chore: ignore local agent workspace artifacts

.gitignore

@@ -55,3 +55,5 @@ cover*.out
 
 lark-env.sh
 /automations/
+/.agent-work/
+/.agents/

cmd/auth/login_messages.go

@@ -128,5 +128,5 @@ func getLoginMsg(lang i18n.Lang) *loginMsg {
 // (not backed by from_meta service specs). Descriptions are now centralized in
 // service_descriptions.json.
 func getShortcutOnlyDomainNames() []string {
-	return []string{"application", "base", "contact", "docs", "markdown", "apps", "note"}
+	return []string{"base", "contact", "docs", "markdown", "apps", "note"}
 }

internal/registry/registry_test.go

@@ -248,18 +248,10 @@ func TestLoadPlatformAutoApproveSet(t *testing.T) {
 
 func TestLoadOverrideAutoApproveAllow(t *testing.T) {
 	allowSet := LoadOverrideAutoApproveAllow()
-	// recommend.allow special-cases scopes absent from scope_priorities.json
-	// (application v7 is not in the platform catalog yet) so interactive
-	// login's "common scopes" tier still offers them. Only the read scope is
-	// admitted: write stays out of the recommended tier by design.
-	if !allowSet["application:app_slash_command:read"] {
-		t.Error("expected application:app_slash_command:read in override allow set")
-	}
-	if allowSet["application:app_slash_command:write"] {
-		t.Error("write scope must NOT be in the recommended tier")
-	}
-	if len(allowSet) != 1 {
-		t.Errorf("expected exactly 1 override allow entry, got %d", len(allowSet))
+	// recommend.allow in scope_overrides.json is intentionally empty:
+	// no scopes are special-cased into the auto-approve set anymore.
+	if len(allowSet) != 0 {
+		t.Errorf("expected empty override allow set, got %d entries", len(allowSet))
 	}
 }
 

internal/registry/scope_overrides.json

@@ -12,9 +12,7 @@
     "vc:meeting.meetingevent:read": 75
   },
   "recommend": {
-    "allow": [
-      "application:app_slash_command:read"
-    ],
+    "allow": [],
     "deny": [
       "im:chat",
       "im:message.send_as_user"

internal/registry/service_descriptions.json

@@ -3,10 +3,6 @@
     "en": { "title": "Approval", "description": "Approval instance, and task management" },
     "zh": { "title": "审批", "description": "审批实例、审批任务管理" }
   },
-  "application": {
-    "en": { "title": "Application", "description": "Open Platform app self-management: slash commands of the current bound app (NOT Miaoda low-code apps)" },
-    "zh": { "title": "应用管理", "description": "开放平台应用自管理：当前绑定应用的斜杠指令管理（非妙搭低代码应用）" }
-  },
   "apps": {
     "en": { "title": "Apps", "description": "Develop, deploy HTML, web pages and applications" },
     "zh": { "title": "应用", "description": "开发、部署 HTML、Web 页面和应用" }

shortcuts/application/shortcuts.go

@@ -1,18 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-// Package application provides shortcuts for Open Platform app
-// self-management (slash commands of the current bound app).
-package application
-
-import "github.com/larksuite/cli/shortcuts/common"
-
-// Shortcuts returns all shortcuts of the application domain.
-func Shortcuts() []common.Shortcut {
-	return []common.Shortcut{
-		SlashCommandList,
-		SlashCommandCreate,
-		SlashCommandUpdate,
-		SlashCommandDelete,
-	}
-}

shortcuts/application/slash_command_common.go

@@ -1,98 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package application
-
-import (
-	"strings"
-
-	"github.com/larksuite/cli/errs"
-)
-
-// slashCommandBasePath is the raw v7 endpoint (not in meta_data.json / SDK).
-const slashCommandBasePath = "/open-apis/application/v7/app_slash_commands"
-
-// clientCacheHint is printed to stderr after every successful write.
-const clientCacheHint = "note: changes take ~5 minutes to appear in Feishu clients (client-side cache); the server state is already updated - list reflects it immediately."
-
-// parseDescriptionI18n parses repeated --description-i18n values ("<lang>=<text>",
-// split on the FIRST '='). Returns nil for empty input. Duplicate langs rejected.
-func parseDescriptionI18n(values []string) (map[string]string, error) {
-	if len(values) == 0 {
-		return nil, nil
-	}
-	m := make(map[string]string, len(values))
-	for _, v := range values {
-		idx := strings.Index(v, "=")
-		if idx <= 0 || idx == len(v)-1 {
-			return nil, errs.NewValidationError(errs.SubtypeInvalidArgument,
-				"invalid --description-i18n value %q: expected <lang>=<text> (e.g. zh_cn=你好)", v).
-				WithParam("--description-i18n")
-		}
-		lang := strings.TrimSpace(v[:idx])
-		text := v[idx+1:]
-		if lang == "" || strings.TrimSpace(text) == "" {
-			return nil, errs.NewValidationError(errs.SubtypeInvalidArgument,
-				"invalid --description-i18n value %q: language and text must be non-empty", v).
-				WithParam("--description-i18n")
-		}
-		if _, dup := m[lang]; dup {
-			return nil, errs.NewValidationError(errs.SubtypeInvalidArgument,
-				"duplicate language %q in --description-i18n", lang).
-				WithParam("--description-i18n")
-		}
-		m[lang] = text
-	}
-	return m, nil
-}
-
-// validateCommandName rejects empty and slash-prefixed command names.
-func validateCommandName(name, flagName string) error {
-	trimmed := strings.TrimSpace(name)
-	if trimmed == "" {
-		return errs.NewValidationError(errs.SubtypeInvalidArgument,
-			"%s must not be empty", flagName).WithParam(flagName)
-	}
-	if strings.HasPrefix(trimmed, "/") {
-		return errs.NewValidationError(errs.SubtypeInvalidArgument,
-			"%s must not start with \"/\" - the slash is implied (use %q)",
-			flagName, strings.TrimPrefix(trimmed, "/")).WithParam(flagName)
-	}
-	return nil
-}
-
-// buildSlashCommandBody assembles a create/update request body. Only provided
-// fields are included: PATCH is field-level partial (absent top-level fields
-// are preserved server-side; a provided i18n map REPLACES the whole map).
-// icon sits at the top level, sibling of description (verified live; the
-// official create sample nesting icon inside description is a doc bug).
-func buildSlashCommandBody(command, description string, i18n map[string]string, iconKey string) map[string]interface{} {
-	body := map[string]interface{}{}
-	if command != "" {
-		body["command"] = command
-	}
-	if description != "" || len(i18n) > 0 {
-		desc := map[string]interface{}{}
-		if description != "" {
-			desc["default_value"] = description
-		}
-		if len(i18n) > 0 {
-			desc["i18n"] = i18n
-		}
-		body["description"] = desc
-	}
-	if iconKey != "" {
-		body["icon"] = map[string]interface{}{"icon_key": iconKey}
-	}
-	return body
-}
-
-// isCommandExists reports whether err is the server-side name-collision error
-// (code=40000000, message contains "command already exists"; verified live).
-func isCommandExists(err error) bool {
-	p, ok := errs.ProblemOf(err)
-	if !ok {
-		return false
-	}
-	return strings.Contains(p.Message, "command already exists")
-}

shortcuts/application/slash_command_common_test.go

@@ -1,155 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package application
-
-import (
-	"strings"
-	"testing"
-
-	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/shortcuts/common"
-)
-
-func TestParseDescriptionI18n_OK(t *testing.T) {
-	m, err := parseDescriptionI18n([]string{"zh_cn=你好", "en_us=Hello=World"})
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if m["zh_cn"] != "你好" {
-		t.Errorf("zh_cn = %q", m["zh_cn"])
-	}
-	// 只按首个 = 分割：值内可含 =
-	if m["en_us"] != "Hello=World" {
-		t.Errorf("en_us = %q", m["en_us"])
-	}
-}
-
-func TestParseDescriptionI18n_Empty(t *testing.T) {
-	m, err := parseDescriptionI18n(nil)
-	if err != nil || m != nil {
-		t.Fatalf("nil input: m=%v err=%v", m, err)
-	}
-}
-
-func TestParseDescriptionI18n_BadFormat(t *testing.T) {
-	for _, bad := range []string{"zh_cn", "=text", "zh_cn=", "  =x"} {
-		_, err := parseDescriptionI18n([]string{bad})
-		if err == nil {
-			t.Errorf("%q: expected error", bad)
-			continue
-		}
-		p, ok := errs.ProblemOf(err)
-		if !ok || p.Category != errs.CategoryValidation {
-			t.Errorf("%q: expected validation problem, got %v", bad, err)
-		}
-	}
-}
-
-func TestParseDescriptionI18n_DuplicateLang(t *testing.T) {
-	_, err := parseDescriptionI18n([]string{"zh_cn=a", "zh_cn=b"})
-	if err == nil || !strings.Contains(err.Error(), "duplicate language") {
-		t.Fatalf("expected duplicate language error, got %v", err)
-	}
-}
-
-func TestValidateCommandName(t *testing.T) {
-	if err := validateCommandName("greet", "--command"); err != nil {
-		t.Fatalf("greet: %v", err)
-	}
-	for _, bad := range []string{"", "  ", "/greet"} {
-		if err := validateCommandName(bad, "--command"); err == nil {
-			t.Errorf("%q: expected error", bad)
-		}
-	}
-}
-
-func TestBuildSlashCommandBody(t *testing.T) {
-	body := buildSlashCommandBody("greet", "hi", map[string]string{"zh_cn": "你好"}, "skill_outlined")
-	if body["command"] != "greet" {
-		t.Errorf("command = %v", body["command"])
-	}
-	desc := body["description"].(map[string]interface{})
-	if desc["default_value"] != "hi" {
-		t.Errorf("default_value = %v", desc["default_value"])
-	}
-	if desc["i18n"].(map[string]string)["zh_cn"] != "你好" {
-		t.Errorf("i18n = %v", desc["i18n"])
-	}
-	// icon 与 description 顶层平级（实测钉死，文档 create 示例是笔误）
-	if body["icon"].(map[string]interface{})["icon_key"] != "skill_outlined" {
-		t.Errorf("icon = %v", body["icon"])
-	}
-	// partial：不提供的字段不出现（PATCH 语义依赖）
-	partial := buildSlashCommandBody("", "", nil, "skill_outlined")
-	if _, has := partial["command"]; has {
-		t.Error("empty command must be omitted")
-	}
-	if _, has := partial["description"]; has {
-		t.Error("empty description must be omitted")
-	}
-}
-
-// TestSlashCommandShortcuts_SharedScopesAcrossIdentities locks in the
-// reversal of the OAuth-isolation design: all four slash-command shortcuts
-// declare identical scopes for the bot and user identities (plain Scopes /
-// ConditionalScopes, no per-identity overrides), so a user-identity
-// pre-flight sees the same scope set a bot identity would.
-func TestSlashCommandShortcuts_SharedScopesAcrossIdentities(t *testing.T) {
-	cases := []struct {
-		name            string
-		shortcut        common.Shortcut
-		wantScope       string
-		wantConditional string
-		hasConditional  bool
-	}{
-		{
-			name:      "list",
-			shortcut:  SlashCommandList,
-			wantScope: "application:app_slash_command:read",
-		},
-		{
-			name:            "create",
-			shortcut:        SlashCommandCreate,
-			wantScope:       "application:app_slash_command:write",
-			wantConditional: "application:app_slash_command:read",
-			hasConditional:  true,
-		},
-		{
-			name:            "update",
-			shortcut:        SlashCommandUpdate,
-			wantScope:       "application:app_slash_command:write",
-			wantConditional: "application:app_slash_command:read",
-			hasConditional:  true,
-		},
-		{
-			name:            "delete",
-			shortcut:        SlashCommandDelete,
-			wantScope:       "application:app_slash_command:write",
-			wantConditional: "application:app_slash_command:read",
-			hasConditional:  true,
-		},
-	}
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			for _, identity := range []string{"user", "bot"} {
-				declared := tc.shortcut.DeclaredScopesForIdentity(identity)
-				if !containsStr(declared, tc.wantScope) {
-					t.Errorf("%s: DeclaredScopesForIdentity(%q) = %v, want to contain %q", tc.name, identity, declared, tc.wantScope)
-				}
-				if tc.hasConditional && !containsStr(declared, tc.wantConditional) {
-					t.Errorf("%s: DeclaredScopesForIdentity(%q) = %v, want to contain conditional %q", tc.name, identity, declared, tc.wantConditional)
-				}
-			}
-		})
-	}
-}
-
-func containsStr(list []string, want string) bool {
-	for _, v := range list {
-		if v == want {
-			return true
-		}
-	}
-	return false
-}

shortcuts/application/slash_command_create.go

@@ -1,117 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package application
-
-import (
-	"context"
-	"fmt"
-	"io"
-	"strings"
-
-	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/validate"
-	"github.com/larksuite/cli/shortcuts/common"
-)
-
-// SlashCommandCreate registers a new slash command on the current bound app.
-var SlashCommandCreate = common.Shortcut{
-	Service:     "application",
-	Command:     "+slash-command-create",
-	Description: "Register a slash command (/ command) on the current bound Open Platform app; --force converts a name collision into an update (idempotent re-run)",
-	Risk:        "write",
-	Scopes:      []string{"application:app_slash_command:write"},
-	ConditionalScopes: []string{
-		"application:app_slash_command:read", // only the --force collision path lists to resolve the id
-	},
-	AuthTypes: []string{"bot", "user"},
-	Flags: []common.Flag{
-		{Name: "command", Desc: "command name WITHOUT the leading slash (server enforces uniqueness per app; max 100 commands)", Required: true},
-		{Name: "description", Desc: "default description shown in the client command panel (description.default_value)", Required: true},
-		{Name: "description-i18n", Type: "string_array", Desc: "localized description, repeatable, format <lang>=<text> (e.g. zh_cn=发送问候); language codes are passed through to the server"},
-		{Name: "icon-key", Desc: "icon key (server default: skill_outlined; invalid keys are rejected server-side with code 40000031)"},
-		{Name: "force", Type: "bool", Desc: "on name collision, resolve the existing command by name and PATCH it instead (like `gh label create --force`)"},
-	},
-	Tips: []string{
-		`lark-cli application +slash-command-create --command greet --description "say hi" --description-i18n zh_cn=问候 --as bot`,
-		"changes take ~5 minutes to appear in clients (client-side cache); the server updates immediately",
-		"user identity needs explicit authorization first: lark-cli auth login --scope application:app_slash_command:write",
-	},
-	Validate: func(ctx context.Context, runtime *common.RuntimeContext) error {
-		if err := validateCommandName(runtime.Str("command"), "--command"); err != nil {
-			return err
-		}
-		if len(strings.TrimSpace(runtime.Str("description"))) == 0 {
-			return errs.NewValidationError(errs.SubtypeInvalidArgument,
-				"--description must not be blank").WithParam("--description")
-		}
-		if _, err := parseDescriptionI18n(runtime.StrArray("description-i18n")); err != nil {
-			return err
-		}
-		return nil
-	},
-	DryRun: func(ctx context.Context, runtime *common.RuntimeContext) *common.DryRunAPI {
-		i18n, err := parseDescriptionI18n(runtime.StrArray("description-i18n"))
-		if err != nil {
-			return common.NewDryRunAPI().Set("error", err.Error())
-		}
-		body := buildSlashCommandBody(runtime.Str("command"), runtime.Str("description"), i18n, runtime.Str("icon-key"))
-		d := common.NewDryRunAPI().
-			Desc("Create a slash command on the current bound app").
-			POST(slashCommandBasePath).
-			Body(body)
-		if runtime.Bool("force") {
-			d.Desc("--force: on 'command already exists' (code 40000000), GET list to resolve command_id then PATCH the same body")
-		}
-		return d
-	},
-	Execute: func(ctx context.Context, runtime *common.RuntimeContext) error {
-		name := runtime.Str("command")
-		i18n, err := parseDescriptionI18n(runtime.StrArray("description-i18n"))
-		if err != nil {
-			return err
-		}
-		body := buildSlashCommandBody(name, runtime.Str("description"), i18n, runtime.Str("icon-key"))
-
-		data, err := runtime.CallAPITyped("POST", slashCommandBasePath, nil, body)
-		action := "created"
-		if err != nil {
-			if !isCommandExists(err) {
-				return err
-			}
-			if !runtime.Bool("force") {
-				p, _ := errs.ProblemOf(err)
-				rewrapped := errs.NewAPIError(p.Subtype, "slash command %q already exists", name).
-					WithHint("rerun with --force to update it, or use `lark-cli application +slash-command-update --command %q`", name).
-					WithCause(err)
-				if p.Code != 0 {
-					rewrapped = rewrapped.WithCode(p.Code)
-				}
-				if p.LogID != "" {
-					rewrapped = rewrapped.WithLogID(p.LogID)
-				}
-				return rewrapped
-			}
-			// --force: name collision -> resolve id -> PATCH (idempotent re-run).
-			id, _, rerr := resolveCommandID(runtime, name)
-			if rerr != nil {
-				return rerr
-			}
-			patchBody := buildSlashCommandBody("", runtime.Str("description"), i18n, runtime.Str("icon-key"))
-			data, err = runtime.CallAPITyped("PATCH", slashCommandBasePath+"/"+validate.EncodePathSegment(id), nil, patchBody)
-			if err != nil {
-				return err
-			}
-			action = "updated"
-		}
-		if data == nil {
-			data = map[string]interface{}{}
-		}
-		data["action"] = action
-		fmt.Fprintln(runtime.IO().ErrOut, clientCacheHint)
-		runtime.OutFormat(data, nil, func(w io.Writer) {
-			fmt.Fprintf(w, "%s /%v (command_id: %v)\n", action, data["command"], data["command_id"])
-		})
-		return nil
-	},
-}

shortcuts/application/slash_command_create_test.go

@@ -1,182 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package application
-
-import (
-	"encoding/json"
-	"errors"
-	"strings"
-	"testing"
-
-	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/httpmock"
-)
-
-func createOKStub() *httpmock.Stub {
-	return &httpmock.Stub{
-		Method: "POST",
-		URL:    "/open-apis/application/v7/app_slash_commands",
-		Body: map[string]interface{}{
-			"code": 0, "msg": "success",
-			"data": sampleItem("greet", "id-new"),
-		},
-	}
-}
-
-func createConflictStub() *httpmock.Stub {
-	return &httpmock.Stub{
-		Method: "POST",
-		URL:    "/open-apis/application/v7/app_slash_commands",
-		Body: map[string]interface{}{
-			"code": 40000000, "msg": "Invalid Param 'command'. command already exists.",
-		},
-	}
-}
-
-func patchOKStub(id string) *httpmock.Stub {
-	return &httpmock.Stub{
-		Method: "PATCH",
-		URL:    "/open-apis/application/v7/app_slash_commands/" + id,
-		Body: map[string]interface{}{
-			"code": 0, "msg": "success",
-			"data": sampleItem("greet", id),
-		},
-	}
-}
-
-func TestSlashCommandCreate_OK(t *testing.T) {
-	f, stdout, _, reg := cmdutil.TestFactory(t, appTestConfig())
-	reg.Register(createOKStub())
-
-	err := mountAndRun(t, SlashCommandCreate, []string{"+slash-command-create",
-		"--command", "greet", "--description", "hi",
-		"--description-i18n", "zh_cn=你好", "--description-i18n", "en_us=Hello",
-		"--icon-key", "skill_outlined", "--format", "json", "--as", "bot"}, f, stdout)
-	if err != nil {
-		t.Fatalf("execute: %v", err)
-	}
-	var got map[string]interface{}
-	if err := json.Unmarshal(stdout.Bytes(), &got); err != nil {
-		t.Fatalf("json: %v\n%s", err, stdout.String())
-	}
-	data := got["data"].(map[string]interface{})
-	if data["action"] != "created" {
-		t.Fatalf("action = %v", data["action"])
-	}
-	if data["command_id"] != "id-new" {
-		t.Fatalf("command_id = %v", data["command_id"])
-	}
-}
-
-func TestSlashCommandCreate_ValidateRejects(t *testing.T) {
-	f, stdout, _, _ := cmdutil.TestFactory(t, appTestConfig())
-	cases := [][]string{
-		{"+slash-command-create", "--command", "/greet", "--description", "hi", "--as", "bot"},
-		{"+slash-command-create", "--command", "greet", "--description", "hi", "--description-i18n", "bad", "--as", "bot"},
-		{"+slash-command-create", "--command", "greet", "--description", "hi", "--description-i18n", "zh_cn=a", "--description-i18n", "zh_cn=b", "--as", "bot"},
-		{"+slash-command-create", "--command", "greet", "--description", "  ", "--as", "bot"},
-	}
-	for i, args := range cases {
-		err := mountAndRun(t, SlashCommandCreate, args, f, stdout)
-		if err == nil {
-			t.Errorf("case %d: expected validation error", i)
-			continue
-		}
-		p, ok := errs.ProblemOf(err)
-		if !ok || p.Category != errs.CategoryValidation {
-			t.Errorf("case %d: expected validation problem, got %v", i, err)
-		}
-	}
-}
-
-func TestSlashCommandCreate_ConflictNoForce(t *testing.T) {
-	f, stdout, _, reg := cmdutil.TestFactory(t, appTestConfig())
-	reg.Register(createConflictStub())
-
-	err := mountAndRun(t, SlashCommandCreate, []string{"+slash-command-create",
-		"--command", "greet", "--description", "hi", "--as", "bot"}, f, stdout)
-	if err == nil {
-		t.Fatal("expected conflict error")
-	}
-	p, _ := errs.ProblemOf(err)
-	if !strings.Contains(p.Hint, "--force") || !strings.Contains(p.Hint, "+slash-command-update") {
-		t.Fatalf("hint must offer --force and update, got %q", p.Hint)
-	}
-	var apiErr *errs.APIError
-	if !errors.As(err, &apiErr) {
-		t.Fatalf("rewrapped error must be *errs.APIError, got %T", err)
-	}
-	if errors.Unwrap(apiErr) == nil {
-		t.Fatal("rewrapped conflict error must preserve the original cause via WithCause")
-	}
-}
-
-func TestSlashCommandCreate_ForceConvertsToUpdate(t *testing.T) {
-	f, stdout, _, reg := cmdutil.TestFactory(t, appTestConfig())
-	reg.Register(createConflictStub())
-	reg.Register(listStub([]interface{}{sampleItem("greet", "id-exist")}))
-	reg.Register(patchOKStub("id-exist"))
-
-	err := mountAndRun(t, SlashCommandCreate, []string{"+slash-command-create",
-		"--command", "greet", "--description", "hi2", "--force", "--format", "json", "--as", "bot"}, f, stdout)
-	if err != nil {
-		t.Fatalf("execute: %v", err)
-	}
-	var got map[string]interface{}
-	if err := json.Unmarshal(stdout.Bytes(), &got); err != nil {
-		t.Fatalf("json: %v", err)
-	}
-	data := got["data"].(map[string]interface{})
-	if data["action"] != "updated" {
-		t.Fatalf("action = %v (force must convert to update)", data["action"])
-	}
-}
-
-func createIconInvalidStub() *httpmock.Stub {
-	return &httpmock.Stub{
-		Method: "POST",
-		URL:    "/open-apis/application/v7/app_slash_commands",
-		Body: map[string]interface{}{
-			"code": 40000031, "msg": "Invalid Param 'icon_key'. icon_key is invalid.",
-		},
-	}
-}
-
-// TestSlashCommandCreate_ForceDoesNotConvertNonConflict guards against --force
-// blindly treating ANY POST failure as a name collision: only the
-// "command already exists" (40000000) shape may fall through to the
-// GET+PATCH idempotent-update path. No PATCH stub is registered here, so if
-// the code mistakenly attempted a PATCH, the httpmock registry would fail
-// the unexpected request and surface a different (registry) error instead
-// of the original icon_key failure asserted below.
-func TestSlashCommandCreate_ForceDoesNotConvertNonConflict(t *testing.T) {
-	f, stdout, _, reg := cmdutil.TestFactory(t, appTestConfig())
-	reg.Register(createIconInvalidStub())
-
-	err := mountAndRun(t, SlashCommandCreate, []string{"+slash-command-create",
-		"--command", "greet", "--description", "hi", "--icon-key", "bogus", "--force", "--as", "bot"}, f, stdout)
-	if err == nil {
-		t.Fatal("expected the original icon_key error, got nil")
-	}
-	if !strings.Contains(err.Error(), "icon_key") {
-		t.Fatalf("expected original icon_key failure to surface unchanged, got %v", err)
-	}
-}
-
-func TestSlashCommandCreate_DryRun(t *testing.T) {
-	f, stdout, _, _ := cmdutil.TestFactory(t, appTestConfig())
-	if err := mountAndRun(t, SlashCommandCreate, []string{"+slash-command-create",
-		"--command", "greet", "--description", "hi", "--icon-key", "skill_outlined", "--dry-run", "--as", "bot"}, f, stdout); err != nil {
-		t.Fatalf("execute: %v", err)
-	}
-	out := stdout.String()
-	if !strings.Contains(out, "POST") || !strings.Contains(out, slashCommandBasePath) {
-		t.Fatalf("dry-run must show POST path: %s", out)
-	}
-	// icon 顶层：dry-run body 里 icon 不嵌套在 description 内
-	if !strings.Contains(out, "icon_key") {
-		t.Fatalf("dry-run must include body: %s", out)
-	}
-}

shortcuts/application/slash_command_delete.go

@@ -1,83 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package application
-
-import (
-	"context"
-	"fmt"
-	"io"
-	"strings"
-
-	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/validate"
-	"github.com/larksuite/cli/shortcuts/common"
-)
-
-// SlashCommandDelete removes a slash command (irreversible; command_id is not
-// reused - recreating the same name yields a NEW id).
-var SlashCommandDelete = common.Shortcut{
-	Service:     "application",
-	Command:     "+slash-command-delete",
-	Description: "Delete a slash command from the current bound app (high-risk: irreversible; recreating the same name yields a new command_id)",
-	Risk:        "high-risk-write",
-	Scopes:      []string{"application:app_slash_command:write"},
-	ConditionalScopes: []string{
-		"application:app_slash_command:read", // only the --command by-name path
-	},
-	AuthTypes: []string{"bot", "user"},
-	Flags: []common.Flag{
-		{Name: "command-id", Desc: "target command_id; mutually exclusive with --command"},
-		{Name: "command", Desc: "target command name WITHOUT leading slash (resolved via live list, needs read scope); mutually exclusive with --command-id"},
-	},
-	Tips: []string{
-		"lark-cli application +slash-command-delete --command greet --yes --as bot",
-		"deleted commands may linger in clients for ~5 minutes (client cache)",
-	},
-	Validate: func(ctx context.Context, runtime *common.RuntimeContext) error {
-		id := strings.TrimSpace(runtime.Str("command-id"))
-		name := strings.TrimSpace(runtime.Str("command"))
-		if (id == "") == (name == "") {
-			return errs.NewValidationError(errs.SubtypeInvalidArgument,
-				"provide exactly one of --command-id or --command").WithParam("--command-id")
-		}
-		if name != "" {
-			return validateCommandName(name, "--command")
-		}
-		return nil
-	},
-	DryRun: func(ctx context.Context, runtime *common.RuntimeContext) *common.DryRunAPI {
-		d := common.NewDryRunAPI().Desc("HIGH-RISK: delete a slash command (irreversible; same-name recreate gets a NEW command_id)")
-		target := runtime.Str("command-id")
-		if target == "" {
-			d.GET(slashCommandBasePath).
-				Desc(fmt.Sprintf("resolve command_id by name %q via GET list first", runtime.Str("command")))
-			target = "<resolved_command_id>"
-		}
-		return d.DELETE(slashCommandBasePath + "/" + target)
-	},
-	Execute: func(ctx context.Context, runtime *common.RuntimeContext) error {
-		id := strings.TrimSpace(runtime.Str("command-id"))
-		name := strings.TrimSpace(runtime.Str("command"))
-		if id == "" {
-			resolved, _, err := resolveCommandID(runtime, name)
-			if err != nil {
-				return err
-			}
-			id = resolved
-		}
-		if _, err := runtime.CallAPITyped("DELETE", slashCommandBasePath+"/"+validate.EncodePathSegment(id), nil, nil); err != nil {
-			return err
-		}
-		out := map[string]interface{}{"action": "deleted", "command_id": id}
-		if name != "" {
-			out["command"] = name
-		}
-		fmt.Fprintln(runtime.IO().ErrOut, clientCacheHint)
-		fmt.Fprintln(runtime.IO().ErrOut, "note: recreating the same command name will yield a NEW command_id.")
-		runtime.OutFormat(out, nil, func(w io.Writer) {
-			fmt.Fprintf(w, "deleted command_id %s\n", id)
-		})
-		return nil
-	},
-}

shortcuts/application/slash_command_delete_test.go

@@ -1,109 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package application
-
-import (
-	"encoding/json"
-	"strings"
-	"testing"
-
-	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/httpmock"
-)
-
-func deleteOKStub(id string) *httpmock.Stub {
-	return &httpmock.Stub{
-		Method: "DELETE",
-		URL:    slashCommandBasePath + "/" + id,
-		Body:   map[string]interface{}{"code": 0, "msg": "success", "data": map[string]interface{}{}},
-	}
-}
-
-func TestSlashCommandDelete_RequiresYes(t *testing.T) {
-	f, stdout, _, _ := cmdutil.TestFactory(t, appTestConfig())
-	err := mountAndRun(t, SlashCommandDelete, []string{"+slash-command-delete",
-		"--command-id", "id1", "--as", "bot"}, f, stdout)
-	if err == nil {
-		t.Fatal("expected confirmation_required without --yes")
-	}
-	if errs.CategoryOf(err) != errs.CategoryConfirmation {
-		t.Fatalf("expected confirmation category, got %v (%v)", errs.CategoryOf(err), err)
-	}
-}
-
-func TestSlashCommandDelete_ByIDWithYes(t *testing.T) {
-	f, stdout, _, reg := cmdutil.TestFactory(t, appTestConfig())
-	reg.Register(deleteOKStub("id1"))
-
-	err := mountAndRun(t, SlashCommandDelete, []string{"+slash-command-delete",
-		"--command-id", "id1", "--yes", "--format", "json", "--as", "bot"}, f, stdout)
-	if err != nil {
-		t.Fatalf("execute: %v", err)
-	}
-	var got map[string]interface{}
-	if err := json.Unmarshal(stdout.Bytes(), &got); err != nil {
-		t.Fatalf("json: %v", err)
-	}
-	data := got["data"].(map[string]interface{})
-	// 上游 DELETE 返回空对象；CLI 必须补 action/command_id（写操作返回资源 ID）
-	if data["action"] != "deleted" || data["command_id"] != "id1" {
-		t.Fatalf("data = %v", data)
-	}
-}
-
-func TestSlashCommandDelete_ByNameWithYes(t *testing.T) {
-	f, stdout, _, reg := cmdutil.TestFactory(t, appTestConfig())
-	reg.Register(listStub([]interface{}{sampleItem("greet", "id7")}))
-	reg.Register(deleteOKStub("id7"))
-
-	err := mountAndRun(t, SlashCommandDelete, []string{"+slash-command-delete",
-		"--command", "greet", "--yes", "--format", "json", "--as", "bot"}, f, stdout)
-	if err != nil {
-		t.Fatalf("execute: %v", err)
-	}
-	var got map[string]interface{}
-	_ = json.Unmarshal(stdout.Bytes(), &got)
-	data := got["data"].(map[string]interface{})
-	if data["command"] != "greet" || data["command_id"] != "id7" {
-		t.Fatalf("data = %v", data)
-	}
-}
-
-func TestSlashCommandDelete_ByNameDryRun(t *testing.T) {
-	f, stdout, _, _ := cmdutil.TestFactory(t, appTestConfig())
-
-	err := mountAndRun(t, SlashCommandDelete, []string{"+slash-command-delete",
-		"--command", "greet", "--dry-run", "--as", "bot"}, f, stdout)
-	if err != nil {
-		t.Fatalf("execute: %v", err)
-	}
-	out := stdout.String()
-	// 两条 Desc 都必须保留：top-level HIGH-RISK 说明和 GET 调用的 resolve 说明
-	// 不能被覆盖（DryRunAPI.Desc 在没有 call 时设置 top-level，append 后设置 per-call）。
-	if !strings.Contains(out, "HIGH-RISK") {
-		t.Fatalf("dry-run must keep top-level HIGH-RISK desc: %s", out)
-	}
-	if !strings.Contains(out, "resolve command_id") {
-		t.Fatalf("dry-run must keep per-call resolve desc: %s", out)
-	}
-}
-
-func TestSlashCommandDelete_Validate(t *testing.T) {
-	f, stdout, _, _ := cmdutil.TestFactory(t, appTestConfig())
-	for _, args := range [][]string{
-		{"+slash-command-delete", "--yes", "--as", "bot"},
-		{"+slash-command-delete", "--command-id", "id1", "--command", "greet", "--yes", "--as", "bot"},
-	} {
-		err := mountAndRun(t, SlashCommandDelete, args, f, stdout)
-		if err == nil {
-			t.Errorf("%v: expected validation error", args)
-			continue
-		}
-		p, ok := errs.ProblemOf(err)
-		if !ok || p.Category != errs.CategoryValidation {
-			t.Errorf("%v: expected validation problem, got %v", args, err)
-		}
-	}
-}

shortcuts/application/slash_command_list.go

@@ -1,58 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package application
-
-import (
-	"context"
-	"fmt"
-	"io"
-
-	"github.com/larksuite/cli/shortcuts/common"
-)
-
-// SlashCommandList lists all slash commands of the current bound app.
-var SlashCommandList = common.Shortcut{
-	Service:     "application",
-	Command:     "+slash-command-list",
-	Description: "List all slash commands (/ commands) registered on the current bound Open Platform app; source of command_id for update/delete (NOT for Miaoda apps - use the apps domain for those)",
-	Risk:        "read",
-	Scopes:      []string{"application:app_slash_command:read"},
-	AuthTypes:   []string{"bot", "user"},
-	Tips: []string{
-		"lark-cli application +slash-command-list --as bot",
-		"user identity needs explicit authorization first: lark-cli auth login --scope application:app_slash_command:read",
-		"the upstream API returns all commands at once (max 100 per app, no pagination)",
-	},
-	DryRun: func(ctx context.Context, runtime *common.RuntimeContext) *common.DryRunAPI {
-		return common.NewDryRunAPI().
-			Desc("List all slash commands of the current bound app (read-only)").
-			GET(slashCommandBasePath)
-	},
-	Execute: func(ctx context.Context, runtime *common.RuntimeContext) error {
-		data, err := runtime.CallAPITyped("GET", slashCommandBasePath, nil, nil)
-		if err != nil {
-			return err
-		}
-		items, _ := data["items"].([]interface{})
-		if items == nil {
-			items = []interface{}{}
-		}
-		out := map[string]interface{}{"items": items, "count": len(items)}
-		runtime.OutFormat(out, nil, func(w io.Writer) {
-			fmt.Fprintf(w, "%d slash command(s)\n", len(items))
-			for _, it := range items {
-				m, ok := it.(map[string]interface{})
-				if !ok {
-					continue
-				}
-				desc := ""
-				if d, ok := m["description"].(map[string]interface{}); ok {
-					desc, _ = d["default_value"].(string)
-				}
-				fmt.Fprintf(w, "  /%v\t%v\t%s\n", m["command"], m["command_id"], desc)
-			}
-		})
-		return nil
-	},
-}

shortcuts/application/slash_command_list_test.go

@@ -1,115 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package application
-
-import (
-	"bytes"
-	"encoding/json"
-	"strings"
-	"testing"
-
-	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
-	"github.com/larksuite/cli/internal/httpmock"
-	"github.com/larksuite/cli/shortcuts/common"
-	"github.com/spf13/cobra"
-)
-
-func appTestConfig() *core.CliConfig {
-	return &core.CliConfig{AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu}
-}
-
-// mountAndRun mounts the shortcut under a parent cobra command and runs it.
-// Mirrors shortcuts/contact tests.
-func mountAndRun(t *testing.T, s common.Shortcut, args []string, f *cmdutil.Factory, stdout *bytes.Buffer) error {
-	t.Helper()
-	parent := &cobra.Command{Use: "application"}
-	s.Mount(parent, f)
-	parent.SetArgs(args)
-	parent.SilenceErrors = true
-	parent.SilenceUsage = true
-	if stdout != nil {
-		stdout.Reset()
-	}
-	return parent.Execute()
-}
-
-func listStub(items []interface{}) *httpmock.Stub {
-	return &httpmock.Stub{
-		Method: "GET",
-		URL:    "/open-apis/application/v7/app_slash_commands",
-		Body: map[string]interface{}{
-			"code": 0, "msg": "success",
-			"data": map[string]interface{}{"items": items},
-		},
-	}
-}
-
-func sampleItem(name, id string) map[string]interface{} {
-	return map[string]interface{}{
-		"command": name, "command_id": id,
-		"create_time": "1783318553", "update_time": "1783318553",
-		"description": map[string]interface{}{"default_value": "desc of " + name},
-		"icon":        map[string]interface{}{"icon_key": "skill_outlined"},
-	}
-}
-
-func TestSlashCommandList_JSON(t *testing.T) {
-	f, stdout, _, reg := cmdutil.TestFactory(t, appTestConfig())
-	reg.Register(listStub([]interface{}{sampleItem("greet", "id1"), sampleItem("weather", "id2")}))
-
-	if err := mountAndRun(t, SlashCommandList, []string{"+slash-command-list", "--format", "json", "--as", "bot"}, f, stdout); err != nil {
-		t.Fatalf("execute: %v", err)
-	}
-	var got map[string]interface{}
-	if err := json.Unmarshal(stdout.Bytes(), &got); err != nil {
-		t.Fatalf("json: %v\n%s", err, stdout.String())
-	}
-	data := got["data"].(map[string]interface{})
-	items := data["items"].([]interface{})
-	if len(items) != 2 {
-		t.Fatalf("items = %d", len(items))
-	}
-	if data["count"] != float64(2) {
-		t.Fatalf("count = %v", data["count"])
-	}
-	first := items[0].(map[string]interface{})
-	for _, k := range []string{"command", "command_id", "description", "icon", "create_time", "update_time"} {
-		if _, ok := first[k]; !ok {
-			t.Errorf("missing item key %q", k)
-		}
-	}
-}
-
-func TestSlashCommandList_Empty(t *testing.T) {
-	f, stdout, _, reg := cmdutil.TestFactory(t, appTestConfig())
-	reg.Register(listStub(nil))
-
-	if err := mountAndRun(t, SlashCommandList, []string{"+slash-command-list", "--format", "json", "--as", "bot"}, f, stdout); err != nil {
-		t.Fatalf("execute: %v", err)
-	}
-	var got map[string]interface{}
-	if err := json.Unmarshal(stdout.Bytes(), &got); err != nil {
-		t.Fatalf("json: %v", err)
-	}
-	data := got["data"].(map[string]interface{})
-	items, ok := data["items"].([]interface{})
-	if !ok || len(items) != 0 {
-		t.Fatalf("empty list must be [] not %v", data["items"])
-	}
-	if data["count"] != float64(0) {
-		t.Fatalf("count = %v", data["count"])
-	}
-}
-
-func TestSlashCommandList_DryRun(t *testing.T) {
-	f, stdout, _, _ := cmdutil.TestFactory(t, appTestConfig())
-	if err := mountAndRun(t, SlashCommandList, []string{"+slash-command-list", "--dry-run", "--as", "bot"}, f, stdout); err != nil {
-		t.Fatalf("execute: %v", err)
-	}
-	out := stdout.String()
-	if !strings.Contains(out, "/open-apis/application/v7/app_slash_commands") || !strings.Contains(out, "GET") {
-		t.Fatalf("dry-run must show GET path, got %s", out)
-	}
-}

shortcuts/application/slash_command_resolve.go

@@ -1,53 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package application
-
-import (
-	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/shortcuts/common"
-)
-
-// matchCommandItem finds the item whose "command" equals name (exact match -
-// the server enforces name uniqueness, so first hit is the only hit).
-func matchCommandItem(items []interface{}, name string) (string, map[string]interface{}) {
-	for _, it := range items {
-		m, ok := it.(map[string]interface{})
-		if !ok {
-			continue
-		}
-		if m["command"] == name {
-			id, _ := m["command_id"].(string)
-			if id != "" {
-				return id, m
-			}
-		}
-	}
-	return "", nil
-}
-
-// commandNotFoundError reports a resolution miss against the live list as an
-// API-category not-found error (the name is a valid argument shape; the
-// resource simply does not exist server-side - this is not a validation
-// failure of caller input).
-func commandNotFoundError(name string) error {
-	return errs.NewAPIError(errs.SubtypeNotFound,
-		"slash command %q not found in the current bound app", name).
-		WithHint("run `lark-cli application +slash-command-list` to see registered commands")
-}
-
-// resolveCommandID resolves a command name to its command_id via the live
-// list endpoint (in-memory only; never touches local files). Requires the
-// read scope on the current identity.
-func resolveCommandID(runtime *common.RuntimeContext, name string) (string, map[string]interface{}, error) {
-	data, err := runtime.CallAPITyped("GET", slashCommandBasePath, nil, nil)
-	if err != nil {
-		return "", nil, err
-	}
-	items, _ := data["items"].([]interface{})
-	id, item := matchCommandItem(items, name)
-	if id == "" {
-		return "", nil, commandNotFoundError(name)
-	}
-	return id, item, nil
-}

shortcuts/application/slash_command_resolve_test.go

@@ -1,39 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package application
-
-import (
-	"strings"
-	"testing"
-)
-
-func TestMatchCommandItem(t *testing.T) {
-	items := []interface{}{
-		sampleItem("greet", "id1"),
-		sampleItem("weather", "id2"),
-	}
-	id, item := matchCommandItem(items, "weather")
-	if id != "id2" || item == nil {
-		t.Fatalf("got id=%q item=%v", id, item)
-	}
-	id, item = matchCommandItem(items, "nope")
-	if id != "" || item != nil {
-		t.Fatalf("miss should return empty, got id=%q", id)
-	}
-	// 精确匹配：大小写与空白不做宽容
-	id, _ = matchCommandItem(items, "Greet")
-	if id != "" {
-		t.Fatalf("match must be exact, got %q", id)
-	}
-}
-
-func TestResolveNotFoundErrorShape(t *testing.T) {
-	err := commandNotFoundError("nope")
-	if err == nil || !strings.Contains(err.Error(), `"nope"`) {
-		t.Fatalf("err = %v", err)
-	}
-	if !strings.Contains(err.Error(), "not found") {
-		t.Fatalf("err should say not found: %v", err)
-	}
-}

shortcuts/application/slash_command_update.go

@@ -1,119 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package application
-
-import (
-	"context"
-	"fmt"
-	"io"
-	"strings"
-
-	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/validate"
-	"github.com/larksuite/cli/shortcuts/common"
-)
-
-// validateUpdateTarget enforces: exactly one of --command-id/--command, and at
-// least one editable field; --description-i18n requires --description (PATCH
-// replaces the whole description object - sending i18n alone would drop
-// default_value; conservative rule, see spec amendment #3).
-func validateUpdateTarget(runtime *common.RuntimeContext) error {
-	id := strings.TrimSpace(runtime.Str("command-id"))
-	name := strings.TrimSpace(runtime.Str("command"))
-	if (id == "") == (name == "") {
-		return errs.NewValidationError(errs.SubtypeInvalidArgument,
-			"provide exactly one of --command-id or --command").WithParam("--command-id")
-	}
-	if name != "" {
-		if err := validateCommandName(name, "--command"); err != nil {
-			return err
-		}
-	}
-	hasDesc := strings.TrimSpace(runtime.Str("description")) != ""
-	hasI18n := len(runtime.StrArray("description-i18n")) > 0
-	hasIcon := strings.TrimSpace(runtime.Str("icon-key")) != ""
-	if !hasDesc && !hasI18n && !hasIcon {
-		return errs.NewValidationError(errs.SubtypeInvalidArgument,
-			"provide at least one of --description / --description-i18n / --icon-key").WithParam("--description")
-	}
-	if hasI18n && !hasDesc {
-		return errs.NewValidationError(errs.SubtypeInvalidArgument,
-			"--description-i18n requires --description: PATCH replaces the whole description object, so default_value must be provided together").WithParam("--description-i18n")
-	}
-	if _, err := parseDescriptionI18n(runtime.StrArray("description-i18n")); err != nil {
-		return err
-	}
-	return nil
-}
-
-// SlashCommandUpdate updates description/i18n/icon of an existing slash command.
-var SlashCommandUpdate = common.Shortcut{
-	Service:     "application",
-	Command:     "+slash-command-update",
-	Description: "Update description / localized descriptions / icon of a slash command on the current bound app, addressed by --command-id or by name via --command",
-	Risk:        "write",
-	Scopes:      []string{"application:app_slash_command:write"},
-	ConditionalScopes: []string{
-		"application:app_slash_command:read", // only the --command by-name path lists to resolve the id
-	},
-	AuthTypes: []string{"bot", "user"},
-	Flags: []common.Flag{
-		{Name: "command-id", Desc: "target command_id (from +slash-command-list or create output); mutually exclusive with --command"},
-		{Name: "command", Desc: "target command name WITHOUT leading slash; resolved via live list (needs read scope); mutually exclusive with --command-id"},
-		{Name: "description", Desc: "new default description (description.default_value)"},
-		{Name: "description-i18n", Type: "string_array", Desc: "localized description, repeatable <lang>=<text>; REPLACES the whole i18n map (missing languages are dropped); requires --description"},
-		{Name: "icon-key", Desc: "new icon key (invalid keys rejected server-side with code 40000031)"},
-	},
-	Tips: []string{
-		`lark-cli application +slash-command-update --command greet --description "new text" --as bot`,
-		"PATCH is field-level partial: fields you do not pass are preserved server-side",
-		"the command NAME itself cannot be changed (API limitation): rename = delete + create (new command_id)",
-	},
-	Validate: func(ctx context.Context, runtime *common.RuntimeContext) error {
-		return validateUpdateTarget(runtime)
-	},
-	DryRun: func(ctx context.Context, runtime *common.RuntimeContext) *common.DryRunAPI {
-		i18n, err := parseDescriptionI18n(runtime.StrArray("description-i18n"))
-		if err != nil {
-			return common.NewDryRunAPI().Set("error", err.Error())
-		}
-		body := buildSlashCommandBody("", runtime.Str("description"), i18n, runtime.Str("icon-key"))
-		d := common.NewDryRunAPI()
-		target := runtime.Str("command-id")
-		if target == "" {
-			d.Desc(fmt.Sprintf("resolve command_id by name %q via GET list first", runtime.Str("command"))).
-				GET(slashCommandBasePath)
-			target = "<resolved_command_id>"
-		}
-		return d.PATCH(slashCommandBasePath + "/" + target).Body(body)
-	},
-	Execute: func(ctx context.Context, runtime *common.RuntimeContext) error {
-		id := strings.TrimSpace(runtime.Str("command-id"))
-		if id == "" {
-			resolved, _, err := resolveCommandID(runtime, strings.TrimSpace(runtime.Str("command")))
-			if err != nil {
-				return err
-			}
-			id = resolved
-		}
-		i18n, err := parseDescriptionI18n(runtime.StrArray("description-i18n"))
-		if err != nil {
-			return err
-		}
-		body := buildSlashCommandBody("", runtime.Str("description"), i18n, runtime.Str("icon-key"))
-		data, err := runtime.CallAPITyped("PATCH", slashCommandBasePath+"/"+validate.EncodePathSegment(id), nil, body)
-		if err != nil {
-			return err
-		}
-		if data == nil {
-			data = map[string]interface{}{}
-		}
-		data["action"] = "updated"
-		fmt.Fprintln(runtime.IO().ErrOut, clientCacheHint)
-		runtime.OutFormat(data, nil, func(w io.Writer) {
-			fmt.Fprintf(w, "updated /%v (command_id: %v)\n", data["command"], data["command_id"])
-		})
-		return nil
-	},
-}

shortcuts/application/slash_command_update_test.go

@@ -1,79 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package application
-
-import (
-	"encoding/json"
-	"strings"
-	"testing"
-
-	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/cmdutil"
-)
-
-func TestSlashCommandUpdate_ByID(t *testing.T) {
-	f, stdout, _, reg := cmdutil.TestFactory(t, appTestConfig())
-	reg.Register(patchOKStub("id1"))
-
-	err := mountAndRun(t, SlashCommandUpdate, []string{"+slash-command-update",
-		"--command-id", "id1", "--description", "new", "--format", "json", "--as", "bot"}, f, stdout)
-	if err != nil {
-		t.Fatalf("execute: %v", err)
-	}
-	var got map[string]interface{}
-	if err := json.Unmarshal(stdout.Bytes(), &got); err != nil {
-		t.Fatalf("json: %v", err)
-	}
-	data := got["data"].(map[string]interface{})
-	if data["action"] != "updated" {
-		t.Fatalf("action = %v", data["action"])
-	}
-}
-
-func TestSlashCommandUpdate_ByName(t *testing.T) {
-	f, stdout, _, reg := cmdutil.TestFactory(t, appTestConfig())
-	reg.Register(listStub([]interface{}{sampleItem("greet", "id9")}))
-	reg.Register(patchOKStub("id9"))
-
-	err := mountAndRun(t, SlashCommandUpdate, []string{"+slash-command-update",
-		"--command", "greet", "--icon-key", "skill_outlined", "--format", "json", "--as", "bot"}, f, stdout)
-	if err != nil {
-		t.Fatalf("execute: %v", err)
-	}
-}
-
-func TestSlashCommandUpdate_ByNameNotFound(t *testing.T) {
-	f, stdout, _, reg := cmdutil.TestFactory(t, appTestConfig())
-	reg.Register(listStub(nil))
-
-	err := mountAndRun(t, SlashCommandUpdate, []string{"+slash-command-update",
-		"--command", "nope", "--description", "x", "--as", "bot"}, f, stdout)
-	if err == nil || !strings.Contains(err.Error(), "not found") {
-		t.Fatalf("expected not found, got %v", err)
-	}
-}
-
-func TestSlashCommandUpdate_Validate(t *testing.T) {
-	f, stdout, _, _ := cmdutil.TestFactory(t, appTestConfig())
-	cases := []struct {
-		name string
-		args []string
-	}{
-		{"both id and name", []string{"+slash-command-update", "--command-id", "id1", "--command", "greet", "--description", "x", "--as", "bot"}},
-		{"neither id nor name", []string{"+slash-command-update", "--description", "x", "--as", "bot"}},
-		{"no editable field", []string{"+slash-command-update", "--command-id", "id1", "--as", "bot"}},
-		{"i18n without description", []string{"+slash-command-update", "--command-id", "id1", "--description-i18n", "zh_cn=x", "--as", "bot"}},
-	}
-	for _, c := range cases {
-		err := mountAndRun(t, SlashCommandUpdate, c.args, f, stdout)
-		if err == nil {
-			t.Errorf("%s: expected validation error", c.name)
-			continue
-		}
-		p, ok := errs.ProblemOf(err)
-		if !ok || p.Category != errs.CategoryValidation {
-			t.Errorf("%s: expected validation problem, got %v", c.name, err)
-		}
-	}
-}

shortcuts/mail/helpers.go

@@ -51,9 +51,8 @@ func hintSendDraft(runtime *common.RuntimeContext, mailboxID, draftID string) {
 // original message as read after a reply/reply-all/forward operation.
 func hintMarkAsRead(runtime *common.RuntimeContext, mailboxID, originalMessageID string) {
 	fmt.Fprintf(runtime.IO().ErrOut,
-		"tip: mark original as read? lark-cli mail user_mailbox.messages batch_modify_message"+
-			` --params '{"user_mailbox_id":"%s"}' --data '{"message_ids":["%s"],"remove_label_ids":["UNREAD"]}'`+"\n",
-		sanitizeForTerminal(mailboxID), sanitizeForTerminal(originalMessageID))
+		"tip: mark original as read? lark-cli mail +message-modify --mailbox '%s' --message-ids '%s' --remove-label-ids UNREAD\n",
+		shellQuoteForHint(mailboxID), shellQuoteForHint(originalMessageID))
 }
 
 // hintReadReceiptRequest prints a stderr tip when a message that the caller

shortcuts/mail/helpers_test.go

@@ -465,14 +465,19 @@ func TestPrintWatchOutputSchema(t *testing.T) {
 // TestHintMarkAsRead verifies hint mark as read.
 func TestHintMarkAsRead(t *testing.T) {
 	rt, _, stderr := newOutputRuntime(t)
-	// Inject ANSI escape + message ID to verify sanitization
-	hintMarkAsRead(rt, "me", "msg-\x1b[31m123")
+	hintMarkAsRead(rt, "mail box;$(whoami)", "msg-\x1b[31m123 'quoted'\nnext")
 	out := stderr.String()
 	if strings.Contains(out, "\x1b[") {
 		t.Errorf("hintMarkAsRead should sanitize ANSI escapes, got: %q", out)
 	}
-	if !strings.Contains(out, "msg-123") {
-		t.Errorf("hintMarkAsRead should contain sanitized message ID, got: %q", out)
+	if strings.Contains(out, "\nnext") {
+		t.Errorf("hintMarkAsRead should strip embedded newlines, got: %q", out)
+	}
+	if !strings.Contains(out, "--mailbox 'mail box;$(whoami)'") {
+		t.Errorf("hintMarkAsRead should quote mailbox for shell copy/paste, got: %q", out)
+	}
+	if !strings.Contains(out, "--message-ids 'msg-123 '\\''quoted'\\''next'") {
+		t.Errorf("hintMarkAsRead should quote message ID for shell copy/paste, got: %q", out)
 	}
 }
 

shortcuts/mail/mail_message_manage_test.go

@@ -0,0 +1,482 @@
+// Copyright (c) 2026 Lark Technologies Pte. Ltd.
+// SPDX-License-Identifier: MIT
+
+package mail
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"strings"
+	"testing"
+
+	"github.com/larksuite/cli/errs"
+	"github.com/larksuite/cli/internal/auth"
+	"github.com/larksuite/cli/internal/httpmock"
+	"github.com/larksuite/cli/internal/output"
+	"github.com/larksuite/cli/shortcuts/common"
+)
+
+func messageManageID(suffix string) string {
+	return "msg_abcdefghijklmnop_" + suffix
+}
+
+func stubMessageManagePost(reg *httpmock.Registry, endpoint string, body map[string]interface{}) *httpmock.Stub {
+	stub := &httpmock.Stub{
+		Method: "POST",
+		URL:    "/user_mailboxes/me/messages/" + endpoint,
+		Body:   body,
+	}
+	reg.Register(stub)
+	return stub
+}
+
+func decodeMessageManageSummary(t *testing.T, data map[string]interface{}) ([]interface{}, []interface{}) {
+	t.Helper()
+	success, ok := data["success_message_ids"].([]interface{})
+	if !ok {
+		t.Fatalf("success_message_ids = %#v, want array", data["success_message_ids"])
+	}
+	failed, ok := data["failed_message_ids"].([]interface{})
+	if !ok {
+		t.Fatalf("failed_message_ids = %#v, want array", data["failed_message_ids"])
+	}
+	return success, failed
+}
+
+func requireMessageManageValidationParam(t *testing.T, err error, param string) *errs.ValidationError {
+	t.Helper()
+	if err == nil {
+		t.Fatalf("expected validation error for %s, got nil", param)
+	}
+	var validationErr *errs.ValidationError
+	if !errors.As(err, &validationErr) {
+		t.Fatalf("expected *errs.ValidationError for %s, got %T", param, err)
+	}
+	problem, ok := errs.ProblemOf(err)
+	if !ok {
+		t.Fatalf("expected typed Problem for %s, got %T", param, err)
+	}
+	if problem.Category != errs.CategoryValidation || problem.Subtype != errs.SubtypeInvalidArgument {
+		t.Fatalf("problem = %s/%s, want validation/invalid_argument", problem.Category, problem.Subtype)
+	}
+	if validationErr.Param != param {
+		t.Fatalf("param = %q, want %q", validationErr.Param, param)
+	}
+	return validationErr
+}
+
+func requireMessageManageFailedPrecondition(t *testing.T, err error) {
+	t.Helper()
+	if err == nil {
+		t.Fatal("expected failed precondition error, got nil")
+	}
+	var validationErr *errs.ValidationError
+	if !errors.As(err, &validationErr) {
+		t.Fatalf("expected *errs.ValidationError, got %T", err)
+	}
+	problem, ok := errs.ProblemOf(err)
+	if !ok {
+		t.Fatalf("expected typed Problem, got %T", err)
+	}
+	if problem.Category != errs.CategoryValidation || problem.Subtype != errs.SubtypeFailedPrecondition {
+		t.Fatalf("problem = %s/%s, want validation/failed_precondition", problem.Category, problem.Subtype)
+	}
+}
+
+func TestMessageManage_NormalizeMessageIDs(t *testing.T) {
+	id1 := messageManageID("1")
+	id2 := messageManageID("2")
+	got, err := normalizeMessageManageIDs([]string{id1, id2, id1})
+	if err != nil {
+		t.Fatalf("normalizeMessageManageIDs returned error: %v", err)
+	}
+	if len(got) != 2 || got[0] != id1 || got[1] != id2 {
+		t.Fatalf("ids = %v, want [%s %s]", got, id1, id2)
+	}
+	got, err = normalizeMessageManageIDs([]string{id1 + "," + id2, id1})
+	if err != nil {
+		t.Fatalf("normalizeMessageManageIDs CSV/repeated returned error: %v", err)
+	}
+	if len(got) != 2 || got[0] != id1 || got[1] != id2 {
+		t.Fatalf("CSV/repeated ids = %v, want [%s %s]", got, id1, id2)
+	}
+
+	cases := [][]string{
+		{""},
+		{" id_with_leading_space_12345"},
+		{"msg_abcdefghijklmnop_1,msg_abcdefghijklmnop_2 "},
+		{"1234567890123456"},
+		{"short"},
+		{"msg_abcdefghijklmnop!"},
+		{"msg_abcdefghijklmnop\t"},
+		{"msg_abcdefghijklmnop_1\nmsg_abcdefghijklmnop_2"},
+		{"msg_abcdefghijklmnop_1", "msg_abcdefghijklmnop_2 "},
+	}
+	for _, tc := range cases {
+		_, err := normalizeMessageManageIDs(tc)
+		requireMessageManageValidationParam(t, err, "--message-ids")
+	}
+}
+
+func TestMessageModify_Metadata(t *testing.T) {
+	if MailMessageModify.Command != "+message-modify" {
+		t.Fatalf("Command = %q", MailMessageModify.Command)
+	}
+	if MailMessageModify.Risk != "write" {
+		t.Errorf("Risk = %q, want write", MailMessageModify.Risk)
+	}
+	if len(MailMessageModify.AuthTypes) != 1 || MailMessageModify.AuthTypes[0] != "user" {
+		t.Errorf("AuthTypes = %v, want [user]", MailMessageModify.AuthTypes)
+	}
+	requiredScopes := map[string]bool{
+		"mail:user_mailbox.message:modify": true,
+	}
+	for _, scope := range MailMessageModify.Scopes {
+		delete(requiredScopes, scope)
+	}
+	if len(requiredScopes) != 0 {
+		t.Errorf("Scopes missing %v", requiredScopes)
+	}
+	if len(MailMessageModify.ConditionalScopes) != 1 || MailMessageModify.ConditionalScopes[0] != "mail:user_mailbox.folder:read" {
+		t.Errorf("ConditionalScopes = %v, want [mail:user_mailbox.folder:read]", MailMessageModify.ConditionalScopes)
+	}
+	flags := map[string]common.Flag{}
+	for _, fl := range MailMessageModify.Flags {
+		flags[fl.Name] = fl
+	}
+	for _, name := range []string{"mailbox", "message-ids", "add-label-ids", "remove-label-ids", "add-folder"} {
+		if _, ok := flags[name]; !ok {
+			t.Fatalf("missing --%s flag", name)
+		}
+	}
+	if flags["message-ids"].Type != "string_array" || !flags["message-ids"].Required {
+		t.Errorf("--message-ids = %#v, want required string_array", flags["message-ids"])
+	}
+}
+
+func TestMessageTrash_Metadata(t *testing.T) {
+	if MailMessageTrash.Command != "+message-trash" {
+		t.Fatalf("Command = %q", MailMessageTrash.Command)
+	}
+	if MailMessageTrash.Risk != "high-risk-write" {
+		t.Errorf("Risk = %q, want high-risk-write", MailMessageTrash.Risk)
+	}
+	if len(MailMessageTrash.AuthTypes) != 1 || MailMessageTrash.AuthTypes[0] != "user" {
+		t.Errorf("AuthTypes = %v, want [user]", MailMessageTrash.AuthTypes)
+	}
+	if len(MailMessageTrash.Scopes) != 1 || MailMessageTrash.Scopes[0] != "mail:user_mailbox.message:modify" {
+		t.Errorf("Scopes = %v, want [mail:user_mailbox.message:modify]", MailMessageTrash.Scopes)
+	}
+}
+
+func TestMessageModify_LabelOnlyDoesNotRequireFolderReadScope(t *testing.T) {
+	f, stdout, _, reg := mailShortcutTestFactory(t)
+	token := auth.GetStoredToken("test-app", "ou_testuser")
+	if token == nil {
+		t.Fatal("expected test token")
+	}
+	token.Scope = strings.ReplaceAll(token.Scope, " mail:user_mailbox.folder:read", "")
+	if err := auth.SetStoredToken(token); err != nil {
+		t.Fatalf("SetStoredToken() error = %v", err)
+	}
+
+	id := messageManageID("1")
+	post := stubMessageManagePost(reg, "batch_modify", map[string]interface{}{"code": 0, "data": map[string]interface{}{}})
+
+	err := runMountedMailShortcut(t, MailMessageModify, []string{
+		"+message-modify",
+		"--message-ids", id,
+		"--remove-label-ids", "UNREAD",
+	}, f, stdout)
+	if err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
+	var body map[string]interface{}
+	if err := json.Unmarshal(post.CapturedBody, &body); err != nil {
+		t.Fatalf("unmarshal captured body: %v", err)
+	}
+	removeLabels := body["remove_label_ids"].([]interface{})
+	if len(removeLabels) != 1 || removeLabels[0] != "UNREAD" {
+		t.Fatalf("remove_label_ids = %#v, want [UNREAD]", removeLabels)
+	}
+}
+
+func TestMessageModify_ReadReceiptRequestLabelIsSystemLabel(t *testing.T) {
+	f, stdout, _, reg := mailShortcutTestFactory(t)
+	id := messageManageID("1")
+	post := stubMessageManagePost(reg, "batch_modify", map[string]interface{}{"code": 0, "data": map[string]interface{}{}})
+
+	err := runMountedMailShortcut(t, MailMessageModify, []string{
+		"+message-modify",
+		"--message-ids", id,
+		"--remove-label-ids", "read_receipt_request",
+	}, f, stdout)
+	if err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
+	var body map[string]interface{}
+	if err := json.Unmarshal(post.CapturedBody, &body); err != nil {
+		t.Fatalf("unmarshal captured body: %v", err)
+	}
+	removeLabels := body["remove_label_ids"].([]interface{})
+	if len(removeLabels) != 1 || removeLabels[0] != "READ_RECEIPT_REQUEST" {
+		t.Fatalf("remove_label_ids = %#v, want [READ_RECEIPT_REQUEST]", removeLabels)
+	}
+}
+
+func TestMessageModify_LabelFolderNormalizationAndValidationAPIs(t *testing.T) {
+	f, stdout, _, reg := mailShortcutTestFactory(t)
+	id := messageManageID("1")
+	reg.Register(&httpmock.Stub{Method: "GET", URL: "/user_mailboxes/me/labels/customA", Body: map[string]interface{}{"code": 0, "data": map[string]interface{}{"label_id": "customA"}}})
+	reg.Register(&httpmock.Stub{Method: "GET", URL: "/user_mailboxes/me/folders/folderA", Body: map[string]interface{}{"code": 0, "data": map[string]interface{}{"folder_id": "folderA"}}})
+	post := stubMessageManagePost(reg, "batch_modify", map[string]interface{}{"code": 0, "data": map[string]interface{}{}})
+
+	err := runMountedMailShortcut(t, MailMessageModify, []string{
+		"+message-modify",
+		"--message-ids", id,
+		"--add-label-ids", "unread,customA",
+		"--remove-label-ids", "FLAGGED",
+		"--add-folder", "folderA",
+	}, f, stdout)
+	if err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
+	var body map[string]interface{}
+	if err := json.Unmarshal(post.CapturedBody, &body); err != nil {
+		t.Fatalf("unmarshal captured body: %v", err)
+	}
+	if got := body["add_folder"]; got != "folderA" {
+		t.Errorf("add_folder = %v, want folderA", got)
+	}
+	addLabels := body["add_label_ids"].([]interface{})
+	if addLabels[0] != "UNREAD" || addLabels[1] != "customA" {
+		t.Errorf("add_label_ids = %#v, want [UNREAD customA]", addLabels)
+	}
+	removeLabels := body["remove_label_ids"].([]interface{})
+	if removeLabels[0] != "FLAGGED" {
+		t.Errorf("remove_label_ids = %#v, want [FLAGGED]", removeLabels)
+	}
+	success, failed := decodeMessageManageSummary(t, decodeShortcutEnvelopeData(t, stdout))
+	if len(success) != 1 || success[0] != id || len(failed) != 0 {
+		t.Errorf("summary success=%v failed=%v", success, failed)
+	}
+}
+
+func TestMessageModify_RejectsLabelIntersectionAndTrashFolder(t *testing.T) {
+	f, stdout, _, _ := mailShortcutTestFactory(t)
+	id := messageManageID("1")
+	err := runMountedMailShortcut(t, MailMessageModify, []string{
+		"+message-modify",
+		"--message-ids", id,
+		"--add-label-ids", "unread",
+		"--remove-label-ids", "UNREAD",
+	}, f, stdout)
+	requireMessageManageValidationParam(t, err, "--add-label-ids")
+	if !strings.Contains(err.Error(), "label cannot be both added and removed") {
+		t.Fatalf("error = %v, want label intersection validation", err)
+	}
+
+	err = runMountedMailShortcut(t, MailMessageModify, []string{
+		"+message-modify",
+		"--message-ids", id,
+		"--add-folder", "trash",
+	}, f, stdout)
+	requireMessageManageValidationParam(t, err, "--add-folder")
+	if !strings.Contains(err.Error(), "use +message-trash") {
+		t.Fatalf("error = %v, want TRASH validation", err)
+	}
+}
+
+func TestMessageModify_EmptyOperationDoesNotCallPost(t *testing.T) {
+	f, stdout, _, _ := mailShortcutTestFactory(t)
+	id1 := messageManageID("1")
+	id2 := messageManageID("2")
+	err := runMountedMailShortcut(t, MailMessageModify, []string{
+		"+message-modify",
+		"--message-ids", id1 + "," + id2 + "," + id1,
+	}, f, stdout)
+	if err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
+	success, failed := decodeMessageManageSummary(t, decodeShortcutEnvelopeData(t, stdout))
+	if len(success) != 2 || success[0] != id1 || success[1] != id2 || len(failed) != 0 {
+		t.Fatalf("summary success=%v failed=%v", success, failed)
+	}
+}
+
+func TestMessageModify_BatchesAndAggregatesPartialFailure(t *testing.T) {
+	f, stdout, _, reg := mailShortcutTestFactory(t)
+	ids := make([]string, 41)
+	for i := range ids {
+		ids[i] = messageManageID(fmt.Sprintf("%02d", i))
+	}
+	first := stubMessageManagePost(reg, "batch_modify", map[string]interface{}{"code": 0, "data": map[string]interface{}{}})
+	second := stubMessageManagePost(reg, "batch_modify", map[string]interface{}{"code": 1230001, "msg": "bad request"})
+	third := stubMessageManagePost(reg, "batch_modify", map[string]interface{}{"code": 0, "data": map[string]interface{}{}})
+
+	err := runMountedMailShortcut(t, MailMessageModify, []string{
+		"+message-modify",
+		"--message-ids", strings.Join(ids, ","),
+		"--add-folder", "archive",
+	}, f, stdout)
+	if err != nil {
+		t.Fatalf("unexpected err: %v", err)
+	}
+	for idx, stub := range []*httpmock.Stub{first, second, third} {
+		var body map[string]interface{}
+		if err := json.Unmarshal(stub.CapturedBody, &body); err != nil {
+			t.Fatalf("batch %d body unmarshal: %v", idx+1, err)
+		}
+		messageIDs := body["message_ids"].([]interface{})
+		want := []int{20, 20, 1}[idx]
+		if len(messageIDs) != want {
+			t.Fatalf("batch %d size = %d, want %d", idx+1, len(messageIDs), want)
+		}
+		if body["add_folder"] != "ARCHIVED" {
+			t.Fatalf("batch %d add_folder = %v, want ARCHIVED", idx+1, body["add_folder"])
+		}
+	}
+	success, failed := decodeMessageManageSummary(t, decodeShortcutEnvelopeData(t, stdout))
+	if len(success) != 21 || len(failed) != 20 {
+		t.Fatalf("success=%d failed=%d, want 21/20", len(success), len(failed))
+	}
+}
+
+func TestMessageModify_AllBatchesFailReturnsError(t *testing.T) {
+	f, stdout, _, reg := mailShortcutTestFactory(t)
+	id := messageManageID("1")
+	stubMessageManagePost(reg, "batch_modify", map[string]interface{}{"code": 1230001, "msg": "bad request"})
+
+	err := runMountedMailShortcut(t, MailMessageModify, []string{
+		"+message-modify",
+		"--message-ids", id,
+		"--add-folder", "archive",
+	}, f, stdout)
+	requireMessageManageFailedPrecondition(t, err)
+}
+
+func TestMessageModify_DryRunShowsPlanWithoutValidationGET(t *testing.T) {
+	f, stdout, _, _ := mailShortcutTestFactory(t)
+	id1 := messageManageID("1")
+	id2 := messageManageID("2")
+	err := runMountedMailShortcut(t, MailMessageModify, []string{
+		"+message-modify",
+		"--message-ids", id1 + "," + id2,
+		"--add-label-ids", "customA",
+		"--add-folder", "folderA",
+		"--dry-run",
+	}, f, stdout)
+	if err != nil {
+		t.Fatalf("dry-run failed: %v", err)
+	}
+	out := stdout.String()
+	for _, want := range []string{
+		`/user_mailboxes/me/messages/batch_modify`,
+		`validation_api_plan`,
+		`/user_mailboxes/me/labels/customA`,
+		`/user_mailboxes/me/folders/folderA`,
+		`will_validate`,
+		`batch_size`,
+	} {
+		if !strings.Contains(out, want) {
+			t.Fatalf("dry-run output missing %q; got %s", want, out)
+		}
+	}
+}
+
+func TestMessageTrash_RequiresYesAndBatches(t *testing.T) {
+	f, stdout, _, reg := mailShortcutTestFactory(t)
+	id1 := messageManageID("1")
+	id2 := messageManageID("2")
+	err := runMountedMailShortcut(t, MailMessageTrash, []string{
+		"+message-trash",
+		"--message-ids", id1 + "," + id2,
+	}, f, stdout)
+	if err == nil {
+		t.Fatal("expected confirmation error, got nil")
+	}
+	if code := output.ExitCodeOf(err); code != output.ExitConfirmationRequired {
+		t.Fatalf("exit code = %d, want %d", code, output.ExitConfirmationRequired)
+	}
+
+	post := stubMessageManagePost(reg, "batch_trash", map[string]interface{}{"code": 0, "data": map[string]interface{}{}})
+	err = runMountedMailShortcut(t, MailMessageTrash, []string{
+		"+message-trash",
+		"--message-ids", id1 + "," + id2,
+		"--yes",
+	}, f, stdout)
+	if err != nil {
+		t.Fatalf("unexpected err with --yes: %v", err)
+	}
+	var body map[string]interface{}
+	if err := json.Unmarshal(post.CapturedBody, &body); err != nil {
+		t.Fatalf("unmarshal captured body: %v", err)
+	}
+	if got := len(body["message_ids"].([]interface{})); got != 2 {
+		t.Fatalf("message_ids len = %d, want 2", got)
+	}
+	success, failed := decodeMessageManageSummary(t, decodeShortcutEnvelopeData(t, stdout))
+	if len(success) != 2 || len(failed) != 0 {
+		t.Fatalf("summary success=%v failed=%v", success, failed)
+	}
+}
+
+func TestMessageTrash_AllBatchesFailReturnsError(t *testing.T) {
+	f, stdout, _, reg := mailShortcutTestFactory(t)
+	id := messageManageID("1")
+	stubMessageManagePost(reg, "batch_trash", map[string]interface{}{"code": 1230001, "msg": "bad request"})
+
+	err := runMountedMailShortcut(t, MailMessageTrash, []string{
+		"+message-trash",
+		"--message-ids", id,
+		"--yes",
+	}, f, stdout)
+	requireMessageManageFailedPrecondition(t, err)
+}
+
+func TestMessageManage_RejectsWhitespaceBeforeAPI(t *testing.T) {
+	id1 := messageManageID("1")
+	id2 := messageManageID("2")
+	cases := []struct {
+		name     string
+		shortcut common.Shortcut
+		args     []string
+	}{
+		{
+			name:     "trash newline in repeated flag",
+			shortcut: MailMessageTrash,
+			args:     []string{"+message-trash", "--message-ids", id1 + "\n" + id2, "--yes"},
+		},
+		{
+			name:     "trash tab in csv flag",
+			shortcut: MailMessageTrash,
+			args:     []string{"+message-trash", "--message-ids", id1 + ",\t" + id2, "--yes"},
+		},
+		{
+			name:     "modify space in repeated flag",
+			shortcut: MailMessageModify,
+			args:     []string{"+message-modify", "--message-ids", id1, "--message-ids", id2 + " ", "--add-folder", "archive"},
+		},
+		{
+			name:     "modify space in csv flag",
+			shortcut: MailMessageModify,
+			args:     []string{"+message-modify", "--message-ids", id1 + ", " + id2, "--add-folder", "archive"},
+		},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			f, stdout, _, _ := mailShortcutTestFactory(t)
+			err := runMountedMailShortcut(t, tc.shortcut, tc.args, f, stdout)
+			if err == nil {
+				t.Fatal("expected validation error, got nil")
+			}
+			if code := output.ExitCodeOf(err); code != output.ExitValidation {
+				t.Fatalf("exit code = %d, want %d; err=%v", code, output.ExitValidation, err)
+			}
+			if !strings.Contains(err.Error(), "must not contain whitespace or control characters") {
+				t.Fatalf("error = %v, want whitespace/control validation", err)
+			}
+		})
+	}
+}

shortcuts/mail/mail_message_modify.go

@@ -0,0 +1,141 @@
+// Copyright (c) 2026 Lark Technologies Pte. Ltd.
+// SPDX-License-Identifier: MIT
+
+package mail
+
+import (
+	"context"
+
+	"github.com/larksuite/cli/shortcuts/common"
+)
+
+type messageModifyInput struct {
+	MessageIDs         []string
+	AddLabelIDs        []string
+	RemoveLabelIDs     []string
+	AddFolder          string
+	CustomLabelIDs     []string
+	CustomFolderID     string
+	ValidationAPIPlans []validationAPIPlan
+}
+
+// MailMessageModify is the `+message-modify` shortcut: apply labels, unread
+// state labels, or a folder move to existing messages in batches of 20.
+var MailMessageModify = common.Shortcut{
+	Service:     "mail",
+	Command:     "+message-modify",
+	Description: "Modify existing mail messages by adding/removing label IDs or moving them to a folder. Batches message IDs in groups of 20 and keeps output compact.",
+	Risk:        "write",
+	Scopes:      []string{"mail:user_mailbox.message:modify"},
+	ConditionalScopes: []string{
+		"mail:user_mailbox.folder:read",
+	},
+	AuthTypes: []string{"user"},
+	HasFormat: true,
+	Flags: []common.Flag{
+		{Name: "mailbox", Desc: "Mailbox email address that owns the messages (default: me)."},
+		{Name: "message-ids", Type: "string_array", Required: true, Desc: "Message IDs to modify; comma-separated or repeat the flag."},
+		{Name: "add-label-ids", Type: "string_slice", Desc: "Label IDs to add. System labels unread/important/other/flagged are normalized to upper case."},
+		{Name: "remove-label-ids", Type: "string_slice", Desc: "Label IDs to remove. System labels unread/important/other/flagged are normalized to upper case."},
+		{Name: "add-folder", Desc: "Folder ID to move messages to. System folders inbox/sent/spam/archive/archived are normalized; TRASH is rejected, use +message-trash."},
+	},
+	Validate: validateMessageModify,
+	DryRun:   dryRunMessageModify,
+	Execute:  executeMessageModify,
+}
+
+func validateMessageModify(ctx context.Context, rt *common.RuntimeContext) error {
+	_, err := buildMessageModifyInput(rt)
+	return err
+}
+
+func dryRunMessageModify(ctx context.Context, rt *common.RuntimeContext) *common.DryRunAPI {
+	mailboxID := resolveMailboxID(rt)
+	input, _ := buildMessageModifyInput(rt)
+	api := common.NewDryRunAPI().
+		Desc("Modify messages sequentially in batches of 20; dry-run does not call label/folder validation APIs").
+		Set("batch_size", mailMessageManageBatchSize).
+		Set("batches", chunkMessageManageIDs(input.MessageIDs)).
+		Set("validation_api_plan", input.ValidationAPIPlans)
+	for _, batch := range chunkMessageManageIDs(input.MessageIDs) {
+		api = api.POST(mailboxPath(mailboxID, "messages", "batch_modify")).
+			Body(messageManageBody(batch, input.AddLabelIDs, input.RemoveLabelIDs, input.AddFolder))
+	}
+	return api
+}
+
+func executeMessageModify(ctx context.Context, rt *common.RuntimeContext) error {
+	mailboxID := resolveMailboxID(rt)
+	input, err := buildMessageModifyInput(rt)
+	if err != nil {
+		return err
+	}
+	if err := validateCustomMessageManageLabels(rt, mailboxID, input.CustomLabelIDs); err != nil {
+		return err
+	}
+	if err := validateCustomMessageManageFolder(rt, mailboxID, input.CustomFolderID); err != nil {
+		return err
+	}
+
+	if len(input.AddLabelIDs) == 0 && len(input.RemoveLabelIDs) == 0 && input.AddFolder == "" {
+		emitMessageManageSummary(rt, messageManageSummary{
+			SuccessMessageIDs: input.MessageIDs,
+			FailedMessageIDs:  []messageManageFailure{},
+		}, true)
+		return nil
+	}
+
+	summary := messageManageSummary{FailedMessageIDs: []messageManageFailure{}}
+	for _, batch := range chunkMessageManageIDs(input.MessageIDs) {
+		_, err := rt.CallAPITyped("POST", mailboxPath(mailboxID, "messages", "batch_modify"), nil,
+			messageManageBody(batch, input.AddLabelIDs, input.RemoveLabelIDs, input.AddFolder))
+		if err != nil {
+			for _, id := range batch {
+				summary.FailedMessageIDs = append(summary.FailedMessageIDs, messageManageFailure{MessageID: id, Reason: err.Error()})
+			}
+			continue
+		}
+		summary.SuccessMessageIDs = append(summary.SuccessMessageIDs, batch...)
+	}
+	emitMessageManageSummary(rt, summary, false)
+	if len(summary.SuccessMessageIDs) == 0 && len(summary.FailedMessageIDs) > 0 {
+		return mailFailedPreconditionError("all message modify batches failed")
+	}
+	return nil
+}
+
+func buildMessageModifyInput(rt *common.RuntimeContext) (messageModifyInput, error) {
+	messageIDs, err := normalizeMessageManageIDs(rt.StrArray("message-ids"))
+	if err != nil {
+		return messageModifyInput{}, err
+	}
+	addLabels, customAddLabels, err := normalizeMessageManageLabels(rt.StrSlice("add-label-ids"), "--add-label-ids")
+	if err != nil {
+		return messageModifyInput{}, err
+	}
+	removeLabels, customRemoveLabels, err := normalizeMessageManageLabels(rt.StrSlice("remove-label-ids"), "--remove-label-ids")
+	if err != nil {
+		return messageModifyInput{}, err
+	}
+	if err := validateLabelIntersection(addLabels, removeLabels); err != nil {
+		return messageModifyInput{}, err
+	}
+	folder, customFolder, err := normalizeMessageManageFolder(rt.Str("add-folder"))
+	if err != nil {
+		return messageModifyInput{}, err
+	}
+	customLabels := append(customAddLabels, customRemoveLabels...)
+	customFolderID := ""
+	if customFolder {
+		customFolderID = folder
+	}
+	return messageModifyInput{
+		MessageIDs:         messageIDs,
+		AddLabelIDs:        addLabels,
+		RemoveLabelIDs:     removeLabels,
+		AddFolder:          folder,
+		CustomLabelIDs:     customLabels,
+		CustomFolderID:     customFolderID,
+		ValidationAPIPlans: messageManageValidationPlan(resolveMailboxID(rt), customLabels, customFolderID),
+	}, nil
+}

shortcuts/mail/mail_message_trash.go

@@ -0,0 +1,75 @@
+// Copyright (c) 2026 Lark Technologies Pte. Ltd.
+// SPDX-License-Identifier: MIT
+
+package mail
+
+import (
+	"context"
+
+	"github.com/larksuite/cli/shortcuts/common"
+)
+
+// MailMessageTrash is the `+message-trash` shortcut: soft-delete existing
+// messages in batches of 20 via batch_trash. Risk is high-risk-write, so the
+// runner requires --yes before Execute.
+var MailMessageTrash = common.Shortcut{
+	Service:     "mail",
+	Command:     "+message-trash",
+	Description: "Soft-delete existing mail messages. Batches message IDs in groups of 20 and calls batch_trash sequentially. Requires --yes.",
+	Risk:        "high-risk-write",
+	Scopes:      []string{"mail:user_mailbox.message:modify"},
+	AuthTypes:   []string{"user"},
+	HasFormat:   true,
+	Flags: []common.Flag{
+		{Name: "mailbox", Desc: "Mailbox email address that owns the messages (default: me)."},
+		{Name: "message-ids", Type: "string_array", Required: true, Desc: "Message IDs to soft-delete; comma-separated or repeat the flag."},
+	},
+	Validate: validateMessageTrash,
+	DryRun:   dryRunMessageTrash,
+	Execute:  executeMessageTrash,
+}
+
+func validateMessageTrash(ctx context.Context, rt *common.RuntimeContext) error {
+	_, err := normalizeMessageManageIDs(rt.StrArray("message-ids"))
+	return err
+}
+
+func dryRunMessageTrash(ctx context.Context, rt *common.RuntimeContext) *common.DryRunAPI {
+	mailboxID := resolveMailboxID(rt)
+	messageIDs, _ := normalizeMessageManageIDs(rt.StrArray("message-ids"))
+	api := common.NewDryRunAPI().
+		Desc("Soft-delete messages sequentially in batches of 20").
+		Set("batch_size", mailMessageManageBatchSize).
+		Set("batches", chunkMessageManageIDs(messageIDs))
+	for _, batch := range chunkMessageManageIDs(messageIDs) {
+		api = api.POST(mailboxPath(mailboxID, "messages", "batch_trash")).
+			Body(map[string]interface{}{"message_ids": batch})
+	}
+	return api
+}
+
+func executeMessageTrash(ctx context.Context, rt *common.RuntimeContext) error {
+	mailboxID := resolveMailboxID(rt)
+	messageIDs, err := normalizeMessageManageIDs(rt.StrArray("message-ids"))
+	if err != nil {
+		return err
+	}
+
+	summary := messageManageSummary{FailedMessageIDs: []messageManageFailure{}}
+	for _, batch := range chunkMessageManageIDs(messageIDs) {
+		_, err := rt.CallAPITyped("POST", mailboxPath(mailboxID, "messages", "batch_trash"), nil,
+			map[string]interface{}{"message_ids": batch})
+		if err != nil {
+			for _, id := range batch {
+				summary.FailedMessageIDs = append(summary.FailedMessageIDs, messageManageFailure{MessageID: id, Reason: err.Error()})
+			}
+			continue
+		}
+		summary.SuccessMessageIDs = append(summary.SuccessMessageIDs, batch...)
+	}
+	emitMessageManageSummary(rt, summary, false)
+	if len(summary.SuccessMessageIDs) == 0 && len(summary.FailedMessageIDs) > 0 {
+		return mailFailedPreconditionError("all message trash batches failed")
+	}
+	return nil
+}

shortcuts/mail/mail_shortcut_test.go

@@ -44,7 +44,7 @@ func mailShortcutTestFactory(t *testing.T) (*cmdutil.Factory, *bytes.Buffer, *by
 		RefreshToken:     "test-refresh-token",
 		ExpiresAt:        time.Now().Add(1 * time.Hour).UnixMilli(),
 		RefreshExpiresAt: time.Now().Add(24 * time.Hour).UnixMilli(),
-		Scope:            "mail:user_mailbox.messages:write mail:user_mailbox.messages:read mail:user_mailbox.message:modify mail:user_mailbox.message:readonly mail:user_mailbox.message.address:read mail:user_mailbox.message.subject:read mail:user_mailbox.message.body:read mail:user_mailbox:readonly",
+		Scope:            "mail:user_mailbox.messages:write mail:user_mailbox.messages:read mail:user_mailbox.message:modify mail:user_mailbox.message:readonly mail:user_mailbox.message.address:read mail:user_mailbox.message.subject:read mail:user_mailbox.message.body:read mail:user_mailbox:readonly mail:user_mailbox.folder:read",
 		GrantedAt:        time.Now().Add(-1 * time.Hour).UnixMilli(),
 	}
 	if err := auth.SetStoredToken(token); err != nil {

shortcuts/mail/message_manage_helpers.go

@@ -0,0 +1,283 @@
+// Copyright (c) 2026 Lark Technologies Pte. Ltd.
+// SPDX-License-Identifier: MIT
+
+package mail
+
+import (
+	"fmt"
+	"io"
+	"strings"
+	"unicode"
+
+	"github.com/larksuite/cli/internal/output"
+	"github.com/larksuite/cli/shortcuts/common"
+)
+
+const mailMessageManageBatchSize = 20
+
+var messageManageSystemLabels = map[string]string{
+	"UNREAD":               "UNREAD",
+	"IMPORTANT":            "IMPORTANT",
+	"OTHER":                "OTHER",
+	"FLAGGED":              "FLAGGED",
+	"READ_RECEIPT_REQUEST": "READ_RECEIPT_REQUEST",
+}
+
+var messageManageSystemFolders = map[string]string{
+	"INBOX":    "INBOX",
+	"SENT":     "SENT",
+	"SPAM":     "SPAM",
+	"ARCHIVE":  "ARCHIVED",
+	"ARCHIVED": "ARCHIVED",
+}
+
+type messageManageSummary struct {
+	SuccessMessageIDs []string               `json:"success_message_ids"`
+	FailedMessageIDs  []messageManageFailure `json:"failed_message_ids"`
+}
+
+type messageManageFailure struct {
+	MessageID string `json:"message_id"`
+	Reason    string `json:"reason"`
+}
+
+type validationAPIPlan struct {
+	Method       string `json:"method"`
+	Path         string `json:"path"`
+	WillValidate bool   `json:"will_validate"`
+}
+
+func normalizeMessageManageIDs(raw []string) ([]string, error) {
+	if len(raw) == 0 {
+		return nil, mailValidationParamError("--message-ids", "--message-ids is required")
+	}
+	parts, err := splitMessageManageIDTokens(raw)
+	if err != nil {
+		return nil, err
+	}
+	ids := make([]string, 0, len(parts))
+	seen := make(map[string]struct{}, len(parts))
+	for i, part := range parts {
+		if part == "" {
+			return nil, mailValidationParamError("--message-ids", "--message-ids entry %d is empty; remove extra commas or provide valid message IDs", i+1)
+		}
+		id := strings.TrimSpace(part)
+		if id == "" {
+			return nil, mailValidationParamError("--message-ids", "--message-ids entry %d is empty; remove extra commas or provide valid message IDs", i+1)
+		}
+		if id != part {
+			return nil, mailValidationParamError("--message-ids", "--message-ids entry %d (%q): must not contain leading or trailing whitespace", i+1, part)
+		}
+		if err := validateMessageManageID(id, i); err != nil {
+			return nil, err
+		}
+		if _, ok := seen[id]; ok {
+			continue
+		}
+		seen[id] = struct{}{}
+		ids = append(ids, id)
+	}
+	if len(ids) == 0 {
+		return nil, mailValidationParamError("--message-ids", "--message-ids is required")
+	}
+	return ids, nil
+}
+
+func splitMessageManageIDTokens(raw []string) ([]string, error) {
+	parts := make([]string, 0, len(raw))
+	for i, token := range raw {
+		for _, r := range token {
+			if unicode.IsSpace(r) || unicode.IsControl(r) {
+				return nil, mailValidationParamError("--message-ids", "--message-ids entry %d (%q): must not contain whitespace or control characters", i+1, token)
+			}
+		}
+		parts = append(parts, strings.Split(token, ",")...)
+	}
+	return parts, nil
+}
+
+func validateMessageManageID(id string, index int) error {
+	if len(id) < 16 {
+		return mailValidationParamError("--message-ids", "--message-ids entry %d (%q): length must be at least 16 characters", index+1, id)
+	}
+	if strings.Trim(id, "0123456789") == "" {
+		return mailValidationParamError("--message-ids", "--message-ids entry %d (%q): numeric primary IDs are not supported; pass the Open API message_id from mail output", index+1, id)
+	}
+	for _, r := range id {
+		if unicode.IsSpace(r) || unicode.IsControl(r) {
+			return mailValidationParamError("--message-ids", "--message-ids entry %d (%q): must not contain whitespace or control characters", index+1, id)
+		}
+		if (r >= 'A' && r <= 'Z') || (r >= 'a' && r <= 'z') || (r >= '0' && r <= '9') {
+			continue
+		}
+		switch r {
+		case '+', '/', '=', '_', '-':
+			continue
+		default:
+			return mailValidationParamError("--message-ids", "--message-ids entry %d (%q): contains characters outside the Open API message_id character set", index+1, id)
+		}
+	}
+	return nil
+}
+
+func normalizeMessageManageLabels(raw []string, flagName string) ([]string, []string, error) {
+	labels := make([]string, 0, len(raw))
+	custom := make([]string, 0, len(raw))
+	seen := make(map[string]struct{}, len(raw))
+	for i, part := range raw {
+		id := strings.TrimSpace(part)
+		if id == "" {
+			return nil, nil, mailValidationParamError(flagName, "%s entry %d is empty; remove extra commas or provide valid label IDs", flagName, i+1)
+		}
+		if id != part {
+			return nil, nil, mailValidationParamError(flagName, "%s entry %d (%q): must not contain leading or trailing whitespace", flagName, i+1, part)
+		}
+		normalized := id
+		if system, ok := messageManageSystemLabels[strings.ToUpper(id)]; ok {
+			normalized = system
+		} else {
+			custom = append(custom, id)
+		}
+		if _, ok := seen[normalized]; ok {
+			continue
+		}
+		seen[normalized] = struct{}{}
+		labels = append(labels, normalized)
+	}
+	if len(labels) > 20 {
+		return nil, nil, mailValidationParamError(flagName, "%s accepts at most 20 label IDs (got %d)", flagName, len(labels))
+	}
+	return labels, custom, nil
+}
+
+func validateLabelIntersection(add, remove []string) error {
+	removeSet := make(map[string]struct{}, len(remove))
+	for _, id := range remove {
+		removeSet[id] = struct{}{}
+	}
+	for _, id := range add {
+		if _, ok := removeSet[id]; ok {
+			return mailValidationParamError("--add-label-ids", "label cannot be both added and removed: %s", id)
+		}
+	}
+	return nil
+}
+
+func normalizeMessageManageFolder(raw string) (string, bool, error) {
+	if raw == "" {
+		return "", false, nil
+	}
+	folder := strings.TrimSpace(raw)
+	if folder == "" {
+		return "", false, mailValidationParamError("--add-folder", "--add-folder must not be empty")
+	}
+	if folder != raw {
+		return "", false, mailValidationParamError("--add-folder", "--add-folder %q must not contain leading or trailing whitespace", raw)
+	}
+	if strings.EqualFold(folder, "TRASH") {
+		return "", false, mailValidationParamError("--add-folder", "TRASH is not supported by +message-modify; use +message-trash")
+	}
+	if system, ok := messageManageSystemFolders[strings.ToUpper(folder)]; ok {
+		return system, false, nil
+	}
+	return folder, true, nil
+}
+
+func chunkMessageManageIDs(ids []string) [][]string {
+	if len(ids) == 0 {
+		return nil
+	}
+	chunks := make([][]string, 0, (len(ids)+mailMessageManageBatchSize-1)/mailMessageManageBatchSize)
+	for start := 0; start < len(ids); start += mailMessageManageBatchSize {
+		end := start + mailMessageManageBatchSize
+		if end > len(ids) {
+			end = len(ids)
+		}
+		chunks = append(chunks, ids[start:end])
+	}
+	return chunks
+}
+
+func validateCustomMessageManageLabels(rt *common.RuntimeContext, mailboxID string, ids []string) error {
+	if len(ids) == 0 {
+		return nil
+	}
+	if err := validateLabelReadScope(rt); err != nil {
+		return err
+	}
+	seen := map[string]struct{}{}
+	for _, id := range ids {
+		if _, ok := seen[id]; ok {
+			continue
+		}
+		seen[id] = struct{}{}
+		if _, err := rt.CallAPITyped("GET", mailboxPath(mailboxID, "labels", id), nil, nil); err != nil {
+			return mailDecorateProblemMessage(err, "label not found: %s", id)
+		}
+	}
+	return nil
+}
+
+func validateCustomMessageManageFolder(rt *common.RuntimeContext, mailboxID, id string) error {
+	if id == "" {
+		return nil
+	}
+	if err := validateFolderReadScope(rt); err != nil {
+		return err
+	}
+	if _, err := rt.CallAPITyped("GET", mailboxPath(mailboxID, "folders", id), nil, nil); err != nil {
+		return mailDecorateProblemMessage(err, "folder not found: %s", id)
+	}
+	return nil
+}
+
+func messageManageBody(ids, addLabels, removeLabels []string, addFolder string) map[string]interface{} {
+	body := map[string]interface{}{"message_ids": ids}
+	if len(addLabels) > 0 {
+		body["add_label_ids"] = addLabels
+	}
+	if len(removeLabels) > 0 {
+		body["remove_label_ids"] = removeLabels
+	}
+	if addFolder != "" {
+		body["add_folder"] = addFolder
+	}
+	return body
+}
+
+func messageManageValidationPlan(mailboxID string, customLabels []string, customFolder string) []validationAPIPlan {
+	plans := make([]validationAPIPlan, 0, len(customLabels)+1)
+	seenLabels := map[string]struct{}{}
+	for _, id := range customLabels {
+		if _, ok := seenLabels[id]; ok {
+			continue
+		}
+		seenLabels[id] = struct{}{}
+		plans = append(plans, validationAPIPlan{
+			Method:       "GET",
+			Path:         mailboxPath(mailboxID, "labels", id),
+			WillValidate: true,
+		})
+	}
+	if customFolder != "" {
+		plans = append(plans, validationAPIPlan{
+			Method:       "GET",
+			Path:         mailboxPath(mailboxID, "folders", customFolder),
+			WillValidate: true,
+		})
+	}
+	return plans
+}
+
+func emitMessageManageSummary(rt *common.RuntimeContext, summary messageManageSummary, noAPICalls bool) {
+	rt.OutFormat(summary, &output.Meta{Count: len(summary.SuccessMessageIDs)}, func(w io.Writer) {
+		fmt.Fprintf(w, "success_message_ids: %d\n", len(summary.SuccessMessageIDs))
+		fmt.Fprintf(w, "failed_message_ids: %d\n", len(summary.FailedMessageIDs))
+		if noAPICalls {
+			fmt.Fprintln(w, "No changes requested; no API calls were made.")
+		}
+		for _, item := range summary.FailedMessageIDs {
+			fmt.Fprintf(w, "- %s: %s\n", item.MessageID, item.Reason)
+		}
+	})
+}

shortcuts/mail/shortcuts.go

@@ -10,6 +10,8 @@ func Shortcuts() []common.Shortcut {
 	return []common.Shortcut{
 		MailMessage,
 		MailMessages,
+		MailMessageModify,
+		MailMessageTrash,
 		MailThread,
 		MailTriage,
 		MailWatch,

shortcuts/register.go

@@ -17,7 +17,6 @@ import (
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/deprecation"
 	"github.com/larksuite/cli/internal/registry"
-	"github.com/larksuite/cli/shortcuts/application"
 	"github.com/larksuite/cli/shortcuts/apps"
 	"github.com/larksuite/cli/shortcuts/base"
 	"github.com/larksuite/cli/shortcuts/calendar"
@@ -62,7 +61,6 @@ var allShortcuts []common.Shortcut
 
 func init() {
 	allShortcuts = append(allShortcuts, apps.Shortcuts()...)
-	allShortcuts = append(allShortcuts, application.Shortcuts()...)
 	allShortcuts = append(allShortcuts, calendar.Shortcuts()...)
 	allShortcuts = append(allShortcuts, doc.Shortcuts()...)
 	allShortcuts = append(allShortcuts, drive.Shortcuts()...)

skill-template/domains/mail.md

@@ -65,7 +65,7 @@
 
 1. `+triage --from spam@x.com` → 列出 N 条结果
 2. 展示："将删除 N 封邮件（发件人 spam@x.com，主题：…），确认？"
-3. 用户确认后 → `*.batch_trash`
+3. 用户确认后 → `+message-trash --message-ids ... --yes`
 
 ## 身份选择：优先使用 user 身份
 
@@ -82,12 +82,13 @@
 1. **确认身份** — 首次操作邮箱前先调用 `lark-cli mail user_mailboxes profile --params '{"user_mailbox_id":"me"}'` 获取当前用户的真实邮箱地址（`primary_email_address`），不要通过系统用户名猜测。后续判断"发件人是否为用户本人"时以此地址为准。
 2. **浏览** — `+triage` 查看收件箱摘要，获取 `message_id` / `thread_id`
 3. **阅读** — `+message` 读单封邮件，`+thread` 读整个会话
-4. **回复** — `+reply` / `+reply-all`（默认存草稿，加 `--confirm-send` 则立即发送）
-5. **转发** — `+forward`（默认存草稿，加 `--confirm-send` 则立即发送）
-6. **新邮件** — `+send` 存草稿（默认），加 `--confirm-send` 发送
-7. **确认投递** — 立即发送后用 `send_status` 查询投递状态，定时发送后在预定时间后再查询；取消定时发送用 `cancel_scheduled_send`
-8. **编辑草稿** — `+draft-edit` 修改已有草稿。正文编辑通过 `--patch-file`：回复/转发草稿用 `set_reply_body` op 保留引用区，普通草稿用 `set_body` op
-9. **已读回执** —
+4. **整理** — 标签、已读/未读状态和移动文件夹优先用 `+message-modify`；软删除优先用 `+message-trash`
+5. **回复** — `+reply` / `+reply-all`（默认存草稿，加 `--confirm-send` 则立即发送）
+6. **转发** — `+forward`（默认存草稿，加 `--confirm-send` 则立即发送）
+7. **新邮件** — `+send` 存草稿（默认），加 `--confirm-send` 发送
+8. **确认投递** — 立即发送后用 `send_status` 查询投递状态，定时发送后在预定时间后再查询；取消定时发送用 `cancel_scheduled_send`
+9. **编辑草稿** — `+draft-edit` 修改已有草稿。正文编辑通过 `--patch-file`：回复/转发草稿用 `set_reply_body` op 保留引用区，普通草稿用 `set_body` op
+10. **已读回执** —
    - **请求回执（写信侧）**：`--request-receipt` 仅在**用户显式要求**时添加，**不要从 subject / body 内容推断意图**。
    - **响应回执（拉信侧）**：拉信看到 `label_ids` 含 `READ_RECEIPT_REQUEST`（或 `-607`）时，**必须先问用户**是否回执（不要自动回执，涉及隐私）。用户同意 → `+send-receipt` 响应；用户不同意但想消掉提示 → `+decline-receipt` 只清本地标签、不发邮件。
 
@@ -417,7 +418,7 @@ lark-cli mail +message --message-id <id>
 
 ## 原生 API 调用规则
 
-没有 Shortcut 覆盖的操作才使用原生 API。调用步骤以本节为准（API Resources 章节的 resource/method 列表可辅助查阅）。
+没有 Shortcut 覆盖的操作才使用原生 API。标签、已读状态、移动文件夹优先使用 `+message-modify`；软删除优先使用 `+message-trash`。调用步骤以本节为准（API Resources 章节的 resource/method 列表可辅助查阅）。
 
 ### Step 1 — 用 `-h` 确定要调用的 API（必须，不可跳过）
 

skills/lark-doc/SKILL.md

@@ -39,7 +39,7 @@ lark-cli docs +update --doc "文档URL或token" --command append --content '<p>
 - 连续执行多个文档写操作时，必须按 [`lark-doc-update.md`](references/lark-doc-update.md) 的「Block ID 生命周期」判断旧 block ID 是否还能复用；`overwrite` / `block_replace` / `block_delete` 后不要复用受影响的旧 ID，插入 / 复制后要重新 fetch 才能拿到新 block ID
 - 用户需要在文档内**创建、复制或移动**资源块（画板、电子表格、多维表格等）时，必须先读取 [`lark-doc-xml.md`](references/lark-doc-xml.md) 的「三、资源块」章节
 - 写文档时，由内容和用户意图决定表达形式；流程、架构、路线图、关键指标等信息可以使用画板，但不要默认把重要信息都画板化
-- 新增或更新画板时，按 [`lark-doc-whiteboard.md`](references/lark-doc-whiteboard.md) 选型；Mermaid 可由主 Agent 直接插入，SVG / 复杂图 / 已有画板更新按其中流程隔离到 SubAgent
+- 新增或更新画板时，按 [`lark-doc-whiteboard.md`](references/lark-doc-whiteboard.md) 选型；先按图形语义判断 Mermaid / SVG / blank 路径，再用复杂度与上下文预算决定是否隔离到 SubAgent。简单 Mermaid 和简单自包含 SVG 可由主 Agent 直接插入；复杂图或已有画板内容更新再切到 `lark-whiteboard`
 - 用户说"看一下文档里的图片/附件/素材""预览素材" → 用 `lark-cli docs +media-preview`
 - 用户明确说"下载素材" → 用 `lark-cli docs +media-download`
 - 用户想把文档回滚到某个 `revision_id` 或某一时刻 → 先读 [`lark-doc-history.md`](references/lark-doc-history.md)，按其中流程操作

skills/lark-doc/references/lark-doc-update.md

@@ -230,7 +230,9 @@ lark-cli docs +update --doc "<doc_id>" --command str_replace \
 
 ## 画板处理
 
-> **`docs +update` 不能直接编辑已有画板的内容。** 本命令只能**新增**画板块；要修改已有画板，先用 `docs +fetch` 取到 `<whiteboard token="...">`，再按 [`lark-doc-whiteboard.md`](lark-doc-whiteboard.md) 启动 SubAgent 读取 [`lark-whiteboard`](../../lark-whiteboard/SKILL.md) 并写入。
+> **`docs +update` 不能直接编辑已有画板的内容。** 本命令只能**新增**画板块；要修改已有画板内部内容，先用 `docs +fetch` 取到 `<whiteboard token="...">`，再按 [`lark-doc-whiteboard.md`](lark-doc-whiteboard.md) 切到 [`lark-whiteboard`](../../lark-whiteboard/SKILL.md) 写入。
+>
+> **如果是更换文档中嵌入的画板底层类型**（例如把 `<whiteboard type="mermaid">` 改成 `<whiteboard type="svg">`，或改成 `blank` 后再交由 `lark-whiteboard` 填充），这属于文档 block 层替换，不是画板内部编辑；应优先使用 `docs +update --command block_replace` 整块替换该 `<whiteboard>` block。
 
 画板的语法选型与插入示例见 [`lark-doc-xml.md`](lark-doc-xml.md) 与 [`lark-doc-whiteboard.md`](lark-doc-whiteboard.md)。
 

skills/lark-doc/references/lark-doc-whiteboard.md

@@ -4,10 +4,10 @@
 
 ## 两个 Skill 的职责边界
 
-| Skill             | 核心职责                                                      | 约束                              |
-|-------------------|-----------------------------------------------------------|---------------------------------|
-| `lark-doc`        | 识别画板机会、使用 Mermaid/SVG 创建图表、调度 SubAgent、插入简单 SVG 画板或复杂空白画板 | 主 Agent 不直接创作画板内容；              |
-| `lark-whiteboard` | 查询/导出已有画板；复杂图表生成（Mermaid/DSL/SVG 路由、场景选型、渲染验证）；写入已有/空白画板  | 仅特别复杂的图表或已有画板更新时由独立 SubAgent 读取 |
+| Skill | 核心职责 | 约束 |
+|---|---|---|
+| `lark-doc` | 识别画板机会、决定文档内嵌画板用 Mermaid / SVG / blank 哪条路径、直接插入简单 Mermaid 或简单自包含 SVG、在需要时创建空白画板并把后续创作切给 `lark-whiteboard` | 主 Agent 负责文档入口的选型和简单插入；不要把所有图都默认外包给 SubAgent |
+| `lark-whiteboard` | 查询 / 导出已有画板；处理复杂图表生成、DSL/场景选型、渲染验证；写入已有画板或空白画板 | 当图复杂、需要多轮打磨、需要 whiteboard 专属场景能力，或要更新已有画板内部内容时再切入 |
 
 ## 画板适用规则
 
@@ -19,49 +19,92 @@
 
 ### 步骤 1：识别画板机会
 
-| 场景                      | 入口                                                        |
-|-------------------------|-----------------------------------------------------------|
-| 文档中需要思维导图、时序图、类图、饼图、甘特图 | 步骤 2A:使用 mermaid 插入图表                                     |
-| 文档中需要插入其他图表/自定义图形       | 步骤 2B: 使用 SVG 插入图表                                        |
-| 已有画板需要更新内容              | 先 `docs +fetch` 获取 `board_token`，跳至步骤 3B |
-| 只查看 / 下载已有画板            | 切换至 `lark-whiteboard`，不走本流程                               |
+| 场景 | 入口 |
+|---|---|
+| 文档中需要思维导图、时序图、类图、饼图、甘特图，或用户明确给了 Mermaid 语法 | 优先看步骤 2A：使用 Mermaid 插入图表 |
+| 文档中需要组织结构、架构关系、泳道、对比、分层、漏斗、金字塔、飞轮、路线图、信息卡片式示意等更依赖形状表达的图 | 优先看步骤 2B：按复杂度选择直接插入 SVG 或先建空白画板 |
+| 已有画板需要更新内部内容 | 先 `docs +fetch` 获取 `board_token`，跳至步骤 3B |
+| 只查看 / 下载已有画板 | 切换至 `lark-whiteboard`，不走本流程 |
 
 > [!IMPORTANT]
-> ⚠️ **分别对每个图表进行决策**
+> **每个图单独决策，不按整篇文档一刀切。**
 
-如果有多个位置需要插入图表，你需要根据每个图表的内容**分别决定**采用步骤 2A 还是 2B
-中的方式插入这个图表。在需要插入思维导图、时序图、类图、饼图、甘特图的时候可以插入 mermaid 块，在需要插入其他类型图表时启动
-SubAgent 插入 SVG。
+先看图形语义，再看实现成本。不要把“哪种更好插入”当成第一判断标准：
 
-建议优先使用 SVG 插入图表，除非其属于思维导图、时序图、类图、饼图、甘特图这类可以直接使用 mermaid 语法描述，且不适宜用 SVG 绘制的图表
+- **结构即语义**的图，优先 Mermaid：例如思维导图、时序图、类图、饼图、甘特图，以及用户明确给出 Mermaid 文本的场景
+- **形状即语义**的图，优先 SVG / blank + `lark-whiteboard`：例如组织架构、流程分层、架构拓扑、泳道、漏斗、金字塔、飞轮、路线图、对比卡片
+- **已有画板内部内容修改**，不走文档重建，直接切 `lark-whiteboard`
 
-### 步骤 2A: 使用 mermaid 插入图表
+### 步骤 1.5：选型表
+
+| 图形语义 / 复杂度 | 推荐路径 | 说明 |
+|---|---|---|
+| Mermaid 原生强适配，且图不复杂 | 主 Agent 直接插入 `<whiteboard type="mermaid">` | 适合源码短、结构清晰、无需复杂视觉设计的图 |
+| SVG 更合适，但图简单、源码可控、主流程上下文足够 | 主 Agent 直接插入 `<whiteboard type="svg">` | 适合简单对比图、轻量架构示意、少量节点关系图 |
+| SVG 或 whiteboard scene 更合适，且图复杂、源码长、需要多轮修改或渲染校验 | 先插入 `<whiteboard type="blank"></whiteboard>`，再切 `lark-whiteboard` | 适合复杂流程、泳道、漏斗、金字塔、飞轮、大型架构图 |
+| 已有画板内部内容更新 | 切 `lark-whiteboard` | 这是画板内容编辑，不是文档 block 替换 |
+| 仅更换嵌入类型（mermaid / svg / blank 之间切换） | 用 `docs +update --command block_replace` 替换整个 `<whiteboard>` block | 这是文档层替换，不是画板内部编辑 |
+
+### 步骤 2A：使用 Mermaid 插入图表
 
 ```xml
-
 <whiteboard type="mermaid">
     mermaid 代码...
 </whiteboard>
 ```
 
-### 步骤 2B: SubAgent 使用 SVG 插入图表
+适用条件：
 
-主 Agent 启动 SubAgent，让它用 `docs +create` / `docs +update` 插入：
+- 图本身更适合 Mermaid 表达
+- Mermaid 文本较短，主流程可以稳定维护
+- 不需要复杂视觉编排或多轮渲染打磨
+
+### 步骤 2B：SVG 路径
+
+当图形语义更适合 SVG 表达时，不要默认一定启动 SubAgent，先判断复杂度与上下文预算。
+
+#### 2B-1：简单 SVG 由主 Agent 直接插入
 
 ```xml
-
 <whiteboard type="svg">
-    <svg...>...
-    </svg>
+    <svg ...>...</svg>
 </whiteboard>
 ```
 
-Sub Agent 需要携带以下的最小上下文，以及后续的 [SVG 设计 Workflow] 章节指南：
+适用条件：
+
+- 节点不多，结构清晰，SVG 源码规模可控
+- 不需要 whiteboard 专属 scene、复杂布局推演或多轮修图
+- 主流程保留该图上下文不会明显污染后续任务
+
+#### 2B-2：复杂图先建空白画板，再切 `lark-whiteboard`
+
+主 Agent 先在文档里插入：
+
+```xml
+<whiteboard type="blank"></whiteboard>
+```
+
+然后读取返回值里的 `block_token` / whiteboard token，切到 `lark-whiteboard` 完成写入。
+
+适用条件：
+
+- 图表复杂，源码长，或预期需要多轮修改
+- 需要 `lark-whiteboard` 的 DSL / scene / 渲染校验能力
+- 图对视觉质量要求高，主流程继续携带画图上下文成本过高
+
+切给 `lark-whiteboard` 时携带最小上下文：
 
 - doc token、插入位置（标题 / block_id / command）
+- board_token
 - 图表目标、受众、源段落或数据
-- 要求读取 `lark-doc-xml.md`；不需要读取 `lark-whiteboard`
+- 推荐画板类型或推荐 scene（如果已经判断出来）
+
+### 步骤 2C：直接插入 SVG 时的约束
+
 - SVG 必须完整自包含：包含 `<svg>` 根节点和 `viewBox`，不引用外部图片、脚本、远程资源
+- 直接插入 SVG 时仍需遵守下方的 [SVG 设计 Workflow] 与支持/不支持特性约束
+- 如果插入后发现设计方向不对或需要大改，不要在文档层反复硬改；改走 2B-2 或切 `lark-whiteboard`
 
 #### 画板 SVG 设计指南
 
@@ -125,24 +168,30 @@ lark-cli whiteboard +query \
   --output ./preview.png
 ```
 
-### 步骤 3B：编辑已有画板 — 启动 lark-whiteboard SubAgent
+### 步骤 3B：编辑已有画板或复杂空白画板
 
-复杂图和已有画板更新必须启动 SubAgent。主 Agent 只传最小上下文，不直接执行 `lark-whiteboard` 的渲染和写入流程。
+以下场景切 `lark-whiteboard`：
 
-复杂图 SubAgent 的最小上下文：
+- 更新已有画板内部内容
+- 已经插入 `<whiteboard type="blank"></whiteboard>`，需要继续填充
+- 复杂图需要 `lark-whiteboard` 的 DSL / scene / 渲染校验能力
+
+最小上下文：
 
 - board_token
 - 图表目标、推荐画板类型、受众
 - 与图表直接相关的源段落或数据
 - 要求读取 [`../../lark-whiteboard/SKILL.md`](../../lark-whiteboard/SKILL.md)，按其完整流程写入该 board_token
 
-多个画板互不依赖时，可并行启动多个 SubAgent；每个 SubAgent 只负责一个画板或一个 SVG 插入点，不要互相复用上下文。
+如果只是想把现有 `<whiteboard type="mermaid">` 换成 `<whiteboard type="svg">`，或从 `svg` 改成 `blank` 再重做，不走本步骤，回到文档层用 `docs +update --command block_replace` 替换整个画板 block。
 
 ### 步骤 4：完成校验
 
-- Mermaid: 确认插入的是 `<whiteboard type="mermaid">`，且内容 mermaid 语法完整
-- SVG: 确认插入的是 `<whiteboard type="svg">`，且内容是完整 `<svg ...>...</svg>`
-- 不保留空白占位画板；复杂路径只有空白画板而无内容视为任务未完成
+- Mermaid：确认插入的是 `<whiteboard type="mermaid">`，且 Mermaid 语法完整
+- 直接插入 SVG：确认插入的是 `<whiteboard type="svg">`，且内容是完整 `<svg ...>...</svg>`
+- blank 路径：确认空白画板后续已经由 `lark-whiteboard` 写入内容；只有占位空板视为任务未完成
+- 已有画板更新：确认走的是 `lark-whiteboard`，不是误用 `docs +update` 直接改内部内容
+- 类型切换：确认走的是文档层 `block_replace`，不是误当成画板内部编辑
 
 ---
 

skills/lark-doc/references/lark-doc-xml.md

@@ -41,7 +41,7 @@ p, h1-h9, ul, ol, li, table, thead, tbody, tr, th, td, blockquote, pre, code, hr
 文档中可嵌入外部资源块（属于容器标签的特殊形式），需要额外语法创建：
 
 - `<img>` — `<img href="https://..."/>` 上传网络图片
-- `<whiteboard>` — 简单图由 SubAgent 直接插入 `<whiteboard type="svg">完整自包含 SVG</whiteboard>`；复杂图使用 `<whiteboard type="blank"></whiteboard>` 先创建空白画板，再按 [`lark-doc-whiteboard.md`](lark-doc-whiteboard.md) 启动 SubAgent 调用 `lark-whiteboard` 写入；
+- `<whiteboard>` — 按 [`lark-doc-whiteboard.md`](lark-doc-whiteboard.md) 先判断图形语义与复杂度：结构语义强且 Mermaid 适配时可直接写 `<whiteboard type="mermaid">...</whiteboard>`；简单且自包含的 SVG 可直接写 `<whiteboard type="svg">完整自包含 SVG</whiteboard>`；复杂图或需要多轮编辑时先创建 `<whiteboard type="blank"></whiteboard>`，再按该指南切到 `lark-whiteboard` 写入；
 - `<sheet>` — `<sheet type="blank"></sheet>` 空白；`<sheet sheet-id="SID" token="TOKEN"></sheet>` 复制已有
 - `<task>` — `<task task-id="GUID"></task>`，必传 task-id（任务 guid）
 - `<chat_card>` — `<chat_card chat-id="CHAT_ID"></chat_card>`，必传 chat-id

skills/lark-mail/SKILL.md

@@ -79,7 +79,7 @@ metadata:
 
 1. `+triage --from spam@x.com` → 列出 N 条结果
 2. 展示："将删除 N 封邮件（发件人 spam@x.com，主题：…），确认？"
-3. 用户确认后 → `*.batch_trash`
+3. 用户确认后 → `+message-trash --message-ids ... --yes`
 
 ## 身份选择：优先使用 user 身份
 
@@ -96,13 +96,14 @@ metadata:
 1. **确认身份** — 首次操作邮箱前先调用 `lark-cli mail user_mailboxes profile --params '{"user_mailbox_id":"me"}'` 获取当前用户的真实邮箱地址（`primary_email_address`），不要通过系统用户名猜测。后续判断"发件人是否为用户本人"时以此地址为准。
 2. **浏览** — `+triage` 查看收件箱摘要，获取 `message_id` / `thread_id`
 3. **阅读** — `+message` 只读单封邮件；已有多个 `message_id` 时用 `+messages` 批量读取，不要循环调用 `+message`；`+thread` 读整个会话
-4. **回复** — `+reply` / `+reply-all`（默认存草稿，加 `--confirm-send` 则立即发送）
-5. **转发** — `+forward`（默认存草稿，加 `--confirm-send` 则立即发送）
-6. **新邮件** — `+send` 存草稿（默认），加 `--confirm-send` 发送
-7. **HTML body 预检（可选）** — 复杂 HTML body 提交前可先跑 `+lint-html` 看 lint 会改 / 删什么；写信路径（`+send` / `+draft-create` / `+reply` / `+reply-all` / `+forward` / `+draft-edit` body op）已内置 autofix，普通正文不必先跑。详见 [references/lark-mail-html.md](references/lark-mail-html.md) 中的「写入路径内置 HTML lint」章节
-8. **确认投递** — 立即发送后用 `send_status` 查询投递状态，定时发送后在预定时间后再查询；取消定时发送用 `cancel_scheduled_send`
-9. **编辑草稿** — `+draft-edit` 修改已有草稿。正文编辑通过 `--patch-file`：回复/转发草稿用 `set_reply_body` op 保留引用区，普通草稿用 `set_body` op
-10. **已读回执** —
+4. **整理** — 标签、已读/未读状态和移动文件夹优先用 `+message-modify`；软删除优先用 `+message-trash`
+5. **回复** — `+reply` / `+reply-all`（默认存草稿，加 `--confirm-send` 则立即发送）
+6. **转发** — `+forward`（默认存草稿，加 `--confirm-send` 则立即发送）
+7. **新邮件** — `+send` 存草稿（默认），加 `--confirm-send` 发送
+8. **HTML body 预检（可选）** — 复杂 HTML body 提交前可先跑 `+lint-html` 看 lint 会改 / 删什么；写信路径（`+send` / `+draft-create` / `+reply` / `+reply-all` / `+forward` / `+draft-edit` body op）已内置 autofix，普通正文不必先跑。详见 [references/lark-mail-html.md](references/lark-mail-html.md) 中的「写入路径内置 HTML lint」章节
+9. **确认投递** — 立即发送后用 `send_status` 查询投递状态，定时发送后在预定时间后再查询；取消定时发送用 `cancel_scheduled_send`
+10. **编辑草稿** — `+draft-edit` 修改已有草稿。正文编辑通过 `--patch-file`：回复/转发草稿用 `set_reply_body` op 保留引用区，普通草稿用 `set_body` op
+11. **已读回执** —
    - **请求回执（写信侧）**：`--request-receipt` 仅在**用户显式要求**时添加，**不要从 subject / body 内容推断意图**。
    - **响应回执（拉信侧）**：拉信看到 `label_ids` 含 `READ_RECEIPT_REQUEST`（或 `-607`）时，**必须先问用户**是否回执（不要自动回执，涉及隐私）。用户同意 → `+send-receipt` 响应；用户不同意但想消掉提示 → `+decline-receipt` 只清本地标签、不发邮件。
 
@@ -119,6 +120,8 @@ metadata:
 - 查看发送邮件后的投递状态：发送成功后查看邮件投递状态；也覆盖发送拦截。ref: [lark-mail-send-status](references/lark-mail-send-status.md)
 - 使用邮件模板：区分个人模板和静态 HTML 模板，发信类 shortcut 用 `--template-id` 套用模板。ref: [lark-mail-template](references/lark-mail-template.md)
 - 撤回已发送邮件：撤回邮件并查询异步撤回状态。ref: [lark-mail-recall](references/lark-mail-recall.md)
+- 修改邮件标签/已读状态/文件夹：优先使用 `+message-modify`。ref: [`+message-modify`](references/lark-mail-message-modify.md)
+- 软删除邮件：优先使用 `+message-trash`。ref: [`+message-trash`](references/lark-mail-message-trash.md)
 - 收信规则：创建、验证、删除自动处理收到邮件的规则。ref: [lark-mail-rules](references/lark-mail-rules.md)
 - 分享邮件到 IM：分享邮件或会话到群聊、个人会话。ref: [lark-mail-share-to-chat](references/lark-mail-share-to-chat.md)
 - 发送日程邀请邮件：在邮件中嵌入 `text/calendar` 日程邀请。ref: [lark-mail-calendar-invite](references/lark-mail-calendar-invite.md)
@@ -192,7 +195,7 @@ lark-cli mail +messages --message-ids <id1>,<id2>,<id3> --html=false
 
 ## 原生 API 调用规则
 
-没有 Shortcut 覆盖的操作才使用原生 API。调用步骤以本节为准；资源和 method 用 `lark-cli mail -h` / `lark-cli mail <resource> -h` 发现，不在入口保留完整资源表。
+没有 Shortcut 覆盖的操作才使用原生 API。标签、已读状态、移动文件夹优先使用 `+message-modify`；软删除优先使用 `+message-trash`。调用步骤以本节为准；资源和 method 用 `lark-cli mail -h` / `lark-cli mail <resource> -h` 发现，不在入口保留完整资源表。
 
 ### Step 1 — 用 `-h` 确定要调用的 API（必须，不可跳过）
 

skills/lark-mail/references/lark-mail-forward.md

@@ -215,7 +215,7 @@ lark-cli mail user_mailbox.drafts cancel_scheduled_send --params '{"user_mailbox
 **2. 标记已读**（可选）— 询问用户是否需要将原邮件标记为已读。如果用户同意：
 
 ```bash
-lark-cli mail user_mailbox.messages batch_modify --params '{"user_mailbox_id":"me"}' --data '{"message_ids":["<原邮件ID>"],"remove_label_ids":["UNREAD"]}'
+lark-cli mail +message-modify --message-ids <原邮件ID> --remove-label-ids UNREAD
 ```
 
 ## 编辑转发草稿

skills/lark-mail/references/lark-mail-message-modify.md

@@ -0,0 +1,48 @@
+# mail +message-modify
+
+`mail +message-modify` is the preferred shortcut for changing labels, read-state labels, or folder placement on existing messages.
+
+Use it instead of raw `user_mailbox.messages batch_modify` when the operation targets concrete `message_id` values from `+triage`, `+message`, or `+messages`.
+
+## Common Commands
+
+```bash
+lark-cli mail +message-modify --message-ids <id1>,<id2> --add-label-ids unread
+lark-cli mail +message-modify --message-ids <id> --remove-label-ids FLAGGED
+lark-cli mail +message-modify --message-ids <id> --add-folder archive
+lark-cli mail +message-modify --mailbox shared@example.com --message-ids <id> --add-folder folder_xxx
+lark-cli mail +message-modify --message-ids <id> --add-label-ids custom_label_id --dry-run
+```
+
+## Flags
+
+| Flag | Required | Notes |
+| --- | --- | --- |
+| `--mailbox` | No | Mailbox that owns the messages. Defaults to `me`. |
+| `--message-ids` | Yes | `string_array`; supports comma-separated values and repeated flags. |
+| `--add-label-ids` | No | Adds labels. System labels `unread`, `important`, `other`, `flagged` normalize to upper case. |
+| `--remove-label-ids` | No | Removes labels. Cannot overlap with `--add-label-ids`. |
+| `--add-folder` | No | Moves to one folder. `inbox`, `sent`, `spam`, `archive`, `archived` normalize to system folder IDs. |
+
+`TRASH` is intentionally rejected by this shortcut. Use `mail +message-trash --message-ids <id> --yes` for soft deletion.
+
+## Behavior
+
+- Message IDs are locally validated, de-duplicated in first-seen order, and sent in batches of 20.
+- Custom label IDs are checked with `labels.get`; custom folder IDs are checked with `folders.get`.
+- If no label or folder operation is requested, the command succeeds locally, emits all message IDs as `success_message_ids`, and makes no POST request.
+- Single batch POST failures mark every message in that batch with the same failure reason; later batches still run.
+- JSON output is intentionally compact:
+
+```json
+{
+  "success_message_ids": ["id1"],
+  "failed_message_ids": [
+    {"message_id": "id2", "reason": "api error"}
+  ]
+}
+```
+
+## When Raw API Is Still Appropriate
+
+Use raw `mail user_mailbox.messages batch_modify` only when you need a request shape that the shortcut intentionally does not expose, or when reproducing backend/API behavior exactly for diagnostics.

skills/lark-mail/references/lark-mail-message-trash.md

@@ -0,0 +1,41 @@
+# mail +message-trash
+
+`mail +message-trash` is the preferred shortcut for soft-deleting existing messages.
+
+Use it after obtaining real `message_id` values from `+triage`, `+message`, or `+messages`, and after the user has confirmed the deletion preview.
+
+## Common Commands
+
+```bash
+lark-cli mail +message-trash --message-ids <id1>,<id2> --yes
+lark-cli mail +message-trash --mailbox shared@example.com --message-ids <id> --yes
+lark-cli mail +message-trash --message-ids <id1> --message-ids <id2> --dry-run
+```
+
+## Flags
+
+| Flag | Required | Notes |
+| --- | --- | --- |
+| `--mailbox` | No | Mailbox that owns the messages. Defaults to `me`. |
+| `--message-ids` | Yes | `string_array`; supports comma-separated values and repeated flags. |
+| `--yes` | Yes for execution | Required by the high-risk write confirmation framework. |
+
+## Behavior
+
+- Message IDs are locally validated, de-duplicated in first-seen order, and sent in batches of 20.
+- The shortcut calls `POST /open-apis/mail/v1/user_mailboxes/<mailbox>/messages/batch_trash` sequentially.
+- Single batch POST failures mark every message in that batch with the same failure reason; later batches still run.
+- JSON output is intentionally compact:
+
+```json
+{
+  "success_message_ids": ["id1"],
+  "failed_message_ids": [
+    {"message_id": "id2", "reason": "api error"}
+  ]
+}
+```
+
+## When Raw API Is Still Appropriate
+
+Use raw `mail user_mailbox.messages batch_trash` only when reproducing backend/API behavior exactly for diagnostics. For normal soft deletion, prefer this shortcut because it handles validation, batching, compact output, and `--yes` confirmation consistently.

skills/lark-mail/references/lark-mail-reply-all.md

@@ -203,7 +203,7 @@ lark-cli mail user_mailbox.drafts cancel_scheduled_send --params '{"user_mailbox
 **2. 标记已读**（可选）— 询问用户是否需要将原邮件标记为已读。如果用户同意：
 
 ```bash
-lark-cli mail user_mailbox.messages batch_modify --params '{"user_mailbox_id":"me"}' --data '{"message_ids":["<原邮件ID>"],"remove_label_ids":["UNREAD"]}'
+lark-cli mail +message-modify --message-ids <原邮件ID> --remove-label-ids UNREAD
 ```
 
 ## 相关命令

skills/lark-mail/references/lark-mail-reply.md

@@ -218,7 +218,7 @@ lark-cli mail user_mailbox.drafts cancel_scheduled_send --params '{"user_mailbox
 **2. 标记已读**（可选）— 询问用户是否需要将原邮件标记为已读。如果用户同意：
 
 ```bash
-lark-cli mail user_mailbox.messages batch_modify --params '{"user_mailbox_id":"me"}' --data '{"message_ids":["<原邮件ID>"],"remove_label_ids":["UNREAD"]}'
+lark-cli mail +message-modify --message-ids <原邮件ID> --remove-label-ids UNREAD
 ```
 
 ## 编辑回复草稿

tests/cli_e2e/application/slash_command_dryrun_test.go

@@ -1,166 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package application
-
-import (
-	"context"
-	"testing"
-	"time"
-
-	clie2e "github.com/larksuite/cli/tests/cli_e2e"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"github.com/tidwall/gjson"
-)
-
-// setSlashCommandDryRunEnv isolates config and supplies stub credentials so
-// dry-run / the pre-Execute confirmation gate short-circuit before identity
-// resolution touches a real keychain. Mirrors tests/cli_e2e/apps/helpers_test.go
-// and tests/cli_e2e/calendar/calendar_update_dryrun_test.go.
-func setSlashCommandDryRunEnv(t *testing.T) {
-	t.Helper()
-	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
-	t.Setenv("LARKSUITE_CLI_APP_ID", "application_dryrun_test")
-	t.Setenv("LARKSUITE_CLI_APP_SECRET", "application_dryrun_secret")
-	t.Setenv("LARKSUITE_CLI_BRAND", "feishu")
-}
-
-const slashCommandBasePath = "/open-apis/application/v7/app_slash_commands"
-
-// TestSlashCommandList_DryRunShowsGetPath pins the read-only GET shape for
-// `application +slash-command-list --dry-run`.
-func TestSlashCommandList_DryRunShowsGetPath(t *testing.T) {
-	setSlashCommandDryRunEnv(t)
-
-	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
-	t.Cleanup(cancel)
-
-	result, err := clie2e.RunCmd(ctx, clie2e.Request{
-		Args: []string{
-			"application", "+slash-command-list",
-			"--dry-run",
-		},
-		DefaultAs: "bot",
-	})
-	require.NoError(t, err)
-	result.AssertExitCode(t, 0)
-
-	out := result.Stdout
-	assert.Equal(t, "GET", gjson.Get(out, "api.0.method").String(), "stdout:\n%s", out)
-	assert.Equal(t, slashCommandBasePath, gjson.Get(out, "api.0.url").String(), "stdout:\n%s", out)
-}
-
-// TestSlashCommandCreate_DryRunShowsPostBody pins the POST body shape for
-// `application +slash-command-create --dry-run`: icon sits at the TOP LEVEL,
-// a sibling of description (not nested inside description) - the official
-// create sample nesting icon inside description is a documented doc bug -
-// and description.i18n carries the localized map.
-func TestSlashCommandCreate_DryRunShowsPostBody(t *testing.T) {
-	setSlashCommandDryRunEnv(t)
-
-	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
-	t.Cleanup(cancel)
-
-	result, err := clie2e.RunCmd(ctx, clie2e.Request{
-		Args: []string{
-			"application", "+slash-command-create",
-			"--command", "greet",
-			"--description", "say hi",
-			"--description-i18n", "zh_cn=你好",
-			"--icon-key", "skill_outlined",
-			"--dry-run",
-		},
-		DefaultAs: "bot",
-	})
-	require.NoError(t, err)
-	result.AssertExitCode(t, 0)
-
-	out := result.Stdout
-	assert.Equal(t, "POST", gjson.Get(out, "api.0.method").String(), "stdout:\n%s", out)
-	assert.Equal(t, slashCommandBasePath, gjson.Get(out, "api.0.url").String(), "stdout:\n%s", out)
-	assert.Equal(t, "greet", gjson.Get(out, "api.0.body.command").String(), "stdout:\n%s", out)
-	assert.Equal(t, "say hi", gjson.Get(out, "api.0.body.description.default_value").String(), "stdout:\n%s", out)
-	assert.Equal(t, "你好", gjson.Get(out, "api.0.body.description.i18n.zh_cn").String(), "stdout:\n%s", out)
-	// icon is a top-level key, sibling of description.
-	assert.Equal(t, "skill_outlined", gjson.Get(out, "api.0.body.icon.icon_key").String(), "stdout:\n%s", out)
-	assert.False(t, gjson.Get(out, "api.0.body.description.icon").Exists(), "icon must not be nested inside description:\n%s", out)
-}
-
-// TestSlashCommandUpdate_DryRunShowsPatchPath pins the PATCH shape for
-// `application +slash-command-update --command-id --dry-run`.
-func TestSlashCommandUpdate_DryRunShowsPatchPath(t *testing.T) {
-	setSlashCommandDryRunEnv(t)
-
-	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
-	t.Cleanup(cancel)
-
-	result, err := clie2e.RunCmd(ctx, clie2e.Request{
-		Args: []string{
-			"application", "+slash-command-update",
-			"--command-id", "id_dry",
-			"--description", "updated description",
-			"--dry-run",
-		},
-		DefaultAs: "bot",
-	})
-	require.NoError(t, err)
-	result.AssertExitCode(t, 0)
-
-	out := result.Stdout
-	assert.Equal(t, "PATCH", gjson.Get(out, "api.0.method").String(), "stdout:\n%s", out)
-	assert.Equal(t, slashCommandBasePath+"/id_dry", gjson.Get(out, "api.0.url").String(), "stdout:\n%s", out)
-	assert.Equal(t, "updated description", gjson.Get(out, "api.0.body.description.default_value").String(), "stdout:\n%s", out)
-}
-
-// TestSlashCommandDelete_DryRunShowsDeletePath pins the DELETE shape for
-// `application +slash-command-delete --command-id --yes --dry-run`. Dry-run
-// short-circuits before the high-risk-write confirmation gate (see
-// shortcuts/common/runner.go), but --yes is passed anyway to match the
-// eventual real invocation the agent would run.
-func TestSlashCommandDelete_DryRunShowsDeletePath(t *testing.T) {
-	setSlashCommandDryRunEnv(t)
-
-	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
-	t.Cleanup(cancel)
-
-	result, err := clie2e.RunCmd(ctx, clie2e.Request{
-		Args: []string{
-			"application", "+slash-command-delete",
-			"--command-id", "id_dry",
-			"--dry-run",
-		},
-		Yes:       true,
-		DefaultAs: "bot",
-	})
-	require.NoError(t, err)
-	result.AssertExitCode(t, 0)
-
-	out := result.Stdout
-	assert.Equal(t, "DELETE", gjson.Get(out, "api.0.method").String(), "stdout:\n%s", out)
-	assert.Equal(t, slashCommandBasePath+"/id_dry", gjson.Get(out, "api.0.url").String(), "stdout:\n%s", out)
-}
-
-// TestSlashCommandDelete_WithoutYesRequiresConfirmation asserts the
-// high-risk-write gate fires BEFORE any HTTP call: no --dry-run, no --yes ->
-// exit 10 (ExitConfirmationRequired) with a confirmation_required envelope on
-// stderr (see internal/output/exitcode.go and cmd/root.go handleRootError).
-func TestSlashCommandDelete_WithoutYesRequiresConfirmation(t *testing.T) {
-	setSlashCommandDryRunEnv(t)
-
-	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
-	t.Cleanup(cancel)
-
-	result, err := clie2e.RunCmd(ctx, clie2e.Request{
-		Args: []string{
-			"application", "+slash-command-delete",
-			"--command-id", "id_dry",
-		},
-		DefaultAs: "bot",
-	})
-	require.NoError(t, err)
-	result.AssertExitCode(t, 10)
-
-	assert.Equal(t, "confirmation", gjson.Get(result.Stderr, "error.type").String(), "stderr:\n%s", result.Stderr)
-	assert.Equal(t, "confirmation_required", gjson.Get(result.Stderr, "error.subtype").String(), "stderr:\n%s", result.Stderr)
-}

tests/cli_e2e/mail/coverage.md

@@ -1,9 +1,9 @@
 # Mail CLI E2E Coverage
 
 ## Metrics
-- Denominator: 63 leaf commands
-- Covered: 14
-- Coverage: 22.2%
+- Denominator: 65 leaf commands
+- Covered: 16
+- Coverage: 24.6%
 
 ## Summary
 - TestMail_DraftLifecycleWorkflowAsUser: proves a self-contained user draft workflow across `mail user_mailboxes profile`, `mail +draft-create`, `mail user_mailbox.drafts list`, `mail user_mailbox.drafts get`, `mail +draft-edit`, and `mail user_mailbox.drafts delete`; key `t.Run(...)` proof points are `get mailbox profile as user`, `create draft with shortcut as user`, `list draft as user`, `get created draft as user`, `inspect created draft as user`, `update draft subject with shortcut as user`, `inspect updated draft as user`, `delete draft as user`, and `verify draft removed from list as user`.
@@ -20,6 +20,8 @@
 | ✓ | mail +draft-send | shortcut | mail_draft_send_workflow_test.go::TestMail_DraftSendWorkflowAsUser/send draft with shortcut as user; mail_draft_send_dryrun_test.go::TestMail_DraftSendDryRun | `--draft-id`; `--mailbox me`; `--yes`; dry-run repeated/comma-separated `--draft-id` | sends a self-addressed draft through the batch shortcut and locks dry-run request shape |
 | ✓ | mail +forward | shortcut | mail_send_workflow_test.go::TestMail_SendWorkflowAsUser/forward received message with shortcut as user; mail_send_workflow_test.go::TestMail_SendWorkflowAsUser/inspect forward draft as user | `--message-id`; `--to`; `--body`; `--plain-text` | uses self-generated inbox message as source and inspects forwarded draft projection |
 | ✓ | mail +message | shortcut | mail_send_workflow_test.go::TestMail_SendWorkflowAsUser/get sent message as user; mail_send_workflow_test.go::TestMail_SendWorkflowAsUser/get received message as user | `--mailbox me`; `--message-id` | verifies both SENT and INBOX copies after self-send |
+| ✓ | mail +message-modify | shortcut | shortcuts/mail/mail_message_manage_test.go::TestMessageModify_DryRunShowsPlanWithoutValidationGET; shortcuts/mail/mail_message_manage_test.go::TestMessageModify_BatchesAndAggregatesPartialFailure | `--message-ids`; `--add-label-ids`; `--remove-label-ids`; `--add-folder`; `--dry-run` | unit/dry-run coverage locks validation, batching, request shape, and partial failure aggregation; live E2E needs controlled disposable messages/labels/folders |
+| ✓ | mail +message-trash | shortcut | shortcuts/mail/mail_message_manage_test.go::TestMessageTrash_RequiresYesAndBatches | `--message-ids`; `--yes`; `--dry-run` | unit coverage locks high-risk confirmation and batch_trash request shape; live E2E needs controlled disposable messages |
 | ✓ | mail +messages | shortcut | mail_send_workflow_test.go::TestMail_SendWorkflowAsUser/get both self sent messages as user | `--mailbox me`; `--message-ids` | batch reads both sent and received message copies |
 | ✓ | mail +reply | shortcut | mail_send_workflow_test.go::TestMail_SendWorkflowAsUser/reply to received message with shortcut as user; mail_send_workflow_test.go::TestMail_SendWorkflowAsUser/inspect reply draft as user | `--message-id`; `--body`; `--plain-text` | creates reply draft from self-generated inbox message and inspects quoted content |
 | ✕ | mail +reply-all | shortcut |  | none | self-send traffic leaves no stable non-self recipient set for deterministic reply-all assertions |