fix: preserve cause chain when rewrapping name-collision error

test: use conventional placeholder credentials in app test config
test: build delete stub URL from shared base path constant
2026-07-08 18:13:01 +08:00 · 2026-07-08 17:53:18 +08:00 · 2026-07-08 17:27:22 +08:00 · 2026-07-08 17:16:02 +08:00 · 2026-07-08 17:10:01 +08:00 · 2026-07-08 16:10:18 +08:00
51 changed files with 1869 additions and 1710 deletions
--- a/cmd/auth/login_messages.go
+++ b/cmd/auth/login_messages.go
@@ -128,5 +128,5 @@ func getLoginMsg(lang i18n.Lang) *loginMsg {
 // (not backed by from_meta service specs). Descriptions are now centralized in
 // service_descriptions.json.
 func getShortcutOnlyDomainNames() []string {
-	return []string{"base", "contact", "docs", "markdown", "apps", "note"}
+	return []string{"application", "base", "contact", "docs", "markdown", "apps", "note"}
 }
--- a/internal/registry/registry_test.go
+++ b/internal/registry/registry_test.go
@@ -248,10 +248,18 @@ func TestLoadPlatformAutoApproveSet(t *testing.T) {

 func TestLoadOverrideAutoApproveAllow(t *testing.T) {
 	allowSet := LoadOverrideAutoApproveAllow()
-	// recommend.allow in scope_overrides.json is intentionally empty:
-	// no scopes are special-cased into the auto-approve set anymore.
-	if len(allowSet) != 0 {
-		t.Errorf("expected empty override allow set, got %d entries", len(allowSet))
+	// recommend.allow special-cases scopes absent from scope_priorities.json
+	// (application v7 is not in the platform catalog yet) so interactive
+	// login's "common scopes" tier still offers them. Only the read scope is
+	// admitted: write stays out of the recommended tier by design.
+	if !allowSet["application:app_slash_command:read"] {
+		t.Error("expected application:app_slash_command:read in override allow set")
+	}
+	if allowSet["application:app_slash_command:write"] {
+		t.Error("write scope must NOT be in the recommended tier")
+	}
+	if len(allowSet) != 1 {
+		t.Errorf("expected exactly 1 override allow entry, got %d", len(allowSet))
 	}
 }

--- a/internal/registry/scope_overrides.json
+++ b/internal/registry/scope_overrides.json
@@ -12,7 +12,9 @@
    "vc:meeting.meetingevent:read": 75
  },
  "recommend": {
-    "allow": [],
+    "allow": [
+      "application:app_slash_command:read"
+    ],
    "deny": [
      "im:chat",
      "im:message.send_as_user"
--- a/internal/registry/service_descriptions.json
+++ b/internal/registry/service_descriptions.json
@@ -3,6 +3,10 @@
    "en": { "title": "Approval", "description": "Approval instance, and task management" },
    "zh": { "title": "审批", "description": "审批实例、审批任务管理" }
  },
+  "application": {
+    "en": { "title": "Application", "description": "Open Platform app self-management: slash commands of the current bound app (NOT Miaoda low-code apps)" },
+    "zh": { "title": "应用管理", "description": "开放平台应用自管理：当前绑定应用的斜杠指令管理（非妙搭低代码应用）" }
+  },
  "apps": {
    "en": { "title": "Apps", "description": "Develop, deploy HTML, web pages and applications" },
    "zh": { "title": "应用", "description": "开发、部署 HTML、Web 页面和应用" }
--- a/shortcuts/application/shortcuts.go
+++ b/shortcuts/application/shortcuts.go
@@ -0,0 +1,18 @@
+// Copyright (c) 2026 Lark Technologies Pte. Ltd.
+// SPDX-License-Identifier: MIT
+
+// Package application provides shortcuts for Open Platform app
+// self-management (slash commands of the current bound app).
+package application
+
+import "github.com/larksuite/cli/shortcuts/common"
+
+// Shortcuts returns all shortcuts of the application domain.
+func Shortcuts() []common.Shortcut {
+	return []common.Shortcut{
+		SlashCommandList,
+		SlashCommandCreate,
+		SlashCommandUpdate,
+		SlashCommandDelete,
+	}
+}
--- a/shortcuts/application/slash_command_common.go
+++ b/shortcuts/application/slash_command_common.go
@@ -0,0 +1,98 @@
+// Copyright (c) 2026 Lark Technologies Pte. Ltd.
+// SPDX-License-Identifier: MIT
+
+package application
+
+import (
+	"strings"
+
+	"github.com/larksuite/cli/errs"
+)
+
+// slashCommandBasePath is the raw v7 endpoint (not in meta_data.json / SDK).
+const slashCommandBasePath = "/open-apis/application/v7/app_slash_commands"
+
+// clientCacheHint is printed to stderr after every successful write.
+const clientCacheHint = "note: changes take ~5 minutes to appear in Feishu clients (client-side cache); the server state is already updated - list reflects it immediately."
+
+// parseDescriptionI18n parses repeated --description-i18n values ("<lang>=<text>",
+// split on the FIRST '='). Returns nil for empty input. Duplicate langs rejected.
+func parseDescriptionI18n(values []string) (map[string]string, error) {
+	if len(values) == 0 {
+		return nil, nil
+	}
+	m := make(map[string]string, len(values))
+	for _, v := range values {
+		idx := strings.Index(v, "=")
+		if idx <= 0 || idx == len(v)-1 {
+			return nil, errs.NewValidationError(errs.SubtypeInvalidArgument,
+				"invalid --description-i18n value %q: expected <lang>=<text> (e.g. zh_cn=你好)", v).
+				WithParam("--description-i18n")
+		}
+		lang := strings.TrimSpace(v[:idx])
+		text := v[idx+1:]
+		if lang == "" || strings.TrimSpace(text) == "" {
+			return nil, errs.NewValidationError(errs.SubtypeInvalidArgument,
+				"invalid --description-i18n value %q: language and text must be non-empty", v).
+				WithParam("--description-i18n")
+		}
+		if _, dup := m[lang]; dup {
+			return nil, errs.NewValidationError(errs.SubtypeInvalidArgument,
+				"duplicate language %q in --description-i18n", lang).
+				WithParam("--description-i18n")
+		}
+		m[lang] = text
+	}
+	return m, nil
+}
+
+// validateCommandName rejects empty and slash-prefixed command names.
+func validateCommandName(name, flagName string) error {
+	trimmed := strings.TrimSpace(name)
+	if trimmed == "" {
+		return errs.NewValidationError(errs.SubtypeInvalidArgument,
+			"%s must not be empty", flagName).WithParam(flagName)
+	}
+	if strings.HasPrefix(trimmed, "/") {
+		return errs.NewValidationError(errs.SubtypeInvalidArgument,
+			"%s must not start with \"/\" - the slash is implied (use %q)",
+			flagName, strings.TrimPrefix(trimmed, "/")).WithParam(flagName)
+	}
+	return nil
+}
+
+// buildSlashCommandBody assembles a create/update request body. Only provided
+// fields are included: PATCH is field-level partial (absent top-level fields
+// are preserved server-side; a provided i18n map REPLACES the whole map).
+// icon sits at the top level, sibling of description (verified live; the
+// official create sample nesting icon inside description is a doc bug).
+func buildSlashCommandBody(command, description string, i18n map[string]string, iconKey string) map[string]interface{} {
+	body := map[string]interface{}{}
+	if command != "" {
+		body["command"] = command
+	}
+	if description != "" || len(i18n) > 0 {
+		desc := map[string]interface{}{}
+		if description != "" {
+			desc["default_value"] = description
+		}
+		if len(i18n) > 0 {
+			desc["i18n"] = i18n
+		}
+		body["description"] = desc
+	}
+	if iconKey != "" {
+		body["icon"] = map[string]interface{}{"icon_key": iconKey}
+	}
+	return body
+}
+
+// isCommandExists reports whether err is the server-side name-collision error
+// (code=40000000, message contains "command already exists"; verified live).
+func isCommandExists(err error) bool {
+	p, ok := errs.ProblemOf(err)
+	if !ok {
+		return false
+	}
+	return strings.Contains(p.Message, "command already exists")
+}
--- a/shortcuts/application/slash_command_common_test.go
+++ b/shortcuts/application/slash_command_common_test.go
@@ -0,0 +1,155 @@
+// Copyright (c) 2026 Lark Technologies Pte. Ltd.
+// SPDX-License-Identifier: MIT
+
+package application
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/larksuite/cli/errs"
+	"github.com/larksuite/cli/shortcuts/common"
+)
+
+func TestParseDescriptionI18n_OK(t *testing.T) {
+	m, err := parseDescriptionI18n([]string{"zh_cn=你好", "en_us=Hello=World"})
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if m["zh_cn"] != "你好" {
+		t.Errorf("zh_cn = %q", m["zh_cn"])
+	}
+	// 只按首个 = 分割：值内可含 =
+	if m["en_us"] != "Hello=World" {
+		t.Errorf("en_us = %q", m["en_us"])
+	}
+}
+
+func TestParseDescriptionI18n_Empty(t *testing.T) {
+	m, err := parseDescriptionI18n(nil)
+	if err != nil || m != nil {
+		t.Fatalf("nil input: m=%v err=%v", m, err)
+	}
+}
+
+func TestParseDescriptionI18n_BadFormat(t *testing.T) {
+	for _, bad := range []string{"zh_cn", "=text", "zh_cn=", "  =x"} {
+		_, err := parseDescriptionI18n([]string{bad})
+		if err == nil {
+			t.Errorf("%q: expected error", bad)
+			continue
+		}
+		p, ok := errs.ProblemOf(err)
+		if !ok || p.Category != errs.CategoryValidation {
+			t.Errorf("%q: expected validation problem, got %v", bad, err)
+		}
+	}
+}
+
+func TestParseDescriptionI18n_DuplicateLang(t *testing.T) {
+	_, err := parseDescriptionI18n([]string{"zh_cn=a", "zh_cn=b"})
+	if err == nil || !strings.Contains(err.Error(), "duplicate language") {
+		t.Fatalf("expected duplicate language error, got %v", err)
+	}
+}
+
+func TestValidateCommandName(t *testing.T) {
+	if err := validateCommandName("greet", "--command"); err != nil {
+		t.Fatalf("greet: %v", err)
+	}
+	for _, bad := range []string{"", "  ", "/greet"} {
+		if err := validateCommandName(bad, "--command"); err == nil {
+			t.Errorf("%q: expected error", bad)
+		}
+	}
+}
+
+func TestBuildSlashCommandBody(t *testing.T) {
+	body := buildSlashCommandBody("greet", "hi", map[string]string{"zh_cn": "你好"}, "skill_outlined")
+	if body["command"] != "greet" {
+		t.Errorf("command = %v", body["command"])
+	}
+	desc := body["description"].(map[string]interface{})
+	if desc["default_value"] != "hi" {
+		t.Errorf("default_value = %v", desc["default_value"])
+	}
+	if desc["i18n"].(map[string]string)["zh_cn"] != "你好" {
+		t.Errorf("i18n = %v", desc["i18n"])
+	}
+	// icon 与 description 顶层平级（实测钉死，文档 create 示例是笔误）
+	if body["icon"].(map[string]interface{})["icon_key"] != "skill_outlined" {
+		t.Errorf("icon = %v", body["icon"])
+	}
+	// partial：不提供的字段不出现（PATCH 语义依赖）
+	partial := buildSlashCommandBody("", "", nil, "skill_outlined")
+	if _, has := partial["command"]; has {
+		t.Error("empty command must be omitted")
+	}
+	if _, has := partial["description"]; has {
+		t.Error("empty description must be omitted")
+	}
+}
+
+// TestSlashCommandShortcuts_SharedScopesAcrossIdentities locks in the
+// reversal of the OAuth-isolation design: all four slash-command shortcuts
+// declare identical scopes for the bot and user identities (plain Scopes /
+// ConditionalScopes, no per-identity overrides), so a user-identity
+// pre-flight sees the same scope set a bot identity would.
+func TestSlashCommandShortcuts_SharedScopesAcrossIdentities(t *testing.T) {
+	cases := []struct {
+		name            string
+		shortcut        common.Shortcut
+		wantScope       string
+		wantConditional string
+		hasConditional  bool
+	}{
+		{
+			name:      "list",
+			shortcut:  SlashCommandList,
+			wantScope: "application:app_slash_command:read",
+		},
+		{
+			name:            "create",
+			shortcut:        SlashCommandCreate,
+			wantScope:       "application:app_slash_command:write",
+			wantConditional: "application:app_slash_command:read",
+			hasConditional:  true,
+		},
+		{
+			name:            "update",
+			shortcut:        SlashCommandUpdate,
+			wantScope:       "application:app_slash_command:write",
+			wantConditional: "application:app_slash_command:read",
+			hasConditional:  true,
+		},
+		{
+			name:            "delete",
+			shortcut:        SlashCommandDelete,
+			wantScope:       "application:app_slash_command:write",
+			wantConditional: "application:app_slash_command:read",
+			hasConditional:  true,
+		},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			for _, identity := range []string{"user", "bot"} {
+				declared := tc.shortcut.DeclaredScopesForIdentity(identity)
+				if !containsStr(declared, tc.wantScope) {
+					t.Errorf("%s: DeclaredScopesForIdentity(%q) = %v, want to contain %q", tc.name, identity, declared, tc.wantScope)
+				}
+				if tc.hasConditional && !containsStr(declared, tc.wantConditional) {
+					t.Errorf("%s: DeclaredScopesForIdentity(%q) = %v, want to contain conditional %q", tc.name, identity, declared, tc.wantConditional)
+				}
+			}
+		})
+	}
+}
+
+func containsStr(list []string, want string) bool {
+	for _, v := range list {
+		if v == want {
+			return true
+		}
+	}
+	return false
+}
--- a/shortcuts/application/slash_command_create.go
+++ b/shortcuts/application/slash_command_create.go
@@ -0,0 +1,117 @@
+// Copyright (c) 2026 Lark Technologies Pte. Ltd.
+// SPDX-License-Identifier: MIT
+
+package application
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"strings"
+
+	"github.com/larksuite/cli/errs"
+	"github.com/larksuite/cli/internal/validate"
+	"github.com/larksuite/cli/shortcuts/common"
+)
+
+// SlashCommandCreate registers a new slash command on the current bound app.
+var SlashCommandCreate = common.Shortcut{
+	Service:     "application",
+	Command:     "+slash-command-create",
+	Description: "Register a slash command (/ command) on the current bound Open Platform app; --force converts a name collision into an update (idempotent re-run)",
+	Risk:        "write",
+	Scopes:      []string{"application:app_slash_command:write"},
+	ConditionalScopes: []string{
+		"application:app_slash_command:read", // only the --force collision path lists to resolve the id
+	},
+	AuthTypes: []string{"bot", "user"},
+	Flags: []common.Flag{
+		{Name: "command", Desc: "command name WITHOUT the leading slash (server enforces uniqueness per app; max 100 commands)", Required: true},
+		{Name: "description", Desc: "default description shown in the client command panel (description.default_value)", Required: true},
+		{Name: "description-i18n", Type: "string_array", Desc: "localized description, repeatable, format <lang>=<text> (e.g. zh_cn=发送问候); language codes are passed through to the server"},
+		{Name: "icon-key", Desc: "icon key (server default: skill_outlined; invalid keys are rejected server-side with code 40000031)"},
+		{Name: "force", Type: "bool", Desc: "on name collision, resolve the existing command by name and PATCH it instead (like `gh label create --force`)"},
+	},
+	Tips: []string{
+		`lark-cli application +slash-command-create --command greet --description "say hi" --description-i18n zh_cn=问候 --as bot`,
+		"changes take ~5 minutes to appear in clients (client-side cache); the server updates immediately",
+		"user identity needs explicit authorization first: lark-cli auth login --scope application:app_slash_command:write",
+	},
+	Validate: func(ctx context.Context, runtime *common.RuntimeContext) error {
+		if err := validateCommandName(runtime.Str("command"), "--command"); err != nil {
+			return err
+		}
+		if len(strings.TrimSpace(runtime.Str("description"))) == 0 {
+			return errs.NewValidationError(errs.SubtypeInvalidArgument,
+				"--description must not be blank").WithParam("--description")
+		}
+		if _, err := parseDescriptionI18n(runtime.StrArray("description-i18n")); err != nil {
+			return err
+		}
+		return nil
+	},
+	DryRun: func(ctx context.Context, runtime *common.RuntimeContext) *common.DryRunAPI {
+		i18n, err := parseDescriptionI18n(runtime.StrArray("description-i18n"))
+		if err != nil {
+			return common.NewDryRunAPI().Set("error", err.Error())
+		}
+		body := buildSlashCommandBody(runtime.Str("command"), runtime.Str("description"), i18n, runtime.Str("icon-key"))
+		d := common.NewDryRunAPI().
+			Desc("Create a slash command on the current bound app").
+			POST(slashCommandBasePath).
+			Body(body)
+		if runtime.Bool("force") {
+			d.Desc("--force: on 'command already exists' (code 40000000), GET list to resolve command_id then PATCH the same body")
+		}
+		return d
+	},
+	Execute: func(ctx context.Context, runtime *common.RuntimeContext) error {
+		name := runtime.Str("command")
+		i18n, err := parseDescriptionI18n(runtime.StrArray("description-i18n"))
+		if err != nil {
+			return err
+		}
+		body := buildSlashCommandBody(name, runtime.Str("description"), i18n, runtime.Str("icon-key"))
+
+		data, err := runtime.CallAPITyped("POST", slashCommandBasePath, nil, body)
+		action := "created"
+		if err != nil {
+			if !isCommandExists(err) {
+				return err
+			}
+			if !runtime.Bool("force") {
+				p, _ := errs.ProblemOf(err)
+				rewrapped := errs.NewAPIError(p.Subtype, "slash command %q already exists", name).
+					WithHint("rerun with --force to update it, or use `lark-cli application +slash-command-update --command %q`", name).
+					WithCause(err)
+				if p.Code != 0 {
+					rewrapped = rewrapped.WithCode(p.Code)
+				}
+				if p.LogID != "" {
+					rewrapped = rewrapped.WithLogID(p.LogID)
+				}
+				return rewrapped
+			}
+			// --force: name collision -> resolve id -> PATCH (idempotent re-run).
+			id, _, rerr := resolveCommandID(runtime, name)
+			if rerr != nil {
+				return rerr
+			}
+			patchBody := buildSlashCommandBody("", runtime.Str("description"), i18n, runtime.Str("icon-key"))
+			data, err = runtime.CallAPITyped("PATCH", slashCommandBasePath+"/"+validate.EncodePathSegment(id), nil, patchBody)
+			if err != nil {
+				return err
+			}
+			action = "updated"
+		}
+		if data == nil {
+			data = map[string]interface{}{}
+		}
+		data["action"] = action
+		fmt.Fprintln(runtime.IO().ErrOut, clientCacheHint)
+		runtime.OutFormat(data, nil, func(w io.Writer) {
+			fmt.Fprintf(w, "%s /%v (command_id: %v)\n", action, data["command"], data["command_id"])
+		})
+		return nil
+	},
+}
--- a/shortcuts/application/slash_command_create_test.go
+++ b/shortcuts/application/slash_command_create_test.go
@@ -0,0 +1,182 @@
+// Copyright (c) 2026 Lark Technologies Pte. Ltd.
+// SPDX-License-Identifier: MIT
+
+package application
+
+import (
+	"encoding/json"
+	"errors"
+	"strings"
+	"testing"
+
+	"github.com/larksuite/cli/errs"
+	"github.com/larksuite/cli/internal/cmdutil"
+	"github.com/larksuite/cli/internal/httpmock"
+)
+
+func createOKStub() *httpmock.Stub {
+	return &httpmock.Stub{
+		Method: "POST",
+		URL:    "/open-apis/application/v7/app_slash_commands",
+		Body: map[string]interface{}{
+			"code": 0, "msg": "success",
+			"data": sampleItem("greet", "id-new"),
+		},
+	}
+}
+
+func createConflictStub() *httpmock.Stub {
+	return &httpmock.Stub{
+		Method: "POST",
+		URL:    "/open-apis/application/v7/app_slash_commands",
+		Body: map[string]interface{}{
+			"code": 40000000, "msg": "Invalid Param 'command'. command already exists.",
+		},
+	}
+}
+
+func patchOKStub(id string) *httpmock.Stub {
+	return &httpmock.Stub{
+		Method: "PATCH",
+		URL:    "/open-apis/application/v7/app_slash_commands/" + id,
+		Body: map[string]interface{}{
+			"code": 0, "msg": "success",
+			"data": sampleItem("greet", id),
+		},
+	}
+}
+
+func TestSlashCommandCreate_OK(t *testing.T) {
+	f, stdout, _, reg := cmdutil.TestFactory(t, appTestConfig())
+	reg.Register(createOKStub())
+
+	err := mountAndRun(t, SlashCommandCreate, []string{"+slash-command-create",
+		"--command", "greet", "--description", "hi",
+		"--description-i18n", "zh_cn=你好", "--description-i18n", "en_us=Hello",
+		"--icon-key", "skill_outlined", "--format", "json", "--as", "bot"}, f, stdout)
+	if err != nil {
+		t.Fatalf("execute: %v", err)
+	}
+	var got map[string]interface{}
+	if err := json.Unmarshal(stdout.Bytes(), &got); err != nil {
+		t.Fatalf("json: %v\n%s", err, stdout.String())
+	}
+	data := got["data"].(map[string]interface{})
+	if data["action"] != "created" {
+		t.Fatalf("action = %v", data["action"])
+	}
+	if data["command_id"] != "id-new" {
+		t.Fatalf("command_id = %v", data["command_id"])
+	}
+}
+
+func TestSlashCommandCreate_ValidateRejects(t *testing.T) {
+	f, stdout, _, _ := cmdutil.TestFactory(t, appTestConfig())
+	cases := [][]string{
+		{"+slash-command-create", "--command", "/greet", "--description", "hi", "--as", "bot"},
+		{"+slash-command-create", "--command", "greet", "--description", "hi", "--description-i18n", "bad", "--as", "bot"},
+		{"+slash-command-create", "--command", "greet", "--description", "hi", "--description-i18n", "zh_cn=a", "--description-i18n", "zh_cn=b", "--as", "bot"},
+		{"+slash-command-create", "--command", "greet", "--description", "  ", "--as", "bot"},
+	}
+	for i, args := range cases {
+		err := mountAndRun(t, SlashCommandCreate, args, f, stdout)
+		if err == nil {
+			t.Errorf("case %d: expected validation error", i)
+			continue
+		}
+		p, ok := errs.ProblemOf(err)
+		if !ok || p.Category != errs.CategoryValidation {
+			t.Errorf("case %d: expected validation problem, got %v", i, err)
+		}
+	}
+}
+
+func TestSlashCommandCreate_ConflictNoForce(t *testing.T) {
+	f, stdout, _, reg := cmdutil.TestFactory(t, appTestConfig())
+	reg.Register(createConflictStub())
+
+	err := mountAndRun(t, SlashCommandCreate, []string{"+slash-command-create",
+		"--command", "greet", "--description", "hi", "--as", "bot"}, f, stdout)
+	if err == nil {
+		t.Fatal("expected conflict error")
+	}
+	p, _ := errs.ProblemOf(err)
+	if !strings.Contains(p.Hint, "--force") || !strings.Contains(p.Hint, "+slash-command-update") {
+		t.Fatalf("hint must offer --force and update, got %q", p.Hint)
+	}
+	var apiErr *errs.APIError
+	if !errors.As(err, &apiErr) {
+		t.Fatalf("rewrapped error must be *errs.APIError, got %T", err)
+	}
+	if errors.Unwrap(apiErr) == nil {
+		t.Fatal("rewrapped conflict error must preserve the original cause via WithCause")
+	}
+}
+
+func TestSlashCommandCreate_ForceConvertsToUpdate(t *testing.T) {
+	f, stdout, _, reg := cmdutil.TestFactory(t, appTestConfig())
+	reg.Register(createConflictStub())
+	reg.Register(listStub([]interface{}{sampleItem("greet", "id-exist")}))
+	reg.Register(patchOKStub("id-exist"))
+
+	err := mountAndRun(t, SlashCommandCreate, []string{"+slash-command-create",
+		"--command", "greet", "--description", "hi2", "--force", "--format", "json", "--as", "bot"}, f, stdout)
+	if err != nil {
+		t.Fatalf("execute: %v", err)
+	}
+	var got map[string]interface{}
+	if err := json.Unmarshal(stdout.Bytes(), &got); err != nil {
+		t.Fatalf("json: %v", err)
+	}
+	data := got["data"].(map[string]interface{})
+	if data["action"] != "updated" {
+		t.Fatalf("action = %v (force must convert to update)", data["action"])
+	}
+}
+
+func createIconInvalidStub() *httpmock.Stub {
+	return &httpmock.Stub{
+		Method: "POST",
+		URL:    "/open-apis/application/v7/app_slash_commands",
+		Body: map[string]interface{}{
+			"code": 40000031, "msg": "Invalid Param 'icon_key'. icon_key is invalid.",
+		},
+	}
+}
+
+// TestSlashCommandCreate_ForceDoesNotConvertNonConflict guards against --force
+// blindly treating ANY POST failure as a name collision: only the
+// "command already exists" (40000000) shape may fall through to the
+// GET+PATCH idempotent-update path. No PATCH stub is registered here, so if
+// the code mistakenly attempted a PATCH, the httpmock registry would fail
+// the unexpected request and surface a different (registry) error instead
+// of the original icon_key failure asserted below.
+func TestSlashCommandCreate_ForceDoesNotConvertNonConflict(t *testing.T) {
+	f, stdout, _, reg := cmdutil.TestFactory(t, appTestConfig())
+	reg.Register(createIconInvalidStub())
+
+	err := mountAndRun(t, SlashCommandCreate, []string{"+slash-command-create",
+		"--command", "greet", "--description", "hi", "--icon-key", "bogus", "--force", "--as", "bot"}, f, stdout)
+	if err == nil {
+		t.Fatal("expected the original icon_key error, got nil")
+	}
+	if !strings.Contains(err.Error(), "icon_key") {
+		t.Fatalf("expected original icon_key failure to surface unchanged, got %v", err)
+	}
+}
+
+func TestSlashCommandCreate_DryRun(t *testing.T) {
+	f, stdout, _, _ := cmdutil.TestFactory(t, appTestConfig())
+	if err := mountAndRun(t, SlashCommandCreate, []string{"+slash-command-create",
+		"--command", "greet", "--description", "hi", "--icon-key", "skill_outlined", "--dry-run", "--as", "bot"}, f, stdout); err != nil {
+		t.Fatalf("execute: %v", err)
+	}
+	out := stdout.String()
+	if !strings.Contains(out, "POST") || !strings.Contains(out, slashCommandBasePath) {
+		t.Fatalf("dry-run must show POST path: %s", out)
+	}
+	// icon 顶层：dry-run body 里 icon 不嵌套在 description 内
+	if !strings.Contains(out, "icon_key") {
+		t.Fatalf("dry-run must include body: %s", out)
+	}
+}
--- a/shortcuts/application/slash_command_delete.go
+++ b/shortcuts/application/slash_command_delete.go
@@ -0,0 +1,83 @@
+// Copyright (c) 2026 Lark Technologies Pte. Ltd.
+// SPDX-License-Identifier: MIT
+
+package application
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"strings"
+
+	"github.com/larksuite/cli/errs"
+	"github.com/larksuite/cli/internal/validate"
+	"github.com/larksuite/cli/shortcuts/common"
+)
+
+// SlashCommandDelete removes a slash command (irreversible; command_id is not
+// reused - recreating the same name yields a NEW id).
+var SlashCommandDelete = common.Shortcut{
+	Service:     "application",
+	Command:     "+slash-command-delete",
+	Description: "Delete a slash command from the current bound app (high-risk: irreversible; recreating the same name yields a new command_id)",
+	Risk:        "high-risk-write",
+	Scopes:      []string{"application:app_slash_command:write"},
+	ConditionalScopes: []string{
+		"application:app_slash_command:read", // only the --command by-name path
+	},
+	AuthTypes: []string{"bot", "user"},
+	Flags: []common.Flag{
+		{Name: "command-id", Desc: "target command_id; mutually exclusive with --command"},
+		{Name: "command", Desc: "target command name WITHOUT leading slash (resolved via live list, needs read scope); mutually exclusive with --command-id"},
+	},
+	Tips: []string{
+		"lark-cli application +slash-command-delete --command greet --yes --as bot",
+		"deleted commands may linger in clients for ~5 minutes (client cache)",
+	},
+	Validate: func(ctx context.Context, runtime *common.RuntimeContext) error {
+		id := strings.TrimSpace(runtime.Str("command-id"))
+		name := strings.TrimSpace(runtime.Str("command"))
+		if (id == "") == (name == "") {
+			return errs.NewValidationError(errs.SubtypeInvalidArgument,
+				"provide exactly one of --command-id or --command").WithParam("--command-id")
+		}
+		if name != "" {
+			return validateCommandName(name, "--command")
+		}
+		return nil
+	},
+	DryRun: func(ctx context.Context, runtime *common.RuntimeContext) *common.DryRunAPI {
+		d := common.NewDryRunAPI().Desc("HIGH-RISK: delete a slash command (irreversible; same-name recreate gets a NEW command_id)")
+		target := runtime.Str("command-id")
+		if target == "" {
+			d.GET(slashCommandBasePath).
+				Desc(fmt.Sprintf("resolve command_id by name %q via GET list first", runtime.Str("command")))
+			target = "<resolved_command_id>"
+		}
+		return d.DELETE(slashCommandBasePath + "/" + target)
+	},
+	Execute: func(ctx context.Context, runtime *common.RuntimeContext) error {
+		id := strings.TrimSpace(runtime.Str("command-id"))
+		name := strings.TrimSpace(runtime.Str("command"))
+		if id == "" {
+			resolved, _, err := resolveCommandID(runtime, name)
+			if err != nil {
+				return err
+			}
+			id = resolved
+		}
+		if _, err := runtime.CallAPITyped("DELETE", slashCommandBasePath+"/"+validate.EncodePathSegment(id), nil, nil); err != nil {
+			return err
+		}
+		out := map[string]interface{}{"action": "deleted", "command_id": id}
+		if name != "" {
+			out["command"] = name
+		}
+		fmt.Fprintln(runtime.IO().ErrOut, clientCacheHint)
+		fmt.Fprintln(runtime.IO().ErrOut, "note: recreating the same command name will yield a NEW command_id.")
+		runtime.OutFormat(out, nil, func(w io.Writer) {
+			fmt.Fprintf(w, "deleted command_id %s\n", id)
+		})
+		return nil
+	},
+}
--- a/shortcuts/application/slash_command_delete_test.go
+++ b/shortcuts/application/slash_command_delete_test.go
@@ -0,0 +1,109 @@
+// Copyright (c) 2026 Lark Technologies Pte. Ltd.
+// SPDX-License-Identifier: MIT
+
+package application
+
+import (
+	"encoding/json"
+	"strings"
+	"testing"
+
+	"github.com/larksuite/cli/errs"
+	"github.com/larksuite/cli/internal/cmdutil"
+	"github.com/larksuite/cli/internal/httpmock"
+)
+
+func deleteOKStub(id string) *httpmock.Stub {
+	return &httpmock.Stub{
+		Method: "DELETE",
+		URL:    slashCommandBasePath + "/" + id,
+		Body:   map[string]interface{}{"code": 0, "msg": "success", "data": map[string]interface{}{}},
+	}
+}
+
+func TestSlashCommandDelete_RequiresYes(t *testing.T) {
+	f, stdout, _, _ := cmdutil.TestFactory(t, appTestConfig())
+	err := mountAndRun(t, SlashCommandDelete, []string{"+slash-command-delete",
+		"--command-id", "id1", "--as", "bot"}, f, stdout)
+	if err == nil {
+		t.Fatal("expected confirmation_required without --yes")
+	}
+	if errs.CategoryOf(err) != errs.CategoryConfirmation {
+		t.Fatalf("expected confirmation category, got %v (%v)", errs.CategoryOf(err), err)
+	}
+}
+
+func TestSlashCommandDelete_ByIDWithYes(t *testing.T) {
+	f, stdout, _, reg := cmdutil.TestFactory(t, appTestConfig())
+	reg.Register(deleteOKStub("id1"))
+
+	err := mountAndRun(t, SlashCommandDelete, []string{"+slash-command-delete",
+		"--command-id", "id1", "--yes", "--format", "json", "--as", "bot"}, f, stdout)
+	if err != nil {
+		t.Fatalf("execute: %v", err)
+	}
+	var got map[string]interface{}
+	if err := json.Unmarshal(stdout.Bytes(), &got); err != nil {
+		t.Fatalf("json: %v", err)
+	}
+	data := got["data"].(map[string]interface{})
+	// 上游 DELETE 返回空对象；CLI 必须补 action/command_id（写操作返回资源 ID）
+	if data["action"] != "deleted" || data["command_id"] != "id1" {
+		t.Fatalf("data = %v", data)
+	}
+}
+
+func TestSlashCommandDelete_ByNameWithYes(t *testing.T) {
+	f, stdout, _, reg := cmdutil.TestFactory(t, appTestConfig())
+	reg.Register(listStub([]interface{}{sampleItem("greet", "id7")}))
+	reg.Register(deleteOKStub("id7"))
+
+	err := mountAndRun(t, SlashCommandDelete, []string{"+slash-command-delete",
+		"--command", "greet", "--yes", "--format", "json", "--as", "bot"}, f, stdout)
+	if err != nil {
+		t.Fatalf("execute: %v", err)
+	}
+	var got map[string]interface{}
+	_ = json.Unmarshal(stdout.Bytes(), &got)
+	data := got["data"].(map[string]interface{})
+	if data["command"] != "greet" || data["command_id"] != "id7" {
+		t.Fatalf("data = %v", data)
+	}
+}
+
+func TestSlashCommandDelete_ByNameDryRun(t *testing.T) {
+	f, stdout, _, _ := cmdutil.TestFactory(t, appTestConfig())
+
+	err := mountAndRun(t, SlashCommandDelete, []string{"+slash-command-delete",
+		"--command", "greet", "--dry-run", "--as", "bot"}, f, stdout)
+	if err != nil {
+		t.Fatalf("execute: %v", err)
+	}
+	out := stdout.String()
+	// 两条 Desc 都必须保留：top-level HIGH-RISK 说明和 GET 调用的 resolve 说明
+	// 不能被覆盖（DryRunAPI.Desc 在没有 call 时设置 top-level，append 后设置 per-call）。
+	if !strings.Contains(out, "HIGH-RISK") {
+		t.Fatalf("dry-run must keep top-level HIGH-RISK desc: %s", out)
+	}
+	if !strings.Contains(out, "resolve command_id") {
+		t.Fatalf("dry-run must keep per-call resolve desc: %s", out)
+	}
+}
+
+func TestSlashCommandDelete_Validate(t *testing.T) {
+	f, stdout, _, _ := cmdutil.TestFactory(t, appTestConfig())
+	for _, args := range [][]string{
+		{"+slash-command-delete", "--yes", "--as", "bot"},
+		{"+slash-command-delete", "--command-id", "id1", "--command", "greet", "--yes", "--as", "bot"},
+	} {
+		err := mountAndRun(t, SlashCommandDelete, args, f, stdout)
+		if err == nil {
+			t.Errorf("%v: expected validation error", args)
+			continue
+		}
+		p, ok := errs.ProblemOf(err)
+		if !ok || p.Category != errs.CategoryValidation {
+			t.Errorf("%v: expected validation problem, got %v", args, err)
+		}
+	}
+}
--- a/shortcuts/application/slash_command_list.go
+++ b/shortcuts/application/slash_command_list.go
@@ -0,0 +1,58 @@
+// Copyright (c) 2026 Lark Technologies Pte. Ltd.
+// SPDX-License-Identifier: MIT
+
+package application
+
+import (
+	"context"
+	"fmt"
+	"io"
+
+	"github.com/larksuite/cli/shortcuts/common"
+)
+
+// SlashCommandList lists all slash commands of the current bound app.
+var SlashCommandList = common.Shortcut{
+	Service:     "application",
+	Command:     "+slash-command-list",
+	Description: "List all slash commands (/ commands) registered on the current bound Open Platform app; source of command_id for update/delete (NOT for Miaoda apps - use the apps domain for those)",
+	Risk:        "read",
+	Scopes:      []string{"application:app_slash_command:read"},
+	AuthTypes:   []string{"bot", "user"},
+	Tips: []string{
+		"lark-cli application +slash-command-list --as bot",
+		"user identity needs explicit authorization first: lark-cli auth login --scope application:app_slash_command:read",
+		"the upstream API returns all commands at once (max 100 per app, no pagination)",
+	},
+	DryRun: func(ctx context.Context, runtime *common.RuntimeContext) *common.DryRunAPI {
+		return common.NewDryRunAPI().
+			Desc("List all slash commands of the current bound app (read-only)").
+			GET(slashCommandBasePath)
+	},
+	Execute: func(ctx context.Context, runtime *common.RuntimeContext) error {
+		data, err := runtime.CallAPITyped("GET", slashCommandBasePath, nil, nil)
+		if err != nil {
+			return err
+		}
+		items, _ := data["items"].([]interface{})
+		if items == nil {
+			items = []interface{}{}
+		}
+		out := map[string]interface{}{"items": items, "count": len(items)}
+		runtime.OutFormat(out, nil, func(w io.Writer) {
+			fmt.Fprintf(w, "%d slash command(s)\n", len(items))
+			for _, it := range items {
+				m, ok := it.(map[string]interface{})
+				if !ok {
+					continue
+				}
+				desc := ""
+				if d, ok := m["description"].(map[string]interface{}); ok {
+					desc, _ = d["default_value"].(string)
+				}
+				fmt.Fprintf(w, "  /%v\t%v\t%s\n", m["command"], m["command_id"], desc)
+			}
+		})
+		return nil
+	},
+}
--- a/shortcuts/application/slash_command_list_test.go
+++ b/shortcuts/application/slash_command_list_test.go
@@ -0,0 +1,115 @@
+// Copyright (c) 2026 Lark Technologies Pte. Ltd.
+// SPDX-License-Identifier: MIT
+
+package application
+
+import (
+	"bytes"
+	"encoding/json"
+	"strings"
+	"testing"
+
+	"github.com/larksuite/cli/internal/cmdutil"
+	"github.com/larksuite/cli/internal/core"
+	"github.com/larksuite/cli/internal/httpmock"
+	"github.com/larksuite/cli/shortcuts/common"
+	"github.com/spf13/cobra"
+)
+
+func appTestConfig() *core.CliConfig {
+	return &core.CliConfig{AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu}
+}
+
+// mountAndRun mounts the shortcut under a parent cobra command and runs it.
+// Mirrors shortcuts/contact tests.
+func mountAndRun(t *testing.T, s common.Shortcut, args []string, f *cmdutil.Factory, stdout *bytes.Buffer) error {
+	t.Helper()
+	parent := &cobra.Command{Use: "application"}
+	s.Mount(parent, f)
+	parent.SetArgs(args)
+	parent.SilenceErrors = true
+	parent.SilenceUsage = true
+	if stdout != nil {
+		stdout.Reset()
+	}
+	return parent.Execute()
+}
+
+func listStub(items []interface{}) *httpmock.Stub {
+	return &httpmock.Stub{
+		Method: "GET",
+		URL:    "/open-apis/application/v7/app_slash_commands",
+		Body: map[string]interface{}{
+			"code": 0, "msg": "success",
+			"data": map[string]interface{}{"items": items},
+		},
+	}
+}
+
+func sampleItem(name, id string) map[string]interface{} {
+	return map[string]interface{}{
+		"command": name, "command_id": id,
+		"create_time": "1783318553", "update_time": "1783318553",
+		"description": map[string]interface{}{"default_value": "desc of " + name},
+		"icon":        map[string]interface{}{"icon_key": "skill_outlined"},
+	}
+}
+
+func TestSlashCommandList_JSON(t *testing.T) {
+	f, stdout, _, reg := cmdutil.TestFactory(t, appTestConfig())
+	reg.Register(listStub([]interface{}{sampleItem("greet", "id1"), sampleItem("weather", "id2")}))
+
+	if err := mountAndRun(t, SlashCommandList, []string{"+slash-command-list", "--format", "json", "--as", "bot"}, f, stdout); err != nil {
+		t.Fatalf("execute: %v", err)
+	}
+	var got map[string]interface{}
+	if err := json.Unmarshal(stdout.Bytes(), &got); err != nil {
+		t.Fatalf("json: %v\n%s", err, stdout.String())
+	}
+	data := got["data"].(map[string]interface{})
+	items := data["items"].([]interface{})
+	if len(items) != 2 {
+		t.Fatalf("items = %d", len(items))
+	}
+	if data["count"] != float64(2) {
+		t.Fatalf("count = %v", data["count"])
+	}
+	first := items[0].(map[string]interface{})
+	for _, k := range []string{"command", "command_id", "description", "icon", "create_time", "update_time"} {
+		if _, ok := first[k]; !ok {
+			t.Errorf("missing item key %q", k)
+		}
+	}
+}
+
+func TestSlashCommandList_Empty(t *testing.T) {
+	f, stdout, _, reg := cmdutil.TestFactory(t, appTestConfig())
+	reg.Register(listStub(nil))
+
+	if err := mountAndRun(t, SlashCommandList, []string{"+slash-command-list", "--format", "json", "--as", "bot"}, f, stdout); err != nil {
+		t.Fatalf("execute: %v", err)
+	}
+	var got map[string]interface{}
+	if err := json.Unmarshal(stdout.Bytes(), &got); err != nil {
+		t.Fatalf("json: %v", err)
+	}
+	data := got["data"].(map[string]interface{})
+	items, ok := data["items"].([]interface{})
+	if !ok || len(items) != 0 {
+		t.Fatalf("empty list must be [] not %v", data["items"])
+	}
+	if data["count"] != float64(0) {
+		t.Fatalf("count = %v", data["count"])
+	}
+}
+
+func TestSlashCommandList_DryRun(t *testing.T) {
+	f, stdout, _, _ := cmdutil.TestFactory(t, appTestConfig())
+	if err := mountAndRun(t, SlashCommandList, []string{"+slash-command-list", "--dry-run", "--as", "bot"}, f, stdout); err != nil {
+		t.Fatalf("execute: %v", err)
+	}
+	out := stdout.String()
+	if !strings.Contains(out, "/open-apis/application/v7/app_slash_commands") || !strings.Contains(out, "GET") {
+		t.Fatalf("dry-run must show GET path, got %s", out)
+	}
+}
--- a/shortcuts/application/slash_command_resolve.go
+++ b/shortcuts/application/slash_command_resolve.go
@@ -0,0 +1,53 @@
+// Copyright (c) 2026 Lark Technologies Pte. Ltd.
+// SPDX-License-Identifier: MIT
+
+package application
+
+import (
+	"github.com/larksuite/cli/errs"
+	"github.com/larksuite/cli/shortcuts/common"
+)
+
+// matchCommandItem finds the item whose "command" equals name (exact match -
+// the server enforces name uniqueness, so first hit is the only hit).
+func matchCommandItem(items []interface{}, name string) (string, map[string]interface{}) {
+	for _, it := range items {
+		m, ok := it.(map[string]interface{})
+		if !ok {
+			continue
+		}
+		if m["command"] == name {
+			id, _ := m["command_id"].(string)
+			if id != "" {
+				return id, m
+			}
+		}
+	}
+	return "", nil
+}
+
+// commandNotFoundError reports a resolution miss against the live list as an
+// API-category not-found error (the name is a valid argument shape; the
+// resource simply does not exist server-side - this is not a validation
+// failure of caller input).
+func commandNotFoundError(name string) error {
+	return errs.NewAPIError(errs.SubtypeNotFound,
+		"slash command %q not found in the current bound app", name).
+		WithHint("run `lark-cli application +slash-command-list` to see registered commands")
+}
+
+// resolveCommandID resolves a command name to its command_id via the live
+// list endpoint (in-memory only; never touches local files). Requires the
+// read scope on the current identity.
+func resolveCommandID(runtime *common.RuntimeContext, name string) (string, map[string]interface{}, error) {
+	data, err := runtime.CallAPITyped("GET", slashCommandBasePath, nil, nil)
+	if err != nil {
+		return "", nil, err
+	}
+	items, _ := data["items"].([]interface{})
+	id, item := matchCommandItem(items, name)
+	if id == "" {
+		return "", nil, commandNotFoundError(name)
+	}
+	return id, item, nil
+}
--- a/shortcuts/application/slash_command_resolve_test.go
+++ b/shortcuts/application/slash_command_resolve_test.go
@@ -0,0 +1,39 @@
+// Copyright (c) 2026 Lark Technologies Pte. Ltd.
+// SPDX-License-Identifier: MIT
+
+package application
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestMatchCommandItem(t *testing.T) {
+	items := []interface{}{
+		sampleItem("greet", "id1"),
+		sampleItem("weather", "id2"),
+	}
+	id, item := matchCommandItem(items, "weather")
+	if id != "id2" || item == nil {
+		t.Fatalf("got id=%q item=%v", id, item)
+	}
+	id, item = matchCommandItem(items, "nope")
+	if id != "" || item != nil {
+		t.Fatalf("miss should return empty, got id=%q", id)
+	}
+	// 精确匹配：大小写与空白不做宽容
+	id, _ = matchCommandItem(items, "Greet")
+	if id != "" {
+		t.Fatalf("match must be exact, got %q", id)
+	}
+}
+
+func TestResolveNotFoundErrorShape(t *testing.T) {
+	err := commandNotFoundError("nope")
+	if err == nil || !strings.Contains(err.Error(), `"nope"`) {
+		t.Fatalf("err = %v", err)
+	}
+	if !strings.Contains(err.Error(), "not found") {
+		t.Fatalf("err should say not found: %v", err)
+	}
+}
--- a/shortcuts/application/slash_command_update.go
+++ b/shortcuts/application/slash_command_update.go
@@ -0,0 +1,119 @@
+// Copyright (c) 2026 Lark Technologies Pte. Ltd.
+// SPDX-License-Identifier: MIT
+
+package application
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"strings"
+
+	"github.com/larksuite/cli/errs"
+	"github.com/larksuite/cli/internal/validate"
+	"github.com/larksuite/cli/shortcuts/common"
+)
+
+// validateUpdateTarget enforces: exactly one of --command-id/--command, and at
+// least one editable field; --description-i18n requires --description (PATCH
+// replaces the whole description object - sending i18n alone would drop
+// default_value; conservative rule, see spec amendment #3).
+func validateUpdateTarget(runtime *common.RuntimeContext) error {
+	id := strings.TrimSpace(runtime.Str("command-id"))
+	name := strings.TrimSpace(runtime.Str("command"))
+	if (id == "") == (name == "") {
+		return errs.NewValidationError(errs.SubtypeInvalidArgument,
+			"provide exactly one of --command-id or --command").WithParam("--command-id")
+	}
+	if name != "" {
+		if err := validateCommandName(name, "--command"); err != nil {
+			return err
+		}
+	}
+	hasDesc := strings.TrimSpace(runtime.Str("description")) != ""
+	hasI18n := len(runtime.StrArray("description-i18n")) > 0
+	hasIcon := strings.TrimSpace(runtime.Str("icon-key")) != ""
+	if !hasDesc && !hasI18n && !hasIcon {
+		return errs.NewValidationError(errs.SubtypeInvalidArgument,
+			"provide at least one of --description / --description-i18n / --icon-key").WithParam("--description")
+	}
+	if hasI18n && !hasDesc {
+		return errs.NewValidationError(errs.SubtypeInvalidArgument,
+			"--description-i18n requires --description: PATCH replaces the whole description object, so default_value must be provided together").WithParam("--description-i18n")
+	}
+	if _, err := parseDescriptionI18n(runtime.StrArray("description-i18n")); err != nil {
+		return err
+	}
+	return nil
+}
+
+// SlashCommandUpdate updates description/i18n/icon of an existing slash command.
+var SlashCommandUpdate = common.Shortcut{
+	Service:     "application",
+	Command:     "+slash-command-update",
+	Description: "Update description / localized descriptions / icon of a slash command on the current bound app, addressed by --command-id or by name via --command",
+	Risk:        "write",
+	Scopes:      []string{"application:app_slash_command:write"},
+	ConditionalScopes: []string{
+		"application:app_slash_command:read", // only the --command by-name path lists to resolve the id
+	},
+	AuthTypes: []string{"bot", "user"},
+	Flags: []common.Flag{
+		{Name: "command-id", Desc: "target command_id (from +slash-command-list or create output); mutually exclusive with --command"},
+		{Name: "command", Desc: "target command name WITHOUT leading slash; resolved via live list (needs read scope); mutually exclusive with --command-id"},
+		{Name: "description", Desc: "new default description (description.default_value)"},
+		{Name: "description-i18n", Type: "string_array", Desc: "localized description, repeatable <lang>=<text>; REPLACES the whole i18n map (missing languages are dropped); requires --description"},
+		{Name: "icon-key", Desc: "new icon key (invalid keys rejected server-side with code 40000031)"},
+	},
+	Tips: []string{
+		`lark-cli application +slash-command-update --command greet --description "new text" --as bot`,
+		"PATCH is field-level partial: fields you do not pass are preserved server-side",
+		"the command NAME itself cannot be changed (API limitation): rename = delete + create (new command_id)",
+	},
+	Validate: func(ctx context.Context, runtime *common.RuntimeContext) error {
+		return validateUpdateTarget(runtime)
+	},
+	DryRun: func(ctx context.Context, runtime *common.RuntimeContext) *common.DryRunAPI {
+		i18n, err := parseDescriptionI18n(runtime.StrArray("description-i18n"))
+		if err != nil {
+			return common.NewDryRunAPI().Set("error", err.Error())
+		}
+		body := buildSlashCommandBody("", runtime.Str("description"), i18n, runtime.Str("icon-key"))
+		d := common.NewDryRunAPI()
+		target := runtime.Str("command-id")
+		if target == "" {
+			d.Desc(fmt.Sprintf("resolve command_id by name %q via GET list first", runtime.Str("command"))).
+				GET(slashCommandBasePath)
+			target = "<resolved_command_id>"
+		}
+		return d.PATCH(slashCommandBasePath + "/" + target).Body(body)
+	},
+	Execute: func(ctx context.Context, runtime *common.RuntimeContext) error {
+		id := strings.TrimSpace(runtime.Str("command-id"))
+		if id == "" {
+			resolved, _, err := resolveCommandID(runtime, strings.TrimSpace(runtime.Str("command")))
+			if err != nil {
+				return err
+			}
+			id = resolved
+		}
+		i18n, err := parseDescriptionI18n(runtime.StrArray("description-i18n"))
+		if err != nil {
+			return err
+		}
+		body := buildSlashCommandBody("", runtime.Str("description"), i18n, runtime.Str("icon-key"))
+		data, err := runtime.CallAPITyped("PATCH", slashCommandBasePath+"/"+validate.EncodePathSegment(id), nil, body)
+		if err != nil {
+			return err
+		}
+		if data == nil {
+			data = map[string]interface{}{}
+		}
+		data["action"] = "updated"
+		fmt.Fprintln(runtime.IO().ErrOut, clientCacheHint)
+		runtime.OutFormat(data, nil, func(w io.Writer) {
+			fmt.Fprintf(w, "updated /%v (command_id: %v)\n", data["command"], data["command_id"])
+		})
+		return nil
+	},
+}
--- a/shortcuts/application/slash_command_update_test.go
+++ b/shortcuts/application/slash_command_update_test.go
@@ -0,0 +1,79 @@
+// Copyright (c) 2026 Lark Technologies Pte. Ltd.
+// SPDX-License-Identifier: MIT
+
+package application
+
+import (
+	"encoding/json"
+	"strings"
+	"testing"
+
+	"github.com/larksuite/cli/errs"
+	"github.com/larksuite/cli/internal/cmdutil"
+)
+
+func TestSlashCommandUpdate_ByID(t *testing.T) {
+	f, stdout, _, reg := cmdutil.TestFactory(t, appTestConfig())
+	reg.Register(patchOKStub("id1"))
+
+	err := mountAndRun(t, SlashCommandUpdate, []string{"+slash-command-update",
+		"--command-id", "id1", "--description", "new", "--format", "json", "--as", "bot"}, f, stdout)
+	if err != nil {
+		t.Fatalf("execute: %v", err)
+	}
+	var got map[string]interface{}
+	if err := json.Unmarshal(stdout.Bytes(), &got); err != nil {
+		t.Fatalf("json: %v", err)
+	}
+	data := got["data"].(map[string]interface{})
+	if data["action"] != "updated" {
+		t.Fatalf("action = %v", data["action"])
+	}
+}
+
+func TestSlashCommandUpdate_ByName(t *testing.T) {
+	f, stdout, _, reg := cmdutil.TestFactory(t, appTestConfig())
+	reg.Register(listStub([]interface{}{sampleItem("greet", "id9")}))
+	reg.Register(patchOKStub("id9"))
+
+	err := mountAndRun(t, SlashCommandUpdate, []string{"+slash-command-update",
+		"--command", "greet", "--icon-key", "skill_outlined", "--format", "json", "--as", "bot"}, f, stdout)
+	if err != nil {
+		t.Fatalf("execute: %v", err)
+	}
+}
+
+func TestSlashCommandUpdate_ByNameNotFound(t *testing.T) {
+	f, stdout, _, reg := cmdutil.TestFactory(t, appTestConfig())
+	reg.Register(listStub(nil))
+
+	err := mountAndRun(t, SlashCommandUpdate, []string{"+slash-command-update",
+		"--command", "nope", "--description", "x", "--as", "bot"}, f, stdout)
+	if err == nil || !strings.Contains(err.Error(), "not found") {
+		t.Fatalf("expected not found, got %v", err)
+	}
+}
+
+func TestSlashCommandUpdate_Validate(t *testing.T) {
+	f, stdout, _, _ := cmdutil.TestFactory(t, appTestConfig())
+	cases := []struct {
+		name string
+		args []string
+	}{
+		{"both id and name", []string{"+slash-command-update", "--command-id", "id1", "--command", "greet", "--description", "x", "--as", "bot"}},
+		{"neither id nor name", []string{"+slash-command-update", "--description", "x", "--as", "bot"}},
+		{"no editable field", []string{"+slash-command-update", "--command-id", "id1", "--as", "bot"}},
+		{"i18n without description", []string{"+slash-command-update", "--command-id", "id1", "--description-i18n", "zh_cn=x", "--as", "bot"}},
+	}
+	for _, c := range cases {
+		err := mountAndRun(t, SlashCommandUpdate, c.args, f, stdout)
+		if err == nil {
+			t.Errorf("%s: expected validation error", c.name)
+			continue
+		}
+		p, ok := errs.ProblemOf(err)
+		if !ok || p.Category != errs.CategoryValidation {
+			t.Errorf("%s: expected validation problem, got %v", c.name, err)
+		}
+	}
+}
--- a/shortcuts/apps/apps_create.go
+++ b/shortcuts/apps/apps_create.go
@@ -7,7 +7,6 @@ import (
 	"context"
 	"fmt"
 	"io"
-	"os"
 	"strings"

 	"github.com/larksuite/cli/shortcuts/common"
@@ -30,7 +29,7 @@ var AppsCreate = common.Shortcut{
 	HasFormat: true,
 	Flags: []common.Flag{
 		{Name: "name", Desc: "app display name", Required: true},
-		{Name: "app-type", Desc: "app type", Required: true, Enum: []string{"html", "full_stack", "modern_html"}},
+		{Name: "app-type", Desc: "app type", Required: true, Enum: []string{"html", "full_stack"}},
 		{Name: "description", Desc: "app description"},
 		{Name: "icon-url", Desc: "app icon URL (server uses default if omitted)"},
 	},
@@ -72,8 +71,5 @@ func buildAppsCreateBody(rctx *common.RuntimeContext) map[string]interface{} {
 	if icon := strings.TrimSpace(rctx.Str("icon-url")); icon != "" {
 		body["icon_url"] = icon
 	}
-	if agent := os.Getenv("LARKSUITE_CLI_AGENT"); agent != "" {
-		body["source_agent"] = agent
-	}
 	return body
 }
--- a/shortcuts/apps/apps_create_test.go
+++ b/shortcuts/apps/apps_create_test.go
@@ -273,92 +273,3 @@ func TestAppsCreate_FullstackDryRun(t *testing.T) {
 		t.Fatalf("dry-run should not contain message: %s", got)
 	}
 }
-
-func TestAppsCreate_WithAgentEnvVar(t *testing.T) {
-	t.Setenv("LARKSUITE_CLI_AGENT", "doubao")
-	factory, stdout, reg := newAppsExecuteFactory(t)
-	stub := &httpmock.Stub{
-		Method: "POST",
-		URL:    "/open-apis/spark/v1/apps",
-		Body: map[string]interface{}{
-			"code": 0,
-			"data": map[string]interface{}{
-				"app": map[string]interface{}{"app_id": "app_d", "name": "Demo"},
-			},
-		},
-	}
-	reg.Register(stub)
-
-	if err := runAppsShortcut(t, AppsCreate,
-		[]string{"+create", "--name", "Demo", "--app-type", "html", "--as", "user"},
-		factory, stdout); err != nil {
-		t.Fatalf("execute err=%v", err)
-	}
-
-	var sent map[string]interface{}
-	if err := json.Unmarshal(stub.CapturedBody, &sent); err != nil {
-		t.Fatalf("decode body: %v", err)
-	}
-	if sent["source_agent"] != "doubao" {
-		t.Fatalf("body.source_agent = %v, want doubao", sent["source_agent"])
-	}
-}
-
-func TestAppsCreate_WithoutAgentEnvVar(t *testing.T) {
-	t.Setenv("LARKSUITE_CLI_AGENT", "")
-	factory, stdout, reg := newAppsExecuteFactory(t)
-	stub := &httpmock.Stub{
-		Method: "POST",
-		URL:    "/open-apis/spark/v1/apps",
-		Body: map[string]interface{}{
-			"code": 0,
-			"data": map[string]interface{}{
-				"app": map[string]interface{}{"app_id": "app_d", "name": "Demo"},
-			},
-		},
-	}
-	reg.Register(stub)
-
-	if err := runAppsShortcut(t, AppsCreate,
-		[]string{"+create", "--name", "Demo", "--app-type", "html", "--as", "user"},
-		factory, stdout); err != nil {
-		t.Fatalf("execute err=%v", err)
-	}
-
-	var sent map[string]interface{}
-	if err := json.Unmarshal(stub.CapturedBody, &sent); err != nil {
-		t.Fatalf("decode body: %v", err)
-	}
-	if _, present := sent["source_agent"]; present {
-		t.Fatalf("source_agent should not be present when env var is empty: %v", sent)
-	}
-}
-
-func TestAppsCreate_AgentEnvVarNotSet(t *testing.T) {
-	factory, stdout, reg := newAppsExecuteFactory(t)
-	stub := &httpmock.Stub{
-		Method: "POST",
-		URL:    "/open-apis/spark/v1/apps",
-		Body: map[string]interface{}{
-			"code": 0,
-			"data": map[string]interface{}{
-				"app": map[string]interface{}{"app_id": "app_d", "name": "Demo"},
-			},
-		},
-	}
-	reg.Register(stub)
-
-	if err := runAppsShortcut(t, AppsCreate,
-		[]string{"+create", "--name", "Demo", "--app-type", "html", "--as", "user"},
-		factory, stdout); err != nil {
-		t.Fatalf("execute err=%v", err)
-	}
-
-	var sent map[string]interface{}
-	if err := json.Unmarshal(stub.CapturedBody, &sent); err != nil {
-		t.Fatalf("decode body: %v", err)
-	}
-	if _, present := sent["source_agent"]; present {
-		t.Fatalf("source_agent should not be present when env var is unset: %v", sent)
-	}
-}
--- a/shortcuts/apps/apps_init.go
+++ b/shortcuts/apps/apps_init.go
@@ -11,7 +11,6 @@ import (
 	"os"
 	"os/exec"
 	"path/filepath"
-
 	"strings"
 	"unicode"

@@ -39,7 +38,8 @@ const (
 )

 const (
-	miaodaCLIPkg    = "@lark-apaas/miaoda-cli@0.1.20-alpha.dd573f8"
+	miaodaCLIPkg    = "@lark-apaas/miaoda-cli@latest"
+	defaultTemplate = "nestjs-react-fullstack"
 	metaRelPath     = ".spark/meta.json"
 	steeringRelPath = ".agent/skills/steering"
 	seedReadme      = "README.md"
@@ -75,7 +75,7 @@ var AppsInit = common.Shortcut{
 		// check lives in Validate (typed validation error -> exit 2).
 		{Name: "app-id", Desc: "app ID"},
 		{Name: "dir", Desc: "clone target directory; absolute or relative path (default ./<app-id>)"},
-		{Name: "source-path", Desc: "path to existing source files (e.g. HTML output from an agent) to incorporate into the initialized project"},
+		{Name: "template", Desc: "code-init template for an empty repo; optional — if omitted, derived from the app's tech stack"},
 	},
 	Validate: func(ctx context.Context, rctx *common.RuntimeContext) error {
 		if strings.TrimSpace(rctx.Str("app-id")) == "" {
@@ -85,13 +85,14 @@ var AppsInit = common.Shortcut{
 	},
 	DryRun: func(ctx context.Context, rctx *common.RuntimeContext) *common.DryRunAPI {
 		appID := strings.TrimSpace(rctx.Str("app-id"))
+		template := resolveTemplate(rctx, appID)
 		dry := common.NewDryRunAPI().
 			Desc("Initialize app code (credential-init, clone, checkout, npx code-init, optional commit/push)").
 			Set("credential_init", fmt.Sprintf("apps +git-credential-init --app-id %s --format json", appID)).
 			Set("checkout", "git checkout "+defaultInitBranch).
-			Set("scaffold", fmt.Sprintf("empty repo: npx -y --prefer-online %s app init --app-type <appType> --app-id %s; non-empty: npx -y --prefer-online %s app sync + .spark/meta.json app_id patch + conditional skills sync --local", miaodaCLIPkg, appID, miaodaCLIPkg)).
+			Set("scaffold", fmt.Sprintf("empty repo: npx -y --prefer-online %s app init --template %s --app-id %s; non-empty: npx -y --prefer-online %s app sync + .spark/meta.json app_id patch + conditional skills sync --local", miaodaCLIPkg, template, appID, miaodaCLIPkg)).
 			Set("commit_push", "conditional: git add -A + commit + push origin "+defaultInitBranch+" when the working tree has changes").
-			Set("template", "derived from queryAppType (fallback: full_stack)").
+			Set("template", template).
 			Set("env_pull", fmt.Sprintf("apps +env-pull --app-id %s --project-path <clone_path> --format json (after successful init)", appID))
 		dir, err := resolveTargetPath(rctx, appID)
 		if err != nil {
@@ -121,6 +122,20 @@ func defaultCloneDir(appID string) string {
 	return filepath.Join(".", appID)
 }

+// resolveTemplate returns the scaffold template for an empty-repo `app init`.
+// An explicit --template wins. When omitted, it should be derived from the
+// app's tech stack.
+// TODO(apps-init): look up the app by appID via the apps API (e.g. `apps +list`
+// or a get-app endpoint), read its tech stack, and map tech-stack -> template
+// through a (future) enum. Until that lands, fall back to defaultTemplate.
+func resolveTemplate(rctx *common.RuntimeContext, appID string) string {
+	if t := strings.TrimSpace(rctx.Str("template")); t != "" {
+		return t
+	}
+	// TODO(apps-init): derive from app tech stack (apps API + enum mapping).
+	return defaultTemplate
+}
+
 // initLogf writes a one-line progress message to stderr. stdout stays reserved
 // for the structured JSON envelope, so progress never pollutes it. Callers must
 // never pass a raw repository_url (it may embed a token) — pass step names,
@@ -311,14 +326,16 @@ func isEmptyRepo(ctx context.Context, dir string) (bool, error) {
 // runScaffold runs the npx scaffolding step inside the cloned repo (cwd=dir).
 // Empty repo -> `app init`; non-empty -> `app sync` + meta app_id patch +
 // conditional `skills sync`. Returns "init" or "upgrade".
-func runScaffold(ctx context.Context, dir, appID, appType, sourcePath string) (string, error) {
+func runScaffold(ctx context.Context, dir, appID, template string) (string, error) {
 	empty, err := isEmptyRepo(ctx, dir)
 	if err != nil {
 		return "", err
 	}
 	if empty {
-		args := scaffoldInitArgs(appType, appID, sourcePath)
-		if _, stderr, err := initRunner.Run(ctx, dir, "npx", args...); err != nil {
+		// isEmptyRepo treats a repo with no tracked files — or only the backend's
+		// seed README.md — as empty. If other seed files (e.g. .gitignore) can
+		// appear, extend isEmptyRepo's allow-list accordingly.
+		if _, stderr, err := initRunner.Run(ctx, dir, "npx", "-y", "--prefer-online", miaodaCLIPkg, "app", "init", "--template", template, "--app-id", appID); err != nil {
 			return "", appsExternalToolError(err, "npx app init failed: %s", gitErr(stderr, err))
 		}
 		return scaffoldKindInit, nil
@@ -337,22 +354,6 @@ func runScaffold(ctx context.Context, dir, appID, appType, sourcePath string) (s
 	return scaffoldKindUpgrade, nil
 }

-// scaffoldInitArgs builds the npx argument list for `app init`.
-// appType from queryAppType is passed as --app-type; falls back to "full_stack"
-// when empty. sourcePath is appended as --source-path when non-empty.
-func scaffoldInitArgs(appType, appID, sourcePath string) []string {
-	base := []string{"-y", "--prefer-online", miaodaCLIPkg, "app", "init"}
-	at := appType
-	if at == "" {
-		at = "full_stack"
-	}
-	base = append(base, "--app-type", at, "--app-id", appID)
-	if sourcePath != "" {
-		base = append(base, "--source-path", sourcePath)
-	}
-	return base
-}
-
 // parseRepoURLFromEnvelope extracts data.repository_url from a lark-cli JSON
 // envelope ({"ok":true,"data":{"repository_url":"..."}}). The field name
 // matches the contract emitted by `apps +git-credential-init`.
@@ -444,8 +445,6 @@ func appsInitExecute(ctx context.Context, rctx *common.RuntimeContext) error {
 		return err
 	}

-	appType := queryAppType(ctx, rctx, appID)
-
 	// Already-initialized short-circuit: a dir containing .spark/meta.json is an
 	// initialized app repo -> skip clone/scaffold/commit, but still refresh
 	// the local env so a re-run picks up the latest startup env vars.
@@ -458,9 +457,6 @@ func appsInitExecute(ctx context.Context, rctx *common.RuntimeContext) error {
 			"committed":  false,
 			"pushed":     false,
 		}
-		if appType != "" {
-			out["app_type"] = appType
-		}
 		initLogf(rctx, "Pulling local environment variables...")
 		envFile, envPullErr := pullEnv(ctx, rctx, appID, dir)
 		envPulled := envPullErr == ""
@@ -519,8 +515,7 @@ func appsInitExecute(ctx context.Context, rctx *common.RuntimeContext) error {
 	}

 	initLogf(rctx, "Initializing app code (running miaoda-cli)...")
-	sourcePath := strings.TrimSpace(rctx.Str("source-path"))
-	scaffold, err := runScaffold(ctx, dir, appID, appType, sourcePath)
+	scaffold, err := runScaffold(ctx, dir, appID, resolveTemplate(rctx, appID))
 	if err != nil {
 		return err
 	}
@@ -535,6 +530,15 @@ func appsInitExecute(ctx context.Context, rctx *common.RuntimeContext) error {
 		initLogf(rctx, "Working tree clean — skipped commit/push")
 	}

+	initLogf(rctx, "Pulling local environment variables...")
+	envFile, envPullErr := pullEnv(ctx, rctx, appID, dir)
+	envPulled := envPullErr == ""
+	if envPulled {
+		initLogf(rctx, "Local environment written to %s", envFile)
+	} else {
+		initLogf(rctx, "Could not pull local env vars: %s", envPullErr)
+	}
+
 	out := map[string]interface{}{
 		"app_id":         appID,
 		"repository_url": redactURLCredentials(repoURL),
@@ -543,25 +547,15 @@ func appsInitExecute(ctx context.Context, rctx *common.RuntimeContext) error {
 		"scaffold":       scaffold,
 		"committed":      committed,
 		"pushed":         pushed,
+		"env_pulled":     envPulled,
 		"message":        "Repository initialized. You can start developing.",
 	}
-	if appType != "" {
-		out["app_type"] = appType
-	}
-
-	initLogf(rctx, "Pulling local environment variables...")
-	envFile, envPullErr := pullEnv(ctx, rctx, appID, dir)
-	envPulled := envPullErr == ""
-	out["env_pulled"] = envPulled
 	if envPulled {
-		initLogf(rctx, "Local environment written to %s", envFile)
 		out["env_file"] = envFile
 	} else {
-		initLogf(rctx, "Could not pull local env vars: %s", envPullErr)
 		out["env_pull_error"] = envPullErr
 		out["message"] = fmt.Sprintf("Repository initialized. Could not pull local env vars automatically — run `lark-cli apps +env-pull --app-id %s` to retry.", appID)
 	}
-
 	rctx.OutFormat(out, nil, func(w io.Writer) {
 		fmt.Fprintf(w, "✓ Repository initialized at %s\n", dir)
 		fmt.Fprintf(w, "  branch: %s\n  scaffold: %s\n", defaultInitBranch, scaffold)
--- a/shortcuts/apps/apps_init_test.go
+++ b/shortcuts/apps/apps_init_test.go
@@ -20,20 +20,46 @@ import (
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
-	"github.com/larksuite/cli/internal/httpmock"
 	"github.com/larksuite/cli/shortcuts/common"
 )

 // testRuntimeWithDir builds a *common.RuntimeContext whose backing cobra command
-// has a string flag "dir" (=dirFlag) registered, mirroring how +init reads it
-// at runtime via rctx.Str.
+// has string flags "dir" (=dirFlag) and "template" (=defaultTemplate) registered,
+// mirroring how +init reads them at runtime via rctx.Str.
 func testRuntimeWithDir(t *testing.T, dirFlag string) *common.RuntimeContext {
 	t.Helper()
 	cmd := &cobra.Command{Use: "init"}
 	cmd.Flags().String("dir", dirFlag, "")
+	cmd.Flags().String("template", defaultTemplate, "")
 	return common.TestNewRuntimeContext(cmd, nil)
 }

+// testRuntimeWithTemplate builds a *common.RuntimeContext with "dir" and
+// "template" string flags registered, mirroring +init's runtime flag set. The
+// template flag is registered with an empty default (matching the real flag,
+// which no longer carries Default: defaultTemplate); pass tpl="" to model an
+// omitted --template and a non-empty tpl to model an explicit one.
+func testRuntimeWithTemplate(t *testing.T, dirFlag, tpl string) *common.RuntimeContext {
+	t.Helper()
+	cmd := &cobra.Command{Use: "init"}
+	cmd.Flags().String("dir", dirFlag, "")
+	cmd.Flags().String("template", tpl, "")
+	return common.TestNewRuntimeContext(cmd, nil)
+}
+
+func TestResolveTemplate(t *testing.T) {
+	if got := resolveTemplate(testRuntimeWithTemplate(t, "", "foo"), "app_x"); got != "foo" {
+		t.Errorf("explicit --template = %q, want foo", got)
+	}
+	if got := resolveTemplate(testRuntimeWithTemplate(t, "", ""), "app_x"); got != defaultTemplate {
+		t.Errorf("omitted --template = %q, want fallback %q", got, defaultTemplate)
+	}
+	// Whitespace-only --template is treated as omitted -> fallback.
+	if got := resolveTemplate(testRuntimeWithTemplate(t, "", "   "), "app_x"); got != defaultTemplate {
+		t.Errorf("whitespace --template = %q, want fallback %q", got, defaultTemplate)
+	}
+}
+
 func TestResolveTargetPath(t *testing.T) {
 	got, err := resolveTargetPath(testRuntimeWithDir(t, ""), "app_x")
 	if err != nil {
@@ -235,12 +261,12 @@ func TestRunScaffold_EmptyRepo(t *testing.T) {
 		t.Run("ls="+ls, func(t *testing.T) {
 			f := &fakeCommandRunner{results: map[string]fakeCallResult{"git ls-files": {stdout: ls}}}
 			withFakeRunner(t, f)
-			kind, err := runScaffold(context.Background(), t.TempDir(), "app_x", "", "")
+			kind, err := runScaffold(context.Background(), t.TempDir(), "app_x", "nestjs-react-fullstack")
 			if err != nil || kind != "init" {
 				t.Fatalf("ls=%q kind=%q err=%v, want init", ls, kind, err)
 			}
 			c := findCall(f.calls, "npx", "-y")
-			if c == nil || !containsAll(c, "-y", "--prefer-online", miaodaCLIPkg, "app", "init", "--app-type", "full_stack", "--app-id", "app_x") {
+			if c == nil || !containsAll(c, "-y", "--prefer-online", miaodaCLIPkg, "app", "init", "--template", "nestjs-react-fullstack", "--app-id", "app_x") {
 				t.Errorf("app init not invoked with expected args: %v", f.calls)
 			}
 			if c != nil && containsAll(c, "--local") {
@@ -254,7 +280,7 @@ func TestRunScaffold_NonEmpty_SyncsWhenNoSteering(t *testing.T) {
 	dir := t.TempDir() // no steering dir, no meta.json
 	f := &fakeCommandRunner{results: map[string]fakeCallResult{"git ls-files": {stdout: "src/x.ts\n"}}}
 	withFakeRunner(t, f)
-	kind, err := runScaffold(context.Background(), dir, "app_x", "", "")
+	kind, err := runScaffold(context.Background(), dir, "app_x", "nestjs-react-fullstack")
 	if err != nil || kind != "upgrade" {
 		t.Fatalf("kind=%q err=%v, want upgrade", kind, err)
 	}
@@ -273,7 +299,7 @@ func TestRunScaffold_NonEmpty_SkipsSyncWhenSteeringExists(t *testing.T) {
 	os.MkdirAll(filepath.Join(dir, steeringRelPath), 0o755)
 	f := &fakeCommandRunner{results: map[string]fakeCallResult{"git ls-files": {stdout: "src/x.ts\n"}}}
 	withFakeRunner(t, f)
-	if _, err := runScaffold(context.Background(), dir, "app_x", "", ""); err != nil {
+	if _, err := runScaffold(context.Background(), dir, "app_x", "nestjs-react-fullstack"); err != nil {
 		t.Fatal(err)
 	}
 	if findCallArg(f.calls, "npx", "skills", "sync") != nil {
@@ -287,7 +313,7 @@ func TestRunScaffold_AppInitFailure(t *testing.T) {
 		"npx -y":       {stderr: "boom", err: errors.New("exit 1")},
 	}}
 	withFakeRunner(t, f)
-	if _, err := runScaffold(context.Background(), t.TempDir(), "app_x", "", ""); err == nil {
+	if _, err := runScaffold(context.Background(), t.TempDir(), "app_x", "nestjs-react-fullstack"); err == nil {
 		t.Error("app init failure must propagate")
 	}
 }
@@ -316,12 +342,12 @@ func TestAppsInit_EmptyRepo_EndToEnd(t *testing.T) {
 	if _, ok := data["npx_skipped"]; ok {
 		t.Error("npx_skipped must be removed")
 	}
-	// appType is empty, so scaffoldInitArgs falls back to "full_stack"
-	// and `app init` must still receive --template full_stack.
+	// --template is omitted here, so resolveTemplate falls back to
+	// defaultTemplate and `app init` must still receive --template nestjs-react-fullstack.
 	c := findCall(f.calls, "npx", "-y")
 	if c == nil {
 		t.Error("npx scaffold not invoked")
-	} else if !containsAll(c, "-y", "--prefer-online", miaodaCLIPkg, "app", "init", "--app-type", "full_stack", "--app-id", "app_x") {
+	} else if !containsAll(c, "-y", "--prefer-online", miaodaCLIPkg, "app", "init", "--template", defaultTemplate, "--app-id", "app_x") {
 		t.Errorf("app init missing expected --template fallback args: %v", c)
 	} else if containsAll(c, "--local") {
 		t.Errorf("app init must NOT carry --local: %v", c)
@@ -725,6 +751,22 @@ func newAppsExecuteFactoryWithStderr(t *testing.T) (*cmdutil.Factory, *bytes.Buf
 }

 func TestAppsInit_Req1_Wording(t *testing.T) {
+	var tmpl *common.Flag
+	for i := range AppsInit.Flags {
+		if AppsInit.Flags[i].Name == "template" {
+			tmpl = &AppsInit.Flags[i]
+		}
+	}
+	if tmpl == nil {
+		t.Fatal("--template flag missing")
+	}
+	if strings.Contains(strings.ToLower(tmpl.Desc), "scaffold") {
+		t.Errorf("--template Desc still mentions scaffold: %q", tmpl.Desc)
+	}
+	if !strings.Contains(strings.ToLower(tmpl.Desc), "code-init") {
+		t.Errorf("--template Desc should use code-init wording: %q", tmpl.Desc)
+	}
+
 	// The --dry-run output is a flat object (DryRunAPI marshals to top-level keys
 	// description/scaffold/api/...), NOT wrapped in {"data":...}, so parse stdout
 	// directly rather than via parseEnvelopeData.
@@ -745,8 +787,9 @@ func TestAppsInit_Req1_Wording(t *testing.T) {
 		t.Error("dry-run must keep machine-contract key `scaffold`")
 	} else if !strings.Contains(scaffold, "skills sync --local") {
 		t.Errorf("dry-run scaffold string must show --local on skills sync: %q", scaffold)
-	} else if strings.Contains(scaffold, "app sync --local") {
-		t.Errorf("dry-run scaffold string must NOT show --local on app sync: %q", scaffold)
+	} else if strings.Contains(scaffold, "app init --template nestjs-react-fullstack --app-id app_x --local") ||
+		strings.Contains(scaffold, "app sync --local") {
+		t.Errorf("dry-run scaffold string must NOT show --local on app init / app sync: %q", scaffold)
 	}

 	f := &fakeCommandRunner{results: map[string]fakeCallResult{
@@ -1207,7 +1250,7 @@ func TestRunScaffold_NonEmpty_SyncFailure(t *testing.T) {
 		"git ls-files": {stdout: "src/x.ts\n"},
 		"npx -y":       {err: errors.New("sync boom")},
 	}})
-	if _, err := runScaffold(context.Background(), t.TempDir(), "app_x", "", ""); err == nil {
+	if _, err := runScaffold(context.Background(), t.TempDir(), "app_x", "tpl"); err == nil {
 		t.Error("npx app sync failure must surface as an error")
 	}
 }
@@ -1587,7 +1630,7 @@ func TestRunScaffold_SubprocessFailureIsExternalTool(t *testing.T) {
 		"git ls-files": {stderr: "fatal: not a git repository", err: cause},
 	}}
 	withFakeRunner(t, f)
-	_, err := runScaffold(context.Background(), t.TempDir(), "app_x", "", "")
+	_, err := runScaffold(context.Background(), t.TempDir(), "app_x", "nestjs-react-fullstack")
 	if err == nil {
 		t.Fatalf("expected error from failing git subprocess")
 	}
@@ -1602,195 +1645,3 @@ func TestRunScaffold_SubprocessFailureIsExternalTool(t *testing.T) {
 		t.Fatalf("cause chain not preserved: %v", err)
 	}
 }
-
-func TestRunScaffold_HtmlPassesTemplate(t *testing.T) {
-	f := &fakeCommandRunner{results: map[string]fakeCallResult{"git ls-files": {stdout: ""}}}
-	withFakeRunner(t, f)
-	kind, err := runScaffold(context.Background(), t.TempDir(), "app_x", "html", "")
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if kind != scaffoldKindInit {
-		t.Errorf("kind = %q, want %q", kind, scaffoldKindInit)
-	}
-	c := findCall(f.calls, "npx", "-y")
-	if c == nil {
-		t.Fatal("npx not called")
-	}
-	if !containsAll(c, "--app-type", "html") {
-		t.Errorf("expected --template html in args: %v", c)
-	}
-}
-
-func TestRunScaffold_ModernHtmlPassesTemplate(t *testing.T) {
-	f := &fakeCommandRunner{results: map[string]fakeCallResult{"git ls-files": {stdout: ""}}}
-	withFakeRunner(t, f)
-	kind, err := runScaffold(context.Background(), t.TempDir(), "app_x", "modern_html", "")
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if kind != scaffoldKindInit {
-		t.Errorf("kind = %q, want %q", kind, scaffoldKindInit)
-	}
-	c := findCall(f.calls, "npx", "-y")
-	if c == nil {
-		t.Fatal("npx not called")
-	}
-	if !containsAll(c, "--app-type", "modern_html") {
-		t.Errorf("expected --template modern_html in args: %v", c)
-	}
-}
-
-func TestRunScaffold_EmptyAppTypeFallback(t *testing.T) {
-	f := &fakeCommandRunner{results: map[string]fakeCallResult{"git ls-files": {stdout: ""}}}
-	withFakeRunner(t, f)
-	kind, err := runScaffold(context.Background(), t.TempDir(), "app_x", "", "")
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if kind != scaffoldKindInit {
-		t.Errorf("kind = %q, want %q", kind, scaffoldKindInit)
-	}
-	c := findCall(f.calls, "npx", "-y")
-	if c == nil {
-		t.Fatal("npx not called")
-	}
-	if !containsAll(c, "--app-type", "full_stack") {
-		t.Errorf("expected --template full_stack in args: %v", c)
-	}
-}
-
-func TestRunScaffold_FullStackPassesTemplate(t *testing.T) {
-	f := &fakeCommandRunner{results: map[string]fakeCallResult{"git ls-files": {stdout: ""}}}
-	withFakeRunner(t, f)
-	kind, err := runScaffold(context.Background(), t.TempDir(), "app_x", "full_stack", "")
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if kind != scaffoldKindInit {
-		t.Errorf("kind = %q, want %q", kind, scaffoldKindInit)
-	}
-	c := findCall(f.calls, "npx", "-y")
-	if c == nil {
-		t.Fatal("npx not called")
-	}
-	if !containsAll(c, "--app-type", "full_stack") {
-		t.Errorf("expected --template full_stack in args: %v", c)
-	}
-}
-
-func TestScaffoldInitArgs_WithAppType(t *testing.T) {
-	args := scaffoldInitArgs("modern_html", "app_x", "")
-	if !containsAll(args, "--app-type", "modern_html", "--app-id", "app_x") {
-		t.Errorf("expected --template modern_html --app-id app_x, got %v", args)
-	}
-	for _, a := range args {
-		if a == "--source-path" {
-			t.Errorf("--source-path must not appear when sourcePath is empty: %v", args)
-		}
-	}
-}
-
-func TestScaffoldInitArgs_EmptyFallback(t *testing.T) {
-	args := scaffoldInitArgs("", "app_x", "")
-	if !containsAll(args, "--app-type", "full_stack", "--app-id", "app_x") {
-		t.Errorf("expected --template full_stack fallback, got %v", args)
-	}
-}
-
-func TestScaffoldInitArgs_WithSourcePath(t *testing.T) {
-	args := scaffoldInitArgs("modern_html", "app_x", "/path/to/src")
-	if !containsAll(args, "--app-type", "modern_html", "--app-id", "app_x", "--source-path", "/path/to/src") {
-		t.Errorf("expected --source-path /path/to/src, got %v", args)
-	}
-}
-
-func TestAppsInit_WithAppType_FreshClone(t *testing.T) {
-	f := &fakeCommandRunner{results: map[string]fakeCallResult{
-		"credential-init": credInitOK("http://u:t@h/app_typed.git"),
-		"git clone":       {},
-		"git checkout":    {},
-		"git ls-files":    {stdout: ""},
-		"git status":      {stdout: " A src/app.ts\n"},
-	}}
-	withFakeRunner(t, f)
-	factory, stdout, reg := newAppsExecuteFactory(t)
-
-	// Register a meta mock so queryAppType returns "modern_html"
-	reg.Register(&httpmock.Stub{
-		Method: "GET",
-		URL:    "/open-apis/spark/v1/apps/app_typed",
-		Body: map[string]interface{}{
-			"code": float64(0),
-			"data": map[string]interface{}{
-				"app": map[string]interface{}{
-					"app_id":   "app_typed",
-					"app_type": "MODERN_HTML",
-				},
-			},
-		},
-	})
-
-	dir := relCloneDir(t)
-	if err := runAppsShortcut(t, AppsInit, []string{"+init", "--app-id", "app_typed", "--dir", dir, "--as", "user"}, factory, stdout); err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-
-	data := parseEnvelopeData(t, stdout)
-	if data["app_type"] != "modern_html" {
-		t.Errorf("app_type = %v, want modern_html", data["app_type"])
-	}
-	// Verify the scaffold used --template modern_html
-	c := findCall(f.calls, "npx", "-y")
-	if c == nil {
-		t.Fatal("npx not called")
-	}
-	if !containsAll(c, "--app-type", "modern_html") {
-		t.Errorf("expected --template modern_html, got %v", c)
-	}
-}
-
-func TestAppsInit_WithAppType_AlreadyInitialized(t *testing.T) {
-	dir := relCloneDir(t)
-	abs, err := filepath.Abs(dir)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if err := os.MkdirAll(filepath.Join(abs, ".spark"), 0o755); err != nil {
-		t.Fatal(err)
-	}
-	if err := os.WriteFile(filepath.Join(abs, metaRelPath), []byte(`{"app_id":"app_typed2"}`), 0o644); err != nil {
-		t.Fatal(err)
-	}
-	envFile := filepath.Join(abs, ".env.local")
-	f := &fakeCommandRunner{results: map[string]fakeCallResult{"env-pull": envPullOK(envFile)}}
-	withFakeRunner(t, f)
-	factory, stdout, reg := newAppsExecuteFactory(t)
-
-	// Register meta mock so queryAppType returns "html"
-	reg.Register(&httpmock.Stub{
-		Method: "GET",
-		URL:    "/open-apis/spark/v1/apps/app_typed2",
-		Body: map[string]interface{}{
-			"code": float64(0),
-			"data": map[string]interface{}{
-				"app": map[string]interface{}{
-					"app_id":   "app_typed2",
-					"app_type": "HTML",
-				},
-			},
-		},
-	})
-
-	if err := runAppsShortcut(t, AppsInit, []string{"+init", "--app-id", "app_typed2", "--dir", dir, "--as", "user"}, factory, stdout); err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-
-	data := parseEnvelopeData(t, stdout)
-	if data["scaffold"] != "already_initialized" {
-		t.Errorf("scaffold = %v, want already_initialized", data["scaffold"])
-	}
-	if data["app_type"] != "html" {
-		t.Errorf("app_type = %v, want html", data["app_type"])
-	}
-}
--- a/shortcuts/apps/apps_meta.go
+++ b/shortcuts/apps/apps_meta.go
@@ -1,52 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package apps
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"strings"
-
-	"github.com/larksuite/cli/internal/validate"
-	"github.com/larksuite/cli/shortcuts/common"
-)
-
-// appInfo represents the app object returned by GET /open-apis/spark/v1/apps/{appID}.
-type appInfo struct {
-	AppID       string `json:"app_id"`
-	AppType     string `json:"app_type"`
-	Name        string `json:"name"`
-	Description string `json:"description"`
-	IconURL     string `json:"icon_url"`
-	CreatedAt   string `json:"created_at"`
-	UpdatedAt   string `json:"updated_at"`
-	IsPublished bool   `json:"is_published"`
-}
-
-// queryAppType fetches the app's type string from the server via
-// GET /open-apis/spark/v1/apps/{appID}. The server returns uppercase
-// values ("HTML", "FULL_STACK", "MODERN_HTML"); this function normalizes
-// to lowercase. Returns "" when the API is unavailable or returns an
-// error — callers fall back to legacy behavior.
-func queryAppType(ctx context.Context, rctx *common.RuntimeContext, appID string) string {
-	path := fmt.Sprintf("%s/apps/%s", apiBasePath, validate.EncodePathSegment(appID))
-	data, err := rctx.CallAPITyped("GET", path, nil, nil)
-	if err != nil {
-		return ""
-	}
-	appRaw, _ := data["app"].(map[string]interface{})
-	if appRaw == nil {
-		return ""
-	}
-	b, err := json.Marshal(appRaw)
-	if err != nil {
-		return ""
-	}
-	var info appInfo
-	if err := json.Unmarshal(b, &info); err != nil {
-		return ""
-	}
-	return strings.ToLower(info.AppType)
-}
--- a/shortcuts/apps/apps_meta_test.go
+++ b/shortcuts/apps/apps_meta_test.go
@@ -1,148 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package apps
-
-import (
-	"context"
-	"testing"
-
-	"github.com/spf13/cobra"
-
-	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
-	"github.com/larksuite/cli/internal/httpmock"
-	"github.com/larksuite/cli/shortcuts/common"
-)
-
-func newMetaTestRuntime(t *testing.T) (*common.RuntimeContext, *httpmock.Registry) {
-	t.Helper()
-	cfg := &core.CliConfig{Brand: core.BrandFeishu, AppID: "cli_meta_test"}
-	f, _, _, reg := cmdutil.TestFactory(t, cfg)
-	rt := common.TestNewRuntimeContextForAPI(
-		context.Background(),
-		&cobra.Command{Use: "+meta-test"},
-		cfg, f, core.AsUser,
-	)
-	return rt, reg
-}
-
-func TestQueryAppType_Success(t *testing.T) {
-	rt, reg := newMetaTestRuntime(t)
-	reg.Register(&httpmock.Stub{
-		Method: "GET",
-		URL:    "/open-apis/spark/v1/apps/app_test",
-		Body: map[string]interface{}{
-			"code": float64(0),
-			"data": map[string]interface{}{
-				"app": map[string]interface{}{
-					"app_id":   "app_test",
-					"app_type": "MODERN_HTML",
-				},
-			},
-		},
-	})
-
-	result := queryAppType(context.Background(), rt, "app_test")
-	if result != "modern_html" {
-		t.Errorf("queryAppType = %q, want modern_html", result)
-	}
-}
-
-func TestQueryAppType_FullStack(t *testing.T) {
-	rt, reg := newMetaTestRuntime(t)
-	reg.Register(&httpmock.Stub{
-		Method: "GET",
-		URL:    "/open-apis/spark/v1/apps/app_fs",
-		Body: map[string]interface{}{
-			"code": float64(0),
-			"data": map[string]interface{}{
-				"app": map[string]interface{}{
-					"app_id":   "app_fs",
-					"app_type": "FULL_STACK",
-				},
-			},
-		},
-	})
-
-	result := queryAppType(context.Background(), rt, "app_fs")
-	if result != "full_stack" {
-		t.Errorf("queryAppType = %q, want full_stack", result)
-	}
-}
-
-func TestQueryAppType_Html(t *testing.T) {
-	rt, reg := newMetaTestRuntime(t)
-	reg.Register(&httpmock.Stub{
-		Method: "GET",
-		URL:    "/open-apis/spark/v1/apps/app_html",
-		Body: map[string]interface{}{
-			"code": float64(0),
-			"data": map[string]interface{}{
-				"app": map[string]interface{}{
-					"app_id":   "app_html",
-					"app_type": "HTML",
-				},
-			},
-		},
-	})
-
-	result := queryAppType(context.Background(), rt, "app_html")
-	if result != "html" {
-		t.Errorf("queryAppType = %q, want html", result)
-	}
-}
-
-func TestQueryAppType_APIError(t *testing.T) {
-	rt, reg := newMetaTestRuntime(t)
-	reg.Register(&httpmock.Stub{
-		Method: "GET",
-		URL:    "/open-apis/spark/v1/apps/app_bad",
-		Status: 500,
-		Body:   map[string]interface{}{"code": float64(99999), "msg": "internal error"},
-	})
-
-	result := queryAppType(context.Background(), rt, "app_bad")
-	if result != "" {
-		t.Errorf("queryAppType = %q, want empty on error", result)
-	}
-}
-
-func TestQueryAppType_MissingAppObject(t *testing.T) {
-	rt, reg := newMetaTestRuntime(t)
-	reg.Register(&httpmock.Stub{
-		Method: "GET",
-		URL:    "/open-apis/spark/v1/apps/app_no",
-		Body: map[string]interface{}{
-			"code": float64(0),
-			"data": map[string]interface{}{},
-		},
-	})
-
-	result := queryAppType(context.Background(), rt, "app_no")
-	if result != "" {
-		t.Errorf("queryAppType = %q, want empty when app object missing", result)
-	}
-}
-
-func TestQueryAppType_EmptyAppType(t *testing.T) {
-	rt, reg := newMetaTestRuntime(t)
-	reg.Register(&httpmock.Stub{
-		Method: "GET",
-		URL:    "/open-apis/spark/v1/apps/app_empty",
-		Body: map[string]interface{}{
-			"code": float64(0),
-			"data": map[string]interface{}{
-				"app": map[string]interface{}{
-					"app_id":   "app_empty",
-					"app_type": "",
-				},
-			},
-		},
-	})
-
-	result := queryAppType(context.Background(), rt, "app_empty")
-	if result != "" {
-		t.Errorf("queryAppType = %q, want empty when app_type is empty", result)
-	}
-}
--- a/shortcuts/apps/apps_release_create.go
+++ b/shortcuts/apps/apps_release_create.go
@@ -56,10 +56,9 @@ var AppsReleaseCreate = common.Shortcut{
 		out := map[string]interface{}{
 			"release_id": common.GetString(data, "release_id"),
 			"status":     common.GetString(data, "status"),
-			"sync":       common.GetBool(data, "sync"),
 		}
 		rctx.OutFormat(out, nil, func(w io.Writer) {
-			fmt.Fprintf(w, "release_id: %s\nstatus: %s\nsync: %v\n", out["release_id"], out["status"], out["sync"])
+			fmt.Fprintf(w, "release_id: %s\nstatus: %s\n", out["release_id"], out["status"])
 		})
 		return nil
 	},
--- a/shortcuts/apps/apps_release_create_test.go
+++ b/shortcuts/apps/apps_release_create_test.go
@@ -105,45 +105,3 @@ func TestAppsReleaseCreateExecute_Success(t *testing.T) {
 		t.Errorf("status = %v, want publishing", env.Data["status"])
 	}
 }
-
-func TestAppsReleaseCreate_SyncField(t *testing.T) {
-	rctx, stdoutBuf, reg := newReleaseCreateRuntimeContext(t, "app_sync", "main")
-	reg.Register(&httpmock.Stub{
-		Method: "POST",
-		URL:    "/open-apis/spark/v1/apps/app_sync/releases",
-		Body: map[string]interface{}{
-			"code": 0,
-			"msg":  "",
-			"data": map[string]interface{}{
-				"release_id": "456",
-				"status":     "publishing",
-				"sync":       true,
-			},
-		},
-	})
-
-	err := AppsReleaseCreate.Execute(context.Background(), rctx)
-	if err != nil {
-		t.Fatalf("Execute() = %v", err)
-	}
-
-	var env struct {
-		OK   bool                   `json:"ok"`
-		Data map[string]interface{} `json:"data"`
-	}
-	if err := json.Unmarshal(stdoutBuf.Bytes(), &env); err != nil {
-		t.Fatalf("unmarshal output: %v\nraw: %s", err, stdoutBuf.String())
-	}
-	if !env.OK {
-		t.Fatalf("expected ok=true, got: %s", stdoutBuf.String())
-	}
-	if env.Data["release_id"] != "456" {
-		t.Errorf("release_id = %v, want 456", env.Data["release_id"])
-	}
-	if env.Data["status"] != "publishing" {
-		t.Errorf("status = %v, want publishing", env.Data["status"])
-	}
-	if env.Data["sync"] != true {
-		t.Errorf("sync = %v, want true", env.Data["sync"])
-	}
-}
--- a/shortcuts/mail/helpers.go
+++ b/shortcuts/mail/helpers.go
@@ -51,8 +51,9 @@ func hintSendDraft(runtime *common.RuntimeContext, mailboxID, draftID string) {
 // original message as read after a reply/reply-all/forward operation.
 func hintMarkAsRead(runtime *common.RuntimeContext, mailboxID, originalMessageID string) {
 	fmt.Fprintf(runtime.IO().ErrOut,
-		"tip: mark original as read? lark-cli mail +message-modify --mailbox '%s' --message-ids '%s' --remove-label-ids UNREAD\n",
-		shellQuoteForHint(mailboxID), shellQuoteForHint(originalMessageID))
+		"tip: mark original as read? lark-cli mail user_mailbox.messages batch_modify_message"+
+			` --params '{"user_mailbox_id":"%s"}' --data '{"message_ids":["%s"],"remove_label_ids":["UNREAD"]}'`+"\n",
+		sanitizeForTerminal(mailboxID), sanitizeForTerminal(originalMessageID))
 }

 // hintReadReceiptRequest prints a stderr tip when a message that the caller
--- a/shortcuts/mail/helpers_test.go
+++ b/shortcuts/mail/helpers_test.go
@@ -465,19 +465,14 @@ func TestPrintWatchOutputSchema(t *testing.T) {
 // TestHintMarkAsRead verifies hint mark as read.
 func TestHintMarkAsRead(t *testing.T) {
 	rt, _, stderr := newOutputRuntime(t)
-	hintMarkAsRead(rt, "mail box;$(whoami)", "msg-\x1b[31m123 'quoted'\nnext")
+	// Inject ANSI escape + message ID to verify sanitization
+	hintMarkAsRead(rt, "me", "msg-\x1b[31m123")
 	out := stderr.String()
 	if strings.Contains(out, "\x1b[") {
 		t.Errorf("hintMarkAsRead should sanitize ANSI escapes, got: %q", out)
 	}
-	if strings.Contains(out, "\nnext") {
-		t.Errorf("hintMarkAsRead should strip embedded newlines, got: %q", out)
-	}
-	if !strings.Contains(out, "--mailbox 'mail box;$(whoami)'") {
-		t.Errorf("hintMarkAsRead should quote mailbox for shell copy/paste, got: %q", out)
-	}
-	if !strings.Contains(out, "--message-ids 'msg-123 '\\''quoted'\\''next'") {
-		t.Errorf("hintMarkAsRead should quote message ID for shell copy/paste, got: %q", out)
+	if !strings.Contains(out, "msg-123") {
+		t.Errorf("hintMarkAsRead should contain sanitized message ID, got: %q", out)
 	}
 }

--- a/shortcuts/mail/mail_message_manage_test.go
+++ b/shortcuts/mail/mail_message_manage_test.go
@@ -1,482 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package mail
-
-import (
-	"encoding/json"
-	"errors"
-	"fmt"
-	"strings"
-	"testing"
-
-	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/auth"
-	"github.com/larksuite/cli/internal/httpmock"
-	"github.com/larksuite/cli/internal/output"
-	"github.com/larksuite/cli/shortcuts/common"
-)
-
-func messageManageID(suffix string) string {
-	return "msg_abcdefghijklmnop_" + suffix
-}
-
-func stubMessageManagePost(reg *httpmock.Registry, endpoint string, body map[string]interface{}) *httpmock.Stub {
-	stub := &httpmock.Stub{
-		Method: "POST",
-		URL:    "/user_mailboxes/me/messages/" + endpoint,
-		Body:   body,
-	}
-	reg.Register(stub)
-	return stub
-}
-
-func decodeMessageManageSummary(t *testing.T, data map[string]interface{}) ([]interface{}, []interface{}) {
-	t.Helper()
-	success, ok := data["success_message_ids"].([]interface{})
-	if !ok {
-		t.Fatalf("success_message_ids = %#v, want array", data["success_message_ids"])
-	}
-	failed, ok := data["failed_message_ids"].([]interface{})
-	if !ok {
-		t.Fatalf("failed_message_ids = %#v, want array", data["failed_message_ids"])
-	}
-	return success, failed
-}
-
-func requireMessageManageValidationParam(t *testing.T, err error, param string) *errs.ValidationError {
-	t.Helper()
-	if err == nil {
-		t.Fatalf("expected validation error for %s, got nil", param)
-	}
-	var validationErr *errs.ValidationError
-	if !errors.As(err, &validationErr) {
-		t.Fatalf("expected *errs.ValidationError for %s, got %T", param, err)
-	}
-	problem, ok := errs.ProblemOf(err)
-	if !ok {
-		t.Fatalf("expected typed Problem for %s, got %T", param, err)
-	}
-	if problem.Category != errs.CategoryValidation || problem.Subtype != errs.SubtypeInvalidArgument {
-		t.Fatalf("problem = %s/%s, want validation/invalid_argument", problem.Category, problem.Subtype)
-	}
-	if validationErr.Param != param {
-		t.Fatalf("param = %q, want %q", validationErr.Param, param)
-	}
-	return validationErr
-}
-
-func requireMessageManageFailedPrecondition(t *testing.T, err error) {
-	t.Helper()
-	if err == nil {
-		t.Fatal("expected failed precondition error, got nil")
-	}
-	var validationErr *errs.ValidationError
-	if !errors.As(err, &validationErr) {
-		t.Fatalf("expected *errs.ValidationError, got %T", err)
-	}
-	problem, ok := errs.ProblemOf(err)
-	if !ok {
-		t.Fatalf("expected typed Problem, got %T", err)
-	}
-	if problem.Category != errs.CategoryValidation || problem.Subtype != errs.SubtypeFailedPrecondition {
-		t.Fatalf("problem = %s/%s, want validation/failed_precondition", problem.Category, problem.Subtype)
-	}
-}
-
-func TestMessageManage_NormalizeMessageIDs(t *testing.T) {
-	id1 := messageManageID("1")
-	id2 := messageManageID("2")
-	got, err := normalizeMessageManageIDs([]string{id1, id2, id1})
-	if err != nil {
-		t.Fatalf("normalizeMessageManageIDs returned error: %v", err)
-	}
-	if len(got) != 2 || got[0] != id1 || got[1] != id2 {
-		t.Fatalf("ids = %v, want [%s %s]", got, id1, id2)
-	}
-	got, err = normalizeMessageManageIDs([]string{id1 + "," + id2, id1})
-	if err != nil {
-		t.Fatalf("normalizeMessageManageIDs CSV/repeated returned error: %v", err)
-	}
-	if len(got) != 2 || got[0] != id1 || got[1] != id2 {
-		t.Fatalf("CSV/repeated ids = %v, want [%s %s]", got, id1, id2)
-	}
-
-	cases := [][]string{
-		{""},
-		{" id_with_leading_space_12345"},
-		{"msg_abcdefghijklmnop_1,msg_abcdefghijklmnop_2 "},
-		{"1234567890123456"},
-		{"short"},
-		{"msg_abcdefghijklmnop!"},
-		{"msg_abcdefghijklmnop\t"},
-		{"msg_abcdefghijklmnop_1\nmsg_abcdefghijklmnop_2"},
-		{"msg_abcdefghijklmnop_1", "msg_abcdefghijklmnop_2 "},
-	}
-	for _, tc := range cases {
-		_, err := normalizeMessageManageIDs(tc)
-		requireMessageManageValidationParam(t, err, "--message-ids")
-	}
-}
-
-func TestMessageModify_Metadata(t *testing.T) {
-	if MailMessageModify.Command != "+message-modify" {
-		t.Fatalf("Command = %q", MailMessageModify.Command)
-	}
-	if MailMessageModify.Risk != "write" {
-		t.Errorf("Risk = %q, want write", MailMessageModify.Risk)
-	}
-	if len(MailMessageModify.AuthTypes) != 1 || MailMessageModify.AuthTypes[0] != "user" {
-		t.Errorf("AuthTypes = %v, want [user]", MailMessageModify.AuthTypes)
-	}
-	requiredScopes := map[string]bool{
-		"mail:user_mailbox.message:modify": true,
-	}
-	for _, scope := range MailMessageModify.Scopes {
-		delete(requiredScopes, scope)
-	}
-	if len(requiredScopes) != 0 {
-		t.Errorf("Scopes missing %v", requiredScopes)
-	}
-	if len(MailMessageModify.ConditionalScopes) != 1 || MailMessageModify.ConditionalScopes[0] != "mail:user_mailbox.folder:read" {
-		t.Errorf("ConditionalScopes = %v, want [mail:user_mailbox.folder:read]", MailMessageModify.ConditionalScopes)
-	}
-	flags := map[string]common.Flag{}
-	for _, fl := range MailMessageModify.Flags {
-		flags[fl.Name] = fl
-	}
-	for _, name := range []string{"mailbox", "message-ids", "add-label-ids", "remove-label-ids", "add-folder"} {
-		if _, ok := flags[name]; !ok {
-			t.Fatalf("missing --%s flag", name)
-		}
-	}
-	if flags["message-ids"].Type != "string_array" || !flags["message-ids"].Required {
-		t.Errorf("--message-ids = %#v, want required string_array", flags["message-ids"])
-	}
-}
-
-func TestMessageTrash_Metadata(t *testing.T) {
-	if MailMessageTrash.Command != "+message-trash" {
-		t.Fatalf("Command = %q", MailMessageTrash.Command)
-	}
-	if MailMessageTrash.Risk != "high-risk-write" {
-		t.Errorf("Risk = %q, want high-risk-write", MailMessageTrash.Risk)
-	}
-	if len(MailMessageTrash.AuthTypes) != 1 || MailMessageTrash.AuthTypes[0] != "user" {
-		t.Errorf("AuthTypes = %v, want [user]", MailMessageTrash.AuthTypes)
-	}
-	if len(MailMessageTrash.Scopes) != 1 || MailMessageTrash.Scopes[0] != "mail:user_mailbox.message:modify" {
-		t.Errorf("Scopes = %v, want [mail:user_mailbox.message:modify]", MailMessageTrash.Scopes)
-	}
-}
-
-func TestMessageModify_LabelOnlyDoesNotRequireFolderReadScope(t *testing.T) {
-	f, stdout, _, reg := mailShortcutTestFactory(t)
-	token := auth.GetStoredToken("test-app", "ou_testuser")
-	if token == nil {
-		t.Fatal("expected test token")
-	}
-	token.Scope = strings.ReplaceAll(token.Scope, " mail:user_mailbox.folder:read", "")
-	if err := auth.SetStoredToken(token); err != nil {
-		t.Fatalf("SetStoredToken() error = %v", err)
-	}
-
-	id := messageManageID("1")
-	post := stubMessageManagePost(reg, "batch_modify", map[string]interface{}{"code": 0, "data": map[string]interface{}{}})
-
-	err := runMountedMailShortcut(t, MailMessageModify, []string{
-		"+message-modify",
-		"--message-ids", id,
-		"--remove-label-ids", "UNREAD",
-	}, f, stdout)
-	if err != nil {
-		t.Fatalf("unexpected err: %v", err)
-	}
-	var body map[string]interface{}
-	if err := json.Unmarshal(post.CapturedBody, &body); err != nil {
-		t.Fatalf("unmarshal captured body: %v", err)
-	}
-	removeLabels := body["remove_label_ids"].([]interface{})
-	if len(removeLabels) != 1 || removeLabels[0] != "UNREAD" {
-		t.Fatalf("remove_label_ids = %#v, want [UNREAD]", removeLabels)
-	}
-}
-
-func TestMessageModify_ReadReceiptRequestLabelIsSystemLabel(t *testing.T) {
-	f, stdout, _, reg := mailShortcutTestFactory(t)
-	id := messageManageID("1")
-	post := stubMessageManagePost(reg, "batch_modify", map[string]interface{}{"code": 0, "data": map[string]interface{}{}})
-
-	err := runMountedMailShortcut(t, MailMessageModify, []string{
-		"+message-modify",
-		"--message-ids", id,
-		"--remove-label-ids", "read_receipt_request",
-	}, f, stdout)
-	if err != nil {
-		t.Fatalf("unexpected err: %v", err)
-	}
-	var body map[string]interface{}
-	if err := json.Unmarshal(post.CapturedBody, &body); err != nil {
-		t.Fatalf("unmarshal captured body: %v", err)
-	}
-	removeLabels := body["remove_label_ids"].([]interface{})
-	if len(removeLabels) != 1 || removeLabels[0] != "READ_RECEIPT_REQUEST" {
-		t.Fatalf("remove_label_ids = %#v, want [READ_RECEIPT_REQUEST]", removeLabels)
-	}
-}
-
-func TestMessageModify_LabelFolderNormalizationAndValidationAPIs(t *testing.T) {
-	f, stdout, _, reg := mailShortcutTestFactory(t)
-	id := messageManageID("1")
-	reg.Register(&httpmock.Stub{Method: "GET", URL: "/user_mailboxes/me/labels/customA", Body: map[string]interface{}{"code": 0, "data": map[string]interface{}{"label_id": "customA"}}})
-	reg.Register(&httpmock.Stub{Method: "GET", URL: "/user_mailboxes/me/folders/folderA", Body: map[string]interface{}{"code": 0, "data": map[string]interface{}{"folder_id": "folderA"}}})
-	post := stubMessageManagePost(reg, "batch_modify", map[string]interface{}{"code": 0, "data": map[string]interface{}{}})
-
-	err := runMountedMailShortcut(t, MailMessageModify, []string{
-		"+message-modify",
-		"--message-ids", id,
-		"--add-label-ids", "unread,customA",
-		"--remove-label-ids", "FLAGGED",
-		"--add-folder", "folderA",
-	}, f, stdout)
-	if err != nil {
-		t.Fatalf("unexpected err: %v", err)
-	}
-	var body map[string]interface{}
-	if err := json.Unmarshal(post.CapturedBody, &body); err != nil {
-		t.Fatalf("unmarshal captured body: %v", err)
-	}
-	if got := body["add_folder"]; got != "folderA" {
-		t.Errorf("add_folder = %v, want folderA", got)
-	}
-	addLabels := body["add_label_ids"].([]interface{})
-	if addLabels[0] != "UNREAD" || addLabels[1] != "customA" {
-		t.Errorf("add_label_ids = %#v, want [UNREAD customA]", addLabels)
-	}
-	removeLabels := body["remove_label_ids"].([]interface{})
-	if removeLabels[0] != "FLAGGED" {
-		t.Errorf("remove_label_ids = %#v, want [FLAGGED]", removeLabels)
-	}
-	success, failed := decodeMessageManageSummary(t, decodeShortcutEnvelopeData(t, stdout))
-	if len(success) != 1 || success[0] != id || len(failed) != 0 {
-		t.Errorf("summary success=%v failed=%v", success, failed)
-	}
-}
-
-func TestMessageModify_RejectsLabelIntersectionAndTrashFolder(t *testing.T) {
-	f, stdout, _, _ := mailShortcutTestFactory(t)
-	id := messageManageID("1")
-	err := runMountedMailShortcut(t, MailMessageModify, []string{
-		"+message-modify",
-		"--message-ids", id,
-		"--add-label-ids", "unread",
-		"--remove-label-ids", "UNREAD",
-	}, f, stdout)
-	requireMessageManageValidationParam(t, err, "--add-label-ids")
-	if !strings.Contains(err.Error(), "label cannot be both added and removed") {
-		t.Fatalf("error = %v, want label intersection validation", err)
-	}
-
-	err = runMountedMailShortcut(t, MailMessageModify, []string{
-		"+message-modify",
-		"--message-ids", id,
-		"--add-folder", "trash",
-	}, f, stdout)
-	requireMessageManageValidationParam(t, err, "--add-folder")
-	if !strings.Contains(err.Error(), "use +message-trash") {
-		t.Fatalf("error = %v, want TRASH validation", err)
-	}
-}
-
-func TestMessageModify_EmptyOperationDoesNotCallPost(t *testing.T) {
-	f, stdout, _, _ := mailShortcutTestFactory(t)
-	id1 := messageManageID("1")
-	id2 := messageManageID("2")
-	err := runMountedMailShortcut(t, MailMessageModify, []string{
-		"+message-modify",
-		"--message-ids", id1 + "," + id2 + "," + id1,
-	}, f, stdout)
-	if err != nil {
-		t.Fatalf("unexpected err: %v", err)
-	}
-	success, failed := decodeMessageManageSummary(t, decodeShortcutEnvelopeData(t, stdout))
-	if len(success) != 2 || success[0] != id1 || success[1] != id2 || len(failed) != 0 {
-		t.Fatalf("summary success=%v failed=%v", success, failed)
-	}
-}
-
-func TestMessageModify_BatchesAndAggregatesPartialFailure(t *testing.T) {
-	f, stdout, _, reg := mailShortcutTestFactory(t)
-	ids := make([]string, 41)
-	for i := range ids {
-		ids[i] = messageManageID(fmt.Sprintf("%02d", i))
-	}
-	first := stubMessageManagePost(reg, "batch_modify", map[string]interface{}{"code": 0, "data": map[string]interface{}{}})
-	second := stubMessageManagePost(reg, "batch_modify", map[string]interface{}{"code": 1230001, "msg": "bad request"})
-	third := stubMessageManagePost(reg, "batch_modify", map[string]interface{}{"code": 0, "data": map[string]interface{}{}})
-
-	err := runMountedMailShortcut(t, MailMessageModify, []string{
-		"+message-modify",
-		"--message-ids", strings.Join(ids, ","),
-		"--add-folder", "archive",
-	}, f, stdout)
-	if err != nil {
-		t.Fatalf("unexpected err: %v", err)
-	}
-	for idx, stub := range []*httpmock.Stub{first, second, third} {
-		var body map[string]interface{}
-		if err := json.Unmarshal(stub.CapturedBody, &body); err != nil {
-			t.Fatalf("batch %d body unmarshal: %v", idx+1, err)
-		}
-		messageIDs := body["message_ids"].([]interface{})
-		want := []int{20, 20, 1}[idx]
-		if len(messageIDs) != want {
-			t.Fatalf("batch %d size = %d, want %d", idx+1, len(messageIDs), want)
-		}
-		if body["add_folder"] != "ARCHIVED" {
-			t.Fatalf("batch %d add_folder = %v, want ARCHIVED", idx+1, body["add_folder"])
-		}
-	}
-	success, failed := decodeMessageManageSummary(t, decodeShortcutEnvelopeData(t, stdout))
-	if len(success) != 21 || len(failed) != 20 {
-		t.Fatalf("success=%d failed=%d, want 21/20", len(success), len(failed))
-	}
-}
-
-func TestMessageModify_AllBatchesFailReturnsError(t *testing.T) {
-	f, stdout, _, reg := mailShortcutTestFactory(t)
-	id := messageManageID("1")
-	stubMessageManagePost(reg, "batch_modify", map[string]interface{}{"code": 1230001, "msg": "bad request"})
-
-	err := runMountedMailShortcut(t, MailMessageModify, []string{
-		"+message-modify",
-		"--message-ids", id,
-		"--add-folder", "archive",
-	}, f, stdout)
-	requireMessageManageFailedPrecondition(t, err)
-}
-
-func TestMessageModify_DryRunShowsPlanWithoutValidationGET(t *testing.T) {
-	f, stdout, _, _ := mailShortcutTestFactory(t)
-	id1 := messageManageID("1")
-	id2 := messageManageID("2")
-	err := runMountedMailShortcut(t, MailMessageModify, []string{
-		"+message-modify",
-		"--message-ids", id1 + "," + id2,
-		"--add-label-ids", "customA",
-		"--add-folder", "folderA",
-		"--dry-run",
-	}, f, stdout)
-	if err != nil {
-		t.Fatalf("dry-run failed: %v", err)
-	}
-	out := stdout.String()
-	for _, want := range []string{
-		`/user_mailboxes/me/messages/batch_modify`,
-		`validation_api_plan`,
-		`/user_mailboxes/me/labels/customA`,
-		`/user_mailboxes/me/folders/folderA`,
-		`will_validate`,
-		`batch_size`,
-	} {
-		if !strings.Contains(out, want) {
-			t.Fatalf("dry-run output missing %q; got %s", want, out)
-		}
-	}
-}
-
-func TestMessageTrash_RequiresYesAndBatches(t *testing.T) {
-	f, stdout, _, reg := mailShortcutTestFactory(t)
-	id1 := messageManageID("1")
-	id2 := messageManageID("2")
-	err := runMountedMailShortcut(t, MailMessageTrash, []string{
-		"+message-trash",
-		"--message-ids", id1 + "," + id2,
-	}, f, stdout)
-	if err == nil {
-		t.Fatal("expected confirmation error, got nil")
-	}
-	if code := output.ExitCodeOf(err); code != output.ExitConfirmationRequired {
-		t.Fatalf("exit code = %d, want %d", code, output.ExitConfirmationRequired)
-	}
-
-	post := stubMessageManagePost(reg, "batch_trash", map[string]interface{}{"code": 0, "data": map[string]interface{}{}})
-	err = runMountedMailShortcut(t, MailMessageTrash, []string{
-		"+message-trash",
-		"--message-ids", id1 + "," + id2,
-		"--yes",
-	}, f, stdout)
-	if err != nil {
-		t.Fatalf("unexpected err with --yes: %v", err)
-	}
-	var body map[string]interface{}
-	if err := json.Unmarshal(post.CapturedBody, &body); err != nil {
-		t.Fatalf("unmarshal captured body: %v", err)
-	}
-	if got := len(body["message_ids"].([]interface{})); got != 2 {
-		t.Fatalf("message_ids len = %d, want 2", got)
-	}
-	success, failed := decodeMessageManageSummary(t, decodeShortcutEnvelopeData(t, stdout))
-	if len(success) != 2 || len(failed) != 0 {
-		t.Fatalf("summary success=%v failed=%v", success, failed)
-	}
-}
-
-func TestMessageTrash_AllBatchesFailReturnsError(t *testing.T) {
-	f, stdout, _, reg := mailShortcutTestFactory(t)
-	id := messageManageID("1")
-	stubMessageManagePost(reg, "batch_trash", map[string]interface{}{"code": 1230001, "msg": "bad request"})
-
-	err := runMountedMailShortcut(t, MailMessageTrash, []string{
-		"+message-trash",
-		"--message-ids", id,
-		"--yes",
-	}, f, stdout)
-	requireMessageManageFailedPrecondition(t, err)
-}
-
-func TestMessageManage_RejectsWhitespaceBeforeAPI(t *testing.T) {
-	id1 := messageManageID("1")
-	id2 := messageManageID("2")
-	cases := []struct {
-		name     string
-		shortcut common.Shortcut
-		args     []string
-	}{
-		{
-			name:     "trash newline in repeated flag",
-			shortcut: MailMessageTrash,
-			args:     []string{"+message-trash", "--message-ids", id1 + "\n" + id2, "--yes"},
-		},
-		{
-			name:     "trash tab in csv flag",
-			shortcut: MailMessageTrash,
-			args:     []string{"+message-trash", "--message-ids", id1 + ",\t" + id2, "--yes"},
-		},
-		{
-			name:     "modify space in repeated flag",
-			shortcut: MailMessageModify,
-			args:     []string{"+message-modify", "--message-ids", id1, "--message-ids", id2 + " ", "--add-folder", "archive"},
-		},
-		{
-			name:     "modify space in csv flag",
-			shortcut: MailMessageModify,
-			args:     []string{"+message-modify", "--message-ids", id1 + ", " + id2, "--add-folder", "archive"},
-		},
-	}
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			f, stdout, _, _ := mailShortcutTestFactory(t)
-			err := runMountedMailShortcut(t, tc.shortcut, tc.args, f, stdout)
-			if err == nil {
-				t.Fatal("expected validation error, got nil")
-			}
-			if code := output.ExitCodeOf(err); code != output.ExitValidation {
-				t.Fatalf("exit code = %d, want %d; err=%v", code, output.ExitValidation, err)
-			}
-			if !strings.Contains(err.Error(), "must not contain whitespace or control characters") {
-				t.Fatalf("error = %v, want whitespace/control validation", err)
-			}
-		})
-	}
-}
--- a/shortcuts/mail/mail_message_modify.go
+++ b/shortcuts/mail/mail_message_modify.go
@@ -1,141 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package mail
-
-import (
-	"context"
-
-	"github.com/larksuite/cli/shortcuts/common"
-)
-
-type messageModifyInput struct {
-	MessageIDs         []string
-	AddLabelIDs        []string
-	RemoveLabelIDs     []string
-	AddFolder          string
-	CustomLabelIDs     []string
-	CustomFolderID     string
-	ValidationAPIPlans []validationAPIPlan
-}
-
-// MailMessageModify is the `+message-modify` shortcut: apply labels, unread
-// state labels, or a folder move to existing messages in batches of 20.
-var MailMessageModify = common.Shortcut{
-	Service:     "mail",
-	Command:     "+message-modify",
-	Description: "Modify existing mail messages by adding/removing label IDs or moving them to a folder. Batches message IDs in groups of 20 and keeps output compact.",
-	Risk:        "write",
-	Scopes:      []string{"mail:user_mailbox.message:modify"},
-	ConditionalScopes: []string{
-		"mail:user_mailbox.folder:read",
-	},
-	AuthTypes: []string{"user"},
-	HasFormat: true,
-	Flags: []common.Flag{
-		{Name: "mailbox", Desc: "Mailbox email address that owns the messages (default: me)."},
-		{Name: "message-ids", Type: "string_array", Required: true, Desc: "Message IDs to modify; comma-separated or repeat the flag."},
-		{Name: "add-label-ids", Type: "string_slice", Desc: "Label IDs to add. System labels unread/important/other/flagged are normalized to upper case."},
-		{Name: "remove-label-ids", Type: "string_slice", Desc: "Label IDs to remove. System labels unread/important/other/flagged are normalized to upper case."},
-		{Name: "add-folder", Desc: "Folder ID to move messages to. System folders inbox/sent/spam/archive/archived are normalized; TRASH is rejected, use +message-trash."},
-	},
-	Validate: validateMessageModify,
-	DryRun:   dryRunMessageModify,
-	Execute:  executeMessageModify,
-}
-
-func validateMessageModify(ctx context.Context, rt *common.RuntimeContext) error {
-	_, err := buildMessageModifyInput(rt)
-	return err
-}
-
-func dryRunMessageModify(ctx context.Context, rt *common.RuntimeContext) *common.DryRunAPI {
-	mailboxID := resolveMailboxID(rt)
-	input, _ := buildMessageModifyInput(rt)
-	api := common.NewDryRunAPI().
-		Desc("Modify messages sequentially in batches of 20; dry-run does not call label/folder validation APIs").
-		Set("batch_size", mailMessageManageBatchSize).
-		Set("batches", chunkMessageManageIDs(input.MessageIDs)).
-		Set("validation_api_plan", input.ValidationAPIPlans)
-	for _, batch := range chunkMessageManageIDs(input.MessageIDs) {
-		api = api.POST(mailboxPath(mailboxID, "messages", "batch_modify")).
-			Body(messageManageBody(batch, input.AddLabelIDs, input.RemoveLabelIDs, input.AddFolder))
-	}
-	return api
-}
-
-func executeMessageModify(ctx context.Context, rt *common.RuntimeContext) error {
-	mailboxID := resolveMailboxID(rt)
-	input, err := buildMessageModifyInput(rt)
-	if err != nil {
-		return err
-	}
-	if err := validateCustomMessageManageLabels(rt, mailboxID, input.CustomLabelIDs); err != nil {
-		return err
-	}
-	if err := validateCustomMessageManageFolder(rt, mailboxID, input.CustomFolderID); err != nil {
-		return err
-	}
-
-	if len(input.AddLabelIDs) == 0 && len(input.RemoveLabelIDs) == 0 && input.AddFolder == "" {
-		emitMessageManageSummary(rt, messageManageSummary{
-			SuccessMessageIDs: input.MessageIDs,
-			FailedMessageIDs:  []messageManageFailure{},
-		}, true)
-		return nil
-	}
-
-	summary := messageManageSummary{FailedMessageIDs: []messageManageFailure{}}
-	for _, batch := range chunkMessageManageIDs(input.MessageIDs) {
-		_, err := rt.CallAPITyped("POST", mailboxPath(mailboxID, "messages", "batch_modify"), nil,
-			messageManageBody(batch, input.AddLabelIDs, input.RemoveLabelIDs, input.AddFolder))
-		if err != nil {
-			for _, id := range batch {
-				summary.FailedMessageIDs = append(summary.FailedMessageIDs, messageManageFailure{MessageID: id, Reason: err.Error()})
-			}
-			continue
-		}
-		summary.SuccessMessageIDs = append(summary.SuccessMessageIDs, batch...)
-	}
-	emitMessageManageSummary(rt, summary, false)
-	if len(summary.SuccessMessageIDs) == 0 && len(summary.FailedMessageIDs) > 0 {
-		return mailFailedPreconditionError("all message modify batches failed")
-	}
-	return nil
-}
-
-func buildMessageModifyInput(rt *common.RuntimeContext) (messageModifyInput, error) {
-	messageIDs, err := normalizeMessageManageIDs(rt.StrArray("message-ids"))
-	if err != nil {
-		return messageModifyInput{}, err
-	}
-	addLabels, customAddLabels, err := normalizeMessageManageLabels(rt.StrSlice("add-label-ids"), "--add-label-ids")
-	if err != nil {
-		return messageModifyInput{}, err
-	}
-	removeLabels, customRemoveLabels, err := normalizeMessageManageLabels(rt.StrSlice("remove-label-ids"), "--remove-label-ids")
-	if err != nil {
-		return messageModifyInput{}, err
-	}
-	if err := validateLabelIntersection(addLabels, removeLabels); err != nil {
-		return messageModifyInput{}, err
-	}
-	folder, customFolder, err := normalizeMessageManageFolder(rt.Str("add-folder"))
-	if err != nil {
-		return messageModifyInput{}, err
-	}
-	customLabels := append(customAddLabels, customRemoveLabels...)
-	customFolderID := ""
-	if customFolder {
-		customFolderID = folder
-	}
-	return messageModifyInput{
-		MessageIDs:         messageIDs,
-		AddLabelIDs:        addLabels,
-		RemoveLabelIDs:     removeLabels,
-		AddFolder:          folder,
-		CustomLabelIDs:     customLabels,
-		CustomFolderID:     customFolderID,
-		ValidationAPIPlans: messageManageValidationPlan(resolveMailboxID(rt), customLabels, customFolderID),
-	}, nil
-}
--- a/shortcuts/mail/mail_message_trash.go
+++ b/shortcuts/mail/mail_message_trash.go
@@ -1,75 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package mail
-
-import (
-	"context"
-
-	"github.com/larksuite/cli/shortcuts/common"
-)
-
-// MailMessageTrash is the `+message-trash` shortcut: soft-delete existing
-// messages in batches of 20 via batch_trash. Risk is high-risk-write, so the
-// runner requires --yes before Execute.
-var MailMessageTrash = common.Shortcut{
-	Service:     "mail",
-	Command:     "+message-trash",
-	Description: "Soft-delete existing mail messages. Batches message IDs in groups of 20 and calls batch_trash sequentially. Requires --yes.",
-	Risk:        "high-risk-write",
-	Scopes:      []string{"mail:user_mailbox.message:modify"},
-	AuthTypes:   []string{"user"},
-	HasFormat:   true,
-	Flags: []common.Flag{
-		{Name: "mailbox", Desc: "Mailbox email address that owns the messages (default: me)."},
-		{Name: "message-ids", Type: "string_array", Required: true, Desc: "Message IDs to soft-delete; comma-separated or repeat the flag."},
-	},
-	Validate: validateMessageTrash,
-	DryRun:   dryRunMessageTrash,
-	Execute:  executeMessageTrash,
-}
-
-func validateMessageTrash(ctx context.Context, rt *common.RuntimeContext) error {
-	_, err := normalizeMessageManageIDs(rt.StrArray("message-ids"))
-	return err
-}
-
-func dryRunMessageTrash(ctx context.Context, rt *common.RuntimeContext) *common.DryRunAPI {
-	mailboxID := resolveMailboxID(rt)
-	messageIDs, _ := normalizeMessageManageIDs(rt.StrArray("message-ids"))
-	api := common.NewDryRunAPI().
-		Desc("Soft-delete messages sequentially in batches of 20").
-		Set("batch_size", mailMessageManageBatchSize).
-		Set("batches", chunkMessageManageIDs(messageIDs))
-	for _, batch := range chunkMessageManageIDs(messageIDs) {
-		api = api.POST(mailboxPath(mailboxID, "messages", "batch_trash")).
-			Body(map[string]interface{}{"message_ids": batch})
-	}
-	return api
-}
-
-func executeMessageTrash(ctx context.Context, rt *common.RuntimeContext) error {
-	mailboxID := resolveMailboxID(rt)
-	messageIDs, err := normalizeMessageManageIDs(rt.StrArray("message-ids"))
-	if err != nil {
-		return err
-	}
-
-	summary := messageManageSummary{FailedMessageIDs: []messageManageFailure{}}
-	for _, batch := range chunkMessageManageIDs(messageIDs) {
-		_, err := rt.CallAPITyped("POST", mailboxPath(mailboxID, "messages", "batch_trash"), nil,
-			map[string]interface{}{"message_ids": batch})
-		if err != nil {
-			for _, id := range batch {
-				summary.FailedMessageIDs = append(summary.FailedMessageIDs, messageManageFailure{MessageID: id, Reason: err.Error()})
-			}
-			continue
-		}
-		summary.SuccessMessageIDs = append(summary.SuccessMessageIDs, batch...)
-	}
-	emitMessageManageSummary(rt, summary, false)
-	if len(summary.SuccessMessageIDs) == 0 && len(summary.FailedMessageIDs) > 0 {
-		return mailFailedPreconditionError("all message trash batches failed")
-	}
-	return nil
-}
--- a/shortcuts/mail/mail_shortcut_test.go
+++ b/shortcuts/mail/mail_shortcut_test.go
@@ -44,7 +44,7 @@ func mailShortcutTestFactory(t *testing.T) (*cmdutil.Factory, *bytes.Buffer, *by
 		RefreshToken:     "test-refresh-token",
 		ExpiresAt:        time.Now().Add(1 * time.Hour).UnixMilli(),
 		RefreshExpiresAt: time.Now().Add(24 * time.Hour).UnixMilli(),
-		Scope:            "mail:user_mailbox.messages:write mail:user_mailbox.messages:read mail:user_mailbox.message:modify mail:user_mailbox.message:readonly mail:user_mailbox.message.address:read mail:user_mailbox.message.subject:read mail:user_mailbox.message.body:read mail:user_mailbox:readonly mail:user_mailbox.folder:read",
+		Scope:            "mail:user_mailbox.messages:write mail:user_mailbox.messages:read mail:user_mailbox.message:modify mail:user_mailbox.message:readonly mail:user_mailbox.message.address:read mail:user_mailbox.message.subject:read mail:user_mailbox.message.body:read mail:user_mailbox:readonly",
 		GrantedAt:        time.Now().Add(-1 * time.Hour).UnixMilli(),
 	}
 	if err := auth.SetStoredToken(token); err != nil {
--- a/shortcuts/mail/message_manage_helpers.go
+++ b/shortcuts/mail/message_manage_helpers.go
@@ -1,283 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package mail
-
-import (
-	"fmt"
-	"io"
-	"strings"
-	"unicode"
-
-	"github.com/larksuite/cli/internal/output"
-	"github.com/larksuite/cli/shortcuts/common"
-)
-
-const mailMessageManageBatchSize = 20
-
-var messageManageSystemLabels = map[string]string{
-	"UNREAD":               "UNREAD",
-	"IMPORTANT":            "IMPORTANT",
-	"OTHER":                "OTHER",
-	"FLAGGED":              "FLAGGED",
-	"READ_RECEIPT_REQUEST": "READ_RECEIPT_REQUEST",
-}
-
-var messageManageSystemFolders = map[string]string{
-	"INBOX":    "INBOX",
-	"SENT":     "SENT",
-	"SPAM":     "SPAM",
-	"ARCHIVE":  "ARCHIVED",
-	"ARCHIVED": "ARCHIVED",
-}
-
-type messageManageSummary struct {
-	SuccessMessageIDs []string               `json:"success_message_ids"`
-	FailedMessageIDs  []messageManageFailure `json:"failed_message_ids"`
-}
-
-type messageManageFailure struct {
-	MessageID string `json:"message_id"`
-	Reason    string `json:"reason"`
-}
-
-type validationAPIPlan struct {
-	Method       string `json:"method"`
-	Path         string `json:"path"`
-	WillValidate bool   `json:"will_validate"`
-}
-
-func normalizeMessageManageIDs(raw []string) ([]string, error) {
-	if len(raw) == 0 {
-		return nil, mailValidationParamError("--message-ids", "--message-ids is required")
-	}
-	parts, err := splitMessageManageIDTokens(raw)
-	if err != nil {
-		return nil, err
-	}
-	ids := make([]string, 0, len(parts))
-	seen := make(map[string]struct{}, len(parts))
-	for i, part := range parts {
-		if part == "" {
-			return nil, mailValidationParamError("--message-ids", "--message-ids entry %d is empty; remove extra commas or provide valid message IDs", i+1)
-		}
-		id := strings.TrimSpace(part)
-		if id == "" {
-			return nil, mailValidationParamError("--message-ids", "--message-ids entry %d is empty; remove extra commas or provide valid message IDs", i+1)
-		}
-		if id != part {
-			return nil, mailValidationParamError("--message-ids", "--message-ids entry %d (%q): must not contain leading or trailing whitespace", i+1, part)
-		}
-		if err := validateMessageManageID(id, i); err != nil {
-			return nil, err
-		}
-		if _, ok := seen[id]; ok {
-			continue
-		}
-		seen[id] = struct{}{}
-		ids = append(ids, id)
-	}
-	if len(ids) == 0 {
-		return nil, mailValidationParamError("--message-ids", "--message-ids is required")
-	}
-	return ids, nil
-}
-
-func splitMessageManageIDTokens(raw []string) ([]string, error) {
-	parts := make([]string, 0, len(raw))
-	for i, token := range raw {
-		for _, r := range token {
-			if unicode.IsSpace(r) || unicode.IsControl(r) {
-				return nil, mailValidationParamError("--message-ids", "--message-ids entry %d (%q): must not contain whitespace or control characters", i+1, token)
-			}
-		}
-		parts = append(parts, strings.Split(token, ",")...)
-	}
-	return parts, nil
-}
-
-func validateMessageManageID(id string, index int) error {
-	if len(id) < 16 {
-		return mailValidationParamError("--message-ids", "--message-ids entry %d (%q): length must be at least 16 characters", index+1, id)
-	}
-	if strings.Trim(id, "0123456789") == "" {
-		return mailValidationParamError("--message-ids", "--message-ids entry %d (%q): numeric primary IDs are not supported; pass the Open API message_id from mail output", index+1, id)
-	}
-	for _, r := range id {
-		if unicode.IsSpace(r) || unicode.IsControl(r) {
-			return mailValidationParamError("--message-ids", "--message-ids entry %d (%q): must not contain whitespace or control characters", index+1, id)
-		}
-		if (r >= 'A' && r <= 'Z') || (r >= 'a' && r <= 'z') || (r >= '0' && r <= '9') {
-			continue
-		}
-		switch r {
-		case '+', '/', '=', '_', '-':
-			continue
-		default:
-			return mailValidationParamError("--message-ids", "--message-ids entry %d (%q): contains characters outside the Open API message_id character set", index+1, id)
-		}
-	}
-	return nil
-}
-
-func normalizeMessageManageLabels(raw []string, flagName string) ([]string, []string, error) {
-	labels := make([]string, 0, len(raw))
-	custom := make([]string, 0, len(raw))
-	seen := make(map[string]struct{}, len(raw))
-	for i, part := range raw {
-		id := strings.TrimSpace(part)
-		if id == "" {
-			return nil, nil, mailValidationParamError(flagName, "%s entry %d is empty; remove extra commas or provide valid label IDs", flagName, i+1)
-		}
-		if id != part {
-			return nil, nil, mailValidationParamError(flagName, "%s entry %d (%q): must not contain leading or trailing whitespace", flagName, i+1, part)
-		}
-		normalized := id
-		if system, ok := messageManageSystemLabels[strings.ToUpper(id)]; ok {
-			normalized = system
-		} else {
-			custom = append(custom, id)
-		}
-		if _, ok := seen[normalized]; ok {
-			continue
-		}
-		seen[normalized] = struct{}{}
-		labels = append(labels, normalized)
-	}
-	if len(labels) > 20 {
-		return nil, nil, mailValidationParamError(flagName, "%s accepts at most 20 label IDs (got %d)", flagName, len(labels))
-	}
-	return labels, custom, nil
-}
-
-func validateLabelIntersection(add, remove []string) error {
-	removeSet := make(map[string]struct{}, len(remove))
-	for _, id := range remove {
-		removeSet[id] = struct{}{}
-	}
-	for _, id := range add {
-		if _, ok := removeSet[id]; ok {
-			return mailValidationParamError("--add-label-ids", "label cannot be both added and removed: %s", id)
-		}
-	}
-	return nil
-}
-
-func normalizeMessageManageFolder(raw string) (string, bool, error) {
-	if raw == "" {
-		return "", false, nil
-	}
-	folder := strings.TrimSpace(raw)
-	if folder == "" {
-		return "", false, mailValidationParamError("--add-folder", "--add-folder must not be empty")
-	}
-	if folder != raw {
-		return "", false, mailValidationParamError("--add-folder", "--add-folder %q must not contain leading or trailing whitespace", raw)
-	}
-	if strings.EqualFold(folder, "TRASH") {
-		return "", false, mailValidationParamError("--add-folder", "TRASH is not supported by +message-modify; use +message-trash")
-	}
-	if system, ok := messageManageSystemFolders[strings.ToUpper(folder)]; ok {
-		return system, false, nil
-	}
-	return folder, true, nil
-}
-
-func chunkMessageManageIDs(ids []string) [][]string {
-	if len(ids) == 0 {
-		return nil
-	}
-	chunks := make([][]string, 0, (len(ids)+mailMessageManageBatchSize-1)/mailMessageManageBatchSize)
-	for start := 0; start < len(ids); start += mailMessageManageBatchSize {
-		end := start + mailMessageManageBatchSize
-		if end > len(ids) {
-			end = len(ids)
-		}
-		chunks = append(chunks, ids[start:end])
-	}
-	return chunks
-}
-
-func validateCustomMessageManageLabels(rt *common.RuntimeContext, mailboxID string, ids []string) error {
-	if len(ids) == 0 {
-		return nil
-	}
-	if err := validateLabelReadScope(rt); err != nil {
-		return err
-	}
-	seen := map[string]struct{}{}
-	for _, id := range ids {
-		if _, ok := seen[id]; ok {
-			continue
-		}
-		seen[id] = struct{}{}
-		if _, err := rt.CallAPITyped("GET", mailboxPath(mailboxID, "labels", id), nil, nil); err != nil {
-			return mailDecorateProblemMessage(err, "label not found: %s", id)
-		}
-	}
-	return nil
-}
-
-func validateCustomMessageManageFolder(rt *common.RuntimeContext, mailboxID, id string) error {
-	if id == "" {
-		return nil
-	}
-	if err := validateFolderReadScope(rt); err != nil {
-		return err
-	}
-	if _, err := rt.CallAPITyped("GET", mailboxPath(mailboxID, "folders", id), nil, nil); err != nil {
-		return mailDecorateProblemMessage(err, "folder not found: %s", id)
-	}
-	return nil
-}
-
-func messageManageBody(ids, addLabels, removeLabels []string, addFolder string) map[string]interface{} {
-	body := map[string]interface{}{"message_ids": ids}
-	if len(addLabels) > 0 {
-		body["add_label_ids"] = addLabels
-	}
-	if len(removeLabels) > 0 {
-		body["remove_label_ids"] = removeLabels
-	}
-	if addFolder != "" {
-		body["add_folder"] = addFolder
-	}
-	return body
-}
-
-func messageManageValidationPlan(mailboxID string, customLabels []string, customFolder string) []validationAPIPlan {
-	plans := make([]validationAPIPlan, 0, len(customLabels)+1)
-	seenLabels := map[string]struct{}{}
-	for _, id := range customLabels {
-		if _, ok := seenLabels[id]; ok {
-			continue
-		}
-		seenLabels[id] = struct{}{}
-		plans = append(plans, validationAPIPlan{
-			Method:       "GET",
-			Path:         mailboxPath(mailboxID, "labels", id),
-			WillValidate: true,
-		})
-	}
-	if customFolder != "" {
-		plans = append(plans, validationAPIPlan{
-			Method:       "GET",
-			Path:         mailboxPath(mailboxID, "folders", customFolder),
-			WillValidate: true,
-		})
-	}
-	return plans
-}
-
-func emitMessageManageSummary(rt *common.RuntimeContext, summary messageManageSummary, noAPICalls bool) {
-	rt.OutFormat(summary, &output.Meta{Count: len(summary.SuccessMessageIDs)}, func(w io.Writer) {
-		fmt.Fprintf(w, "success_message_ids: %d\n", len(summary.SuccessMessageIDs))
-		fmt.Fprintf(w, "failed_message_ids: %d\n", len(summary.FailedMessageIDs))
-		if noAPICalls {
-			fmt.Fprintln(w, "No changes requested; no API calls were made.")
-		}
-		for _, item := range summary.FailedMessageIDs {
-			fmt.Fprintf(w, "- %s: %s\n", item.MessageID, item.Reason)
-		}
-	})
-}
--- a/shortcuts/mail/shortcuts.go
+++ b/shortcuts/mail/shortcuts.go
@@ -10,8 +10,6 @@ func Shortcuts() []common.Shortcut {
 	return []common.Shortcut{
 		MailMessage,
 		MailMessages,
-		MailMessageModify,
-		MailMessageTrash,
 		MailThread,
 		MailTriage,
 		MailWatch,
--- a/shortcuts/register.go
+++ b/shortcuts/register.go
@@ -17,6 +17,7 @@ import (
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/deprecation"
 	"github.com/larksuite/cli/internal/registry"
+	"github.com/larksuite/cli/shortcuts/application"
 	"github.com/larksuite/cli/shortcuts/apps"
 	"github.com/larksuite/cli/shortcuts/base"
 	"github.com/larksuite/cli/shortcuts/calendar"
@@ -61,6 +62,7 @@ var allShortcuts []common.Shortcut

 func init() {
 	allShortcuts = append(allShortcuts, apps.Shortcuts()...)
+	allShortcuts = append(allShortcuts, application.Shortcuts()...)
 	allShortcuts = append(allShortcuts, calendar.Shortcuts()...)
 	allShortcuts = append(allShortcuts, doc.Shortcuts()...)
 	allShortcuts = append(allShortcuts, drive.Shortcuts()...)
--- a/skill-template/domains/application.md
+++ b/skill-template/domains/application.md
@@ -0,0 +1,20 @@
+## 开放平台应用自管理（application）域介绍
+
+本域面向飞书开放平台的**应用自身**做自管理操作——即应用对着自己的配置做增删改查（而不是操作某个用户/群组的业务资源）。当前唯一承载的能力是**斜杠指令（Slash Command）**：应用注册在客户端指令面板里可见的 `/` 命令（也叫机器人命令），用户在会话输入框敲出后会触发对应的机器人交互。
+
+- **App（应用）**：当前 lark-cli 绑定的开放平台应用本身，通过 appId/appSecret 识别，没有独立的 `app_id` 参数——所有操作都作用于"当前绑定应用"
+- **Slash Command（斜杠指令）**：应用注册的 `/` 命令对象，含 `command_id`（服务端生成、不可复用）、`command`（指令名，不带前导 `/`）、`description`（默认描述 + 多语言 i18n）、`icon`
+
+### 与 apps（妙搭）域的区别
+
+两者经常被用户口语混淆，务必区分：
+
+| | application（本域） | apps（妙搭） |
+|---|---|---|
+| 对象 | 开放平台应用自身的配置（自管理） | 低代码/无代码平台上创建的妙搭应用 |
+| 典型能力 | 斜杠指令管理 | 应用创建、HTML 发布、可用范围管理 |
+| 触发词 | 斜杠指令、指令面板、机器人命令、应用自管理 | 妙搭、Miaoda、低代码应用 |
+
+### 当前能力与未来规划
+
+当前仅实现斜杠指令的列出/创建/更新/删除。**bot 菜单管理、应用版本发布、应用使用统计**等其他"应用自管理"类能力规划中、尚未实现——遇到相关用户诉求应如实告知暂不支持，不要臆造对应命令。
--- a/skill-template/domains/mail.md
+++ b/skill-template/domains/mail.md
@@ -65,7 +65,7 @@

 1. `+triage --from spam@x.com` → 列出 N 条结果
 2. 展示："将删除 N 封邮件（发件人 spam@x.com，主题：…），确认？"
-3. 用户确认后 → `+message-trash --message-ids ... --yes`
+3. 用户确认后 → `*.batch_trash`

 ## 身份选择：优先使用 user 身份

@@ -82,13 +82,12 @@
 1. **确认身份** — 首次操作邮箱前先调用 `lark-cli mail user_mailboxes profile --params '{"user_mailbox_id":"me"}'` 获取当前用户的真实邮箱地址（`primary_email_address`），不要通过系统用户名猜测。后续判断"发件人是否为用户本人"时以此地址为准。
 2. **浏览** — `+triage` 查看收件箱摘要，获取 `message_id` / `thread_id`
 3. **阅读** — `+message` 读单封邮件，`+thread` 读整个会话
-4. **整理** — 标签、已读/未读状态和移动文件夹优先用 `+message-modify`；软删除优先用 `+message-trash`
-5. **回复** — `+reply` / `+reply-all`（默认存草稿，加 `--confirm-send` 则立即发送）
-6. **转发** — `+forward`（默认存草稿，加 `--confirm-send` 则立即发送）
-7. **新邮件** — `+send` 存草稿（默认），加 `--confirm-send` 发送
-8. **确认投递** — 立即发送后用 `send_status` 查询投递状态，定时发送后在预定时间后再查询；取消定时发送用 `cancel_scheduled_send`
-9. **编辑草稿** — `+draft-edit` 修改已有草稿。正文编辑通过 `--patch-file`：回复/转发草稿用 `set_reply_body` op 保留引用区，普通草稿用 `set_body` op
-10. **已读回执** —
+4. **回复** — `+reply` / `+reply-all`（默认存草稿，加 `--confirm-send` 则立即发送）
+5. **转发** — `+forward`（默认存草稿，加 `--confirm-send` 则立即发送）
+6. **新邮件** — `+send` 存草稿（默认），加 `--confirm-send` 发送
+7. **确认投递** — 立即发送后用 `send_status` 查询投递状态，定时发送后在预定时间后再查询；取消定时发送用 `cancel_scheduled_send`
+8. **编辑草稿** — `+draft-edit` 修改已有草稿。正文编辑通过 `--patch-file`：回复/转发草稿用 `set_reply_body` op 保留引用区，普通草稿用 `set_body` op
+9. **已读回执** —
   - **请求回执（写信侧）**：`--request-receipt` 仅在**用户显式要求**时添加，**不要从 subject / body 内容推断意图**。
   - **响应回执（拉信侧）**：拉信看到 `label_ids` 含 `READ_RECEIPT_REQUEST`（或 `-607`）时，**必须先问用户**是否回执（不要自动回执，涉及隐私）。用户同意 → `+send-receipt` 响应；用户不同意但想消掉提示 → `+decline-receipt` 只清本地标签、不发邮件。

@@ -418,7 +417,7 @@ lark-cli mail +message --message-id <id>

 ## 原生 API 调用规则

-没有 Shortcut 覆盖的操作才使用原生 API。标签、已读状态、移动文件夹优先使用 `+message-modify`；软删除优先使用 `+message-trash`。调用步骤以本节为准（API Resources 章节的 resource/method 列表可辅助查阅）。
+没有 Shortcut 覆盖的操作才使用原生 API。调用步骤以本节为准（API Resources 章节的 resource/method 列表可辅助查阅）。

 ### Step 1 — 用 `-h` 确定要调用的 API（必须，不可跳过）

--- a/skills/lark-application/SKILL.md
+++ b/skills/lark-application/SKILL.md
@@ -0,0 +1,38 @@
+---
+name: lark-application
+version: 1.0.0
+description: "飞书开放平台应用自管理：目前仅实现管理当前绑定应用的斜杠指令（Slash Command 是一种允许用户在飞书聊天框中通过输入 / 快速触发机器人服务的交互方式）——列出、创建、更新、删除。当用户提到Slash Command、发消息斜杠指令面板、斜杠指令时使用。注意区分：这不是妙搭应用（lark-apps）；也不负责指令触发后的回调消费（lark-event）。"
+metadata:
+  requires:
+    bins: ["lark-cli"]
+  cliHelp: "lark-cli application --help"
+---
+
+# application
+
+## 身份权限和风险处理
+
+开始前先读 [`../lark-shared/SKILL.md`](../lark-shared/SKILL.md)（认证、权限处理、`--dry-run`、exit 10 高风险确认协议）。
+`--as bot` 或 `--as user`均支持。
+两个权限：`application:app_slash_command:read`（列出）/ `application:app_slash_command:write`（创建/更新/删除）
+
+## Shortcuts
+
+| Shortcut | 说明 |
+|----------|------|
+| [`+slash-command-list`](references/lark-application-slash-command-list.md) | 列出当前绑定应用的全部斜杠指令；是 update/delete 定位 `command_id` 的数据来源 |
+| [`+slash-command-create`](references/lark-application-slash-command-create.md) | 注册新斜杠指令；`--force` 可把撞名冲突转成幂等的 update |
+| [`+slash-command-update`](references/lark-application-slash-command-update.md) | 更新已有指令的描述 / 多语言描述 / 图标，按 `--command-id` 或 `--command` 定位 |
+| [`+slash-command-delete`](references/lark-application-slash-command-delete.md) | 删除斜杠指令（高危写操作，走 exit 10 确认协议） |
+
+## 关键语义
+
+- **`--command` 不带前导 `/`**：传 `/greet` 会被拒绝，正确写法是 `--command greet`（斜杠是隐含的，客户端展示时自动加上）。
+- **客户端缓存 ~5 分钟，服务端立即生效**：写操作成功后 `+slash-command-list` 立刻能看到最新状态，但 Feishu 客户端指令面板可能仍显示旧值，这是客户端缓存导致，不代表写入失败，不要因为客户端没刷新就重试写操作。
+- **改名 = 删除 + 创建，`command_id` 会变**：API 不支持直接修改 `command` 字段本身（`+slash-command-update` 只能改描述/图标）。要重命名指令，必须先 `+slash-command-delete` 旧指令，再 `+slash-command-create` 新名字，产生的是全新 `command_id`，不是原地重命名。
+
+## 不在本 skill 范围
+
+- 妙搭应用的创建、发布、可见范围管理 → [lark-apps](../lark-apps/SKILL.md)
+- 指令触发后的消息以普通 IM 消息送达（`im.message.receive_v1` 事件），消费走 lark-event（`lark-cli event consume`） → [lark-event](../lark-event/SKILL.md)
+- bot 菜单、应用版本管理、应用统计（未实现）
--- a/skills/lark-application/references/lark-application-slash-command-create.md
+++ b/skills/lark-application/references/lark-application-slash-command-create.md
@@ -0,0 +1,67 @@
+# application +slash-command-create
+
+在当前绑定应用上注册一个新的斜杠指令。
+
+## 命令格式
+
+```bash
+lark-cli application +slash-command-create --command <name> --description <text> [flags]
+```
+
+## 参数表
+
+| 参数 | 类型 | 必填 | 说明 |
+|---|---|---|---|
+| `--command` | string | 是 | 指令名，**不带前导 `/`**（服务端按应用维度校验唯一，最多 100 条指令） |
+| `--description` | string | 是 | 客户端指令面板默认展示的描述（写入 `description.default_value`） |
+| `--description-i18n` | string_array（可重复） | 否 | 多语言描述，格式 `<lang>=<text>`（如 `zh_cn=发送问候`），可重复多次传不同语言；语言码原样透传给服务端，不做校验 |
+| `--icon-key` | string | 否 | 图标 key；不传时服务端默认 `skill_outlined`；非法 key 会被服务端拒绝（code `40000031`） |
+| `--force` | bool | 否 | 撞名时不报错，改为解析出已存在指令的 `command_id` 并对其执行 PATCH（等价于幂等重跑，类似 `gh label create --force`） |
+
+> **CAUTION**：`--force` 撞名转 PATCH 时，`description`（含 `i18n` map）按整体替换处理，不是增量合并。若重跑命令时不带上完整的 `--description-i18n`，指令已有的多语言翻译会被静默清空。要做真正幂等的重跑，必须把之前设置过的所有语言连同新值一起重新传入 `--description-i18n`。
+
+## 返回值
+
+```json
+{
+  "ok": true,
+  "identity": "bot",
+  "data": {
+    "command_id": "7123456789012345678",
+    "command": "greet",
+    "description": { "default_value": "say hi", "i18n": { "zh_cn": "问候" } },
+    "icon": { "icon_key": "skill_outlined" },
+    "action": "created"
+  }
+}
+```
+
+`action` 为 `created` 或 `updated`（后者只在 `--force` 命中撞名分支时出现）。命令执行成功后 stderr 会打印一行客户端缓存提示，不是错误。
+
+## 典型用法
+
+```bash
+# 创建一个新指令，附带中文本地化描述
+lark-cli application +slash-command-create \
+  --command greet --description "say hi" --description-i18n zh_cn=问候 --as bot
+
+# 幂等重跑：如果 greet 已存在则直接更新它，而不是报错退出
+# 注意：若 greet 已有 --description-i18n（如 zh_cn=问候），这里不带上就会被清空
+lark-cli application +slash-command-create \
+  --command greet --description "say hi v2" --description-i18n zh_cn=问候 --force --as bot
+```
+
+## 错误与恢复
+
+| 场景 | 识别 | 处理 |
+|---|---|---|
+| 指令名已存在 | 错误 `code=40000000`，message 含 `command already exists` | 未加 `--force` 时直接报错并提示改用 `+slash-command-update` 或加 `--force` 重跑；已加 `--force` 时 CLI 会自动列出全部指令解析 `command_id` 后转为 PATCH，无需人工介入 |
+| `--icon-key` 非法 | 错误 `code=40000031`，原样透传服务端 message | 换成合法 icon key，或省略该参数使用默认值 |
+| bot 缺少 `application:app_slash_command:write`（`--force` 撞名分支还需 `:read`） | 错误信封携带 `console_url` | 把 `console_url` 给用户，引导去开发者后台开通对应 scope 并**发布新版本**；不要对 bot 执行 `auth login` |
+| user 缺少对应 scope | 错误提示缺失 scope | `lark-cli auth login --scope application:app_slash_command:write`（`--force` 场景还需 `:read`） |
+
+## 参考
+
+- [lark-application](../SKILL.md) — skill 入口与路由，含"改名=删除+创建"等关键语义
+- [+slash-command-list](lark-application-slash-command-list.md)
+- [+slash-command-update](lark-application-slash-command-update.md)
--- a/skills/lark-application/references/lark-application-slash-command-delete.md
+++ b/skills/lark-application/references/lark-application-slash-command-delete.md
@@ -0,0 +1,65 @@
+# application +slash-command-delete
+
+删除当前绑定应用上的一个斜杠指令。**`Risk: high-risk-write`，不可逆。**
+
+## 命令格式
+
+```bash
+lark-cli application +slash-command-delete (--command-id <id> | --command <name>) --yes
+```
+
+## 参数表
+
+| 参数 | 类型 | 必填 | 说明 |
+|---|---|---|---|
+| `--command-id` | string | 与 `--command` 二选一 | 目标指令的 `command_id` |
+| `--command` | string | 与 `--command-id` 二选一 | 按名字定位（不带前导 `/`），CLI 会先调用 list 解析出 `command_id`，需要 read scope |
+| `--yes` | bool | 高风险操作确认必需 | 见下方"高风险确认协议" |
+
+## 高风险确认协议（CRITICAL）
+
+本命令 `Risk: high-risk-write`。不带 `--yes` 调用会以 exit code `10` 失败，stderr 返回 `error.type == "confirmation_required"` 的结构化 envelope——完整协议见 [lark-shared 高风险操作的审批协议（exit 10）](../../lark-shared/SKILL.md)，本节只补充本命令的领域特有部分。
+
+**Agent 必须在追加 `--yes` 重试前，先把要删除的指令名 / `command_id` 明确展示给用户并取得同意**——不要因为 exit 10 是"标准协议"就默认自动重试。判断"是否已获得授权"时，用户必须在当前对话中明确点名了具体指令；仅泛泛说"清理一下指令"不构成授权。
+
+## 返回值
+
+```json
+{
+  "ok": true,
+  "identity": "bot",
+  "data": { "action": "deleted", "command_id": "7123456789012345678", "command": "greet" }
+}
+```
+
+`command` 字段只在通过 `--command` 定位时才会出现（`--command-id` 直接删除时无法反查名字，字段缺省）。
+
+## 典型用法
+
+```bash
+# 先不加 --yes 试探，看到 confirmation_required 后向用户确认
+lark-cli application +slash-command-delete --command greet
+
+# 用户明确同意后，原样追加 --yes 重试
+lark-cli application +slash-command-delete --command greet --yes --as bot
+```
+
+## 错误与恢复
+
+| 场景 | 识别 | 处理 |
+|---|---|---|
+| 未加 `--yes` | exit code `10`，`error.type == "confirmation_required"` | 展示待删除指令给用户确认，同意后在原始命令末尾追加 `--yes` 重试；不要静默重试 |
+| 按 `--command` 找不到指令 | 报错"未找到"，hint 指向 list | 先跑 `+slash-command-list` 确认名字 |
+| bot 缺少 `application:app_slash_command:write`（按名定位还需 `:read`） | 错误信封携带 `console_url` | 引导用户去开发者后台开通并发版；不要对 bot 执行 `auth login` |
+| user 缺少对应 scope | 提示缺失 scope | `lark-cli auth login --scope application:app_slash_command:write`（按名定位还需 `--scope application:app_slash_command:read`） |
+| 删除后客户端指令面板仍显示旧指令 | 正常现象，约 5 分钟客户端缓存 | 服务端已立即生效（`+slash-command-list` 会立刻反映删除），不要因客户端未刷新而重复删除 |
+
+## 恢复注意
+
+删除是不可逆操作，且**没有"撤销删除"**。如果需要恢复同名指令，只能重新 `+slash-command-create`，得到的是**全新的 `command_id`**（与原指令无关联）。
+
+## 参考
+
+- [lark-application](../SKILL.md) — skill 入口与路由
+- [+slash-command-list](lark-application-slash-command-list.md)
+- [+slash-command-create](lark-application-slash-command-create.md)
--- a/skills/lark-application/references/lark-application-slash-command-list.md
+++ b/skills/lark-application/references/lark-application-slash-command-list.md
@@ -0,0 +1,62 @@
+# application +slash-command-list
+
+列出当前绑定应用的全部斜杠指令。只读操作，也是 `+slash-command-update` / `+slash-command-delete` 按名字定位 `command_id` 的数据来源。
+
+## 命令格式
+
+```bash
+lark-cli application +slash-command-list --as bot
+```
+
+无参数、无分页——上游 API 一次性返回全部指令（每个应用最多 100 条）。
+
+## 参数表
+
+本命令不接受除全局 `--as` / `--format` 之外的业务参数。
+
+## 返回值
+
+```json
+{
+  "ok": true,
+  "identity": "bot",
+  "data": {
+    "items": [
+      {
+        "command_id": "7123456789012345678",
+        "command": "greet",
+        "description": { "default_value": "say hi", "i18n": { "zh_cn": "问候" } },
+        "icon": { "icon_key": "skill_outlined" }
+      }
+    ],
+    "count": 1
+  }
+}
+```
+
+`count` 是 `items` 的长度，供快速判断是否为空列表；不要用它替代实际遍历 `items`。
+
+## 典型用法
+
+```bash
+# 查看当前应用注册了哪些指令
+lark-cli application +slash-command-list --as bot
+
+# 按名字找出某条指令的 command_id，供 update/delete 使用
+lark-cli application +slash-command-list --as bot --format json | jq '.data.items[] | select(.command=="greet")'
+```
+
+## 错误与恢复
+
+| 场景 | 处理 |
+|---|---|
+| bot 缺少 `application:app_slash_command:read` scope | 错误信封携带 `console_url`；把它原样给用户，引导去开发者后台开通并**发布新版本**——scope 变更需要应用发版才能对线上 bot 生效，不要对 bot 执行 `auth login` |
+| user 缺少该 scope | 提示执行 `lark-cli auth login --scope application:app_slash_command:read` |
+| 返回空列表 | 正常状态（应用还没注册任何指令），不是错误 |
+
+## 参考
+
+- [lark-application](../SKILL.md) — skill 入口与路由
+- [+slash-command-create](lark-application-slash-command-create.md)
+- [+slash-command-update](lark-application-slash-command-update.md)
+- [+slash-command-delete](lark-application-slash-command-delete.md)
--- a/skills/lark-application/references/lark-application-slash-command-update.md
+++ b/skills/lark-application/references/lark-application-slash-command-update.md
@@ -0,0 +1,74 @@
+# application +slash-command-update
+
+更新一个已有斜杠指令的描述 / 多语言描述 / 图标。
+
+## 命令格式
+
+```bash
+lark-cli application +slash-command-update (--command-id <id> | --command <name>) [flags]
+```
+
+## 参数表
+
+| 参数 | 类型 | 必填 | 说明 |
+|---|---|---|---|
+| `--command-id` | string | 与 `--command` 二选一 | 目标指令的 `command_id`（来自 `+slash-command-list` 或 create 的输出） |
+| `--command` | string | 与 `--command-id` 二选一 | 按名字定位（不带前导 `/`），CLI 会先调用 list 解析出 `command_id`，需要 read scope |
+| `--description` | string | 否 | 新的默认描述（`description.default_value`） |
+| `--description-i18n` | string_array（可重复） | 否 | 多语言描述，格式 `<lang>=<text>`；**整体替换**已有 i18n map（未传入的语言会被服务端丢弃，不是增量合并）；**必须伴随 `--description` 一起传**，否则报错 |
+| `--icon-key` | string | 否 | 新图标 key；非法 key 服务端拒绝（code `40000031`） |
+
+`--description` / `--description-i18n` / `--icon-key` 三者至少提供一个，否则报错"没有可更新字段"。
+
+## 关键语义
+
+- **`--command-id` 与 `--command` 互斥，且必须提供其中之一**——两个都不传或都传都会报错。
+- **PATCH 是字段级局部更新**：未显式传入的字段（如只传了 `--icon-key`）在服务端保持原值不变。
+- **`--description-i18n` 是整体替换，不是增量合并**：如果指令原本有 `zh_cn` + `ja_jp` 两个语言的描述，本次只传 `--description-i18n en_us=hi`，结果是只剩 `en_us` 一个语言，`zh_cn`/`ja_jp` 会丢失。要保留原有语言，需要把它们连同新值一起重新传入。
+- **指令名本身不可改**（API 限制）：`+slash-command-update` 不支持修改 `command` 字段。要"重命名"，必须走 [+slash-command-delete](lark-application-slash-command-delete.md) + [+slash-command-create](lark-application-slash-command-create.md)（详见 [SKILL.md 关键语义](../SKILL.md#关键语义)），会产生一个全新的 `command_id`。
+
+## 返回值
+
+```json
+{
+  "ok": true,
+  "identity": "bot",
+  "data": {
+    "command_id": "7123456789012345678",
+    "command": "greet",
+    "description": { "default_value": "new text", "i18n": { "en_us": "hi" } },
+    "icon": { "icon_key": "skill_outlined" },
+    "action": "updated"
+  }
+}
+```
+
+## 典型用法
+
+```bash
+# 按名字更新描述（CLI 内部先 list 解析 command_id 再 PATCH）
+lark-cli application +slash-command-update --command greet --description "new text" --as bot
+
+# 只改图标，不动描述
+lark-cli application +slash-command-update --command-id 7123456789012345678 --icon-key chat_outlined --as bot
+
+# 同时替换默认描述和多语言描述（记得带上所有要保留的语言）
+lark-cli application +slash-command-update --command greet \
+  --description "say hi" --description-i18n zh_cn=你好 --description-i18n en_us=hi --as bot
+```
+
+## 错误与恢复
+
+| 场景 | 识别 | 处理 |
+|---|---|---|
+| `--description-i18n` 未伴随 `--description` | 校验期报错，提示两者必须同传 | 补上 `--description`（哪怕值和原来一样），因为 PATCH 会整体替换 description 对象，缺 `default_value` 会导致其被清空 |
+| 按 `--command` 找不到指令 | 报错"未找到"，hint 指向 list | 先跑 `+slash-command-list` 确认指令名拼写和是否存在 |
+| `--icon-key` 非法 | 错误 `code=40000031` | 换合法 icon key |
+| bot 缺少 `application:app_slash_command:write`（按名定位还需 `:read`） | 错误信封携带 `console_url` | 引导用户去开发者后台开通并发版；不要对 bot 执行 `auth login` |
+| user 缺少对应 scope | 提示缺失 scope | `lark-cli auth login --scope application:app_slash_command:write`（按名定位还需 `--scope application:app_slash_command:read`） |
+
+## 参考
+
+- [lark-application](../SKILL.md) — skill 入口与路由
+- [+slash-command-list](lark-application-slash-command-list.md)
+- [+slash-command-delete](lark-application-slash-command-delete.md)
--- a/skills/lark-apps/references/lark-apps-init.md
+++ b/skills/lark-apps/references/lark-apps-init.md
@@ -10,6 +10,7 @@

 - 必填：`--app-id`。
 - 可选：`--dir`，clone 目标目录；省略时默认 `./<app-id>`。
+- 可选：`--template`，空仓库脚手架模板；省略时当前回退 `nestjs-react-fullstack`。
 - 固定 checkout 分支：`sprint/default`。
 - `+init` 会初始化 Git 凭证、clone 仓库、切到工作分支并生成/同步本地项目。

@@ -17,7 +18,7 @@

 ```bash
 lark-cli apps +init --app-id app_xxx --dir ./my-app
-lark-cli apps +init --app-id app_xxx --dir /absolute/path/my-app
+lark-cli apps +init --app-id app_xxx --dir /absolute/path/my-app --template nestjs-react-fullstack
 lark-cli apps +init --app-id app_xxx --dir ./my-app --dry-run
 ```

--- a/skills/lark-apps/references/lark-apps-release-create.md
+++ b/skills/lark-apps/references/lark-apps-release-create.md
@@ -21,10 +21,8 @@ lark-cli apps +release-create --app-id app_xxx --branch sprint/default --dry-run

 ## 输出契约

- 成功读取 `data.release_id`、`data.status` 和 `data.sync`；`release_id` 是后续 `+release-get` 的入参。
- `sync=true` 表示同步部署（服务端等待部署完成后才返回），`sync=false` 或缺失表示异步部署。
+- 成功读取 `data.release_id` 和 `data.status`；`release_id` 是后续 `+release-get` 的入参。
 - `status=publishing` 表示发布仍在进行；继续用 `+release-get` 轮询，轮询间隔应该为 20s。应用发布平均耗时大约 2min，整体超时时间大约 5min。
- `status=finished` 表示部署已完成（同步部署时可能直接返回此状态）。
 - `+release-create` 返回 release 只代表发布已发起。只有 `+release-get` 对同一个 `release_id` 返回 `finished` 后，才能说本轮最新版本已部署。

 ## Agent 规则
--- a/skills/lark-mail/SKILL.md
+++ b/skills/lark-mail/SKILL.md
@@ -79,7 +79,7 @@ metadata:

 1. `+triage --from spam@x.com` → 列出 N 条结果
 2. 展示："将删除 N 封邮件（发件人 spam@x.com，主题：…），确认？"
-3. 用户确认后 → `+message-trash --message-ids ... --yes`
+3. 用户确认后 → `*.batch_trash`

 ## 身份选择：优先使用 user 身份

@@ -96,14 +96,13 @@ metadata:
 1. **确认身份** — 首次操作邮箱前先调用 `lark-cli mail user_mailboxes profile --params '{"user_mailbox_id":"me"}'` 获取当前用户的真实邮箱地址（`primary_email_address`），不要通过系统用户名猜测。后续判断"发件人是否为用户本人"时以此地址为准。
 2. **浏览** — `+triage` 查看收件箱摘要，获取 `message_id` / `thread_id`
 3. **阅读** — `+message` 只读单封邮件；已有多个 `message_id` 时用 `+messages` 批量读取，不要循环调用 `+message`；`+thread` 读整个会话
-4. **整理** — 标签、已读/未读状态和移动文件夹优先用 `+message-modify`；软删除优先用 `+message-trash`
-5. **回复** — `+reply` / `+reply-all`（默认存草稿，加 `--confirm-send` 则立即发送）
-6. **转发** — `+forward`（默认存草稿，加 `--confirm-send` 则立即发送）
-7. **新邮件** — `+send` 存草稿（默认），加 `--confirm-send` 发送
-8. **HTML body 预检（可选）** — 复杂 HTML body 提交前可先跑 `+lint-html` 看 lint 会改 / 删什么；写信路径（`+send` / `+draft-create` / `+reply` / `+reply-all` / `+forward` / `+draft-edit` body op）已内置 autofix，普通正文不必先跑。详见 [references/lark-mail-html.md](references/lark-mail-html.md) 中的「写入路径内置 HTML lint」章节
-9. **确认投递** — 立即发送后用 `send_status` 查询投递状态，定时发送后在预定时间后再查询；取消定时发送用 `cancel_scheduled_send`
-10. **编辑草稿** — `+draft-edit` 修改已有草稿。正文编辑通过 `--patch-file`：回复/转发草稿用 `set_reply_body` op 保留引用区，普通草稿用 `set_body` op
-11. **已读回执** —
+4. **回复** — `+reply` / `+reply-all`（默认存草稿，加 `--confirm-send` 则立即发送）
+5. **转发** — `+forward`（默认存草稿，加 `--confirm-send` 则立即发送）
+6. **新邮件** — `+send` 存草稿（默认），加 `--confirm-send` 发送
+7. **HTML body 预检（可选）** — 复杂 HTML body 提交前可先跑 `+lint-html` 看 lint 会改 / 删什么；写信路径（`+send` / `+draft-create` / `+reply` / `+reply-all` / `+forward` / `+draft-edit` body op）已内置 autofix，普通正文不必先跑。详见 [references/lark-mail-html.md](references/lark-mail-html.md) 中的「写入路径内置 HTML lint」章节
+8. **确认投递** — 立即发送后用 `send_status` 查询投递状态，定时发送后在预定时间后再查询；取消定时发送用 `cancel_scheduled_send`
+9. **编辑草稿** — `+draft-edit` 修改已有草稿。正文编辑通过 `--patch-file`：回复/转发草稿用 `set_reply_body` op 保留引用区，普通草稿用 `set_body` op
+10. **已读回执** —
   - **请求回执（写信侧）**：`--request-receipt` 仅在**用户显式要求**时添加，**不要从 subject / body 内容推断意图**。
   - **响应回执（拉信侧）**：拉信看到 `label_ids` 含 `READ_RECEIPT_REQUEST`（或 `-607`）时，**必须先问用户**是否回执（不要自动回执，涉及隐私）。用户同意 → `+send-receipt` 响应；用户不同意但想消掉提示 → `+decline-receipt` 只清本地标签、不发邮件。

@@ -120,8 +119,6 @@ metadata:
 - 查看发送邮件后的投递状态：发送成功后查看邮件投递状态；也覆盖发送拦截。ref: [lark-mail-send-status](references/lark-mail-send-status.md)
 - 使用邮件模板：区分个人模板和静态 HTML 模板，发信类 shortcut 用 `--template-id` 套用模板。ref: [lark-mail-template](references/lark-mail-template.md)
 - 撤回已发送邮件：撤回邮件并查询异步撤回状态。ref: [lark-mail-recall](references/lark-mail-recall.md)
- 修改邮件标签/已读状态/文件夹：优先使用 `+message-modify`。ref: [`+message-modify`](references/lark-mail-message-modify.md)
- 软删除邮件：优先使用 `+message-trash`。ref: [`+message-trash`](references/lark-mail-message-trash.md)
 - 收信规则：创建、验证、删除自动处理收到邮件的规则。ref: [lark-mail-rules](references/lark-mail-rules.md)
 - 分享邮件到 IM：分享邮件或会话到群聊、个人会话。ref: [lark-mail-share-to-chat](references/lark-mail-share-to-chat.md)
 - 发送日程邀请邮件：在邮件中嵌入 `text/calendar` 日程邀请。ref: [lark-mail-calendar-invite](references/lark-mail-calendar-invite.md)
@@ -195,7 +192,7 @@ lark-cli mail +messages --message-ids <id1>,<id2>,<id3> --html=false

 ## 原生 API 调用规则

-没有 Shortcut 覆盖的操作才使用原生 API。标签、已读状态、移动文件夹优先使用 `+message-modify`；软删除优先使用 `+message-trash`。调用步骤以本节为准；资源和 method 用 `lark-cli mail -h` / `lark-cli mail <resource> -h` 发现，不在入口保留完整资源表。
+没有 Shortcut 覆盖的操作才使用原生 API。调用步骤以本节为准；资源和 method 用 `lark-cli mail -h` / `lark-cli mail <resource> -h` 发现，不在入口保留完整资源表。

 ### Step 1 — 用 `-h` 确定要调用的 API（必须，不可跳过）

--- a/skills/lark-mail/references/lark-mail-forward.md
+++ b/skills/lark-mail/references/lark-mail-forward.md
@@ -215,7 +215,7 @@ lark-cli mail user_mailbox.drafts cancel_scheduled_send --params '{"user_mailbox
 **2. 标记已读**（可选）— 询问用户是否需要将原邮件标记为已读。如果用户同意：

 ```bash
-lark-cli mail +message-modify --message-ids <原邮件ID> --remove-label-ids UNREAD
+lark-cli mail user_mailbox.messages batch_modify --params '{"user_mailbox_id":"me"}' --data '{"message_ids":["<原邮件ID>"],"remove_label_ids":["UNREAD"]}'
 ```

 ## 编辑转发草稿
--- a/skills/lark-mail/references/lark-mail-message-modify.md
+++ b/skills/lark-mail/references/lark-mail-message-modify.md
@@ -1,48 +0,0 @@
-# mail +message-modify
-
-`mail +message-modify` is the preferred shortcut for changing labels, read-state labels, or folder placement on existing messages.
-
-Use it instead of raw `user_mailbox.messages batch_modify` when the operation targets concrete `message_id` values from `+triage`, `+message`, or `+messages`.
-
-## Common Commands
-
-```bash
-lark-cli mail +message-modify --message-ids <id1>,<id2> --add-label-ids unread
-lark-cli mail +message-modify --message-ids <id> --remove-label-ids FLAGGED
-lark-cli mail +message-modify --message-ids <id> --add-folder archive
-lark-cli mail +message-modify --mailbox shared@example.com --message-ids <id> --add-folder folder_xxx
-lark-cli mail +message-modify --message-ids <id> --add-label-ids custom_label_id --dry-run
-```
-
-## Flags
-
-| Flag | Required | Notes |
-| --- | --- | --- |
-| `--mailbox` | No | Mailbox that owns the messages. Defaults to `me`. |
-| `--message-ids` | Yes | `string_array`; supports comma-separated values and repeated flags. |
-| `--add-label-ids` | No | Adds labels. System labels `unread`, `important`, `other`, `flagged` normalize to upper case. |
-| `--remove-label-ids` | No | Removes labels. Cannot overlap with `--add-label-ids`. |
-| `--add-folder` | No | Moves to one folder. `inbox`, `sent`, `spam`, `archive`, `archived` normalize to system folder IDs. |
-
-`TRASH` is intentionally rejected by this shortcut. Use `mail +message-trash --message-ids <id> --yes` for soft deletion.
-
-## Behavior
-
- Message IDs are locally validated, de-duplicated in first-seen order, and sent in batches of 20.
- Custom label IDs are checked with `labels.get`; custom folder IDs are checked with `folders.get`.
- If no label or folder operation is requested, the command succeeds locally, emits all message IDs as `success_message_ids`, and makes no POST request.
- Single batch POST failures mark every message in that batch with the same failure reason; later batches still run.
- JSON output is intentionally compact:
-
-```json
-{
-  "success_message_ids": ["id1"],
-  "failed_message_ids": [
-    {"message_id": "id2", "reason": "api error"}
-  ]
-}
-```
-
-## When Raw API Is Still Appropriate
-
-Use raw `mail user_mailbox.messages batch_modify` only when you need a request shape that the shortcut intentionally does not expose, or when reproducing backend/API behavior exactly for diagnostics.
--- a/skills/lark-mail/references/lark-mail-message-trash.md
+++ b/skills/lark-mail/references/lark-mail-message-trash.md
@@ -1,41 +0,0 @@
-# mail +message-trash
-
-`mail +message-trash` is the preferred shortcut for soft-deleting existing messages.
-
-Use it after obtaining real `message_id` values from `+triage`, `+message`, or `+messages`, and after the user has confirmed the deletion preview.
-
-## Common Commands
-
-```bash
-lark-cli mail +message-trash --message-ids <id1>,<id2> --yes
-lark-cli mail +message-trash --mailbox shared@example.com --message-ids <id> --yes
-lark-cli mail +message-trash --message-ids <id1> --message-ids <id2> --dry-run
-```
-
-## Flags
-
-| Flag | Required | Notes |
-| --- | --- | --- |
-| `--mailbox` | No | Mailbox that owns the messages. Defaults to `me`. |
-| `--message-ids` | Yes | `string_array`; supports comma-separated values and repeated flags. |
-| `--yes` | Yes for execution | Required by the high-risk write confirmation framework. |
-
-## Behavior
-
- Message IDs are locally validated, de-duplicated in first-seen order, and sent in batches of 20.
- The shortcut calls `POST /open-apis/mail/v1/user_mailboxes/<mailbox>/messages/batch_trash` sequentially.
- Single batch POST failures mark every message in that batch with the same failure reason; later batches still run.
- JSON output is intentionally compact:
-
-```json
-{
-  "success_message_ids": ["id1"],
-  "failed_message_ids": [
-    {"message_id": "id2", "reason": "api error"}
-  ]
-}
-```
-
-## When Raw API Is Still Appropriate
-
-Use raw `mail user_mailbox.messages batch_trash` only when reproducing backend/API behavior exactly for diagnostics. For normal soft deletion, prefer this shortcut because it handles validation, batching, compact output, and `--yes` confirmation consistently.
--- a/skills/lark-mail/references/lark-mail-reply-all.md
+++ b/skills/lark-mail/references/lark-mail-reply-all.md
@@ -203,7 +203,7 @@ lark-cli mail user_mailbox.drafts cancel_scheduled_send --params '{"user_mailbox
 **2. 标记已读**（可选）— 询问用户是否需要将原邮件标记为已读。如果用户同意：

 ```bash
-lark-cli mail +message-modify --message-ids <原邮件ID> --remove-label-ids UNREAD
+lark-cli mail user_mailbox.messages batch_modify --params '{"user_mailbox_id":"me"}' --data '{"message_ids":["<原邮件ID>"],"remove_label_ids":["UNREAD"]}'
 ```

 ## 相关命令
--- a/skills/lark-mail/references/lark-mail-reply.md
+++ b/skills/lark-mail/references/lark-mail-reply.md
@@ -218,7 +218,7 @@ lark-cli mail user_mailbox.drafts cancel_scheduled_send --params '{"user_mailbox
 **2. 标记已读**（可选）— 询问用户是否需要将原邮件标记为已读。如果用户同意：

 ```bash
-lark-cli mail +message-modify --message-ids <原邮件ID> --remove-label-ids UNREAD
+lark-cli mail user_mailbox.messages batch_modify --params '{"user_mailbox_id":"me"}' --data '{"message_ids":["<原邮件ID>"],"remove_label_ids":["UNREAD"]}'
 ```

 ## 编辑回复草稿
--- a/tests/cli_e2e/application/slash_command_dryrun_test.go
+++ b/tests/cli_e2e/application/slash_command_dryrun_test.go
@@ -0,0 +1,166 @@
+// Copyright (c) 2026 Lark Technologies Pte. Ltd.
+// SPDX-License-Identifier: MIT
+
+package application
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	clie2e "github.com/larksuite/cli/tests/cli_e2e"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"github.com/tidwall/gjson"
+)
+
+// setSlashCommandDryRunEnv isolates config and supplies stub credentials so
+// dry-run / the pre-Execute confirmation gate short-circuit before identity
+// resolution touches a real keychain. Mirrors tests/cli_e2e/apps/helpers_test.go
+// and tests/cli_e2e/calendar/calendar_update_dryrun_test.go.
+func setSlashCommandDryRunEnv(t *testing.T) {
+	t.Helper()
+	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
+	t.Setenv("LARKSUITE_CLI_APP_ID", "application_dryrun_test")
+	t.Setenv("LARKSUITE_CLI_APP_SECRET", "application_dryrun_secret")
+	t.Setenv("LARKSUITE_CLI_BRAND", "feishu")
+}
+
+const slashCommandBasePath = "/open-apis/application/v7/app_slash_commands"
+
+// TestSlashCommandList_DryRunShowsGetPath pins the read-only GET shape for
+// `application +slash-command-list --dry-run`.
+func TestSlashCommandList_DryRunShowsGetPath(t *testing.T) {
+	setSlashCommandDryRunEnv(t)
+
+	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+	t.Cleanup(cancel)
+
+	result, err := clie2e.RunCmd(ctx, clie2e.Request{
+		Args: []string{
+			"application", "+slash-command-list",
+			"--dry-run",
+		},
+		DefaultAs: "bot",
+	})
+	require.NoError(t, err)
+	result.AssertExitCode(t, 0)
+
+	out := result.Stdout
+	assert.Equal(t, "GET", gjson.Get(out, "api.0.method").String(), "stdout:\n%s", out)
+	assert.Equal(t, slashCommandBasePath, gjson.Get(out, "api.0.url").String(), "stdout:\n%s", out)
+}
+
+// TestSlashCommandCreate_DryRunShowsPostBody pins the POST body shape for
+// `application +slash-command-create --dry-run`: icon sits at the TOP LEVEL,
+// a sibling of description (not nested inside description) - the official
+// create sample nesting icon inside description is a documented doc bug -
+// and description.i18n carries the localized map.
+func TestSlashCommandCreate_DryRunShowsPostBody(t *testing.T) {
+	setSlashCommandDryRunEnv(t)
+
+	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+	t.Cleanup(cancel)
+
+	result, err := clie2e.RunCmd(ctx, clie2e.Request{
+		Args: []string{
+			"application", "+slash-command-create",
+			"--command", "greet",
+			"--description", "say hi",
+			"--description-i18n", "zh_cn=你好",
+			"--icon-key", "skill_outlined",
+			"--dry-run",
+		},
+		DefaultAs: "bot",
+	})
+	require.NoError(t, err)
+	result.AssertExitCode(t, 0)
+
+	out := result.Stdout
+	assert.Equal(t, "POST", gjson.Get(out, "api.0.method").String(), "stdout:\n%s", out)
+	assert.Equal(t, slashCommandBasePath, gjson.Get(out, "api.0.url").String(), "stdout:\n%s", out)
+	assert.Equal(t, "greet", gjson.Get(out, "api.0.body.command").String(), "stdout:\n%s", out)
+	assert.Equal(t, "say hi", gjson.Get(out, "api.0.body.description.default_value").String(), "stdout:\n%s", out)
+	assert.Equal(t, "你好", gjson.Get(out, "api.0.body.description.i18n.zh_cn").String(), "stdout:\n%s", out)
+	// icon is a top-level key, sibling of description.
+	assert.Equal(t, "skill_outlined", gjson.Get(out, "api.0.body.icon.icon_key").String(), "stdout:\n%s", out)
+	assert.False(t, gjson.Get(out, "api.0.body.description.icon").Exists(), "icon must not be nested inside description:\n%s", out)
+}
+
+// TestSlashCommandUpdate_DryRunShowsPatchPath pins the PATCH shape for
+// `application +slash-command-update --command-id --dry-run`.
+func TestSlashCommandUpdate_DryRunShowsPatchPath(t *testing.T) {
+	setSlashCommandDryRunEnv(t)
+
+	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+	t.Cleanup(cancel)
+
+	result, err := clie2e.RunCmd(ctx, clie2e.Request{
+		Args: []string{
+			"application", "+slash-command-update",
+			"--command-id", "id_dry",
+			"--description", "updated description",
+			"--dry-run",
+		},
+		DefaultAs: "bot",
+	})
+	require.NoError(t, err)
+	result.AssertExitCode(t, 0)
+
+	out := result.Stdout
+	assert.Equal(t, "PATCH", gjson.Get(out, "api.0.method").String(), "stdout:\n%s", out)
+	assert.Equal(t, slashCommandBasePath+"/id_dry", gjson.Get(out, "api.0.url").String(), "stdout:\n%s", out)
+	assert.Equal(t, "updated description", gjson.Get(out, "api.0.body.description.default_value").String(), "stdout:\n%s", out)
+}
+
+// TestSlashCommandDelete_DryRunShowsDeletePath pins the DELETE shape for
+// `application +slash-command-delete --command-id --yes --dry-run`. Dry-run
+// short-circuits before the high-risk-write confirmation gate (see
+// shortcuts/common/runner.go), but --yes is passed anyway to match the
+// eventual real invocation the agent would run.
+func TestSlashCommandDelete_DryRunShowsDeletePath(t *testing.T) {
+	setSlashCommandDryRunEnv(t)
+
+	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+	t.Cleanup(cancel)
+
+	result, err := clie2e.RunCmd(ctx, clie2e.Request{
+		Args: []string{
+			"application", "+slash-command-delete",
+			"--command-id", "id_dry",
+			"--dry-run",
+		},
+		Yes:       true,
+		DefaultAs: "bot",
+	})
+	require.NoError(t, err)
+	result.AssertExitCode(t, 0)
+
+	out := result.Stdout
+	assert.Equal(t, "DELETE", gjson.Get(out, "api.0.method").String(), "stdout:\n%s", out)
+	assert.Equal(t, slashCommandBasePath+"/id_dry", gjson.Get(out, "api.0.url").String(), "stdout:\n%s", out)
+}
+
+// TestSlashCommandDelete_WithoutYesRequiresConfirmation asserts the
+// high-risk-write gate fires BEFORE any HTTP call: no --dry-run, no --yes ->
+// exit 10 (ExitConfirmationRequired) with a confirmation_required envelope on
+// stderr (see internal/output/exitcode.go and cmd/root.go handleRootError).
+func TestSlashCommandDelete_WithoutYesRequiresConfirmation(t *testing.T) {
+	setSlashCommandDryRunEnv(t)
+
+	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+	t.Cleanup(cancel)
+
+	result, err := clie2e.RunCmd(ctx, clie2e.Request{
+		Args: []string{
+			"application", "+slash-command-delete",
+			"--command-id", "id_dry",
+		},
+		DefaultAs: "bot",
+	})
+	require.NoError(t, err)
+	result.AssertExitCode(t, 10)
+
+	assert.Equal(t, "confirmation", gjson.Get(result.Stderr, "error.type").String(), "stderr:\n%s", result.Stderr)
+	assert.Equal(t, "confirmation_required", gjson.Get(result.Stderr, "error.subtype").String(), "stderr:\n%s", result.Stderr)
+}
--- a/tests/cli_e2e/mail/coverage.md
+++ b/tests/cli_e2e/mail/coverage.md
@@ -1,9 +1,9 @@
 # Mail CLI E2E Coverage

 ## Metrics
- Denominator: 65 leaf commands
- Covered: 16
- Coverage: 24.6%
+- Denominator: 63 leaf commands
+- Covered: 14
+- Coverage: 22.2%

 ## Summary
 - TestMail_DraftLifecycleWorkflowAsUser: proves a self-contained user draft workflow across `mail user_mailboxes profile`, `mail +draft-create`, `mail user_mailbox.drafts list`, `mail user_mailbox.drafts get`, `mail +draft-edit`, and `mail user_mailbox.drafts delete`; key `t.Run(...)` proof points are `get mailbox profile as user`, `create draft with shortcut as user`, `list draft as user`, `get created draft as user`, `inspect created draft as user`, `update draft subject with shortcut as user`, `inspect updated draft as user`, `delete draft as user`, and `verify draft removed from list as user`.
@@ -20,8 +20,6 @@
 | ✓ | mail +draft-send | shortcut | mail_draft_send_workflow_test.go::TestMail_DraftSendWorkflowAsUser/send draft with shortcut as user; mail_draft_send_dryrun_test.go::TestMail_DraftSendDryRun | `--draft-id`; `--mailbox me`; `--yes`; dry-run repeated/comma-separated `--draft-id` | sends a self-addressed draft through the batch shortcut and locks dry-run request shape |
 | ✓ | mail +forward | shortcut | mail_send_workflow_test.go::TestMail_SendWorkflowAsUser/forward received message with shortcut as user; mail_send_workflow_test.go::TestMail_SendWorkflowAsUser/inspect forward draft as user | `--message-id`; `--to`; `--body`; `--plain-text` | uses self-generated inbox message as source and inspects forwarded draft projection |
 | ✓ | mail +message | shortcut | mail_send_workflow_test.go::TestMail_SendWorkflowAsUser/get sent message as user; mail_send_workflow_test.go::TestMail_SendWorkflowAsUser/get received message as user | `--mailbox me`; `--message-id` | verifies both SENT and INBOX copies after self-send |
-| ✓ | mail +message-modify | shortcut | shortcuts/mail/mail_message_manage_test.go::TestMessageModify_DryRunShowsPlanWithoutValidationGET; shortcuts/mail/mail_message_manage_test.go::TestMessageModify_BatchesAndAggregatesPartialFailure | `--message-ids`; `--add-label-ids`; `--remove-label-ids`; `--add-folder`; `--dry-run` | unit/dry-run coverage locks validation, batching, request shape, and partial failure aggregation; live E2E needs controlled disposable messages/labels/folders |
-| ✓ | mail +message-trash | shortcut | shortcuts/mail/mail_message_manage_test.go::TestMessageTrash_RequiresYesAndBatches | `--message-ids`; `--yes`; `--dry-run` | unit coverage locks high-risk confirmation and batch_trash request shape; live E2E needs controlled disposable messages |
 | ✓ | mail +messages | shortcut | mail_send_workflow_test.go::TestMail_SendWorkflowAsUser/get both self sent messages as user | `--mailbox me`; `--message-ids` | batch reads both sent and received message copies |
 | ✓ | mail +reply | shortcut | mail_send_workflow_test.go::TestMail_SendWorkflowAsUser/reply to received message with shortcut as user; mail_send_workflow_test.go::TestMail_SendWorkflowAsUser/inspect reply draft as user | `--message-id`; `--body`; `--plain-text` | creates reply draft from self-generated inbox message and inspects quoted content |
 | ✕ | mail +reply-all | shortcut |  | none | self-send traffic leaves no stable non-self recipient set for deterministic reply-all assertions |
Author	SHA1	Message	Date
leave330	78acceb910	fix: preserve cause chain when rewrapping name-collision error	2026-07-08 17:53:18 +08:00
leave330	cb8d09d802	test: use conventional placeholder credentials in app test config	2026-07-08 17:27:22 +08:00
leave330	42dc50f5fb	test: build delete stub URL from shared base path constant	2026-07-08 17:16:02 +08:00
leave330	59ccffb09a	docs: refine lark-application skill guide	2026-07-08 17:10:01 +08:00
leave330	d4f62490d0	fix: limit recommended tier to slash-command read scope	2026-07-08 16:10:18 +08:00
leave330	d8327726b0	feat: expose application domain in interactive auth login	2026-07-08 16:00:16 +08:00
leave330	3a297df5b0	docs: note interactive login picker does not yet list application domain	2026-07-08 15:38:05 +08:00
leave330	dce04f792a	fix: declare shared scopes on application shortcuts for user preflight	2026-07-08 15:09:52 +08:00
leave330	fd00d43406	fix: preserve high-risk note in delete dry-run and document force i18n caveat	2026-07-08 13:28:36 +08:00
leave330	f2f49a68f4	test: add application slash command dry-run E2E coverage Pin the dry-run request shapes for +slash-command-list/create/update/delete (GET/POST/PATCH/DELETE paths, top-level icon key sibling to description, description.i18n) and confirm the high-risk-write delete path exits 10 with a confirmation_required envelope on stderr when --yes is omitted.	2026-07-08 12:38:59 +08:00
leave330	42c4b7d155	fix: classify slash command not-found as API error and preserve conflict code - commandNotFoundError now returns errs.NewAPIError(SubtypeNotFound, ...) instead of a validation error: a resolution miss against the live list means the resource doesn't exist, not that the caller's argument shape was invalid. - The no-force name-collision rewrap in +slash-command-create now carries over the original Code/LogID from the upstream conflict response instead of dropping them. - +slash-command-delete now prints an extra stderr note that recreating the same command name yields a NEW command_id. - Add a test guarding that --force only converts a name-collision response into an update; any other POST failure (e.g. invalid icon_key) must surface unchanged with no PATCH attempted.	2026-07-08 12:38:53 +08:00
leave330	96c8e638a1	docs: fix slash command trigger event reference in lark-application skill	2026-07-08 12:20:01 +08:00
leave330	ba8368504d	docs: add lark-application skill for slash command management	2026-07-08 11:56:15 +08:00
leave330	c3adfc1789	feat: add slash-command-delete shortcut with high-risk confirmation	2026-07-08 11:49:00 +08:00
leave330	a290aa628f	feat: add slash-command-update shortcut with by-name addressing	2026-07-08 11:43:36 +08:00
leave330	edeccaa419	feat: add slash-command-create shortcut with --force idempotent re-run	2026-07-08 11:38:39 +08:00
leave330	84962a1927	feat: add slash command name-to-id resolution helper	2026-07-08 11:29:38 +08:00
leave330	a72a562c7d	feat: add application domain with slash-command-list shortcut	2026-07-08 11:25:20 +08:00
leave330	deb866f981	feat: add application domain description and slash command helpers	2026-07-08 11:17:15 +08:00