chore: add PPE headers and pin miaoda-cli alpha for testing

2026-08-03 08:32:46 +08:00 · 2026-07-13 17:00:39 +08:00
951 changed files with 7414 additions and 87285 deletions
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -1,7 +1,4 @@
-/go.mod @liangshuo-1
-/go.sum @liangshuo-1
 /internal/ @liangshuo-1
-/shortcuts/common/ @liangshuo-1

 # Last match wins: existing domains below are exempt, only new skills/ entries need review.
 /skills/ @liangshuo-1
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,5 +1,4 @@
 name: CI
-run-name: ${{ github.event_name == 'pull_request' && format('CI / {0}', github.event.pull_request.number) || '' }}

 on:
  push:
@@ -9,12 +8,6 @@ on:
    types: [opened, synchronize, reopened, edited]
  workflow_dispatch:

-# PR metadata edits can retrigger full CI for the same head. Keep only the
-# newest run for a pull request; push and manual runs use a unique run ID.
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-
 permissions:
  contents: read
  actions: read
@@ -54,84 +47,6 @@ jobs:
            exit 1
          fi

-  plugin-integration:
-    needs: fast-gate
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
-        with:
-          persist-credentials: false
-      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
-        with:
-          go-version-file: go.mod
-      # No fetch_meta: the git-archive clean tree must embed only the
-      # committed meta_data stub (reproduces the bare-module customer state).
-      - name: Run plugin-integration L4 tests
-        run: go test -count=1 -timeout=15m ./tests/plugin_e2e/...
-
-  sidecar-integration:
-    needs: fast-gate
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
-        with:
-          persist-credentials: false
-      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
-        with:
-          go-version-file: go.mod
-      - name: Run sidecar tag build + HMAC round-trip
-        run: make sidecar-test
-
-  extended-integration:
-    needs: fast-gate
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
-        with:
-          persist-credentials: false
-      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
-        with:
-          go-version-file: go.mod
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
-        with:
-          python-version: '3.x'
-      - name: Fetch meta data
-        run: python3 scripts/fetch_meta.py
-      - name: Build both editions and verify identity
-        run: |
-          set -euo pipefail
-          go build -o /tmp/lark-cli-standard .
-          go build -tags extended -o /tmp/lark-cli-extended .
-          test "$(/tmp/lark-cli-standard version --json | jq -r .edition)" = "standard"
-          test "$(/tmp/lark-cli-extended version --json | jq -r .edition)" = "extended"
-          test "$(/tmp/lark-cli-extended version --json | jq -r '.capabilities[]')" = "external-credential-platform"
-      - name: Cross-compile Extended platform-specific security code
-        run: |
-          set -euo pipefail
-          GOOS=darwin GOARCH=arm64 go build -tags extended -o /tmp/lark-cli-extended-darwin .
-          GOOS=windows GOARCH=amd64 go build -tags extended -o /tmp/lark-cli-extended-windows.exe .
-      - name: Verify edition source isolation
-        run: go test -count=1 ./internal/externalcredential -run '^TestEditionSourceIsolation$'
-      - name: Run Extended tests
-        run: make extended-test
-
-  extended-platform-security:
-    needs: fast-gate
-    strategy:
-      fail-fast: false
-      matrix:
-        os: [macos-latest, windows-latest]
-    runs-on: ${{ matrix.os }}
-    steps:
-      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
-        with:
-          persist-credentials: false
-      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
-        with:
-          go-version-file: go.mod
-      - name: Run native helper isolation and path trust tests
-        run: go test -tags extended -count=1 ./internal/externalcredential -run '^(TestNativeAdminControlledPath|TestCredentialProcessEnvironmentUsesExplicitAllowlist|TestCredentialProcessCommandRunsWithIsolatedEnvironment)$'
-
  # ── Layer 2: Quality Gate ──────────────────────────────────────────
  unit-test:
    needs: fast-gate
@@ -192,28 +107,6 @@ jobs:
          node-version: '22'
      - name: Run script tests
        run: make script-test
-      - name: Install GoReleaser
-        uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6
-        with:
-          version: '~> v2'
-          install-only: true
-      - name: Validate GoReleaser configuration
-        run: goreleaser check
-      - name: Check Extended installer syntax
-        shell: pwsh
-        run: |
-          sh -n scripts/install-extended.sh
-          $tokens = $null
-          $errors = $null
-          [System.Management.Automation.Language.Parser]::ParseFile(
-            (Resolve-Path scripts/install-extended.ps1),
-            [ref]$tokens,
-            [ref]$errors
-          ) | Out-Null
-          if ($errors.Count -ne 0) {
-            $errors | ForEach-Object { Write-Error $_ }
-            exit 1
-          }

  deterministic-gate:
    needs: fast-gate
@@ -283,25 +176,17 @@ jobs:
        run: python3 scripts/fetch_meta.py
      - name: Run tests with coverage
        run: |
-          # tests/ holds only L3/L4 suites (cli_e2e, plugin_e2e, sidecar_e2e) that
-          # have dedicated jobs; exclude the whole subtree so none of them runs a
-          # second time here — and, crucially, so an observe-only suite's failure
-          # can never block merges through coverage's spot in the results loop.
-          packages=$(go list ./... | grep -v '^github.com/larksuite/cli/tests/')
-          go test -race -coverprofile=coverage-standard.txt -covermode=atomic $packages
-          # Extended implementation files are selected by build tags and would
-          # otherwise be absent from the uploaded report. Their race-enabled
-          # suite runs in extended-integration; this pass contributes coverage.
-          go test -tags extended -coverprofile=coverage-extended.txt -covermode=atomic $packages
+          packages=$(go list ./... | grep -v '^github.com/larksuite/cli/tests/cli_e2e$' | grep -v '^github.com/larksuite/cli/tests/cli_e2e/')
+          go test -race -coverprofile=coverage.txt -covermode=atomic $packages
      - name: Upload coverage to Codecov
        if: ${{ github.event_name != 'pull_request' || !github.event.pull_request.head.repo.fork }}
        uses: codecov/codecov-action@3f20e214133d0983f9a10f3d63b0faf9241a3daa # v6
        with:
-          files: coverage-standard.txt,coverage-extended.txt
+          files: coverage.txt
          token: ${{ secrets.CODECOV_TOKEN }}
      - name: Check coverage threshold
        run: |
-          total=$(go tool cover -func=coverage-standard.txt | grep total | awk '{print $3}' | tr -d '%')
+          total=$(go tool cover -func=coverage.txt | grep total | awk '{print $3}' | tr -d '%')
          threshold=40
          echo "Coverage: ${total}% (threshold: ${threshold}%)"
          if (( $(echo "$total < $threshold" | bc -l) )); then
@@ -311,31 +196,21 @@ jobs:
      - name: Coverage summary
        if: ${{ !cancelled() }}
        run: |
+          if [ ! -f coverage.txt ]; then
+            echo "No coverage data available" >> $GITHUB_STEP_SUMMARY
+            exit 0
+          fi
+          total=$(go tool cover -func=coverage.txt | grep total | awk '{print $3}')
          echo "## Coverage Report" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
-          report_coverage() {
-            profile="$1"
-            label="$2"
-            echo "### ${label} edition" >> $GITHUB_STEP_SUMMARY
-            echo "" >> $GITHUB_STEP_SUMMARY
-            if [ ! -f "$profile" ]; then
-              echo "No ${label} coverage data available." >> $GITHUB_STEP_SUMMARY
-              echo "" >> $GITHUB_STEP_SUMMARY
-              return
-            fi
-            total=$(go tool cover -func="$profile" | grep total | awk '{print $3}')
-            echo "**Total coverage: ${total}**" >> $GITHUB_STEP_SUMMARY
-            echo "" >> $GITHUB_STEP_SUMMARY
-            echo "<details><summary>Details</summary>" >> $GITHUB_STEP_SUMMARY
-            echo "" >> $GITHUB_STEP_SUMMARY
-            echo '```' >> $GITHUB_STEP_SUMMARY
-            go tool cover -func="$profile" >> $GITHUB_STEP_SUMMARY
-            echo '```' >> $GITHUB_STEP_SUMMARY
-            echo "</details>" >> $GITHUB_STEP_SUMMARY
-            echo "" >> $GITHUB_STEP_SUMMARY
-          }
-          report_coverage coverage-standard.txt Standard
-          report_coverage coverage-extended.txt Extended
+          echo "**Total coverage: ${total}**" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "<details><summary>Details</summary>" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo '```' >> $GITHUB_STEP_SUMMARY
+          go tool cover -func=coverage.txt >> $GITHUB_STEP_SUMMARY
+          echo '```' >> $GITHUB_STEP_SUMMARY
+          echo "</details>" >> $GITHUB_STEP_SUMMARY

  deadcode:
    needs: fast-gate
@@ -388,11 +263,6 @@ jobs:
  e2e-dry-run:
    needs: [unit-test, lint, script-test, deterministic-gate]
    runs-on: ubuntu-latest
-    timeout-minutes: 20
-    outputs:
-      mode: ${{ steps.e2e_domains.outputs.mode }}
-      reason: ${{ steps.e2e_domains.outputs.reason }}
-      live_packages: ${{ steps.e2e_domains.outputs.live_packages }}
    steps:
      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
        with:
@@ -406,23 +276,6 @@ jobs:
      - name: Resolve CLI E2E domains
        id: e2e_domains
        run: node scripts/e2e_domains.js
-      - name: Validate CLI E2E domain outputs
-        env:
-          E2E_MODE: ${{ steps.e2e_domains.outputs.mode }}
-          E2E_LIVE_PACKAGES: ${{ steps.e2e_domains.outputs.live_packages }}
-        run: |
-          case "$E2E_MODE" in
-            skip)
-              [ -z "$E2E_LIVE_PACKAGES" ] || { echo "::error::Skip mode must not resolve live packages"; exit 1; }
-              ;;
-            full|subset)
-              [ -n "$E2E_LIVE_PACKAGES" ] || { echo "::error::No live packages resolved for mode $E2E_MODE"; exit 1; }
-              ;;
-            *)
-              echo "::error::Invalid CLI E2E mode: $E2E_MODE"
-              exit 1
-              ;;
-          esac
      - name: Build lark-cli
        if: ${{ steps.e2e_domains.outputs.mode != 'skip' }}
        run: make build
@@ -456,22 +309,16 @@ jobs:
          fi

  e2e-live:
-    needs: [unit-test, lint, script-test, deterministic-gate, e2e-dry-run]
-    if: ${{ always() && (github.event_name != 'pull_request' || !github.event.pull_request.head.repo.fork) && needs.unit-test.result == 'success' && needs.lint.result == 'success' && needs.script-test.result == 'success' && needs.deterministic-gate.result == 'success' && needs.e2e-dry-run.result == 'success' && (needs.e2e-dry-run.outputs.mode == 'full' || needs.e2e-dry-run.outputs.mode == 'subset') && needs.e2e-dry-run.outputs.live_packages != '' }}
+    needs: [unit-test, lint, script-test, deterministic-gate]
+    if: ${{ github.event_name != 'pull_request' || !github.event.pull_request.head.repo.fork }}
    runs-on: ubuntu-latest
-    timeout-minutes: 30
-    # Live E2E uses one repository-wide execution slot.
-    concurrency:
-      group: lark-cli-e2e-live
-      cancel-in-progress: false
-      queue: max
    permissions:
-      actions: read
      contents: read
      checks: write
    env:
      TEST_BOT1_APP_ID: ${{ secrets.TEST_BOT1_APP_ID }}
-      LARKSUITE_CLI_BRAND: feishu
+      TEST_BOT1_APP_SECRET: ${{ secrets.TEST_BOT1_APP_SECRET }}
+      TEST_USER_ACCESS_TOKEN: ${{ secrets.TEST_USER_ACCESS_TOKEN }}
    steps:
      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
        with:
@@ -482,68 +329,31 @@ jobs:
      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
        with:
          python-version: '3.x'
+      - name: Resolve CLI E2E domains
+        id: e2e_domains
+        run: node scripts/e2e_domains.js
      - name: Build lark-cli
-        id: build_cli
+        if: ${{ steps.e2e_domains.outputs.mode != 'skip' }}
        run: make build
-      - name: Prepare shared live E2E tenant token
-        id: live_e2e_tat
-        env:
-          LARKSUITE_CLI_APP_ID: ${{ secrets.TEST_BOT1_APP_ID }}
-          TEST_BOT1_APP_SECRET: ${{ secrets.TEST_BOT1_APP_SECRET }}
-        run: node scripts/fetch_e2e_tat.js
-      - name: Run CLI E2E tests
-        # Keep an active Go test alive so t.Cleanup can finish. A queued stale
-        # run is rejected below before it can start live E2E.
-        if: ${{ always() && steps.build_cli.outcome == 'success' && steps.live_e2e_tat.outcome == 'success' }}
-        shell: bash
-        env:
-          GH_TOKEN: ${{ github.token }}
-          REPOSITORY: ${{ github.repository }}
-          EVENT_NAME: ${{ github.event_name }}
-          RUN_ID: ${{ github.run_id }}
-          RUN_NUMBER: ${{ github.run_number }}
-          RUN_GENERATION: ${{ github.event_name == 'pull_request' && format('CI / {0}', github.event.pull_request.number) || '' }}
-          LARK_CLI_BIN: ${{ github.workspace }}/lark-cli
-          E2E_MODE: ${{ needs.e2e-dry-run.outputs.mode }}
-          E2E_REASON: ${{ needs.e2e-dry-run.outputs.reason }}
-          E2E_LIVE_PACKAGES: ${{ needs.e2e-dry-run.outputs.live_packages }}
-          E2E_TENANT_AUTH_FILE: ${{ steps.live_e2e_tat.outputs.path }}
-          TEST_USER_ACCESS_TOKEN: ${{ secrets.TEST_USER_ACCESS_TOKEN }}
+      - name: Configure bot credentials
+        if: ${{ steps.e2e_domains.outputs.mode != 'skip' }}
        run: |
-          if [ "$EVENT_NAME" = "pull_request" ]; then
-            workflow_id="$(gh api "repos/$REPOSITORY/actions/runs/$RUN_ID" --jq '.workflow_id')"
-            newer_runs="$(
-              gh api --paginate -X GET "repos/$REPOSITORY/actions/workflows/$workflow_id/runs" \
-                -f event=pull_request -f branch="$GITHUB_HEAD_REF" -f per_page=100 |
-                jq -r --arg repository "$REPOSITORY" --arg generation "$RUN_GENERATION" --argjson run_number "$RUN_NUMBER" \
-                  '.workflow_runs[] | select(.head_repository.full_name == $repository and .display_title == $generation and .run_number > $run_number) | .id'
-            )"
-            if [ -n "$newer_runs" ]; then
-              echo "::error::Superseded before live E2E started by newer workflow run(s): $newer_runs"
-              exit 1
-            fi
-          fi
-          if [ -z "${E2E_TENANT_AUTH_FILE:-}" ] || [ ! -f "$E2E_TENANT_AUTH_FILE" ]; then
-            echo "::error::Missing shared live E2E tenant token file"
+          if [ -z "$TEST_BOT1_APP_ID" ] || [ -z "$TEST_BOT1_APP_SECRET" ]; then
+            echo "::error::Missing required secrets: TEST_BOT1_APP_ID / TEST_BOT1_APP_SECRET"
            exit 1
          fi
-          export TEST_TENANT_ACCESS_TOKEN="$(cat "$E2E_TENANT_AUTH_FILE")"
-          rm -f "$E2E_TENANT_AUTH_FILE"
-          if ! LARKSUITE_CLI_APP_ID="$TEST_BOT1_APP_ID" \
-            LARKSUITE_CLI_TENANT_ACCESS_TOKEN="$TEST_TENANT_ACCESS_TOKEN" \
-            ./lark-cli whoami --as bot | node -e '
-            let input = "";
-            process.stdin.setEncoding("utf8");
-            process.stdin.on("data", (chunk) => { input += chunk; });
-            process.stdin.on("end", () => {
-              const result = JSON.parse(input);
-              if (result.identity !== "bot" || result.available !== true || result.tokenStatus !== "ready") process.exit(1);
-            });
-          '; then
-            echo "::error::Tenant credential preflight failed"
-            exit 1
+          printf '%s\n' "$TEST_BOT1_APP_SECRET" | ./lark-cli config init --app-id "$TEST_BOT1_APP_ID" --app-secret-stdin
+      - name: Run CLI E2E tests
+        env:
+          LARK_CLI_BIN: ${{ github.workspace }}/lark-cli
+          E2E_MODE: ${{ steps.e2e_domains.outputs.mode }}
+          E2E_REASON: ${{ steps.e2e_domains.outputs.reason }}
+          E2E_LIVE_PACKAGES: ${{ steps.e2e_domains.outputs.live_packages }}
+        run: |
+          if [ "$E2E_MODE" = "skip" ]; then
+            echo "No live CLI E2E needed: $E2E_REASON"
+            exit 0
          fi
-          echo "Tenant credential preflight succeeded"
          packages="$E2E_LIVE_PACKAGES"
          if [ -z "$packages" ]; then
            echo "::error::No live CLI E2E packages resolved for mode $E2E_MODE"
@@ -553,7 +363,7 @@ jobs:
          echo "Live CLI E2E packages: $packages"
          go run gotest.tools/gotestsum@v1.12.3 --rerun-fails=2 --rerun-fails-max-failures=20 --packages="$packages" --format testname --junitfile cli-e2e-report.xml -- -count=1 -v
      - name: Publish CLI E2E test report
-        if: ${{ !cancelled() }}
+        if: ${{ !cancelled() && steps.e2e_domains.outputs.mode != 'skip' }}
        uses: dorny/test-reporter@a43b3a5f7366b97d083190328d2c652e1a8b6aa2 # v3.0.0
        with:
          name: CLI E2E Tests
@@ -606,7 +416,7 @@ jobs:
  # ── Results Gate (single required check for branch protection) ─────
  results:
    if: ${{ always() }}
-    needs: [fast-gate, unit-test, lint, script-test, deterministic-gate, coverage, deadcode, e2e-dry-run, e2e-live, security, license-header, plugin-integration, sidecar-integration, extended-integration, extended-platform-security]
+    needs: [fast-gate, unit-test, lint, script-test, deterministic-gate, coverage, deadcode, e2e-dry-run, e2e-live, security, license-header]
    runs-on: ubuntu-latest
    steps:
      - name: Evaluate results
@@ -626,21 +436,10 @@ jobs:
          echo "| L3 | e2e-live | ${{ needs.e2e-live.result }} |" >> $GITHUB_STEP_SUMMARY
          echo "| L4 | security | ${{ needs.security.result }} |" >> $GITHUB_STEP_SUMMARY
          echo "| L4 | license-header | ${{ needs.license-header.result }} |" >> $GITHUB_STEP_SUMMARY
-          echo "| L4 | plugin-integration (observe-only) | ${{ needs.plugin-integration.result }} |" >> $GITHUB_STEP_SUMMARY
-          echo "| L4 | sidecar-integration (observe-only) | ${{ needs.sidecar-integration.result }} |" >> $GITHUB_STEP_SUMMARY
-          echo "| L4 | extended-integration | ${{ needs.extended-integration.result }} |" >> $GITHUB_STEP_SUMMARY
-          echo "| L4 | extended-platform-security | ${{ needs.extended-platform-security.result }} |" >> $GITHUB_STEP_SUMMARY

          # Any failure or cancellation in any job blocks the merge.
-          # Legitimately skipped jobs (deadcode on push, e2e-live when not
-          # needed or on a fork, license-header on push) are OK.
-          #
-          # plugin-integration and sidecar-integration are intentionally NOT
-          # in this loop yet: they run on every PR and their status is shown
-          # in the table above, but a failure is observe-only (non-blocking)
-          # during the initial soak. Graduation to required is tracked in
-          # https://github.com/larksuite/cli/issues/1894 (criteria: 4
-          # consecutive weeks with zero false positives).
+          # Legitimately skipped jobs (deadcode on push, e2e-live on fork,
+          # license-header on push) are OK.
          FAILED=0
          for result in \
            "${{ needs.fast-gate.result }}" \
@@ -653,9 +452,7 @@ jobs:
            "${{ needs.e2e-dry-run.result }}" \
            "${{ needs.e2e-live.result }}" \
            "${{ needs.security.result }}" \
-            "${{ needs.license-header.result }}" \
-            "${{ needs.extended-integration.result }}" \
-            "${{ needs.extended-platform-security.result }}"; do
+            "${{ needs.license-header.result }}"; do
            if [ "$result" = "failure" ] || [ "$result" = "cancelled" ]; then
              FAILED=1
            fi
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -9,45 +9,10 @@ permissions:
  contents: read

 jobs:
-  preflight:
-    runs-on: ubuntu-22.04
-    permissions:
-      contents: read
-    steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
-        with:
-          fetch-depth: 0
-
-      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
-        with:
-          node-version: '22.14.0'
-
-      - name: Validate tag and commit
-        env:
-          TAG: ${{ github.ref_name }}
-        run: |
-          set -euo pipefail
-          node scripts/release-preflight.js --tag "$TAG"
-          git fetch origin main
-          HEAD_SHA="$(git rev-parse --verify 'HEAD^{commit}')"
-          MAIN_SHA="$(git rev-parse --verify 'FETCH_HEAD^{commit}')"
-          TAG_SHA="$(git rev-parse --verify "refs/tags/${TAG}^{commit}")"
-          if [[ "$TAG_SHA" != "$HEAD_SHA" ]]; then
-            echo "Tag ${TAG} does not resolve to the checked-out HEAD commit." >&2
-            exit 1
-          fi
-          if ! git merge-base --is-ancestor "$HEAD_SHA" "$MAIN_SHA"; then
-            echo "Tag ${TAG} does not point to a commit contained in origin/main." >&2
-            exit 1
-          fi
-
-  build-release:
-    needs: preflight
+  goreleaser:
    runs-on: ubuntu-22.04
    permissions:
      contents: write
-      id-token: write
-      attestations: write
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
@@ -61,176 +26,35 @@ jobs:
        with:
          python-version: '3.x'

-      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
-        with:
-          node-version: '22.14.0'
-          registry-url: 'https://registry.npmjs.org'
-          package-manager-cache: false
-
-      - name: Install pinned npm
-        run: npm install --global npm@11.16.0
-
-      - name: Build and upload draft release with GoReleaser
+      - name: Run GoReleaser
        uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6
        with:
          version: '~> v2'
          args: release --clean
        env:
-          GITHUB_TOKEN: ${{ github.token }}
-
-      - name: Include release checksums
-        run: |
-          set -euo pipefail
-          test -s dist/checksums.txt
-          cp scripts/install-extended.sh scripts/install-extended.ps1 dist/
-          (cd dist && sha256sum --check checksums.txt)
-          cp dist/checksums.txt checksums.txt
-
-      - name: Verify release edition identities
-        run: |
-          set -euo pipefail
-          mkdir -p /tmp/lark-cli-standard /tmp/lark-cli-extended
-          tar -xzf "dist/lark-cli-${GITHUB_REF_NAME#v}-linux-amd64.tar.gz" -C /tmp/lark-cli-standard lark-cli
-          tar -xzf "dist/lark-cli-extended-${GITHUB_REF_NAME#v}-linux-amd64.tar.gz" -C /tmp/lark-cli-extended lark-cli
-          test "$(/tmp/lark-cli-standard/lark-cli version --json | jq -r .edition)" = "standard"
-          test "$(/tmp/lark-cli-extended/lark-cli version --json | jq -r .edition)" = "extended"
-          test "$(/tmp/lark-cli-standard/lark-cli version --json | jq -r .version)" = "${GITHUB_REF_NAME#v}"
-          test "$(/tmp/lark-cli-extended/lark-cli version --json | jq -r .version)" = "${GITHUB_REF_NAME#v}"
-
-      - name: Verify release platform asset matrix
-        run: bash scripts/verify-release-assets.sh dist "${GITHUB_REF_NAME#v}"
-
-      - name: Attest release archives
-        uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2
-        with:
-          subject-path: |
-            dist/*.tar.gz
-            dist/*.zip
-            dist/checksums.txt
-            dist/install-extended.sh
-            dist/install-extended.ps1
-
-      - name: Collect release asset
-        run: |
-          set -euo pipefail
-          mkdir npm-publish-asset
-          cp dist/*.tar.gz dist/*.zip dist/checksums.txt \
-            dist/install-extended.sh dist/install-extended.ps1 \
-            npm-publish-asset/
-
-      - name: Upload release asset
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
-        with:
-          name: npm-publish-asset-${{ github.run_id }}
-          path: npm-publish-asset/
-          if-no-files-found: error
-          overwrite: true
-
-      - name: Publish verified GitHub release
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
-        env:
-          RELEASE_TAG: ${{ github.ref_name }}
-        with:
-          github-token: ${{ github.token }}
-          script: |
-            const crypto = require("node:crypto");
-            const fs = require("node:fs");
-            const tag = process.env.RELEASE_TAG;
-            const { owner, repo } = context.repo;
-            const releases = await github.paginate(github.rest.repos.listReleases, {
-              owner,
-              repo,
-              per_page: 100,
-            });
-            const matches = releases.filter((release) => release.tag_name === tag);
-            if (matches.length !== 1) {
-              throw new Error(`expected exactly one draft release for ${tag}, found ${matches.length}`);
-            }
-            const release = matches[0];
-            if (!release.draft) {
-              throw new Error(`release ${tag} became public before verification completed`);
-            }
-
-            const checksumPath = "dist/checksums.txt";
-            const checksumBody = fs.readFileSync(checksumPath, "utf8");
-            const expectedDigests = new Map();
-            for (const line of checksumBody.split(/\r?\n/)) {
-              if (!line.trim()) continue;
-              const match = line.match(/^([0-9a-fA-F]{64})\s+\*?(.+)$/);
-              if (!match) throw new Error(`invalid checksums.txt line: ${line}`);
-              const name = match[2];
-              if (expectedDigests.has(name)) {
-                throw new Error(`duplicate checksums.txt entry: ${name}`);
-              }
-              expectedDigests.set(name, `sha256:${match[1].toLowerCase()}`);
-            }
-            expectedDigests.set(
-              "checksums.txt",
-              `sha256:${crypto.createHash("sha256").update(checksumBody).digest("hex")}`,
-            );
-
-            const actualNames = release.assets.map((asset) => asset.name).sort();
-            const expectedNames = [...expectedDigests.keys()].sort();
-            if (JSON.stringify(actualNames) !== JSON.stringify(expectedNames)) {
-              throw new Error(
-                `draft release asset set mismatch: expected ${expectedNames.join(", ")}, got ${actualNames.join(", ")}`,
-              );
-            }
-            for (const asset of release.assets) {
-              const expected = expectedDigests.get(asset.name);
-              if (!asset.digest) {
-                throw new Error(`GitHub did not report a digest for draft asset ${asset.name}`);
-              }
-              if (asset.digest.toLowerCase() !== expected) {
-                throw new Error(
-                  `draft asset digest mismatch for ${asset.name}: expected ${expected}, got ${asset.digest}`,
-                );
-              }
-            }
-
-            await github.rest.repos.updateRelease({
-              owner,
-              repo,
-              release_id: release.id,
-              draft: false,
-              make_latest: "true",
-            });
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  publish-npm:
-    needs: build-release
+    needs: goreleaser
    runs-on: ubuntu-22.04
-    environment: npm-production
-    permissions:
-      contents: read
-      id-token: write
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

-      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
-          node-version: '22.14.0'
+          node-version: '20'
          registry-url: 'https://registry.npmjs.org'
-          package-manager-cache: false

-      - name: Install pinned npm
-        run: npm install --global npm@11.16.0
-
-      - name: Download release asset
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
-        with:
-          name: npm-publish-asset-${{ github.run_id }}
-          path: npm-publish-asset
-
-      - name: Verify npm publish asset
+      - name: Download checksums from release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -euo pipefail
-          (cd npm-publish-asset && sha256sum --check checksums.txt)
-          cp npm-publish-asset/checksums.txt checksums.txt
-          PACK_JSON="$(npm pack --ignore-scripts --json)"
-          PACK_FILE="$(node -e 'const p=JSON.parse(process.argv[1]); if(p.length!==1 || !p[0].filename) process.exit(1); process.stdout.write(p[0].filename)' "$PACK_JSON")"
-          test -s "$PACK_FILE"
-          tar -tzf "$PACK_FILE" | grep -qx 'package/checksums.txt'
-          rm "$PACK_FILE"
+          TAG="${GITHUB_REF_NAME}"
+          gh release download "${TAG}" --pattern checksums.txt --dir .
+          test -s checksums.txt || { echo "checksums.txt missing or empty for ${TAG}"; exit 1; }

      - name: Publish to npm
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
        run: npm publish --access public
--- a/.github/workflows/semantic-review.yml
+++ b/.github/workflows/semantic-review.yml
@@ -25,16 +25,19 @@ jobs:
        with:
          script: |
            const run = context.payload.workflow_run;
-            const workflowId = Number(run.workflow_id || 0);
-            if (!Number.isInteger(workflowId) || workflowId <= 0) throw new Error("missing workflow id");
-            const { data: workflow } = await github.rest.actions.getWorkflow({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              workflow_id: workflowId,
-            });
-            if (workflow.name !== "CI") throw new Error(`unexpected workflow name: ${workflow.name}`);
-            if (workflow.path !== ".github/workflows/ci.yml") throw new Error(`unexpected workflow path: ${workflow.path}`);
-            if (run.path && run.path !== workflow.path) throw new Error(`workflow path mismatch: ${run.path}`);
+            if (run.name !== "CI") throw new Error(`unexpected workflow name: ${run.name}`);
+            let workflowPath = run.path || "";
+            if (!workflowPath) {
+              const workflowId = Number(run.workflow_id || 0);
+              if (!Number.isInteger(workflowId) || workflowId <= 0) throw new Error("missing workflow id");
+              const { data: workflow } = await github.rest.actions.getWorkflow({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                workflow_id: workflowId,
+              });
+              workflowPath = workflow.path || "";
+            }
+            if (workflowPath !== ".github/workflows/ci.yml") throw new Error(`unexpected workflow path: ${workflowPath}`);
            if (run.event !== "pull_request") throw new Error(`unexpected event: ${run.event}`);
            if (run.repository.id !== context.payload.repository.id) throw new Error("repository id mismatch");
            if (run.repository.full_name !== context.payload.repository.full_name) throw new Error("repository name mismatch");
@@ -250,16 +253,19 @@ jobs:
        with:
          script: |
            const run = context.payload.workflow_run;
-            const workflowId = Number(run.workflow_id || 0);
-            if (!Number.isInteger(workflowId) || workflowId <= 0) throw new Error("missing workflow id");
-            const { data: workflow } = await github.rest.actions.getWorkflow({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              workflow_id: workflowId,
-            });
-            if (workflow.name !== "CI") throw new Error(`unexpected workflow name: ${workflow.name}`);
-            if (workflow.path !== ".github/workflows/ci.yml") throw new Error(`unexpected workflow path: ${workflow.path}`);
-            if (run.path && run.path !== workflow.path) throw new Error(`workflow path mismatch: ${run.path}`);
+            if (run.name !== "CI") throw new Error(`unexpected workflow name: ${run.name}`);
+            let workflowPath = run.path || "";
+            if (!workflowPath) {
+              const workflowId = Number(run.workflow_id || 0);
+              if (!Number.isInteger(workflowId) || workflowId <= 0) throw new Error("missing workflow id");
+              const { data: workflow } = await github.rest.actions.getWorkflow({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                workflow_id: workflowId,
+              });
+              workflowPath = workflow.path || "";
+            }
+            if (workflowPath !== ".github/workflows/ci.yml") throw new Error(`unexpected workflow path: ${workflowPath}`);
            if (run.event !== "pull_request") throw new Error(`unexpected event: ${run.event}`);
            if (run.conclusion !== "success") throw new Error(`unexpected conclusion: ${run.conclusion}`);
            if (run.repository.id !== context.payload.repository.id) throw new Error("repository id mismatch");
--- a/.goreleaser.yml
+++ b/.goreleaser.yml
@@ -5,8 +5,7 @@ before:
    - python3 scripts/fetch_meta.py

 builds:
-  - id: standard
-    binary: lark-cli
+  - binary: lark-cli
    env:
      - CGO_ENABLED=0
    ldflags:
@@ -19,54 +18,12 @@ builds:
      - amd64
      - arm64
      - riscv64
-    ignore:
-      - goos: darwin
-        goarch: riscv64
-      - goos: windows
-        goarch: riscv64
-  - id: extended
-    binary: lark-cli
-    tags:
-      - extended
-    env:
-      - CGO_ENABLED=0
-    ldflags:
-      - -s -w -X github.com/larksuite/cli/internal/build.Version={{ .Version }} -X github.com/larksuite/cli/internal/build.Date={{ .Date }}
-    goos:
-      - darwin
-      - linux
-      - windows
-    goarch:
-      - amd64
-      - arm64
-      - riscv64
-    ignore:
-      - goos: darwin
-        goarch: riscv64
-      - goos: windows
-        goarch: riscv64

 archives:
-  - id: standard
-    ids:
-      - standard
-    name_template: "lark-cli-{{ .Version }}-{{ .Os }}-{{ .Arch }}"
+  - name_template: "lark-cli-{{ .Version }}-{{ .Os }}-{{ .Arch }}"
    format_overrides:
      - goos: windows
-        formats:
-          - zip
-    files:
-      - README.md
-      - LICENSE
-      - CHANGELOG.md
-  - id: extended
-    ids:
-      - extended
-    name_template: "lark-cli-extended-{{ .Version }}-{{ .Os }}-{{ .Arch }}"
-    format_overrides:
-      - goos: windows
-        formats:
-          - zip
+        format: zip
    files:
      - README.md
      - LICENSE
@@ -74,18 +31,6 @@ archives:

 checksum:
  name_template: checksums.txt
-  extra_files:
-    - glob: ./scripts/install-extended.sh
-    - glob: ./scripts/install-extended.ps1
-
-release:
-  # Keep assets undiscoverable by releases/latest until the workflow has
-  # independently verified checksums, edition identity, and platform coverage.
-  draft: true
-  replace_existing_draft: true
-  extra_files:
-    - glob: ./scripts/install-extended.sh
-    - glob: ./scripts/install-extended.ps1

 changelog:
  sort: asc
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -10,10 +10,9 @@
 ## Build & Test

 ```bash
-make build             # Build (runs fetch_meta first)
-make unit-test         # Required before PR (runs with -race where supported, e.g. amd64/arm64)
-make live-skills-test  # Opt-in real Skills CLI tests; runs with isolated user directories
-make test              # Full: vet + unit + integration
+make build          # Build (runs fetch_meta first)
+make unit-test      # Required before PR (runs with -race where supported, e.g. amd64/arm64)
+make test           # Full: vet + unit + integration
 ```

 ## Notification Opt-Outs
@@ -106,20 +105,6 @@ Signatures that are easy to guess wrong:

 Program output (JSON envelopes) goes to stdout. Progress, warnings, hints go to stderr. Mixing them corrupts pipe chains.

-### Typed data over loose maps
-
-Parse `map[string]interface{}` into a typed struct at the boundary — one projection function per shape — and let everything downstream consume struct fields, not string keys. A typo'd map key compiles fine and fails at runtime, which an agent then debugs blind.
-
-Use distinct types when two values could be swapped silently: see `internal/meta.Token` — a bare string compiles on either side of a string/string signature, a distinct type does not.
-
-Legacy loose-map code exists in older paths. Match its call sites when touching it, but do not copy the pattern into new code.
-
-### Transcribe faithfully — no silent fallbacks
-
-When code echoes input onward (request previews, transformations, proxies), transcribe verbatim. A `default:` branch that coerces unrecognized input into a plausible value ("unknown HTTP verb → GET") makes the output lie, and an agent reasons from the lie.
-
-The same rule applies to flag combinations and internal wiring: if a requested option cannot be honored, return a typed validation error — never silently substitute another behavior and exit 0. Silent guesses (defaulting a missing identity, discarding writes on a nil writer) are bugs even when every current caller happens to avoid them.
-
 ### Use `vfs.*` instead of `os.*`

 All filesystem access goes through `internal/vfs`. This enables test mocking.
@@ -131,7 +116,6 @@ CLI arguments are untrusted (they come from AI agents). Call `validate.SafeInput
 ### Tests

 - Every behavior change needs a test alongside the change.
- A contract test must fail if the implementation is reverted. If you can undo the code change and the suite stays green, the contract is not pinned — assert the new field/behavior directly, not a happy-path substring.
 - `cmdutil.TestFactory(t, config)` for test factories.
 - `t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())` to isolate config state.

--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,290 +2,6 @@

 All notable changes to this project will be documented in this file.

-## [v1.0.80] - 2026-07-29
-
-### Features
-
- **drive**: add +member-list shortcut (#1795)
- **drive**: add +permission-get-setting shortcut (#1738)
- propagate invocation metadata (#2097)
-
-### Documentation
-
- **slides**: 补齐 shortcut 参数说明，修正 +xml-get --output 必填标注 (#2088)
- **slides**: +create 的参数下沉到 create.md，主 skill 只留路由 (#2096)
-
-### Tests
-
- **e2e**: wait for base role update visibility (#2087)
-
-### Misc
-
- Feat/detect line text overlap (#2069)
-
-## [v1.0.79] - 2026-07-28
-
-### Features
-
- **slides**: update xsd (#2067)
-
-### Bug Fixes
-
- **ci**: validate static workflow identity (#2015)
- **sheets**: recognize OFL0X local office tokens (#2063)
-
-### Documentation
-
- **calendar**: clarify identity selection by event ownership (#2071)
- **slides**: add formula inline element syntax to quick-ref (#2077)
-
-## [v1.0.78] - 2026-07-27
-
-### Features
-
- event description support rich text (#1975)
-
-### Bug Fixes
-
- **slides**: restrict canvas overflow checks
- **slides**: upgrade text overflow to error above 10px threshold
- **slides**: detect letterSpacing-driven text overflow
- **slides**: downgrade background-decoration text overflow to info
- **slides**: allow chartParsedValues roundtrip tag
- refine character width estimation for lark-slides text lint
- **slides**: preserve info lint severity
- **slides**: text may over flow shape
- exempt ghost text from slides lint
-
-## [v1.0.77] - 2026-07-24
-
-### Features
-
- introducing official card icon (#1973)
- **apps**: validate +file-list --page-size against server (0, 200] range (#2007)
- **apps**: support absolute and relative upload paths (#2005)
- **slides**: fill xml-schema-quick-ref gaps that forced XSD fallback (#2026)
- **slides**: add layout density lint for sparse/empty containers (#2022)
- add risk-control protection (#1910)
-
-### Bug Fixes
-
- **slides**: normalize presentation flag aliases (#2032)
- **base**: classify +form-submit as high-risk-write (#1969)
- **slides**: declare screenshot scope
- **slides**: support CSV multi-value for --slide-id in screenshot (#2047)
-
-### Documentation
-
- **skill**: clarify scope handling for query expansion (#2030)
- **base**: clarify complete and partial updates (#1993)
- **skills**: clarify callout child rules (#2048)
-
-### Misc
-
- fix/task id handling (#2023)
- fix/task search pagination (#2041)
-
-## [v1.0.75] - 2026-07-22
-
-### Features
-
- add okr single create shortcut & skill text opti (#1941)
- **calendar**: auto-add bot self as attendee and note user-only search (#1991)
-
-### Bug Fixes
-
- **base**: improve table shortcut behavior & guidance (#1803)
- issue#1935 & whiteboard shortcut reformat (#1980)
- remove legacy shortcut (#1997)
- **e2e**: inject shared credentials by identity (#1995)
-
-### Documentation
-
- **skill**: describe html5 block xml usage (#1380)
- clarify fetch metadata and user cites (#1981)
- add topic move collector workflow (#1473)
- update lark doc HTML size limit (#2001)
- **base**: align record write schema guidance (#2000)
-
-### Tests
-
- **e2e**: declare request identities explicitly (#2004)
-
-### Misc
-
- harden npm release publishing (#1918)
-
-## [v1.0.74] - 2026-07-21
-
-### Features
-
- **slides**: add history rollback shortcuts (#1714)
- **base**: support per-record batch updates (#1889)
-
-### Bug Fixes
-
- preserve slides schema issues
- allow jq examples in quality gate dry-runs
- **im**: warn when flag pagination is truncated (#1906)
- **slides**: warn on text shape overflow
- **slides**: exempt chart roundtrip attributes from lint
- **slides**: detect image text occlusion
- **slides**: clarify xml-text-overlap-lint error for positional argument (#1986)
-
-### Documentation
-
- clarify drive upload overwrite guidance (#1982)
-
-### Tests
-
- isolate unit tests from user state (#1883)
-
-### Refactoring
-
- converge success output through a single Emitter that owns the write (#1899)
-
-## [v1.0.73] - 2026-07-20
-
-### Features
-
- **apps**: design_html support, creative-design skill, unified TOS publish (#1901)
-
-### Bug Fixes
-
- **slides**: detect visual elements outside canvas
- reduce public content credential fixture false positives
- standardize CLI shortcut text in English (#1942)
-
-### Documentation
-
- **base**: reduce filter and update retry loops (#1879)
- **vc**: default transcript routing to smart notes over minutes (#1961)
- clarify local trigger automation (#1958)
-
-### Tests
-
- synchronize temporary Git maintenance (#1946)
-
-### Misc
-
- **slides**: update lark-slides skill to 0715 snapshot (#1933)
- [codex] support bot menu events (#1765)
-
-## [v1.0.72] - 2026-07-17
-
-### Features
-
- **slides**: lint table out of canvas
- **slides**: report resolved table size mismatches
- **approval**: support approval event consumption (#1924)
-
-### Bug Fixes
-
- **vc**: don't fail +detail for in-progress meetings (#1930)
- stabilize drive delete E2E terminal-state checks (#1939)
-
-### Documentation
-
- **slides**: document table dimensions
- document base field default values (#1500)
- **sheets**: use English placeholder in table-get guidance (#1936)
-
-### Tests
-
- stabilize live e2e auth retries (#1904)
- use tri-state wiki node identity in delete verification (#1931)
- fix drive cover download retries (#1934)
-
-## [v1.0.71] - 2026-07-16
-
-### Features
-
- add wiki move-to-drive shortcut (#1869)
- **apps**: add role management shortcuts (#1881)
- **drive**: add secure label support and clarify comment location API (#1913)
-
-### Bug Fixes
-
- **base**: improve dashboard shortcut guidance (#1787)
-
-### Documentation
-
- **apps**: add platform SQL authoring guide to the db-execute skill (#1912)
-
-### Misc
-
- add L4 plugin-integration and sidecar-integration CI jobs (#1840)
- **drive**: optimize drive +delete workflow (#1909)
-
-## [v1.0.70] - 2026-07-15
-
-### Features
-
- add minutes permission application shortcut (#1876)
- **drive**: support apps in list comments (#1877)
- slide style
- edit ppt template
- **slides**: add sxsd validation to slides lint
- **slides**: validate iconpark icon types in slides lint
- **slides**: lint before create
- **apps**: add automation trigger commands for Miaoda (#1886)
-
-### Bug Fixes
-
- unify dry-run output contract (#1870)
- **skills**: align skill guidance with the typed error contract (#1786)
- **slides**: limit slides screenshot page requests
- **slides**: detect lark slides text overflow overlap
- **vc**: align meeting query scopes by identity (#1850)
-
-### Documentation
-
- clarify task search relevance filters (#1884)
- surface minutes permission application in skill description (#1890)
- clarify okr progress children (#1861)
- **slides**: prefer slides xml-get shortcut
- **calendar**: document setting meeting owner via full API (#1903)
-
-### Refactoring
-
- **slides**: streamline create workflow and validate SML namespaces
-
-### Misc
-
- **slides**: address PR review feedback
-
-## [v1.0.69] - 2026-07-13
-
-### Features
-
- support docs fetch selection anchors (#1815)
- **apps**: support modern_html app type with TOS publish path and app type querying
- **im**: show bot sender display names when reading messages (#1829)
- add drive list comments shortcut (#1845)
- support wiki sources in drive export (#1802)
- add application domain with slash command management shortcuts (#1806)
- validate IM idempotency key length (#1797)
- surface reply context and mentions in im.message.receive_v1 (#1798)
-
-### Bug Fixes
-
- route brand-sensitive endpoints through the resolver (#1836)
-
-### Documentation
-
- document OKR block XML guidance (#1648)
- refine doubao whiteboard workflow routing (#1841)
- clarify Mindnote token handling (#1827)
-
-### Tests
-
- isolate semantic waiver fixtures from wall clock
-
-### Misc
-
- Merge lark sheets development branch (#1833)
-
 ## [v1.0.68] - 2026-07-09

 ### Features
@@ -1722,17 +1438,6 @@ Bundled AI agent skills for intelligent assistance:
 - Bilingual documentation (English & Chinese).
 - CI/CD pipelines: linting, testing, coverage reporting, and automated releases.

-[v1.0.80]: https://github.com/larksuite/cli/releases/tag/v1.0.80
-[v1.0.79]: https://github.com/larksuite/cli/releases/tag/v1.0.79
-[v1.0.78]: https://github.com/larksuite/cli/releases/tag/v1.0.78
-[v1.0.77]: https://github.com/larksuite/cli/releases/tag/v1.0.77
-[v1.0.75]: https://github.com/larksuite/cli/releases/tag/v1.0.75
-[v1.0.74]: https://github.com/larksuite/cli/releases/tag/v1.0.74
-[v1.0.73]: https://github.com/larksuite/cli/releases/tag/v1.0.73
-[v1.0.72]: https://github.com/larksuite/cli/releases/tag/v1.0.72
-[v1.0.71]: https://github.com/larksuite/cli/releases/tag/v1.0.71
-[v1.0.70]: https://github.com/larksuite/cli/releases/tag/v1.0.70
-[v1.0.69]: https://github.com/larksuite/cli/releases/tag/v1.0.69
 [v1.0.68]: https://github.com/larksuite/cli/releases/tag/v1.0.68
 [v1.0.67]: https://github.com/larksuite/cli/releases/tag/v1.0.67
 [v1.0.66]: https://github.com/larksuite/cli/releases/tag/v1.0.66
--- a/27
+++ b/27
@@ -23,7 +23,7 @@ PREFIX   ?= /usr/local
 TEST_GOARCH := $(or $(GOARCH),$(shell go env GOARCH))
 RACE_FLAG := $(if $(filter riscv64,$(TEST_GOARCH)),,-race)

-.PHONY: all build vet fmt-check script-test test unit-test live-skills-test integration-test examples-build quality-gate install uninstall clean fetch_meta gitleaks sidecar-test extended-test
+.PHONY: all build vet fmt-check script-test test unit-test integration-test examples-build quality-gate install uninstall clean fetch_meta gitleaks

 all: test

@@ -50,29 +50,20 @@ fmt-check:
 script-test:
 	bash scripts/resolve-changed-from.test.sh
 	bash scripts/ci-workflow.test.sh
-	bash scripts/release-workflow.test.sh
 	bash scripts/semantic-review-workflow.test.sh
-	$(NODE) --test scripts/e2e_domains.test.js scripts/fetch_e2e_tat.test.js scripts/install.test.js scripts/release-preflight.test.js scripts/semantic-review-verify-artifact.test.js scripts/pr-quality-summary.test.js scripts/semantic-review-publish.test.js scripts/ci-quality-summary-publish.test.js
+	$(NODE) --test scripts/e2e_domains.test.js scripts/semantic-review-verify-artifact.test.js scripts/pr-quality-summary.test.js scripts/semantic-review-publish.test.js scripts/ci-quality-summary-publish.test.js

 # ./extension/... keeps the public plugin SDK in the default test matrix.
 unit-test: fetch_meta
 	go test $(RACE_FLAG) -gcflags="all=-N -l" -count=1 \
 		./cmd/... ./internal/... ./shortcuts/... ./extension/...

-live-skills-test: fetch_meta
-	LARKSUITE_CLI_RUN_LIVE_SKILLS_TESTS=1 \
-	go test -v -count=1 ./cmd/update \
-		-run '^TestUpdateCommand_(RealSkillsSyncRewritesState|SkillsSyncColdStart)$$'
-
 # examples-build keeps the shipped plugin-SDK examples compilable. If this
 # breaks, the plugin author guide's "go build ./..." path is broken.
 examples-build:
 	go build ./extension/platform/examples/audit-observer
 	go build ./extension/platform/examples/readonly-policy

-# ./tests/... includes tests/plugin_e2e, which builds ~20 customer-fork
-# binaries (~1 min warm; a cold module cache also downloads via GOPROXY).
-# Deliberate: local `make test` exercises the L4 plugin contract by default.
 integration-test: build
 	go test -v -count=1 ./tests/...

@@ -114,20 +105,6 @@ uninstall:
 clean:
 	rm -f $(BINARY)

-# sidecar-test compiles and runs the authsidecar* build-tagged code that the
-# default CI matrix never sees (they carry //go:build tags).
-sidecar-test:
-	go build -tags authsidecar -o /dev/null .
-	go test $(RACE_FLAG) -count=1 -tags authsidecar ./extension/credential/sidecar/ ./extension/transport/sidecar/ ./internal/cmdutil/
-	go test $(RACE_FLAG) -count=1 -tags authsidecar_demo ./sidecar/server-demo/
-	go test $(RACE_FLAG) -count=1 -tags authsidecar ./tests/sidecar_e2e/
-
-# extended-test compiles and exercises the separately distributed Extended
-# edition. The default build remains the Standard npm/npx binary.
-extended-test:
-	go build -tags extended -o /dev/null .
-	go test $(RACE_FLAG) -count=1 -tags extended ./cmd/... ./internal/... ./shortcuts/... ./extension/... ./tests/externalcredential_e2e
-
 # Run secret-leak checks locally before pushing.
 # Step 1: check-doc-tokens catches realistic-looking example tokens in reference
 #         docs and asks you to use _EXAMPLE_TOKEN placeholders instead.
--- a/README.md
+++ b/README.md
@@ -285,29 +285,6 @@ To reduce these risks, the tool enables default security protections at multiple

 We recommend using the Lark/Feishu bot integrated with this tool as a private conversational assistant. Do not add it to group chats or allow other users to interact with it, to avoid abuse of permissions or data leakage.

-To reduce the security risks associated with access token theft, the CLI sends a minimal set of risk-control signals with OpenAPI requests made to exact official Feishu/Lark HTTPS domains. These signals are used to help identify anomalous API activity. This protection is enabled by default. The information sent is limited to:
-
- Operating system type: macOS, Windows, or Linux
- Device hardware model: for example, Mac17,9
-
-To disable this protection for the current workspace, run:
-
-```bash
-lark-cli config risk-control off
-```
-
-To enable this protection for the current workspace, run:
-
-```bash
-lark-cli config risk-control on
-```
-
-To restore the default policy for the current workspace, run:
-
-```bash
-lark-cli config risk-control default
-```
-
 Please fully understand all usage risks. By using this tool, you are deemed to voluntarily assume all related responsibilities.

 ## Star History
--- a/README.zh.md
+++ b/README.zh.md
@@ -286,29 +286,6 @@ lark-cli schema im.messages.delete

 我们建议您将对接本工具的飞书机器人作为私人对话助手使用，请勿将其拉入群聊或允许其他用户与其交互，以避免权限被滥用或数据泄露。

-为降低访问令牌被盗用后的安全风险，CLI 在向飞书/Lark 官方 HTTPS 精确域名发起 OpenAPI 请求时，会随请求发送一组最小化的风控信号，用于辅助识别异常调用行为。该保护默认开启，发送的信息仅包括：
-
- 操作系统类型：macOS、Windows 或 Linux
- 设备的硬件产品型号：例如 Mac17,9
-
-如需让当前 workspace 退出该保护，可执行以下命令：
-
-```bash
-lark-cli config risk-control off
-```
-
-如需开启当前 workspace 的保护，可执行以下命令：
-
-```bash
-lark-cli config risk-control on
-```
-
-恢复当前 workspace 默认策略可执行：
-
-```bash
-lark-cli config risk-control default
-```
-
 请您充分知悉全部使用风险，使用本工具即视为您自愿承担相关所有责任。

 ## Star History
--- a/affordance/contact.md
+++ b/affordance/contact.md
@@ -23,41 +23,6 @@ lark-cli contact +search-user --query "alice" --as user
 lark-cli contact +search-user --user-ids "ou_3a8b****6a7b,me" --as user
 ```

-## +search-bot
-Search bots (apps) by keyword. Pass `--query` or `--queries`; use `--chat-ids` to search within specific chats.
-
-### Skills
- lark-contact/references/lark-contact-search-bot.md
-
-### Avoid when
- Looking for a person rather than a bot → use [[+search-user]]
- Running as a bot — this shortcut is user-only
-
-### Tips
- `has_more=true` means the search is incomplete; refine the keyword or search scope instead of paginating
-
-### Examples
-
-**Find bots by keyword**
-```bash
-lark-cli contact +search-bot --query "会议助手" --as user
-```
-
-**Search inside one chat**
-```bash
-lark-cli contact +search-bot --query "助手" --chat-ids "oc_3a8b****6a7b" --as user
-```
-
-**Find bots you've chatted with**
-```bash
-lark-cli contact +search-bot --query "助手" --has-chatted --as user
-```
-
-**Search several bot keywords in one call**
-```bash
-lark-cli contact +search-bot --queries "会议助手,日报助手,审批助手" --as user
-```
-
 ## +get-user
 Fetch one user's profile by id, or your own with --user-id omitted. Use it under bot identity — `+search-user` is user-only.

--- a/cmd/api/api.go
+++ b/cmd/api/api.go
@@ -130,13 +130,6 @@ func buildAPIRequest(opts *APIOptions) (client.RawApiRequest, *cmdutil.FileUploa
 	stdin := opts.Factory.IOStreams.In
 	fileIO := opts.Factory.ResolveFileIO(opts.Ctx)

-	if opts.Method == "" {
-		return client.RawApiRequest{}, nil, errs.NewValidationError(errs.SubtypeInvalidArgument,
-			"HTTP method must not be empty").
-			WithHint("pass the verb as the first argument, e.g. lark-cli api GET /open-apis/...").
-			WithParam("<method>")
-	}
-
 	// Validate --file mutual exclusions first.
 	if err := cmdutil.ValidateFileFlag(opts.File, opts.Params, opts.Data, opts.Output, opts.PageAll, opts.Method); err != nil {
 		return client.RawApiRequest{}, nil, err
@@ -250,9 +243,9 @@ func apiRun(opts *APIOptions) error {

 	if opts.DryRun {
 		if fileMeta != nil {
-			return cmdutil.PrintDryRunWithFile(request, config, dryRunOutputOptions(f, opts), *fileMeta)
+			return cmdutil.PrintDryRunWithFile(f.IOStreams.Out, request, config, opts.Format, fileMeta.FieldName, fileMeta.FilePath, fileMeta.FormFields)
 		}
-		return apiDryRun(f, request, config, opts)
+		return apiDryRun(f, request, config, opts.Format)
 	}
 	// Identity info is now included in the JSON envelope; skip stderr printing.
 	// cmdutil.PrintIdentity(f.IOStreams.ErrOut, opts.As, config, f.IdentityAutoDetected)
@@ -304,19 +297,8 @@ func apiRun(opts *APIOptions) error {
 	return nil
 }

-func apiDryRun(f *cmdutil.Factory, request client.RawApiRequest, config *core.CliConfig, opts *APIOptions) error {
-	return cmdutil.PrintDryRun(request, config, dryRunOutputOptions(f, opts))
-}
-
-func dryRunOutputOptions(f *cmdutil.Factory, opts *APIOptions) cmdutil.DryRunOutputOptions {
-	return cmdutil.DryRunOutputOptions{
-		Format:      opts.Format,
-		JqExpr:      opts.JqExpr,
-		CommandPath: opts.Cmd.CommandPath(),
-		Identity:    opts.As,
-		Out:         f.IOStreams.Out,
-		ErrOut:      f.IOStreams.ErrOut,
-	}
+func apiDryRun(f *cmdutil.Factory, request client.RawApiRequest, config *core.CliConfig, format string) error {
+	return cmdutil.PrintDryRun(f.IOStreams.Out, request, config, format)
 }

 func apiPaginate(ctx context.Context, ac *client.APIClient, request client.RawApiRequest, format output.Format, jqExpr string, out, errOut io.Writer, commandPath string, pagOpts client.PaginationOptions) error {
@@ -344,18 +326,20 @@ func apiPaginate(ctx context.Context, ac *client.APIClient, request client.RawAp

 	switch format {
 	case output.FormatNDJSON, output.FormatTable, output.FormatCSV:
-		emitter := output.NewEmitter(output.EmitterConfig{
-			Out:            out,
-			ErrOut:         errOut,
-			CommandPath:    commandPath,
-			Identity:       string(pagOpts.Identity),
-			NoticeProvider: output.GetNotice,
-		})
+		pf := output.NewPaginatedFormatter(out, format)
 		result, hasItems, err := ac.StreamPages(ctx, request, func(items []interface{}) error {
 			// Streaming formats intentionally emit each page after that page has
 			// passed safety scanning. A later page may still fail, so callers
 			// must use the exit code to distinguish complete vs partial output.
-			return emitter.StreamPage(items, output.StreamOptions{Format: format.String()})
+			scanResult := output.ScanForSafety(commandPath, items, errOut)
+			if scanResult.Blocked {
+				return scanResult.BlockErr
+			}
+			if scanResult.Alert != nil {
+				output.WriteAlertWarning(errOut, scanResult.Alert)
+			}
+			pf.FormatPage(items)
+			return nil
 		}, pagOpts)
 		if err != nil {
 			return errs.MarkRaw(err)
--- a/cmd/api/api_paginate_test.go
+++ b/cmd/api/api_paginate_test.go
@@ -1,396 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package api
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"io"
-	"net/http"
-	"testing"
-
-	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/client"
-	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
-	"github.com/larksuite/cli/internal/httpmock"
-	"github.com/larksuite/cli/internal/output"
-)
-
-type apiFailOnWriteWriter struct {
-	buf    bytes.Buffer
-	writes int
-	failAt int
-	err    error
-}
-
-func (w *apiFailOnWriteWriter) Write(p []byte) (int, error) {
-	w.writes++
-	if w.writes == w.failAt {
-		return 0, w.err
-	}
-	return w.buf.Write(p)
-}
-
-func newAPIPaginateTestHarness(t *testing.T) (*client.APIClient, *bytes.Buffer, *bytes.Buffer, *httpmock.Registry) {
-	t.Helper()
-	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
-	t.Setenv("LARKSUITE_CLI_CONTENT_SAFETY_MODE", "off")
-	previousNotice := output.PendingNotice
-	output.PendingNotice = nil
-	t.Cleanup(func() { output.PendingNotice = previousNotice })
-
-	config := &core.CliConfig{
-		AppID:     "test-app",
-		AppSecret: "test-secret",
-		Brand:     core.BrandFeishu,
-	}
-	f, out, errOut, reg := cmdutil.TestFactory(t, config)
-	ac, err := f.NewAPIClientWithConfig(config)
-	if err != nil {
-		t.Fatalf("NewAPIClientWithConfig() error = %v", err)
-	}
-	ac.ErrOut = io.Discard
-	return ac, out, errOut, reg
-}
-
-func apiPaginateRequest() client.RawApiRequest {
-	return client.RawApiRequest{
-		Method: "GET",
-		URL:    "/open-apis/test/v1/items",
-		As:     core.AsBot,
-	}
-}
-
-func assertAPIPaginateJSONBytes(t *testing.T, got []byte, want interface{}) {
-	t.Helper()
-	wantBytes, err := json.MarshalIndent(want, "", "  ")
-	if err != nil {
-		t.Fatalf("marshal expected JSON: %v", err)
-	}
-	wantBytes = append(wantBytes, '\n')
-	if !bytes.Equal(got, wantBytes) {
-		t.Fatalf("stdout bytes mismatch\ngot:\n%s\nwant:\n%s", got, wantBytes)
-	}
-}
-
-func TestAPIPaginate_DefaultAggregatesAllPages(t *testing.T) {
-	ac, out, errOut, reg := newAPIPaginateTestHarness(t)
-	calls := 0
-	wantTokens := []string{"", "next-1", "next-2"}
-	for i, wantToken := range wantTokens {
-		page := i + 1
-		hasMore := page < len(wantTokens)
-		data := map[string]interface{}{
-			"items":    []interface{}{map[string]interface{}{"id": string(rune('0' + page))}},
-			"has_more": hasMore,
-		}
-		if hasMore {
-			data["page_token"] = wantTokens[page]
-		}
-		reg.Register(&httpmock.Stub{
-			URL: "/open-apis/test/v1/items",
-			OnMatch: func(req *http.Request) {
-				calls++
-				if got := req.URL.Query().Get("page_token"); got != wantToken {
-					t.Errorf("request %d page_token = %q, want %q", page, got, wantToken)
-				}
-			},
-			Body: map[string]interface{}{
-				"code": 0,
-				"msg":  "ok",
-				"data": data,
-			},
-		})
-	}
-
-	err := apiPaginate(context.Background(), ac, apiPaginateRequest(),
-		output.FormatJSON, "", out, errOut, "lark-cli api GET", client.PaginationOptions{
-			PageLimit: 10,
-			PageDelay: -1,
-		})
-
-	if err != nil {
-		t.Fatalf("apiPaginate() error = %v, want nil", err)
-	}
-	if calls != 3 {
-		t.Fatalf("pagination requests = %d, want 3", calls)
-	}
-	assertAPIPaginateJSONBytes(t, out.Bytes(), output.Envelope{
-		OK:       true,
-		Identity: "bot",
-		Data: map[string]interface{}{
-			"items": []interface{}{
-				map[string]interface{}{"id": "1"},
-				map[string]interface{}{"id": "2"},
-				map[string]interface{}{"id": "3"},
-			},
-			"has_more": false,
-		},
-	})
-	if got := errOut.String(); got != "" {
-		t.Fatalf("stderr bytes = %q, want empty", got)
-	}
-}
-
-func TestAPIPaginate_StreamingFormatsEmitExactMultiPageBytes(t *testing.T) {
-	tests := []struct {
-		name   string
-		format output.Format
-		want   string
-	}{
-		{
-			name:   "ndjson",
-			format: output.FormatNDJSON,
-			want:   "{\"id\":\"1\",\"name\":\"Alice\"}\n{\"id\":\"2\",\"name\":\"Carol\",\"page_only\":\"ignored\"}\n",
-		},
-		{
-			name:   "table",
-			format: output.FormatTable,
-			want:   "id  name \n──  ─────\n1   Alice\n2   Carol\n",
-		},
-		{
-			name:   "csv",
-			format: output.FormatCSV,
-			want:   "id,name\n1,Alice\n2,Carol\n",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			ac, out, errOut, reg := newAPIPaginateTestHarness(t)
-			reg.Register(&httpmock.Stub{
-				URL: "/open-apis/test/v1/items",
-				Body: map[string]interface{}{
-					"code": 0,
-					"msg":  "ok",
-					"data": map[string]interface{}{
-						"items": []interface{}{
-							map[string]interface{}{"id": "1", "name": "Alice"},
-						},
-						"has_more":   true,
-						"page_token": "next-1",
-					},
-				},
-			})
-			reg.Register(&httpmock.Stub{
-				URL: "/open-apis/test/v1/items",
-				Body: map[string]interface{}{
-					"code": 0,
-					"msg":  "ok",
-					"data": map[string]interface{}{
-						"items": []interface{}{
-							map[string]interface{}{"id": "2", "name": "Carol", "page_only": "ignored"},
-						},
-						"has_more": false,
-					},
-				},
-			})
-
-			err := apiPaginate(context.Background(), ac, apiPaginateRequest(),
-				tt.format, "", out, errOut, "lark-cli api GET", client.PaginationOptions{
-					PageLimit: 10,
-					PageDelay: -1,
-				})
-
-			if err != nil {
-				t.Fatalf("apiPaginate() error = %v, want nil", err)
-			}
-			if got := out.String(); got != tt.want {
-				t.Fatalf("stdout byte mismatch\ngot (%d bytes):\n%q\nwant (%d bytes):\n%q", len(got), got, len(tt.want), tt.want)
-			}
-			if got := errOut.String(); got != "" {
-				t.Fatalf("stderr bytes = %q, want empty", got)
-			}
-		})
-	}
-}
-
-func TestAPIPaginate_StreamingWriteFailureStopsFurtherPages(t *testing.T) {
-	ac, _, errOut, reg := newAPIPaginateTestHarness(t)
-	sentinel := errors.New("page write failed")
-	out := &apiFailOnWriteWriter{failAt: 2, err: sentinel}
-	calls := 0
-	for page := 1; page <= 2; page++ {
-		hasMore := true
-		data := map[string]interface{}{
-			"items":    []interface{}{map[string]interface{}{"id": page}},
-			"has_more": hasMore,
-		}
-		if hasMore {
-			data["page_token"] = fmt.Sprintf("next-%d", page)
-		}
-		reg.Register(&httpmock.Stub{
-			URL: "/open-apis/test/v1/items",
-			OnMatch: func(*http.Request) {
-				calls++
-			},
-			Body: map[string]interface{}{
-				"code": 0,
-				"msg":  "ok",
-				"data": data,
-			},
-		})
-	}
-
-	err := apiPaginate(context.Background(), ac, apiPaginateRequest(),
-		output.FormatNDJSON, "", out, errOut, "lark-cli api GET",
-		client.PaginationOptions{PageLimit: 10, PageDelay: -1})
-
-	if !errors.Is(err, sentinel) {
-		t.Fatalf("apiPaginate() error = %v, want preserved writer cause", err)
-	}
-	problem, ok := errs.ProblemOf(err)
-	if !ok || problem.Category != errs.CategoryInternal {
-		t.Fatalf("apiPaginate() problem = %#v, %v; want internal typed error", problem, ok)
-	}
-	if calls != 2 {
-		t.Fatalf("pagination requests = %d, want 2", calls)
-	}
-	if got, want := out.buf.String(), "{\"id\":1}\n"; got != want {
-		t.Fatalf("stdout bytes = %q, want %q", got, want)
-	}
-}
-
-func TestAPIPaginate_StreamingFormatFallsBackToJSONWithoutList(t *testing.T) {
-	ac, out, errOut, reg := newAPIPaginateTestHarness(t)
-	reg.Register(&httpmock.Stub{
-		URL: "/open-apis/test/v1/items",
-		Body: map[string]interface{}{
-			"code": 0,
-			"msg":  "ok",
-			"data": map[string]interface{}{
-				"name":    "Test User",
-				"user_id": "u123",
-			},
-		},
-	})
-
-	err := apiPaginate(context.Background(), ac, apiPaginateRequest(),
-		output.FormatNDJSON, "", out, errOut, "lark-cli api GET", client.PaginationOptions{PageDelay: -1})
-
-	if err != nil {
-		t.Fatalf("apiPaginate() error = %v, want nil", err)
-	}
-	assertAPIPaginateJSONBytes(t, out.Bytes(), output.Envelope{
-		OK:       true,
-		Identity: "bot",
-		Data: map[string]interface{}{
-			"name":    "Test User",
-			"user_id": "u123",
-		},
-	})
-	wantWarning := "warning: this API does not return a list, format \"ndjson\" is not supported, falling back to json\n"
-	if got := errOut.String(); got != wantWarning {
-		t.Fatalf("stderr bytes = %q, want %q", got, wantWarning)
-	}
-}
-
-func TestAPIPaginate_BusinessErrorsWriteRawAndAreMarkedRaw(t *testing.T) {
-	businessResponse := map[string]interface{}{
-		"code": 123456,
-		"msg":  "fixture business error",
-		"data": map[string]interface{}{"detail": "business failed"},
-	}
-	tests := []struct {
-		name   string
-		format output.Format
-		jqExpr string
-	}{
-		{name: "jq", format: output.FormatJSON, jqExpr: ".data.items"},
-		{name: "default_json", format: output.FormatJSON},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			ac, out, errOut, reg := newAPIPaginateTestHarness(t)
-			reg.Register(&httpmock.Stub{
-				URL:  "/open-apis/test/v1/items",
-				Body: businessResponse,
-			})
-
-			err := apiPaginate(context.Background(), ac, apiPaginateRequest(),
-				tt.format, tt.jqExpr, out, errOut, "lark-cli api GET", client.PaginationOptions{PageDelay: -1})
-
-			if err == nil {
-				t.Fatal("apiPaginate() error = nil, want business error")
-			}
-			if !errs.IsRaw(err) {
-				t.Fatalf("errs.IsRaw(error) = false, want true; error = %T: %v", err, err)
-			}
-			assertAPIPaginateJSONBytes(t, out.Bytes(), businessResponse)
-			if bytes.Contains(out.Bytes(), []byte(`"ok": true`)) {
-				t.Fatalf("business-error stdout contains a success envelope:\n%s", out.Bytes())
-			}
-			if got := errOut.String(); got != "" {
-				t.Fatalf("stderr bytes = %q, want empty", got)
-			}
-		})
-	}
-}
-
-func TestAPIPaginate_TransportErrorsAreMarkedRaw(t *testing.T) {
-	tests := []struct {
-		name   string
-		format output.Format
-		jqExpr string
-	}{
-		{name: "jq_paginate_all", format: output.FormatJSON, jqExpr: ".data.items"},
-		{name: "stream_pages", format: output.FormatNDJSON},
-		{name: "default_paginate_all", format: output.FormatJSON},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			ac, out, errOut, _ := newAPIPaginateTestHarness(t)
-
-			err := apiPaginate(context.Background(), ac, apiPaginateRequest(),
-				tt.format, tt.jqExpr, out, errOut, "lark-cli api GET", client.PaginationOptions{PageDelay: -1})
-
-			if err == nil {
-				t.Fatal("apiPaginate() error = nil, want transport error")
-			}
-			if !errs.IsRaw(err) {
-				t.Fatalf("errs.IsRaw(error) = false, want true; error = %T: %v", err, err)
-			}
-			if got := out.String(); got != "" {
-				t.Fatalf("stdout bytes = %q, want empty", got)
-			}
-			if got := errOut.String(); got != "" {
-				t.Fatalf("stderr bytes = %q, want empty", got)
-			}
-		})
-	}
-}
-
-func TestAPIPaginate_StreamBusinessErrorIsMarkedRaw(t *testing.T) {
-	ac, out, errOut, reg := newAPIPaginateTestHarness(t)
-	reg.Register(&httpmock.Stub{
-		URL: "/open-apis/test/v1/items",
-		Body: map[string]interface{}{
-			"code": 123456,
-			"msg":  "fixture business error",
-			"data": map[string]interface{}{},
-		},
-	})
-
-	err := apiPaginate(context.Background(), ac, apiPaginateRequest(),
-		output.FormatNDJSON, "", out, errOut, "lark-cli api GET", client.PaginationOptions{PageDelay: -1})
-
-	if err == nil {
-		t.Fatal("apiPaginate() error = nil, want business error")
-	}
-	if !errs.IsRaw(err) {
-		t.Fatalf("errs.IsRaw(error) = false, want true; error = %T: %v", err, err)
-	}
-	if got := out.String(); got != "" {
-		t.Fatalf("stdout bytes = %q, want empty", got)
-	}
-	if got := errOut.String(); got != "" {
-		t.Fatalf("stderr bytes = %q, want empty", got)
-	}
-}
--- a/cmd/api/api_test.go
+++ b/cmd/api/api_test.go
@@ -69,7 +69,7 @@ func TestApiCmd_FlagParsing(t *testing.T) {
 }

 func TestApiCmd_DryRun(t *testing.T) {
-	f, stdout, stderr, _ := cmdutil.TestFactory(t, &core.CliConfig{
+	f, stdout, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
 		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
 	})

@@ -79,42 +79,12 @@ func TestApiCmd_DryRun(t *testing.T) {
 	if err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
-	var got map[string]interface{}
-	if err := json.Unmarshal(stdout.Bytes(), &got); err != nil {
-		t.Fatalf("dry-run stdout is not JSON: %v\nstdout:\n%s\nstderr:\n%s", err, stdout.String(), stderr.String())
+	output := stdout.String()
+	if !strings.Contains(output, "Dry Run") {
+		t.Error("expected dry run output")
 	}
-	if got["ok"] != true || got["identity"] != "bot" || got["dry_run"] != true {
-		t.Fatalf("unexpected dry-run envelope: %#v", got)
-	}
-	data, ok := got["data"].(map[string]interface{})
-	if !ok {
-		t.Fatalf("data = %#v, want object", got["data"])
-	}
-	api, ok := data["api"].([]interface{})
-	if !ok || len(api) != 1 {
-		t.Fatalf("api = %#v, want one call", data["api"])
-	}
-	call, ok := api[0].(map[string]interface{})
-	if !ok || call["url"] != "/open-apis/test" {
-		t.Fatalf("api[0] = %#v", api[0])
-	}
-	if strings.Contains(stdout.String(), "=== Dry Run ===") {
-		t.Fatalf("stdout should not contain dry-run banner: %s", stdout.String())
-	}
-}
-
-func TestApiCmd_DryRunWithJq(t *testing.T) {
-	f, stdout, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
-	})
-
-	cmd := newTestApiCmd(f, nil)
-	cmd.SetArgs([]string{"GET", "/open-apis/test", "--as", "bot", "--dry-run", "--jq", ".data.api[0].url"})
-	if err := cmd.Execute(); err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if got := strings.TrimSpace(stdout.String()); got != "/open-apis/test" {
-		t.Fatalf("jq output = %q, want /open-apis/test", got)
+	if !strings.Contains(output, "/open-apis/test") {
+		t.Error("expected path in dry run output")
 	}
 }

@@ -182,22 +152,6 @@ func TestApiCmd_MissingArgs(t *testing.T) {
 	}
 }

-func TestApiCmd_EmptyMethodRejected(t *testing.T) {
-	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
-	})
-
-	cmd := newTestApiCmd(f, nil)
-	cmd.SetArgs([]string{"", "/open-apis/test", "--as", "bot", "--dry-run"})
-	err := cmd.Execute()
-	if err == nil {
-		t.Fatal("expected validation error for empty HTTP method")
-	}
-	if !strings.Contains(err.Error(), "method") {
-		t.Fatalf("error should name the method argument, got: %v", err)
-	}
-}
-
 func TestApiCmd_InvalidParamsJSON(t *testing.T) {
 	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
 		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
@@ -352,9 +306,6 @@ func TestApiCmd_OutputAndPageAllConflict(t *testing.T) {
 }

 func TestApiCmd_BinaryResponse_AutoSave(t *testing.T) {
-	dir := t.TempDir()
-	cmdutil.TestChdir(t, dir)
-
 	f, stdout, stderr, reg := cmdutil.TestFactory(t, &core.CliConfig{
 		AppID: "test-app-bin", AppSecret: "test-secret-bin", Brand: core.BrandFeishu,
 	})
@@ -374,33 +325,8 @@ func TestApiCmd_BinaryResponse_AutoSave(t *testing.T) {
 	if !strings.Contains(stderr.String(), "binary response detected") {
 		t.Error("expected binary response hint in stderr")
 	}
-	var got map[string]interface{}
-	if err := json.Unmarshal(stdout.Bytes(), &got); err != nil {
-		t.Fatalf("stdout is not JSON: %v\nstdout:\n%s", err, stdout.String())
-	}
-	savedPath, _ := got["saved_path"].(string)
-	if savedPath == "" {
-		t.Fatalf("saved_path missing from output: %#v", got)
-	}
-	// The file must land inside the temporary cwd — this pins the isolation
-	// contract: rolling back TestChdir would leave download.bin in the repo.
-	wantDir, err := filepath.EvalSymlinks(dir)
-	if err != nil {
-		t.Fatal(err)
-	}
-	gotDir, err := filepath.EvalSymlinks(filepath.Dir(savedPath))
-	if err != nil {
-		t.Fatalf("saved_path %q dir not resolvable: %v", savedPath, err)
-	}
-	if gotDir != wantDir {
-		t.Errorf("saved_path %q is outside temp cwd %q", savedPath, wantDir)
-	}
-	content, err := os.ReadFile(savedPath)
-	if err != nil {
-		t.Fatalf("read saved file: %v", err)
-	}
-	if string(content) != "fake-binary-content" {
-		t.Errorf("saved file content = %q, want %q", content, "fake-binary-content")
+	if !strings.Contains(stdout.String(), "saved_path") {
+		t.Error("expected saved_path in output")
 	}
 }

@@ -1074,23 +1000,11 @@ func TestApiCmd_DryRunWithFile(t *testing.T) {
 		t.Fatalf("unexpected error: %v", err)
 	}
 	out := stdout.String()
-	var env map[string]interface{}
-	if err := json.Unmarshal(stdout.Bytes(), &env); err != nil {
-		t.Fatalf("dry-run stdout is not JSON: %v\n%s", err, out)
+	if !strings.Contains(out, "image") {
+		t.Errorf("expected dry-run output to mention file field, got: %s", out)
 	}
-	if env["dry_run"] != true {
-		t.Fatalf("dry_run = %#v, want true", env["dry_run"])
-	}
-	data := env["data"].(map[string]interface{})
-	api := data["api"].([]interface{})
-	call := api[0].(map[string]interface{})
-	body := call["body"].(map[string]interface{})
-	file := body["file"].(map[string]interface{})
-	if file["field"] != "image" || file["path"] != tmpFile {
-		t.Fatalf("unexpected file dry-run body: %#v", body)
-	}
-	if strings.Contains(out, "=== Dry Run ===") {
-		t.Fatalf("stdout should not contain dry-run banner: %s", out)
+	if !strings.Contains(out, "Dry Run") {
+		t.Errorf("expected dry-run header, got: %s", out)
 	}
 }

--- a/cmd/auth/auth.go
+++ b/cmd/auth/auth.go
@@ -18,7 +18,6 @@ import (
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/errclass"
-	"github.com/larksuite/cli/internal/runtimeplan"
 )

 // NewCmdAuth creates the auth command with subcommands.
@@ -31,23 +30,21 @@ func NewCmdAuth(f *cmdutil.Factory) *cobra.Command {
 			// PersistentPreRun[E] found walking up the chain, so the root-level
 			// SilenceUsage=true would be skipped without this line.
 			cmd.SilenceUsage = true
-			return f.RequireCommandRuntimeCapabilities(cmd.Context(), cmd)
+			// cmd.Name() returns the subcommand name (e.g. "login"), not "auth".
+			// Pass "auth" as a literal so the error message reads
+			// `"auth" is not supported: ...`
+			return f.RequireBuiltinCredentialProvider(cmd.Context(), "auth")
 		},
 	}
 	cmdutil.DisableAuthCheck(cmd)
-	cmdutil.SetRuntimeCapabilities(cmd, runtimeplan.CapabilityLocalCredentialManagement)

-	login := NewCmdAuthLogin(f, nil)
-	logout := NewCmdAuthLogout(f, nil)
-	status := NewCmdAuthStatus(f, nil)
-	scopes := NewCmdAuthScopes(f, nil)
-	list := NewCmdAuthList(f, nil)
-	check := NewCmdAuthCheck(f, nil)
-	qrcode := NewCmdAuthQRCode(f, nil)
-	for _, diagnostic := range []*cobra.Command{status, scopes, check, qrcode} {
-		cmdutil.SetRuntimeCapabilities(diagnostic)
-	}
-	cmd.AddCommand(login, logout, status, scopes, list, check, qrcode)
+	cmd.AddCommand(NewCmdAuthLogin(f, nil))
+	cmd.AddCommand(NewCmdAuthLogout(f, nil))
+	cmd.AddCommand(NewCmdAuthStatus(f, nil))
+	cmd.AddCommand(NewCmdAuthScopes(f, nil))
+	cmd.AddCommand(NewCmdAuthList(f, nil))
+	cmd.AddCommand(NewCmdAuthCheck(f, nil))
+	cmd.AddCommand(NewCmdAuthQRCode(f, nil))
 	return cmd
 }

--- a/cmd/auth/auth_test.go
+++ b/cmd/auth/auth_test.go
@@ -530,7 +530,10 @@ func TestAuthBlockedByExternalProvider(t *testing.T) {
 	}{
 		{"login", []string{"login"}},
 		{"logout", []string{"logout"}},
+		{"status", []string{"status"}},
+		{"check", []string{"check", "--scope", "calendar:read"}}, // --scope is required
 		{"list", []string{"list"}},
+		{"scopes", []string{"scopes"}},
 	}

 	for _, tt := range tests {
@@ -555,19 +558,3 @@ func TestAuthBlockedByExternalProvider(t *testing.T) {
 		})
 	}
 }
-
-func TestAuthReadOnlyCommandsAllowedByExternalProvider(t *testing.T) {
-	f := newFactoryWithExternalProvider(t)
-	for _, name := range []string{"status", "check", "scopes", "qrcode"} {
-		t.Run(name, func(t *testing.T) {
-			cmd := NewCmdAuth(f)
-			matched, _, err := cmd.Find([]string{name})
-			if err != nil {
-				t.Fatal(err)
-			}
-			if err := cmd.PersistentPreRunE(matched, nil); err != nil {
-				t.Fatalf("read-only command blocked: %v", err)
-			}
-		})
-	}
-}
--- a/cmd/auth/check.go
+++ b/cmd/auth/check.go
@@ -4,7 +4,6 @@
 package auth

 import (
-	"context"
 	"fmt"
 	"strings"

@@ -13,7 +12,6 @@ import (
 	"github.com/larksuite/cli/errs"
 	larkauth "github.com/larksuite/cli/internal/auth"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/credential"
 	"github.com/larksuite/cli/internal/output"
 )

@@ -35,7 +33,7 @@ func NewCmdAuthCheck(f *cmdutil.Factory, runF func(*CheckOptions) error) *cobra.
 			if runF != nil {
 				return runF(opts)
 			}
-			return authCheckRunContext(cmd.Context(), opts)
+			return authCheckRun(opts)
 		},
 	}

@@ -48,10 +46,6 @@ func NewCmdAuthCheck(f *cmdutil.Factory, runF func(*CheckOptions) error) *cobra.
 }

 func authCheckRun(opts *CheckOptions) error {
-	return authCheckRunContext(context.Background(), opts)
-}
-
-func authCheckRunContext(ctx context.Context, opts *CheckOptions) error {
 	f := opts.Factory

 	required := strings.Fields(opts.Scope)
@@ -63,74 +57,18 @@ func authCheckRunContext(ctx context.Context, opts *CheckOptions) error {
 	if err != nil {
 		return err
 	}
-	if f.Credential == nil {
-		return errs.NewInternalError(errs.SubtypeUnknown, "credential inspection is unavailable")
-	}
-
-	inspection, err := f.Credential.InspectToken(ctx, credential.TokenInspectionRequest{
-		TokenSpec: credential.TokenSpec{
-			Type:  credential.TokenTypeUAT,
-			AppID: config.AppID,
-		},
-		IncludeScopes: true,
-	})
-	if err != nil {
-		if _, ok := errs.ProblemOf(err); ok {
-			return err
-		}
-		return errs.NewInternalError(errs.SubtypeUnknown,
-			"failed to inspect user authorization: %v", err).
-			WithCause(err)
-	}
-	if inspection == nil {
-		return errs.NewInternalError(errs.SubtypeInvalidResponse,
-			"credential source returned no authorization inspection")
-	}
-
-	if inspection.Status == credential.TokenInspectionNotLoggedIn && !inspection.Source.Managed {
+	if config.UserOpenId == "" {
 		output.PrintJson(f.IOStreams.Out, map[string]interface{}{"ok": false, "error": "not_logged_in", "missing": required})
 		return output.ErrBare(1)
 	}
-	if !inspection.Present {
-		if inspection.Source.Managed {
-			return errs.NewAuthenticationError(errs.SubtypeTokenMissing,
-				"credential source %q did not provide a user access token", inspection.Source.Name).
-				WithHint("authorize the user through the selected credential source")
-		}
+
+	stored := larkauth.GetStoredToken(config.AppID, config.UserOpenId)
+	if stored == nil {
 		output.PrintJson(f.IOStreams.Out, map[string]interface{}{"ok": false, "error": "no_token", "missing": required})
 		return output.ErrBare(1)
 	}

-	switch inspection.ScopeState {
-	case credential.ScopeUnsupported:
-		return errs.NewValidationError(errs.SubtypeFailedPrecondition,
-			"auth check is unsupported by credential source %q because granted scopes are unavailable", inspection.Source.Name).
-			WithHint("the credential source must expose trusted scope metadata before `auth check` can evaluate --scope")
-	case credential.ScopeUnknown:
-		return errs.NewValidationError(errs.SubtypeFailedPrecondition,
-			"auth check result is unknown because credential source %q returned no scope metadata", inspection.Source.Name).
-			WithHint("configure the credential source to return trusted scopes for user access tokens")
-	case credential.ScopeKnown:
-		// Continue below.
-	default:
-		return errs.NewInternalError(errs.SubtypeInvalidResponse,
-			"credential source %q returned invalid scope inspection state %q", inspection.Source.Name, inspection.ScopeState)
-	}
-
-	suggestion := ""
-	missing := larkauth.MissingScopes(inspection.Scopes, required)
-	if inspection.Source.Managed {
-		if len(missing) > 0 {
-			suggestion = fmt.Sprintf("grant these scopes through credential source %s: %s", inspection.Source.Name, strings.Join(missing, " "))
-		}
-	} else {
-		suggestion = fmt.Sprintf(`lark-cli auth login --scope "%s"`, strings.Join(missing, " "))
-	}
-	return writeAuthCheckResult(f, required, inspection.Scopes, suggestion)
-}
-
-func writeAuthCheckResult(f *cmdutil.Factory, required []string, availableScopes, suggestion string) error {
-	missing := larkauth.MissingScopes(availableScopes, required)
+	missing := larkauth.MissingScopes(stored.Scope, required)
 	missingSet := make(map[string]bool, len(missing))
 	for _, s := range missing {
 		missingSet[s] = true
@@ -144,8 +82,8 @@ func writeAuthCheckResult(f *cmdutil.Factory, required []string, availableScopes

 	ok := len(missing) == 0
 	result := map[string]interface{}{"ok": ok, "granted": granted, "missing": missing}
-	if len(missing) > 0 && suggestion != "" {
-		result["suggestion"] = suggestion
+	if len(missing) > 0 {
+		result["suggestion"] = fmt.Sprintf(`lark-cli auth login --scope "%s"`, strings.Join(missing, " "))
 	}
 	output.PrintJson(f.IOStreams.Out, result)
 	if !ok {
--- a/cmd/auth/check_test.go
+++ b/cmd/auth/check_test.go
@@ -4,20 +4,14 @@
 package auth

 import (
-	"bytes"
-	"context"
 	"encoding/json"
 	"errors"
-	"strings"
 	"testing"
 	"time"

-	"github.com/larksuite/cli/errs"
-	extcred "github.com/larksuite/cli/extension/credential"
 	larkauth "github.com/larksuite/cli/internal/auth"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
-	"github.com/larksuite/cli/internal/credential"
 	"github.com/larksuite/cli/internal/output"
 	"github.com/zalando/go-keyring"
 )
@@ -152,128 +146,6 @@ func TestAuthCheckRun_ScopedTokenPresent_ExitZero(t *testing.T) {
 	}
 }

-type authCheckExternalProvider struct {
-	token        *extcred.Token
-	capabilities credential.ProviderCapabilities
-	resolveCalls int
-}
-
-func (p *authCheckExternalProvider) Name() string { return "external-check-test" }
-
-func (p *authCheckExternalProvider) ResolveAccount(context.Context) (*extcred.Account, error) {
-	return &extcred.Account{AppID: "test-app", Brand: extcred.BrandFeishu}, nil
-}
-
-func (p *authCheckExternalProvider) ResolveToken(context.Context, extcred.TokenSpec) (*extcred.Token, error) {
-	p.resolveCalls++
-	return p.token, nil
-}
-
-func (p *authCheckExternalProvider) CredentialCapabilities() credential.ProviderCapabilities {
-	return p.capabilities
-}
-
-func externalAuthCheckFactory(t *testing.T, canInspectScopes bool, token *extcred.Token) (*cmdutil.Factory, *authCheckExternalProvider) {
-	t.Helper()
-	cfg := &core.CliConfig{
-		AppID: "test-app",
-		Brand: core.BrandFeishu,
-	}
-	f, _, _, _ := cmdutil.TestFactory(t, cfg)
-	provider := &authCheckExternalProvider{
-		token: token,
-		capabilities: credential.ProviderCapabilities{
-			ProvidesOnDemandAuth: true,
-			CanInspectScopes:     canInspectScopes,
-		},
-	}
-	f.Credential = credential.NewCredentialProvider(
-		[]extcred.Provider{provider},
-		nil,
-		nil,
-		nil,
-	)
-	return f, provider
-}
-
-func TestAuthCheckRun_ExternalDirectUsesProviderScopes(t *testing.T) {
-	f, provider := externalAuthCheckFactory(t, true, &extcred.Token{
-		Value:  "external-uat",
-		Scopes: "im:message docx:document",
-	})
-	stdout := f.IOStreams.Out.(*bytes.Buffer)
-
-	err := authCheckRun(&CheckOptions{
-		Factory: f,
-		Scope:   "im:message",
-	})
-	if err != nil {
-		t.Fatalf("authCheckRun() error = %v", err)
-	}
-	if provider.resolveCalls != 1 {
-		t.Fatalf("ResolveToken calls = %d, want 1", provider.resolveCalls)
-	}
-
-	var payload map[string]any
-	if err := json.Unmarshal(stdout.Bytes(), &payload); err != nil {
-		t.Fatalf("stdout must be valid JSON: %v\nstdout=%s", err, stdout.String())
-	}
-	if payload["ok"] != true {
-		t.Fatalf("stdout.ok = %v, want true; payload=%v", payload["ok"], payload)
-	}
-	granted, ok := payload["granted"].([]any)
-	if !ok || len(granted) != 1 || granted[0] != "im:message" {
-		t.Fatalf("stdout.granted = %v, want [im:message]", payload["granted"])
-	}
-}
-
-func TestAuthCheckRun_ExternalProxyReturnsTypedUnknown(t *testing.T) {
-	f, provider := externalAuthCheckFactory(t, false, &extcred.Token{
-		Value: "proxy-placeholder",
-	})
-
-	err := authCheckRun(&CheckOptions{
-		Factory: f,
-		Scope:   "im:message",
-	})
-	problem, ok := errs.ProblemOf(err)
-	if !ok {
-		t.Fatalf("error = %T %v, want typed error", err, err)
-	}
-	if problem.Category != errs.CategoryValidation || problem.Subtype != errs.SubtypeFailedPrecondition {
-		t.Fatalf("problem = %#v, want validation/failed_precondition", problem)
-	}
-	var validation *errs.ValidationError
-	if !errors.As(err, &validation) || !strings.Contains(problem.Message, "unsupported") || validation.Param != "" || problem.Hint == "" {
-		t.Fatalf("problem = %#v, want explicit unsupported result with actionable hint and no param", problem)
-	}
-	if provider.resolveCalls != 0 {
-		t.Fatalf("ResolveToken calls = %d, want 0 for proxy scope check", provider.resolveCalls)
-	}
-}
-
-func TestAuthCheckRun_ExternalDirectWithoutScopeMetadataReturnsTypedUnknown(t *testing.T) {
-	f, _ := externalAuthCheckFactory(t, true, &extcred.Token{
-		Value: "external-uat",
-	})
-
-	err := authCheckRun(&CheckOptions{
-		Factory: f,
-		Scope:   "im:message",
-	})
-	problem, ok := errs.ProblemOf(err)
-	if !ok {
-		t.Fatalf("error = %T %v, want typed error", err, err)
-	}
-	if problem.Category != errs.CategoryValidation || problem.Subtype != errs.SubtypeFailedPrecondition {
-		t.Fatalf("problem = %#v, want validation/failed_precondition", problem)
-	}
-	var validation *errs.ValidationError
-	if !errors.As(err, &validation) || !strings.Contains(problem.Message, "unknown") || validation.Param != "" || problem.Hint == "" {
-		t.Fatalf("problem = %#v, want explicit unknown result with actionable hint and no param", problem)
-	}
-}
-
 func TestAuthCheckRun_EmptyScopeIsValidationError(t *testing.T) {
 	// Scope validation is a real input error, not a predicate negative
 	// answer — it must surface as a typed ValidationError with the normal
--- a/cmd/auth/login_messages.go
+++ b/cmd/auth/login_messages.go
@@ -128,5 +128,5 @@ func getLoginMsg(lang i18n.Lang) *loginMsg {
 // (not backed by from_meta service specs). Descriptions are now centralized in
 // service_descriptions.json.
 func getShortcutOnlyDomainNames() []string {
-	return []string{"application", "base", "contact", "docs", "markdown", "apps", "note"}
+	return []string{"base", "contact", "docs", "markdown", "apps", "note"}
 }
--- a/cmd/auth/qrcode.go
+++ b/cmd/auth/qrcode.go
@@ -56,7 +56,6 @@ For ASCII output, the result is printed to stdout with fixed size.`,
 	cmd.Flags().IntVar(&opts.Size, "size", 256, "Size of the QR code image in pixels (default: 256, for PNG mode only)")
 	cmd.Flags().BoolVar(&opts.ASCII, "ascii", false, "Output ASCII QR code to stdout")
 	cmd.Flags().StringVarP(&opts.Output, "output", "o", "", "Output file path for PNG image (relative path within current directory, required for non-ASCII mode)")
-	cmdutil.SetRisk(cmd, "read")

 	return cmd
 }
--- a/cmd/auth/status.go
+++ b/cmd/auth/status.go
@@ -44,10 +44,6 @@ func NewCmdAuthStatus(f *cmdutil.Factory, runF func(*StatusOptions) error) *cobr

 func authStatusRun(opts *StatusOptions) error {
 	f := opts.Factory
-	editionStatus, err := inspectEditionStatus(f)
-	if err != nil {
-		return err
-	}

 	config, err := f.Config()
 	if err != nil {
@@ -68,9 +64,7 @@ func authStatusRun(opts *StatusOptions) error {
 	result["identities"] = diagnostics
 	result["identity"] = effectiveIdentity(diagnostics)
 	addEffectiveVerification(result, diagnostics)
-	if !applyEditionStatus(result, diagnostics, editionStatus) {
-		addStatusNote(result, diagnostics)
-	}
+	addStatusNote(result, diagnostics)

 	output.PrintJson(f.IOStreams.Out, result)
 	return nil
--- a/cmd/auth/status_edition_extended.go
+++ b/cmd/auth/status_edition_extended.go
@@ -1,58 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-//go:build extended
-
-package auth
-
-import (
-	"context"
-
-	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/identitydiag"
-)
-
-type editionStatusState struct {
-	provider string
-	variant  string
-}
-
-func inspectEditionStatus(f *cmdutil.Factory) (editionStatusState, error) {
-	if f == nil || f.Credential == nil {
-		return editionStatusState{}, nil
-	}
-	source, err := f.Credential.InspectSource(context.Background())
-	if err != nil {
-		return editionStatusState{}, err
-	}
-	if source == nil || !source.Managed {
-		return editionStatusState{}, nil
-	}
-	state := editionStatusState{provider: source.Name}
-	description := f.RuntimeDescription()
-	if description.Managed {
-		state.variant = description.Variant
-	}
-	return state, nil
-}
-
-func applyEditionStatus(result map[string]interface{}, diagnostics identitydiag.Result, state editionStatusState) bool {
-	if state.provider == "" {
-		return false
-	}
-	result["source"] = "external"
-	result["credentialProvider"] = state.provider
-	if state.variant != "" {
-		result["externalCredentialMode"] = state.variant
-	}
-	switch {
-	case !diagnostics.User.Available && diagnostics.Bot.Available:
-		result["note"] = "User identity is " + identitydiag.StatusMessage(diagnostics.User.Status) +
-			"; bot identity is ready. Update authorization through external credential provider " + state.provider + "."
-	case diagnostics.User.Status == identitydiag.StatusNeedsRefresh:
-		result["note"] = "User identity needs refresh. Check external credential provider " + state.provider + "."
-	case !diagnostics.User.Available && !diagnostics.Bot.Available:
-		result["note"] = "No usable identity is available. Check external credential provider " + state.provider + "."
-	}
-	return true
-}
--- a/cmd/auth/status_edition_extended_test.go
+++ b/cmd/auth/status_edition_extended_test.go
@@ -1,54 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-//go:build extended
-
-package auth
-
-import (
-	"encoding/json"
-	"strings"
-	"testing"
-
-	extcred "github.com/larksuite/cli/extension/credential"
-	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
-	"github.com/larksuite/cli/internal/credential"
-	"github.com/larksuite/cli/internal/runtimeplan"
-)
-
-func TestExtendedAuthStatusReportsManagedSource(t *testing.T) {
-	cfg := &core.CliConfig{
-		AppID: "cli_env", Brand: core.BrandFeishu, DefaultAs: core.AsBot,
-		SupportedIdentities: uint8(extcred.SupportsBot),
-	}
-	f, stdout, _, _ := cmdutil.TestFactory(t, cfg)
-	f.Credential = credential.NewCredentialProvider(
-		[]extcred.Provider{&stubExternalProvider{name: "env"}},
-		nil, nil, f.HttpClient,
-	)
-	cmdutil.TestSetRuntimePlan(t, f, runtimeplan.New(runtimeplan.Options{
-		Description: runtimeplan.Description{
-			Managed: true,
-			Variant: "managed-test",
-		},
-	}))
-
-	if err := authStatusRun(&StatusOptions{Factory: f}); err != nil {
-		t.Fatal(err)
-	}
-	var got map[string]interface{}
-	if err := json.Unmarshal(stdout.Bytes(), &got); err != nil {
-		t.Fatal(err)
-	}
-	if got["source"] != "external" ||
-		got["credentialProvider"] != "env" ||
-		got["externalCredentialMode"] != "managed-test" ||
-		got["identity"] != "bot" {
-		t.Fatalf("output = %#v", got)
-	}
-	if note, _ := got["note"].(string); strings.Contains(note, "auth login") ||
-		!strings.Contains(note, "external credential provider env") {
-		t.Fatalf("note = %q", note)
-	}
-}
--- a/cmd/auth/status_edition_standard.go
+++ b/cmd/auth/status_edition_standard.go
@@ -1,21 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-//go:build !extended
-
-package auth
-
-import (
-	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/identitydiag"
-)
-
-type editionStatusState struct{}
-
-func inspectEditionStatus(*cmdutil.Factory) (editionStatusState, error) {
-	return editionStatusState{}, nil
-}
-
-func applyEditionStatus(map[string]interface{}, identitydiag.Result, editionStatusState) bool {
-	return false
-}
--- a/cmd/auth/status_edition_standard_test.go
+++ b/cmd/auth/status_edition_standard_test.go
@@ -1,49 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-//go:build !extended
-
-package auth
-
-import (
-	"encoding/json"
-	"strings"
-	"testing"
-
-	extcred "github.com/larksuite/cli/extension/credential"
-	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
-	"github.com/larksuite/cli/internal/credential"
-)
-
-func TestStandardAuthStatusPreservesExistingProjection(t *testing.T) {
-	cfg := &core.CliConfig{
-		AppID: "cli_env", Brand: core.BrandFeishu, DefaultAs: core.AsBot,
-		SupportedIdentities: uint8(extcred.SupportsBot),
-	}
-	f, stdout, _, _ := cmdutil.TestFactory(t, cfg)
-	f.Credential = credential.NewCredentialProvider(
-		[]extcred.Provider{&stubExternalProvider{name: "env"}},
-		nil, nil, f.HttpClient,
-	)
-
-	if err := authStatusRun(&StatusOptions{Factory: f}); err != nil {
-		t.Fatal(err)
-	}
-	var got map[string]json.RawMessage
-	if err := json.Unmarshal(stdout.Bytes(), &got); err != nil {
-		t.Fatal(err)
-	}
-	for _, field := range []string{"source", "credentialProvider", "externalCredentialMode"} {
-		if _, exists := got[field]; exists {
-			t.Fatalf("Standard auth status contains edition field %q: %s", field, stdout.String())
-		}
-	}
-	var note string
-	if err := json.Unmarshal(got["note"], &note); err != nil {
-		t.Fatal(err)
-	}
-	if !strings.Contains(note, "lark-cli auth login") {
-		t.Fatalf("Standard note = %q, want established login guidance", note)
-	}
-}
--- a/cmd/auth/status_test.go
+++ b/cmd/auth/status_test.go
@@ -35,15 +35,6 @@ func TestAuthStatusRun_SplitsBotAndUserIdentity(t *testing.T) {
 	if got.Identities.User.Status != "missing" || got.Identities.User.Available {
 		t.Fatalf("user = %#v, want missing and unavailable", got.Identities.User)
 	}
-	var raw map[string]json.RawMessage
-	if err := json.Unmarshal(stdout.Bytes(), &raw); err != nil {
-		t.Fatalf("json.Unmarshal(raw) error = %v", err)
-	}
-	for _, field := range []string{"source", "credentialProvider", "externalCredentialMode"} {
-		if _, exists := raw[field]; exists {
-			t.Fatalf("local auth status unexpectedly contains edition field %q: %s", field, stdout.String())
-		}
-	}
 }

 func TestAuthStatusRun_VerifyReportsBotIdentity(t *testing.T) {
--- a/cmd/auth/testmain_test.go
+++ b/cmd/auth/testmain_test.go
@@ -1,46 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package auth
-
-import (
-	"os"
-	"path/filepath"
-	"testing"
-
-	"github.com/larksuite/cli/internal/registry/registrytest"
-)
-
-// TestMain isolates auth command tests from the host machine: config, logs
-// and the registry cache are redirected to a temp dir, then the registry is
-// seeded from the tracked fixture and initialized eagerly. Domain-completion
-// tests read the registry, so without seeding a clean checkout would either
-// fail or trigger a remote metadata fetch.
-//
-// Note: os.Exit skips deferred functions, so cleanup runs explicitly after
-// m.Run before exiting.
-func TestMain(m *testing.M) {
-	root, err := os.MkdirTemp("", "lark-cli-cmd-auth-test-*")
-	if err != nil {
-		println("cmd/auth test setup: MkdirTemp failed:", err.Error())
-		os.Exit(2)
-	}
-	if err := os.Setenv("LARKSUITE_CLI_CONFIG_DIR", filepath.Join(root, "config")); err != nil {
-		println("cmd/auth test setup: Setenv failed:", err.Error())
-		os.RemoveAll(root)
-		os.Exit(2)
-	}
-	if err := os.Setenv("LARKSUITE_CLI_LOG_DIR", filepath.Join(root, "logs")); err != nil {
-		println("cmd/auth test setup: Setenv failed:", err.Error())
-		os.RemoveAll(root)
-		os.Exit(2)
-	}
-	if err := registrytest.Seed(root); err != nil {
-		println("cmd/auth test setup: registrytest.Seed failed:", err.Error())
-		os.RemoveAll(root)
-		os.Exit(2)
-	}
-	code := m.Run()
-	_ = os.RemoveAll(root)
-	os.Exit(code)
-}
--- a/cmd/build.go
+++ b/cmd/build.go
@@ -29,7 +29,6 @@ import (
 	"github.com/larksuite/cli/internal/hook"
 	"github.com/larksuite/cli/internal/keychain"
 	"github.com/larksuite/cli/internal/registry"
-	"github.com/larksuite/cli/internal/runtimebootstrap"
 	"github.com/larksuite/cli/shortcuts"
 	"github.com/spf13/cobra"
 )
@@ -46,7 +45,6 @@ type buildConfig struct {
 	skipService    bool
 	serviceCatalog *apicatalog.Catalog
 	startupBrand   core.LarkBrand
-	runtime        *runtimebootstrap.Result
 }

 // WithStartupBrand initializes the API registry with the given brand before
@@ -60,14 +58,6 @@ func WithStartupBrand(brand core.LarkBrand) BuildOption {
 	}
 }

-// withRuntimeBootstrap shares one invocation snapshot across registry,
-// credentials, transports, and command capabilities.
-func withRuntimeBootstrap(runtime *runtimebootstrap.Result) BuildOption {
-	return func(c *buildConfig) {
-		c.runtime = runtime
-	}
-}
-
 // WithIO sets the IO streams for the CLI by wrapping raw reader/writers.
 // Terminal detection is delegated to cmdutil.NewIOStreams.
 func WithIO(in io.Reader, out, errOut io.Writer) BuildOption {
@@ -153,9 +143,9 @@ func Build(ctx context.Context, inv cmdutil.InvocationContext, opts ...BuildOpti
 	return rootCmd
 }

-// buildInternal assembles the command tree from one immutable startup
-// configuration snapshot. Profile selection happens before any registry
-// network decision and the same result is passed to the Factory.
+// buildInternal is a pure assembly function: it wires the command tree from
+// inv and BuildOptions alone. Any state-dependent decision (disk, network,
+// env) belongs in the caller and must be threaded in via BuildOption.
 //
 // Returns (factory, rootCmd, registry). The registry is nil when plugin
 // install failed (FailClosed guard installed) or when no plugin produced
@@ -178,29 +168,13 @@ func buildInternal(ctx context.Context, inv cmdutil.InvocationContext, opts ...B
 		cfg.streams = cmdutil.SystemIO()
 	}

-	startup := cfg.runtime
-	if startup == nil {
-		startup = runtimebootstrap.Resolve(inv.Profile)
-	}
-
 	// Initialize the registry brand before anything touches the runtime
 	// catalog (its sync.Once would otherwise lock onto the Feishu default).
-	// Runtime policy can close direct metadata egress before any command is
-	// registered, without exposing a concrete credential mode here.
-	registryBrand := cfg.startupBrand
-	if registryBrand == "" {
-		registryBrand = resolveStartupBrandFromConfig(inv.Profile, startup.ProfileConfig)
-	}
-	if !startup.Plan.AllowsRemoteMetadata() {
-		if registryBrand == "" {
-			registryBrand = core.BrandFeishu
-		}
-		registry.InitEmbeddedWithBrand(registryBrand)
-	} else if registryBrand != "" {
-		registry.InitWithBrand(registryBrand)
+	if cfg.startupBrand != "" {
+		registry.InitWithBrand(cfg.startupBrand)
 	}

-	f := cmdutil.NewDefaultWithRuntimePlan(cfg.streams, inv, startup.ProfileConfig, startup.Plan)
+	f := cmdutil.NewDefault(cfg.streams, inv)
 	if cfg.keychain != nil {
 		f.Keychain = cfg.keychain
 	}
@@ -246,7 +220,6 @@ func buildInternal(ctx context.Context, inv cmdutil.InvocationContext, opts ...B
 	rootCmd.AddCommand(schema.NewCmdSchema(f, nil))
 	rootCmd.AddCommand(completion.NewCmdCompletion(f))
 	rootCmd.AddCommand(cmdupdate.NewCmdUpdate(f))
-	registerEditionCommands(rootCmd, f)
 	rootCmd.AddCommand(cmdevent.NewCmdEvents(f))
 	rootCmd.AddCommand(skill.NewCmdSkill(f))
 	if !cfg.skipService {
--- a/cmd/build_workspace_test.go
+++ b/cmd/build_workspace_test.go
@@ -1,176 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package cmd
-
-import (
-	"context"
-	"io"
-	"path/filepath"
-	"strings"
-	"testing"
-
-	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
-	"github.com/larksuite/cli/internal/envvars"
-)
-
-func TestStartupProfileSnapshotUsesDetectedWorkspace(t *testing.T) {
-	previousWorkspace := core.CurrentWorkspace()
-	t.Cleanup(func() { core.SetCurrentWorkspace(previousWorkspace) })
-
-	tests := []struct {
-		name          string
-		workspace     core.Workspace
-		signalName    string
-		signalValue   string
-		expectedAppID string
-		expectedBrand core.LarkBrand
-	}{
-		{
-			name:          "local",
-			workspace:     core.WorkspaceLocal,
-			expectedAppID: "cli_local",
-			expectedBrand: core.BrandFeishu,
-		},
-		{
-			name:          "openclaw",
-			workspace:     core.WorkspaceOpenClaw,
-			signalName:    "OPENCLAW_CLI",
-			signalValue:   "1",
-			expectedAppID: "cli_openclaw",
-			expectedBrand: core.BrandLark,
-		},
-		{
-			name:          "hermes",
-			workspace:     core.WorkspaceHermes,
-			signalName:    "HERMES_HOME",
-			signalValue:   "/managed/hermes",
-			expectedAppID: "cli_hermes",
-			expectedBrand: core.BrandLark,
-		},
-		{
-			name:          "lark_channel",
-			workspace:     core.WorkspaceLarkChannel,
-			signalName:    "LARK_CHANNEL",
-			signalValue:   "1",
-			expectedAppID: "cli_lark_channel",
-			expectedBrand: core.BrandLark,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			clearWorkspaceSignals(t)
-			clearCredentialSignals(t)
-			configRoot := t.TempDir()
-			t.Setenv("LARKSUITE_CLI_CONFIG_DIR", configRoot)
-			t.Setenv(envvars.CliExternalCredentialConfig,
-				filepath.Join(configRoot, "missing-external-credential.json"))
-			t.Setenv("LARKSUITE_CLI_REMOTE_META", "off")
-			if tt.signalName != "" {
-				t.Setenv(tt.signalName, tt.signalValue)
-			}
-
-			writeWorkspaceProfile(t, core.WorkspaceLocal, "local", "cli_local", core.BrandFeishu)
-			if !tt.workspace.IsLocal() {
-				writeWorkspaceProfile(t, tt.workspace, tt.name, tt.expectedAppID, tt.expectedBrand)
-			}
-
-			// Execute resolves the registry brand before entering
-			// buildInternal. Pin that ordering independently.
-			core.SetCurrentWorkspace(core.WorkspaceLocal)
-			if got := selectInvocationWorkspace(); got != tt.workspace {
-				t.Fatalf("selected workspace = %q, want %q", got, tt.workspace)
-			}
-			if got := ResolveStartupBrand(""); got != tt.expectedBrand {
-				t.Fatalf("startup brand = %q, want %q", got, tt.expectedBrand)
-			}
-
-			// Build/buildInternal is also a public construction path. Reset the
-			// process state to local so the test proves it establishes the
-			// workspace before SelectProfile captures the immutable snapshot.
-			core.SetCurrentWorkspace(core.WorkspaceLocal)
-			factory, _, _ := buildInternal(
-				context.Background(),
-				cmdutil.InvocationContext{},
-				WithIO(strings.NewReader(""), io.Discard, io.Discard),
-				WithoutPlugins(),
-				WithoutServiceCommands(),
-			)
-			if got := core.CurrentWorkspace(); got != tt.workspace {
-				t.Fatalf("workspace after build = %q, want %q", got, tt.workspace)
-			}
-			config, err := factory.Config()
-			if err != nil {
-				t.Fatalf("Factory.Config() error = %v", err)
-			}
-			if config.AppID != tt.expectedAppID || config.Brand != tt.expectedBrand {
-				t.Fatalf("resolved config = app %q (%s), want app %q (%s)",
-					config.AppID, config.Brand, tt.expectedAppID, tt.expectedBrand)
-			}
-		})
-	}
-}
-
-func clearWorkspaceSignals(t *testing.T) {
-	t.Helper()
-	for _, name := range []string{
-		"OPENCLAW_CLI",
-		"OPENCLAW_HOME",
-		"OPENCLAW_STATE_DIR",
-		"OPENCLAW_CONFIG_PATH",
-		"OPENCLAW_SERVICE_MARKER",
-		"OPENCLAW_SERVICE_VERSION",
-		"OPENCLAW_GATEWAY_PORT",
-		"OPENCLAW_SHELL",
-		"HERMES_HOME",
-		"HERMES_QUIET",
-		"HERMES_EXEC_ASK",
-		"HERMES_GATEWAY_TOKEN",
-		"HERMES_SESSION_KEY",
-		"LARK_CHANNEL",
-	} {
-		t.Setenv(name, "")
-	}
-}
-
-func clearCredentialSignals(t *testing.T) {
-	t.Helper()
-	for _, name := range []string{
-		envvars.CliAppID,
-		envvars.CliAppSecret,
-		envvars.CliBrand,
-		envvars.CliUserAccessToken,
-		envvars.CliTenantAccessToken,
-		envvars.CliDefaultAs,
-		envvars.CliStrictMode,
-	} {
-		t.Setenv(name, "")
-	}
-}
-
-func writeWorkspaceProfile(
-	t *testing.T,
-	workspace core.Workspace,
-	name string,
-	appID string,
-	brand core.LarkBrand,
-) {
-	t.Helper()
-	previous := core.CurrentWorkspace()
-	core.SetCurrentWorkspace(workspace)
-	defer core.SetCurrentWorkspace(previous)
-	if err := core.SaveMultiAppConfig(&core.MultiAppConfig{
-		CurrentApp: name,
-		Apps: []core.AppConfig{{
-			Name:      name,
-			AppId:     appID,
-			AppSecret: core.PlainSecret("test-secret-" + name),
-			Brand:     brand,
-			Users:     []core.AppUser{},
-		}},
-	}); err != nil {
-		t.Fatalf("save %s workspace profile: %v", workspace.Display(), err)
-	}
-}
--- a/cmd/config/config.go
+++ b/cmd/config/config.go
@@ -6,7 +6,6 @@ package config
 import (
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
-	"github.com/larksuite/cli/internal/runtimeplan"
 	"github.com/spf13/cobra"
 )

@@ -20,38 +19,21 @@ func NewCmdConfig(f *cmdutil.Factory) *cobra.Command {
 			// PersistentPreRun[E] found walking up the chain, so the root-level
 			// SilenceUsage=true would be skipped without this line.
 			cmd.SilenceUsage = true
-			return f.RequireCommandRuntimeCapabilities(cmd.Context(), cmd)
+			// Pass "config" as a literal — cmd.Name() would return the subcommand name.
+			return f.RequireBuiltinCredentialProvider(cmd.Context(), "config")
 		},
 	}
 	cmdutil.DisableAuthCheck(cmd)
-	cmdutil.SetRuntimeCapabilities(cmd, runtimeplan.CapabilityLocalCredentialManagement)

-	initCmd := NewCmdConfigInit(f, nil)
-	bind := NewCmdConfigBind(f, nil)
-	remove := NewCmdConfigRemove(f, nil)
-	show := NewCmdConfigShow(f, nil)
-	defaultAs := NewCmdConfigDefaultAs(f)
-	strictMode := NewCmdConfigStrictMode(f)
-	riskControl := NewCmdConfigRiskControl(f)
-	policy := NewCmdConfigPolicy(f)
-	plugins := NewCmdConfigPlugins(f)
-	keychainDowngrade := NewCmdConfigKeychainDowngrade(f)
-	// Identity preferences live in the Profile, but external providers have
-	// historically treated these config commands as credential management.
-	// Check Profile ownership first so a managed runtime gives the actionable
-	// deployment-managed Profile error, then retain the credential capability
-	// so Standard external-provider behavior stays unchanged.
-	for _, identitySetting := range []*cobra.Command{defaultAs, strictMode} {
-		cmdutil.SetRuntimeCapabilities(
-			identitySetting,
-			runtimeplan.CapabilityLocalProfileMutation,
-			runtimeplan.CapabilityLocalCredentialManagement,
-		)
-	}
-	for _, sourceNeutral := range []*cobra.Command{show, riskControl, policy, plugins} {
-		cmdutil.SetRuntimeCapabilities(sourceNeutral)
-	}
-	cmd.AddCommand(initCmd, bind, remove, show, defaultAs, strictMode, riskControl, policy, plugins, keychainDowngrade)
+	cmd.AddCommand(NewCmdConfigInit(f, nil))
+	cmd.AddCommand(NewCmdConfigBind(f, nil))
+	cmd.AddCommand(NewCmdConfigRemove(f, nil))
+	cmd.AddCommand(NewCmdConfigShow(f, nil))
+	cmd.AddCommand(NewCmdConfigDefaultAs(f))
+	cmd.AddCommand(NewCmdConfigStrictMode(f))
+	cmd.AddCommand(NewCmdConfigPolicy(f))
+	cmd.AddCommand(NewCmdConfigPlugins(f))
+	cmd.AddCommand(NewCmdConfigKeychainDowngrade(f))
 	return cmd
 }

--- a/cmd/config/config_test.go
+++ b/cmd/config/config_test.go
@@ -20,7 +20,6 @@ import (
 	"github.com/larksuite/cli/internal/i18n"
 	"github.com/larksuite/cli/internal/keychain"
 	"github.com/larksuite/cli/internal/output"
-	"github.com/larksuite/cli/internal/runtimeplan"
 )

 type noopConfigKeychain struct{}
@@ -453,16 +452,10 @@ func TestUpdateExistingProfileWithoutSecret_RejectsAppIDChange(t *testing.T) {
 }

 // stubConfigExtProvider simulates env/sidecar credential mode for config guard tests.
-type stubConfigExtProvider struct {
-	name string
-	err  error
-}
+type stubConfigExtProvider struct{ name string }

 func (s *stubConfigExtProvider) Name() string { return s.name }
 func (s *stubConfigExtProvider) ResolveAccount(_ context.Context) (*extcred.Account, error) {
-	if s.err != nil {
-		return nil, s.err
-	}
 	return &extcred.Account{AppID: "test-app"}, nil
 }
 func (s *stubConfigExtProvider) ResolveToken(_ context.Context, _ extcred.TokenSpec) (*extcred.Token, error) {
@@ -488,6 +481,7 @@ func TestConfigBlockedByExternalProvider(t *testing.T) {
 	}{
 		{"init", []string{"init", "--app-id", "x", "--app-secret-stdin"}},
 		{"remove", []string{"remove"}},
+		{"show", []string{"show"}},
 		{"default-as", []string{"default-as", "user"}},
 		{"strict-mode", []string{"strict-mode", "off"}},
 	}
@@ -515,63 +509,6 @@ func TestConfigBlockedByExternalProvider(t *testing.T) {
 	}
 }

-func TestConfigIdentityCommandsCheckProfileOwnershipBeforeCredentialOwnership(t *testing.T) {
-	profileDenied := errors.New("Profile identity settings are deployment-managed")
-	credentialChecks := 0
-	plan := runtimeplan.New(runtimeplan.Options{
-		Capabilities: func(capability runtimeplan.Capability) error {
-			switch capability {
-			case runtimeplan.CapabilityLocalProfileMutation:
-				return profileDenied
-			case runtimeplan.CapabilityLocalCredentialManagement:
-				credentialChecks++
-			}
-			return nil
-		},
-	})
-
-	for _, args := range [][]string{
-		{"default-as", "bot"},
-		{"strict-mode", "bot"},
-	} {
-		t.Run(args[0], func(t *testing.T) {
-			f, _, _, _ := cmdutil.TestFactoryWithRuntimePlan(t, nil, plan)
-			cmd := NewCmdConfig(f)
-			cmd.SetArgs(args)
-
-			err := cmd.Execute()
-			if !errors.Is(err, profileDenied) {
-				t.Fatalf("Execute(%v) error = %v, want Profile ownership denial", args, err)
-			}
-		})
-	}
-	if credentialChecks != 0 {
-		t.Fatalf("credential capability checked %d times after Profile denial, want 0", credentialChecks)
-	}
-}
-
-func TestConfigIdentityCommandsRetainCredentialOwnershipCapability(t *testing.T) {
-	f, _, _, _ := cmdutil.TestFactory(t, nil)
-	root := NewCmdConfig(f)
-
-	for _, name := range []string{"default-as", "strict-mode"} {
-		t.Run(name, func(t *testing.T) {
-			leaf, _, err := root.Find([]string{name})
-			if err != nil {
-				t.Fatal(err)
-			}
-			got := cmdutil.GetRuntimeCapabilities(leaf)
-			want := []runtimeplan.Capability{
-				runtimeplan.CapabilityLocalProfileMutation,
-				runtimeplan.CapabilityLocalCredentialManagement,
-			}
-			if len(got) != len(want) || got[0] != want[0] || got[1] != want[1] {
-				t.Fatalf("%s capabilities = %v, want %v", name, got, want)
-			}
-		})
-	}
-}
-
 // TestValidateInitLang covers the --lang contract: empty (omitted or explicit)
 // is a no-op leaving Lang unset; a short code or Feishu locale canonicalizes to
 // the same locale; an unrecognized value errors.
--- a/cmd/config/plugins.go
+++ b/cmd/config/plugins.go
@@ -27,6 +27,13 @@ func NewCmdConfigPlugins(f *cmdutil.Factory) *cobra.Command {
 		Use:    "plugins",
 		Hidden: true, // diagnostic-only; kept callable, omitted from --help so it stays out of AI-agent context
 		Short:  "Inspect installed plugins and their hook contributions",
+		// Same leaf-level no-op as config policy: the parent `config`
+		// group's PersistentPreRunE requires builtin credential, but
+		// this is a read-only diagnostic that must work everywhere.
+		PersistentPreRunE: func(c *cobra.Command, _ []string) error {
+			c.SilenceUsage = true
+			return nil
+		},
 	}
 	cmd.AddCommand(newCmdConfigPluginsShow(f))
 	return cmd
--- a/cmd/config/policy.go
+++ b/cmd/config/policy.go
@@ -16,6 +16,12 @@ func NewCmdConfigPolicy(f *cmdutil.Factory) *cobra.Command {
 		Use:    "policy",
 		Hidden: true,
 		Short:  "Inspect the user-layer command policy",
+		// Override parent's RequireBuiltinCredentialProvider check; this
+		// group is read-only diagnostic and must work under any provider.
+		PersistentPreRunE: func(c *cobra.Command, _ []string) error {
+			c.SilenceUsage = true
+			return nil
+		},
 	}
 	cmd.AddCommand(newCmdConfigPolicyShow(f))
 	return cmd
--- a/cmd/config/policy_test.go
+++ b/cmd/config/policy_test.go
@@ -132,16 +132,19 @@ func TestConfigPolicyShow_YamlSourceNameIsEmpty(t *testing.T) {
 	}
 }

-// The policy group explicitly overrides the config parent's local credential
-// management capability because it is source-neutral diagnostics.
-func TestConfigPolicyOverridesCredentialManagementCapability(t *testing.T) {
+// Regression: the parent `config` command declares a PersistentPreRunE
+// that calls RequireBuiltinCredentialProvider; env credentials cause
+// it to return external_provider. `config policy` is a diagnostic
+// group that must not be blocked by that check. The group declares
+// its own no-op PersistentPreRunE so cobra's "first walking up from
+// leaf" picks ours over the config parent's.
+func TestConfigPolicy_BypassesConfigParentPersistentPreRunE(t *testing.T) {
 	f, _, _ := newPolicyTestFactory()
-	root := NewCmdConfig(f)
-	leaf, _, err := root.Find([]string{"policy", "show"})
-	if err != nil {
-		t.Fatal(err)
+	group := NewCmdConfigPolicy(f)
+	if group.PersistentPreRunE == nil {
+		t.Fatal("config policy group must declare its own PersistentPreRunE to win over config parent")
 	}
-	if capabilities := cmdutil.GetRuntimeCapabilities(leaf); len(capabilities) != 0 {
-		t.Fatalf("policy capabilities = %v, want source-neutral", capabilities)
+	if err := group.PersistentPreRunE(group, nil); err != nil {
+		t.Errorf("config policy PersistentPreRunE should be no-op, got %v", err)
 	}
 }
--- a/cmd/config/risk_control.go
+++ b/cmd/config/risk_control.go
@@ -1,75 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package config
-
-import (
-	"fmt"
-
-	"github.com/spf13/cobra"
-
-	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
-)
-
-// NewCmdConfigRiskControl creates the workspace risk-control policy command.
-func NewCmdConfigRiskControl(f *cmdutil.Factory) *cobra.Command {
-	cmd := &cobra.Command{
-		Use:   "risk-control [on|off|default]",
-		Short: "Manage workspace account-protection policy",
-		Long: `View or set the account-protection risk-control policy for this workspace.
-
-Account protection is on by default. Use off to opt this workspace out, on to
-opt it back in explicitly, or default to remove the explicit preference.`,
-		Args: cobra.MaximumNArgs(1),
-		RunE: func(cmd *cobra.Command, args []string) error {
-			config, err := core.LoadOrNotConfigured()
-			if err != nil {
-				return err
-			}
-			if len(args) == 0 {
-				printRiskControl(f, config)
-				return nil
-			}
-
-			switch args[0] {
-			case "on":
-				enabled := true
-				config.RiskControl = &enabled
-			case "off":
-				enabled := false
-				config.RiskControl = &enabled
-			case "default":
-				config.RiskControl = nil
-			default:
-				return errs.NewValidationError(errs.SubtypeInvalidArgument,
-					"invalid risk-control value %q, valid values: on | off | default", args[0])
-			}
-
-			if err := core.SaveMultiAppConfig(config); err != nil {
-				return errs.NewInternalError(errs.SubtypeStorage,
-					"failed to save risk-control policy: %v", err).WithCause(err)
-			}
-			fmt.Fprintf(f.IOStreams.ErrOut, "Risk control set to %s (workspace)\n", args[0])
-			return nil
-		},
-	}
-	cmdutil.SetRisk(cmd, cmdutil.RiskWrite)
-	return cmd
-}
-
-func printRiskControl(f *cmdutil.Factory, config *core.MultiAppConfig) {
-	source := "default"
-	if config.RiskControl != nil {
-		source = "workspace"
-	}
-	fmt.Fprintf(f.IOStreams.Out, "risk-control: %s (source: %s)\n", riskControlState(config.RiskControlEnabled()), source)
-}
-
-func riskControlState(enabled bool) string {
-	if enabled {
-		return "on"
-	}
-	return "off"
-}
--- a/cmd/config/risk_control_test.go
+++ b/cmd/config/risk_control_test.go
@@ -1,130 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package config
-
-import (
-	"errors"
-	"strings"
-	"testing"
-
-	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
-)
-
-func TestRiskControlWorkspacePolicy(t *testing.T) {
-	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
-	config := &core.MultiAppConfig{Apps: []core.AppConfig{{
-		AppId: "cli_test", AppSecret: core.PlainSecret("secret"), Brand: core.BrandFeishu,
-	}}}
-	if err := core.SaveMultiAppConfig(config); err != nil {
-		t.Fatal(err)
-	}
-
-	f, stdout, stderr, _ := cmdutil.TestFactory(t, nil)
-	cmd := NewCmdConfigRiskControl(f)
-	cmd.SetArgs([]string{"off"})
-	if err := cmd.Execute(); err != nil {
-		t.Fatalf("set off: %v", err)
-	}
-	loaded, err := core.LoadMultiAppConfig()
-	if err != nil {
-		t.Fatal(err)
-	}
-	if loaded.RiskControl == nil || *loaded.RiskControl {
-		t.Fatalf("RiskControl = %v, want explicit false", loaded.RiskControl)
-	}
-	if !strings.Contains(stderr.String(), "set to off") {
-		t.Fatalf("stderr = %q", stderr.String())
-	}
-
-	stdout.Reset()
-	cmd = NewCmdConfigRiskControl(f)
-	if err := cmd.Execute(); err != nil {
-		t.Fatalf("show: %v", err)
-	}
-	if got := stdout.String(); got != "risk-control: off (source: workspace)\n" {
-		t.Fatalf("stdout = %q", got)
-	}
-
-	cmd = NewCmdConfigRiskControl(f)
-	cmd.SetArgs([]string{"on"})
-	if err := cmd.Execute(); err != nil {
-		t.Fatalf("set on: %v", err)
-	}
-	loaded, err = core.LoadMultiAppConfig()
-	if err != nil {
-		t.Fatal(err)
-	}
-	if loaded.RiskControl == nil || !*loaded.RiskControl {
-		t.Fatalf("RiskControl = %v, want explicit true", loaded.RiskControl)
-	}
-
-	cmd = NewCmdConfigRiskControl(f)
-	cmd.SetArgs([]string{"default"})
-	if err := cmd.Execute(); err != nil {
-		t.Fatalf("reset default: %v", err)
-	}
-	loaded, err = core.LoadMultiAppConfig()
-	if err != nil {
-		t.Fatal(err)
-	}
-	if loaded.RiskControl != nil {
-		t.Fatalf("RiskControl = %v, want nil", loaded.RiskControl)
-	}
-
-	stdout.Reset()
-	cmd = NewCmdConfigRiskControl(f)
-	if err := cmd.Execute(); err != nil {
-		t.Fatalf("show default: %v", err)
-	}
-	if got := stdout.String(); got != "risk-control: on (source: default)\n" {
-		t.Fatalf("stdout = %q", got)
-	}
-}
-
-func TestRiskControlWorkspacePolicyRejectsInvalidValue(t *testing.T) {
-	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
-	if err := core.SaveMultiAppConfig(&core.MultiAppConfig{Apps: []core.AppConfig{{
-		AppId: "cli_test", AppSecret: core.PlainSecret("secret"), Brand: core.BrandFeishu,
-	}}}); err != nil {
-		t.Fatal(err)
-	}
-
-	f, _, _, _ := cmdutil.TestFactory(t, nil)
-	cmd := NewCmdConfigRiskControl(f)
-	cmd.SetArgs([]string{"invalid"})
-	err := cmd.Execute()
-	var validationErr *errs.ValidationError
-	if !errors.As(err, &validationErr) {
-		t.Fatalf("error = %T %v, want *errs.ValidationError", err, err)
-	}
-	if validationErr.Subtype != errs.SubtypeInvalidArgument {
-		t.Fatalf("subtype = %q, want %q", validationErr.Subtype, errs.SubtypeInvalidArgument)
-	}
-}
-
-func TestRiskControlWorkspacePolicyAllowedWithExternalCredentials(t *testing.T) {
-	f := newConfigFactoryWithExternalProvider(t)
-	config := &core.MultiAppConfig{Apps: []core.AppConfig{{
-		AppId: "cli_test", AppSecret: core.PlainSecret("secret"), Brand: core.BrandFeishu,
-	}}}
-	if err := core.SaveMultiAppConfig(config); err != nil {
-		t.Fatal(err)
-	}
-
-	cmd := NewCmdConfig(f)
-	cmd.SetArgs([]string{"risk-control", "off"})
-	if err := cmd.Execute(); err != nil {
-		t.Fatalf("set off with external credentials: %v", err)
-	}
-
-	loaded, err := core.LoadMultiAppConfig()
-	if err != nil {
-		t.Fatal(err)
-	}
-	if loaded.RiskControl == nil || *loaded.RiskControl {
-		t.Fatalf("RiskControl = %v, want explicit false", loaded.RiskControl)
-	}
-}
--- a/cmd/config/show.go
+++ b/cmd/config/show.go
@@ -42,16 +42,6 @@ func NewCmdConfigShow(f *cmdutil.Factory, runF func(*ConfigShowOptions) error) *

 func configShowRun(opts *ConfigShowOptions) error {
 	f := opts.Factory
-	// config show describes the effective invocation configuration, not merely
-	// the bytes in config.json. Preserve the typed bootstrap failure so a
-	// Standard binary cannot present a local Profile as active when the system
-	// requires Extended runtime support.
-	if startupErr := f.RuntimeStartupError(); startupErr != nil {
-		return startupErr
-	}
-	if handled, editionErr := showEditionConfig(f); handled {
-		return editionErr
-	}

 	config, err := core.LoadMultiAppConfig()
 	if err != nil {
--- a/cmd/config/show_edition_extended.go
+++ b/cmd/config/show_edition_extended.go
@@ -1,73 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-//go:build extended
-
-package config
-
-import (
-	"context"
-
-	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
-	"github.com/larksuite/cli/internal/output"
-)
-
-type editionConfigShowResult struct {
-	Source                 string  `json:"source"`
-	CredentialProvider     string  `json:"credentialProvider"`
-	Manageable             bool    `json:"manageable"`
-	Workspace              string  `json:"workspace"`
-	AppID                  string  `json:"appId"`
-	Brand                  string  `json:"brand"`
-	DefaultAs              string  `json:"defaultAs"`
-	Profile                *string `json:"profile,omitempty"`
-	ExternalCredentialMode *string `json:"externalCredentialMode,omitempty"`
-	RemoteEndpoint         *string `json:"remoteEndpoint,omitempty"`
-}
-
-func showEditionConfig(f *cmdutil.Factory) (bool, error) {
-	if f == nil || f.Credential == nil {
-		return false, nil
-	}
-	source, err := f.Credential.InspectSource(context.Background())
-	if err != nil {
-		return true, typedEditionProviderError("determine the active credential provider", err)
-	}
-	if source == nil || !source.Managed {
-		return false, nil
-	}
-	if source.AppID == "" {
-		return true, errs.NewInternalError(errs.SubtypeInvalidResponse,
-			"external credential provider %q returned no account", source.Name)
-	}
-	result := editionConfigShowResult{
-		Source:             "external",
-		CredentialProvider: source.Name,
-		Manageable:         false,
-		Workspace:          core.CurrentWorkspace().Display(),
-		AppID:              source.AppID,
-		Brand:              string(source.Brand),
-		DefaultAs:          string(source.DefaultAs),
-	}
-	description := f.RuntimeDescription()
-	if source.ProfileName != "" {
-		result.Profile = &source.ProfileName
-	}
-	if description.Managed && description.Variant != "" {
-		result.ExternalCredentialMode = &description.Variant
-		if description.ProxiesRequests {
-			result.RemoteEndpoint = &description.DataPlaneEndpoint
-		}
-	}
-	output.PrintJson(f.IOStreams.Out, result)
-	return true, nil
-}
-
-func typedEditionProviderError(action string, err error) error {
-	if _, ok := errs.ProblemOf(err); ok {
-		return err
-	}
-	return errs.NewInternalError(errs.SubtypeUnknown, "failed to %s: %v", action, err).WithCause(err)
-}
--- a/cmd/config/show_edition_extended_test.go
+++ b/cmd/config/show_edition_extended_test.go
@@ -1,93 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-//go:build extended
-
-package config
-
-import (
-	"bytes"
-	"encoding/json"
-	"errors"
-	"testing"
-
-	"github.com/larksuite/cli/errs"
-	extcred "github.com/larksuite/cli/extension/credential"
-	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/credential"
-	"github.com/larksuite/cli/internal/runtimeplan"
-)
-
-func TestExtendedConfigShowAllowedWithManagedSource(t *testing.T) {
-	f := newConfigFactoryWithExternalProvider(t)
-	cmd := NewCmdConfig(f)
-	matched, _, err := cmd.Find([]string{"show"})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if err := cmd.PersistentPreRunE(matched, nil); err != nil {
-		t.Fatalf("config show blocked: %v", err)
-	}
-}
-
-func TestExtendedConfigShowProjectsManagedSource(t *testing.T) {
-	f := newConfigFactoryWithExternalProvider(t)
-	var stdout bytes.Buffer
-	f.IOStreams.Out = &stdout
-	cmdutil.TestSetRuntimePlan(t, f, runtimeplan.New(runtimeplan.Options{
-		Description: runtimeplan.Description{
-			Managed:           true,
-			Variant:           "managed-test",
-			ProxiesRequests:   true,
-			DataPlaneEndpoint: "https://managed.example.test",
-		},
-	}))
-
-	if err := configShowRun(&ConfigShowOptions{Factory: f}); err != nil {
-		t.Fatalf("configShowRun() error = %v", err)
-	}
-	var got editionConfigShowResult
-	if err := json.Unmarshal(stdout.Bytes(), &got); err != nil {
-		t.Fatal(err)
-	}
-	if got.Source != "external" ||
-		got.CredentialProvider != "env" ||
-		got.Manageable ||
-		got.AppID != "test-app" ||
-		got.ExternalCredentialMode == nil ||
-		*got.ExternalCredentialMode != "managed-test" ||
-		got.RemoteEndpoint == nil ||
-		*got.RemoteEndpoint != "https://managed.example.test" {
-		t.Fatalf("output = %#v", got)
-	}
-	var fields map[string]json.RawMessage
-	if err := json.Unmarshal(stdout.Bytes(), &fields); err != nil {
-		t.Fatal(err)
-	}
-	if _, ok := fields["appSecret"]; ok {
-		t.Fatalf("managed output must not invent appSecret: %s", stdout.String())
-	}
-	if _, ok := fields["users"]; ok {
-		t.Fatalf("managed output must not invent users: %s", stdout.String())
-	}
-}
-
-func TestExtendedConfigShowTypesManagedSourceFailure(t *testing.T) {
-	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
-	providerErr := errors.New("provider failed")
-	cred := credential.NewCredentialProvider(
-		[]extcred.Provider{&stubConfigExtProvider{name: "broken", err: providerErr}},
-		nil, nil, nil,
-	)
-	f, _, _, _ := cmdutil.TestFactory(t, nil)
-	f.Credential = cred
-
-	err := configShowRun(&ConfigShowOptions{Factory: f})
-	problem, ok := errs.ProblemOf(err)
-	if !ok || problem.Category != errs.CategoryInternal || problem.Subtype != errs.SubtypeUnknown {
-		t.Fatalf("error = %#v, want internal/unknown", err)
-	}
-	if !errors.Is(err, providerErr) {
-		t.Fatalf("error does not preserve provider failure: %v", err)
-	}
-}
--- a/cmd/config/show_edition_standard.go
+++ b/cmd/config/show_edition_standard.go
@@ -1,12 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-//go:build !extended
-
-package config
-
-import "github.com/larksuite/cli/internal/cmdutil"
-
-func showEditionConfig(*cmdutil.Factory) (bool, error) {
-	return false, nil
-}
--- a/cmd/config/show_edition_standard_test.go
+++ b/cmd/config/show_edition_standard_test.go
@@ -1,54 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-//go:build !extended
-
-package config
-
-import (
-	"errors"
-	"testing"
-
-	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/runtimeplan"
-)
-
-func TestStandardConfigShowPreservesLocalConfigPath(t *testing.T) {
-	f := newConfigFactoryWithExternalProvider(t)
-
-	err := configShowRun(&ConfigShowOptions{Factory: f})
-	problem, ok := errs.ProblemOf(err)
-	if !ok ||
-		problem.Category != errs.CategoryConfig ||
-		problem.Subtype != errs.SubtypeNotConfigured {
-		t.Fatalf("error = %#v, want established config/not_configured result", err)
-	}
-}
-
-func TestStandardConfigShowReturnsTypedRuntimeStartupError(t *testing.T) {
-	startupErr := errs.NewValidationError(
-		errs.SubtypeFailedPrecondition,
-		"system external credential configuration requires the lark-cli Extended edition",
-	).WithHint("install lark-cli Extended or ask the administrator to remove external-credential.json")
-	f, stdout, _, _ := cmdutil.TestFactoryWithRuntimePlan(
-		t,
-		nil,
-		runtimeplan.Failed(startupErr, runtimeplan.MetadataEmbeddedOnly),
-	)
-
-	err := configShowRun(&ConfigShowOptions{Factory: f})
-	if !errors.Is(err, startupErr) {
-		t.Fatalf("config show error = %v, want original startup error", err)
-	}
-	problem, ok := errs.ProblemOf(err)
-	if !ok ||
-		problem.Category != errs.CategoryValidation ||
-		problem.Subtype != errs.SubtypeFailedPrecondition ||
-		problem.Message != "system external credential configuration requires the lark-cli Extended edition" {
-		t.Fatalf("config show problem = %#v, want typed Extended-required startup failure", problem)
-	}
-	if stdout.Len() != 0 {
-		t.Fatalf("config show wrote local Profile after bootstrap failure: %s", stdout.String())
-	}
-}
--- a/cmd/doctor/doctor.go
+++ b/cmd/doctor/doctor.go
@@ -84,10 +84,6 @@ func doctorRun(opts *DoctorOptions) error {
 		checks = append(checks, checkCLIUpdate()...)
 	}

-	if handled, editionErr := runEditionDoctor(opts, checks); handled {
-		return editionErr
-	}
-
 	// ── 1. Config file ──
 	_, err := core.LoadMultiAppConfig()
 	if err != nil {
@@ -134,7 +130,8 @@ func doctorRun(opts *DoctorOptions) error {
 		checks = append(checks, pass("identity_ready", "at least one identity is available"))
 	} else {
 		// No hint: this only summarizes the two checks above, which already carry
-		// the source-appropriate remediation. A command here would be redundant.
+		// the source-appropriate remediation. A command here would be redundant,
+		// or wrong (`auth status` is blocked under an external provider).
 		checks = append(checks, fail("identity_ready", "no usable bot or user identity is available", ""))
 	}

@@ -218,7 +215,7 @@ func probeEndpoint(ctx context.Context, client *http.Client, url string) error {
 // Unlike the root-level async check, this does a synchronous fetch with timeout
 // and works regardless of build version (dev builds included).
 func checkCLIUpdate() []checkResult {
-	latest, err := fetchLatestForEdition()
+	latest, err := update.FetchLatest()
 	if err != nil {
 		return []checkResult{warn("cli_update", "check failed: "+err.Error(), "")}
 	}
--- a/cmd/doctor/doctor_edition_extended.go
+++ b/cmd/doctor/doctor_edition_extended.go
@@ -1,94 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-//go:build extended
-
-package doctor
-
-import (
-	"errors"
-	"fmt"
-
-	"github.com/larksuite/cli/errs"
-	extcred "github.com/larksuite/cli/extension/credential"
-	"github.com/larksuite/cli/internal/core"
-	"github.com/larksuite/cli/internal/identitydiag"
-)
-
-func runEditionDoctor(opts *DoctorOptions, checks []checkResult) (bool, error) {
-	f := opts.Factory
-	if f == nil || f.Credential == nil {
-		return false, nil
-	}
-	source, err := f.Credential.InspectSource(opts.Ctx)
-	if err != nil {
-		checks = append(checks, fail("credential_source", err.Error(), editionDiagnosticErrorHint(err)))
-		return true, finishDoctor(f, checks)
-	}
-	if source == nil || !source.Managed {
-		return false, nil
-	}
-
-	provider := source.Name
-	cfg, err := f.Config()
-	if err != nil {
-		checks = append(checks,
-			fail("credential_source", err.Error(), editionDiagnosticErrorHint(err)),
-			skip("config_file", fmt.Sprintf("local credentials are not used; source is %s", provider)),
-		)
-		return true, finishDoctor(f, checks)
-	}
-	checks = append(checks, pass("credential_source",
-		fmt.Sprintf("credentials provided by %s (app %s; token not verified by this check)", provider, cfg.AppID)))
-
-	description := f.RuntimeDescription()
-	if description.Managed {
-		checks = append(checks, pass("config_file", "config.json found (system external credential mode)"))
-	} else {
-		checks = append(checks, skip("config_file",
-			fmt.Sprintf("local config not used; credentials provided by %s", provider)))
-	}
-	checks = append(checks, pass("app_resolved", fmt.Sprintf("app: %s (%s)", cfg.AppID, cfg.Brand)))
-
-	diagnostics := identitydiag.Diagnose(opts.Ctx, f, cfg, !opts.Offline)
-	checks = append(checks,
-		identityCheck("bot_identity", diagnostics.Bot),
-		identityCheck("user_identity", diagnostics.User),
-	)
-	if diagnostics.Bot.Available || diagnostics.User.Available {
-		checks = append(checks, pass("identity_ready", "at least one identity is available"))
-	} else {
-		checks = append(checks, fail("identity_ready", "no usable bot or user identity is available", ""))
-	}
-
-	if description.ProxiesRequests {
-		checks = append(checks, editionProxyNetworkCheck(opts, description.DataPlaneEndpoint, diagnostics))
-	} else {
-		checks = append(checks, networkChecks(opts.Ctx, opts, core.ResolveEndpoints(cfg.Brand))...)
-	}
-	return true, finishDoctor(f, checks)
-}
-
-func editionDiagnosticErrorHint(err error) string {
-	var blockErr *extcred.BlockError
-	if errors.As(err, &blockErr) {
-		return blockErr.Reason
-	}
-	var cfgErr *errs.ConfigError
-	if errors.As(err, &cfgErr) {
-		return cfgErr.Hint
-	}
-	return ""
-}
-
-func editionProxyNetworkCheck(opts *DoctorOptions, endpoint string, diagnostics identitydiag.Result) checkResult {
-	if opts.Offline {
-		return skip("endpoint_external_platform", "skipped (--offline)")
-	}
-	verified := func(id identitydiag.Identity) bool { return id.Verified != nil && *id.Verified }
-	if verified(diagnostics.User) || verified(diagnostics.Bot) {
-		return pass("endpoint_external_platform", endpoint+" reachable through an authenticated API request")
-	}
-	return fail("endpoint_external_platform", endpoint+" could not complete an authenticated API request",
-		"check the external credential program and platform logs")
-}
--- a/cmd/doctor/doctor_edition_extended_test.go
+++ b/cmd/doctor/doctor_edition_extended_test.go
@@ -1,75 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-//go:build extended
-
-package doctor
-
-import (
-	"context"
-	"encoding/json"
-	"strings"
-	"testing"
-
-	extcred "github.com/larksuite/cli/extension/credential"
-	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
-	"github.com/larksuite/cli/internal/credential"
-	"github.com/larksuite/cli/internal/identitydiag"
-)
-
-func TestExtendedProxyNetworkCheckUsesAuthenticatedDiagnostics(t *testing.T) {
-	verified := true
-	endpoint := "https://credentials.example.com"
-	got := editionProxyNetworkCheck(&DoctorOptions{}, endpoint, identitydiag.Result{
-		User: identitydiag.Identity{Verified: &verified},
-	})
-	if got.Status != "pass" || got.Name != "endpoint_external_platform" {
-		t.Fatalf("check = %#v", got)
-	}
-
-	got = editionProxyNetworkCheck(&DoctorOptions{}, endpoint, identitydiag.Result{})
-	if got.Status != "fail" {
-		t.Fatalf("unverified check = %#v, want fail", got)
-	}
-}
-
-func TestExtendedDoctorManagedSourceDoesNotRequireLocalConfig(t *testing.T) {
-	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
-	cfg := &core.CliConfig{
-		AppID: "cli_env", Brand: core.BrandFeishu,
-		SupportedIdentities: uint8(extcred.SupportsBot), DefaultAs: core.AsBot,
-	}
-	f, out, _, _ := cmdutil.TestFactory(t, cfg)
-	f.Credential = credential.NewCredentialProvider(
-		[]extcred.Provider{&fakeExtProvider{
-			name: "env",
-			account: &extcred.Account{
-				AppID:               "cli_env",
-				SupportedIdentities: extcred.SupportsBot,
-			},
-		}},
-		nil, nil, nil,
-	)
-
-	if err := doctorRun(&DoctorOptions{Factory: f, Ctx: context.Background(), Offline: true}); err != nil {
-		t.Fatalf("doctorRun() error = %v", err)
-	}
-	var got struct {
-		OK     bool          `json:"ok"`
-		Checks []checkResult `json:"checks"`
-	}
-	if err := json.Unmarshal(out.Bytes(), &got); err != nil {
-		t.Fatal(err)
-	}
-	if !got.OK {
-		t.Fatalf("checks = %#v", got.Checks)
-	}
-	assertCheck(t, got.Checks, "credential_source", "pass")
-	configCheck := findCheck(t, got.Checks, "config_file")
-	if configCheck.Status != "skip" ||
-		!strings.Contains(configCheck.Message, "local config") ||
-		strings.Contains(configCheck.Message, "config init") {
-		t.Fatalf("config_file = %#v", configCheck)
-	}
-}
--- a/cmd/doctor/doctor_edition_standard.go
+++ b/cmd/doctor/doctor_edition_standard.go
@@ -1,24 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-//go:build !extended
-
-package doctor
-
-import "github.com/larksuite/cli/errs"
-
-func runEditionDoctor(opts *DoctorOptions, checks []checkResult) (bool, error) {
-	if opts == nil || opts.Factory == nil {
-		return false, nil
-	}
-	startupErr := opts.Factory.RuntimeStartupError()
-	if startupErr == nil {
-		return false, nil
-	}
-	hint := ""
-	if problem, ok := errs.ProblemOf(startupErr); ok {
-		hint = problem.Hint
-	}
-	checks = append(checks, fail("credential_source", startupErr.Error(), hint))
-	return true, finishDoctor(opts.Factory, checks)
-}
--- a/cmd/doctor/doctor_edition_standard_test.go
+++ b/cmd/doctor/doctor_edition_standard_test.go
@@ -1,52 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-//go:build !extended
-
-package doctor
-
-import (
-	"context"
-	"encoding/json"
-	"testing"
-
-	extcred "github.com/larksuite/cli/extension/credential"
-	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
-	"github.com/larksuite/cli/internal/credential"
-)
-
-func TestStandardDoctorPreservesConfigFirstDiagnostics(t *testing.T) {
-	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
-	cfg := &core.CliConfig{
-		AppID: "cli_env", Brand: core.BrandFeishu,
-		SupportedIdentities: uint8(extcred.SupportsBot), DefaultAs: core.AsBot,
-	}
-	f, out, _, _ := cmdutil.TestFactory(t, cfg)
-	f.Credential = credential.NewCredentialProvider(
-		[]extcred.Provider{&fakeExtProvider{
-			name: "env",
-			account: &extcred.Account{
-				AppID:               "cli_env",
-				SupportedIdentities: extcred.SupportsBot,
-			},
-		}},
-		nil, nil, nil,
-	)
-
-	if err := doctorRun(&DoctorOptions{Factory: f, Ctx: context.Background(), Offline: true}); err == nil {
-		t.Fatal("doctorRun() = nil, want established missing-config failure")
-	}
-	var got struct {
-		Checks []checkResult `json:"checks"`
-	}
-	if err := json.Unmarshal(out.Bytes(), &got); err != nil {
-		t.Fatal(err)
-	}
-	assertCheck(t, got.Checks, "config_file", "fail")
-	for _, check := range got.Checks {
-		if check.Name == "credential_source" {
-			t.Fatalf("Standard doctor exposed edition diagnostic: %#v", got.Checks)
-		}
-	}
-}
--- a/cmd/doctor/doctor_test.go
+++ b/cmd/doctor/doctor_test.go
@@ -4,6 +4,7 @@
 package doctor

 import (
+	"bytes"
 	"context"
 	"encoding/json"
 	"net/http"
@@ -174,44 +175,6 @@ func (p *fakeExtProvider) ResolveToken(context.Context, extcred.TokenSpec) (*ext
 	return nil, nil
 }

-type failingDefaultAccountResolver struct {
-	err error
-}
-
-func (r *failingDefaultAccountResolver) ResolveAccount(context.Context) (*credential.Account, error) {
-	return nil, r.err
-}
-
-func TestDoctor_DefaultResolutionFailurePreservesConfigFileCheck(t *testing.T) {
-	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
-	f, out, _, _ := cmdutil.TestFactory(t, nil)
-	f.Credential = credential.NewCredentialProvider(
-		nil,
-		&failingDefaultAccountResolver{err: core.NotConfiguredError()},
-		nil,
-		nil,
-	)
-
-	if err := doctorRun(&DoctorOptions{Factory: f, Ctx: context.Background(), Offline: true}); err == nil {
-		t.Fatal("doctorRun() = nil, want not-configured failure")
-	}
-	var got struct {
-		Checks []checkResult `json:"checks"`
-	}
-	if err := json.Unmarshal(out.Bytes(), &got); err != nil {
-		t.Fatalf("json.Unmarshal() error = %v\n%s", err, out.String())
-	}
-	configCheck := findCheck(t, got.Checks, "config_file")
-	if configCheck.Status != "fail" {
-		t.Fatalf("config_file = %#v, want fail", configCheck)
-	}
-	for _, check := range got.Checks {
-		if check.Name == "credential_source" {
-			t.Fatalf("default source resolution replaced the legacy config check: %#v", got.Checks)
-		}
-	}
-}
-
 // Under an external credential provider with no usable identity, the
 // identity_ready hint must not point at `auth status` (blocked there); the
 // per-identity checks already carry the source-appropriate escalation.
@@ -232,8 +195,12 @@ func TestDoctor_ExternalProvider_IdentityReadyHintNotBlockedCommand(t *testing.T
 		nil, nil,
 		func() (*http.Client, error) { return nil, nil },
 	)
-	f, out, _, _ := cmdutil.TestFactory(t, cfg)
-	f.Credential = cred
+	out := &bytes.Buffer{}
+	f := &cmdutil.Factory{
+		Config:     func() (*core.CliConfig, error) { return cfg, nil },
+		Credential: cred,
+		IOStreams:  &cmdutil.IOStreams{Out: out, ErrOut: &bytes.Buffer{}},
+	}

 	if err := doctorRun(&DoctorOptions{Factory: f, Ctx: context.Background(), Offline: true}); err == nil {
 		t.Fatalf("doctorRun() = nil, want failure when no identity is available")
--- a/cmd/doctor/update_extended.go
+++ b/cmd/doctor/update_extended.go
@@ -1,12 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-//go:build extended
-
-package doctor
-
-import "github.com/larksuite/cli/internal/extendedupdate"
-
-func fetchLatestForEdition() (string, error) {
-	return extendedupdate.FetchLatest()
-}
--- a/cmd/doctor/update_standard.go
+++ b/cmd/doctor/update_standard.go
@@ -1,12 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-//go:build !extended
-
-package doctor
-
-import "github.com/larksuite/cli/internal/update"
-
-func fetchLatestForEdition() (string, error) {
-	return update.FetchLatest()
-}
--- a/cmd/doctor_startup_standard_test.go
+++ b/cmd/doctor_startup_standard_test.go
@@ -1,74 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-//go:build !extended
-
-package cmd
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-	"path/filepath"
-	"strings"
-	"testing"
-
-	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/envvars"
-	"github.com/larksuite/cli/internal/vfs"
-)
-
-func TestStandardDoctorReportsEditionSentinelWithoutLocalProfile(t *testing.T) {
-	clearWorkspaceSignals(t)
-	clearCredentialSignals(t)
-	configDir := t.TempDir()
-	systemPath := filepath.Join(configDir, "external-credential.json")
-	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", configDir)
-	t.Setenv(envvars.CliExternalCredentialConfig, systemPath)
-	t.Setenv("LARKSUITE_CLI_REMOTE_META", "off")
-	t.Setenv("LARKSUITE_CLI_NO_UPDATE_NOTIFIER", "1")
-	t.Setenv("LARKSUITE_CLI_NO_SKILLS_NOTIFIER", "1")
-	if err := vfs.WriteFile(systemPath, []byte("sentinel-only"), 0o600); err != nil {
-		t.Fatal(err)
-	}
-
-	var stdout, stderr bytes.Buffer
-	root := Build(
-		context.Background(),
-		cmdutil.InvocationContext{},
-		WithIO(strings.NewReader(""), &stdout, &stderr),
-		WithoutPlugins(),
-		WithoutServiceCommands(),
-	)
-	root.SetArgs([]string{"doctor", "--offline"})
-	if err := root.ExecuteContext(context.Background()); err == nil {
-		t.Fatal("doctor returned nil, want failed diagnostic result")
-	}
-
-	var report struct {
-		Checks []struct {
-			Name    string `json:"name"`
-			Status  string `json:"status"`
-			Message string `json:"message"`
-			Hint    string `json:"hint"`
-		} `json:"checks"`
-	}
-	if err := json.Unmarshal(stdout.Bytes(), &report); err != nil {
-		t.Fatalf("decode doctor output: %v\nstdout: %s\nstderr: %s", err, stdout.String(), stderr.String())
-	}
-	for _, check := range report.Checks {
-		if check.Name != "credential_source" {
-			continue
-		}
-		if check.Status != "fail" ||
-			check.Message != "system external credential configuration requires the lark-cli Extended edition" ||
-			!strings.Contains(check.Hint, "install lark-cli Extended") {
-			t.Fatalf("credential_source check = %#v", check)
-		}
-		if strings.Contains(stdout.String(), "config init") {
-			t.Fatalf("doctor suggested local credential bootstrap for an edition sentinel: %s", stdout.String())
-		}
-		return
-	}
-	t.Fatalf("doctor did not report the edition sentinel: %s", stdout.String())
-}
--- a/cmd/edition_commands_extended.go
+++ b/cmd/edition_commands_extended.go
@@ -1,17 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-//go:build extended
-
-package cmd
-
-import (
-	cmdversion "github.com/larksuite/cli/cmd/version"
-	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/spf13/cobra"
-)
-
-// registerEditionCommands owns the Extended-only command surface.
-func registerEditionCommands(root *cobra.Command, f *cmdutil.Factory) {
-	root.AddCommand(cmdversion.NewCmdVersion(f))
-}
--- a/cmd/edition_commands_extended_test.go
+++ b/cmd/edition_commands_extended_test.go
@@ -1,28 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-//go:build extended
-
-package cmd
-
-import (
-	"testing"
-
-	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/spf13/cobra"
-)
-
-func TestExtendedRegistersVersionCommand(t *testing.T) {
-	f, _, _, _ := cmdutil.TestFactory(t, nil)
-	root := &cobra.Command{Use: "lark-cli"}
-
-	registerEditionCommands(root, f)
-
-	commands := root.Commands()
-	if len(commands) != 1 || commands[0].Name() != "version" {
-		t.Fatalf("Extended edition commands = %v, want [version]", commands)
-	}
-	if commands[0].Hidden {
-		t.Fatal("Extended version command must be visible")
-	}
-}
--- a/cmd/edition_commands_standard.go
+++ b/cmd/edition_commands_standard.go
@@ -1,20 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-//go:build !extended
-
-package cmd
-
-import (
-	cmdversion "github.com/larksuite/cli/cmd/version"
-	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/spf13/cobra"
-)
-
-// registerEditionCommands keeps the release identity probe callable in
-// Standard while cmd/version hides it from help. This preserves the ordinary
-// command surface and gives installers/CI one edition-neutral verification
-// contract.
-func registerEditionCommands(root *cobra.Command, f *cmdutil.Factory) {
-	root.AddCommand(cmdversion.NewCmdVersion(f))
-}
--- a/cmd/edition_commands_standard_test.go
+++ b/cmd/edition_commands_standard_test.go
@@ -1,28 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-//go:build !extended
-
-package cmd
-
-import (
-	"testing"
-
-	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/spf13/cobra"
-)
-
-func TestStandardRegistersHiddenVersionCommand(t *testing.T) {
-	f, _, _, _ := cmdutil.TestFactory(t, nil)
-	root := &cobra.Command{Use: "lark-cli"}
-
-	registerEditionCommands(root, f)
-
-	commands := root.Commands()
-	if len(commands) != 1 || commands[0].Name() != "version" {
-		t.Fatalf("Standard edition commands = %v, want [version]", commands)
-	}
-	if !commands[0].Hidden {
-		t.Fatal("Standard version command must remain hidden")
-	}
-}
--- a/cmd/event/event.go
+++ b/cmd/event/event.go
@@ -7,7 +7,6 @@ import (
 	"github.com/spf13/cobra"

 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/runtimeplan"
 )

 func NewCmdEvents(f *cmdutil.Factory) *cobra.Command {
@@ -17,31 +16,14 @@ func NewCmdEvents(f *cmdutil.Factory) *cobra.Command {
 		Long:  `Unified event consumption system. Use 'event consume <EventKey>' to start consuming events.`,
 		// Without SilenceUsage, RunE errors print the full flag help banner.
 		SilenceUsage: true,
-		PersistentPreRunE: func(cmd *cobra.Command, _ []string) error {
-			cmd.SilenceUsage = true
-			// This hook shadows root's PersistentPreRun, so preserve the matched
-			// command for structured error and declared-scope hints.
-			f.CurrentCommand = cmd
-			return f.RequireCommandRuntimeCapabilities(cmd.Context(), cmd)
-		},
 	}
-	cmdutil.SetRuntimeCapabilities(cmd, runtimeplan.CapabilityRealtimeEvents)

-	consume := NewCmdConsume(f)
-	bus := NewCmdBus(f)
-	list := NewCmdList(f)
-	schema := NewCmdSchema(f)
-	status := NewCmdStatus(f)
-	stop := NewCmdStop(f)
-	for _, local := range []*cobra.Command{list, schema, status, stop} {
-		cmdutil.SetRuntimeCapabilities(local)
-	}
-	cmd.AddCommand(consume)
-	cmd.AddCommand(list)
-	cmd.AddCommand(schema)
-	cmd.AddCommand(status)
-	cmd.AddCommand(stop)
-	cmd.AddCommand(bus)
+	cmd.AddCommand(NewCmdConsume(f))
+	cmd.AddCommand(NewCmdList(f))
+	cmd.AddCommand(NewCmdSchema(f))
+	cmd.AddCommand(NewCmdStatus(f))
+	cmd.AddCommand(NewCmdStop(f))
+	cmd.AddCommand(NewCmdBus(f))

 	return cmd
 }
--- a/cmd/event/external_credential_guard_test.go
+++ b/cmd/event/external_credential_guard_test.go
@@ -1,146 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package event
-
-import (
-	"errors"
-	"io/fs"
-	"path/filepath"
-	"testing"
-
-	"github.com/spf13/cobra"
-
-	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
-	"github.com/larksuite/cli/internal/runtimeplan"
-	"github.com/larksuite/cli/internal/vfs"
-)
-
-func TestEventCommandsRejectDeniedRuntimeCapability(t *testing.T) {
-	cfg := &core.CliConfig{
-		AppID:     "cli_runtime_event_test",
-		AppSecret: "must-not-be-used",
-		Brand:     core.BrandFeishu,
-	}
-	denied := errs.NewValidationError(errs.SubtypeFailedPrecondition,
-		"real-time events are unavailable in this runtime").
-		WithHint("use a runtime that supports real-time events")
-	plan := runtimeplan.New(runtimeplan.Options{
-		Capabilities: func(capability runtimeplan.Capability) error {
-			if capability == runtimeplan.CapabilityRealtimeEvents {
-				return denied
-			}
-			return nil
-		},
-	})
-
-	t.Run("consume", func(t *testing.T) {
-		f, _, _, _ := cmdutil.TestFactoryWithRuntimePlan(t, cfg, plan)
-		cmd := NewCmdEvents(f)
-		args := []string{"consume", "guarded-before-event-lookup"}
-		matched, _, err := cmd.Find(args)
-		if err != nil {
-			t.Fatalf("Find() error = %v", err)
-		}
-		cmd.SetArgs(args)
-		requireExternalEventGuard(t, cmd.Execute())
-		if f.CurrentCommand != matched {
-			t.Fatalf("CurrentCommand = %v, want matched command %v", f.CurrentCommand, matched)
-		}
-	})
-
-	t.Run("bus", func(t *testing.T) {
-		configDir := t.TempDir()
-		t.Setenv("LARKSUITE_CLI_CONFIG_DIR", configDir)
-		f, _, _, _ := cmdutil.TestFactoryWithRuntimePlan(t, cfg, plan)
-		cmd := NewCmdEvents(f)
-		args := []string{"_bus"}
-		matched, _, err := cmd.Find(args)
-		if err != nil {
-			t.Fatalf("Find() error = %v", err)
-		}
-		cmd.SetArgs(args)
-		requireExternalEventGuard(t, cmd.Execute())
-		if f.CurrentCommand != matched {
-			t.Fatalf("CurrentCommand = %v, want matched command %v", f.CurrentCommand, matched)
-		}
-		if _, err := vfs.Stat(filepath.Join(configDir, "events")); !errors.Is(err, fs.ErrNotExist) {
-			t.Fatalf("event bus created runtime files before guard: %v", err)
-		}
-	})
-}
-
-func TestEventCommandRuntimeCapabilityMatrix(t *testing.T) {
-	f, _, _, _ := cmdutil.TestFactory(t, nil)
-	cmd := NewCmdEvents(f)
-
-	parentCapabilities := cmdutil.GetRuntimeCapabilities(cmd)
-	if len(parentCapabilities) != 1 || parentCapabilities[0] != runtimeplan.CapabilityRealtimeEvents {
-		t.Fatalf("event capabilities = %v, want [%s]", parentCapabilities, runtimeplan.CapabilityRealtimeEvents)
-	}
-
-	wantRealtime := map[string]bool{
-		"_bus":    true,
-		"consume": true,
-		"list":    false,
-		"schema":  false,
-		"status":  false,
-		"stop":    false,
-	}
-	children := make(map[string]*cobra.Command, len(wantRealtime))
-	for _, child := range cmd.Commands() {
-		name := child.Name()
-		want, ok := wantRealtime[name]
-		if !ok {
-			t.Fatalf("event command %q is missing from the runtime capability matrix", name)
-		}
-		children[name] = child
-		got := cmdutil.GetRuntimeCapabilities(child)
-		if want {
-			if len(got) != 1 || got[0] != runtimeplan.CapabilityRealtimeEvents {
-				t.Errorf("event %s capabilities = %v, want [%s]", name, got, runtimeplan.CapabilityRealtimeEvents)
-			}
-			continue
-		}
-		if len(got) != 0 {
-			t.Errorf("event %s capabilities = %v, want source-neutral local command", name, got)
-		}
-	}
-	if len(children) != len(wantRealtime) {
-		t.Fatalf("event command matrix covered %d commands, want %d", len(children), len(wantRealtime))
-	}
-
-	// Clearing the parent declaration must also clear both consumers. This
-	// proves they inherit the fail-closed default instead of duplicating a
-	// leaf annotation that future event commands could forget.
-	cmdutil.SetRuntimeCapabilities(cmd)
-	for _, name := range []string{"consume", "_bus"} {
-		if got := cmdutil.GetRuntimeCapabilities(children[name]); len(got) != 0 {
-			t.Errorf("event %s capabilities after clearing parent = %v, want inherited empty declaration", name, got)
-		}
-	}
-}
-
-func requireExternalEventGuard(t *testing.T, err error) {
-	t.Helper()
-	problem, ok := errs.ProblemOf(err)
-	if !ok {
-		t.Fatalf("error = %T %v, want typed problem", err, err)
-	}
-	if problem.Category != errs.CategoryValidation || problem.Subtype != errs.SubtypeFailedPrecondition {
-		t.Fatalf("problem = %s/%s, want %s/%s",
-			problem.Category, problem.Subtype, errs.CategoryValidation, errs.SubtypeFailedPrecondition)
-	}
-	var validationErr *errs.ValidationError
-	if !errors.As(err, &validationErr) {
-		t.Fatalf("error = %T, want *errs.ValidationError", err)
-	}
-	if validationErr.Param != "" {
-		t.Fatalf("param = %q, want empty", validationErr.Param)
-	}
-	if problem.Hint == "" {
-		t.Fatal("hint is empty")
-	}
-}
--- a/cmd/event/list_test.go
+++ b/cmd/event/list_test.go
@@ -17,8 +17,6 @@ import (

 func TestEventLookup_VCMeetingLifecycleKeys(t *testing.T) {
 	for _, key := range []string{
-		"approval.instance.status_changed_v4",
-		"approval.task.status_changed_v4",
 		"vc.meeting.participant_meeting_started_v1",
 		"vc.meeting.participant_meeting_joined_v1",
 	} {
@@ -38,8 +36,6 @@ func TestRunList_TextOutput(t *testing.T) {
 	out := stdout.String()
 	for _, want := range []string{
 		"KEY", "AUTH", "PARAMS", "DESCRIPTION",
-		"approval.instance.status_changed_v4",
-		"approval.task.status_changed_v4",
 		"im.message.receive_v1",
 		"im.message.message_read_v1",
 		"task.task.update_user_access_v2",
@@ -94,8 +90,6 @@ func TestRunList_JSONOutput(t *testing.T) {
 		t.Fatal("event list JSON missing task.task.update_user_access_v2")
 	}
 	for _, want := range []string{
-		"approval.instance.status_changed_v4",
-		"approval.task.status_changed_v4",
 		"vc.meeting.participant_meeting_started_v1",
 		"vc.meeting.participant_meeting_joined_v1",
 	} {
--- a/cmd/event/schema_test.go
+++ b/cmd/event/schema_test.go
@@ -19,29 +19,6 @@ import (
 	_ "github.com/larksuite/cli/events"
 )

-type approvalSchemaJSONPayload struct {
-	JQRootPath           string                           `json:"jq_root_path"`
-	AuthTypes            []string                         `json:"auth_types"`
-	Scopes               []string                         `json:"scopes"`
-	Params               []approvalSchemaJSONParam        `json:"params"`
-	ResolvedOutputSchema approvalSchemaJSONResolvedSchema `json:"resolved_output_schema"`
-}
-
-type approvalSchemaJSONParam struct {
-	Name            string `json:"name"`
-	Type            string `json:"type"`
-	Required        bool   `json:"required"`
-	SubscriptionKey bool   `json:"subscription_key"`
-}
-
-type approvalSchemaJSONResolvedSchema struct {
-	Properties map[string]approvalSchemaJSONProperty `json:"properties"`
-}
-
-type approvalSchemaJSONProperty struct {
-	Format string `json:"format"`
-}
-
 func TestRunSchema_ProcessedKey_Text(t *testing.T) {
 	f, stdout, _, _ := cmdutil.TestFactory(t, &core.CliConfig{AppID: "test"})

@@ -119,40 +96,6 @@ func TestRunSchema_JSONOutput(t *testing.T) {
 	}
 }

-func TestRunSchema_ReceiveMessageAgentFieldsJSON(t *testing.T) {
-	f, stdout, _, _ := cmdutil.TestFactory(t, &core.CliConfig{AppID: "test"})
-
-	if err := runSchema(f, "im.message.receive_v1", true); err != nil {
-		t.Fatalf("runSchema json: %v", err)
-	}
-
-	var payload map[string]interface{}
-	if err := json.Unmarshal(stdout.Bytes(), &payload); err != nil {
-		t.Fatalf("output is not valid JSON: %v\n%s", err, stdout.String())
-	}
-	resolved := payload["resolved_output_schema"].(map[string]interface{})
-	props := resolved["properties"].(map[string]interface{})
-	for _, field := range []string{
-		"root_id",
-		"thread_id",
-		"reply_to",
-		"sender_type",
-		"mentions",
-	} {
-		if _, ok := props[field]; !ok {
-			t.Errorf("receive schema missing field %q", field)
-		}
-	}
-	msgDesc := props["message_id"].(map[string]interface{})["description"].(string)
-	if !strings.Contains(msgDesc, "Recommended idempotency key") {
-		t.Errorf("message_id description should guide deduplication, got %q", msgDesc)
-	}
-	eventDesc := props["event_id"].(map[string]interface{})["description"].(string)
-	if strings.Contains(eventDesc, "safe for deduplication") {
-		t.Errorf("event_id description should not recommend deduplication, got %q", eventDesc)
-	}
-}
-
 func TestRunSchema_TaskUpdateUserAccessJSON(t *testing.T) {
 	f, stdout, _, _ := cmdutil.TestFactory(t, &core.CliConfig{AppID: "test"})

@@ -181,60 +124,6 @@ func TestRunSchema_TaskUpdateUserAccessJSON(t *testing.T) {
 	}
 }

-func TestRunSchema_ApprovalStatusChangedJSON(t *testing.T) {
-	tests := []struct {
-		key   string
-		scope string
-	}{
-		{"approval.instance.status_changed_v4", "approval:instance:read"},
-		{"approval.task.status_changed_v4", "approval:task:read"},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.key, func(t *testing.T) {
-			t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
-			f, stdout, _, _ := cmdutil.TestFactory(t, &core.CliConfig{AppID: "test"})
-
-			if err := runSchema(f, tc.key, true); err != nil {
-				t.Fatalf("runSchema json: %v", err)
-			}
-
-			var payload approvalSchemaJSONPayload
-			if err := json.Unmarshal(stdout.Bytes(), &payload); err != nil {
-				t.Fatalf("output is not valid JSON: %v\n%s", err, stdout.String())
-			}
-			if payload.JQRootPath != "." {
-				t.Errorf("jq_root_path = %v, want .", payload.JQRootPath)
-			}
-			if got := payload.AuthTypes; !reflect.DeepEqual(got, []string{"user"}) {
-				t.Errorf("auth_types = %#v, want user", got)
-			}
-			if got := payload.Scopes; !reflect.DeepEqual(got, []string{tc.scope}) {
-				t.Errorf("scopes = %#v, want %s", got, tc.scope)
-			}
-			if len(payload.Params) != 1 {
-				t.Fatalf("params = %#v, want one subscription_type param", payload.Params)
-			}
-			param := payload.Params[0]
-			if param.Name != "subscription_type" || param.Type != "multi" || param.Required || param.SubscriptionKey {
-				t.Fatalf("subscription_type param = %#v, want optional multi non-subscription-key param", param)
-			}
-			props := payload.ResolvedOutputSchema.Properties
-			for _, field := range []string{"type", "event_id", "timestamp", "approval_code", "instance_code", "status", "operate_time"} {
-				if _, ok := props[field]; !ok {
-					t.Errorf("approval schema missing flat field %q: %+v", field, props)
-				}
-			}
-			if _, ok := props["event"]; ok {
-				t.Errorf("approval Custom schema should be flat, got envelope field event: %+v", props)
-			}
-			if got := props["operate_time"].Format; got != "timestamp_ms" {
-				t.Errorf("operate_time format = %v, want timestamp_ms", got)
-			}
-		})
-	}
-}
-
 func TestRunSchema_JSONOutput_VCMeetingLifecycleKeys(t *testing.T) {
 	for _, key := range []string{
 		"vc.meeting.participant_meeting_started_v1",
--- a/cmd/profile/profile.go
+++ b/cmd/profile/profile.go
@@ -7,7 +7,6 @@ import (
 	"github.com/spf13/cobra"

 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/runtimeplan"
 )

 // NewCmdProfile creates the profile command with subcommands.
@@ -15,26 +14,13 @@ func NewCmdProfile(f *cmdutil.Factory) *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "profile",
 		Short: "Manage configuration profiles",
-		PersistentPreRunE: func(cmd *cobra.Command, _ []string) error {
-			// A child PersistentPreRunE shadows root's PersistentPreRun, so retain
-			// the invocation state used by structured error hints here.
-			cmd.SilenceUsage = true
-			f.CurrentCommand = cmd
-			return f.RequireCommandRuntimeCapabilities(cmd.Context(), cmd)
-		},
 	}
 	cmdutil.DisableAuthCheck(cmd)
-	cmdutil.SetRuntimeCapabilities(cmd, runtimeplan.CapabilityLocalProfileMutation)
 	cmdutil.SetTips(cmd, []string{
 		"AI agents: Do NOT switch or remove profiles unless the user explicitly asks.",
 	})

-	list := NewCmdProfileList(f)
-	// Listing profiles is read-only and remains useful for diagnostics under a
-	// managed credential runtime. Every other profile subcommand mutates local
-	// profile selection, config, or keychain state and inherits the parent gate.
-	cmdutil.SetRuntimeCapabilities(list)
-	cmd.AddCommand(list)
+	cmd.AddCommand(NewCmdProfileList(f))
 	cmd.AddCommand(NewCmdProfileUse(f))
 	cmd.AddCommand(NewCmdProfileAdd(f))
 	cmd.AddCommand(NewCmdProfileRemove(f))
--- a/cmd/profile/runtime_capabilities_test.go
+++ b/cmd/profile/runtime_capabilities_test.go
@@ -1,222 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package profile
-
-import (
-	"bytes"
-	"context"
-	"errors"
-	"path/filepath"
-	"strings"
-	"testing"
-
-	"github.com/larksuite/cli/errs"
-	extcred "github.com/larksuite/cli/extension/credential"
-	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
-	"github.com/larksuite/cli/internal/credential"
-	"github.com/larksuite/cli/internal/runtimeplan"
-	"github.com/larksuite/cli/internal/vfs"
-)
-
-type recordingProfileKeychain struct {
-	gets    int
-	sets    int
-	removes int
-}
-
-func (k *recordingProfileKeychain) Get(_, _ string) (string, error) {
-	k.gets++
-	return "", nil
-}
-
-func (k *recordingProfileKeychain) Set(_, _, _ string) error {
-	k.sets++
-	return nil
-}
-
-func (k *recordingProfileKeychain) Remove(_, _ string) error {
-	k.removes++
-	return nil
-}
-
-func TestProfileMutationCommandsAreDeniedBeforeLocalStateChanges(t *testing.T) {
-	denied := errs.NewValidationError(
-		errs.SubtypeFailedPrecondition,
-		"local credential management is unavailable in this runtime",
-	).WithHint("manage credentials through the active provider")
-	plan := runtimeplan.New(runtimeplan.Options{
-		Capabilities: func(capability runtimeplan.Capability) error {
-			if capability == runtimeplan.CapabilityLocalProfileMutation {
-				return denied
-			}
-			return nil
-		},
-	})
-
-	tests := []struct {
-		name string
-		args []string
-	}{
-		{
-			name: "add",
-			args: []string{"add", "--name", "new", "--app-id", "app-new", "--app-secret-stdin"},
-		},
-		{
-			name: "use",
-			args: []string{"use", "target"},
-		},
-		{
-			name: "rename",
-			args: []string{"rename", "target", "renamed"},
-		},
-		{
-			name: "remove",
-			args: []string{"remove", "target"},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			configDir := setupProfileConfigDir(t)
-			saveManagedGateFixture(t)
-			configPath := filepath.Join(configDir, "config.json")
-			before, err := vfs.ReadFile(configPath)
-			if err != nil {
-				t.Fatalf("ReadFile(before) error = %v", err)
-			}
-
-			f, _, _, _ := cmdutil.TestFactoryWithRuntimePlan(t, nil, plan)
-			f.IOStreams.In = strings.NewReader("must-not-be-read\n")
-			keychain := &recordingProfileKeychain{}
-			f.Keychain = keychain
-
-			cmd := NewCmdProfile(f)
-			cmd.SetArgs(tt.args)
-			err = cmd.Execute()
-			if !errors.Is(err, denied) {
-				t.Fatalf("Execute() error = %v, want denied runtime error", err)
-			}
-
-			after, readErr := vfs.ReadFile(configPath)
-			if readErr != nil {
-				t.Fatalf("ReadFile(after) error = %v", readErr)
-			}
-			if !bytes.Equal(after, before) {
-				t.Fatalf("config changed despite runtime denial:\nbefore: %s\nafter:  %s", before, after)
-			}
-			if keychain.gets != 0 || keychain.sets != 0 || keychain.removes != 0 {
-				t.Fatalf("keychain calls = get:%d set:%d remove:%d, want none",
-					keychain.gets, keychain.sets, keychain.removes)
-			}
-		})
-	}
-}
-
-func TestProfileListRemainsAvailableWhenLocalMutationIsDenied(t *testing.T) {
-	setupProfileConfigDir(t)
-	saveManagedGateFixture(t)
-	plan := runtimeplan.New(runtimeplan.Options{
-		Capabilities: func(capability runtimeplan.Capability) error {
-			if capability == runtimeplan.CapabilityLocalProfileMutation {
-				return errs.NewValidationError(
-					errs.SubtypeFailedPrecondition,
-					"local credential management is unavailable in this runtime",
-				)
-			}
-			return nil
-		},
-	})
-	f, stdout, _, _ := cmdutil.TestFactoryWithRuntimePlan(t, nil, plan)
-
-	cmd := NewCmdProfile(f)
-	cmd.SetArgs([]string{"list"})
-	if err := cmd.Execute(); err != nil {
-		t.Fatalf("profile list was blocked by mutation capability: %v", err)
-	}
-	if !strings.Contains(stdout.String(), `"name": "default"`) {
-		t.Fatalf("profile list output = %s, want default profile", stdout.String())
-	}
-}
-
-func TestProfileMutationCommandsRemainAvailableByDefault(t *testing.T) {
-	setupProfileConfigDir(t)
-	saveManagedGateFixture(t)
-	f, _, _, _ := cmdutil.TestFactory(t, nil)
-	// origin/main allows Profile preparation while an environment/extension
-	// provider is active. The managed runtime blocks this through its explicit
-	// plan policy; generic provider ownership must not change Standard.
-	f.Credential = credential.NewCredentialProvider(
-		[]extcred.Provider{profileEnvironmentProvider{}},
-		nil,
-		nil,
-		nil,
-	)
-
-	cmd := NewCmdProfile(f)
-	args := []string{"use", "target"}
-	matched, _, err := cmd.Find(args)
-	if err != nil {
-		t.Fatalf("Find() error = %v", err)
-	}
-	cmd.SetArgs(args)
-	if err := cmd.Execute(); err != nil {
-		t.Fatalf("profile use with default runtime plan error = %v", err)
-	}
-	if f.CurrentCommand != matched {
-		t.Fatalf("CurrentCommand = %v, want matched command %v", f.CurrentCommand, matched)
-	}
-
-	saved, err := core.LoadMultiAppConfig()
-	if err != nil {
-		t.Fatalf("LoadMultiAppConfig() error = %v", err)
-	}
-	if saved.CurrentApp != "target" || saved.PreviousApp != "default" {
-		t.Fatalf("selection = current:%q previous:%q, want target/default",
-			saved.CurrentApp, saved.PreviousApp)
-	}
-}
-
-type profileEnvironmentProvider struct{}
-
-func (profileEnvironmentProvider) Name() string { return "env" }
-
-func (profileEnvironmentProvider) ResolveAccount(context.Context) (*extcred.Account, error) {
-	return &extcred.Account{
-		AppID:               "cli_environment",
-		Brand:               extcred.BrandFeishu,
-		SupportedIdentities: extcred.SupportsAll,
-	}, nil
-}
-
-func (profileEnvironmentProvider) ResolveToken(context.Context, extcred.TokenSpec) (*extcred.Token, error) {
-	return &extcred.Token{Value: "environment-token"}, nil
-}
-
-func saveManagedGateFixture(t *testing.T) {
-	t.Helper()
-	multi := &core.MultiAppConfig{
-		CurrentApp: "default",
-		Apps: []core.AppConfig{
-			{
-				Name:      "default",
-				AppId:     "app-default",
-				AppSecret: core.PlainSecret("secret-default"),
-				Brand:     core.BrandFeishu,
-			},
-			{
-				Name:  "target",
-				AppId: "app-target",
-				AppSecret: core.SecretInput{Ref: &core.SecretRef{
-					Source: "keychain",
-					ID:     "appsecret:app-target",
-				}},
-				Brand: core.BrandLark,
-			},
-		},
-	}
-	if err := core.SaveMultiAppConfig(multi); err != nil {
-		t.Fatalf("SaveMultiAppConfig() error = %v", err)
-	}
-}
--- a/cmd/root.go
+++ b/cmd/root.go
@@ -21,7 +21,6 @@ import (
 	"github.com/larksuite/cli/internal/deprecation"
 	"github.com/larksuite/cli/internal/hook"
 	"github.com/larksuite/cli/internal/output"
-	"github.com/larksuite/cli/internal/runtimebootstrap"
 	"github.com/larksuite/cli/internal/skillscheck"
 	"github.com/larksuite/cli/internal/suggest"
 	"github.com/larksuite/cli/internal/update"
@@ -101,12 +100,6 @@ func Execute() int {
 		fmt.Fprintln(os.Stderr, "Error:", err)
 		return 1
 	}
-	// Resolve all startup state from the detected workspace. This must happen
-	// before ResolveStartupBrand, isSingleAppMode, or buildInternal reads
-	// workspace-scoped configuration.
-	selectInvocationWorkspace()
-	startup := runtimebootstrap.Resolve(inv.Profile)
-	startupBrand := resolveStartupBrandFromConfig(inv.Profile, startup.ProfileConfig)
 	configureFlagCompletions(os.Args)

 	ctx := context.Background()
@@ -114,8 +107,7 @@ func Execute() int {
 		ctx, inv,
 		WithIO(os.Stdin, os.Stdout, os.Stderr),
 		HideProfile(isSingleAppMode()),
-		WithStartupBrand(startupBrand),
-		withRuntimeBootstrap(startup),
+		WithStartupBrand(ResolveStartupBrand(inv.Profile)),
 	)

 	// --- Notices (non-blocking) ---
@@ -145,7 +137,7 @@ func Execute() int {
 // or both may be present in any given envelope.
 func setupNotices() {
 	// Binary update — synchronous cache check + async refresh
-	if info := checkCachedEditionUpdate(build.Version); info != nil {
+	if info := update.CheckCached(build.Version); info != nil {
 		update.SetPending(info)
 	}
 	ver := build.Version
@@ -155,9 +147,9 @@ func setupNotices() {
 				fmt.Fprintf(os.Stderr, "update check panic: %v\n", r)
 			}
 		}()
-		refreshEditionUpdateCache(ver)
+		update.RefreshCache(ver)
 		if update.GetPending() == nil {
-			if info := checkCachedEditionUpdate(ver); info != nil {
+			if info := update.CheckCached(ver); info != nil {
 				update.SetPending(info)
 			}
 		}
--- a/cmd/root_integration_test.go
+++ b/cmd/root_integration_test.go
@@ -371,11 +371,10 @@ func TestIntegration_StrictModeUser_ProfileOverride_ShortcutExplicitBotReturnsEn

 func TestIntegration_StrictModeBot_ProfileOverride_ServiceExplicitUserReturnsEnvelope(t *testing.T) {
 	f, stdout, stderr := newStrictModeDefaultFactory(t, "target", core.StrictModeBot)
-	catalog := strictModeFixtureCatalog()
-	rootCmd := buildStrictModeIntegrationRootCmdWithCatalog(t, f, &catalog)
+	rootCmd := buildStrictModeIntegrationRootCmd(t, f)

 	code := executeRootIntegration(t, f, rootCmd, []string{
-		"fixture", "things", "create", "--data", `{"name":"probe"}`, "--as", "user", "--dry-run",
+		"im", "chats", "get", "--params", `{"chat_id":"oc_test"}`, "--as", "user", "--dry-run",
 	})

 	if code != output.ExitValidation {
--- a/cmd/root_test.go
+++ b/cmd/root_test.go
@@ -18,7 +18,6 @@ import (
 	cmdconfig "github.com/larksuite/cli/cmd/config"
 	"github.com/larksuite/cli/cmd/schema"
 	"github.com/larksuite/cli/errs"
-	extcred "github.com/larksuite/cli/extension/credential"
 	internalauth "github.com/larksuite/cli/internal/auth"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
@@ -436,25 +435,6 @@ func TestHandleRootError_LeakedUntypedErrorBecomesInternal(t *testing.T) {
 	}
 }

-func TestHandleRootError_BlockErrorPreservesUntypedFallback(t *testing.T) {
-	f, _, _, _ := cmdutil.TestFactory(t, nil)
-	errOut := &bytes.Buffer{}
-	f.IOStreams.ErrOut = errOut
-	blockErr := &extcred.BlockError{Provider: "env", Reason: "LARKSUITE_CLI_APP_ID is missing"}
-
-	exit := handleRootError(f, blockErr)
-	errObj := decodeErrorEnvelope(t, errOut.Bytes())
-	if errObj["type"] != "internal" || errObj["subtype"] != "unknown" {
-		t.Fatalf("error = %#v", errObj)
-	}
-	if errObj["message"] != "blocked by env: LARKSUITE_CLI_APP_ID is missing" {
-		t.Fatalf("error.message = %v", errObj["message"])
-	}
-	if exit != int(output.ExitInternal) {
-		t.Fatalf("exit = %d, want %d", exit, output.ExitInternal)
-	}
-}
-
 // TestHandleRootError_PartialWritePreservesExitCode pins that when the
 // stderr write fails mid-envelope, handleRootError still returns the typed
 // exit code (ExitAuth=3 for AuthenticationError), not fall through to the
--- a/cmd/root_upgrade.go
+++ b/cmd/root_upgrade.go
@@ -11,6 +11,7 @@ import (

 	"github.com/larksuite/cli/internal/build"
 	"github.com/larksuite/cli/internal/cmdutil"
+	"github.com/larksuite/cli/internal/update"
 	"github.com/spf13/cobra"
 )

@@ -57,10 +58,10 @@ func offerRootUpgrade(f *cmdutil.Factory, cmd *cobra.Command) {
 	if !ios.IsTerminal || !ios.OutIsTerminal || !ios.StderrIsTerminal {
 		return
 	}
-	// Gate 4: cached newer version from this binary's release channel.
-	// Standard reads the npm-backed cache; Extended reads its separate
-	// GitHub-release cache.
-	info := checkCachedEditionUpdate(build.Version)
+	// Gate 4: cached newer version. CheckCached applies opt-out (shouldSkip)
+	// and the IsNewer/semver validation chain; it reads the on-disk cache that
+	// the 24h-throttled RefreshCache maintains (CheckCached itself has no TTL).
+	info := update.CheckCached(build.Version)
 	if info == nil {
 		return
 	}
--- a/cmd/root_upgrade_test.go
+++ b/cmd/root_upgrade_test.go
@@ -6,6 +6,7 @@ package cmd
 import (
 	"bytes"
 	"fmt"
+	"os"
 	"path/filepath"
 	"strings"
 	"testing"
@@ -14,21 +15,13 @@ import (
 	"github.com/larksuite/cli/internal/build"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
-	"github.com/larksuite/cli/internal/vfs"
 	"github.com/spf13/cobra"
 )

-func updateStateFileForEdition(edition string) string {
-	if edition == "extended" {
-		return "update-state-extended.json"
-	}
-	return "update-state.json"
-}
-
-func writeUpdateState(t *testing.T, dir, edition, latest string) {
+func writeUpdateState(t *testing.T, dir, latest string) {
 	t.Helper()
 	data := fmt.Sprintf(`{"latest_version":%q,"checked_at":%d}`, latest, time.Now().Unix())
-	if err := vfs.WriteFile(filepath.Join(dir, updateStateFileForEdition(edition)), []byte(data), 0o600); err != nil {
+	if err := os.WriteFile(filepath.Join(dir, "update-state.json"), []byte(data), 0o644); err != nil {
 		t.Fatal(err)
 	}
 }
@@ -112,7 +105,7 @@ func TestOfferRootUpgrade(t *testing.T) {
 			t.Setenv("RUN_ID", "")
 			t.Setenv("LARKSUITE_CLI_NO_UPDATE_NOTIFIER", "")
 			if tc.latest != "" {
-				writeUpdateState(t, dir, build.Edition, tc.latest)
+				writeUpdateState(t, dir, tc.latest)
 			}
 			if tc.optOut {
 				t.Setenv("LARKSUITE_CLI_NO_UPDATE_NOTIFIER", "1")
@@ -142,53 +135,6 @@ func TestOfferRootUpgrade(t *testing.T) {
 	}
 }

-func TestOfferRootUpgradeIgnoresOtherEditionCache(t *testing.T) {
-	origV := build.Version
-	build.Version = "1.0.0"
-	t.Cleanup(func() { build.Version = origV })
-
-	origRun := runRootUpgrade
-	t.Cleanup(func() { runRootUpgrade = origRun })
-
-	origWS := core.CurrentWorkspace()
-	t.Cleanup(func() { core.SetCurrentWorkspace(origWS) })
-	core.SetCurrentWorkspace(core.WorkspaceLocal)
-
-	dir := t.TempDir()
-	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", dir)
-	t.Setenv("CI", "")
-	t.Setenv("BUILD_NUMBER", "")
-	t.Setenv("RUN_ID", "")
-	t.Setenv("LARKSUITE_CLI_NO_UPDATE_NOTIFIER", "")
-
-	otherEdition := "extended"
-	if build.Edition == "extended" {
-		otherEdition = "standard"
-	}
-	writeUpdateState(t, dir, otherEdition, "9.0.0")
-
-	called := false
-	runRootUpgrade = func(*cobra.Command) { called = true }
-	var errBuf bytes.Buffer
-	f := &cmdutil.Factory{IOStreams: &cmdutil.IOStreams{
-		In:               strings.NewReader("y\n"),
-		Out:              &bytes.Buffer{},
-		ErrOut:           &errBuf,
-		IsTerminal:       true,
-		OutIsTerminal:    true,
-		StderrIsTerminal: true,
-	}}
-
-	offerRootUpgrade(f, &cobra.Command{})
-
-	if strings.Contains(errBuf.String(), "available") {
-		t.Fatalf("%s prompt consumed %s cache: %q", build.Edition, otherEdition, errBuf.String())
-	}
-	if called {
-		t.Fatalf("%s upgrade ran from %s cache", build.Edition, otherEdition)
-	}
-}
-
 func TestInstallRootUpgradePromptPreservesInner(t *testing.T) {
 	orig := rawInvocationArgs
 	t.Cleanup(func() { rawInvocationArgs = orig })
--- a/cmd/service/service.go
+++ b/cmd/service/service.go
@@ -403,9 +403,9 @@ func serviceMethodRun(opts *ServiceMethodOptions) error {

 	if opts.DryRun {
 		if fileMeta != nil {
-			return cmdutil.PrintDryRunWithFile(request, config, serviceDryRunOutputOptions(f, opts), *fileMeta)
+			return cmdutil.PrintDryRunWithFile(f.IOStreams.Out, request, config, opts.Format, fileMeta.FieldName, fileMeta.FilePath, fileMeta.FormFields)
 		}
-		return serviceDryRun(f, request, config, opts)
+		return serviceDryRun(f, request, config, opts.Format)
 	}

 	if opts.Method.Risk == cmdutil.RiskHighRiskWrite {
@@ -667,19 +667,8 @@ func buildServiceRequest(opts *ServiceMethodOptions) (client.RawApiRequest, *cmd
 	return request, nil, nil
 }

-func serviceDryRun(f *cmdutil.Factory, request client.RawApiRequest, config *core.CliConfig, opts *ServiceMethodOptions) error {
-	return cmdutil.PrintDryRun(request, config, serviceDryRunOutputOptions(f, opts))
-}
-
-func serviceDryRunOutputOptions(f *cmdutil.Factory, opts *ServiceMethodOptions) cmdutil.DryRunOutputOptions {
-	return cmdutil.DryRunOutputOptions{
-		Format:      opts.Format,
-		JqExpr:      opts.JqExpr,
-		CommandPath: opts.Cmd.CommandPath(),
-		Identity:    opts.As,
-		Out:         f.IOStreams.Out,
-		ErrOut:      f.IOStreams.ErrOut,
-	}
+func serviceDryRun(f *cmdutil.Factory, request client.RawApiRequest, config *core.CliConfig, format string) error {
+	return cmdutil.PrintDryRun(f.IOStreams.Out, request, config, format)
 }

 func servicePaginate(ctx context.Context, ac *client.APIClient, request client.RawApiRequest, format output.Format, jqExpr string, out, errOut io.Writer, commandPath string, pagOpts client.PaginationOptions, checkErr func(interface{}, core.Identity) error) error {
@@ -707,18 +696,20 @@ func servicePaginate(ctx context.Context, ac *client.APIClient, request client.R

 	switch format {
 	case output.FormatNDJSON, output.FormatTable, output.FormatCSV:
-		emitter := output.NewEmitter(output.EmitterConfig{
-			Out:            out,
-			ErrOut:         errOut,
-			CommandPath:    commandPath,
-			Identity:       string(pagOpts.Identity),
-			NoticeProvider: output.GetNotice,
-		})
+		pf := output.NewPaginatedFormatter(out, format)
 		result, hasItems, err := ac.StreamPages(ctx, request, func(items []interface{}) error {
 			// Streaming formats intentionally emit each page after that page has
 			// passed safety scanning. A later page may still fail, so callers
 			// must use the exit code to distinguish complete vs partial output.
-			return emitter.StreamPage(items, output.StreamOptions{Format: format.String()})
+			scanResult := output.ScanForSafety(commandPath, items, errOut)
+			if scanResult.Blocked {
+				return scanResult.BlockErr
+			}
+			if scanResult.Alert != nil {
+				output.WriteAlertWarning(errOut, scanResult.Alert)
+			}
+			pf.FormatPage(items)
+			return nil
 		}, pagOpts)
 		if err != nil {
 			return err
--- a/cmd/service/service_paginate_test.go
+++ b/cmd/service/service_paginate_test.go
@@ -1,400 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package service
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"io"
-	"net/http"
-	"testing"
-
-	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/client"
-	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
-	"github.com/larksuite/cli/internal/httpmock"
-	"github.com/larksuite/cli/internal/output"
-)
-
-type serviceFailOnWriteWriter struct {
-	buf    bytes.Buffer
-	writes int
-	failAt int
-	err    error
-}
-
-func (w *serviceFailOnWriteWriter) Write(p []byte) (int, error) {
-	w.writes++
-	if w.writes == w.failAt {
-		return 0, w.err
-	}
-	return w.buf.Write(p)
-}
-
-func newServicePaginateTestHarness(t *testing.T) (*client.APIClient, *bytes.Buffer, *bytes.Buffer, *httpmock.Registry) {
-	t.Helper()
-	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
-	t.Setenv("LARKSUITE_CLI_CONTENT_SAFETY_MODE", "off")
-	previousNotice := output.PendingNotice
-	output.PendingNotice = nil
-	t.Cleanup(func() { output.PendingNotice = previousNotice })
-
-	config := &core.CliConfig{
-		AppID:     "test-app",
-		AppSecret: "test-secret",
-		Brand:     core.BrandFeishu,
-	}
-	f, out, errOut, reg := cmdutil.TestFactory(t, config)
-	ac, err := f.NewAPIClientWithConfig(config)
-	if err != nil {
-		t.Fatalf("NewAPIClientWithConfig() error = %v", err)
-	}
-	ac.ErrOut = io.Discard
-	return ac, out, errOut, reg
-}
-
-func servicePaginateRequest() client.RawApiRequest {
-	return client.RawApiRequest{
-		Method: "GET",
-		URL:    "/open-apis/test/v1/items",
-		As:     core.AsBot,
-	}
-}
-
-func assertServicePaginateJSONBytes(t *testing.T, got []byte, want interface{}) {
-	t.Helper()
-	wantBytes, err := json.MarshalIndent(want, "", "  ")
-	if err != nil {
-		t.Fatalf("marshal expected JSON: %v", err)
-	}
-	wantBytes = append(wantBytes, '\n')
-	if !bytes.Equal(got, wantBytes) {
-		t.Fatalf("stdout bytes mismatch\ngot:\n%s\nwant:\n%s", got, wantBytes)
-	}
-}
-
-func TestServicePaginate_DefaultAggregatesAllPages(t *testing.T) {
-	ac, out, errOut, reg := newServicePaginateTestHarness(t)
-	calls := 0
-	wantTokens := []string{"", "next-1", "next-2"}
-	for i, wantToken := range wantTokens {
-		page := i + 1
-		hasMore := page < len(wantTokens)
-		data := map[string]interface{}{
-			"items":    []interface{}{map[string]interface{}{"id": string(rune('0' + page))}},
-			"has_more": hasMore,
-		}
-		if hasMore {
-			data["page_token"] = wantTokens[page]
-		}
-		reg.Register(&httpmock.Stub{
-			URL: "/open-apis/test/v1/items",
-			OnMatch: func(req *http.Request) {
-				calls++
-				if got := req.URL.Query().Get("page_token"); got != wantToken {
-					t.Errorf("request %d page_token = %q, want %q", page, got, wantToken)
-				}
-			},
-			Body: map[string]interface{}{
-				"code": 0,
-				"msg":  "ok",
-				"data": data,
-			},
-		})
-	}
-
-	err := servicePaginate(context.Background(), ac, servicePaginateRequest(),
-		output.FormatJSON, "", out, errOut, "lark-cli test items list", client.PaginationOptions{
-			PageLimit: 10,
-			PageDelay: -1,
-		}, ac.CheckResponse)
-
-	if err != nil {
-		t.Fatalf("servicePaginate() error = %v, want nil", err)
-	}
-	if calls != 3 {
-		t.Fatalf("pagination requests = %d, want 3", calls)
-	}
-	assertServicePaginateJSONBytes(t, out.Bytes(), output.Envelope{
-		OK:       true,
-		Identity: "bot",
-		Data: map[string]interface{}{
-			"items": []interface{}{
-				map[string]interface{}{"id": "1"},
-				map[string]interface{}{"id": "2"},
-				map[string]interface{}{"id": "3"},
-			},
-			"has_more": false,
-		},
-	})
-	if got := errOut.String(); got != "" {
-		t.Fatalf("stderr bytes = %q, want empty", got)
-	}
-}
-
-func TestServicePaginate_StreamingFormatsEmitExactMultiPageBytes(t *testing.T) {
-	tests := []struct {
-		name   string
-		format output.Format
-		want   string
-	}{
-		{
-			name:   "ndjson",
-			format: output.FormatNDJSON,
-			want:   "{\"id\":\"1\",\"name\":\"Alice\"}\n{\"id\":\"2\",\"name\":\"Carol\",\"page_only\":\"ignored\"}\n",
-		},
-		{
-			name:   "table",
-			format: output.FormatTable,
-			want:   "id  name \n──  ─────\n1   Alice\n2   Carol\n",
-		},
-		{
-			name:   "csv",
-			format: output.FormatCSV,
-			want:   "id,name\n1,Alice\n2,Carol\n",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			ac, out, errOut, reg := newServicePaginateTestHarness(t)
-			reg.Register(&httpmock.Stub{
-				URL: "/open-apis/test/v1/items",
-				Body: map[string]interface{}{
-					"code": 0,
-					"msg":  "ok",
-					"data": map[string]interface{}{
-						"items": []interface{}{
-							map[string]interface{}{"id": "1", "name": "Alice"},
-						},
-						"has_more":   true,
-						"page_token": "next-1",
-					},
-				},
-			})
-			reg.Register(&httpmock.Stub{
-				URL: "/open-apis/test/v1/items",
-				Body: map[string]interface{}{
-					"code": 0,
-					"msg":  "ok",
-					"data": map[string]interface{}{
-						"items": []interface{}{
-							map[string]interface{}{"id": "2", "name": "Carol", "page_only": "ignored"},
-						},
-						"has_more": false,
-					},
-				},
-			})
-
-			err := servicePaginate(context.Background(), ac, servicePaginateRequest(),
-				tt.format, "", out, errOut, "lark-cli test items list", client.PaginationOptions{
-					PageLimit: 10,
-					PageDelay: -1,
-				}, ac.CheckResponse)
-
-			if err != nil {
-				t.Fatalf("servicePaginate() error = %v, want nil", err)
-			}
-			if got := out.String(); got != tt.want {
-				t.Fatalf("stdout byte mismatch\ngot (%d bytes):\n%q\nwant (%d bytes):\n%q", len(got), got, len(tt.want), tt.want)
-			}
-			if got := errOut.String(); got != "" {
-				t.Fatalf("stderr bytes = %q, want empty", got)
-			}
-		})
-	}
-}
-
-func TestServicePaginate_StreamingWriteFailureStopsFurtherPages(t *testing.T) {
-	ac, _, errOut, reg := newServicePaginateTestHarness(t)
-	sentinel := errors.New("page write failed")
-	out := &serviceFailOnWriteWriter{failAt: 2, err: sentinel}
-	calls := 0
-	for page := 1; page <= 2; page++ {
-		hasMore := true
-		data := map[string]interface{}{
-			"items":    []interface{}{map[string]interface{}{"id": page}},
-			"has_more": hasMore,
-		}
-		if hasMore {
-			data["page_token"] = fmt.Sprintf("next-%d", page)
-		}
-		reg.Register(&httpmock.Stub{
-			URL: "/open-apis/test/v1/items",
-			OnMatch: func(*http.Request) {
-				calls++
-			},
-			Body: map[string]interface{}{
-				"code": 0,
-				"msg":  "ok",
-				"data": data,
-			},
-		})
-	}
-
-	err := servicePaginate(context.Background(), ac, servicePaginateRequest(),
-		output.FormatNDJSON, "", out, errOut, "lark-cli test items list",
-		client.PaginationOptions{PageLimit: 10, PageDelay: -1}, ac.CheckResponse)
-
-	if !errors.Is(err, sentinel) {
-		t.Fatalf("servicePaginate() error = %v, want preserved writer cause", err)
-	}
-	problem, ok := errs.ProblemOf(err)
-	if !ok || problem.Category != errs.CategoryInternal {
-		t.Fatalf("servicePaginate() problem = %#v, %v; want internal typed error", problem, ok)
-	}
-	if calls != 2 {
-		t.Fatalf("pagination requests = %d, want 2", calls)
-	}
-	if got, want := out.buf.String(), "{\"id\":1}\n"; got != want {
-		t.Fatalf("stdout bytes = %q, want %q", got, want)
-	}
-}
-
-func TestServicePaginate_StreamingFormatFallsBackToJSONWithoutList(t *testing.T) {
-	ac, out, errOut, reg := newServicePaginateTestHarness(t)
-	reg.Register(&httpmock.Stub{
-		URL: "/open-apis/test/v1/items",
-		Body: map[string]interface{}{
-			"code": 0,
-			"msg":  "ok",
-			"data": map[string]interface{}{
-				"name":    "Test User",
-				"user_id": "u123",
-			},
-		},
-	})
-
-	err := servicePaginate(context.Background(), ac, servicePaginateRequest(),
-		output.FormatNDJSON, "", out, errOut, "lark-cli test items get",
-		client.PaginationOptions{PageDelay: -1}, ac.CheckResponse)
-
-	if err != nil {
-		t.Fatalf("servicePaginate() error = %v, want nil", err)
-	}
-	assertServicePaginateJSONBytes(t, out.Bytes(), output.Envelope{
-		OK:       true,
-		Identity: "bot",
-		Data: map[string]interface{}{
-			"name":    "Test User",
-			"user_id": "u123",
-		},
-	})
-	wantWarning := "warning: this API does not return a list, format \"ndjson\" is not supported, falling back to json\n"
-	if got := errOut.String(); got != wantWarning {
-		t.Fatalf("stderr bytes = %q, want %q", got, wantWarning)
-	}
-}
-
-func TestServicePaginate_BusinessErrorsWriteRawAndRemainUnmarked(t *testing.T) {
-	businessResponse := map[string]interface{}{
-		"code": 123456,
-		"msg":  "fixture business error",
-		"data": map[string]interface{}{"detail": "business failed"},
-	}
-	tests := []struct {
-		name   string
-		format output.Format
-		jqExpr string
-	}{
-		{name: "jq", format: output.FormatJSON, jqExpr: ".data.items"},
-		{name: "default_json", format: output.FormatJSON},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			ac, out, errOut, reg := newServicePaginateTestHarness(t)
-			reg.Register(&httpmock.Stub{
-				URL:  "/open-apis/test/v1/items",
-				Body: businessResponse,
-			})
-
-			err := servicePaginate(context.Background(), ac, servicePaginateRequest(),
-				tt.format, tt.jqExpr, out, errOut, "lark-cli test items list",
-				client.PaginationOptions{PageDelay: -1}, ac.CheckResponse)
-
-			if err == nil {
-				t.Fatal("servicePaginate() error = nil, want business error")
-			}
-			if errs.IsRaw(err) {
-				t.Fatalf("errs.IsRaw(error) = true, want current servicePaginate pass-through behavior")
-			}
-			assertServicePaginateJSONBytes(t, out.Bytes(), businessResponse)
-			if bytes.Contains(out.Bytes(), []byte(`"ok": true`)) {
-				t.Fatalf("business-error stdout contains a success envelope:\n%s", out.Bytes())
-			}
-			if got := errOut.String(); got != "" {
-				t.Fatalf("stderr bytes = %q, want empty", got)
-			}
-		})
-	}
-}
-
-func TestServicePaginate_TransportErrorsRemainUnmarked(t *testing.T) {
-	tests := []struct {
-		name   string
-		format output.Format
-		jqExpr string
-	}{
-		{name: "jq_paginate_all", format: output.FormatJSON, jqExpr: ".data.items"},
-		{name: "stream_pages", format: output.FormatNDJSON},
-		{name: "default_paginate_all", format: output.FormatJSON},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			ac, out, errOut, _ := newServicePaginateTestHarness(t)
-
-			err := servicePaginate(context.Background(), ac, servicePaginateRequest(),
-				tt.format, tt.jqExpr, out, errOut, "lark-cli test items list",
-				client.PaginationOptions{PageDelay: -1}, ac.CheckResponse)
-
-			if err == nil {
-				t.Fatal("servicePaginate() error = nil, want transport error")
-			}
-			if errs.IsRaw(err) {
-				t.Fatalf("errs.IsRaw(error) = true, want current servicePaginate pass-through behavior")
-			}
-			if got := out.String(); got != "" {
-				t.Fatalf("stdout bytes = %q, want empty", got)
-			}
-			if got := errOut.String(); got != "" {
-				t.Fatalf("stderr bytes = %q, want empty", got)
-			}
-		})
-	}
-}
-
-func TestServicePaginate_StreamBusinessErrorRemainsUnmarked(t *testing.T) {
-	ac, out, errOut, reg := newServicePaginateTestHarness(t)
-	reg.Register(&httpmock.Stub{
-		URL: "/open-apis/test/v1/items",
-		Body: map[string]interface{}{
-			"code": 123456,
-			"msg":  "fixture business error",
-			"data": map[string]interface{}{},
-		},
-	})
-
-	err := servicePaginate(context.Background(), ac, servicePaginateRequest(),
-		output.FormatNDJSON, "", out, errOut, "lark-cli test items list",
-		client.PaginationOptions{PageDelay: -1}, ac.CheckResponse)
-
-	if err == nil {
-		t.Fatal("servicePaginate() error = nil, want business error")
-	}
-	if errs.IsRaw(err) {
-		t.Fatalf("errs.IsRaw(error) = true, want current servicePaginate pass-through behavior")
-	}
-	if got := out.String(); got != "" {
-		t.Fatalf("stdout bytes = %q, want empty", got)
-	}
-	if got := errOut.String(); got != "" {
-		t.Fatalf("stderr bytes = %q, want empty", got)
-	}
-}
--- a/cmd/service/service_test.go
+++ b/cmd/service/service_test.go
@@ -224,39 +224,13 @@ func TestServiceMethod_DryRun_PathParam(t *testing.T) {
 			if err := cmd.Execute(); err != nil {
 				t.Fatalf("unexpected error: %v", err)
 			}
-			var got map[string]interface{}
-			if err := json.Unmarshal(stdout.Bytes(), &got); err != nil {
-				t.Fatalf("dry-run stdout is not JSON: %v\n%s", err, stdout.String())
-			}
-			if got["ok"] != true || got["dry_run"] != true {
-				t.Fatalf("unexpected dry-run envelope: %#v", got)
-			}
-			data := got["data"].(map[string]interface{})
-			api := data["api"].([]interface{})
-			call := api[0].(map[string]interface{})
-			if call["url"] != tt.wantInURL {
-				t.Errorf("url = %q, want %q\nstdout:\n%s", call["url"], tt.wantInURL, stdout.String())
+			if !strings.Contains(stdout.String(), tt.wantInURL) {
+				t.Errorf("expected URL containing %q, got:\n%s", tt.wantInURL, stdout.String())
 			}
 		})
 	}
 }

-func TestServiceMethod_DryRunWithJq(t *testing.T) {
-	f, stdout, _, _ := cmdutil.TestFactory(t, testConfig)
-	cmd := NewCmdServiceMethod(f, driveSpec(), driveMethod("GET", nil), "get", "files", nil)
-	cmd.SetArgs([]string{
-		"--params", `{"file_token":"boxcn123abc"}`,
-		"--dry-run",
-		"--jq", ".data.api[0].url",
-	})
-	if err := cmd.Execute(); err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if got, want := strings.TrimSpace(stdout.String()), "/open-apis/drive/v1/files/boxcn123abc/copy"; got != want {
-		t.Fatalf("jq output = %q, want %q", got, want)
-	}
-}
-
 func TestServiceMethod_PathParamRejectsTraversal(t *testing.T) {
 	tests := []struct {
 		name      string
@@ -344,12 +318,8 @@ func TestServiceMethod_PaginationParamSkippedWithPageAll(t *testing.T) {
 	if err != nil {
 		t.Fatalf("expected no error with --page-all skipping page_size, got: %v", err)
 	}
-	var got map[string]interface{}
-	if err := json.Unmarshal(stdout.Bytes(), &got); err != nil {
-		t.Fatalf("dry-run stdout is not JSON: %v\n%s", err, stdout.String())
-	}
-	if got["dry_run"] != true {
-		t.Fatalf("dry_run = %#v, want true", got["dry_run"])
+	if !strings.Contains(stdout.String(), "Dry Run") {
+		t.Error("expected dry-run output")
 	}
 }

@@ -1111,23 +1081,11 @@ func TestServiceMethod_FileUpload_DryRun(t *testing.T) {
 		t.Fatalf("unexpected error: %v", err)
 	}
 	out := stdout.String()
-	var env map[string]interface{}
-	if err := json.Unmarshal(stdout.Bytes(), &env); err != nil {
-		t.Fatalf("dry-run stdout is not JSON: %v\n%s", err, out)
+	if !strings.Contains(out, "image") {
+		t.Errorf("expected dry-run output to mention file field, got: %s", out)
 	}
-	if env["dry_run"] != true {
-		t.Fatalf("dry_run = %#v, want true", env["dry_run"])
-	}
-	data := env["data"].(map[string]interface{})
-	api := data["api"].([]interface{})
-	call := api[0].(map[string]interface{})
-	body := call["body"].(map[string]interface{})
-	file := body["file"].(map[string]interface{})
-	if file["field"] != "image" || file["path"] != tmpFile {
-		t.Fatalf("unexpected file dry-run body: %#v", body)
-	}
-	if strings.Contains(out, "=== Dry Run ===") {
-		t.Fatalf("stdout should not contain dry-run banner: %s", out)
+	if !strings.Contains(out, "Dry Run") {
+		t.Errorf("expected dry-run header, got: %s", out)
 	}
 }

--- a/cmd/service/testmain_test.go
+++ b/cmd/service/testmain_test.go
@@ -1,39 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package service
-
-import (
-	"os"
-	"testing"
-
-	"github.com/larksuite/cli/internal/registry/registrytest"
-)
-
-// TestMain isolates service command tests from the host machine: config (and
-// the registry cache under it) is redirected to a temp dir, then the registry
-// is seeded from the tracked fixture and initialized eagerly. Tests pass on a
-// clean checkout with no network, no `make fetch_meta`, and no user cache.
-//
-// Note: os.Exit skips deferred functions, so cleanup runs explicitly after
-// m.Run before exiting.
-func TestMain(m *testing.M) {
-	root, err := os.MkdirTemp("", "lark-cli-cmd-service-test-*")
-	if err != nil {
-		println("cmd/service test setup: MkdirTemp failed:", err.Error())
-		os.Exit(2)
-	}
-	if err := os.Setenv("LARKSUITE_CLI_CONFIG_DIR", root); err != nil {
-		println("cmd/service test setup: Setenv failed:", err.Error())
-		os.RemoveAll(root)
-		os.Exit(2)
-	}
-	if err := registrytest.Seed(root); err != nil {
-		println("cmd/service test setup: registrytest.Seed failed:", err.Error())
-		os.RemoveAll(root)
-		os.Exit(2)
-	}
-	code := m.Run()
-	os.RemoveAll(root)
-	os.Exit(code)
-}
--- a/cmd/startup_brand.go
+++ b/cmd/startup_brand.go
@@ -10,34 +10,17 @@ import (
 	"github.com/larksuite/cli/internal/envvars"
 )

-// selectInvocationWorkspace establishes the workspace before any startup
-// consumer reads workspace-scoped configuration. Execute needs this before
-// resolving the registry brand, while Build/buildInternal needs it before
-// capturing the immutable Profile snapshot passed to the Factory.
-func selectInvocationWorkspace() core.Workspace {
-	workspace := core.DetectWorkspaceFromEnv(os.Getenv)
-	core.SetCurrentWorkspace(workspace)
-	return workspace
-}
-
 // ResolveStartupBrand resolves the brand before the command tree is built, so
 // the registry's remote metadata overlay uses the configured brand from the
 // first catalog access. It mirrors the credential chain's brand precedence —
 // environment, then the active profile's raw config entry — without touching
 // the keychain (no secrets are needed to know the brand).
 func ResolveStartupBrand(profile string) core.LarkBrand {
-	config, _ := core.LoadMultiAppConfig()
-	return resolveStartupBrandFromConfig(profile, config)
-}
-
-// resolveStartupBrandFromConfig keeps registry routing on the same immutable
-// Profile snapshot used by credentials and runtime policy.
-func resolveStartupBrandFromConfig(profile string, config *core.MultiAppConfig) core.LarkBrand {
 	if raw := os.Getenv(envvars.CliBrand); raw != "" {
 		return core.ParseBrand(raw)
 	}
-	if config != nil {
-		if app := config.CurrentAppConfig(profile); app != nil {
+	if cfg, err := core.LoadMultiAppConfig(); err == nil {
+		if app := cfg.CurrentAppConfig(profile); app != nil {
 			return core.ParseBrand(string(app.Brand))
 		}
 	}
--- a/cmd/startup_brand_test.go
+++ b/cmd/startup_brand_test.go
@@ -5,7 +5,6 @@ package cmd

 import (
 	"context"
-	"flag"
 	"fmt"
 	"os"
 	"os/exec"
@@ -13,34 +12,11 @@ import (
 	"strings"
 	"testing"

-	"github.com/google/uuid"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/registry"
 )

-const startupBrandHelperEnv = "GO_TEST_STARTUP_BRAND_HELPER"
-
-var _ = flag.String("startup-brand-helper", "", "internal startup brand test helper nonce")
-
-func isStartupBrandHelper() bool {
-	return startupBrandHelperEnabled(os.Getenv(startupBrandHelperEnv), startupBrandHelperNonce(os.Args))
-}
-
-func startupBrandHelperEnabled(envNonce, argNonce string) bool {
-	return envNonce != "" && envNonce == argNonce
-}
-
-func startupBrandHelperNonce(args []string) string {
-	const prefix = "-startup-brand-helper="
-	for _, arg := range args {
-		if strings.HasPrefix(arg, prefix) {
-			return strings.TrimPrefix(arg, prefix)
-		}
-	}
-	return ""
-}
-
 func TestResolveStartupBrand_Precedence(t *testing.T) {
 	tmp := t.TempDir()
 	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", tmp)
@@ -78,7 +54,7 @@ func TestResolveStartupBrand_Precedence(t *testing.T) {
 // sync.Once, so the brand must be injected before the first catalog access.
 // It runs in a subprocess because the registry is process-global.
 func TestStartupBrandReachesRegistry_RealStartupOrder(t *testing.T) {
-	if isStartupBrandHelper() {
+	if os.Getenv("GO_TEST_STARTUP_BRAND_HELPER") == "1" {
 		// Helper: replicate Execute()'s build wiring with a lark config.
 		buildInternal(
 			context.Background(), cmdutil.InvocationContext{},
@@ -95,11 +71,9 @@ func TestStartupBrandReachesRegistry_RealStartupOrder(t *testing.T) {
 		t.Fatal(err)
 	}

-	nonce := uuid.NewString()
-	t.Setenv(startupBrandHelperEnv, nonce)
 	cmd := exec.Command(os.Args[0], "-test.run", "TestStartupBrandReachesRegistry_RealStartupOrder")
-	cmd.Args = append(cmd.Args, "-startup-brand-helper="+nonce)
 	cmd.Env = append(os.Environ(),
+		"GO_TEST_STARTUP_BRAND_HELPER=1",
 		"LARKSUITE_CLI_CONFIG_DIR="+tmp,
 		"LARKSUITE_CLI_REMOTE_META=off", // no network during the subprocess build
 	)
@@ -111,33 +85,3 @@ func TestStartupBrandReachesRegistry_RealStartupOrder(t *testing.T) {
 		t.Errorf("registry brand after real startup order = %s, want lark", out)
 	}
 }
-
-func TestStartupBrandHelperRequiresMatchingCommandNonce(t *testing.T) {
-	for _, tt := range []struct {
-		name     string
-		envNonce string
-		argNonce string
-		want     bool
-	}{
-		{name: "neither set"},
-		{name: "ambient environment only", envNonce: "ambient"},
-		{name: "command argument only", argNonce: "command"},
-		{name: "mismatch", envNonce: "ambient", argNonce: "command"},
-		{name: "matching", envNonce: "nonce", argNonce: "nonce", want: true},
-	} {
-		t.Run(tt.name, func(t *testing.T) {
-			if got := startupBrandHelperEnabled(tt.envNonce, tt.argNonce); got != tt.want {
-				t.Fatalf("startupBrandHelperEnabled() = %v, want %v", got, tt.want)
-			}
-		})
-	}
-}
-
-func TestStartupBrandHelperNonce(t *testing.T) {
-	if got := startupBrandHelperNonce([]string{"test", "-test.run", "brand"}); got != "" {
-		t.Fatalf("startupBrandHelperNonce() = %q, want empty", got)
-	}
-	if got := startupBrandHelperNonce([]string{"test", "-startup-brand-helper=nonce"}); got != "nonce" {
-		t.Fatalf("startupBrandHelperNonce() = %q, want nonce", got)
-	}
-}
--- a/cmd/testmain_test.go
+++ b/cmd/testmain_test.go
@@ -1,46 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package cmd
-
-import (
-	"os"
-	"testing"
-
-	"github.com/larksuite/cli/internal/registry/registrytest"
-)
-
-// TestMain isolates command-tree tests from the host machine: config (and the
-// registry cache under it) is redirected to a temp dir, then the registry is
-// seeded from the tracked fixture and initialized eagerly. Tests pass on a
-// clean checkout with no network, no `make fetch_meta`, and no user cache.
-//
-// Note: os.Exit skips deferred functions, so cleanup runs explicitly after
-// m.Run before exiting.
-func TestMain(m *testing.M) {
-	if isStartupBrandHelper() {
-		// Re-exec helper subprocess (startup_brand_test.go): the parent test
-		// already provides an isolated config dir and disables remote metadata,
-		// and the helper must own the first registry Init to prove the startup
-		// order — do not seed or eagerly initialize here.
-		os.Exit(m.Run())
-	}
-	root, err := os.MkdirTemp("", "lark-cli-cmd-test-*")
-	if err != nil {
-		println("cmd test setup: MkdirTemp failed:", err.Error())
-		os.Exit(2)
-	}
-	if err := os.Setenv("LARKSUITE_CLI_CONFIG_DIR", root); err != nil {
-		println("cmd test setup: Setenv failed:", err.Error())
-		os.RemoveAll(root)
-		os.Exit(2)
-	}
-	if err := registrytest.Seed(root); err != nil {
-		println("cmd test setup: registrytest.Seed failed:", err.Error())
-		os.RemoveAll(root)
-		os.Exit(2)
-	}
-	code := m.Run()
-	os.RemoveAll(root)
-	os.Exit(code)
-}
--- a/cmd/update/edition_extended.go
+++ b/cmd/update/edition_extended.go
@@ -1,100 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-//go:build extended
-
-package cmdupdate
-
-import (
-	"errors"
-	"fmt"
-
-	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/build"
-	"github.com/larksuite/cli/internal/extendedupdate"
-	"github.com/larksuite/cli/internal/output"
-	"github.com/larksuite/cli/internal/skillscheck"
-	"github.com/larksuite/cli/internal/update"
-)
-
-var (
-	fetchExtendedLatest = extendedupdate.FetchLatest
-	installExtended     = extendedupdate.Install
-)
-
-func updateLongDescription() string {
-	return `Update lark-cli Extended from the matching GitHub Release.
-
-The command downloads the lark-cli-extended asset for the current platform,
-verifies its SHA-256 checksum and compiled edition identity, then replaces the
-current binary. It never installs the Standard npm/npx edition.
-
-Use --json for structured output (for AI agents and scripts).
-Use --check to only check for updates without installing.`
-}
-
-func runEditionUpdate(opts *UpdateOptions) (bool, error) {
-	io := opts.Factory.IOStreams
-	cur := currentVersion()
-	updater := newUpdater()
-	if !opts.Check {
-		updater.Brand = resolveSkillsBrand(opts.Factory, io.ErrOut)
-		updater.CleanupStaleFiles()
-	}
-	output.PendingNotice = nil
-
-	latest, err := fetchExtendedLatest()
-	if err != nil {
-		var typed errs.TypedError
-		if errors.As(err, &typed) {
-			return true, reportError(opts, io, "network", typed)
-		}
-		return true, reportError(opts, io, "network",
-			errs.NewNetworkError(errs.SubtypeNetworkTransport,
-				"failed to check the latest Extended version: %v", err).WithCause(err))
-	}
-	if update.ParseVersion(latest) == nil {
-		return true, reportError(opts, io, "update_error",
-			errs.NewInternalError(errs.SubtypeInvalidResponse,
-				"invalid Extended version from GitHub Releases: %s", latest))
-	}
-	if !opts.Force && !update.IsNewer(latest, cur) {
-		var skillsResult *skillscheck.SyncResult
-		if !opts.Check {
-			skillsResult = runSkillsAndState(updater, io, cur, opts.Force)
-		}
-		return true, reportAlreadyUpToDate(opts, io, cur, latest, skillsResult, opts.Check)
-	}
-	if opts.Check {
-		return true, reportCheckResult(opts, io, cur, latest, true)
-	}
-	if !opts.JSON {
-		fmt.Fprintf(io.ErrOut, "Updating lark-cli Extended %s %s %s from GitHub Releases ...\n", cur, symArrow(), latest)
-	}
-	if err := installExtended(latest); err != nil {
-		var typed errs.TypedError
-		if errors.As(err, &typed) {
-			return true, reportError(opts, io, "update_error", typed)
-		}
-		return true, reportError(opts, io, "update_error",
-			errs.NewInternalError(errs.SubtypeUnknown,
-				"failed to install lark-cli Extended: %v", err).WithCause(err))
-	}
-
-	skillsResult := runSkillsAndState(updater, io, latest, opts.Force)
-	if opts.JSON {
-		result := map[string]interface{}{
-			"ok": true, "previous_version": cur, "current_version": latest,
-			"latest_version": latest, "edition": build.Edition, "action": "updated",
-			"message": fmt.Sprintf("lark-cli Extended updated from %s to %s", cur, latest),
-			"url":     releaseURL(latest), "changelog": changelogURL(),
-		}
-		applySkillsResult(result, skillsResult)
-		output.PrintJson(io.Out, result)
-		return true, nil
-	}
-	fmt.Fprintf(io.ErrOut, "\n%s Successfully updated lark-cli Extended from %s to %s\n", symOK(), cur, latest)
-	fmt.Fprintf(io.ErrOut, "  Changelog: %s\n", changelogURL())
-	emitSkillsTextHints(io, skillsResult)
-	return true, nil
-}
--- a/cmd/update/edition_extended_test.go
+++ b/cmd/update/edition_extended_test.go
@@ -1,80 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-//go:build extended
-
-package cmdupdate
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-	"testing"
-
-	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/selfupdate"
-	"github.com/larksuite/cli/internal/skillscheck"
-)
-
-func TestExtendedUpdateUsesExtendedReleaseInstaller(t *testing.T) {
-	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
-	oldFetch, oldInstall := fetchExtendedLatest, installExtended
-	oldVersion, oldUpdater, oldSync := currentVersion, newUpdater, syncSkills
-	t.Cleanup(func() {
-		fetchExtendedLatest, installExtended = oldFetch, oldInstall
-		currentVersion, newUpdater, syncSkills = oldVersion, oldUpdater, oldSync
-	})
-	fetchExtendedLatest = func() (string, error) { return "1.2.4", nil }
-	currentVersion = func() string { return "1.2.3" }
-	installed := ""
-	installExtended = func(version string) error {
-		installed = version
-		return nil
-	}
-	newUpdater = func() *selfupdate.Updater {
-		return &selfupdate.Updater{DetectOverride: func() selfupdate.DetectResult {
-			return selfupdate.DetectResult{Method: selfupdate.InstallManual}
-		}}
-	}
-	syncSkills = func(skillscheck.SyncOptions) *skillscheck.SyncResult { return &skillscheck.SyncResult{} }
-
-	var out, errOut bytes.Buffer
-	f := cmdutil.NewDefault(cmdutil.NewIOStreams(nil, &out, &errOut), cmdutil.InvocationContext{})
-	cmd := NewCmdUpdate(f)
-	cmd.SetArgs([]string{"--json"})
-	if err := cmd.ExecuteContext(context.Background()); err != nil {
-		t.Fatal(err)
-	}
-	if installed != "1.2.4" {
-		t.Fatalf("installed version = %q, want 1.2.4", installed)
-	}
-	var result map[string]interface{}
-	if err := json.Unmarshal(out.Bytes(), &result); err != nil {
-		t.Fatal(err)
-	}
-	if result["edition"] != "extended" || result["action"] != "updated" {
-		t.Fatalf("result = %#v", result)
-	}
-}
-
-func TestExtendedUpdateCheckDoesNotInstall(t *testing.T) {
-	oldFetch, oldInstall := fetchExtendedLatest, installExtended
-	oldVersion := currentVersion
-	t.Cleanup(func() {
-		fetchExtendedLatest, installExtended = oldFetch, oldInstall
-		currentVersion = oldVersion
-	})
-	fetchExtendedLatest = func() (string, error) { return "1.2.4", nil }
-	currentVersion = func() string { return "1.2.3" }
-	installExtended = func(string) error {
-		t.Fatal("installer called during --check")
-		return nil
-	}
-	var out bytes.Buffer
-	f := cmdutil.NewDefault(cmdutil.NewIOStreams(nil, &out, &bytes.Buffer{}), cmdutil.InvocationContext{})
-	cmd := NewCmdUpdate(f)
-	cmd.SetArgs([]string{"--json", "--check"})
-	if err := cmd.ExecuteContext(context.Background()); err != nil {
-		t.Fatal(err)
-	}
-}
--- a/cmd/update/edition_standard.go
+++ b/cmd/update/edition_standard.go
@@ -1,20 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-//go:build !extended
-
-package cmdupdate
-
-func runEditionUpdate(*UpdateOptions) (bool, error) { return false, nil }
-
-func updateLongDescription() string {
-	return `Update lark-cli to the latest version.
-
-Detects the installation method automatically:
-  - npm install:  runs npm install -g @larksuite/cli@<version>
-  - pnpm install: runs pnpm add -g @larksuite/cli@<version>
-  - manual/other: shows GitHub Releases download URL
-
-Use --json for structured output (for AI agents and scripts).
-Use --check to only check for updates without installing.`
-}
--- a/cmd/update/testmain_test.go
+++ b/cmd/update/testmain_test.go
@@ -1,23 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package cmdupdate
-
-import (
-	"os"
-	"path/filepath"
-	"testing"
-)
-
-func TestMain(m *testing.M) {
-	root, err := os.MkdirTemp("", "lark-cli-update-test-*")
-	if err != nil {
-		panic(err)
-	}
-	if err := os.Setenv("LARKSUITE_CLI_CONFIG_DIR", filepath.Join(root, "config")); err != nil {
-		panic(err)
-	}
-	code := m.Run()
-	_ = os.RemoveAll(root)
-	os.Exit(code)
-}
--- a/cmd/update/update.go
+++ b/cmd/update/update.go
@@ -101,7 +101,15 @@ func NewCmdUpdate(f *cmdutil.Factory) *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "update",
 		Short: "Update lark-cli to the latest version",
-		Long:  updateLongDescription(),
+		Long: `Update lark-cli to the latest version.
+
+Detects the installation method automatically:
+  - npm install:  runs npm install -g @larksuite/cli@<version>
+  - pnpm install: runs pnpm add -g @larksuite/cli@<version>
+  - manual/other: shows GitHub Releases download URL
+
+Use --json for structured output (for AI agents and scripts).
+Use --check to only check for updates without installing.`,
 		RunE: func(cmd *cobra.Command, args []string) error {
 			return updateRun(opts)
 		},
@@ -116,9 +124,6 @@ func NewCmdUpdate(f *cmdutil.Factory) *cobra.Command {
 }

 func updateRun(opts *UpdateOptions) error {
-	if handled, err := runEditionUpdate(opts); handled {
-		return err
-	}
 	io := opts.Factory.IOStreams
 	cur := currentVersion()
 	updater := newUpdater()
--- a/cmd/update/update_test.go
+++ b/cmd/update/update_test.go
@@ -1,8 +1,6 @@
 // Copyright (c) 2026 Lark Technologies Pte. Ltd.
 // SPDX-License-Identifier: MIT

-//go:build !extended
-
 package cmdupdate

 import (
@@ -26,8 +24,6 @@ import (
 	"github.com/larksuite/cli/internal/skillscheck"
 )

-const runLiveSkillsTestsEnv = "LARKSUITE_CLI_RUN_LIVE_SKILLS_TESTS"
-
 // newTestFactory creates a test factory with minimal config.
 func newTestFactory(t *testing.T) (*cmdutil.Factory, *bytes.Buffer, *bytes.Buffer) {
 	t.Helper()
@@ -35,17 +31,13 @@ func newTestFactory(t *testing.T) (*cmdutil.Factory, *bytes.Buffer, *bytes.Buffe
 	return f, stdout, stderr
 }

-// mockDetect sets up newUpdater to return an Updater with the given DetectResult
-// and fully mocked skills operations. Tests that only care about install-method
-// detection must never fall through to the real npx skills CLI.
+// mockDetect sets up newUpdater to return an Updater with the given DetectResult.
 func mockDetect(t *testing.T, result selfupdate.DetectResult) {
 	t.Helper()
 	origNew := newUpdater
 	newUpdater = func() *selfupdate.Updater {
 		u := selfupdate.New()
 		u.DetectOverride = func() selfupdate.DetectResult { return result }
-		u.SkillsIndexFetchOverride = successfulSkillsIndexFetch()
-		u.SkillsCommandOverride = successfulSkillsCommand()
 		return u
 	}
 	t.Cleanup(func() { newUpdater = origNew })
@@ -112,18 +104,6 @@ func successfulSkillsCommand() func(args ...string) *selfupdate.NpmResult {
 	}
 }

-func mockSkillsSync(t *testing.T) {
-	t.Helper()
-	origNew := newUpdater
-	newUpdater = func() *selfupdate.Updater {
-		u := selfupdate.New()
-		u.SkillsIndexFetchOverride = successfulSkillsIndexFetch()
-		u.SkillsCommandOverride = successfulSkillsCommand()
-		return u
-	}
-	t.Cleanup(func() { newUpdater = origNew })
-}
-
 func TestUpdatePnpm_JSON(t *testing.T) {
 	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
 	f, stdout, _ := newTestFactory(t)
@@ -248,9 +228,6 @@ func TestNormalizeVersion(t *testing.T) {
 }

 func TestUpdateAlreadyUpToDate_JSON(t *testing.T) {
-	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
-	mockSkillsSync(t)
-
 	f, stdout, _ := newTestFactory(t)

 	cmd := NewCmdUpdate(f)
@@ -279,9 +256,6 @@ func TestUpdateAlreadyUpToDate_JSON(t *testing.T) {
 }

 func TestUpdateAlreadyUpToDate_Human(t *testing.T) {
-	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
-	mockSkillsSync(t)
-
 	f, _, stderr := newTestFactory(t)

 	cmd := NewCmdUpdate(f)
@@ -307,7 +281,6 @@ func TestUpdateAlreadyUpToDate_Human(t *testing.T) {
 }

 func TestUpdateManual_JSON(t *testing.T) {
-	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
 	f, stdout, _ := newTestFactory(t)
 	cmd := NewCmdUpdate(f)
 	cmd.SetArgs([]string{"--json"})
@@ -339,7 +312,6 @@ func TestUpdateManual_JSON(t *testing.T) {
 }

 func TestUpdateManual_Human(t *testing.T) {
-	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
 	f, _, stderr := newTestFactory(t)
 	cmd := NewCmdUpdate(f)
 	cmd.SetArgs([]string{})
@@ -1189,7 +1161,6 @@ func TestRunSkillsAndState_DedupForceBypass(t *testing.T) {
 	}
 	called := false
 	updater := &selfupdate.Updater{
-		SkillsIndexFetchOverride: successfulSkillsIndexFetch(),
 		SkillsCommandOverride: func(args ...string) *selfupdate.NpmResult {
 			called = true
 			return successfulSkillsCommand()(args...)
@@ -1206,10 +1177,7 @@ func TestRunSkillsAndState_DedupForceBypass(t *testing.T) {

 func TestRunSkillsAndState_SuccessWritesState(t *testing.T) {
 	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
-	updater := &selfupdate.Updater{
-		SkillsIndexFetchOverride: successfulSkillsIndexFetch(),
-		SkillsCommandOverride:    successfulSkillsCommand(),
-	}
+	updater := &selfupdate.Updater{SkillsCommandOverride: successfulSkillsCommand()}
 	got := runSkillsAndState(updater, newTestIO(), "1.0.21", false)
 	if got == nil || got.Err != nil {
 		t.Fatalf("runSkillsAndState() = %+v, want non-nil with nil Err", got)
@@ -1229,7 +1197,6 @@ func TestRunSkillsAndState_FailureKeepsOldState(t *testing.T) {
 		t.Fatal(err)
 	}
 	updater := &selfupdate.Updater{
-		SkillsIndexFetchOverride: successfulSkillsIndexFetch(),
 		SkillsCommandOverride: func(args ...string) *selfupdate.NpmResult {
 			r := &selfupdate.NpmResult{}
 			r.Err = fmt.Errorf("npx failed")
@@ -1546,133 +1513,28 @@ func TestEmitSkillsTextHints_Success(t *testing.T) {
 	}
 }

-// liveSkillsIsolationEnv is the single source of truth for the user-state
-// directories a live skills test must redirect under the temporary home. It
-// covers the CLI's own config, the agent homes the skills CLI installs into,
-// the XDG dirs it derives paths from (XDG_STATE_HOME holds its global
-// .skill-lock.json), and the npm/npx overrides that take precedence over
-// HOME-derived defaults (both cases: npm reads npm_config_* case-insensitively).
-func liveSkillsIsolationEnv(home string) map[string]string {
-	return map[string]string{
-		"HOME":                     home,
-		"USERPROFILE":              home,
-		"APPDATA":                  filepath.Join(home, "AppData", "Roaming"),
-		"LOCALAPPDATA":             filepath.Join(home, "AppData", "Local"),
-		"XDG_CONFIG_HOME":          filepath.Join(home, ".config"),
-		"XDG_DATA_HOME":            filepath.Join(home, ".local", "share"),
-		"XDG_STATE_HOME":           filepath.Join(home, ".local", "state"),
-		"CODEX_HOME":               filepath.Join(home, ".codex"),
-		"CLAUDE_CONFIG_DIR":        filepath.Join(home, ".claude"),
-		"LARKSUITE_CLI_CONFIG_DIR": filepath.Join(home, ".lark-cli"),
-		"npm_config_cache":         filepath.Join(home, ".npm-cache"),
-		"NPM_CONFIG_CACHE":         filepath.Join(home, ".npm-cache"),
-		"npm_config_prefix":        filepath.Join(home, ".npm-global"),
-		"NPM_CONFIG_PREFIX":        filepath.Join(home, ".npm-global"),
-		"npm_config_userconfig":    filepath.Join(home, ".npmrc"),
-		"NPM_CONFIG_USERCONFIG":    filepath.Join(home, ".npmrc"),
-	}
-}
-
-func prepareLiveSkillsIntegration(t *testing.T) string {
-	t.Helper()
-	if os.Getenv(runLiveSkillsTestsEnv) != "1" {
-		t.Skipf("live skills integration test disabled; set %s=1 to run", runLiveSkillsTestsEnv)
-	}
-
-	home := t.TempDir()
-	for key, value := range liveSkillsIsolationEnv(home) {
-		t.Setenv(key, value)
-	}
-	return home
-}
-
-func TestPrepareLiveSkillsIntegration(t *testing.T) {
-	reachedAfterGate := false
-	t.Run("requires explicit opt-in", func(t *testing.T) {
-		t.Setenv(runLiveSkillsTestsEnv, "")
-		prepareLiveSkillsIntegration(t)
-		reachedAfterGate = true
-	})
-	if reachedAfterGate {
-		t.Fatal("prepareLiveSkillsIntegration continued without explicit opt-in")
-	}
-
-	t.Run("isolates user directories", func(t *testing.T) {
-		t.Setenv(runLiveSkillsTestsEnv, "1")
-		home := prepareLiveSkillsIntegration(t)
-		// Pin the isolation contract by key: removing a variable from
-		// liveSkillsIsolationEnv must fail this list, and every redirected
-		// value must live under the temporary home.
-		required := []string{
-			"HOME", "USERPROFILE", "APPDATA", "LOCALAPPDATA",
-			"XDG_CONFIG_HOME", "XDG_DATA_HOME", "XDG_STATE_HOME",
-			"CODEX_HOME", "CLAUDE_CONFIG_DIR", "LARKSUITE_CLI_CONFIG_DIR",
-			"npm_config_cache", "NPM_CONFIG_CACHE",
-			"npm_config_prefix", "NPM_CONFIG_PREFIX",
-			"npm_config_userconfig", "NPM_CONFIG_USERCONFIG",
-		}
-		env := liveSkillsIsolationEnv(home)
-		for _, key := range required {
-			expected, ok := env[key]
-			if !ok {
-				t.Errorf("liveSkillsIsolationEnv dropped required key %s", key)
-				continue
-			}
-			if !strings.HasPrefix(expected, home) {
-				t.Errorf("%s = %q escapes temporary home %q", key, expected, home)
-			}
-			if got := os.Getenv(key); got != expected {
-				t.Errorf("%s = %q, want %q", key, got, expected)
-			}
-		}
-	})
-}
-
-// seedLiveSkillsGlobal verifies the real npx skills CLI is reachable, installs
-// lark-calendar into the isolated global skills dir, and returns the parsed
-// global skills list. The caller opted in explicitly, so every missing
-// precondition is a hard failure — skipping would report "nothing verified"
-// as a green run.
-func seedLiveSkillsGlobal(t *testing.T) []string {
-	t.Helper()
+// TestUpdateCommand_RealSkillsSyncRewritesState is a live integration test that
+// verifies "lark-cli update" correctly triggers skills sync and rewrites the
+// state file. It calls the real npx skills CLI, so the test is skipped when
+// npx or the skills registry is unavailable (e.g. no network or fork PRs).
+func TestUpdateCommand_RealSkillsSyncRewritesState(t *testing.T) {
+	// Phase 1: Verify the real npx skills CLI is available; skip otherwise.
 	if _, err := exec.LookPath("npx"); err != nil {
-		t.Fatalf("live skills tests opted in but npx not found in PATH: %v", err)
+		t.Skipf("npx not found in PATH: %v", err)
 	}
-	// Three sequential npx runs against a cold cache (the isolated home starts
-	// empty) can be slow; with Fatal-on-timeout semantics the budget errs on
-	// the generous side.
-	ctx, cancel := context.WithTimeout(context.Background(), 180*time.Second)
+	ctx, cancel := context.WithTimeout(context.Background(), 45*time.Second)
 	defer cancel()
 	if err := exec.CommandContext(ctx, "npx", "-y", "skills", "add", "https://open.feishu.cn", "--list").Run(); err != nil {
-		t.Fatalf("live skills tests opted in but real skills CLI unavailable: %v", err)
-	}
-	if err := exec.CommandContext(ctx, "npx", "-y", "skills", "add", "https://open.feishu.cn", "-s", "lark-calendar", "-g", "-y").Run(); err != nil {
-		t.Fatalf("failed to seed isolated global skills: %v", err)
+		t.Skipf("real skills CLI unavailable: %v", err)
 	}
 	globalOut, err := exec.CommandContext(ctx, "npx", "-y", "skills", "ls", "-g").Output()
 	if err != nil {
-		t.Fatalf("real global skills CLI unavailable: %v", err)
+		t.Skipf("real global skills CLI unavailable: %v", err)
 	}
 	localSkills := skillscheck.ParseSkillsList(string(globalOut))
-	if len(localSkills) == 0 {
-		t.Fatal("seeded lark-calendar but global skills list is empty")
-	}
 	if err := ctx.Err(); err != nil {
-		t.Fatalf("real skills CLI availability check timed out: %v", err)
+		t.Skipf("real skills CLI availability check timed out: %v", err)
 	}
-	return localSkills
-}
-
-// TestUpdateCommand_RealSkillsSyncRewritesState is a live integration test that
-// verifies "lark-cli update" correctly triggers skills sync and rewrites the
-// state file. It calls the real npx skills CLI and only runs with explicit
-// opt-in. All user directories are redirected to a temporary home.
-func TestUpdateCommand_RealSkillsSyncRewritesState(t *testing.T) {
-	prepareLiveSkillsIntegration(t)
-
-	// Phase 1: Verify the real npx skills CLI is available and seed the
-	// isolated global skills install.
-	localSkills := seedLiveSkillsGlobal(t)

 	// Phase 2: Seed a previous sync state simulating an upgrade from v1.0.19.
 	// lark-doc and lark-mail are recorded as skipped/deleted, meaning the user
@@ -1768,17 +1630,26 @@ func TestUpdateCommand_RealSkillsSyncRewritesState(t *testing.T) {
 // not exist (cold start), the update command installs all official skills and
 // writes a fresh state file. No skill should appear in SkippedDeletedSkills
 // because there is no previous state to preserve user deletions from.
-// This is a live integration test that calls the real npx skills CLI and only
-// runs with explicit opt-in. All user directories are redirected to a temporary
-// home.
+// This is a live integration test that calls the real npx skills CLI; it is
+// skipped when npx or the skills registry is unavailable.
 func TestUpdateCommand_SkillsSyncColdStart(t *testing.T) {
-	prepareLiveSkillsIntegration(t)
-
-	// Phase 1: Verify the real npx skills CLI is available and seed one known
-	// official skill into the isolated global install. Cold start means no
-	// skills-state.json — locally installed skills may still exist, and seeding
-	// one keeps the Phase 4 per-skill assertions from running zero times.
-	localSkills := seedLiveSkillsGlobal(t)
+	// Phase 1: Verify the real npx skills CLI is available; skip otherwise.
+	if _, err := exec.LookPath("npx"); err != nil {
+		t.Skipf("npx not found in PATH: %v", err)
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), 45*time.Second)
+	defer cancel()
+	if err := exec.CommandContext(ctx, "npx", "-y", "skills", "add", "https://open.feishu.cn", "--list").Run(); err != nil {
+		t.Skipf("real skills CLI unavailable: %v", err)
+	}
+	globalOut, err := exec.CommandContext(ctx, "npx", "-y", "skills", "ls", "-g").Output()
+	if err != nil {
+		t.Skipf("real global skills CLI unavailable: %v", err)
+	}
+	localSkills := skillscheck.ParseSkillsList(string(globalOut))
+	if err := ctx.Err(); err != nil {
+		t.Skipf("real skills CLI availability check timed out: %v", err)
+	}

 	// Phase 2: Use an isolated config dir with no pre-existing skills-state.json.
 	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
--- a/cmd/update_notice_extended.go
+++ b/cmd/update_notice_extended.go
@@ -1,19 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-//go:build extended
-
-package cmd
-
-import (
-	"github.com/larksuite/cli/internal/extendedupdate"
-	"github.com/larksuite/cli/internal/update"
-)
-
-func checkCachedEditionUpdate(currentVersion string) *update.UpdateInfo {
-	return extendedupdate.CheckCached(currentVersion)
-}
-
-func refreshEditionUpdateCache(currentVersion string) {
-	extendedupdate.RefreshCache(currentVersion)
-}
--- a/cmd/update_notice_standard.go
+++ b/cmd/update_notice_standard.go
@@ -1,16 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-//go:build !extended
-
-package cmd
-
-import "github.com/larksuite/cli/internal/update"
-
-func checkCachedEditionUpdate(currentVersion string) *update.UpdateInfo {
-	return update.CheckCached(currentVersion)
-}
-
-func refreshEditionUpdateCache(currentVersion string) {
-	update.RefreshCache(currentVersion)
-}
--- a/cmd/version/version.go
+++ b/cmd/version/version.go
@@ -1,56 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package version
-
-import (
-	"fmt"
-
-	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/build"
-	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/output"
-	"github.com/spf13/cobra"
-)
-
-type options struct {
-	factory *cmdutil.Factory
-	json    bool
-}
-
-type versionReport struct {
-	Version      string   `json:"version"`
-	Edition      string   `json:"edition"`
-	Capabilities []string `json:"capabilities"`
-}
-
-// NewCmdVersion reports the immutable edition identity compiled into the
-// binary. Root --version remains unchanged for compatibility.
-func NewCmdVersion(f *cmdutil.Factory) *cobra.Command {
-	opts := &options{factory: f}
-	cmd := &cobra.Command{
-		Use:    "version",
-		Short:  "Show version and edition information",
-		Hidden: hideVersionCommand(),
-		Args:   cobra.NoArgs,
-		RunE: func(cmd *cobra.Command, args []string) error {
-			if opts.json {
-				output.PrintJson(opts.factory.IOStreams.Out, versionReport{
-					Version:      build.Version,
-					Edition:      build.Edition,
-					Capabilities: build.Capabilities(),
-				})
-				return nil
-			}
-			_, err := fmt.Fprintf(opts.factory.IOStreams.Out, "lark-cli version %s (%s)\n", build.Version, build.Edition)
-			if err != nil {
-				return errs.NewInternalError(errs.SubtypeSDKError, "failed to write version output: %v", err).WithCause(err)
-			}
-			return nil
-		},
-	}
-	cmd.Flags().BoolVar(&opts.json, "json", false, "structured JSON output")
-	cmdutil.DisableAuthCheck(cmd)
-	cmdutil.SetRisk(cmd, "read")
-	return cmd
-}
--- a/cmd/version/version_test.go
+++ b/cmd/version/version_test.go
@@ -1,67 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package version
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"reflect"
-	"testing"
-
-	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/build"
-	"github.com/larksuite/cli/internal/cmdutil"
-)
-
-func TestVersionJSONReportsCompiledEdition(t *testing.T) {
-	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
-	f, out, _, _ := cmdutil.TestFactory(t, nil)
-	cmd := NewCmdVersion(f)
-	cmd.SetArgs([]string{"--json"})
-	if err := cmd.ExecuteContext(context.Background()); err != nil {
-		t.Fatal(err)
-	}
-	var got struct {
-		Version      string   `json:"version"`
-		Edition      string   `json:"edition"`
-		Capabilities []string `json:"capabilities"`
-	}
-	if err := json.Unmarshal(out.Bytes(), &got); err != nil {
-		t.Fatal(err)
-	}
-	if got.Version != build.Version || got.Edition != build.Edition || !reflect.DeepEqual(got.Capabilities, build.Capabilities()) {
-		t.Fatalf("version output = %#v, want version=%q edition=%q", got, build.Version, build.Edition)
-	}
-}
-
-func TestVersionVisibilityPreservesStandardHelpSurface(t *testing.T) {
-	f, _, _, _ := cmdutil.TestFactory(t, nil)
-	cmd := NewCmdVersion(f)
-	wantHidden := build.Edition == "standard"
-	if cmd.Hidden != wantHidden {
-		t.Fatalf("version command hidden = %v, want %v for %s", cmd.Hidden, wantHidden, build.Edition)
-	}
-}
-
-type failingWriter struct{ err error }
-
-func (w failingWriter) Write([]byte) (int, error) { return 0, w.err }
-
-func TestVersionTextWriteFailureIsTyped(t *testing.T) {
-	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
-	f, _, _, _ := cmdutil.TestFactory(t, nil)
-	writeErr := errors.New("write failed")
-	f.IOStreams.Out = failingWriter{err: writeErr}
-
-	cmd := NewCmdVersion(f)
-	err := cmd.ExecuteContext(context.Background())
-	problem, ok := errs.ProblemOf(err)
-	if !ok || problem.Category != errs.CategoryInternal || problem.Subtype != errs.SubtypeSDKError {
-		t.Fatalf("error = %#v, want internal/sdk_error", err)
-	}
-	if !errors.Is(err, writeErr) {
-		t.Fatalf("error does not preserve write failure: %v", err)
-	}
-}
--- a/cmd/version/visibility_extended.go
+++ b/cmd/version/visibility_extended.go
@@ -1,8 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-//go:build extended
-
-package version
-
-func hideVersionCommand() bool { return false }
--- a/cmd/version/visibility_standard.go
+++ b/cmd/version/visibility_standard.go
@@ -1,10 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-//go:build !extended
-
-package version
-
-// Standard keeps its historical help surface unchanged. The command remains
-// directly callable for release identity verification.
-func hideVersionCommand() bool { return true }
--- a/errs/ERROR_CONTRACT.md
+++ b/errs/ERROR_CONTRACT.md
@@ -62,8 +62,6 @@ Typed errors render to **stderr** as one JSON object per process exit:
 | `error.message` | informational | not safe to branch on |
 | `error.hint` | informational | actionable recovery guidance |
 | `error.log_id` | informational | upstream request id (server-side trace) |
-| `error.origin` | informational | Extended producer: `cli`, `credential_process`, `proxy`, or `lark`; omitted by Standard to preserve its existing envelope; consumers must tolerate absence and unknown future values |
-| `error.proxy_request_id` | informational | external credential platform trace id; never stored in `log_id` |
 | `error.retryable` | wire-stable | `true` when present; omitted when `false` |
 | `error.param` | per-Subtype-stable | single offending parameter (`ValidationError`); see **Validation parameters** |
 | `error.params` | per-Subtype-stable | per-parameter validation detail array (`ValidationError`); see **Validation parameters** |
@@ -106,7 +104,7 @@ already succeeded).
 | `config` | local config missing / unbound | 3 | `ConfigError` |
 | `network` | DNS, refused, timeout, transport | 4 | `NetworkError` |
 | `api` | server-side Lark error w/o specific bucket | 1 | `APIError` |
-| `policy` | security policy denial/challenge, including content safety | 6 | `SecurityPolicyError`, `ContentSafetyError` |
+| `policy` | content safety / security challenge | 6 | `SecurityPolicyError`, `ContentSafetyError` |
 | `internal` | SDK contract violation / decode failure | 5 | `InternalError` |
 | `confirmation` | high-risk action needs `--yes` | 10 | `ConfirmationRequiredError` |

@@ -274,7 +272,7 @@ legal for framework dynamic paths (e.g. classifier fanout) but the lint
 | Login required | `errs.NewAuthenticationError(errs.SubtypeTokenMissing, msg)` |
 | Token lacks scope | `errclass.BuildAPIError(resp, ctx)` |
 | Local config missing | `errs.NewConfigError(errs.SubtypeNotConfigured, msg)` |
-| Transport or external dependency failure | `errs.NewNetworkError(subtype, msg).WithCause(err)` (subtype: `timeout` / `tls` / `dns` / `server_error` / `transport` / `credential_source_unavailable` / `upstream_unavailable`) |
+| Transport failure | `errs.NewNetworkError(errs.SubtypeNetworkTimeout, msg).WithCause(err)` (subtype: `timeout` / `tls` / `dns` / `server_error` / `transport`) |
 | Lark API error | `errclass.BuildAPIError(resp, ctx)` |
 | SDK / decode bug | `errs.NewInternalError(errs.SubtypeSDKError, msg).WithCause(err)` |
 | Policy block | `errs.NewSecurityPolicyError(subtype, msg).WithChallengeURL(url)` or `errs.NewContentSafetyError(subtype, msg).WithRules(...)` |
@@ -515,11 +513,7 @@ Rare; the existing structs cover the 9 Categories with room. If you must:
 `CheckProblemEmbed` enforces the `Problem` embed at lint time. New
 top-level wire fields are forbidden — per-Subtype data goes into the
 typed struct as a documented extension field, not into the envelope's
-top level. The external credential platform contract is the single explicit
-exception: `origin` and `proxy_request_id` are shared across several error
-categories and therefore live in `Problem`. Both fields are optional, and
-consumers must ignore them when absent or unknown. Any further shared field
-still requires an explicit contract revision and wire-format pin.
+top level.

 ## CI guards

--- a/errs/diagnostic_metadata.go
+++ b/errs/diagnostic_metadata.go
@@ -1,134 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package errs
-
-import (
-	"encoding/json"
-)
-
-// DiagnosticMetadata carries optional producer diagnostics without changing
-// the field layout of Problem or any concrete typed error. Keeping this
-// metadata in a wrapper preserves source compatibility for callers that use
-// positional literals of the existing exported error structs.
-type DiagnosticMetadata struct {
-	Origin         string
-	ProxyRequestID string
-}
-
-type diagnosticMetadataWrapper struct {
-	err      error
-	typed    error
-	metadata DiagnosticMetadata
-}
-
-func (e *diagnosticMetadataWrapper) Error() string {
-	if e == nil || e.err == nil {
-		return ""
-	}
-	return e.err.Error()
-}
-
-func (e *diagnosticMetadataWrapper) Unwrap() error {
-	if e == nil {
-		return nil
-	}
-	return e.err
-}
-
-func (e *diagnosticMetadataWrapper) ProblemDetail() *Problem {
-	if e == nil {
-		return nil
-	}
-	problem, _ := ProblemOf(e.typed)
-	return problem
-}
-
-func (e *diagnosticMetadataWrapper) DiagnosticMetadata() DiagnosticMetadata {
-	if e == nil {
-		return DiagnosticMetadata{}
-	}
-	return e.metadata
-}
-
-// MarshalJSON preserves the concrete typed error's extension fields and adds
-// the optional diagnostics as sibling fields in the existing error object.
-func (e *diagnosticMetadataWrapper) MarshalJSON() ([]byte, error) {
-	raw, err := json.Marshal(e.typed)
-	if err != nil {
-		return nil, err
-	}
-
-	var object map[string]json.RawMessage
-	if err := json.Unmarshal(raw, &object); err != nil {
-		return nil, err
-	}
-	if e.metadata.Origin != "" {
-		origin, err := json.Marshal(e.metadata.Origin)
-		if err != nil {
-			return nil, err
-		}
-		object["origin"] = origin
-	}
-	if e.metadata.ProxyRequestID != "" {
-		requestID, err := json.Marshal(e.metadata.ProxyRequestID)
-		if err != nil {
-			return nil, err
-		}
-		object["proxy_request_id"] = requestID
-	}
-	return json.Marshal(object)
-}
-
-// WithDiagnosticMetadata attaches optional wire diagnostics to a typed error.
-// Empty metadata is a no-op. The returned wrapper still participates in
-// errors.Is/errors.As and TypedError routing through Unwrap and ProblemDetail.
-func WithDiagnosticMetadata(err error, metadata DiagnosticMetadata) error {
-	if err == nil || (metadata.Origin == "" && metadata.ProxyRequestID == "") {
-		return err
-	}
-
-	typed, ok := UnwrapTypedError(err)
-	if !ok {
-		return err
-	}
-	if existing, ok := diagnosticMetadataWrapperForProducer(typed); ok {
-		merged := existing.metadata
-		if metadata.Origin != "" {
-			merged.Origin = metadata.Origin
-		}
-		if metadata.ProxyRequestID != "" {
-			merged.ProxyRequestID = metadata.ProxyRequestID
-		}
-		return &diagnosticMetadataWrapper{err: err, typed: existing.typed, metadata: merged}
-	}
-	return &diagnosticMetadataWrapper{err: err, typed: typed, metadata: metadata}
-}
-
-// DiagnosticMetadataOf returns optional diagnostics attached to the first
-// typed producer in err's wrap chain. Metadata on a typed cause belongs to
-// that inner producer and must not be projected onto an outer typed error.
-func DiagnosticMetadataOf(err error) (DiagnosticMetadata, bool) {
-	typed, ok := UnwrapTypedError(err)
-	if !ok {
-		return DiagnosticMetadata{}, false
-	}
-	carrier, ok := diagnosticMetadataWrapperForProducer(typed)
-	if !ok {
-		return DiagnosticMetadata{}, false
-	}
-	metadata := carrier.DiagnosticMetadata()
-	if metadata.Origin == "" && metadata.ProxyRequestID == "" {
-		return DiagnosticMetadata{}, false
-	}
-	return metadata, true
-}
-
-// diagnosticMetadataWrapperForProducer deliberately checks only the selected
-// typed producer. errors.As must not be used here because it would traverse
-// into an inner typed cause and associate that cause's metadata with the outer
-// producer.
-func diagnosticMetadataWrapperForProducer(typed error) (*diagnosticMetadataWrapper, bool) {
-	wrapper, ok := typed.(*diagnosticMetadataWrapper) //nolint:errorlint // Exact producer identity is the invariant being enforced.
-	return wrapper, ok
-}
--- a/errs/diagnostic_metadata_test.go
+++ b/errs/diagnostic_metadata_test.go
@@ -1,118 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package errs
-
-import (
-	"encoding/json"
-	"errors"
-	"fmt"
-	"testing"
-)
-
-func TestDiagnosticMetadataPreservesTypedErrorContract(t *testing.T) {
-	permission := NewPermissionError(SubtypeMissingScope, "missing scope").
-		WithMissingScopes("im:message")
-	wrapped := WithDiagnosticMetadata(permission, DiagnosticMetadata{
-		Origin:         "proxy",
-		ProxyRequestID: "proxy_req_1",
-	})
-
-	var gotPermission *PermissionError
-	if !errors.As(wrapped, &gotPermission) || gotPermission != permission {
-		t.Fatalf("errors.As() = %p, want original permission error %p", gotPermission, permission)
-	}
-	problem, ok := ProblemOf(wrapped)
-	if !ok || problem != &permission.Problem {
-		t.Fatalf("ProblemOf() = (%p, %v), want original Problem %p", problem, ok, &permission.Problem)
-	}
-	metadata, ok := DiagnosticMetadataOf(wrapped)
-	if !ok || metadata.Origin != "proxy" || metadata.ProxyRequestID != "proxy_req_1" {
-		t.Fatalf("DiagnosticMetadataOf() = (%#v, %v)", metadata, ok)
-	}
-
-	raw, err := json.Marshal(wrapped)
-	if err != nil {
-		t.Fatal(err)
-	}
-	var object map[string]any
-	if err := json.Unmarshal(raw, &object); err != nil {
-		t.Fatal(err)
-	}
-	if object["origin"] != "proxy" || object["proxy_request_id"] != "proxy_req_1" {
-		t.Fatalf("metadata missing from JSON: %s", raw)
-	}
-	missingScopes, ok := object["missing_scopes"].([]any)
-	if !ok || len(missingScopes) != 1 || missingScopes[0] != "im:message" {
-		t.Fatalf("typed extension fields missing from JSON: %s", raw)
-	}
-}
-
-func TestDiagnosticMetadataMergesWithoutMutatingExistingWrapper(t *testing.T) {
-	typed := NewNetworkError(SubtypeUpstreamUnavailable, "unavailable")
-	withOrigin := WithDiagnosticMetadata(typed, DiagnosticMetadata{Origin: "proxy"})
-	withRequestID := WithDiagnosticMetadata(withOrigin, DiagnosticMetadata{ProxyRequestID: "proxy_req_2"})
-
-	original, _ := DiagnosticMetadataOf(withOrigin)
-	if original.ProxyRequestID != "" {
-		t.Fatalf("existing wrapper was mutated: %#v", original)
-	}
-	merged, ok := DiagnosticMetadataOf(withRequestID)
-	if !ok || merged.Origin != "proxy" || merged.ProxyRequestID != "proxy_req_2" {
-		t.Fatalf("merged metadata = (%#v, %v)", merged, ok)
-	}
-}
-
-func TestDiagnosticMetadataPreservesOuterErrorContext(t *testing.T) {
-	cause := errors.New("transport failed")
-	typed := NewNetworkError(SubtypeNetworkTransport, "request failed").WithCause(cause)
-	outer := fmt.Errorf("fetch document: %w", typed)
-
-	wrapped := WithDiagnosticMetadata(outer, DiagnosticMetadata{Origin: "proxy"})
-	if got, want := wrapped.Error(), outer.Error(); got != want {
-		t.Fatalf("Error() = %q, want %q", got, want)
-	}
-	if !errors.Is(wrapped, cause) {
-		t.Fatal("metadata wrapper lost the original cause chain")
-	}
-	var gotTyped *NetworkError
-	if !errors.As(wrapped, &gotTyped) || gotTyped != typed {
-		t.Fatalf("errors.As() = %p, want original typed error %p", gotTyped, typed)
-	}
-}
-
-func TestDiagnosticMetadataDoesNotCrossTypedProducerBoundary(t *testing.T) {
-	inner := NewNetworkError(SubtypeUpstreamUnavailable, "proxy unavailable")
-	annotatedInner := WithDiagnosticMetadata(inner, DiagnosticMetadata{
-		Origin:         "proxy",
-		ProxyRequestID: "proxy_req_inner",
-	})
-	outer := NewInternalError(SubtypeUnknown, "business reclassified failure").
-		WithCause(annotatedInner)
-
-	if metadata, ok := DiagnosticMetadataOf(outer); ok {
-		t.Fatalf("outer typed producer inherited inner metadata: %#v", metadata)
-	}
-
-	wrapped := WithDiagnosticMetadata(outer, DiagnosticMetadata{Origin: "cli"})
-	problem, ok := ProblemOf(wrapped)
-	if !ok || problem != &outer.Problem {
-		t.Fatalf("ProblemOf() = (%p, %v), want outer Problem %p", problem, ok, &outer.Problem)
-	}
-	if problem.Category != CategoryInternal ||
-		problem.Subtype != SubtypeUnknown ||
-		problem.Message != "business reclassified failure" {
-		t.Fatalf("outer typed identity changed: %#v", problem)
-	}
-	metadata, ok := DiagnosticMetadataOf(wrapped)
-	if !ok || metadata.Origin != "cli" || metadata.ProxyRequestID != "" {
-		t.Fatalf("outer metadata = (%#v, %v), want cli without inner request id", metadata, ok)
-	}
-
-	innerMetadata, ok := DiagnosticMetadataOf(annotatedInner)
-	if !ok ||
-		innerMetadata.Origin != "proxy" ||
-		innerMetadata.ProxyRequestID != "proxy_req_inner" {
-		t.Fatalf("inner metadata was mutated: (%#v, %v)", innerMetadata, ok)
-	}
-}
--- a/errs/marshal_test.go
+++ b/errs/marshal_test.go
@@ -27,11 +27,7 @@ func TestPermissionError_MarshalJSON_HasAllWireFields(t *testing.T) {
 		Identity:      "user",
 		ConsoleURL:    "https://example",
 	}
-	withMetadata := WithDiagnosticMetadata(pe, DiagnosticMetadata{
-		Origin:         "proxy",
-		ProxyRequestID: "proxy_req_123",
-	})
-	b, err := json.Marshal(withMetadata)
+	b, err := json.Marshal(pe)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -43,8 +39,6 @@ func TestPermissionError_MarshalJSON_HasAllWireFields(t *testing.T) {
 		`"message":"x"`,
 		`"hint":"y"`,
 		`"log_id":"lg"`,
-		`"origin":"proxy"`,
-		`"proxy_request_id":"proxy_req_123"`,
 		`"missing_scopes":["docx:document"]`,
 		`"identity":"user"`,
 		`"console_url":"https://example"`,
--- a/errs/subtypes.go
+++ b/errs/subtypes.go
@@ -48,13 +48,11 @@ const (

 // CategoryNetwork subtypes
 const (
-	SubtypeNetworkTransport            Subtype = "transport"                     // fallback when no more-specific network subtype matches
-	SubtypeNetworkTimeout              Subtype = "timeout"                       // dial / read timeout
-	SubtypeNetworkTLS                  Subtype = "tls"                           // TLS handshake / cert failure
-	SubtypeNetworkDNS                  Subtype = "dns"                           // DNS resolution failure
-	SubtypeNetworkServer               Subtype = "server_error"                  // upstream HTTP 5xx
-	SubtypeCredentialSourceUnavailable Subtype = "credential_source_unavailable" // external credential program or identity service is temporarily unavailable
-	SubtypeUpstreamUnavailable         Subtype = "upstream_unavailable"          // external proxy cannot reach the requested upstream service
+	SubtypeNetworkTransport Subtype = "transport"    // fallback when no more-specific network subtype matches
+	SubtypeNetworkTimeout   Subtype = "timeout"      // dial / read timeout
+	SubtypeNetworkTLS       Subtype = "tls"          // TLS handshake / cert failure
+	SubtypeNetworkDNS       Subtype = "dns"          // DNS resolution failure
+	SubtypeNetworkServer    Subtype = "server_error" // upstream HTTP 5xx
 )

 // CategoryAPI subtypes
--- a/events/application/menu.go
+++ b/events/application/menu.go
@@ -1,107 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package application
-
-import (
-	"context"
-	"encoding/json"
-	"strings"
-
-	"github.com/larksuite/cli/internal/event"
-)
-
-// BotMenuOutput is the flattened shape for application.bot.menu_v6.
-type BotMenuOutput struct {
-	Type            string `json:"type"                         desc:"Event type; always application.bot.menu_v6"`
-	EventID         string `json:"event_id,omitempty"           desc:"Globally unique event ID; safe for deduplication"`
-	Timestamp       string `json:"timestamp,omitempty"          desc:"Event delivery time (ms timestamp string); prefers header.create_time" kind:"timestamp_ms"`
-	AppID           string `json:"app_id,omitempty"             desc:"Application ID from the event header"`
-	TenantKey       string `json:"tenant_key,omitempty"         desc:"Tenant key from the event header"`
-	EventKey        string `json:"event_key,omitempty"          desc:"Developer-defined bot menu event key"`
-	MenuTimestamp   string `json:"menu_timestamp,omitempty"     desc:"Menu click timestamp from the event body"                           kind:"timestamp_ms"`
-	OperatorID      string `json:"operator_id,omitempty"        desc:"Operator open_id; kept as a short alias of operator_open_id"        kind:"open_id"`
-	OperatorOpenID  string `json:"operator_open_id,omitempty"   desc:"Operator open_id"                                                   kind:"open_id"`
-	OperatorUnionID string `json:"operator_union_id,omitempty"  desc:"Operator union_id"                                                  kind:"union_id"`
-	OperatorUserID  string `json:"operator_user_id,omitempty"   desc:"Operator user_id"                                                   kind:"user_id"`
-	OperatorName    string `json:"operator_name,omitempty"      desc:"Operator display name"`
-}
-
-func processBotMenu(_ context.Context, _ event.APIClient, raw *event.RawEvent, _ map[string]string) (json.RawMessage, error) {
-	var envelope struct {
-		Header struct {
-			EventID    string `json:"event_id"`
-			EventType  string `json:"event_type"`
-			CreateTime string `json:"create_time"`
-			AppID      string `json:"app_id"`
-			TenantKey  string `json:"tenant_key"`
-		} `json:"header"`
-		Event struct {
-			EventKey  string          `json:"event_key"`
-			Timestamp json.RawMessage `json:"timestamp"`
-			Operator  struct {
-				OperatorID struct {
-					OpenID  string `json:"open_id"`
-					UnionID string `json:"union_id"`
-					UserID  string `json:"user_id"`
-				} `json:"operator_id"`
-				OperatorName string `json:"operator_name"`
-			} `json:"operator"`
-		} `json:"event"`
-	}
-	if err := json.Unmarshal(raw.Payload, &envelope); err != nil {
-		return raw.Payload, nil //nolint:nilerr // passthrough on malformed payload so consumers still see the event
-	}
-
-	menuTimestamp := timestampMillisString(envelope.Event.Timestamp)
-	timestamp := envelope.Header.CreateTime
-	if timestamp == "" {
-		timestamp = menuTimestamp
-	}
-	operatorID := envelope.Event.Operator.OperatorID.OpenID
-
-	out := &BotMenuOutput{
-		Type:            eventTypeBotMenuV6,
-		EventID:         envelope.Header.EventID,
-		Timestamp:       timestamp,
-		AppID:           envelope.Header.AppID,
-		TenantKey:       envelope.Header.TenantKey,
-		EventKey:        envelope.Event.EventKey,
-		MenuTimestamp:   menuTimestamp,
-		OperatorID:      operatorID,
-		OperatorOpenID:  operatorID,
-		OperatorUnionID: envelope.Event.Operator.OperatorID.UnionID,
-		OperatorUserID:  envelope.Event.Operator.OperatorID.UserID,
-		OperatorName:    envelope.Event.Operator.OperatorName,
-	}
-	return json.Marshal(out)
-}
-
-func rawScalarString(raw json.RawMessage) string {
-	s := strings.TrimSpace(string(raw))
-	if s == "" || s == "null" {
-		return ""
-	}
-	var text string
-	if err := json.Unmarshal(raw, &text); err == nil {
-		return text
-	}
-	return s
-}
-
-func timestampMillisString(raw json.RawMessage) string {
-	s := rawScalarString(raw)
-	if len(s) == 10 && allDigits(s) {
-		return s + "000"
-	}
-	return s
-}
-
-func allDigits(s string) bool {
-	for _, r := range s {
-		if r < '0' || r > '9' {
-			return false
-		}
-	}
-	return s != ""
-}
--- a/events/application/menu_test.go
+++ b/events/application/menu_test.go
@@ -1,227 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package application
-
-import (
-	"context"
-	"encoding/json"
-	"reflect"
-	"testing"
-	"time"
-
-	"github.com/larksuite/cli/internal/event"
-)
-
-func TestKeysBotMenuMetadata(t *testing.T) {
-	keys := Keys()
-	if len(keys) != 1 {
-		t.Fatalf("len(Keys()) = %d, want 1", len(keys))
-	}
-
-	def := keys[0]
-	if def.Key != eventTypeBotMenuV6 {
-		t.Errorf("Key = %q, want %q", def.Key, eventTypeBotMenuV6)
-	}
-	if def.EventType != eventTypeBotMenuV6 {
-		t.Errorf("EventType = %q, want %q", def.EventType, eventTypeBotMenuV6)
-	}
-	if def.SubscriptionType != "" {
-		t.Errorf("SubscriptionType = %q, want default event subscription", def.SubscriptionType)
-	}
-	if def.Schema.Custom == nil {
-		t.Fatal("Schema.Custom is nil")
-	}
-	if def.Schema.Custom.Type != reflect.TypeOf(BotMenuOutput{}) {
-		t.Errorf("custom type = %v, want BotMenuOutput", def.Schema.Custom.Type)
-	}
-	if def.Schema.Native != nil {
-		t.Fatal("Schema.Native must be nil for processed output")
-	}
-	if def.Process == nil {
-		t.Fatal("Process is nil")
-	}
-	if !reflect.DeepEqual(def.AuthTypes, []string{"bot"}) {
-		t.Errorf("AuthTypes = %#v", def.AuthTypes)
-	}
-	if !reflect.DeepEqual(def.RequiredConsoleEvents, []string{eventTypeBotMenuV6}) {
-		t.Errorf("RequiredConsoleEvents = %#v", def.RequiredConsoleEvents)
-	}
-}
-
-func TestBotMenuRegistersCleanly(t *testing.T) {
-	const key = eventTypeBotMenuV6
-	event.UnregisterKeyForTest(key)
-	t.Cleanup(func() { event.UnregisterKeyForTest(key) })
-
-	for _, def := range Keys() {
-		event.RegisterKey(def)
-	}
-	if _, ok := event.Lookup(key); !ok {
-		t.Fatalf("event.Lookup(%q) not registered", key)
-	}
-}
-
-func TestProcessBotMenu(t *testing.T) {
-	payload := `{
-		"schema": "2.0",
-		"header": {
-			"event_id": "ev_menu_001",
-			"event_type": "application.bot.menu_v6",
-			"create_time": "1776409469273",
-			"app_id": "cli_test",
-			"tenant_key": "tenant_test"
-		},
-		"event": {
-			"event_key": "start_eval",
-			"timestamp": 1776409469000,
-			"operator": {
-				"operator_id": {
-					"open_id": "ou_operator",
-					"union_id": "on_operator",
-					"user_id": "user_operator"
-				},
-				"operator_name": "Test User"
-			}
-		}
-	}`
-	out := runBotMenu(t, payload)
-
-	if out.Type != eventTypeBotMenuV6 {
-		t.Errorf("Type = %q, want %q", out.Type, eventTypeBotMenuV6)
-	}
-	if out.EventID != "ev_menu_001" {
-		t.Errorf("EventID = %q", out.EventID)
-	}
-	if out.Timestamp != "1776409469273" {
-		t.Errorf("Timestamp = %q", out.Timestamp)
-	}
-	if out.EventKey != "start_eval" {
-		t.Errorf("EventKey = %q", out.EventKey)
-	}
-	if out.MenuTimestamp != "1776409469000" {
-		t.Errorf("MenuTimestamp = %q", out.MenuTimestamp)
-	}
-	if out.OperatorID != "ou_operator" || out.OperatorOpenID != "ou_operator" {
-		t.Errorf("OperatorID/OperatorOpenID = %q/%q", out.OperatorID, out.OperatorOpenID)
-	}
-	if out.OperatorUnionID != "on_operator" {
-		t.Errorf("OperatorUnionID = %q", out.OperatorUnionID)
-	}
-	if out.OperatorUserID != "user_operator" {
-		t.Errorf("OperatorUserID = %q", out.OperatorUserID)
-	}
-	if out.OperatorName != "Test User" {
-		t.Errorf("OperatorName = %q", out.OperatorName)
-	}
-	if out.AppID != "cli_test" || out.TenantKey != "tenant_test" {
-		t.Errorf("AppID/TenantKey = %q/%q", out.AppID, out.TenantKey)
-	}
-}
-
-func TestProcessBotMenuStringTimestampFallback(t *testing.T) {
-	payload := `{
-		"schema": "2.0",
-		"header": {
-			"event_id": "ev_menu_002",
-			"event_type": "application.bot.menu_v6"
-		},
-		"event": {
-			"event_key": "start_eval",
-			"timestamp": "1776409469001",
-			"operator": {
-				"operator_id": {"open_id": "ou_operator"}
-			}
-		}
-	}`
-	out := runBotMenu(t, payload)
-
-	if out.Timestamp != "1776409469001" {
-		t.Errorf("Timestamp fallback = %q", out.Timestamp)
-	}
-	if out.MenuTimestamp != "1776409469001" {
-		t.Errorf("MenuTimestamp = %q", out.MenuTimestamp)
-	}
-}
-
-func TestProcessBotMenuSecondsTimestampFallback(t *testing.T) {
-	payload := `{
-		"schema": "2.0",
-		"header": {
-			"event_id": "ev_menu_seconds",
-			"event_type": "application.bot.menu_v6"
-		},
-		"event": {
-			"event_key": "start_eval",
-			"timestamp": 1694592375,
-			"operator": {
-				"operator_id": {"open_id": "ou_operator"}
-			}
-		}
-	}`
-	out := runBotMenu(t, payload)
-
-	if out.Timestamp != "1694592375000" {
-		t.Errorf("Timestamp fallback = %q, want seconds normalized to milliseconds", out.Timestamp)
-	}
-	if out.MenuTimestamp != "1694592375000" {
-		t.Errorf("MenuTimestamp = %q, want seconds normalized to milliseconds", out.MenuTimestamp)
-	}
-}
-
-func TestProcessBotMenuTypeUsesLocalConstant(t *testing.T) {
-	payload := `{
-		"schema": "2.0",
-		"header": {
-			"event_id": "ev_menu_003",
-			"event_type": "unexpected.event_type",
-			"create_time": "1776409469275"
-		},
-		"event": {
-			"event_key": "start_eval",
-			"operator": {
-				"operator_id": {"open_id": "ou_operator"}
-			}
-		}
-	}`
-	out := runBotMenu(t, payload)
-
-	if out.Type != eventTypeBotMenuV6 {
-		t.Errorf("Type = %q, want %q", out.Type, eventTypeBotMenuV6)
-	}
-}
-
-func TestProcessBotMenuMalformedPayload(t *testing.T) {
-	raw := &event.RawEvent{
-		EventID:   "ev_bad",
-		EventType: eventTypeBotMenuV6,
-		Payload:   json.RawMessage(`not json`),
-		Timestamp: time.Now(),
-	}
-	got, err := processBotMenu(context.Background(), nil, raw, nil)
-	if err != nil {
-		t.Fatalf("Process should swallow parse errors, got %v", err)
-	}
-	if string(got) != "not json" {
-		t.Errorf("malformed fallback output = %q, want original bytes", string(got))
-	}
-}
-
-func runBotMenu(t *testing.T, payload string) BotMenuOutput {
-	t.Helper()
-	raw := &event.RawEvent{
-		EventID:   "ev_test",
-		EventType: eventTypeBotMenuV6,
-		Payload:   json.RawMessage(payload),
-		Timestamp: time.Now(),
-	}
-	got, err := processBotMenu(context.Background(), nil, raw, nil)
-	if err != nil {
-		t.Fatalf("processBotMenu: %v", err)
-	}
-	var out BotMenuOutput
-	if err := json.Unmarshal(got, &out); err != nil {
-		t.Fatalf("unmarshal output: %v\n%s", err, got)
-	}
-	return out
-}
--- a/events/application/register.go
+++ b/events/application/register.go
@@ -1,31 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-// Package application registers Application-domain EventKeys.
-package application
-
-import (
-	"reflect"
-
-	"github.com/larksuite/cli/internal/event"
-)
-
-const eventTypeBotMenuV6 = "application.bot.menu_v6"
-
-// Keys returns all Application-domain EventKey definitions.
-func Keys() []event.KeyDefinition {
-	return []event.KeyDefinition{
-		{
-			Key:         eventTypeBotMenuV6,
-			DisplayName: "Bot menu",
-			Description: "Triggered when a user clicks a custom bot menu item whose action is configured as a push event.",
-			EventType:   eventTypeBotMenuV6,
-			Schema: event.SchemaDef{
-				Custom: &event.SchemaSpec{Type: reflect.TypeOf(BotMenuOutput{})},
-			},
-			Process:               processBotMenu,
-			AuthTypes:             []string{"bot"},
-			RequiredConsoleEvents: []string{eventTypeBotMenuV6},
-		},
-	}
-}
--- a/events/approval/preconsume.go
+++ b/events/approval/preconsume.go
@@ -1,155 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package approval
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"strings"
-
-	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/event"
-)
-
-type approvalEventType string
-type approvalSubscriptionPath string
-
-type approvalSubscriptionConfig struct {
-	eventType     approvalEventType
-	subscribePath approvalSubscriptionPath
-}
-
-func approvalSubscriptionPreConsume(cfg approvalSubscriptionConfig) func(context.Context, event.APIClient, map[string]string) (func() error, error) {
-	return func(ctx context.Context, rt event.APIClient, params map[string]string) (func() error, error) {
-		if rt == nil {
-			return nil, errs.NewInternalError(errs.SubtypeUnknown,
-				"runtime API client is required for pre-consume subscription")
-		}
-
-		eventType := string(cfg.eventType)
-		subscribePath := string(cfg.subscribePath)
-		subscriptionTypes, err := approvalSubscriptionTypes(eventType, params)
-		if err != nil {
-			return nil, err
-		}
-
-		registered := make([]string, 0, len(subscriptionTypes))
-		for _, subscriptionType := range subscriptionTypes {
-			body := map[string]string{"subscription_type": subscriptionType}
-			if _, err := rt.CallAPI(ctx, "POST", subscribePath, body); err != nil {
-				return nil, approvalSubscriptionRegistrationError(eventType, registered, subscriptionType, err)
-			}
-			registered = append(registered, subscriptionType)
-		}
-
-		// Approval subscriptions are durable user-auth relations. Consuming events
-		// should not cancel that relation when this local process exits.
-		return nil, nil
-	}
-}
-
-func approvalSubscriptionTypes(eventType string, params map[string]string) ([]string, error) {
-	raw := strings.TrimSpace(params["subscription_type"])
-	if raw == "" {
-		return append([]string(nil), approvalAllSubscriptionTypes...), nil
-	}
-
-	values, err := parseApprovalSubscriptionTypeValues(raw)
-	if err != nil {
-		return nil, invalidApprovalSubscriptionTypeError(eventType, raw)
-	}
-
-	selected := make(map[string]bool, len(values))
-	for _, value := range values {
-		value = strings.TrimSpace(value)
-		switch value {
-		case approvalSubscriptionTypeInvolved, approvalSubscriptionTypeManaged:
-			selected[value] = true
-		default:
-			return nil, invalidApprovalSubscriptionTypeError(eventType, value)
-		}
-	}
-
-	result := make([]string, 0, len(selected))
-	for _, value := range approvalAllSubscriptionTypes {
-		if selected[value] {
-			result = append(result, value)
-		}
-	}
-	if len(result) == 0 {
-		return nil, invalidApprovalSubscriptionTypeError(eventType, raw)
-	}
-	return result, nil
-}
-
-func parseApprovalSubscriptionTypeValues(raw string) ([]string, error) {
-	if strings.HasPrefix(raw, "[") {
-		var values []string
-		if err := json.Unmarshal([]byte(raw), &values); err != nil {
-			return nil, err
-		}
-		return values, nil
-	}
-	return strings.Split(raw, ","), nil
-}
-
-func approvalSubscriptionRegistrationError(eventType string, registered []string, failed string, err error) error {
-	if err == nil {
-		return nil
-	}
-
-	msg := fmt.Sprintf(
-		"approval subscription pre-consume failed for EventKey %s: failed subscription_type %s",
-		eventType,
-		failed,
-	)
-	hint := fmt.Sprintf(
-		"no approval subscription relation was registered for EventKey %s; fix the cause and retry",
-		eventType,
-	)
-	if len(registered) > 0 {
-		msg = fmt.Sprintf(
-			"approval subscription pre-consume partially completed for EventKey %s: registered subscription_type(s) [%s], failed subscription_type %s",
-			eventType,
-			strings.Join(registered, ", "),
-			failed,
-		)
-		hint = fmt.Sprintf(
-			"server-side approval subscription relation(s) already registered for EventKey %s: %s; after fixing the cause, retry with --param subscription_type=%s to register the failed relation",
-			eventType,
-			strings.Join(registered, ", "),
-			failed,
-		)
-	}
-
-	if p, ok := errs.ProblemOf(err); ok {
-		if upstream := strings.TrimSpace(p.Message); upstream != "" {
-			p.Message = msg + ": " + upstream
-		} else {
-			p.Message = msg
-		}
-		if upstreamHint := strings.TrimSpace(p.Hint); upstreamHint != "" {
-			p.Hint = upstreamHint + "\n" + hint
-		} else {
-			p.Hint = hint
-		}
-		return err
-	}
-	return errs.NewInternalError(errs.SubtypeSDKError, "%s: %v", msg, err).
-		WithHint("%s", hint).
-		WithCause(err)
-}
-
-func invalidApprovalSubscriptionTypeError(eventType, value string) error {
-	return errs.NewValidationError(errs.SubtypeInvalidArgument,
-		"invalid subscription_type for EventKey %s: %q", eventType, value).
-		WithParam("--param").
-		WithHint("omit subscription_type to register both approval subscription relations, or pass --param subscription_type=%s, --param subscription_type=%s, or --param subscription_type=%s,%s; run `lark-cli event schema %s` for details",
-			approvalSubscriptionTypeInvolved,
-			approvalSubscriptionTypeManaged,
-			approvalSubscriptionTypeInvolved,
-			approvalSubscriptionTypeManaged,
-			eventType)
-}
--- a/events/approval/register.go
+++ b/events/approval/register.go
@@ -1,179 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-// Package approval registers Approval-domain EventKeys.
-package approval
-
-import (
-	"context"
-	"encoding/json"
-	"reflect"
-
-	"github.com/larksuite/cli/internal/event"
-)
-
-const (
-	eventTypeApprovalInstanceStatusChangedV4 = "approval.instance.status_changed_v4"
-	eventTypeApprovalTaskStatusChangedV4     = "approval.task.status_changed_v4"
-
-	pathApprovalInstancesSubscription = "/open-apis/approval/v4/instances/subscription"
-	pathApprovalTasksSubscription     = "/open-apis/approval/v4/tasks/subscription"
-
-	approvalSubscriptionTypeInvolved = "INVOLVED_APPROVAL"
-	approvalSubscriptionTypeManaged  = "MANAGED_APPROVAL"
-)
-
-var approvalAllSubscriptionTypes = []string{
-	approvalSubscriptionTypeInvolved,
-	approvalSubscriptionTypeManaged,
-}
-
-// Keys returns all Approval-domain EventKey definitions.
-func Keys() []event.KeyDefinition {
-	return []event.KeyDefinition{
-		{
-			Key:         eventTypeApprovalInstanceStatusChangedV4,
-			DisplayName: "Approval instance status changed",
-			Description: "Triggered after an approval instance status becomes visible to the requester or approval participants",
-			EventType:   eventTypeApprovalInstanceStatusChangedV4,
-			Params:      approvalSubscriptionParams(),
-			Schema: event.SchemaDef{
-				Custom: &event.SchemaSpec{Type: reflect.TypeOf(ApprovalInstanceStatusChangedV4Output{})},
-			},
-			Process: processApprovalInstanceStatusChanged,
-			PreConsume: approvalSubscriptionPreConsume(approvalSubscriptionConfig{
-				eventType:     eventTypeApprovalInstanceStatusChangedV4,
-				subscribePath: pathApprovalInstancesSubscription,
-			}),
-			Scopes: []string{"approval:instance:read"},
-			AuthTypes: []string{
-				"user",
-			},
-			RequiredConsoleEvents: []string{eventTypeApprovalInstanceStatusChangedV4},
-		},
-		{
-			Key:         eventTypeApprovalTaskStatusChangedV4,
-			DisplayName: "Approval task status changed",
-			Description: "Triggered after an approval task status becomes visible to the requester or task approver",
-			EventType:   eventTypeApprovalTaskStatusChangedV4,
-			Params:      approvalSubscriptionParams(),
-			Schema: event.SchemaDef{
-				Custom: &event.SchemaSpec{Type: reflect.TypeOf(ApprovalTaskStatusChangedV4Output{})},
-			},
-			Process: processApprovalTaskStatusChanged,
-			PreConsume: approvalSubscriptionPreConsume(approvalSubscriptionConfig{
-				eventType:     eventTypeApprovalTaskStatusChangedV4,
-				subscribePath: pathApprovalTasksSubscription,
-			}),
-			Scopes: []string{"approval:task:read"},
-			AuthTypes: []string{
-				"user",
-			},
-			RequiredConsoleEvents: []string{eventTypeApprovalTaskStatusChangedV4},
-		},
-	}
-}
-
-func approvalSubscriptionParams() []event.ParamDef {
-	return []event.ParamDef{
-		{
-			Name:        "subscription_type",
-			Type:        event.ParamMulti,
-			Description: "Approval subscription relation type(s) to register for the current authorized user. Omit to register both involved and managed approval relations.",
-			Values: []event.ParamValue{
-				{
-					Value: approvalSubscriptionTypeInvolved,
-					Desc:  "Receive events where the current user is the approval requester or approver.",
-				},
-				{
-					Value: approvalSubscriptionTypeManaged,
-					Desc:  "Receive events under approval definitions managed by the current user.",
-				},
-			},
-		},
-	}
-}
-
-func processApprovalInstanceStatusChanged(_ context.Context, _ event.APIClient, raw *event.RawEvent, _ map[string]string) (json.RawMessage, error) {
-	if raw == nil {
-		return nil, nil
-	}
-	var envelope struct {
-		Header struct {
-			EventID    string `json:"event_id"`
-			EventType  string `json:"event_type"`
-			CreateTime string `json:"create_time"`
-		} `json:"header"`
-		Event struct {
-			ApprovalCode string          `json:"approval_code"`
-			InstanceCode string          `json:"instance_code"`
-			ExternalID   string          `json:"external_id"`
-			Status       string          `json:"status"`
-			OperateTime  string          `json:"operate_time"`
-			StartUser    *ApprovalUserID `json:"start_user"`
-		} `json:"event"`
-	}
-	if err := json.Unmarshal(raw.Payload, &envelope); err != nil {
-		return raw.Payload, nil //nolint:nilerr // passthrough on malformed payload so consumers still see the event
-	}
-
-	out := &ApprovalInstanceStatusChangedV4Output{
-		Type:         envelope.Header.EventType,
-		EventID:      envelope.Header.EventID,
-		Timestamp:    envelope.Header.CreateTime,
-		ApprovalCode: envelope.Event.ApprovalCode,
-		InstanceCode: envelope.Event.InstanceCode,
-		ExternalID:   envelope.Event.ExternalID,
-		Status:       envelope.Event.Status,
-		OperateTime:  envelope.Event.OperateTime,
-		StartUser:    envelope.Event.StartUser,
-	}
-	if out.Type == "" {
-		out.Type = raw.EventType
-	}
-	return json.Marshal(out)
-}
-
-func processApprovalTaskStatusChanged(_ context.Context, _ event.APIClient, raw *event.RawEvent, _ map[string]string) (json.RawMessage, error) {
-	if raw == nil {
-		return nil, nil
-	}
-	var envelope struct {
-		Header struct {
-			EventID    string `json:"event_id"`
-			EventType  string `json:"event_type"`
-			CreateTime string `json:"create_time"`
-		} `json:"header"`
-		Event struct {
-			ApprovalCode   string          `json:"approval_code"`
-			InstanceCode   string          `json:"instance_code"`
-			TaskID         string          `json:"task_id"`
-			ExternalID     string          `json:"external_id"`
-			TaskExternalID string          `json:"task_external_id"`
-			AssignedUser   *ApprovalUserID `json:"assigned_user"`
-			Status         string          `json:"status"`
-			OperateTime    string          `json:"operate_time"`
-		} `json:"event"`
-	}
-	if err := json.Unmarshal(raw.Payload, &envelope); err != nil {
-		return raw.Payload, nil //nolint:nilerr // passthrough on malformed payload so consumers still see the event
-	}
-
-	out := &ApprovalTaskStatusChangedV4Output{
-		Type:           envelope.Header.EventType,
-		EventID:        envelope.Header.EventID,
-		Timestamp:      envelope.Header.CreateTime,
-		ApprovalCode:   envelope.Event.ApprovalCode,
-		InstanceCode:   envelope.Event.InstanceCode,
-		TaskID:         envelope.Event.TaskID,
-		ExternalID:     envelope.Event.ExternalID,
-		TaskExternalID: envelope.Event.TaskExternalID,
-		AssignedUser:   envelope.Event.AssignedUser,
-		Status:         envelope.Event.Status,
-		OperateTime:    envelope.Event.OperateTime,
-	}
-	if out.Type == "" {
-		out.Type = raw.EventType
-	}
-	return json.Marshal(out)
-}
--- a/events/approval/register_test.go
+++ b/events/approval/register_test.go
@@ -1,654 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package approval
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"reflect"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/event"
-	"github.com/larksuite/cli/internal/event/schemas"
-)
-
-type recordedCall struct {
-	method string
-	path   string
-	body   interface{}
-}
-
-type fakeAPIClient struct {
-	calls     []recordedCall
-	err       error
-	errOnCall int
-}
-
-func (f *fakeAPIClient) CallAPI(_ context.Context, method, path string, body interface{}) (json.RawMessage, error) {
-	f.calls = append(f.calls, recordedCall{method: method, path: path, body: body})
-	if f.err != nil && (f.errOnCall == 0 || f.errOnCall == len(f.calls)) {
-		return nil, f.err
-	}
-	return json.RawMessage(`{}`), nil
-}
-
-func TestKeysApprovalMetadata(t *testing.T) {
-	keys := Keys()
-	if len(keys) != 2 {
-		t.Fatalf("len(Keys()) = %d, want 2", len(keys))
-	}
-
-	tests := []struct {
-		key        string
-		scope      string
-		schemaType reflect.Type
-		subscribe  string
-	}{
-		{
-			key:        eventTypeApprovalInstanceStatusChangedV4,
-			scope:      "approval:instance:read",
-			schemaType: reflect.TypeOf(ApprovalInstanceStatusChangedV4Output{}),
-			subscribe:  pathApprovalInstancesSubscription,
-		},
-		{
-			key:        eventTypeApprovalTaskStatusChangedV4,
-			scope:      "approval:task:read",
-			schemaType: reflect.TypeOf(ApprovalTaskStatusChangedV4Output{}),
-			subscribe:  pathApprovalTasksSubscription,
-		},
-	}
-
-	byKey := make(map[string]event.KeyDefinition, len(keys))
-	for _, def := range keys {
-		byKey[def.Key] = def
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.key, func(t *testing.T) {
-			def, ok := byKey[tc.key]
-			if !ok {
-				t.Fatalf("missing key %s", tc.key)
-			}
-			if def.EventType != tc.key {
-				t.Errorf("EventType = %q, want %q", def.EventType, tc.key)
-			}
-			if def.Schema.Custom == nil || def.Schema.Custom.Type != tc.schemaType {
-				t.Fatalf("Custom schema Type = %v, want %v", def.Schema.Custom, tc.schemaType)
-			}
-			if def.Schema.Native != nil {
-				t.Fatal("approval events must use Custom schema while SDK event types are not exported")
-			}
-			if def.Process == nil {
-				t.Fatal("Process must flatten raw V2 envelopes")
-			}
-			if def.PreConsume == nil {
-				t.Fatal("PreConsume must subscribe approval user-auth events")
-			}
-			if !reflect.DeepEqual(def.Scopes, []string{tc.scope}) {
-				t.Errorf("Scopes = %#v, want %q", def.Scopes, tc.scope)
-			}
-			if !reflect.DeepEqual(def.AuthTypes, []string{"user"}) {
-				t.Errorf("AuthTypes = %#v, want user", def.AuthTypes)
-			}
-			if !reflect.DeepEqual(def.RequiredConsoleEvents, []string{tc.key}) {
-				t.Errorf("RequiredConsoleEvents = %#v, want %q", def.RequiredConsoleEvents, tc.key)
-			}
-			assertSubscriptionParam(t, def.Params)
-		})
-	}
-}
-
-func assertSubscriptionParam(t *testing.T, params []event.ParamDef) {
-	t.Helper()
-	if len(params) != 1 {
-		t.Fatalf("len(params) = %d, want 1", len(params))
-	}
-	p := params[0]
-	if p.Name != "subscription_type" || p.Type != event.ParamMulti || p.Required || p.SubscriptionKey {
-		t.Fatalf("subscription_type param = %+v, want optional multi non-subscription-key param", p)
-	}
-	got := map[string]string{}
-	for _, v := range p.Values {
-		got[v.Value] = v.Desc
-	}
-	for _, want := range []string{approvalSubscriptionTypeInvolved, approvalSubscriptionTypeManaged} {
-		if got[want] == "" {
-			t.Errorf("subscription_type value %q missing or empty desc; values=%+v", want, p.Values)
-		}
-	}
-}
-
-type reflectedApprovalSchema struct {
-	Properties map[string]reflectedApprovalSchemaProperty `json:"properties"`
-}
-
-type reflectedApprovalSchemaProperty struct {
-	Format     string                                     `json:"format"`
-	Enum       []string                                   `json:"enum"`
-	Properties map[string]reflectedApprovalSchemaProperty `json:"properties"`
-}
-
-func TestApprovalSchemasAnnotations(t *testing.T) {
-	tests := []struct {
-		name         string
-		schemaType   reflect.Type
-		eventType    string
-		statusValues []string
-		userField    string
-	}{
-		{
-			name:         "instance",
-			schemaType:   reflect.TypeOf(ApprovalInstanceStatusChangedV4Output{}),
-			eventType:    eventTypeApprovalInstanceStatusChangedV4,
-			statusValues: []string{"PENDING", "APPROVED", "REJECTED", "CANCELED", "DELETED", "REVERTED", "OVERTIME_CLOSE", "OVERTIME_RECOVER"},
-			userField:    "start_user",
-		},
-		{
-			name:         "task",
-			schemaType:   reflect.TypeOf(ApprovalTaskStatusChangedV4Output{}),
-			eventType:    eventTypeApprovalTaskStatusChangedV4,
-			statusValues: []string{"REVERTED", "PENDING", "APPROVED", "REJECTED", "TRANSFERRED", "ROLLBACK", "DONE", "OVERTIME_CLOSE", "OVERTIME_RECOVER"},
-			userField:    "assigned_user",
-		},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			var schema reflectedApprovalSchema
-			if err := json.Unmarshal(schemas.FromType(tc.schemaType), &schema); err != nil {
-				t.Fatalf("unmarshal schema: %v", err)
-			}
-			props := schema.Properties
-			eventTypeEnum := props["type"].Enum
-			if len(eventTypeEnum) != 1 || eventTypeEnum[0] != tc.eventType {
-				t.Fatalf("type enum = %v, want %s", eventTypeEnum, tc.eventType)
-			}
-			if got := props["timestamp"].Format; got != "timestamp_ms" {
-				t.Errorf("timestamp format = %v, want timestamp_ms", got)
-			}
-			assertEnumContains(t, props["status"].Enum, tc.statusValues)
-			if got := props["operate_time"].Format; got != "timestamp_ms" {
-				t.Errorf("event.operate_time format = %v, want timestamp_ms", got)
-			}
-
-			userProps := props[tc.userField].Properties
-			if got := userProps["open_id"].Format; got != "open_id" {
-				t.Errorf("%s.open_id format = %v, want open_id", tc.userField, got)
-			}
-			if got := userProps["union_id"].Format; got != "union_id" {
-				t.Errorf("%s.union_id format = %v, want union_id", tc.userField, got)
-			}
-			if got := userProps["user_id"].Format; got != "user_id" {
-				t.Errorf("%s.user_id format = %v, want user_id", tc.userField, got)
-			}
-		})
-	}
-}
-
-func assertEnumContains(t *testing.T, raw []string, wants []string) {
-	t.Helper()
-	got := make(map[string]bool, len(raw))
-	for _, v := range raw {
-		got[v] = true
-	}
-	for _, want := range wants {
-		if !got[want] {
-			t.Errorf("enum missing %q; enum=%v", want, raw)
-		}
-	}
-}
-
-func TestApprovalPreConsumeRegistersSubscriptionTypesWithoutCleanup(t *testing.T) {
-	tests := []struct {
-		name          string
-		eventType     string
-		subscribePath string
-		params        map[string]string
-		wantTypes     []string
-	}{
-		{
-			name:          "instance omitted subscription_type registers both",
-			eventType:     eventTypeApprovalInstanceStatusChangedV4,
-			subscribePath: pathApprovalInstancesSubscription,
-			wantTypes: []string{
-				approvalSubscriptionTypeInvolved,
-				approvalSubscriptionTypeManaged,
-			},
-		},
-		{
-			name:          "task explicit single managed",
-			eventType:     eventTypeApprovalTaskStatusChangedV4,
-			subscribePath: pathApprovalTasksSubscription,
-			params:        map[string]string{"subscription_type": approvalSubscriptionTypeManaged},
-			wantTypes:     []string{approvalSubscriptionTypeManaged},
-		},
-		{
-			name:          "task comma separated multi canonicalizes and deduplicates",
-			eventType:     eventTypeApprovalTaskStatusChangedV4,
-			subscribePath: pathApprovalTasksSubscription,
-			params: map[string]string{
-				"subscription_type": approvalSubscriptionTypeManaged + "," + approvalSubscriptionTypeInvolved + "," + approvalSubscriptionTypeManaged,
-			},
-			wantTypes: []string{
-				approvalSubscriptionTypeInvolved,
-				approvalSubscriptionTypeManaged,
-			},
-		},
-		{
-			name:          "instance json array multi",
-			eventType:     eventTypeApprovalInstanceStatusChangedV4,
-			subscribePath: pathApprovalInstancesSubscription,
-			params: map[string]string{
-				"subscription_type": `["MANAGED_APPROVAL","INVOLVED_APPROVAL"]`,
-			},
-			wantTypes: []string{
-				approvalSubscriptionTypeInvolved,
-				approvalSubscriptionTypeManaged,
-			},
-		},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			pc := approvalSubscriptionPreConsume(approvalSubscriptionConfig{
-				eventType:     approvalEventType(tc.eventType),
-				subscribePath: approvalSubscriptionPath(tc.subscribePath),
-			})
-			rt := &fakeAPIClient{}
-			cleanup, err := pc(context.Background(), rt, tc.params)
-			if err != nil {
-				t.Fatalf("PreConsume returned error: %v", err)
-			}
-			if cleanup != nil {
-				t.Fatal("cleanup must be nil; approval consume must not unsubscribe on exit")
-			}
-			assertSubscriptionCalls(t, rt.calls, tc.subscribePath, tc.wantTypes)
-		})
-	}
-}
-
-func assertSubscriptionCalls(t *testing.T, got []recordedCall, wantPath string, wantTypes []string) {
-	t.Helper()
-	if len(got) != len(wantTypes) {
-		t.Fatalf("calls after pre-consume = %d, want %d; calls=%+v", len(got), len(wantTypes), got)
-	}
-	for i, wantType := range wantTypes {
-		assertCall(t, got[i], "POST", wantPath, map[string]string{"subscription_type": wantType})
-	}
-}
-
-func assertCall(t *testing.T, got recordedCall, wantMethod, wantPath string, wantBody interface{}) {
-	t.Helper()
-	if got.method != wantMethod {
-		t.Errorf("method = %q, want %q", got.method, wantMethod)
-	}
-	if got.path != wantPath {
-		t.Errorf("path = %q, want %q", got.path, wantPath)
-	}
-	if !reflect.DeepEqual(got.body, wantBody) {
-		t.Errorf("body = %#v, want %#v", got.body, wantBody)
-	}
-}
-
-func TestApprovalPreConsumeValidationErrors(t *testing.T) {
-	t.Run("nil runtime", func(t *testing.T) {
-		pc := approvalSubscriptionPreConsume(approvalSubscriptionConfig{
-			eventType: eventTypeApprovalInstanceStatusChangedV4,
-		})
-		_, err := pc(context.Background(), nil, map[string]string{"subscription_type": approvalSubscriptionTypeInvolved})
-		if err == nil {
-			t.Fatal("expected nil runtime error")
-		}
-		p, ok := errs.ProblemOf(err)
-		if !ok || p.Category != errs.CategoryInternal {
-			t.Fatalf("err = %T/%v, want typed internal error", err, err)
-		}
-	})
-
-	for _, raw := range []string{"BAD", "[]", `["INVOLVED_APPROVAL",3]`} {
-		t.Run("invalid subscription type "+raw, func(t *testing.T) {
-			pc := approvalSubscriptionPreConsume(approvalSubscriptionConfig{
-				eventType: eventTypeApprovalInstanceStatusChangedV4,
-			})
-			cleanup, err := pc(context.Background(), &fakeAPIClient{}, map[string]string{"subscription_type": raw})
-			if err == nil {
-				t.Fatal("expected invalid subscription_type error")
-			}
-			if cleanup != nil {
-				t.Fatal("cleanup must be nil on validation error")
-			}
-			var ve *errs.ValidationError
-			if !errors.As(err, &ve) {
-				t.Fatalf("err = %T/%v, want *errs.ValidationError", err, err)
-			}
-			if ve.Subtype != errs.SubtypeInvalidArgument || ve.Param != "--param" {
-				t.Errorf("subtype/param = %s/%q, want invalid_argument/--param", ve.Subtype, ve.Param)
-			}
-			if ve.Hint == "" {
-				t.Error("invalid subscription_type should carry a hint")
-			}
-		})
-	}
-
-	t.Run("partial registration failure reports registered and failed relation types", func(t *testing.T) {
-		upstream := errs.NewAPIError(errs.SubtypeServerError, "approval subscription API failed")
-		rt := &fakeAPIClient{err: upstream, errOnCall: 2}
-		pc := approvalSubscriptionPreConsume(approvalSubscriptionConfig{
-			eventType:     eventTypeApprovalTaskStatusChangedV4,
-			subscribePath: pathApprovalTasksSubscription,
-		})
-
-		cleanup, err := pc(context.Background(), rt, map[string]string{})
-		if err == nil {
-			t.Fatal("expected partial registration error")
-		}
-		if cleanup != nil {
-			t.Fatal("cleanup must be nil on registration error")
-		}
-		assertSubscriptionCalls(t, rt.calls, pathApprovalTasksSubscription, []string{
-			approvalSubscriptionTypeInvolved,
-			approvalSubscriptionTypeManaged,
-		})
-		p, ok := errs.ProblemOf(err)
-		if !ok {
-			t.Fatalf("err = %T/%v, want typed error", err, err)
-		}
-		if p.Category != errs.CategoryAPI || p.Subtype != errs.SubtypeServerError {
-			t.Fatalf("category/subtype = %s/%s, want api/server_error", p.Category, p.Subtype)
-		}
-		for _, want := range []string{
-			"registered subscription_type(s) [INVOLVED_APPROVAL]",
-			"failed subscription_type MANAGED_APPROVAL",
-		} {
-			if !strings.Contains(p.Message, want) {
-				t.Errorf("partial error message missing %q: %q", want, p.Message)
-			}
-		}
-		for _, want := range []string{
-			"already registered",
-			"--param subscription_type=MANAGED_APPROVAL",
-		} {
-			if !strings.Contains(p.Hint, want) {
-				t.Errorf("partial error hint missing %q: %q", want, p.Hint)
-			}
-		}
-	})
-}
-
-func TestApprovalSubscriptionRegistrationErrorVariants(t *testing.T) {
-	t.Run("nil error", func(t *testing.T) {
-		if err := approvalSubscriptionRegistrationError(eventTypeApprovalTaskStatusChangedV4, nil, approvalSubscriptionTypeInvolved, nil); err != nil {
-			t.Fatalf("nil cause returned error: %v", err)
-		}
-	})
-
-	t.Run("typed error with existing hint and empty message", func(t *testing.T) {
-		upstream := errs.NewAPIError(errs.SubtypeServerError, "").WithHint("retry later")
-		err := approvalSubscriptionRegistrationError(
-			eventTypeApprovalTaskStatusChangedV4,
-			nil,
-			approvalSubscriptionTypeInvolved,
-			upstream,
-		)
-		if err != upstream {
-			t.Fatalf("typed error should be annotated in place; got %T/%v", err, err)
-		}
-		p, ok := errs.ProblemOf(err)
-		if !ok {
-			t.Fatalf("err = %T/%v, want typed error", err, err)
-		}
-		if !strings.Contains(p.Message, "failed subscription_type INVOLVED_APPROVAL") {
-			t.Errorf("message missing failed relation: %q", p.Message)
-		}
-		for _, want := range []string{"retry later", "no approval subscription relation was registered"} {
-			if !strings.Contains(p.Hint, want) {
-				t.Errorf("hint missing %q: %q", want, p.Hint)
-			}
-		}
-	})
-
-	t.Run("untyped error is wrapped with retry context", func(t *testing.T) {
-		cause := errors.New("transport closed")
-		err := approvalSubscriptionRegistrationError(
-			eventTypeApprovalTaskStatusChangedV4,
-			nil,
-			approvalSubscriptionTypeInvolved,
-			cause,
-		)
-		if !errors.Is(err, cause) {
-			t.Fatalf("wrapped error should preserve cause; got %T/%v", err, err)
-		}
-		p, ok := errs.ProblemOf(err)
-		if !ok {
-			t.Fatalf("err = %T/%v, want typed error", err, err)
-		}
-		if p.Category != errs.CategoryInternal || p.Subtype != errs.SubtypeSDKError {
-			t.Fatalf("category/subtype = %s/%s, want internal/sdk_error", p.Category, p.Subtype)
-		}
-		if !strings.Contains(p.Hint, "no approval subscription relation was registered") {
-			t.Errorf("hint missing no-registration context: %q", p.Hint)
-		}
-	})
-}
-
-func TestProcessApprovalInstanceStatusChanged(t *testing.T) {
-	out := runApprovalInstanceStatusChanged(t, `{
-		"schema": "2.0",
-		"header": {
-			"event_id": "evt_approval_instance_001",
-			"event_type": "approval.instance.status_changed_v4",
-			"create_time": "1710000000000"
-		},
-		"event": {
-			"approval_code": "approval_code_001",
-			"instance_code": "instance_code_001",
-			"external_id": "external_001",
-			"status": "PENDING",
-			"operate_time": "1666079207003",
-			"start_user": {
-				"open_id": "ou_start",
-				"union_id": "on_start",
-				"user_id": "user_start"
-			}
-		}
-	}`)
-
-	if out.Type != eventTypeApprovalInstanceStatusChangedV4 {
-		t.Errorf("Type = %q, want %q", out.Type, eventTypeApprovalInstanceStatusChangedV4)
-	}
-	if out.EventID != "evt_approval_instance_001" || out.Timestamp != "1710000000000" {
-		t.Errorf("EventID/Timestamp = %q/%q", out.EventID, out.Timestamp)
-	}
-	if out.ApprovalCode != "approval_code_001" || out.InstanceCode != "instance_code_001" {
-		t.Errorf("approval/instance code = %q/%q", out.ApprovalCode, out.InstanceCode)
-	}
-	if out.ExternalID != "external_001" || out.Status != "PENDING" || out.OperateTime != "1666079207003" {
-		t.Errorf("external/status/operate_time = %q/%q/%q", out.ExternalID, out.Status, out.OperateTime)
-	}
-	if out.StartUser == nil || out.StartUser.OpenID != "ou_start" || out.StartUser.UnionID != "on_start" || out.StartUser.UserID != "user_start" {
-		t.Fatalf("StartUser = %+v, want full user ids", out.StartUser)
-	}
-}
-
-func TestProcessApprovalTaskStatusChanged(t *testing.T) {
-	out := runApprovalTaskStatusChanged(t, `{
-		"schema": "2.0",
-		"header": {
-			"event_id": "evt_approval_task_001",
-			"event_type": "approval.task.status_changed_v4",
-			"create_time": "1710000000001"
-		},
-		"event": {
-			"approval_code": "approval_code_002",
-			"instance_code": "instance_code_002",
-			"task_id": "task_001",
-			"external_id": "external_002",
-			"task_external_id": "task_external_001",
-			"status": "APPROVED",
-			"operate_time": "1666079207004",
-			"assigned_user": {
-				"open_id": "ou_assignee",
-				"union_id": "on_assignee",
-				"user_id": "user_assignee"
-			}
-		}
-	}`)
-
-	if out.Type != eventTypeApprovalTaskStatusChangedV4 {
-		t.Errorf("Type = %q, want %q", out.Type, eventTypeApprovalTaskStatusChangedV4)
-	}
-	if out.EventID != "evt_approval_task_001" || out.Timestamp != "1710000000001" {
-		t.Errorf("EventID/Timestamp = %q/%q", out.EventID, out.Timestamp)
-	}
-	if out.ApprovalCode != "approval_code_002" || out.InstanceCode != "instance_code_002" || out.TaskID != "task_001" {
-		t.Errorf("approval/instance/task = %q/%q/%q", out.ApprovalCode, out.InstanceCode, out.TaskID)
-	}
-	if out.ExternalID != "external_002" || out.TaskExternalID != "task_external_001" || out.Status != "APPROVED" || out.OperateTime != "1666079207004" {
-		t.Errorf("external/task_external/status/operate_time = %q/%q/%q/%q", out.ExternalID, out.TaskExternalID, out.Status, out.OperateTime)
-	}
-	if out.AssignedUser == nil || out.AssignedUser.OpenID != "ou_assignee" || out.AssignedUser.UnionID != "on_assignee" || out.AssignedUser.UserID != "user_assignee" {
-		t.Fatalf("AssignedUser = %+v, want full user ids", out.AssignedUser)
-	}
-}
-
-func TestProcessApprovalStatusChangedUsesRawEventTypeFallback(t *testing.T) {
-	instance := runApprovalInstanceStatusChanged(t, `{
-		"schema": "2.0",
-		"header": {
-			"event_id": "evt_approval_instance_fallback",
-			"create_time": "1710000000002"
-		},
-		"event": {
-			"approval_code": "approval_code_fallback",
-			"instance_code": "instance_code_fallback",
-			"status": "APPROVED",
-			"operate_time": "1666079207005"
-		}
-	}`)
-	if instance.Type != eventTypeApprovalInstanceStatusChangedV4 {
-		t.Errorf("instance Type fallback = %q, want %q", instance.Type, eventTypeApprovalInstanceStatusChangedV4)
-	}
-
-	task := runApprovalTaskStatusChanged(t, `{
-		"schema": "2.0",
-		"header": {
-			"event_id": "evt_approval_task_fallback",
-			"create_time": "1710000000003"
-		},
-		"event": {
-			"approval_code": "approval_code_fallback",
-			"instance_code": "instance_code_fallback",
-			"task_id": "task_fallback",
-			"status": "DONE",
-			"operate_time": "1666079207006"
-		}
-	}`)
-	if task.Type != eventTypeApprovalTaskStatusChangedV4 {
-		t.Errorf("task Type fallback = %q, want %q", task.Type, eventTypeApprovalTaskStatusChangedV4)
-	}
-}
-
-func TestProcessApprovalStatusChangedMalformedPayloadPassthrough(t *testing.T) {
-	for _, tc := range []struct {
-		name      string
-		eventType string
-		process   event.ProcessFunc
-	}{
-		{"instance", eventTypeApprovalInstanceStatusChangedV4, processApprovalInstanceStatusChanged},
-		{"task", eventTypeApprovalTaskStatusChangedV4, processApprovalTaskStatusChanged},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			raw := &event.RawEvent{
-				EventType: tc.eventType,
-				Payload:   json.RawMessage(`not json`),
-				Timestamp: time.Now(),
-			}
-			got, err := tc.process(context.Background(), nil, raw, nil)
-			if err != nil {
-				t.Fatalf("Process should swallow parse errors, got %v", err)
-			}
-			if string(got) != "not json" {
-				t.Errorf("malformed fallback output = %q, want original bytes", string(got))
-			}
-		})
-	}
-}
-
-func TestProcessApprovalStatusChangedNilRaw(t *testing.T) {
-	for _, tc := range []struct {
-		name    string
-		process event.ProcessFunc
-	}{
-		{"instance", processApprovalInstanceStatusChanged},
-		{"task", processApprovalTaskStatusChanged},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			got, err := tc.process(context.Background(), nil, nil, nil)
-			if err != nil {
-				t.Fatalf("Process nil raw returned error: %v", err)
-			}
-			if got != nil {
-				t.Fatalf("Process nil raw output = %s, want nil", string(got))
-			}
-		})
-	}
-}
-
-func runApprovalInstanceStatusChanged(t *testing.T, payload string) ApprovalInstanceStatusChangedV4Output {
-	t.Helper()
-	raw := &event.RawEvent{
-		EventType: eventTypeApprovalInstanceStatusChangedV4,
-		Payload:   json.RawMessage(payload),
-		Timestamp: time.Now(),
-	}
-	got, err := processApprovalInstanceStatusChanged(context.Background(), nil, raw, nil)
-	if err != nil {
-		t.Fatalf("Process returned error: %v", err)
-	}
-	var out ApprovalInstanceStatusChangedV4Output
-	if err := json.Unmarshal(got, &out); err != nil {
-		t.Fatalf("Process output is not valid instance JSON: %v\nraw=%s", err, string(got))
-	}
-	return out
-}
-
-func runApprovalTaskStatusChanged(t *testing.T, payload string) ApprovalTaskStatusChangedV4Output {
-	t.Helper()
-	raw := &event.RawEvent{
-		EventType: eventTypeApprovalTaskStatusChangedV4,
-		Payload:   json.RawMessage(payload),
-		Timestamp: time.Now(),
-	}
-	got, err := processApprovalTaskStatusChanged(context.Background(), nil, raw, nil)
-	if err != nil {
-		t.Fatalf("Process returned error: %v", err)
-	}
-	var out ApprovalTaskStatusChangedV4Output
-	if err := json.Unmarshal(got, &out); err != nil {
-		t.Fatalf("Process output is not valid task JSON: %v\nraw=%s", err, string(got))
-	}
-	return out
-}
-
-func TestApprovalKeysRegisterCleanly(t *testing.T) {
-	for _, key := range []string{eventTypeApprovalInstanceStatusChangedV4, eventTypeApprovalTaskStatusChangedV4} {
-		event.UnregisterKeyForTest(key)
-		t.Cleanup(func() { event.UnregisterKeyForTest(key) })
-	}
-
-	for _, def := range Keys() {
-		event.RegisterKey(def)
-	}
-	for _, key := range []string{eventTypeApprovalInstanceStatusChangedV4, eventTypeApprovalTaskStatusChangedV4} {
-		if _, ok := event.Lookup(key); !ok {
-			t.Fatalf("event.Lookup(%q) not registered", key)
-		}
-	}
-}
-
-var _ event.APIClient = (*fakeAPIClient)(nil)
--- a/events/approval/types.go
+++ b/events/approval/types.go
@@ -1,42 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package approval
-
-// ApprovalUserID identifies a user in the three Lark ID formats included by
-// approval status-change events.
-type ApprovalUserID struct {
-	OpenID  string `json:"open_id,omitempty"  desc:"User open_id; prefixed with ou_" kind:"open_id"`
-	UnionID string `json:"union_id,omitempty" desc:"User union_id"                  kind:"union_id"`
-	UserID  string `json:"user_id,omitempty"  desc:"User id within the tenant"       kind:"user_id"`
-}
-
-// ApprovalInstanceStatusChangedV4Output is the flattened shape for
-// approval.instance.status_changed_v4.
-type ApprovalInstanceStatusChangedV4Output struct {
-	Type         string          `json:"type"                    desc:"Event type; always approval.instance.status_changed_v4" enum:"approval.instance.status_changed_v4"`
-	EventID      string          `json:"event_id,omitempty"      desc:"Globally unique event ID; safe for deduplication"`
-	Timestamp    string          `json:"timestamp,omitempty"     desc:"Event delivery time (ms timestamp string); taken from header.create_time when present" kind:"timestamp_ms"`
-	ApprovalCode string          `json:"approval_code,omitempty" desc:"Approval definition code; not a subscription dimension"`
-	InstanceCode string          `json:"instance_code,omitempty" desc:"Approval instance code"`
-	ExternalID   string          `json:"external_id,omitempty"   desc:"Third-party approval instance id; present only for third-party approvals"`
-	Status       string          `json:"status,omitempty"        desc:"Approval instance status" enum:"PENDING,APPROVED,REJECTED,CANCELED,DELETED,REVERTED,OVERTIME_CLOSE,OVERTIME_RECOVER"`
-	OperateTime  string          `json:"operate_time,omitempty"  desc:"Status change time in milliseconds" kind:"timestamp_ms"`
-	StartUser    *ApprovalUserID `json:"start_user,omitempty"    desc:"Approval instance starter; omitted when unavailable"`
-}
-
-// ApprovalTaskStatusChangedV4Output is the flattened shape for
-// approval.task.status_changed_v4.
-type ApprovalTaskStatusChangedV4Output struct {
-	Type           string          `json:"type"                      desc:"Event type; always approval.task.status_changed_v4" enum:"approval.task.status_changed_v4"`
-	EventID        string          `json:"event_id,omitempty"        desc:"Globally unique event ID; safe for deduplication"`
-	Timestamp      string          `json:"timestamp,omitempty"       desc:"Event delivery time (ms timestamp string); taken from header.create_time when present" kind:"timestamp_ms"`
-	ApprovalCode   string          `json:"approval_code,omitempty"     desc:"Approval definition code; not a subscription dimension"`
-	InstanceCode   string          `json:"instance_code,omitempty"     desc:"Approval instance code"`
-	TaskID         string          `json:"task_id,omitempty"           desc:"Approval task id"`
-	ExternalID     string          `json:"external_id,omitempty"       desc:"Third-party approval external id; present only for third-party approvals"`
-	TaskExternalID string          `json:"task_external_id,omitempty"  desc:"Third-party approval task external id; present only when emitted by the upstream service"`
-	AssignedUser   *ApprovalUserID `json:"assigned_user,omitempty"     desc:"Task assignee or operator user ids; omitted for automatic flows without an operator"`
-	Status         string          `json:"status,omitempty"            desc:"Approval task status" enum:"REVERTED,PENDING,APPROVED,REJECTED,TRANSFERRED,ROLLBACK,DONE,OVERTIME_CLOSE,OVERTIME_RECOVER"`
-	OperateTime    string          `json:"operate_time,omitempty"      desc:"Status change time in milliseconds" kind:"timestamp_ms"`
-}
--- a/events/im/message_receive.go
+++ b/events/im/message_receive.go
@@ -13,29 +13,17 @@ import (

 // ImMessageReceiveOutput is the flattened shape for im.message.receive_v1; `desc` tags drive the reflected schema.
 type ImMessageReceiveOutput struct {
-	Type        string          `json:"type"                   desc:"Event type; always im.message.receive_v1"`
-	EventID     string          `json:"event_id,omitempty"     desc:"Event delivery ID. Do not use as the message deduplication key; use message_id instead."`
-	Timestamp   string          `json:"timestamp,omitempty"    desc:"Event delivery time (ms timestamp string); prefers header.create_time"                                                                                                              kind:"timestamp_ms"`
-	ID          string          `json:"id,omitempty"           desc:"Message ID (legacy alias of message_id, kept for compatibility)"                                                                                                                     kind:"message_id"`
-	MessageID   string          `json:"message_id,omitempty"   desc:"Message ID; prefixed with om_. Recommended idempotency key for im.message.receive_v1 consumers."                                                                                     kind:"message_id"`
-	CreateTime  string          `json:"create_time,omitempty"  desc:"Message creation time (ms timestamp string)"                                                                                                                                         kind:"timestamp_ms"`
-	UpdateTime  string          `json:"update_time,omitempty"  desc:"Message update time (ms timestamp string); emitted only when different from create_time"                                                                                              kind:"timestamp_ms"`
-	ChatID      string          `json:"chat_id,omitempty"      desc:"Chat/conversation ID; prefixed with oc_"                                                                                                                                             kind:"chat_id"`
-	ChatType    string          `json:"chat_type,omitempty"    desc:"Conversation type"                                                                                                                                                                   enum:"p2p,group"`
-	MessageType string          `json:"message_type,omitempty" desc:"Message type"`
-	SenderID    string          `json:"sender_id,omitempty"    desc:"Sender open_id; prefixed with ou_"                                                                                                                                                   kind:"open_id"`
-	SenderType  string          `json:"sender_type,omitempty"  desc:"Sender type"                                                                                                                                                                         enum:"user,bot"`
-	RootID      string          `json:"root_id,omitempty"      desc:"Root message ID of the reply/thread context, when present"                                                                                                                           kind:"message_id"`
-	ThreadID    string          `json:"thread_id,omitempty"    desc:"Thread ID, when present"`
-	ReplyTo     string          `json:"reply_to,omitempty"     desc:"Parent message ID of the direct reply context, when present"                                                                                                                         kind:"message_id"`
-	Content     string          `json:"content,omitempty"      desc:"Message content. For most types (text/post/image/file/audio, etc.) this is pre-rendered human-readable text."`
-	Mentions    []MentionOutput `json:"mentions,omitempty" desc:"Compact mentions aligned with im +messages-mget"`
-}
-
-type MentionOutput struct {
-	Key  string `json:"key,omitempty"  desc:"Mention placeholder key, for example @_user_1"`
-	ID   string `json:"id,omitempty"   desc:"Mentioned user open_id; prefixed with ou_"        kind:"open_id"`
-	Name string `json:"name,omitempty" desc:"Mentioned display name"`
+	Type        string `json:"type"                   desc:"Event type; always im.message.receive_v1"`
+	EventID     string `json:"event_id,omitempty"     desc:"Globally unique event ID; safe for deduplication"`
+	Timestamp   string `json:"timestamp,omitempty"    desc:"Event delivery time (ms timestamp string); prefers header.create_time"                                                                                                              kind:"timestamp_ms"`
+	ID          string `json:"id,omitempty"           desc:"Message ID (legacy alias of message_id, kept for compatibility)"                                                                                                                     kind:"message_id"`
+	MessageID   string `json:"message_id,omitempty"   desc:"Message ID; prefixed with om_"                                                                                                                                                       kind:"message_id"`
+	CreateTime  string `json:"create_time,omitempty"  desc:"Message creation time (ms timestamp string)"                                                                                                                                         kind:"timestamp_ms"`
+	ChatID      string `json:"chat_id,omitempty"      desc:"Chat/conversation ID; prefixed with oc_"                                                                                                                                             kind:"chat_id"`
+	ChatType    string `json:"chat_type,omitempty"    desc:"Conversation type"                                                                                                                                                                   enum:"p2p,group"`
+	MessageType string `json:"message_type,omitempty" desc:"Message type"`
+	SenderID    string `json:"sender_id,omitempty"    desc:"Sender open_id; prefixed with ou_"                                                                                                                                                   kind:"open_id"`
+	Content     string `json:"content,omitempty"      desc:"Message content. For most types (text/post/image/file/audio, etc.) this is pre-rendered human-readable text."`
 }

 func processImMessageReceive(_ context.Context, _ event.APIClient, raw *event.RawEvent, _ map[string]string) (json.RawMessage, error) {
@@ -48,20 +36,15 @@ func processImMessageReceive(_ context.Context, _ event.APIClient, raw *event.Ra
 		Event struct {
 			Message struct {
 				MessageID   string        `json:"message_id"`
-				RootID      string        `json:"root_id"`
-				ParentID    string        `json:"parent_id"`
-				ThreadID    string        `json:"thread_id"`
 				ChatID      string        `json:"chat_id"`
 				ChatType    string        `json:"chat_type"`
 				MessageType string        `json:"message_type"`
 				Content     string        `json:"content"`
 				CreateTime  string        `json:"create_time"`
-				UpdateTime  string        `json:"update_time"`
 				Mentions    []interface{} `json:"mentions"`
 			} `json:"message"`
 			Sender struct {
-				SenderType string `json:"sender_type"`
-				SenderID   struct {
+				SenderID struct {
 					OpenID string `json:"open_id"`
 				} `json:"sender_id"`
 			} `json:"sender"`
@@ -98,54 +81,7 @@ func processImMessageReceive(_ context.Context, _ event.APIClient, raw *event.Ra
 		ChatType:    msg.ChatType,
 		MessageType: msg.MessageType,
 		SenderID:    envelope.Event.Sender.SenderID.OpenID,
-		SenderType:  envelope.Event.Sender.SenderType,
-		RootID:      msg.RootID,
-		ThreadID:    msg.ThreadID,
-		ReplyTo:     msg.ParentID,
 		Content:     content,
-		Mentions:    compactMentions(msg.Mentions),
-	}
-	if msg.UpdateTime != "" && msg.UpdateTime != msg.CreateTime {
-		out.UpdateTime = msg.UpdateTime
 	}
 	return json.Marshal(out)
 }
-
-func compactMentions(mentions []interface{}) []MentionOutput {
-	if len(mentions) == 0 {
-		return nil
-	}
-	out := make([]MentionOutput, 0, len(mentions))
-	for _, raw := range mentions {
-		item, _ := raw.(map[string]interface{})
-		mention := MentionOutput{
-			Key:  stringField(item, "key"),
-			ID:   mentionOpenID(item["id"]),
-			Name: stringField(item, "name"),
-		}
-		if mention.Key != "" || mention.ID != "" || mention.Name != "" {
-			out = append(out, mention)
-		}
-	}
-	if len(out) == 0 {
-		return nil
-	}
-	return out
-}
-
-func stringField(m map[string]interface{}, key string) string {
-	v, _ := m[key].(string)
-	return v
-}
-
-func mentionOpenID(raw interface{}) string {
-	switch v := raw.(type) {
-	case map[string]interface{}:
-		openID, _ := v["open_id"].(string)
-		return openID
-	case string:
-		return v
-	default:
-		return ""
-	}
-}
--- a/events/im/message_receive_test.go
+++ b/events/im/message_receive_test.go
@@ -84,32 +84,19 @@ func TestProcessImMessageReceive_Text(t *testing.T) {
 		},
 		"event": {
 			"sender": {
-				"sender_type": "user",
 				"sender_id": {"open_id": "ou_sender"}
 			},
 			"message": {
 				"message_id":   "om_text_001",
-				"root_id":      "om_root_001",
-				"parent_id":    "om_parent_001",
-				"thread_id":    "omt_thread_001",
 				"chat_id":      "oc_chat",
 				"chat_type":    "p2p",
 				"message_type": "text",
 				"create_time":  "1776409468987",
-				"update_time":  "1776409469999",
-				"content":      "{\"text\":\"hello @_user_1\"}",
-				"mentions": [
-					{
-						"key": "@_user_1",
-						"id": {"open_id": "ou_mentioned"},
-						"name": "Alice"
-					}
-				]
+				"content":      "{\"text\":\"hello there\"}"
 			}
 		}
 	}`
 	out := runReceive(t, payload)
-	outMap := runReceiveMap(t, payload)

 	if out.Type != "im.message.receive_v1" {
 		t.Errorf("Type = %q", out.Type)
@@ -123,69 +110,12 @@ func TestProcessImMessageReceive_Text(t *testing.T) {
 	if out.SenderID != "ou_sender" {
 		t.Errorf("SenderID = %q", out.SenderID)
 	}
-	if out.Content != "hello @Alice" {
-		t.Errorf("Content = %q, want \"hello @Alice\"", out.Content)
+	if out.Content != "hello there" {
+		t.Errorf("Content = %q, want \"hello there\"", out.Content)
 	}
 	if out.Timestamp != "1776409469273" {
 		t.Errorf("Timestamp = %q", out.Timestamp)
 	}
-	for field, want := range map[string]string{
-		"sender_type": "user",
-		"root_id":     "om_root_001",
-		"thread_id":   "omt_thread_001",
-		"reply_to":    "om_parent_001",
-		"update_time": "1776409469999",
-	} {
-		if got, _ := outMap[field].(string); got != want {
-			t.Errorf("%s = %q, want %q", field, got, want)
-		}
-	}
-	mentions, _ := outMap["mentions"].([]interface{})
-	if len(mentions) != 1 {
-		t.Fatalf("mentions length = %d, want 1: %#v", len(mentions), outMap["mentions"])
-	}
-	mention, _ := mentions[0].(map[string]interface{})
-	for field, want := range map[string]string{
-		"key":  "@_user_1",
-		"id":   "ou_mentioned",
-		"name": "Alice",
-	} {
-		if got, _ := mention[field].(string); got != want {
-			t.Errorf("mentions[0].%s = %q, want %q", field, got, want)
-		}
-	}
-}
-
-func TestProcessImMessageReceive_OmitsUnchangedUpdateTime(t *testing.T) {
-	payload := `{
-		"schema": "2.0",
-		"header": {
-			"event_id": "ev_test_text",
-			"event_type": "im.message.receive_v1",
-			"create_time": "1776409469273",
-			"app_id": "cli_test"
-		},
-		"event": {
-			"sender": {
-				"sender_type": "user",
-				"sender_id": {"open_id": "ou_sender"}
-			},
-			"message": {
-				"message_id":   "om_text_001",
-				"chat_id":      "oc_chat",
-				"chat_type":    "p2p",
-				"message_type": "text",
-				"create_time":  "1776409468987",
-				"update_time":  "1776409468987",
-				"content":      "{\"text\":\"hello there\"}"
-			}
-		}
-	}`
-	outMap := runReceiveMap(t, payload)
-
-	if _, ok := outMap["update_time"]; ok {
-		t.Errorf("update_time should be omitted when it equals create_time: %#v", outMap)
-	}
 }

 func TestProcessImMessageReceive_Interactive(t *testing.T) {
@@ -258,22 +188,3 @@ func runReceive(t *testing.T, payload string) ImMessageReceiveOutput {
 	}
 	return out
 }
-
-func runReceiveMap(t *testing.T, payload string) map[string]interface{} {
-	t.Helper()
-	raw := &event.RawEvent{
-		EventID:   "ev_test",
-		EventType: "im.message.receive_v1",
-		Payload:   json.RawMessage(payload),
-		Timestamp: time.Now(),
-	}
-	got, err := processImMessageReceive(context.Background(), nil, raw, nil)
-	if err != nil {
-		t.Fatalf("Process error: %v", err)
-	}
-	var out map[string]interface{}
-	if err := json.Unmarshal(got, &out); err != nil {
-		t.Fatalf("Process output is not valid JSON: %v\nraw=%s", err, string(got))
-	}
-	return out
-}
--- a/events/register.go
+++ b/events/register.go
@@ -5,8 +5,6 @@
 package events

 import (
-	"github.com/larksuite/cli/events/application"
-	"github.com/larksuite/cli/events/approval"
 	"github.com/larksuite/cli/events/im"
 	"github.com/larksuite/cli/events/minutes"
 	"github.com/larksuite/cli/events/task"
@@ -18,8 +16,6 @@ import (
 // Mail is intentionally omitted in this phase.
 func init() {
 	all := [][]event.KeyDefinition{
-		application.Keys(),
-		approval.Keys(),
 		im.Keys(),
 		minutes.Keys(),
 		task.Keys(),
--- a/internal/auth/testmain_test.go
+++ b/internal/auth/testmain_test.go
@@ -1,23 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package auth
-
-import (
-	"os"
-	"path/filepath"
-	"testing"
-)
-
-func TestMain(m *testing.M) {
-	root, err := os.MkdirTemp("", "lark-cli-internal-auth-test-*")
-	if err != nil {
-		panic(err)
-	}
-	if err := os.Setenv("LARKSUITE_CLI_LOG_DIR", filepath.Join(root, "logs")); err != nil {
-		panic(err)
-	}
-	code := m.Run()
-	_ = os.RemoveAll(root)
-	os.Exit(code)
-}
--- a/Show More
+++ b/Show More