoleMembers))
-	}
-	return groups, nil
-}
-
-func buildRoleMemberBody(groups roleMemberGroups) map[string]interface{} {
-	body := map[string]interface{}{}
-	if len(groups.Users) > 0 {
-		body["users"] = groups.Users
-	}
-	if len(groups.Departments) > 0 {
-		body["departments"] = groups.Departments
-	}
-	if len(groups.Chats) > 0 {
-		body["chats"] = groups.Chats
-	}
-	return body
-}
-
-func roleMemberLimitParams(groups roleMemberGroups) []errs.InvalidParam {
-	reason := fmt.Sprintf("combined role member count exceeds %d", maxRoleMembers)
-	params := make([]errs.InvalidParam, 0, len(roleMemberKinds))
-	if len(groups.Users) > 0 {
-		params = append(params, appsInvalidParam("--users", reason))
-	}
-	if len(groups.Departments) > 0 {
-		params = append(params, appsInvalidParam("--departments", reason))
-	}
-	if len(groups.Chats) > 0 {
-		params = append(params, appsInvalidParam("--chats", reason))
-	}
-	return params
-}

shortcuts/apps/apps_role_common_test.go

@@ -1,447 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package apps
-
-import (
-	"bytes"
-	"context"
-	"errors"
-	"strings"
-	"testing"
-
-	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
-	"github.com/larksuite/cli/internal/errclass"
-	"github.com/larksuite/cli/internal/httpmock"
-	"github.com/larksuite/cli/shortcuts/common"
-	"github.com/spf13/cobra"
-)
-
-func newRoleRCtx(t *testing.T, flagDefs map[string]string, flags map[string]string) (*common.RuntimeContext, *bytes.Buffer, *httpmock.Registry) {
-	t.Helper()
-	cfg := &core.CliConfig{
-		AppID:      "test-app-" + strings.ToLower(t.Name()),
-		AppSecret:  "test-secret",
-		Brand:      core.BrandFeishu,
-		UserOpenId: "ou_test",
-	}
-	factory, stdoutBuf, _, reg := cmdutil.TestFactory(t, cfg)
-	cmd := &cobra.Command{Use: "test-role"}
-	cmd.SetContext(context.Background())
-	for name, typ := range flagDefs {
-		switch typ {
-		case "bool":
-			cmd.Flags().Bool(name, false, "")
-		case "int":
-			cmd.Flags().Int(name, 0, "")
-		case "string_array":
-			cmd.Flags().StringArray(name, nil, "")
-		default:
-			cmd.Flags().String(name, "", "")
-		}
-	}
-	for name, val := range flags {
-		if err := cmd.Flags().Set(name, val); err != nil {
-			t.Fatalf("set flag %q = %q: %v", name, val, err)
-		}
-	}
-	rctx := common.TestNewRuntimeContextForAPI(context.Background(), cmd, cfg, factory, core.AsUser)
-	return rctx, stdoutBuf, reg
-}
-
-func assertRoleValidationParam(t *testing.T, err error, param string) *errs.Problem {
-	t.Helper()
-	problem, ok := errs.ProblemOf(err)
-	if !ok {
-		t.Fatalf("err = %#v, want typed problem", err)
-	}
-	if problem.Category != errs.CategoryValidation {
-		t.Fatalf("category = %q, want validation", problem.Category)
-	}
-	if problem.Subtype != errs.SubtypeInvalidArgument {
-		t.Fatalf("subtype = %q, want invalid_argument", problem.Subtype)
-	}
-	var validation *errs.ValidationError
-	if !errors.As(err, &validation) {
-		t.Fatalf("err = %#v, want validation error", err)
-	}
-	if validation.Param != param {
-		t.Fatalf("param = %q, want %s", validation.Param, param)
-	}
-	return problem
-}
-
-func assertRoleValidationParams(t *testing.T, err error, params ...string) *errs.Problem {
-	t.Helper()
-	problem, ok := errs.ProblemOf(err)
-	if !ok {
-		t.Fatalf("err = %#v, want typed problem", err)
-	}
-	if problem.Category != errs.CategoryValidation || problem.Subtype != errs.SubtypeInvalidArgument {
-		t.Fatalf("problem = %+v, want validation/invalid_argument", problem)
-	}
-	var validation *errs.ValidationError
-	if !errors.As(err, &validation) {
-		t.Fatalf("err = %#v, want validation error", err)
-	}
-	if validation.Param != "" {
-		t.Fatalf("param = %q, want omitted for multi-parameter constraint", validation.Param)
-	}
-	if len(validation.Params) != len(params) {
-		t.Fatalf("params = %#v, want %v", validation.Params, params)
-	}
-	for index, want := range params {
-		if validation.Params[index].Name != want || validation.Params[index].Reason == "" {
-			t.Fatalf("params[%d] = %#v, want name=%q with a reason", index, validation.Params[index], want)
-		}
-	}
-	return problem
-}
-
-func TestBuildRolePageParams_DefaultAndChanged(t *testing.T) {
-	rctx, _, _ := newRoleRCtx(t, map[string]string{
-		"page-size":  "int",
-		"page-token": "string",
-	}, map[string]string{})
-	params, err := buildRolePageParams(rctx)
-	if err != nil {
-		t.Fatalf("buildRolePageParams() = %v", err)
-	}
-	if params["limit"] != defaultRolePageSize || params["offset"] != 0 {
-		t.Fatalf("params = %#v, want limit=%d offset=0", params, defaultRolePageSize)
-	}
-
-	rctx, _, _ = newRoleRCtx(t, map[string]string{
-		"page-size":  "int",
-		"page-token": "string",
-	}, map[string]string{"page-size": "20", "page-token": "40"})
-	params, err = buildRolePageParams(rctx)
-	if err != nil {
-		t.Fatalf("buildRolePageParams(changed) = %v", err)
-	}
-	if params["limit"] != 20 || params["offset"] != 40 {
-		t.Fatalf("params = %#v, want limit=20 offset=40", params)
-	}
-}
-
-func TestBuildRolePageParams_RejectsInvalidToken(t *testing.T) {
-	rctx, _, _ := newRoleRCtx(t, map[string]string{
-		"page-size":  "int",
-		"page-token": "string",
-	}, map[string]string{"page-token": "abc"})
-	_, err := buildRolePageParams(rctx)
-	assertRoleValidationParam(t, err, "--page-token")
-}
-
-func TestBuildRolePageParams_RejectsPageSizeOverMax(t *testing.T) {
-	rctx, _, _ := newRoleRCtx(t, map[string]string{
-		"page-size":  "int",
-		"page-token": "string",
-	}, map[string]string{"page-size": "101"})
-	_, err := buildRolePageParams(rctx)
-	assertRoleValidationParam(t, err, "--page-size")
-}
-
-func TestValidateOptionalRoleID(t *testing.T) {
-	for _, good := range []string{"", " role_001 ", "Role-ABC", "abc123", strings.Repeat("a", 64)} {
-		if err := validateOptionalRoleID(good); err != nil {
-			t.Fatalf("validateOptionalRoleID(%q) = %v", good, err)
-		}
-	}
-	for _, bad := range []string{"bad/role", "bad role", strings.Repeat("a", 65)} {
-		err := validateOptionalRoleID(bad)
-		problem := assertRoleValidationParam(t, err, "--role-id")
-		if !strings.Contains(problem.Hint, "omit --role-id") {
-			t.Fatalf("hint = %q, want create-specific omit guidance", problem.Hint)
-		}
-	}
-}
-
-func TestRoleFlagHelpersTrim(t *testing.T) {
-	rctx, _, _ := newRoleRCtx(t, map[string]string{
-		"app-id":  "string",
-		"role-id": "string",
-	}, map[string]string{"app-id": " app_1 ", "role-id": " role_1 "})
-	if got := roleAppID(rctx); got != "app_1" {
-		t.Fatalf("roleAppID() = %q, want app_1", got)
-	}
-	if got := roleID(rctx); got != "role_1" {
-		t.Fatalf("roleID() = %q, want role_1", got)
-	}
-	if err := validateRoleID(rctx); err != nil {
-		t.Fatalf("validateRoleID() = %v, want nil", err)
-	}
-}
-
-func TestValidateRoleAppIDRejectsEmpty(t *testing.T) {
-	rctx, _, _ := newRoleRCtx(t, map[string]string{
-		"app-id": "string",
-	}, map[string]string{})
-	problem := assertRoleValidationParam(t, validateRoleAppID(rctx), "--app-id")
-	if problem.Message != "--app-id is required" {
-		t.Fatalf("message = %q, want --app-id is required", problem.Message)
-	}
-	if problem.Hint == "" {
-		t.Fatalf("hint is empty, want recovery guidance")
-	}
-}
-
-func TestValidateRoleAppIDRejectsPathSegmentUnsafeChars(t *testing.T) {
-	for _, appID := range []string{"app/bad", `app\bad`, "app bad", "app\u00a0bad", "app\nbad", "app\u0000bad"} {
-		rctx, _, _ := newRoleRCtx(t, map[string]string{
-			"app-id": "string",
-		}, map[string]string{"app-id": appID})
-		assertRoleValidationParam(t, validateRoleAppID(rctx), "--app-id")
-	}
-}
-
-func TestValidateRoleAppIDRejectsLarkCredentialAppID(t *testing.T) {
-	rctx, _, _ := newRoleRCtx(t, map[string]string{
-		"app-id": "string",
-	}, map[string]string{"app-id": "cli_app"})
-	assertRoleValidationParam(t, validateRoleAppID(rctx), "--app-id")
-}
-
-func TestValidateRoleAppIDRequiresMiaodaPrefix(t *testing.T) {
-	for _, appID := range []string{"app", "app_", "miaoda_123", "plain"} {
-		rctx, _, _ := newRoleRCtx(t, map[string]string{
-			"app-id": "string",
-		}, map[string]string{"app-id": appID})
-		problem := assertRoleValidationParam(t, validateRoleAppID(rctx), "--app-id")
-		if !strings.Contains(problem.Message, "starting with app_") {
-			t.Fatalf("appID=%q message=%q, want app_ guidance", appID, problem.Message)
-		}
-	}
-}
-
-func TestValidateRoleIDRejectsInvalidRequiredRoleID(t *testing.T) {
-	rctx, _, _ := newRoleRCtx(t, map[string]string{
-		"app-id":  "string",
-		"role-id": "string",
-	}, map[string]string{"app-id": "app_x", "role-id": "bad/role"})
-	problem := assertRoleValidationParam(t, validateRoleID(rctx), "--role-id")
-	if strings.Contains(problem.Hint, "omit --role-id") || !strings.Contains(problem.Hint, "+role-list") {
-		t.Fatalf("hint = %q, want existing-role resolution guidance", problem.Hint)
-	}
-}
-
-func TestValidateRoleIDRejectsMissingRequiredRoleID(t *testing.T) {
-	rctx, _, _ := newRoleRCtx(t, map[string]string{
-		"app-id":  "string",
-		"role-id": "string",
-	}, map[string]string{"app-id": "app_x"})
-	problem := assertRoleValidationParam(t, validateRoleID(rctx), "--role-id")
-	if problem.Message != "--role-id is required" {
-		t.Fatalf("message = %q, want --role-id is required", problem.Message)
-	}
-}
-
-func TestBuildRoleMemberGroupsAndBody(t *testing.T) {
-	groups, err := buildRoleMemberGroups(" ou_a,ou_b ", " od-a ", " oc_a ")
-	if err != nil {
-		t.Fatalf("buildRoleMemberGroups() = %v", err)
-	}
-	if len(groups.Users) != 2 || len(groups.Departments) != 1 || len(groups.Chats) != 1 {
-		t.Fatalf("groups = %#v", groups)
-	}
-	body := buildRoleMemberBody(groups)
-	assertJSONEquivalent(t, body, map[string]interface{}{
-		"users":       []interface{}{"ou_a", "ou_b"},
-		"departments": []interface{}{"od-a"},
-		"chats":       []interface{}{"oc_a"},
-	})
-}
-
-func TestBuildRoleMemberGroupsRejectsEmpty(t *testing.T) {
-	_, err := buildRoleMemberGroups(" , ", "", "")
-	assertRoleValidationParams(t, err, "--users", "--departments", "--chats")
-}
-
-func TestBuildRoleMemberGroupsRejectsInvalidMemberIDWithSourceParam(t *testing.T) {
-	tests := []struct {
-		name        string
-		users       string
-		departments string
-		chats       string
-		wantParam   string
-	}{
-		{name: "users slash", users: "ou/bad", wantParam: "--users"},
-		{name: "users email", users: "alice@example.com", wantParam: "--users"},
-		{name: "users wrong prefix", users: "user_123", wantParam: "--users"},
-		{name: "users prefix only", users: "ou_", wantParam: "--users"},
-		{name: "departments wrong prefix", departments: "ou_user", wantParam: "--departments"},
-		{name: "departments prefix only", departments: "od-", wantParam: "--departments"},
-		{name: "legacy departments prefix", departments: "od_department", wantParam: "--departments"},
-		{name: "chats wrong prefix", chats: "od-department", wantParam: "--chats"},
-		{name: "chats prefix only", chats: "oc_", wantParam: "--chats"},
-		{
-			name:        "departments",
-			departments: "od-bad value",
-			wantParam:   "--departments",
-		},
-		{
-			name:      "chats",
-			chats:     "oc?bad",
-			wantParam: "--chats",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			_, err := buildRoleMemberGroups(tt.users, tt.departments, tt.chats)
-			assertRoleValidationParam(t, err, tt.wantParam)
-		})
-	}
-}
-
-func TestBuildRoleMemberGroupsRejectsMoreThanMax(t *testing.T) {
-	users := make([]string, maxRoleMembers+1)
-	for i := range users {
-		users[i] = "ou_test"
-	}
-	_, err := buildRoleMemberGroups(strings.Join(users, ","), "", "")
-	assertRoleValidationParams(t, err, "--users")
-}
-
-func TestBuildRoleMemberGroupsRejectsMoreThanMaxOnlyChats(t *testing.T) {
-	chats := make([]string, maxRoleMembers+1)
-	for i := range chats {
-		chats[i] = "oc_test"
-	}
-	_, err := buildRoleMemberGroups("", "", strings.Join(chats, ","))
-	problem := assertRoleValidationParams(t, err, "--chats")
-	if !strings.Contains(problem.Message, "role members cannot exceed 100") {
-		t.Fatalf("message = %q, want role members limit", problem.Message)
-	}
-	if !strings.Contains(problem.Hint, "does not split") || !strings.Contains(problem.Hint, "atomic request") {
-		t.Fatalf("hint = %q, want no automatic batching guidance", problem.Hint)
-	}
-}
-
-func TestBuildRoleMemberGroupsOverflowNamesEveryContributingFlag(t *testing.T) {
-	users := strings.TrimSuffix(strings.Repeat("ou_user,", 60), ",")
-	chats := strings.TrimSuffix(strings.Repeat("oc_chat,", 41), ",")
-	_, err := buildRoleMemberGroups(users, "", chats)
-	assertRoleValidationParams(t, err, "--users", "--chats")
-}
-
-func TestRoleMemberKindsAreCompleteAndStable(t *testing.T) {
-	want := []roleMemberKind{
-		{memberType: "user", dataKey: "users", flagName: "--users", prefix: "ou_"},
-		{memberType: "department", dataKey: "departments", flagName: "--departments", prefix: "od-"},
-		{memberType: "chat", dataKey: "chats", flagName: "--chats", prefix: "oc_"},
-	}
-	if len(roleMemberKinds) != len(want) {
-		t.Fatalf("roleMemberKinds = %#v, want %#v", roleMemberKinds, want)
-	}
-	for index := range want {
-		if roleMemberKinds[index] != want[index] {
-			t.Fatalf("roleMemberKinds[%d] = %#v, want %#v", index, roleMemberKinds[index], want[index])
-		}
-	}
-}
-
-func TestRoleDisplayValueSanitizesAndFlattens(t *testing.T) {
-	got := roleDisplayValue("  Admin\n\x1b[31mred\x1b[0m\tvalue  ")
-	if got != "Admin red value" {
-		t.Fatalf("roleDisplayValue() = %q, want flattened safe text", got)
-	}
-}
-
-func TestRoleNextPageToken(t *testing.T) {
-	if got := roleNextPageToken(40, 20, true); got != "60" {
-		t.Fatalf("roleNextPageToken(hasMore) = %q, want 60", got)
-	}
-	if got := roleNextPageToken(40, 20, false); got != "" {
-		t.Fatalf("roleNextPageToken(!hasMore) = %q, want empty", got)
-	}
-}
-
-func TestWithRoleErrorHintUsesDocumentedRecoveryAndPreservesEnvelope(t *testing.T) {
-	tests := []struct {
-		name      string
-		code      int
-		operation roleErrorOperation
-		wantHint  string
-		forbid    string
-	}{
-		{name: "invalid parameters", code: roleErrInvalidParameters, operation: roleOperationList, wantHint: roleAppHint},
-		{name: "administrator required", code: roleErrAdminRequired, operation: roleOperationList, wantHint: "app administrator"},
-		{name: "administrator or developer required", code: roleErrManagerRequired, operation: roleOperationGet, wantHint: "administrator or app developer"},
-		{name: "invalid create role id", code: roleErrInvalidRoleID, operation: roleOperationCreate, wantHint: "omit --role-id"},
-		{name: "role missing", code: roleErrRoleNotFound, operation: roleOperationGet, wantHint: "+role-list"},
-		{name: "stale match role", code: roleErrRoleNotFound, operation: roleOperationMatchList, wantHint: "may no longer be valid", forbid: "--role-id"},
-		{name: "duplicate role id", code: roleErrRoleAlreadyExists, operation: roleOperationCreate, wantHint: "different --role-id"},
-		{name: "role limit", code: roleErrRoleLimitExceeded, operation: roleOperationCreate, wantHint: "delete an unused app role"},
-		{name: "invalid role name", code: roleErrInvalidRoleName, operation: roleOperationUpdate, wantHint: "adjust --name"},
-		{name: "invalid role description", code: roleErrInvalidRoleDescription, operation: roleOperationUpdate, wantHint: "adjust --description"},
-		{name: "unsupported member type", code: roleErrUnsupportedMemberType, operation: roleOperationMemberList, wantHint: "user, department, or chat"},
-		{name: "invalid member id", code: roleErrInvalidMemberID, operation: roleOperationMemberAdd, wantHint: "member IDs"},
-		{name: "invalid match target", code: roleErrInvalidMemberID, operation: roleOperationMatchList, wantHint: "--user-id", forbid: "--role-id"},
-		{name: "user quota", code: roleErrUserLimitExceeded, operation: roleOperationMemberAdd, wantHint: "reduce the users"},
-		{name: "department quota", code: roleErrDepartmentLimitExceeded, operation: roleOperationMemberAdd, wantHint: "reduce the departments"},
-		{name: "chat quota", code: roleErrChatLimitExceeded, operation: roleOperationMemberAdd, wantHint: "reduce the chats"},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			err := errclass.BuildAPIError(map[string]any{
-				"code":   tt.code,
-				"msg":    "role request failed",
-				"log_id": "log-role-hint",
-			}, errclass.ClassifyContext{Identity: "user"})
-			err = withRoleErrorHint(err, tt.operation)
-			problem, ok := errs.ProblemOf(err)
-			if !ok {
-				t.Fatalf("err = %#v, want typed problem", err)
-			}
-			if problem.Code != tt.code || problem.LogID != "log-role-hint" || problem.Retryable {
-				t.Fatalf("problem envelope changed: %+v", problem)
-			}
-			if !strings.Contains(problem.Hint, tt.wantHint) {
-				t.Fatalf("hint = %q, want substring %q", problem.Hint, tt.wantHint)
-			}
-			if tt.forbid != "" && strings.Contains(problem.Hint, tt.forbid) {
-				t.Fatalf("hint = %q, must not contain %q", problem.Hint, tt.forbid)
-			}
-		})
-	}
-}
-
-func TestWithRoleErrorHintPreservesServerDetail(t *testing.T) {
-	err := errclass.BuildAPIError(map[string]any{
-		"code": roleErrInvalidRoleName,
-		"msg":  "invalid role name",
-		"error": map[string]any{
-			"details": []any{map[string]any{"value": "name exceeds the service limit"}},
-		},
-	}, errclass.ClassifyContext{Identity: "user"})
-	err = withRoleErrorHint(err, roleOperationCreate)
-	problem, ok := errs.ProblemOf(err)
-	if !ok {
-		t.Fatalf("err = %#v, want typed problem", err)
-	}
-	for _, want := range []string{"name exceeds the service limit", "adjust --name"} {
-		if !strings.Contains(problem.Hint, want) {
-			t.Fatalf("hint = %q, want %q", problem.Hint, want)
-		}
-	}
-}
-
-func TestWithRoleErrorHintPreservesAuthorizationDetail(t *testing.T) {
-	var err error = errs.NewPermissionError(errs.SubtypePermissionDenied, "administrator access required").
-		WithCode(roleErrAdminRequired).
-		WithHint("server detail: only owners may change this app")
-	err = withRoleErrorHint(err, roleOperationUpdate)
-	problem, ok := errs.ProblemOf(err)
-	if !ok {
-		t.Fatalf("err = %#v, want typed problem", err)
-	}
-	for _, want := range []string{"server detail: only owners", "ask an app administrator"} {
-		if !strings.Contains(problem.Hint, want) {
-			t.Fatalf("hint = %q, want %q", problem.Hint, want)
-		}
-	}
-}