fix(qualitygate): pin the examples surface with an allowlist

examples-surface-only promised that demos may consume only the assembled CLI
and the public plugin SDK, but it enforced two denied prefixes instead, so
every tree nobody thought to deny was permitted. A demo importing `events`,
`errs` or a `cmd` subpackage passed the gate, and because
extension-zero-internal exempts these packages from the transitive check,
nothing examined what those imports dragged in either. The exemption was
therefore unbounded in what it covered, the same defect as the directory-name
skip it replaced.

- Add Rule.AllowedRepoDeps, which inverts the check: any dependency inside
  this module that is not listed is a violation. Standard library and
  third-party packages, including same-organisation modules that are not this
  one, stay outside the rule.
- Pin examples-surface-only to exactly `cmd` and `extension/platform`, so the
  rule name matches what it enforces and the inherited chain stays bounded by
  a direct surface of two packages.
- Cover the reproducers as contract cases: other repository trees, `cmd`
  subpackages, other `extension` subtrees, and the module root are rejected,
  while the two allowed packages plus non-module imports are not.

layering-edges.txt stays at 39 rows; the demos already import only the two
allowed packages.

.github/CODEOWNERS

@@ -1,7 +1,4 @@
-/go.mod @liangshuo-1
-/go.sum @liangshuo-1
 /internal/ @liangshuo-1
-/shortcuts/common/ @liangshuo-1
 
 # Last match wins: existing domains below are exempt, only new skills/ entries need review.
 /skills/ @liangshuo-1

.github/workflows/arch-audit.yml

@@ -62,19 +62,6 @@ jobs:
           go list -m -u all 2>/dev/null | grep '\[' >> report.md || echo "All dependencies up to date" >> report.md
           echo '```' >> report.md
 
-      - name: Circular dependency check
-        run: |
-          echo "## Circular Dependencies" >> report.md
-          go list -f '{{.ImportPath}} {{join .Imports " "}}' ./... | \
-            go run golang.org/x/tools/cmd/digraph@v0.31.0 scc 2>&1 | tee cycles.txt
-          if [ -s cycles.txt ]; then
-            echo '```' >> report.md
-            cat cycles.txt >> report.md
-            echo '```' >> report.md
-          else
-            echo "No circular dependencies detected." >> report.md
-          fi
-
       - name: E2E coverage gaps
         run: |
           echo "## E2E Coverage Gaps" >> report.md

.github/workflows/ci.yml

@@ -119,6 +119,8 @@ jobs:
         env:
           QUALITY_GATE_CHANGED_FROM: ${{ github.event.pull_request.base.sha || github.event.before || 'origin/main' }}
         run: echo "QUALITY_GATE_CHANGED_FROM=$(bash scripts/resolve-changed-from.sh)" >> "$GITHUB_ENV"
+      - name: Enforce layering ratchet
+        run: bash scripts/check-layering-ratchet.sh "$QUALITY_GATE_CHANGED_FROM"
       - name: Run golangci-lint
         run: go run github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.1.6 run --new-from-rev="$QUALITY_GATE_CHANGED_FROM"
       - name: Run source-contract lint guards (lintcheck)

.github/workflows/semantic-review.yml

@@ -25,16 +25,19 @@ jobs:
         with:
           script: |
             const run = context.payload.workflow_run;
-            const workflowId = Number(run.workflow_id || 0);
-            if (!Number.isInteger(workflowId) || workflowId <= 0) throw new Error("missing workflow id");
-            const { data: workflow } = await github.rest.actions.getWorkflow({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              workflow_id: workflowId,
-            });
-            if (workflow.name !== "CI") throw new Error(`unexpected workflow name: ${workflow.name}`);
-            if (workflow.path !== ".github/workflows/ci.yml") throw new Error(`unexpected workflow path: ${workflow.path}`);
-            if (run.path && run.path !== workflow.path) throw new Error(`workflow path mismatch: ${run.path}`);
+            if (run.name !== "CI") throw new Error(`unexpected workflow name: ${run.name}`);
+            let workflowPath = run.path || "";
+            if (!workflowPath) {
+              const workflowId = Number(run.workflow_id || 0);
+              if (!Number.isInteger(workflowId) || workflowId <= 0) throw new Error("missing workflow id");
+              const { data: workflow } = await github.rest.actions.getWorkflow({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                workflow_id: workflowId,
+              });
+              workflowPath = workflow.path || "";
+            }
+            if (workflowPath !== ".github/workflows/ci.yml") throw new Error(`unexpected workflow path: ${workflowPath}`);
             if (run.event !== "pull_request") throw new Error(`unexpected event: ${run.event}`);
             if (run.repository.id !== context.payload.repository.id) throw new Error("repository id mismatch");
             if (run.repository.full_name !== context.payload.repository.full_name) throw new Error("repository name mismatch");
@@ -250,16 +253,19 @@ jobs:
         with:
           script: |
             const run = context.payload.workflow_run;
-            const workflowId = Number(run.workflow_id || 0);
-            if (!Number.isInteger(workflowId) || workflowId <= 0) throw new Error("missing workflow id");
-            const { data: workflow } = await github.rest.actions.getWorkflow({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              workflow_id: workflowId,
-            });
-            if (workflow.name !== "CI") throw new Error(`unexpected workflow name: ${workflow.name}`);
-            if (workflow.path !== ".github/workflows/ci.yml") throw new Error(`unexpected workflow path: ${workflow.path}`);
-            if (run.path && run.path !== workflow.path) throw new Error(`workflow path mismatch: ${run.path}`);
+            if (run.name !== "CI") throw new Error(`unexpected workflow name: ${run.name}`);
+            let workflowPath = run.path || "";
+            if (!workflowPath) {
+              const workflowId = Number(run.workflow_id || 0);
+              if (!Number.isInteger(workflowId) || workflowId <= 0) throw new Error("missing workflow id");
+              const { data: workflow } = await github.rest.actions.getWorkflow({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                workflow_id: workflowId,
+              });
+              workflowPath = workflow.path || "";
+            }
+            if (workflowPath !== ".github/workflows/ci.yml") throw new Error(`unexpected workflow path: ${workflowPath}`);
             if (run.event !== "pull_request") throw new Error(`unexpected event: ${run.event}`);
             if (run.conclusion !== "success") throw new Error(`unexpected conclusion: ${run.conclusion}`);
             if (run.repository.id !== context.payload.repository.id) throw new Error("repository id mismatch");

CHANGELOG.md

@@ -2,90 +2,6 @@
 
 All notable changes to this project will be documented in this file.
 
-## [v1.0.80] - 2026-07-29
-
-### Features
-
-- **drive**: add +member-list shortcut (#1795)
-- **drive**: add +permission-get-setting shortcut (#1738)
-- propagate invocation metadata (#2097)
-
-### Documentation
-
-- **slides**: 补齐 shortcut 参数说明，修正 +xml-get --output 必填标注 (#2088)
-- **slides**: +create 的参数下沉到 create.md，主 skill 只留路由 (#2096)
-
-### Tests
-
-- **e2e**: wait for base role update visibility (#2087)
-
-### Misc
-
-- Feat/detect line text overlap (#2069)
-
-## [v1.0.79] - 2026-07-28
-
-### Features
-
-- **slides**: update xsd (#2067)
-
-### Bug Fixes
-
-- **ci**: validate static workflow identity (#2015)
-- **sheets**: recognize OFL0X local office tokens (#2063)
-
-### Documentation
-
-- **calendar**: clarify identity selection by event ownership (#2071)
-- **slides**: add formula inline element syntax to quick-ref (#2077)
-
-## [v1.0.78] - 2026-07-27
-
-### Features
-
-- event description support rich text (#1975)
-
-### Bug Fixes
-
-- **slides**: restrict canvas overflow checks
-- **slides**: upgrade text overflow to error above 10px threshold
-- **slides**: detect letterSpacing-driven text overflow
-- **slides**: downgrade background-decoration text overflow to info
-- **slides**: allow chartParsedValues roundtrip tag
-- refine character width estimation for lark-slides text lint
-- **slides**: preserve info lint severity
-- **slides**: text may over flow shape
-- exempt ghost text from slides lint
-
-## [v1.0.77] - 2026-07-24
-
-### Features
-
-- introducing official card icon (#1973)
-- **apps**: validate +file-list --page-size against server (0, 200] range (#2007)
-- **apps**: support absolute and relative upload paths (#2005)
-- **slides**: fill xml-schema-quick-ref gaps that forced XSD fallback (#2026)
-- **slides**: add layout density lint for sparse/empty containers (#2022)
-- add risk-control protection (#1910)
-
-### Bug Fixes
-
-- **slides**: normalize presentation flag aliases (#2032)
-- **base**: classify +form-submit as high-risk-write (#1969)
-- **slides**: declare screenshot scope
-- **slides**: support CSV multi-value for --slide-id in screenshot (#2047)
-
-### Documentation
-
-- **skill**: clarify scope handling for query expansion (#2030)
-- **base**: clarify complete and partial updates (#1993)
-- **skills**: clarify callout child rules (#2048)
-
-### Misc
-
-- fix/task id handling (#2023)
-- fix/task search pagination (#2041)
-
 ## [v1.0.75] - 2026-07-22
 
 ### Features
@@ -1722,10 +1638,6 @@ Bundled AI agent skills for intelligent assistance:
 - Bilingual documentation (English & Chinese).
 - CI/CD pipelines: linting, testing, coverage reporting, and automated releases.
 
-[v1.0.80]: https://github.com/larksuite/cli/releases/tag/v1.0.80
-[v1.0.79]: https://github.com/larksuite/cli/releases/tag/v1.0.79
-[v1.0.78]: https://github.com/larksuite/cli/releases/tag/v1.0.78
-[v1.0.77]: https://github.com/larksuite/cli/releases/tag/v1.0.77
 [v1.0.75]: https://github.com/larksuite/cli/releases/tag/v1.0.75
 [v1.0.74]: https://github.com/larksuite/cli/releases/tag/v1.0.74
 [v1.0.73]: https://github.com/larksuite/cli/releases/tag/v1.0.73

Makefile

@@ -49,6 +49,7 @@ fmt-check:
 
 script-test:
 	bash scripts/resolve-changed-from.test.sh
+	bash scripts/check-layering-ratchet.test.sh
 	bash scripts/ci-workflow.test.sh
 	bash scripts/semantic-review-workflow.test.sh
 	$(NODE) --test scripts/e2e_domains.test.js scripts/fetch_e2e_tat.test.js scripts/install.test.js scripts/release-preflight.test.js scripts/semantic-review-verify-artifact.test.js scripts/pr-quality-summary.test.js scripts/semantic-review-publish.test.js scripts/ci-quality-summary-publish.test.js

README.md

@@ -285,29 +285,6 @@ To reduce these risks, the tool enables default security protections at multiple
 
 We recommend using the Lark/Feishu bot integrated with this tool as a private conversational assistant. Do not add it to group chats or allow other users to interact with it, to avoid abuse of permissions or data leakage.
 
-To reduce the security risks associated with access token theft, the CLI sends a minimal set of risk-control signals with OpenAPI requests made to exact official Feishu/Lark HTTPS domains. These signals are used to help identify anomalous API activity. This protection is enabled by default. The information sent is limited to:
-
-- Operating system type: macOS, Windows, or Linux
-- Device hardware model: for example, Mac17,9
-
-To disable this protection for the current workspace, run:
-
-```bash
-lark-cli config risk-control off
-```
-
-To enable this protection for the current workspace, run:
-
-```bash
-lark-cli config risk-control on
-```
-
-To restore the default policy for the current workspace, run:
-
-```bash
-lark-cli config risk-control default
-```
-
 Please fully understand all usage risks. By using this tool, you are deemed to voluntarily assume all related responsibilities.
 
 ## Star History

README.zh.md

@@ -286,29 +286,6 @@ lark-cli schema im.messages.delete
 
 我们建议您将对接本工具的飞书机器人作为私人对话助手使用，请勿将其拉入群聊或允许其他用户与其交互，以避免权限被滥用或数据泄露。
 
-为降低访问令牌被盗用后的安全风险，CLI 在向飞书/Lark 官方 HTTPS 精确域名发起 OpenAPI 请求时，会随请求发送一组最小化的风控信号，用于辅助识别异常调用行为。该保护默认开启，发送的信息仅包括：
-
-- 操作系统类型：macOS、Windows 或 Linux
-- 设备的硬件产品型号：例如 Mac17,9
-
-如需让当前 workspace 退出该保护，可执行以下命令：
-
-```bash
-lark-cli config risk-control off
-```
-
-如需开启当前 workspace 的保护，可执行以下命令：
-
-```bash
-lark-cli config risk-control on
-```
-
-恢复当前 workspace 默认策略可执行：
-
-```bash
-lark-cli config risk-control default
-```
-
 请您充分知悉全部使用风险，使用本工具即视为您自愿承担相关所有责任。
 
 ## Star History

cmd/config/config.go

@@ -31,7 +31,6 @@ func NewCmdConfig(f *cmdutil.Factory) *cobra.Command {
 	cmd.AddCommand(NewCmdConfigShow(f, nil))
 	cmd.AddCommand(NewCmdConfigDefaultAs(f))
 	cmd.AddCommand(NewCmdConfigStrictMode(f))
-	cmd.AddCommand(NewCmdConfigRiskControl(f))
 	cmd.AddCommand(NewCmdConfigPolicy(f))
 	cmd.AddCommand(NewCmdConfigPlugins(f))
 	cmd.AddCommand(NewCmdConfigKeychainDowngrade(f))

cmd/config/risk_control.go

@@ -1,80 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package config
-
-import (
-	"fmt"
-
-	"github.com/spf13/cobra"
-
-	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
-)
-
-// NewCmdConfigRiskControl creates the workspace risk-control policy command.
-func NewCmdConfigRiskControl(f *cmdutil.Factory) *cobra.Command {
-	cmd := &cobra.Command{
-		Use:   "risk-control [on|off|default]",
-		Short: "Manage workspace account-protection policy",
-		Long: `View or set the account-protection risk-control policy for this workspace.
-
-Account protection is on by default. Use off to opt this workspace out, on to
-opt it back in explicitly, or default to remove the explicit preference.`,
-		Args: cobra.MaximumNArgs(1),
-		// This is persistent workspace policy, not credential management.
-		PersistentPreRunE: func(cmd *cobra.Command, _ []string) error {
-			cmd.SilenceUsage = true
-			return nil
-		},
-		RunE: func(cmd *cobra.Command, args []string) error {
-			config, err := core.LoadOrNotConfigured()
-			if err != nil {
-				return err
-			}
-			if len(args) == 0 {
-				printRiskControl(f, config)
-				return nil
-			}
-
-			switch args[0] {
-			case "on":
-				enabled := true
-				config.RiskControl = &enabled
-			case "off":
-				enabled := false
-				config.RiskControl = &enabled
-			case "default":
-				config.RiskControl = nil
-			default:
-				return errs.NewValidationError(errs.SubtypeInvalidArgument,
-					"invalid risk-control value %q, valid values: on | off | default", args[0])
-			}
-
-			if err := core.SaveMultiAppConfig(config); err != nil {
-				return errs.NewInternalError(errs.SubtypeStorage,
-					"failed to save risk-control policy: %v", err).WithCause(err)
-			}
-			fmt.Fprintf(f.IOStreams.ErrOut, "Risk control set to %s (workspace)\n", args[0])
-			return nil
-		},
-	}
-	cmdutil.SetRisk(cmd, cmdutil.RiskWrite)
-	return cmd
-}
-
-func printRiskControl(f *cmdutil.Factory, config *core.MultiAppConfig) {
-	source := "default"
-	if config.RiskControl != nil {
-		source = "workspace"
-	}
-	fmt.Fprintf(f.IOStreams.Out, "risk-control: %s (source: %s)\n", riskControlState(config.RiskControlEnabled()), source)
-}
-
-func riskControlState(enabled bool) string {
-	if enabled {
-		return "on"
-	}
-	return "off"
-}

cmd/config/risk_control_test.go

@@ -1,130 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package config
-
-import (
-	"errors"
-	"strings"
-	"testing"
-
-	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
-)
-
-func TestRiskControlWorkspacePolicy(t *testing.T) {
-	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
-	config := &core.MultiAppConfig{Apps: []core.AppConfig{{
-		AppId: "cli_test", AppSecret: core.PlainSecret("secret"), Brand: core.BrandFeishu,
-	}}}
-	if err := core.SaveMultiAppConfig(config); err != nil {
-		t.Fatal(err)
-	}
-
-	f, stdout, stderr, _ := cmdutil.TestFactory(t, nil)
-	cmd := NewCmdConfigRiskControl(f)
-	cmd.SetArgs([]string{"off"})
-	if err := cmd.Execute(); err != nil {
-		t.Fatalf("set off: %v", err)
-	}
-	loaded, err := core.LoadMultiAppConfig()
-	if err != nil {
-		t.Fatal(err)
-	}
-	if loaded.RiskControl == nil || *loaded.RiskControl {
-		t.Fatalf("RiskControl = %v, want explicit false", loaded.RiskControl)
-	}
-	if !strings.Contains(stderr.String(), "set to off") {
-		t.Fatalf("stderr = %q", stderr.String())
-	}
-
-	stdout.Reset()
-	cmd = NewCmdConfigRiskControl(f)
-	if err := cmd.Execute(); err != nil {
-		t.Fatalf("show: %v", err)
-	}
-	if got := stdout.String(); got != "risk-control: off (source: workspace)\n" {
-		t.Fatalf("stdout = %q", got)
-	}
-
-	cmd = NewCmdConfigRiskControl(f)
-	cmd.SetArgs([]string{"on"})
-	if err := cmd.Execute(); err != nil {
-		t.Fatalf("set on: %v", err)
-	}
-	loaded, err = core.LoadMultiAppConfig()
-	if err != nil {
-		t.Fatal(err)
-	}
-	if loaded.RiskControl == nil || !*loaded.RiskControl {
-		t.Fatalf("RiskControl = %v, want explicit true", loaded.RiskControl)
-	}
-
-	cmd = NewCmdConfigRiskControl(f)
-	cmd.SetArgs([]string{"default"})
-	if err := cmd.Execute(); err != nil {
-		t.Fatalf("reset default: %v", err)
-	}
-	loaded, err = core.LoadMultiAppConfig()
-	if err != nil {
-		t.Fatal(err)
-	}
-	if loaded.RiskControl != nil {
-		t.Fatalf("RiskControl = %v, want nil", loaded.RiskControl)
-	}
-
-	stdout.Reset()
-	cmd = NewCmdConfigRiskControl(f)
-	if err := cmd.Execute(); err != nil {
-		t.Fatalf("show default: %v", err)
-	}
-	if got := stdout.String(); got != "risk-control: on (source: default)\n" {
-		t.Fatalf("stdout = %q", got)
-	}
-}
-
-func TestRiskControlWorkspacePolicyRejectsInvalidValue(t *testing.T) {
-	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
-	if err := core.SaveMultiAppConfig(&core.MultiAppConfig{Apps: []core.AppConfig{{
-		AppId: "cli_test", AppSecret: core.PlainSecret("secret"), Brand: core.BrandFeishu,
-	}}}); err != nil {
-		t.Fatal(err)
-	}
-
-	f, _, _, _ := cmdutil.TestFactory(t, nil)
-	cmd := NewCmdConfigRiskControl(f)
-	cmd.SetArgs([]string{"invalid"})
-	err := cmd.Execute()
-	var validationErr *errs.ValidationError
-	if !errors.As(err, &validationErr) {
-		t.Fatalf("error = %T %v, want *errs.ValidationError", err, err)
-	}
-	if validationErr.Subtype != errs.SubtypeInvalidArgument {
-		t.Fatalf("subtype = %q, want %q", validationErr.Subtype, errs.SubtypeInvalidArgument)
-	}
-}
-
-func TestRiskControlWorkspacePolicyAllowedWithExternalCredentials(t *testing.T) {
-	f := newConfigFactoryWithExternalProvider(t)
-	config := &core.MultiAppConfig{Apps: []core.AppConfig{{
-		AppId: "cli_test", AppSecret: core.PlainSecret("secret"), Brand: core.BrandFeishu,
-	}}}
-	if err := core.SaveMultiAppConfig(config); err != nil {
-		t.Fatal(err)
-	}
-
-	cmd := NewCmdConfig(f)
-	cmd.SetArgs([]string{"risk-control", "off"})
-	if err := cmd.Execute(); err != nil {
-		t.Fatalf("set off with external credentials: %v", err)
-	}
-
-	loaded, err := core.LoadMultiAppConfig()
-	if err != nil {
-		t.Fatal(err)
-	}
-	if loaded.RiskControl == nil || *loaded.RiskControl {
-		t.Fatalf("RiskControl = %v, want explicit false", loaded.RiskControl)
-	}
-}

cmd/service/affordance.go

@@ -66,7 +66,6 @@ func PrepareDomainHelp(cmd *cobra.Command, skillFS fs.FS) bool {
 			fmt.Fprintf(&b, "\n\nDomain guide (concepts, command choice, conventions): lark-cli skills read %s", skill)
 		}
 	}
-	appendSlidesXMLQuickReference(&b, cmd, skillFS)
 	cmd.Long = b.String()
 	return true
 }
@@ -117,90 +116,6 @@ const (
 	shortcutBaseAnnotation = "affordance-shortcut-base"
 )
 
-const slidesXMLQuickReferencePath = "lark-slides/references/xml-schema-quick-ref.md"
-
-// slidesShortcutReferencePaths maps each Slides shortcut to its primary
-// command guide. XML-consuming shortcuts also include the shared schema
-// reference because their command guide accepts XML but does not repeat the
-// complete element grammar.
-var slidesShortcutReferencePaths = map[string][]string{
-	"+create": {
-		"lark-slides/references/lark-slides-create.md",
-		slidesXMLQuickReferencePath,
-	},
-	"+xml-get": {
-		"lark-slides/references/lark-slides-xml-presentations-get.md",
-	},
-	"+screenshot": {
-		"lark-slides/references/lark-slides-screenshot.md",
-	},
-	"+media-upload": {
-		"lark-slides/references/lark-slides-media-upload.md",
-	},
-	"+replace-slide": {
-		"lark-slides/references/lark-slides-replace-slide.md",
-		"lark-slides/references/lark-slides-edit-workflows.md",
-		slidesXMLQuickReferencePath,
-	},
-	"+replace-pages": {
-		"lark-slides/references/lark-slides-replace-pages.md",
-		"lark-slides/references/lark-slides-edit-workflows.md",
-		slidesXMLQuickReferencePath,
-	},
-	"+history-list": {
-		"lark-slides/references/lark-slides-history.md",
-	},
-	"+history-revert": {
-		"lark-slides/references/lark-slides-history.md",
-	},
-	"+history-revert-status": {
-		"lark-slides/references/lark-slides-history.md",
-	},
-}
-
-// appendSlidesXMLQuickReference adds the embedded XML schema summary to the
-// slides domain help. The reference file is already shipped in the skill
-// content tree, so help and the standalone skill reader share one source of
-// truth instead of maintaining a second, drifting copy in Go.
-func appendSlidesXMLQuickReference(b *strings.Builder, cmd *cobra.Command, skillFS fs.FS) {
-	if cmd.Name() != "slides" || skillFS == nil {
-		return
-	}
-	content, err := fs.ReadFile(skillFS, slidesXMLQuickReferencePath)
-	if err != nil || len(content) == 0 {
-		return
-	}
-	b.WriteString("\n\nEmbedded XML syntax quick reference:\n")
-	b.Write(content)
-}
-
-func readSlidesShortcutReferences(cmd *cobra.Command, skillFS fs.FS) ([]string, bool) {
-	if cmdmeta.Domain(cmd) != "slides" || skillFS == nil {
-		return nil, false
-	}
-	paths, ok := slidesShortcutReferencePaths[cmd.Name()]
-	if !ok {
-		return nil, false
-	}
-
-	var contents []string
-	for _, path := range paths {
-		content, err := fs.ReadFile(skillFS, path)
-		if err != nil || len(content) == 0 {
-			continue
-		}
-		contents = append(contents, fmt.Sprintf("Embedded command reference: %s\n%s", path, content))
-	}
-	return contents, len(contents) > 0
-}
-
-func appendSlidesShortcutReferences(b *strings.Builder, contents []string) {
-	for _, content := range contents {
-		b.WriteString("\n\n")
-		b.WriteString(content)
-	}
-}
-
 // setMethodHelpData records the coordinates PrepareMethodHelp needs (storing a
 // few strings is the only build-time cost; the overlay stays untouched).
 func setMethodHelpData(cmd *cobra.Command, service, methodID, schemaPath, paramsOnly string) {
@@ -256,11 +171,11 @@ func PrepareMethodHelp(cmd *cobra.Command, skillFS fs.FS) bool {
 }
 
 // PrepareShortcutHelp composes a +-prefixed shortcut's Long from its affordance
-// overlay and any embedded command references — the same top layout as method
-// help (description, Risk, guidance block, related skills) minus the schema
-// pointer, which shortcuts have none of. Returns false when the command is not
-// a shortcut, or when it has neither an overlay nor an embedded reference, so
-// ordinary shortcuts keep the default help plus the bottom risk/tips append.
+// overlay — the same top layout as method help (description, Risk, guidance
+// block, related skills) minus the schema pointer, which shortcuts have none
+// of. Returns false when the command is not a shortcut or carries no overlay
+// entry, so shortcuts without guidance keep the default help plus the bottom
+// risk/tips append.
 //
 // The lead is the command's pristine base (captureHelpBase): a shortcut that
 // set a hand-authored Long in PostMount (e.g. the docs shortcuts' "agents MUST
@@ -276,17 +191,12 @@ func PrepareShortcutHelp(cmd *cobra.Command, skillFS fs.FS) bool {
 	if src, _ := cmdmeta.SourceOf(cmd); src != cmdmeta.SourceShortcut {
 		return false
 	}
-	references, hasReferences := readSlidesShortcutReferences(cmd, skillFS)
-
-	var a meta.Affordance
-	hasAffordance := false
-	if raw, ok := affordanceRaw(cmd); ok {
-		if parsed, parsedOK := (meta.Method{Affordance: raw}).ParsedAffordance(); parsedOK {
-			a = parsed
-			hasAffordance = true
-		}
+	raw, ok := affordanceRaw(cmd)
+	if !ok {
+		return false
 	}
-	if !hasAffordance && !hasReferences {
+	a, ok := (meta.Method{Affordance: raw}).ParsedAffordance()
+	if !ok {
 		return false
 	}
 	if len(a.Tips) == 0 {
@@ -301,7 +211,6 @@ func PrepareShortcutHelp(cmd *cobra.Command, skillFS fs.FS) bool {
 		b.WriteString(block)
 	}
 	writeRelatedSkills(&b, a.Skills, skillFS)
-	appendSlidesShortcutReferences(&b, references)
 
 	cmd.Long = b.String()
 	return true

cmd/service/affordance_test.go

@@ -264,94 +264,6 @@ func TestPrepareShortcutHelp_PreservesPostMountLong(t *testing.T) {
 	}
 }
 
-func TestPrepareShortcutHelp_SlidesReferenceWithoutAffordance(t *testing.T) {
-	sc := &cobra.Command{Use: "+xml-get", Short: "Fetch presentation XML"}
-	cmdmeta.SetSource(sc, cmdmeta.SourceShortcut, false)
-	cmdmeta.SetDomain(sc, "slides")
-	cmdmeta.SetAffordanceRef(sc, "slides", "+xml-get")
-	cmdutil.SetRisk(sc, "read")
-
-	skillFS := fstest.MapFS{
-		"lark-slides/references/lark-slides-xml-presentations-get.md": {
-			Data: []byte("# slides +xml-get\n\nRead the presentation XML."),
-		},
-	}
-	if !PrepareShortcutHelp(sc, skillFS) {
-		t.Fatal("PrepareShortcutHelp returned false for a Slides shortcut with an embedded reference")
-	}
-	for _, want := range []string{
-		"Fetch presentation XML",
-		"Risk: read",
-		"Embedded command reference: lark-slides/references/lark-slides-xml-presentations-get.md",
-		"Read the presentation XML.",
-	} {
-		if !strings.Contains(sc.Long, want) {
-			t.Errorf("Slides shortcut help missing %q:\n%s", want, sc.Long)
-		}
-	}
-	PrepareShortcutHelp(sc, skillFS)
-	if got := strings.Count(sc.Long, "Embedded command reference:"); got != 1 {
-		t.Fatalf("embedded reference appended %d times after re-render, want 1:\n%s", got, sc.Long)
-	}
-}
-
-func TestSlidesShortcutReferenceMapping(t *testing.T) {
-	want := map[string]string{
-		"+create":                "lark-slides/references/lark-slides-create.md",
-		"+xml-get":               "lark-slides/references/lark-slides-xml-presentations-get.md",
-		"+screenshot":            "lark-slides/references/lark-slides-screenshot.md",
-		"+media-upload":          "lark-slides/references/lark-slides-media-upload.md",
-		"+replace-slide":         "lark-slides/references/lark-slides-replace-slide.md",
-		"+replace-pages":         "lark-slides/references/lark-slides-replace-pages.md",
-		"+history-list":          "lark-slides/references/lark-slides-history.md",
-		"+history-revert":        "lark-slides/references/lark-slides-history.md",
-		"+history-revert-status": "lark-slides/references/lark-slides-history.md",
-	}
-
-	for command, path := range want {
-		t.Run(command, func(t *testing.T) {
-			sc := &cobra.Command{Use: command, Short: command}
-			cmdmeta.SetSource(sc, cmdmeta.SourceShortcut, false)
-			cmdmeta.SetDomain(sc, "slides")
-			skillFS := fstest.MapFS{
-				path: {Data: []byte("reference content")},
-			}
-			contents, ok := readSlidesShortcutReferences(sc, skillFS)
-			if !ok || len(contents) == 0 {
-				t.Fatalf("shortcut %q has no mapped reference", command)
-			}
-			if !strings.Contains(contents[0], "Embedded command reference: "+path) {
-				t.Fatalf("shortcut %q mapped content does not include %q:\n%s", command, path, contents[0])
-			}
-		})
-	}
-}
-
-func TestSlidesScreenshotHelpDoesNotIncludeXMLQuickReference(t *testing.T) {
-	sc := &cobra.Command{Use: "+screenshot", Short: "Save screenshots"}
-	cmdmeta.SetSource(sc, cmdmeta.SourceShortcut, false)
-	cmdmeta.SetDomain(sc, "slides")
-	skillFS := fstest.MapFS{
-		"lark-slides/references/lark-slides-screenshot.md": {
-			Data: []byte("# slides +screenshot\n\nSave screenshots."),
-		},
-		slidesXMLQuickReferencePath: {
-			Data: []byte("# XML Schema Quick Reference"),
-		},
-	}
-
-	contents, ok := readSlidesShortcutReferences(sc, skillFS)
-	if !ok {
-		t.Fatal("screenshot shortcut should have a primary reference")
-	}
-	if len(contents) != 1 {
-		t.Fatalf("screenshot reference count = %d, want 1: %#v", len(contents), contents)
-	}
-	if strings.Contains(contents[0], "XML Schema Quick Reference") {
-		t.Fatalf("screenshot help must not include the XML quick reference:\n%s", contents[0])
-	}
-}
-
 // domainCmd wires a domain-tagged command with a subcommand under a root, the
 // shape PrepareDomainHelp expects.
 func domainCmd(short, long string) *cobra.Command {
@@ -394,51 +306,3 @@ func TestPrepareDomainHelp_FallsBackToShort(t *testing.T) {
 		t.Errorf("Short should seed Long when no hand-authored Long exists; got:\n%s", dom.Long)
 	}
 }
-
-func TestPrepareDomainHelp_SlidesIncludesEmbeddedXMLReference(t *testing.T) {
-	root := &cobra.Command{Use: "root"}
-	dom := &cobra.Command{Use: "slides", Short: "Slides"}
-	cmdmeta.SetDomain(dom, "slides")
-	dom.AddCommand(&cobra.Command{Use: "+create", Short: "Create", Run: func(*cobra.Command, []string) {}})
-	root.AddCommand(dom)
-
-	const quickReference = `# XML Schema Quick Reference
-
-<presentation xmlns="http://www.larkoffice.com/sml/2.0" width="960" height="540">
-  <slide>
-    <data>
-      <shape type="text" topLeftX="80" topLeftY="80" width="800" height="120">
-        <content textType="title"><p>Title</p></content>
-      </shape>
-    </data>
-  </slide>
-</presentation>
-
-<table><colgroup><col/></colgroup><tr><td><content><p>A</p></content></td></tr></table>
-<chart><chartPlotArea/><chartData/></chart>`
-	skillFS := fstest.MapFS{
-		"lark-slides/SKILL.md":                           {Data: []byte("# slides")},
-		"lark-slides/references/xml-schema-quick-ref.md": {Data: []byte(quickReference)},
-	}
-
-	if !PrepareDomainHelp(dom, skillFS) {
-		t.Fatal("PrepareDomainHelp returned false for slides domain")
-	}
-	for _, want := range []string{
-		"Embedded XML syntax quick reference:",
-		`<presentation xmlns="http://www.larkoffice.com/sml/2.0"`,
-		"<shape type=\"text\"",
-		"<content",
-		"topLeftX",
-		"<table>",
-		"<chart>",
-	} {
-		if !strings.Contains(dom.Long, want) {
-			t.Errorf("slides help missing XML reference marker %q:\n%s", want, dom.Long)
-		}
-	}
-	PrepareDomainHelp(dom, skillFS)
-	if got := strings.Count(dom.Long, "Embedded XML syntax quick reference:"); got != 1 {
-		t.Fatalf("slides XML reference appended %d times after re-render, want 1:\n%s", got, dom.Long)
-	}
-}

internal/cmdutil/factory_default.go

@@ -22,7 +22,6 @@ import (
 	"github.com/larksuite/cli/internal/credential"
 	"github.com/larksuite/cli/internal/keychain"
 	"github.com/larksuite/cli/internal/registry"
-	"github.com/larksuite/cli/internal/riskcontrol"
 	_ "github.com/larksuite/cli/internal/security/contentsafety" // register content safety provider
 	"github.com/larksuite/cli/internal/transport"
 	_ "github.com/larksuite/cli/internal/vfs/localfileio" // register default FileIO provider
@@ -34,7 +33,7 @@ import (
 //	Phase 1: HttpClient (no credential dependency)
 //	Phase 2: Credential (sole data source for account info)
 //	Phase 3: Config derived from Credential
-//	Phase 4: LarkClient derived from Credential and workspace policy
+//	Phase 4: LarkClient derived from Credential
 func NewDefault(streams *IOStreams, inv InvocationContext) *Factory {
 	streams = normalizeStreams(streams)
 	f := &Factory{
@@ -55,10 +54,9 @@ func NewDefault(streams *IOStreams, inv InvocationContext) *Factory {
 
 	// Phase 0: FileIO provider (no dependency)
 	f.FileIOProvider = fileio.GetProvider()
-	workspaceConfig := core.NewConfigSnapshot()
 
 	// Phase 1: HttpClient (no credential dependency)
-	f.HttpClient = cachedHttpClientFunc(f, workspaceConfig)
+	f.HttpClient = cachedHttpClientFunc(f)
 
 	// Phase 2: Credential (sole data source)
 	// Keychain is read via closure so callers can replace f.Keychain after construction.
@@ -69,7 +67,7 @@ func NewDefault(streams *IOStreams, inv InvocationContext) *Factory {
 		ErrOut:     f.IOStreams.ErrOut,
 	})
 
-	// Phase 3: Runtime config contains resolved account data only.
+	// Phase 3: Config derived from Credential via an explicit conversion boundary.
 	f.Config = sync.OnceValues(func() (*core.CliConfig, error) {
 		acct, err := f.Credential.ResolveAccount(context.Background())
 		if err != nil {
@@ -80,9 +78,8 @@ func NewDefault(streams *IOStreams, inv InvocationContext) *Factory {
 		return cfg, nil
 	})
 
-	// Phase 4: LarkClient composes account data and workspace policy at the SDK
-	// transport boundary.
-	f.LarkClient = cachedLarkClientFunc(f, workspaceConfig)
+	// Phase 4: LarkClient from Credential (placeholder AppSecret)
+	f.LarkClient = cachedLarkClientFunc(f)
 
 	return f
 }
@@ -111,16 +108,13 @@ func safeRedirectPolicy(req *http.Request, via []*http.Request) error {
 // .StderrIsTerminal field, which tests set directly.
 var warnIfProxied = transport.WarnIfProxied
 
-func cachedHttpClientFunc(f *Factory, workspaceConfig workspaceConfigSource) func() (*http.Client, error) {
+func cachedHttpClientFunc(f *Factory) func() (*http.Client, error) {
 	return sync.OnceValues(func() (*http.Client, error) {
 		if f.IOStreams.StderrIsTerminal {
 			warnIfProxied(f.IOStreams.ErrOut)
 		}
 
-		hostSignalSource := resolveSDKHostSignalSource(workspaceConfig)
-
 		var rt http.RoundTripper = transport.Shared()
-		rt = riskcontrol.NewTransport(rt, hostSignalSource)
 		rt = &RetryTransport{Base: rt}
 		rt = &SecurityHeaderTransport{Base: rt}
 		rt = &auth.SecurityPolicyTransport{Base: rt} // Add our global response interceptor
@@ -134,7 +128,7 @@ func cachedHttpClientFunc(f *Factory, workspaceConfig workspaceConfigSource) fun
 	})
 }
 
-func cachedLarkClientFunc(f *Factory, workspaceConfig workspaceConfigSource) func() (*lark.Client, error) {
+func cachedLarkClientFunc(f *Factory) func() (*lark.Client, error) {
 	return sync.OnceValues(func() (*lark.Client, error) {
 		acct, err := f.Credential.ResolveAccount(context.Background())
 		if err != nil {
@@ -148,15 +142,8 @@ func cachedLarkClientFunc(f *Factory, workspaceConfig workspaceConfigSource) fun
 		if f.IOStreams.StderrIsTerminal {
 			warnIfProxied(f.IOStreams.ErrOut)
 		}
-		hostSignalSource := resolveSDKHostSignalSource(workspaceConfig)
-		var sdkBase http.RoundTripper = transport.Shared()
-		// The innermost SDK boundary always strips reserved host-signal headers;
-		// a nil source makes it strip-only when workspace policy disables signal
-		// collection.
-		sdkBase = riskcontrol.NewTransport(sdkBase, hostSignalSource)
-		sdkTransport := wrapSDKTransport(sdkBase)
 		opts = append(opts, lark.WithHttpClient(&http.Client{
-			Transport:     sdkTransport,
+			Transport:     buildSDKTransport(),
 			CheckRedirect: safeRedirectPolicy,
 		}))
 		ep := core.ResolveEndpoints(acct.Brand)
@@ -165,8 +152,9 @@ func cachedLarkClientFunc(f *Factory, workspaceConfig workspaceConfigSource) fun
 	})
 }
 
-func wrapSDKTransport(next http.RoundTripper) http.RoundTripper {
-	var sdkTransport http.RoundTripper = &RetryTransport{Base: next}
+func buildSDKTransport() http.RoundTripper {
+	var sdkTransport http.RoundTripper = transport.Shared()
+	sdkTransport = &RetryTransport{Base: sdkTransport}
 	sdkTransport = &UserAgentTransport{Base: sdkTransport}
 	sdkTransport = &BuildHeaderTransport{Base: sdkTransport}
 	sdkTransport = &auth.SecurityPolicyTransport{Base: sdkTransport}

internal/cmdutil/factory_http_test.go

@@ -6,15 +6,10 @@ package cmdutil
 import (
 	"io"
 	"testing"
-
-	"github.com/larksuite/cli/internal/core"
 )
 
 func TestCachedHttpClientFunc_ReturnsSameInstance(t *testing.T) {
-	isEnabled := false
-	f, _, _, _ := TestFactory(t, &core.CliConfig{AppID: "test-app"})
-	f.IOStreams.ErrOut = io.Discard
-	fn := cachedHttpClientFunc(f, staticWorkspaceConfig{config: &core.MultiAppConfig{RiskControl: &isEnabled}})
+	fn := cachedHttpClientFunc(&Factory{IOStreams: &IOStreams{ErrOut: io.Discard}})
 
 	c1, err := fn()
 	if err != nil {
@@ -34,10 +29,7 @@ func TestCachedHttpClientFunc_ReturnsSameInstance(t *testing.T) {
 }
 
 func TestCachedHttpClientFunc_HasTimeout(t *testing.T) {
-	isEnabled := false
-	f, _, _, _ := TestFactory(t, &core.CliConfig{AppID: "test-app"})
-	f.IOStreams.ErrOut = io.Discard
-	fn := cachedHttpClientFunc(f, staticWorkspaceConfig{config: &core.MultiAppConfig{RiskControl: &isEnabled}})
+	fn := cachedHttpClientFunc(&Factory{IOStreams: &IOStreams{ErrOut: io.Discard}})
 	c, _ := fn()
 	if c.Timeout == 0 {
 		t.Error("expected non-zero timeout")
@@ -45,10 +37,7 @@ func TestCachedHttpClientFunc_HasTimeout(t *testing.T) {
 }
 
 func TestCachedHttpClientFunc_HasRedirectPolicy(t *testing.T) {
-	isEnabled := false
-	f, _, _, _ := TestFactory(t, &core.CliConfig{AppID: "test-app"})
-	f.IOStreams.ErrOut = io.Discard
-	fn := cachedHttpClientFunc(f, staticWorkspaceConfig{config: &core.MultiAppConfig{RiskControl: &isEnabled}})
+	fn := cachedHttpClientFunc(&Factory{IOStreams: &IOStreams{ErrOut: io.Discard}})
 	c, _ := fn()
 	if c.CheckRedirect == nil {
 		t.Error("expected CheckRedirect to be set (safeRedirectPolicy)")

internal/cmdutil/factory_proxy_warn_test.go

@@ -8,7 +8,6 @@ import (
 	"testing"
 
 	_ "github.com/larksuite/cli/extension/credential/env" // registers the env-backed account provider
-	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/envvars"
 )
 
@@ -37,15 +36,13 @@ var proxyWarnGateCases = []struct {
 // TestCachedHttpClientFunc_ProxyWarnGate verifies the http-client init path
 // invokes WarnIfProxied only when stderr is an interactive terminal.
 func TestCachedHttpClientFunc_ProxyWarnGate(t *testing.T) {
-	isEnabled := false
 	for _, tc := range proxyWarnGateCases {
 		t.Run(tc.name, func(t *testing.T) {
 			calls := installProxyWarnSpy(t)
 
-			f, _, _, _ := TestFactory(t, &core.CliConfig{AppID: "test-app"})
-			f.IOStreams.ErrOut = io.Discard
-			f.IOStreams.StderrIsTerminal = tc.terminal
-			fn := cachedHttpClientFunc(f, staticWorkspaceConfig{config: &core.MultiAppConfig{RiskControl: &isEnabled}})
+			fn := cachedHttpClientFunc(&Factory{IOStreams: &IOStreams{
+				ErrOut: io.Discard, StderrIsTerminal: tc.terminal,
+			}})
 			if _, err := fn(); err != nil {
 				t.Fatalf("http client init: %v", err)
 			}
@@ -76,7 +73,7 @@ func TestCachedLarkClientFunc_ProxyWarnGate(t *testing.T) {
 			// normalizeStreams copies the struct (out := *s), so the
 			// StderrIsTerminal field survives into f.IOStreams.
 			f := NewDefault(&IOStreams{ErrOut: io.Discard, StderrIsTerminal: tc.terminal}, InvocationContext{})
-			if _, err := cachedLarkClientFunc(f, nil)(); err != nil {
+			if _, err := cachedLarkClientFunc(f)(); err != nil {
 				t.Fatalf("lark client init: %v", err)
 			}
 

internal/cmdutil/risk_control.go

@@ -1,28 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package cmdutil
-
-import (
-	"github.com/larksuite/cli/internal/core"
-	"github.com/larksuite/cli/internal/riskcontrol"
-)
-
-type workspaceConfigSource interface {
-	MultiAppConfig() (*core.MultiAppConfig, error)
-}
-
-// resolveSDKHostSignalSource applies workspace policy at the SDK transport
-// boundary.
-func resolveSDKHostSignalSource(config workspaceConfigSource) riskcontrol.Source {
-	if config == nil {
-		return nil
-	}
-	workspace, configErr := config.MultiAppConfig()
-	// Default-on means an existing config with no explicit preference. Absent
-	// or unreadable config cannot authorize host-signal collection.
-	if configErr != nil || !workspace.RiskControlEnabled() {
-		return nil
-	}
-	return riskcontrol.NewHostSource()
-}

internal/cmdutil/risk_control_test.go

@@ -1,45 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package cmdutil
-
-import (
-	"errors"
-	"testing"
-
-	"github.com/larksuite/cli/internal/core"
-)
-
-type staticWorkspaceConfig struct {
-	config *core.MultiAppConfig
-	err    error
-}
-
-func (s staticWorkspaceConfig) MultiAppConfig() (*core.MultiAppConfig, error) {
-	return s.config, s.err
-}
-
-func TestResolveSDKHostSignalSource(t *testing.T) {
-	disabled := false
-	tests := []struct {
-		name       string
-		config     workspaceConfigSource
-		wantSource bool
-	}{
-		{name: "workspace default on", config: staticWorkspaceConfig{config: &core.MultiAppConfig{}}, wantSource: true},
-		{name: "workspace opt-out", config: staticWorkspaceConfig{config: &core.MultiAppConfig{RiskControl: &disabled}}},
-		{name: "missing config", config: staticWorkspaceConfig{err: errors.New("file does not exist")}},
-		{name: "unreadable config", config: staticWorkspaceConfig{err: errors.New("permission denied")}},
-		{name: "nil config value", config: staticWorkspaceConfig{}},
-		{name: "nil config source"},
-	}
-
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			got := resolveSDKHostSignalSource(test.config)
-			if (got != nil) != test.wantSource {
-				t.Fatalf("resolveSDKHostSignalSource() = %T, wantSource %t", got, test.wantSource)
-			}
-		})
-	}
-}

internal/cmdutil/secheader.go

@@ -26,7 +26,6 @@ const (
 	HeaderShortcut    = "X-Cli-Shortcut"
 	HeaderExecutionId = "X-Cli-Execution-Id"
 	HeaderAgentTrace  = "X-Agent-Trace"
-	HeaderAgentName   = "X-Agent-Name"
 
 	SourceValue = "lark-cli"
 
@@ -56,9 +55,6 @@ func BaseSecurityHeaders() http.Header {
 	if v := envvars.AgentTrace(); v != "" {
 		h.Set(HeaderAgentTrace, v)
 	}
-	if v := envvars.AgentName(); v != "" {
-		h.Set(HeaderAgentName, v)
-	}
 	return h
 }
 

internal/cmdutil/secheader_test.go

@@ -263,34 +263,9 @@ func TestBaseSecurityHeaders_AllRequiredHeaders(t *testing.T) {
 }
 
 // ---------------------------------------------------------------------------
-// Agent headers injected via BaseSecurityHeaders
+// HeaderAgentTrace injection (via BaseSecurityHeaders)
 // ---------------------------------------------------------------------------
 
-func TestBaseSecurityHeaders_NoAgentNameHeaderWhenEnvUnset(t *testing.T) {
-	t.Setenv(envvars.CliAgentName, "")
-	h := BaseSecurityHeaders()
-	if v := h.Get(HeaderAgentName); v != "" {
-		t.Fatalf("BaseSecurityHeaders() included %s = %q, want absent when env unset", HeaderAgentName, v)
-	}
-}
-
-func TestBaseSecurityHeaders_IncludesAgentNameHeaderWhenEnvSet(t *testing.T) {
-	const agentName = "sample-agent"
-	t.Setenv(envvars.CliAgentName, agentName)
-	h := BaseSecurityHeaders()
-	if v := h.Get(HeaderAgentName); v != agentName {
-		t.Fatalf("BaseSecurityHeaders()[%s] = %q, want %q", HeaderAgentName, v, agentName)
-	}
-}
-
-func TestBaseSecurityHeaders_NoAgentNameHeaderWhenEnvInvalid(t *testing.T) {
-	t.Setenv(envvars.CliAgentName, "agent\r\nX-Evil: attack")
-	h := BaseSecurityHeaders()
-	if v := h.Get(HeaderAgentName); v != "" {
-		t.Fatalf("BaseSecurityHeaders() included %s = %q, want absent for invalid input", HeaderAgentName, v)
-	}
-}
-
 func TestBaseSecurityHeaders_NoAgentTraceHeaderWhenEnvUnset(t *testing.T) {
 	t.Setenv(envvars.CliAgentTrace, "")
 	h := BaseSecurityHeaders()

internal/cmdutil/transport_test.go

@@ -15,7 +15,6 @@ import (
 
 	exttransport "github.com/larksuite/cli/extension/transport"
 	internalauth "github.com/larksuite/cli/internal/auth"
-	"github.com/larksuite/cli/internal/riskcontrol"
 )
 
 type roundTripFunc func(*http.Request) (*http.Response, error)
@@ -92,13 +91,13 @@ func TestRetryTransport_DefaultNoRetry(t *testing.T) {
 }
 
 // ---------------------------------------------------------------------------
-// wrapSDKTransport chain composition
+// buildSDKTransport chain composition
 // ---------------------------------------------------------------------------
 
-func TestWrapSDKTransport_IncludesRetryTransport(t *testing.T) {
-	transport := wrapSDKTransport(riskcontrol.NewTransport(http.DefaultTransport, nil))
+func TestBuildSDKTransport_IncludesRetryTransport(t *testing.T) {
+	transport := buildSDKTransport()
 
-	// Chain: SecurityPolicy → BuildHeader → UserAgent → Retry → RiskControl → Base
+	// Chain: SecurityPolicy → BuildHeader → UserAgent → Retry → Base
 	sec, ok := transport.(*internalauth.SecurityPolicyTransport)
 	if !ok {
 		t.Fatalf("outer transport type = %T, want *auth.SecurityPolicyTransport", transport)
@@ -111,23 +110,18 @@ func TestWrapSDKTransport_IncludesRetryTransport(t *testing.T) {
 	if !ok {
 		t.Fatalf("layer after BuildHeader = %T, want *UserAgentTransport", bh.Base)
 	}
-	retry, ok := ua.Base.(*RetryTransport)
-	if !ok {
+	if _, ok := ua.Base.(*RetryTransport); !ok {
 		t.Fatalf("inner transport type = %T, want *RetryTransport", ua.Base)
 	}
-	if _, ok := retry.Base.(*riskcontrol.Transport); !ok {
-		t.Fatalf("layer after Retry = %T, want *riskcontrol.Transport", retry.Base)
-	}
 }
 
-func TestWrapSDKTransport_WithExtension(t *testing.T) {
-	previous := exttransport.GetProvider()
+func TestBuildSDKTransport_WithExtension(t *testing.T) {
 	exttransport.Register(&stubTransportProvider{})
-	t.Cleanup(func() { exttransport.Register(previous) })
+	t.Cleanup(func() { exttransport.Register(nil) })
 
-	transport := wrapSDKTransport(riskcontrol.NewTransport(http.DefaultTransport, nil))
+	transport := buildSDKTransport()
 
-	// Chain: extensionMiddleware → SecurityPolicy → BuildHeader → UserAgent → Retry → RiskControl → Base
+	// Chain: extensionMiddleware → SecurityPolicy → BuildHeader → UserAgent → Retry → Base
 	mid, ok := transport.(*extensionMiddleware)
 	if !ok {
 		t.Fatalf("outer transport type = %T, want *extensionMiddleware", transport)
@@ -144,23 +138,17 @@ func TestWrapSDKTransport_WithExtension(t *testing.T) {
 	if !ok {
 		t.Fatalf("layer after BuildHeader = %T, want *UserAgentTransport", bh.Base)
 	}
-	retry, ok := ua.Base.(*RetryTransport)
-	if !ok {
+	if _, ok := ua.Base.(*RetryTransport); !ok {
 		t.Fatalf("innermost transport type = %T, want *RetryTransport", ua.Base)
 	}
-	if _, ok := retry.Base.(*riskcontrol.Transport); !ok {
-		t.Fatalf("layer after Retry = %T, want *riskcontrol.Transport", retry.Base)
-	}
 }
 
-func TestWrapSDKTransport_WithoutExtension(t *testing.T) {
-	previous := exttransport.GetProvider()
+func TestBuildSDKTransport_WithoutExtension(t *testing.T) {
 	exttransport.Register(nil)
-	t.Cleanup(func() { exttransport.Register(previous) })
 
-	transport := wrapSDKTransport(riskcontrol.NewTransport(http.DefaultTransport, nil))
+	transport := buildSDKTransport()
 
-	// Chain: SecurityPolicy → BuildHeader → UserAgent → Retry → RiskControl → Base
+	// Chain: SecurityPolicy → BuildHeader → UserAgent → Retry → Base
 	sec, ok := transport.(*internalauth.SecurityPolicyTransport)
 	if !ok {
 		t.Fatalf("outer transport type = %T, want *auth.SecurityPolicyTransport", transport)
@@ -173,13 +161,9 @@ func TestWrapSDKTransport_WithoutExtension(t *testing.T) {
 	if !ok {
 		t.Fatalf("layer after BuildHeader = %T, want *UserAgentTransport", bh.Base)
 	}
-	retry, ok := ua.Base.(*RetryTransport)
-	if !ok {
+	if _, ok := ua.Base.(*RetryTransport); !ok {
 		t.Fatalf("inner transport type = %T, want *RetryTransport", ua.Base)
 	}
-	if _, ok := retry.Base.(*riskcontrol.Transport); !ok {
-		t.Fatalf("layer after Retry = %T, want *riskcontrol.Transport", retry.Base)
-	}
 }
 
 // ---------------------------------------------------------------------------
@@ -277,40 +261,6 @@ func (buildTamperingInterceptor) PreRoundTrip(req *http.Request) func(*http.Resp
 	return nil
 }
 
-type riskHeaderTamperingInterceptor struct{}
-
-func (riskHeaderTamperingInterceptor) PreRoundTrip(req *http.Request) func(*http.Response, error) {
-	req.Header.Set(riskcontrol.HeaderOSType, "extension-value")
-	req.Header.Set(riskcontrol.HeaderProductModel, "extension-value")
-	return nil
-}
-
-func TestWrapSDKTransport_StripsExtensionRiskHeaders(t *testing.T) {
-	previous := exttransport.GetProvider()
-	exttransport.Register(&stubTransportProvider{interceptor: riskHeaderTamperingInterceptor{}})
-	t.Cleanup(func() { exttransport.Register(previous) })
-
-	var received http.Header
-	network := roundTripFunc(func(req *http.Request) (*http.Response, error) {
-		received = req.Header.Clone()
-		return &http.Response{StatusCode: http.StatusOK, Body: http.NoBody}, nil
-	})
-	req, err := http.NewRequest(http.MethodGet, "https://open.feishu.cn/open-apis/test", nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-	req.Header.Set("Authorization", "Bearer token")
-
-	resp, err := wrapSDKTransport(riskcontrol.NewTransport(network, nil)).RoundTrip(req)
-	if err != nil {
-		t.Fatal(err)
-	}
-	resp.Body.Close()
-	if received.Get(riskcontrol.HeaderOSType) != "" || received.Get(riskcontrol.HeaderProductModel) != "" {
-		t.Fatalf("extension risk headers reached network: %v", received)
-	}
-}
-
 // TestBuildHeaderTransport_SDKChain_OverridesTamperedHeader verifies that the
 // X-Cli-Build header is force-written by BuildHeaderTransport in the SDK
 // transport chain, even when an extension tries to delete or spoof it. This
@@ -327,7 +277,7 @@ func TestBuildHeaderTransport_SDKChain_OverridesTamperedHeader(t *testing.T) {
 	exttransport.Register(&stubTransportProvider{interceptor: buildTamperingInterceptor{}})
 	t.Cleanup(func() { exttransport.Register(nil) })
 
-	// Replicate the SDK chain layering used by wrapSDKTransport.
+	// Replicate the SDK chain layering used by buildSDKTransport.
 	var base http.RoundTripper = http.DefaultTransport
 	base = &RetryTransport{Base: base}
 	base = &UserAgentTransport{Base: base}

internal/core/config.go

@@ -60,18 +60,11 @@ func (a *AppConfig) ProfileName() string {
 // MultiAppConfig is the multi-app config file format.
 type MultiAppConfig struct {
 	StrictMode  StrictMode  `json:"strictMode,omitempty"`
-	RiskControl *bool       `json:"riskControl,omitempty"`
 	CurrentApp  string      `json:"currentApp,omitempty"`
 	PreviousApp string      `json:"previousApp,omitempty"`
 	Apps        []AppConfig `json:"apps"`
 }
 
-// RiskControlEnabled resolves the workspace policy. An omitted preference
-// keeps the default-on account-protection behavior.
-func (m *MultiAppConfig) RiskControlEnabled() bool {
-	return m != nil && (m.RiskControl == nil || *m.RiskControl)
-}
-
 // CurrentAppConfig returns the currently active app config.
 // Resolution priority: profileOverride > CurrentApp field > Apps[0].
 func (m *MultiAppConfig) CurrentAppConfig(profileOverride string) *AppConfig {

internal/core/config_snapshot.go

@@ -1,37 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package core
-
-import (
-	"io/fs"
-	"sync"
-)
-
-// ConfigSnapshot lazily captures one stable view of config.json for a CLI
-// invocation. All runtime consumers share the same load result so account and
-// workspace policy resolution cannot observe different file revisions. Callers
-// must treat the returned config as read-only.
-type ConfigSnapshot struct {
-	load func() (*MultiAppConfig, error)
-}
-
-// NewConfigSnapshot creates a lazily loaded invocation-scoped config snapshot.
-func NewConfigSnapshot() *ConfigSnapshot {
-	return newConfigSnapshot(LoadMultiAppConfig)
-}
-
-func newConfigSnapshot(load func() (*MultiAppConfig, error)) *ConfigSnapshot {
-	if load == nil {
-		return &ConfigSnapshot{}
-	}
-	return &ConfigSnapshot{load: sync.OnceValues(load)}
-}
-
-// MultiAppConfig returns the captured persistent config and load error.
-func (s *ConfigSnapshot) MultiAppConfig() (*MultiAppConfig, error) {
-	if s == nil || s.load == nil {
-		return nil, fs.ErrNotExist
-	}
-	return s.load()
-}

internal/core/config_snapshot_test.go

@@ -1,58 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package core
-
-import (
-	"errors"
-	"io/fs"
-	"testing"
-)
-
-func TestConfigSnapshotLoadsOnce(t *testing.T) {
-	calls := 0
-	want := &MultiAppConfig{}
-	snapshot := newConfigSnapshot(func() (*MultiAppConfig, error) {
-		calls++
-		return want, nil
-	})
-
-	for range 2 {
-		config, err := snapshot.MultiAppConfig()
-		if err != nil {
-			t.Fatal(err)
-		}
-		if config != want {
-			t.Fatal("snapshot returned a different config instance")
-		}
-	}
-	if calls != 1 {
-		t.Fatalf("config loads = %d, want 1", calls)
-	}
-}
-
-func TestConfigSnapshotZeroValueIsMissing(t *testing.T) {
-	config, err := (&ConfigSnapshot{}).MultiAppConfig()
-	if config != nil || !errors.Is(err, fs.ErrNotExist) {
-		t.Fatalf("MultiAppConfig() = (%v, %v), want (nil, fs.ErrNotExist)", config, err)
-	}
-}
-
-func TestConfigSnapshotCachesError(t *testing.T) {
-	calls := 0
-	want := errors.New("load failed")
-	snapshot := newConfigSnapshot(func() (*MultiAppConfig, error) {
-		calls++
-		return nil, want
-	})
-
-	for range 2 {
-		config, err := snapshot.MultiAppConfig()
-		if config != nil || !errors.Is(err, want) {
-			t.Fatalf("MultiAppConfig() = (%v, %v), want (nil, %v)", config, err, want)
-		}
-	}
-	if calls != 1 {
-		t.Fatalf("config loads = %d, want 1", calls)
-	}
-}

internal/core/config_test.go

@@ -60,9 +60,7 @@ func TestAppConfig_LangOmitEmpty(t *testing.T) {
 }
 
 func TestMultiAppConfig_RoundTrip(t *testing.T) {
-	disabled := false
 	config := &MultiAppConfig{
-		RiskControl: &disabled,
 		Apps: []AppConfig{{
 			AppId: "cli_test", AppSecret: PlainSecret("s"),
 			Brand: BrandLark, Lang: "zh", Users: []AppUser{},
@@ -86,9 +84,6 @@ func TestMultiAppConfig_RoundTrip(t *testing.T) {
 	if got.Apps[0].Brand != BrandLark {
 		t.Errorf("Brand = %q, want %q", got.Apps[0].Brand, BrandLark)
 	}
-	if got.RiskControl == nil || *got.RiskControl {
-		t.Errorf("RiskControl = %v, want explicit false", got.RiskControl)
-	}
 }
 
 func TestResolveConfigFromMulti_RejectsSecretKeyMismatch(t *testing.T) {

internal/envvars/read_test.go

@@ -16,18 +16,16 @@ func TestAgentName_EmptyWhenEnvUnset(t *testing.T) {
 }
 
 func TestAgentName_ReturnsCleanValue(t *testing.T) {
-	const agentName = "sample-agent"
-	t.Setenv(CliAgentName, agentName)
-	if got := AgentName(); got != agentName {
-		t.Fatalf("AgentName() = %q, want %q", got, agentName)
+	t.Setenv(CliAgentName, "claude-code")
+	if got := AgentName(); got != "claude-code" {
+		t.Fatalf("AgentName() = %q, want %q", got, "claude-code")
 	}
 }
 
 func TestAgentName_TrimsWhitespace(t *testing.T) {
-	const agentName = "sample-agent"
-	t.Setenv(CliAgentName, "  "+agentName+"  ")
-	if got := AgentName(); got != agentName {
-		t.Fatalf("AgentName() = %q, want %q (whitespace trimmed)", got, agentName)
+	t.Setenv(CliAgentName, "  cursor  ")
+	if got := AgentName(); got != "cursor" {
+		t.Fatalf("AgentName() = %q, want %q (whitespace trimmed)", got, "cursor")
 	}
 }
 

internal/qualitygate/deptest/layering-edges.txt

@@ -0,0 +1,40 @@
+# from	denied	owner	reason	added_at
+github.com/larksuite/cli/extension/credential/env	github.com/larksuite/cli/internal/charcheck	arch-migration	extension pre-module-split (via core/envvars)	2026-07-24
+github.com/larksuite/cli/extension/credential/env	github.com/larksuite/cli/internal/core	arch-migration	extension pre-module-split (via core/envvars)	2026-07-24
+github.com/larksuite/cli/extension/credential/env	github.com/larksuite/cli/internal/envvars	arch-migration	extension pre-module-split (via core/envvars)	2026-07-24
+github.com/larksuite/cli/extension/credential/env	github.com/larksuite/cli/internal/i18n	arch-migration	extension pre-module-split (via core/envvars)	2026-07-24
+github.com/larksuite/cli/extension/credential/env	github.com/larksuite/cli/internal/keychain	arch-migration	extension pre-module-split (via core/envvars)	2026-07-24
+github.com/larksuite/cli/extension/credential/env	github.com/larksuite/cli/internal/validate	arch-migration	extension pre-module-split (via core/envvars)	2026-07-24
+github.com/larksuite/cli/extension/credential/env	github.com/larksuite/cli/internal/vfs	arch-migration	extension pre-module-split (via core/envvars)	2026-07-24
+github.com/larksuite/cli/extension/credential/env	github.com/larksuite/cli/internal/vfs/localfileio	arch-migration	extension pre-module-split (via core/envvars)	2026-07-24
+github.com/larksuite/cli/extension/credential/sidecar	github.com/larksuite/cli/internal/charcheck	arch-migration	extension pre-module-split (via core/envvars)	2026-07-24
+github.com/larksuite/cli/extension/credential/sidecar	github.com/larksuite/cli/internal/core	arch-migration	extension pre-module-split (via core/envvars)	2026-07-24
+github.com/larksuite/cli/extension/credential/sidecar	github.com/larksuite/cli/internal/envvars	arch-migration	extension pre-module-split (via core/envvars)	2026-07-24
+github.com/larksuite/cli/extension/credential/sidecar	github.com/larksuite/cli/internal/i18n	arch-migration	extension pre-module-split (via core/envvars)	2026-07-24
+github.com/larksuite/cli/extension/credential/sidecar	github.com/larksuite/cli/internal/keychain	arch-migration	extension pre-module-split (via core/envvars)	2026-07-24
+github.com/larksuite/cli/extension/credential/sidecar	github.com/larksuite/cli/internal/validate	arch-migration	extension pre-module-split (via core/envvars)	2026-07-24
+github.com/larksuite/cli/extension/credential/sidecar	github.com/larksuite/cli/internal/vfs	arch-migration	extension pre-module-split (via core/envvars)	2026-07-24
+github.com/larksuite/cli/extension/credential/sidecar	github.com/larksuite/cli/internal/vfs/localfileio	arch-migration	extension pre-module-split (via core/envvars)	2026-07-24
+github.com/larksuite/cli/extension/transport/sidecar	github.com/larksuite/cli/internal/envvars	arch-migration	extension pre-module-split (via core/envvars)	2026-07-24
+github.com/larksuite/cli/events	github.com/larksuite/cli/shortcuts/im/convert_lib	arch-migration	events root aggregates the existing im conversion dependency	2026-07-24
+github.com/larksuite/cli/events	github.com/larksuite/cli/shortcuts/common	arch-migration	events root aggregates the existing im conversion dependency	2026-07-24
+github.com/larksuite/cli/events/im	github.com/larksuite/cli/shortcuts/im/convert_lib	arch-migration	events->shortcuts inversion via convert_lib	2026-07-24
+github.com/larksuite/cli/events/im	github.com/larksuite/cli/shortcuts/common	arch-migration	events->shortcuts inversion via convert_lib	2026-07-24
+github.com/larksuite/cli/shortcuts/im	github.com/larksuite/cli/internal/auth	arch-migration	shortcut bypasses RuntimeContext gate	2026-07-24
+github.com/larksuite/cli/shortcuts/mail	github.com/larksuite/cli/internal/auth	arch-migration	shortcut bypasses RuntimeContext gate	2026-07-24
+github.com/larksuite/cli/shortcuts/minutes	github.com/larksuite/cli/internal/auth	arch-migration	shortcut bypasses RuntimeContext gate	2026-07-24
+github.com/larksuite/cli/shortcuts/vc	github.com/larksuite/cli/internal/auth	arch-migration	shortcut bypasses RuntimeContext gate	2026-07-24
+github.com/larksuite/cli/shortcuts/apps	github.com/larksuite/cli/internal/keychain	arch-migration	shortcut bypasses RuntimeContext gate	2026-07-24
+github.com/larksuite/cli/shortcuts/drive	github.com/larksuite/cli/internal/credential	arch-migration	shortcut bypasses RuntimeContext gate	2026-07-24
+github.com/larksuite/cli/shortcuts/im	github.com/larksuite/cli/internal/credential	arch-migration	shortcut bypasses RuntimeContext gate	2026-07-24
+github.com/larksuite/cli/shortcuts/minutes	github.com/larksuite/cli/internal/credential	arch-migration	shortcut bypasses RuntimeContext gate	2026-07-24
+github.com/larksuite/cli/shortcuts/vc	github.com/larksuite/cli/internal/credential	arch-migration	shortcut bypasses RuntimeContext gate	2026-07-24
+github.com/larksuite/cli/shortcuts/apps	github.com/larksuite/cli/internal/client	arch-migration	shortcut bypasses RuntimeContext gate	2026-07-24
+github.com/larksuite/cli/shortcuts/drive	github.com/larksuite/cli/internal/client	arch-migration	shortcut bypasses RuntimeContext gate	2026-07-24
+github.com/larksuite/cli/shortcuts/im	github.com/larksuite/cli/internal/client	arch-migration	shortcut bypasses RuntimeContext gate	2026-07-24
+github.com/larksuite/cli/shortcuts/mail	github.com/larksuite/cli/internal/client	arch-migration	shortcut bypasses RuntimeContext gate	2026-07-24
+github.com/larksuite/cli/shortcuts/markdown	github.com/larksuite/cli/internal/client	arch-migration	shortcut bypasses RuntimeContext gate	2026-07-24
+github.com/larksuite/cli/shortcuts/task	github.com/larksuite/cli/internal/client	arch-migration	shortcut bypasses RuntimeContext gate	2026-07-24
+github.com/larksuite/cli/shortcuts/apps	github.com/larksuite/cli/internal/vfs	arch-migration	shortcut bypasses RuntimeContext gate	2026-07-24
+github.com/larksuite/cli/shortcuts/event	github.com/larksuite/cli/internal/vfs	arch-migration	shortcut bypasses RuntimeContext gate	2026-07-24
+github.com/larksuite/cli/shortcuts/mail	github.com/larksuite/cli/internal/vfs	arch-migration	shortcut bypasses RuntimeContext gate	2026-07-24

internal/riskcontrol/osmodel.go

@@ -1,142 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-// Package deviceinfo collects the platform hardware product model and the
-// platform values used by device-related risk-control headers.
-package riskcontrol
-
-import (
-	"runtime"
-	"strings"
-	"sync"
-	"unicode"
-	"unicode/utf8"
-
-	"golang.org/x/net/http/httpguts"
-)
-
-// OSType is the server-side risk-control operating-system enum.
-type OSType string
-
-// OS type enum values for X-Agent-Os-Type.
-const (
-	OSTypeUnknown = "0"
-	OSTypeWindows = "1"
-	OSTypeLinux   = "2"
-	OSTypeMacOS   = "3"
-)
-
-const (
-	// TerminalTypePC is the fixed X-Agent-Terminal-Type value for the CLI.
-	TerminalTypePC = "1"
-
-	// Unknown is used when the hardware product model cannot be collected.
-	Unknown = "Unknown"
-
-	// deviceModelMaxBytes bounds the value added to X-Agent-Device-Type.
-	// Device models are short identifiers; a larger value is treated as
-	// malformed rather than truncated so the header never misrepresents it.
-	deviceModelMaxBytes = 256
-)
-
-// Snapshot contains the deliberately small risk-control signal set.
-// ProductModel is omitted when the platform cannot provide a safe value.
-type Snapshot struct {
-	OSType       OSType
-	ProductModel string
-}
-
-// Source supplies one immutable process-level snapshot.
-type Source interface {
-	Snapshot() Snapshot
-}
-
-// HostSource lazily reads host signals once, after outbound policy authorizes
-// the first request. Failed probes are cached and are not retried per request.
-type HostSource struct {
-	once      sync.Once
-	value     Snapshot
-	readModel func() string
-}
-
-// NewHostSource creates the production host signal source.
-func NewHostSource() *HostSource {
-	return &HostSource{readModel: readDeviceModel}
-}
-
-// Snapshot returns the cached host signal snapshot.
-func (s *HostSource) Snapshot() Snapshot {
-	if s == nil {
-		return Snapshot{}
-	}
-	s.once.Do(func() {
-		readModel := s.readModel
-		if readModel == nil {
-			readModel = readDeviceModel
-		}
-		s.value = Snapshot{
-			OSType:       GetOSType(OSName()),
-			ProductModel: normalizeDeviceModel(readModel()),
-		}
-	})
-	return s.value
-}
-
-// normalizeModel removes non-printable characters and returns a model only
-// when the remaining text is safe to use as an HTTP header value. Input that
-// cannot produce a valid model is rejected so Get can fall back to Unknown.
-func normalizeDeviceModel(model string) string {
-	if !utf8.ValidString(model) {
-		return ""
-	}
-	model = strings.Map(func(r rune) rune {
-		switch {
-		case r == '\r' || r == '\n' || r == '\x00':
-			return -1
-		case unicode.IsSpace(r):
-			return ' '
-		case unicode.IsPrint(r):
-			return r
-		default:
-			return -1
-		}
-	}, model)
-
-	model = strings.Join(strings.Fields(model), " ")
-
-	if model == "" || len(model) > deviceModelMaxBytes {
-		return ""
-	}
-	if !httpguts.ValidHeaderFieldValue(model) {
-		return ""
-	}
-	return model
-}
-
-// GetOSType maps a platform name to the X-Agent-Os-Type enum.
-func GetOSType(osName string) OSType {
-	switch osName {
-	case "Windows":
-		return OSTypeWindows
-	case "Linux":
-		return OSTypeLinux
-	case "MacOS":
-		return OSTypeMacOS
-	default:
-		return OSTypeUnknown
-	}
-}
-
-// OSName returns the platform name used by GetOSType.
-func OSName() string {
-	switch runtime.GOOS {
-	case "darwin":
-		return "MacOS"
-	case "windows":
-		return "Windows"
-	case "linux":
-		return "Linux"
-	default:
-		return runtime.GOOS
-	}
-}

internal/riskcontrol/osmodel_darwin.go

@@ -1,27 +0,0 @@
-//go:build darwin
-
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package riskcontrol
-
-import "golang.org/x/sys/unix"
-
-// readDeviceModel reads the current product key first and falls back to the
-// legacy model key. Trying both keys is more robust than branching on a macOS
-// version because virtualized or restricted environments may expose only one.
-func readDeviceModel() string {
-	return readDarwinDeviceModel(unix.Sysctl)
-}
-
-func readDarwinDeviceModel(readSysctl func(string) (string, error)) string {
-	for _, key := range [...]string{"hw.product", "hw.model"} {
-		model, err := readSysctl(key)
-		if err == nil {
-			if model = normalizeDeviceModel(model); model != "" {
-				return model
-			}
-		}
-	}
-	return ""
-}

internal/riskcontrol/osmodel_darwin_test.go

@@ -1,48 +0,0 @@
-//go:build darwin
-
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package riskcontrol
-
-import (
-	"errors"
-	"reflect"
-	"testing"
-)
-
-func TestReadDarwinDeviceModelPrefersProductAndFallsBackToModel(t *testing.T) {
-	t.Run("product available", func(t *testing.T) {
-		var keys []string
-		got := readDarwinDeviceModel(func(key string) (string, error) {
-			keys = append(keys, key)
-			if key == "hw.product" {
-				return "Mac16,1", nil
-			}
-			return "", errors.New("unexpected fallback")
-		})
-		if got != "Mac16,1" {
-			t.Fatalf("model = %q, want %q", got, "Mac16,1")
-		}
-		if want := []string{"hw.product"}; !reflect.DeepEqual(keys, want) {
-			t.Fatalf("sysctl keys = %v, want %v", keys, want)
-		}
-	})
-
-	t.Run("product unavailable", func(t *testing.T) {
-		var keys []string
-		got := readDarwinDeviceModel(func(key string) (string, error) {
-			keys = append(keys, key)
-			if key == "hw.model" {
-				return "MacBookPro18,3", nil
-			}
-			return "", errors.New("not available")
-		})
-		if got != "MacBookPro18,3" {
-			t.Fatalf("model = %q, want %q", got, "MacBookPro18,3")
-		}
-		if want := []string{"hw.product", "hw.model"}; !reflect.DeepEqual(keys, want) {
-			t.Fatalf("sysctl keys = %v, want %v", keys, want)
-		}
-	})
-}

internal/riskcontrol/osmodel_linux.go

@@ -1,17 +0,0 @@
-//go:build linux
-
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package riskcontrol
-
-// readDeviceModel returns a stable device model for Linux. DMI and device-tree
-// values vary widely and can expose the host or virtualization platform when
-// the CLI runs in a container or sandbox.
-func readDeviceModel() string {
-	return readLinuxDeviceModel()
-}
-
-func readLinuxDeviceModel() string {
-	return "linux"
-}

internal/riskcontrol/osmodel_linux_test.go

@@ -1,20 +0,0 @@
-//go:build linux
-
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package riskcontrol
-
-import "testing"
-
-func TestReadDeviceModelReturnsLinux(t *testing.T) {
-	if got := readDeviceModel(); got != "linux" {
-		t.Fatalf("readDeviceModel() = %q, want %q", got, "linux")
-	}
-}
-
-func TestReadLinuxDeviceModel(t *testing.T) {
-	if got := readLinuxDeviceModel(); got != "linux" {
-		t.Fatalf("readLinuxDeviceModel() = %q, want %q", got, "linux")
-	}
-}

internal/riskcontrol/osmodel_other.go

@@ -1,11 +0,0 @@
-//go:build !darwin && !windows && !linux
-
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package riskcontrol
-
-// readDeviceModel returns an empty model on unsupported platforms.
-func readDeviceModel() string {
-	return ""
-}

internal/riskcontrol/osmodel_test.go

@@ -1,143 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package riskcontrol
-
-import (
-	"fmt"
-	"strings"
-	"sync"
-	"sync/atomic"
-	"testing"
-	"unicode"
-)
-
-func TestHostSourceCachesNonEmptyModel(t *testing.T) {
-	calls := 0
-	s := &HostSource{readModel: func() string {
-		calls++
-		return "  MacBookPro18,3\n"
-	}}
-
-	if got := s.Snapshot(); got.ProductModel != "MacBookPro18,3" {
-		t.Fatalf("first Snapshot().ProductModel = %q, want %q", got.ProductModel, "MacBookPro18,3")
-	}
-	if got := s.Snapshot(); got.ProductModel != "MacBookPro18,3" {
-		t.Fatalf("second Snapshot().ProductModel = %q, want cached model", got.ProductModel)
-	}
-	if calls != 1 {
-		t.Fatalf("read called %d times, want 1", calls)
-	}
-}
-
-func TestHostSourceCachesEmptyModel(t *testing.T) {
-	calls := 0
-	s := &HostSource{readModel: func() string {
-		calls++
-		return ""
-	}}
-
-	if got := s.Snapshot(); got.ProductModel != "" {
-		t.Fatalf("first Snapshot().ProductModel = %q, want empty", got.ProductModel)
-	}
-	if got := s.Snapshot(); got.ProductModel != "" {
-		t.Fatalf("second Snapshot().ProductModel = %q, want cached empty result", got.ProductModel)
-	}
-	if calls != 1 {
-		t.Fatalf("read called %d times, want 1", calls)
-	}
-}
-
-func TestHostSourceReadsOnceAcrossConcurrentCalls(t *testing.T) {
-	var calls atomic.Int32
-	s := &HostSource{readModel: func() string {
-		calls.Add(1)
-		return "ThinkPad X1 Carbon"
-	}}
-
-	const goroutines = 32
-	var wg sync.WaitGroup
-	wg.Add(goroutines)
-	for i := 0; i < goroutines; i++ {
-		go func() {
-			defer wg.Done()
-			snapshot := s.Snapshot()
-			if snapshot.ProductModel != "ThinkPad X1 Carbon" {
-				t.Errorf("Snapshot().ProductModel = %q, want %q", snapshot.ProductModel, "ThinkPad X1 Carbon")
-			}
-		}()
-	}
-	wg.Wait()
-
-	if got := calls.Load(); got != 1 {
-		t.Fatalf("read called %d times, want 1", got)
-	}
-}
-
-func TestNormalizeDeviceModel(t *testing.T) {
-	tests := []struct {
-		name  string
-		model string
-		want  string
-	}{
-		{name: "trims surrounding whitespace", model: "  MacBookPro18,3\n", want: "MacBookPro18,3"},
-		{name: "trims device tree terminator", model: "Raspberry Pi 5\x00", want: "Raspberry Pi 5"},
-		{name: "allows printable Unicode", model: "联想 ThinkPad X1", want: "联想 ThinkPad X1"},
-		{name: "rejects empty", model: " \t\r\n"},
-		{name: "rejects invalid UTF-8", model: string([]byte{'M', 0xff, '1'})},
-		{name: "removes CRLF", model: "model\r\nname", want: "modelname"},
-		{name: "normalizes tab", model: "model\tname", want: "model name"},
-		{name: "removes NUL", model: "model\x00name", want: "modelname"},
-		{name: "removes control character", model: "model\x1fname", want: "modelname"},
-		{name: "removes DEL", model: "model\x7fname", want: "modelname"},
-		{name: "normalizes Unicode line separator", model: "model\u2028name", want: "model name"},
-		{name: "collapses whitespace", model: "  model\t \u00a0 name  ", want: "model name"},
-		{name: "accepts maximum byte length", model: strings.Repeat("a", deviceModelMaxBytes), want: strings.Repeat("a", deviceModelMaxBytes)},
-		{name: "rejects overlong value", model: strings.Repeat("a", deviceModelMaxBytes+1)},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			if got := normalizeDeviceModel(tt.model); got != tt.want {
-				t.Fatalf("normalizeDeviceModel(%q) = %q, want %q", tt.model, got, tt.want)
-			}
-		})
-	}
-}
-
-func TestNormalizeDeviceModelRemovesHTTPControlBytes(t *testing.T) {
-	for value := 0; value <= 0x7f; value++ {
-		if value >= 0x20 && value < 0x7f {
-			continue
-		}
-		t.Run(fmt.Sprintf("0x%02x", value), func(t *testing.T) {
-			model := "model" + string(rune(value)) + "name"
-			want := "modelname"
-			if value != '\r' && value != '\n' && value != '\x00' && unicode.IsSpace(rune(value)) {
-				want = "model name"
-			}
-			if got := normalizeDeviceModel(model); got != want {
-				t.Fatalf("normalizeDeviceModel(%q) = %q, want %q", model, got, want)
-			}
-		})
-	}
-}
-
-func TestGetOSType(t *testing.T) {
-	tests := []struct {
-		name string
-		want OSType
-	}{
-		{name: "Windows", want: OSTypeWindows},
-		{name: "Linux", want: OSTypeLinux},
-		{name: "MacOS", want: OSTypeMacOS},
-		{name: "unknown", want: OSTypeUnknown},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			if got := GetOSType(tt.name); got != tt.want {
-				t.Errorf("GetOSType(%q) = %q, want %q", tt.name, got, tt.want)
-			}
-		})
-	}
-}

internal/riskcontrol/osmodel_windows.go

@@ -1,44 +0,0 @@
-//go:build windows
-
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package riskcontrol
-
-import "golang.org/x/sys/windows/registry"
-
-// systemInfoRegistryPaths lists registry locations in device-model lookup order.
-var systemInfoRegistryPaths = [...]string{
-	`HARDWARE\DESCRIPTION\System\BIOS`,
-	`SYSTEM\CurrentControlSet\Control\SystemInformation`,
-	`SYSTEM\HardwareConfig\Current`,
-}
-
-// readDeviceModel returns the first product name found in the Windows registry.
-func readDeviceModel() string {
-	return readWindowsDeviceModel(readWindowsRegistryModel)
-}
-
-func readWindowsRegistryModel(path string) (string, error) {
-	key, err := registry.OpenKey(registry.LOCAL_MACHINE, path, registry.READ)
-	if err != nil {
-		return "", err
-	}
-	defer key.Close()
-
-	model, _, err := key.GetStringValue("SystemProductName")
-	return model, err
-}
-
-func readWindowsDeviceModel(readRegistryModel func(string) (string, error)) string {
-	for _, path := range systemInfoRegistryPaths {
-		model, err := readRegistryModel(path)
-		if err != nil {
-			continue
-		}
-		if model = normalizeDeviceModel(model); model != "" {
-			return model
-		}
-	}
-	return ""
-}

internal/riskcontrol/osmodel_windows_test.go

@@ -1,78 +0,0 @@
-//go:build windows
-
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package riskcontrol
-
-import (
-	"errors"
-	"reflect"
-	"testing"
-)
-
-func TestReadWindowsDeviceModelFallback(t *testing.T) {
-	readError := errors.New("registry read failed")
-	tests := []struct {
-		name      string
-		values    map[string]string
-		errors    map[string]error
-		want      string
-		wantPaths []string
-	}{
-		{
-			name:      "first path wins",
-			values:    map[string]string{systemInfoRegistryPaths[0]: "Surface Laptop"},
-			want:      "Surface Laptop",
-			wantPaths: []string{systemInfoRegistryPaths[0]},
-		},
-		{
-			name: "read failure falls back",
-			errors: map[string]error{
-				systemInfoRegistryPaths[0]: readError,
-			},
-			values: map[string]string{
-				systemInfoRegistryPaths[1]: "ThinkPad X1 Carbon",
-			},
-			want:      "ThinkPad X1 Carbon",
-			wantPaths: systemInfoRegistryPaths[:2],
-		},
-		{
-			name: "empty normalized value falls back",
-			values: map[string]string{
-				systemInfoRegistryPaths[0]: " \r\n\x00",
-				systemInfoRegistryPaths[1]: "Latitude 7450",
-			},
-			want:      "Latitude 7450",
-			wantPaths: systemInfoRegistryPaths[:2],
-		},
-		{
-			name: "all paths fail",
-			errors: map[string]error{
-				systemInfoRegistryPaths[0]: readError,
-				systemInfoRegistryPaths[1]: readError,
-				systemInfoRegistryPaths[2]: readError,
-			},
-			wantPaths: systemInfoRegistryPaths[:],
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			var paths []string
-			got := readWindowsDeviceModel(func(path string) (string, error) {
-				paths = append(paths, path)
-				if err := tt.errors[path]; err != nil {
-					return "", err
-				}
-				return tt.values[path], nil
-			})
-			if got != tt.want {
-				t.Fatalf("model = %q, want %q", got, tt.want)
-			}
-			if !reflect.DeepEqual(paths, tt.wantPaths) {
-				t.Fatalf("registry paths = %v, want %v", paths, tt.wantPaths)
-			}
-		})
-	}
-}

internal/riskcontrol/transport.go

@@ -1,138 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package riskcontrol
-
-import (
-	"net/http"
-	"net/url"
-	"strings"
-
-	"github.com/larksuite/cli/internal/core"
-	internaltransport "github.com/larksuite/cli/internal/transport"
-)
-
-const (
-	HeaderProductModel = "X-Agent-Device-Type"
-	HeaderOSType       = "X-Agent-Os-Type"
-)
-
-var restrictedHeaders = [...]string{HeaderProductModel, HeaderOSType}
-
-// Transport is the feature's final outbound boundary. It removes caller- or
-// extension-supplied signal headers first and writes trusted values only after
-// authorizing an official SDK origin and authentication state.
-type Transport struct {
-	next   http.RoundTripper
-	source Source
-}
-
-// NewTransport creates the final SDK outbound policy boundary. A nil source
-// disables collection and injection while preserving restricted-header
-// stripping for opt-out and extension-credential requests.
-func NewTransport(next http.RoundTripper, source Source) *Transport {
-	if next == nil {
-		next = internaltransport.Fallback()
-	}
-	return &Transport{
-		next:   next,
-		source: source,
-	}
-}
-
-// RoundTrip implements http.RoundTripper.
-func (t *Transport) RoundTrip(req *http.Request) (*http.Response, error) {
-	req = req.Clone(req.Context())
-	if req.Header == nil {
-		req.Header = make(http.Header)
-	}
-	stripRestrictedHeaders(req.Header)
-
-	if t.source != nil && t.routeAllowsSignals(req) {
-		snapshot := t.source.Snapshot()
-		if isSupportedOSType(snapshot.OSType) {
-			req.Header.Set(HeaderOSType, string(snapshot.OSType))
-		}
-		if model := normalizeDeviceModel(snapshot.ProductModel); model != "" {
-			req.Header.Set(HeaderProductModel, model)
-		}
-	}
-	return t.next.RoundTrip(req)
-}
-
-func isSupportedOSType(value OSType) bool {
-	switch value {
-	case OSTypeWindows, OSTypeLinux, OSTypeMacOS:
-		return true
-	default:
-		return false
-	}
-}
-
-func stripRestrictedHeaders(header http.Header) {
-	for name := range header {
-		for _, restricted := range restrictedHeaders {
-			if strings.EqualFold(name, restricted) {
-				delete(header, name)
-				break
-			}
-		}
-	}
-}
-
-type origin struct {
-	scheme string
-	host   string
-	port   string
-}
-
-var officialFeishuOrigins = [...]origin{
-	apiOrigin(core.BrandFeishu, core.ResolveEndpoints(core.BrandFeishu).Open),
-	apiOrigin(core.BrandLark, core.ResolveEndpoints(core.BrandLark).Open),
-	apiOrigin(core.BrandFeishu, core.ResolveEndpoints(core.BrandFeishu).Accounts),
-	apiOrigin(core.BrandLark, core.ResolveEndpoints(core.BrandLark).Accounts),
-}
-
-func (t *Transport) routeAllowsSignals(req *http.Request) bool {
-	if req == nil || req.URL == nil {
-		return false
-	}
-	return isOfficialFeishuOrigin(originOf(req.URL))
-}
-
-func originOf(value *url.URL) origin {
-	if value == nil {
-		return origin{}
-	}
-	scheme := strings.ToLower(value.Scheme)
-	port := value.Port()
-	if port == "" {
-		switch scheme {
-		case "https":
-			port = "443"
-		case "http":
-			port = "80"
-		}
-	}
-	return origin{scheme: scheme, host: strings.ToLower(value.Hostname()), port: port}
-}
-
-func apiOrigin(brand core.LarkBrand, endpointURL string) origin {
-	endpoint, err := url.Parse(endpointURL)
-	if err != nil {
-		return origin{}
-	}
-	return originOf(endpoint)
-}
-
-func isOfficialFeishuOrigin(candidate origin) bool {
-	if candidate.scheme != "https" || candidate.port != "443" {
-		return false
-	}
-	for _, official := range officialFeishuOrigins {
-		if candidate == official {
-			return true
-		}
-	}
-	return false
-}

internal/riskcontrol/transport_test.go

@@ -1,124 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package riskcontrol
-
-import (
-	"net/http"
-	"strings"
-	"sync/atomic"
-	"testing"
-)
-
-type roundTripFunc func(*http.Request) (*http.Response, error)
-
-func (f roundTripFunc) RoundTrip(req *http.Request) (*http.Response, error) {
-	return f(req)
-}
-
-type countingSource struct {
-	calls atomic.Int32
-}
-
-func (s *countingSource) Snapshot() Snapshot {
-	s.calls.Add(1)
-	return Snapshot{OSType: OSTypeMacOS, ProductModel: "Mac16,1"}
-}
-
-type staticSource Snapshot
-
-func (s staticSource) Snapshot() Snapshot { return Snapshot(s) }
-
-func TestTransportAuthorizesBeforeCollecting(t *testing.T) {
-	tests := []struct {
-		name          string
-		requestURL    string
-		authorization string
-		wantSignals   bool
-	}{
-		{name: "authenticated official HTTPS", requestURL: "https://open.feishu.cn/open-apis/test", authorization: "Bearer token", wantSignals: true},
-		{name: "Lark official HTTPS", requestURL: "https://open.larksuite.com/open-apis/test", authorization: "Bearer token", wantSignals: true},
-		{name: "official explicit HTTPS port", requestURL: "https://OPEN.FEISHU.CN:443/open-apis/test", authorization: "Bearer token", wantSignals: true},
-		{name: "unauthenticated", requestURL: "https://open.feishu.cn/open-apis/test", wantSignals: true},
-		{name: "official non-OpenAPI origin", requestURL: "https://accounts.feishu.cn/open-apis/test", authorization: "Bearer token", wantSignals: true},
-		{name: "off domain", requestURL: "https://example.com/test", authorization: "Bearer token", wantSignals: false},
-		{name: "lookalike", requestURL: "https://open.feishu.cn.evil.example/test", authorization: "Bearer token", wantSignals: false},
-		{name: "plain HTTP", requestURL: "http://open.feishu.cn/test", authorization: "Bearer token", wantSignals: false},
-		{name: "non-default port", requestURL: "https://open.feishu.cn:8443/test", authorization: "Bearer token", wantSignals: false},
-	}
-
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			source := &countingSource{}
-			var received http.Header
-			base := roundTripFunc(func(req *http.Request) (*http.Response, error) {
-				received = req.Header.Clone()
-				return &http.Response{StatusCode: http.StatusOK, Body: http.NoBody}, nil
-			})
-			req, err := http.NewRequest(http.MethodGet, test.requestURL, nil)
-			if err != nil {
-				t.Fatal(err)
-			}
-			req.Header.Set("Authorization", test.authorization)
-			req.Header.Set(HeaderOSType, "caller-value")
-			req.Header.Set(HeaderProductModel, "caller-value")
-			req.Header["x-agent-device-type"] = []string{"non-canonical-caller-value"}
-
-			resp, err := NewTransport(base, source).RoundTrip(req)
-			if err != nil {
-				t.Fatal(err)
-			}
-			resp.Body.Close()
-
-			gotSignals := received.Get(HeaderOSType) != ""
-			if gotSignals != test.wantSignals {
-				t.Fatalf("signals present = %t, want %t; headers=%v", gotSignals, test.wantSignals, received)
-			}
-			wantCalls := int32(0)
-			if test.wantSignals {
-				wantCalls = 1
-			}
-			if got := source.calls.Load(); got != wantCalls {
-				t.Fatalf("Snapshot calls = %d, want %d", got, wantCalls)
-			}
-			if got := req.Header.Get(HeaderOSType); got != "caller-value" {
-				t.Fatalf("caller request OS header = %q, want unchanged", got)
-			}
-			if got := req.Header.Get(HeaderProductModel); got != "caller-value" {
-				t.Fatalf("caller request product-model header = %q, want unchanged", got)
-			}
-			if !test.wantSignals {
-				for name := range received {
-					if strings.EqualFold(name, HeaderProductModel) || strings.EqualFold(name, HeaderOSType) {
-						t.Fatalf("restricted header leaked as %q", name)
-					}
-				}
-			}
-		})
-	}
-}
-
-func TestTransportValidatesSourceSnapshot(t *testing.T) {
-	var received http.Header
-	base := roundTripFunc(func(req *http.Request) (*http.Response, error) {
-		received = req.Header.Clone()
-		return &http.Response{StatusCode: http.StatusOK, Body: http.NoBody}, nil
-	})
-	req, err := http.NewRequest(http.MethodGet, "https://open.feishu.cn/open-apis/test", nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-	req.Header.Set("Authorization", "Bearer token")
-
-	resp, err := NewTransport(base, staticSource{
-		OSType:       OSType("unsupported"),
-		ProductModel: "unsafe\nvalue",
-	}).RoundTrip(req)
-	if err != nil {
-		t.Fatal(err)
-	}
-	resp.Body.Close()
-	if received.Get(HeaderOSType) == "" && received.Get(HeaderProductModel) == "" {
-		t.Fatalf("no signals collected: %v", received)
-	}
-}

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@larksuite/cli",
-  "version": "1.0.80",
+  "version": "1.0.76",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@larksuite/cli",
-      "version": "1.0.80",
+      "version": "1.0.76",
       "cpu": [
         "x64",
         "arm64",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@larksuite/cli",
-  "version": "1.0.80",
+  "version": "1.0.76",
   "description": "The official CLI for Lark/Feishu open platform",
   "bin": {
     "lark-cli": "scripts/run.js"

scripts/check-layering-ratchet.sh

@@ -0,0 +1,140 @@
+#!/usr/bin/env bash
+# Copyright (c) 2026 Lark Technologies Pte. Ltd.
+# SPDX-License-Identifier: MIT
+
+layering_ratchet_extract_keys() {
+  local source_file="$1"
+  local output_file="$2"
+  awk -F '\t' '
+    function trim(value) {
+      sub(/^[[:space:]]+/, "", value)
+      sub(/[[:space:]]+$/, "", value)
+      return value
+    }
+    {
+      content = trim($0)
+      if (content == "" || substr(content, 1, 1) == "#") {
+        next
+      }
+      if (NF != 5) {
+        printf "Malformed layering ratchet row at %s:%d: expected five tab-separated fields.\n", FILENAME, FNR > "/dev/stderr"
+        exit 2
+      }
+      from = $1
+      denied = $2
+      owner = $3
+      reason = $4
+      added_at = $5
+      sub(/\r+$/, "", added_at)
+      if (from != trim(from) || denied != trim(denied) || owner != trim(owner) || reason != trim(reason) || added_at != trim(added_at)) {
+        printf "Malformed layering ratchet row at %s:%d: fields must not have surrounding whitespace.\n", FILENAME, FNR > "/dev/stderr"
+        exit 2
+      }
+      if (from == "" || denied == "" || owner == "" || reason == "" || added_at !~ /^[0-9]{4}-[0-9]{2}-[0-9]{2}$/) {
+        printf "Malformed layering ratchet row at %s:%d: fields must be non-empty and added_at must use YYYY-MM-DD.\n", FILENAME, FNR > "/dev/stderr"
+        exit 2
+      }
+      print from "\t" denied
+    }
+  ' "$source_file" | LC_ALL=C sort >"$output_file" || return
+
+  local duplicates
+  duplicates="$(uniq -d "$output_file")" || return
+  if [[ -n "$duplicates" ]]; then
+    echo "Layering ratchet contains duplicate (from, denied) keys: $source_file" >&2
+    printf '%s\n' "$duplicates" >&2
+    return 1
+  fi
+}
+
+layering_ratchet_hash_keys() {
+  local source_file="$1"
+  if command -v sha256sum >/dev/null 2>&1; then
+    sha256sum "$source_file" | awk '{ print $1 }' || return
+    return
+  fi
+  if command -v shasum >/dev/null 2>&1; then
+    shasum -a 256 "$source_file" | awk '{ print $1 }' || return
+    return
+  fi
+  echo "Layering ratchet requires sha256sum or shasum." >&2
+  return 1
+}
+
+layering_ratchet_validate_bootstrap_snapshot() {
+  local current_keys="$1"
+  local expected_count="$2"
+  local expected_hash="$3"
+  local current_count
+  local current_hash
+  current_count="$(wc -l <"$current_keys" | tr -d '[:space:]')" || return
+  current_hash="$(layering_ratchet_hash_keys "$current_keys")" || return
+  if [[ "$current_count" != "$expected_count" || "$current_hash" != "$expected_hash" ]]; then
+    echo "::error::Layering ratchet bootstrap differs from the approved $expected_count-edge snapshot." >&2
+    return 1
+  fi
+}
+
+layering_ratchet_main() (
+  set -euo pipefail
+
+  local ratchet_file="internal/qualitygate/deptest/layering-edges.txt"
+  if root="$(git rev-parse --show-toplevel 2>/dev/null)"; then
+    cd "$root" || return
+  else
+    echo "Layering ratchet must run inside a Git worktree." >&2
+    return 1
+  fi
+
+  local base_revision="${1:-${QUALITY_GATE_CHANGED_FROM:-}}"
+  local approved_initial_count="${2:-39}"
+  local approved_initial_hash="${3:-5636d50d10b9de1e08dc9f06cd66671b3f438650fa5b7f28b95aa7d5a69a1c21}"
+  if [[ -z "$base_revision" ]]; then
+    echo "Layering ratchet requires a base revision." >&2
+    return 1
+  fi
+  if ! git cat-file -e "$base_revision^{commit}" 2>/dev/null; then
+    echo "Layering ratchet base revision does not exist: $base_revision" >&2
+    return 1
+  fi
+  if [[ ! -f "$ratchet_file" ]]; then
+    echo "Layering ratchet file is missing: $ratchet_file" >&2
+    return 1
+  fi
+
+  local tmp_dir
+  tmp_dir="$(mktemp -d "${TMPDIR:-/tmp}/layering-ratchet.XXXXXX")" || return
+  local base_file="$tmp_dir/base.txt"
+  local base_keys="$tmp_dir/base.keys"
+  local current_keys="$tmp_dir/current.keys"
+  local additions="$tmp_dir/additions.keys"
+
+  layering_ratchet_cleanup_current_run() {
+    rm -f "$base_file" "$base_keys" "$current_keys" "$additions"
+    rmdir "$tmp_dir"
+  }
+  trap layering_ratchet_cleanup_current_run EXIT
+
+  layering_ratchet_extract_keys "$ratchet_file" "$current_keys" || return
+
+  if ! git cat-file -e "$base_revision:$ratchet_file" 2>/dev/null; then
+    layering_ratchet_validate_bootstrap_snapshot "$current_keys" "$approved_initial_count" "$approved_initial_hash" || return
+    return
+  fi
+
+  git show "$base_revision:$ratchet_file" >"$base_file" || return
+  layering_ratchet_extract_keys "$base_file" "$base_keys" || return
+  LC_ALL=C comm -13 "$base_keys" "$current_keys" >"$additions" || return
+
+  if [[ -s "$additions" ]]; then
+    echo "::error::Layering ratchet contains new (from, denied) keys. Fix the dependency instead of adding rows." >&2
+    while IFS=$'\t' read -r from denied; do
+      printf 'from=%s denied=%s\n' "$from" "$denied" >&2
+    done <"$additions"
+    return 1
+  fi
+)
+
+if [[ "${BASH_SOURCE[0]}" == "$0" ]]; then
+  layering_ratchet_main "${1:-${QUALITY_GATE_CHANGED_FROM:-}}"
+fi

scripts/check-layering-ratchet.test.sh

@@ -0,0 +1,278 @@
+#!/usr/bin/env bash
+# Copyright (c) 2026 Lark Technologies Pte. Ltd.
+# SPDX-License-Identifier: MIT
+
+set -euo pipefail
+
+repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+script="$repo_root/scripts/check-layering-ratchet.sh"
+ratchet_file="internal/qualitygate/deptest/layering-edges.txt"
+tmp="$(mktemp -d "${TMPDIR:-/tmp}/check-layering-ratchet-test.XXXXXX")"
+source "$script"
+
+cleanup_tmp() {
+  rm -rf "$tmp"
+}
+trap cleanup_tmp EXIT
+
+row() {
+  printf '%s\t%s\towner\treason\t2026-07-24\n' "$1" "$2"
+}
+
+git_init() {
+  local dir="$1"
+  git init -q -b main "$dir"
+  git -C "$dir" config user.name test
+  git -C "$dir" config user.email test@example.com
+  mkdir -p "$dir/$(dirname "$ratchet_file")"
+}
+
+write_rows() {
+  local dir="$1"
+  shift
+  {
+    printf '# from\tdenied\towner\treason\tadded_at\n'
+    while (( $# > 0 )); do
+      row "$1" "$2"
+      shift 2
+    done
+  } >"$dir/$ratchet_file"
+}
+
+commit_ratchet() {
+  local dir="$1"
+  git -C "$dir" add "$ratchet_file"
+  git -C "$dir" commit -q -m "ratchet"
+}
+
+expect_pass() {
+  local dir="$1"
+  local base="$2"
+  if ! (cd "$dir" && bash "$script" "$base"); then
+    echo "Expected layering ratchet check to pass in $dir." >&2
+    return 1
+  fi
+}
+
+expect_fail() {
+  local dir="$1"
+  local base="$2"
+  local expected="$3"
+  local output
+  if output="$(cd "$dir" && bash "$script" "$base" 2>&1)"; then
+    echo "Expected layering ratchet check to fail in $dir." >&2
+    return 1
+  fi
+  if ! grep -Fq "$expected" <<<"$output"; then
+    printf 'Layering ratchet failure did not include %q:\n%s\n' "$expected" "$output" >&2
+    return 1
+  fi
+}
+
+hash_file() {
+  local source_file="$1"
+  if command -v sha256sum >/dev/null 2>&1; then
+    sha256sum "$source_file" | awk '{ print $1 }'
+  else
+    shasum -a 256 "$source_file" | awk '{ print $1 }'
+  fi
+}
+
+bootstrap_keys() {
+  local source_file="$1"
+  awk -F '\t' 'NF == 5 && $1 !~ /^[[:space:]]*#/ { print $1 "\t" $2 }' "$source_file" | LC_ALL=C sort
+}
+
+expect_bootstrap_pass() {
+  local dir="$1"
+  local base="$2"
+  local count="$3"
+  local hash="$4"
+  if ! (cd "$dir" && layering_ratchet_main "$base" "$count" "$hash"); then
+    echo "Expected layering ratchet bootstrap check to pass in $dir." >&2
+    return 1
+  fi
+}
+
+expect_bootstrap_fail() {
+  local dir="$1"
+  local base="$2"
+  local count="$3"
+  local hash="$4"
+  local output
+  if output="$(cd "$dir" && layering_ratchet_main "$base" "$count" "$hash" 2>&1)"; then
+    echo "Expected layering ratchet bootstrap check to fail in $dir." >&2
+    return 1
+  fi
+  if ! grep -Fq "bootstrap differs from the approved" <<<"$output"; then
+    printf 'Unexpected layering ratchet bootstrap failure:\n%s\n' "$output" >&2
+    return 1
+  fi
+}
+
+expect_sourced_main_fail() {
+  local dir="$1"
+  local base="$2"
+  local expected="$3"
+  local output
+  if output="$(cd "$dir" && layering_ratchet_main "$base" 2>&1)"; then
+    echo "Expected sourced layering ratchet main to fail in $dir." >&2
+    return 1
+  fi
+  if ! grep -Fq "$expected" <<<"$output"; then
+    printf 'Sourced layering ratchet failure did not include %q:\n%s\n' "$expected" "$output" >&2
+    return 1
+  fi
+}
+
+test_unchanged_and_metadata_changes_pass() {
+  local dir="$tmp/unchanged"
+  git_init "$dir"
+  write_rows "$dir" from/a denied/a from/b denied/b
+  commit_ratchet "$dir"
+  local base
+  base="$(git -C "$dir" rev-parse HEAD)"
+
+  expect_pass "$dir" "$base"
+  sed -i.bak 's/\towner\treason\t/\tnew-owner\tnew-reason\t/' "$dir/$ratchet_file"
+  rm -f "$dir/$ratchet_file.bak"
+  expect_pass "$dir" "$base"
+}
+
+test_deletion_passes() {
+  local dir="$tmp/deletion"
+  git_init "$dir"
+  write_rows "$dir" from/a denied/a from/b denied/b
+  commit_ratchet "$dir"
+  local base
+  base="$(git -C "$dir" rev-parse HEAD)"
+
+  write_rows "$dir" from/a denied/a
+  expect_pass "$dir" "$base"
+}
+
+test_addition_fails() {
+  local dir="$tmp/addition"
+  git_init "$dir"
+  write_rows "$dir" from/a denied/a
+  commit_ratchet "$dir"
+  local base
+  base="$(git -C "$dir" rev-parse HEAD)"
+
+  write_rows "$dir" from/a denied/a from/b denied/b
+  expect_fail "$dir" "$base" "from=from/b denied=denied/b"
+}
+
+test_equal_count_replacement_fails() {
+  local dir="$tmp/replacement"
+  git_init "$dir"
+  write_rows "$dir" from/a denied/a from/b denied/b
+  commit_ratchet "$dir"
+  local base
+  base="$(git -C "$dir" rev-parse HEAD)"
+
+  write_rows "$dir" from/a denied/a from/c denied/c
+  expect_fail "$dir" "$base" "from=from/c denied=denied/c"
+}
+
+test_malformed_and_missing_current_file_fail() {
+  local dir="$tmp/malformed"
+  git_init "$dir"
+  write_rows "$dir" from/a denied/a
+  commit_ratchet "$dir"
+  local base
+  base="$(git -C "$dir" rev-parse HEAD)"
+
+  printf 'from/a\tdenied/a\towner\treason\n' >"$dir/$ratchet_file"
+  expect_fail "$dir" "$base" "expected five tab-separated fields"
+  expect_sourced_main_fail "$dir" "$base" "expected five tab-separated fields"
+  rm -f "$dir/$ratchet_file"
+  expect_fail "$dir" "$base" "Layering ratchet file is missing"
+}
+
+test_surrounding_whitespace_fails() {
+  local dir="$tmp/surrounding-whitespace"
+  git_init "$dir"
+  write_rows "$dir" from/a denied/a
+  commit_ratchet "$dir"
+  local base
+  base="$(git -C "$dir" rev-parse HEAD)"
+
+  printf '# from\tdenied\towner\treason\tadded_at\nfrom/a\t denied/a \towner\treason\t2026-07-24\n' >"$dir/$ratchet_file"
+  expect_fail "$dir" "$base" "fields must not have surrounding whitespace"
+  expect_sourced_main_fail "$dir" "$base" "fields must not have surrounding whitespace"
+}
+
+test_crlf_rows_pass() {
+  local dir="$tmp/crlf"
+  git_init "$dir"
+  write_rows "$dir" from/a denied/a
+  commit_ratchet "$dir"
+  local base
+  base="$(git -C "$dir" rev-parse HEAD)"
+
+  printf '# from\tdenied\towner\treason\tadded_at\r\nfrom/a\tdenied/a\towner\treason\t2026-07-24\r\n' >"$dir/$ratchet_file"
+  expect_pass "$dir" "$base"
+}
+
+test_duplicate_key_fails() {
+  local dir="$tmp/duplicate"
+  git_init "$dir"
+  write_rows "$dir" from/a denied/a
+  commit_ratchet "$dir"
+  local base
+  base="$(git -C "$dir" rev-parse HEAD)"
+
+  write_rows "$dir" from/a denied/a from/a denied/a
+  expect_fail "$dir" "$base" "duplicate (from, denied) keys"
+}
+
+test_bootstrap_requires_the_approved_snapshot() {
+  local dir="$tmp/bootstrap"
+  git_init "$dir"
+  printf 'base\n' >"$dir/base.txt"
+  git -C "$dir" add base.txt
+  git -C "$dir" commit -q -m "base"
+  local base
+  base="$(git -C "$dir" rev-parse HEAD)"
+
+  local args=()
+  local index
+  for index in $(seq 1 39); do
+    args+=("from/$index" "denied/$index")
+  done
+  write_rows "$dir" "${args[@]}"
+  local keys_file="$dir/initial.keys"
+  bootstrap_keys "$dir/$ratchet_file" >"$keys_file"
+  local expected_hash
+  expected_hash="$(hash_file "$keys_file")"
+  expect_bootstrap_pass "$dir" "$base" 39 "$expected_hash"
+
+  args[76]="from/replacement"
+  write_rows "$dir" "${args[@]}"
+  expect_bootstrap_fail "$dir" "$base" 39 "$expected_hash"
+
+  args[76]="from/39"
+  args+=("from/40" "denied/40")
+  write_rows "$dir" "${args[@]}"
+  expect_bootstrap_fail "$dir" "$base" 39 "$expected_hash"
+}
+
+test_invalid_base_fails() {
+  local dir="$tmp/invalid-base"
+  git_init "$dir"
+  write_rows "$dir" from/a denied/a
+  commit_ratchet "$dir"
+  expect_fail "$dir" missing-revision "base revision does not exist"
+}
+
+test_unchanged_and_metadata_changes_pass
+test_deletion_passes
+test_addition_fails
+test_equal_count_replacement_fails
+test_malformed_and_missing_current_file_fail
+test_surrounding_whitespace_fails
+test_crlf_rows_pass
+test_duplicate_key_fails
+test_bootstrap_requires_the_approved_snapshot
+test_invalid_base_fails

scripts/ci-workflow.test.sh

@@ -170,6 +170,21 @@ if grep -Fq '${{ secrets.' <<<"$script_test_section"; then
   exit 1
 fi
 
+if ! grep -Fq 'bash scripts/check-layering-ratchet.sh "$QUALITY_GATE_CHANGED_FROM"' <<<"$lint_section"; then
+  echo "lint should enforce the layering ratchet with the tested key-set checker"
+  exit 1
+fi
+
+if grep -Fq "grep -vcE" <<<"$lint_section"; then
+  echo "lint should not enforce the layering ratchet by row count alone"
+  exit 1
+fi
+
+if grep -Fq "LAYERING_RATCHET_INITIAL_" "$workflow"; then
+  echo "CI must use the immutable checked-in layering bootstrap snapshot"
+  exit 1
+fi
+
 if grep -Fq "metadata-gate:" "$workflow"; then
   echo "metadata-gate should not run alongside deterministic-gate because both would upload the same facts artifact"
   exit 1

scripts/semantic-review-workflow.test.sh

@@ -176,15 +176,7 @@ if ! grep -Fq "if: always() && github.event.workflow_run.conclusion == 'success'
   exit 1
 fi
 
-if grep -Fq 'run.name !== "CI"' "$workflow"; then
-  echo "semantic-review must not use the dynamic workflow run name as workflow identity" >&2
-  exit 1
-fi
-
-require_in_step "$summary_verify_step" 'github.rest.actions.getWorkflow' "PR quality summary must resolve static workflow metadata"
-require_in_step "$summary_verify_step" 'workflow.name !== "CI"' "PR quality summary must verify the static workflow name"
-require_in_step "$summary_verify_step" 'workflow.path !== ".github/workflows/ci.yml"' "PR quality summary must verify the static workflow path"
-require_in_step "$summary_verify_step" 'run.path && run.path !== workflow.path' "PR quality summary must reject workflow path metadata mismatches"
+require_in_step "$summary_verify_step" 'workflowPath !== ".github/workflows/ci.yml"' "PR quality summary must verify the triggering workflow path"
 require_in_step "$summary_verify_step" 'run.event !== "pull_request"' "PR quality summary must only handle pull_request workflow_run events"
 require_in_step "$summary_verify_step" 'run.repository.id !== context.payload.repository.id' "PR quality summary must verify workflow_run repository id"
 require_in_step "$summary_verify_step" 'const targetHeadSha = run.head_sha' "PR quality summary must use the CI run head SHA as the verified PR head"
@@ -209,10 +201,7 @@ require_in_step "$summary_publish_step" 'CI_QUALITY_SUMMARY_BASE_SHA' "PR qualit
 require_in_step "$summary_publish_step" 'CI_QUALITY_SUMMARY_RUN_ID' "PR quality summary publisher must receive verified workflow run id"
 require_in_step "$summary_publish_step" 'require("./scripts/ci-quality-summary-publish.js")' "PR quality summary publisher must use the shared CI publisher script"
 
-require_in_step "$verify_step" 'github.rest.actions.getWorkflow' "semantic-review must resolve static workflow metadata"
-require_in_step "$verify_step" 'workflow.name !== "CI"' "semantic-review must verify the static workflow name"
-require_in_step "$verify_step" 'workflow.path !== ".github/workflows/ci.yml"' "semantic-review must verify the static workflow path"
-require_in_step "$verify_step" 'run.path && run.path !== workflow.path' "semantic-review must reject workflow path metadata mismatches"
+require_in_step "$verify_step" 'workflowPath !== ".github/workflows/ci.yml"' "semantic-review must verify the triggering workflow path"
 require_in_step "$verify_step" 'run.repository.id !== context.payload.repository.id' "semantic-review must verify workflow_run repository id"
 require_in_step "$verify_step" 'run.event !== "pull_request"' "semantic-review must only handle pull_request workflow_run events"
 require_in_step "$verify_step" 'run.conclusion !== "success"' "semantic-review must only consume successful CI runs"

shortcuts/base/base_form_execute_test.go

@@ -4,7 +4,6 @@
 package base
 
 import (
-	"encoding/json"
 	"strings"
 	"testing"
 
@@ -251,8 +250,7 @@ func TestBaseFormQuestionsExecuteList(t *testing.T) {
 				"total": 2,
 				"questions": []interface{}{
 					map[string]interface{}{"id": "q_001", "title": "您的姓名", "required": true, "description": nil},
-					map[string]interface{}{"id": "q_002", "title": "发票抬头", "required": false, "description": nil,
-						"visible_rule": map[string]interface{}{"logic": "and", "conditions": []interface{}{[]interface{}{"q_001", "==", "是"}}}},
+					map[string]interface{}{"id": "q_002", "title": "您的年龄", "required": false, "description": nil},
 				},
 			},
 		},
@@ -260,14 +258,9 @@ func TestBaseFormQuestionsExecuteList(t *testing.T) {
 	if err := runShortcut(t, BaseFormQuestionsList, []string{"+form-questions-list", "--base-token", "app_x", "--table-id", "tbl_x", "--form-id", "vew_form1"}, factory, stdout); err != nil {
 		t.Fatalf("err=%v", err)
 	}
-	got := stdout.String()
-	if !strings.Contains(got, `"q_001"`) || !strings.Contains(got, `"total": 2`) {
+	if got := stdout.String(); !strings.Contains(got, `"q_001"`) || !strings.Contains(got, `"total": 2`) {
 		t.Fatalf("stdout=%s", got)
 	}
-	// The list output must forward visible_rule verbatim so agents can read existing display conditions.
-	if !strings.Contains(got, `"visible_rule"`) {
-		t.Fatalf("visible_rule missing from list output: %s", got)
-	}
 }
 
 func TestBaseFormQuestionsExecuteCreate(t *testing.T) {
@@ -303,49 +296,11 @@ func TestBaseFormQuestionsExecuteCreate(t *testing.T) {
 			t.Fatalf("expected error for invalid questions JSON")
 		}
 	})
-
-	t.Run("visible_rule passthrough", func(t *testing.T) {
-		factory, stdout, reg := newExecuteFactory(t)
-		stub := &httpmock.Stub{
-			Method: "POST",
-			URL:    "/open-apis/base/v3/bases/app_x/tables/tbl_x/forms/vew_form1/questions",
-			Body: map[string]interface{}{
-				"code": 0,
-				"data": map[string]interface{}{
-					"questions": []interface{}{
-						map[string]interface{}{"id": "q_new1", "title": "发票抬头"},
-					},
-				},
-			},
-		}
-		reg.Register(stub)
-		args := []string{"+form-questions-create", "--base-token", "app_x", "--table-id", "tbl_x", "--form-id", "vew_form1",
-			"--questions", `[{"type":"text","title":"发票抬头","visible_rule":{"logic":"and","conditions":[["是否需要发票","==","是"]]}}]`}
-		if err := runShortcut(t, BaseFormQuestionsCreate, args, factory, stdout); err != nil {
-			t.Fatalf("err=%v", err)
-		}
-		var body struct {
-			Questions []map[string]interface{} `json:"questions"`
-		}
-		if err := json.Unmarshal(stub.CapturedBody, &body); err != nil {
-			t.Fatalf("captured body json err=%v body=%s", err, string(stub.CapturedBody))
-		}
-		if len(body.Questions) != 1 {
-			t.Fatalf("questions=%#v", body.Questions)
-		}
-		rule, ok := body.Questions[0]["visible_rule"].(map[string]interface{})
-		if !ok {
-			t.Fatalf("visible_rule not forwarded verbatim: body=%s", string(stub.CapturedBody))
-		}
-		if rule["logic"] != "and" {
-			t.Fatalf("visible_rule logic not preserved: %#v", rule)
-		}
-	})
 }
 
 func TestBaseFormQuestionsExecuteUpdate(t *testing.T) {
 	factory, stdout, reg := newExecuteFactory(t)
-	stub := &httpmock.Stub{
+	reg.Register(&httpmock.Stub{
 		Method: "PATCH",
 		URL:    "/open-apis/base/v3/bases/app_x/tables/tbl_x/forms/vew_form1/questions",
 		Body: map[string]interface{}{
@@ -356,29 +311,15 @@ func TestBaseFormQuestionsExecuteUpdate(t *testing.T) {
 				},
 			},
 		},
-	}
-	reg.Register(stub)
+	})
 	args := []string{"+form-questions-update", "--base-token", "app_x", "--table-id", "tbl_x", "--form-id", "vew_form1",
-		"--questions", `[{"id":"q_001","title":"更新后的问题","required":true,"visible_rule":{"logic":"and","conditions":[["q_002","==","是"]]}}]`}
+		"--questions", `[{"id":"q_001","title":"更新后的问题","required":true}]`}
 	if err := runShortcut(t, BaseFormQuestionsUpdate, args, factory, stdout); err != nil {
 		t.Fatalf("err=%v", err)
 	}
 	if got := stdout.String(); !strings.Contains(got, `"questions"`) || !strings.Contains(got, `"q_001"`) {
 		t.Fatalf("stdout=%s", got)
 	}
-	// visible_rule must be forwarded verbatim to the API (transcribe faithfully).
-	var body struct {
-		Questions []map[string]interface{} `json:"questions"`
-	}
-	if err := json.Unmarshal(stub.CapturedBody, &body); err != nil {
-		t.Fatalf("captured body json err=%v body=%s", err, string(stub.CapturedBody))
-	}
-	if len(body.Questions) != 1 {
-		t.Fatalf("questions=%#v", body.Questions)
-	}
-	if _, ok := body.Questions[0]["visible_rule"].(map[string]interface{}); !ok {
-		t.Fatalf("visible_rule not forwarded verbatim: body=%s", string(stub.CapturedBody))
-	}
 }
 
 func TestBaseFormQuestionsExecuteDelete(t *testing.T) {

shortcuts/base/base_form_questions_create.go

@@ -25,21 +25,14 @@ var BaseFormQuestionsCreate = common.Shortcut{
 		{Name: "base-token", Desc: "Base token (base_token)", Required: true},
 		{Name: "table-id", Desc: "table ID", Required: true},
 		{Name: "form-id", Desc: "form ID", Required: true},
-		{Name: "questions", Desc: `questions JSON array, max 10 items. Each item requires "title"(field title) and "type"(text/number/select/datetime/user/attachment/location). Optional fields: "description"(plain text or markdown link like [text](https://example.com)),"required","option_display_mode"(0=dropdown/1=vertical/2=horizontal,select only),"multiple"(bool,select/user),"options"([{"name":"opt","hue":"Blue"}],select only),"style"({"type":"plain/phone/url/email/barcode/rating","precision":2,"format":"yyyy/MM/dd","icon":"star","min":1,"max":5}),"visible_rule"(display condition; same shape as view filter {"logic":"and","conditions":[["前序题目","==","是"]]}, field references another question's title/id, empty/absent = always shown). E.g. '[{"type":"text","title":"Your name","required":true}]'`, Required: true},
+		{Name: "questions", Desc: `questions JSON array, max 10 items. Each item requires "title"(field title) and "type"(text/number/select/datetime/user/attachment/location). Optional fields: "description"(plain text or markdown link like [text](https://example.com)),"required","option_display_mode"(0=dropdown/1=vertical/2=horizontal,select only),"multiple"(bool,select/user),"options"([{"name":"opt","hue":"Blue"}],select only),"style"({"type":"plain/phone/url/email/barcode/rating","precision":2,"format":"yyyy/MM/dd","icon":"star","min":1,"max":5}). E.g. '[{"type":"text","title":"Your name","required":true}]'`, Required: true},
 	},
 	DryRun: func(ctx context.Context, runtime *common.RuntimeContext) *common.DryRunAPI {
-		api := common.NewDryRunAPI().
+		return common.NewDryRunAPI().
 			POST("/open-apis/base/v3/bases/:base_token/tables/:table_id/forms/:form_id/questions").
 			Set("base_token", runtime.Str("base-token")).
 			Set("table_id", runtime.Str("table-id")).
 			Set("form_id", runtime.Str("form-id"))
-		// Transcribe the questions body verbatim so the preview shows exactly
-		// what would be sent (including optional fields like visible_rule).
-		var questions []interface{}
-		if err := json.Unmarshal([]byte(runtime.Str("questions")), &questions); err == nil {
-			api.Body(map[string]interface{}{"questions": questions})
-		}
-		return api
 	},
 	Execute: func(ctx context.Context, runtime *common.RuntimeContext) error {
 		baseToken := runtime.Str("base-token")

shortcuts/base/base_form_questions_update.go

@@ -25,26 +25,14 @@ var BaseFormQuestionsUpdate = common.Shortcut{
 		{Name: "base-token", Desc: "Base token (base_token)", Required: true},
 		{Name: "table-id", Desc: "table ID", Required: true},
 		{Name: "form-id", Desc: "form ID", Required: true},
-		{Name: "questions", Desc: `questions JSON array, max 10 items, each item must include "id". Update uses full question overwrite semantics: omitted/empty fields are written as defaults/empty, so run +form-questions-list first and include existing values you want to keep. Supported fields: "id"(required),"title","description"(plain text or markdown link like [text](https://example.com)),"required","option_display_mode"(0=dropdown,1=vertical,2=horizontal,select only),"visible_rule"(display condition; same shape as view filter {"logic":"and","conditions":[["前序题目","==","是"]]}, field references another question's title/id; pass null or omit to clear). E.g. '[{"id":"q_001","title":"Updated?","required":true}]'`, Required: true},
-	},
-	Tips: []string{
-		"Update uses full question overwrite semantics, not a patch.",
-		"Run +form-questions-list first and include existing title/description/required/option_display_mode/visible_rule values you want to keep.",
-		"Omitted fields reset to defaults; empty strings, null, and empty arrays are written as empty/clear when accepted by the API.",
+		{Name: "questions", Desc: `questions JSON array, max 10 items, each item must include "id". Supported fields: "id"(required),"title","description"(plain text or markdown link like [text](https://example.com)),"required","option_display_mode"(0=dropdown,1=vertical,2=horizontal,select only). E.g. '[{"id":"q_001","title":"Updated?","required":true}]'`, Required: true},
 	},
 	DryRun: func(ctx context.Context, runtime *common.RuntimeContext) *common.DryRunAPI {
-		api := common.NewDryRunAPI().
+		return common.NewDryRunAPI().
 			PATCH("/open-apis/base/v3/bases/:base_token/tables/:table_id/forms/:form_id/questions").
 			Set("base_token", runtime.Str("base-token")).
 			Set("table_id", runtime.Str("table-id")).
 			Set("form_id", runtime.Str("form-id"))
-		// Transcribe the questions body verbatim so the preview shows exactly
-		// what would be sent (including optional fields like visible_rule).
-		var questions []interface{}
-		if err := json.Unmarshal([]byte(runtime.Str("questions")), &questions); err == nil {
-			api.Body(map[string]interface{}{"questions": questions})
-		}
-		return api
 	},
 	Execute: func(ctx context.Context, runtime *common.RuntimeContext) error {
 		baseToken := runtime.Str("base-token")

shortcuts/base/base_shortcuts_test.go

@@ -783,20 +783,6 @@ func TestBaseJSONExamplesLiveInFlagDescriptions(t *testing.T) {
 				`JSON array of question IDs to delete, max 10 items, e.g. '["q_001","q_002"]'`,
 			},
 		},
-		{
-			name:     "form question create visible_rule",
-			shortcut: BaseFormQuestionsCreate,
-			wantHelp: []string{
-				`"visible_rule"(display condition; same shape as view filter`,
-			},
-		},
-		{
-			name:     "form question update visible_rule",
-			shortcut: BaseFormQuestionsUpdate,
-			wantHelp: []string{
-				`"visible_rule"(display condition; same shape as view filter`,
-			},
-		},
 		{
 			name:     "record search json",
 			shortcut: BaseRecordSearch,
@@ -1042,39 +1028,6 @@ func TestBaseFieldUpdateHelpGuidesAgents(t *testing.T) {
 	}
 }
 
-func TestBaseFormQuestionsUpdateHelpGuidesFullOverwrite(t *testing.T) {
-	parent := &cobra.Command{Use: "base"}
-	BaseFormQuestionsUpdate.Mount(parent, &cmdutil.Factory{})
-	cmd := parent.Commands()[0]
-
-	help := cmd.Flags().FlagUsages()
-	wantHelp := []string{
-		"Update uses full question overwrite semantics",
-		"run +form-questions-list first",
-		"include existing values you want to keep",
-		"pass null or omit to clear",
-	}
-	for _, want := range wantHelp {
-		if !strings.Contains(help, want) {
-			t.Fatalf("flag help missing %q:\n%s", want, help)
-		}
-	}
-
-	tips := strings.Join(cmdutil.GetTips(cmd), "\n")
-	wantTips := []string{
-		"full question overwrite semantics, not a patch",
-		"Run +form-questions-list first",
-		"title/description/required/option_display_mode/visible_rule",
-		"Omitted fields reset to defaults",
-		"empty strings, null, and empty arrays are written as empty/clear",
-	}
-	for _, want := range wantTips {
-		if !strings.Contains(tips, want) {
-			t.Fatalf("tips missing %q:\n%s", want, tips)
-		}
-	}
-}
-
 func TestBaseAttachmentHelpGuidesAgents(t *testing.T) {
 	tests := []struct {
 		name     string

shortcuts/calendar/calendar_agenda.go

@@ -250,8 +250,6 @@ var CalendarAgenda = common.Shortcut{
 					}
 				}
 
-				collapseDescription(e)
-
 				filtered = append(filtered, e)
 			}
 		}

shortcuts/calendar/calendar_create.go

@@ -20,6 +20,7 @@ import (
 func buildEventData(runtime *common.RuntimeContext, startTs, endTs string) map[string]interface{} {
 	eventData := map[string]interface{}{
 		"summary":          runtime.Str("summary"),
+		"description":      runtime.Str("description"),
 		"start_time":       map[string]string{"timestamp": startTs},
 		"end_time":         map[string]string{"timestamp": endTs},
 		"attendee_ability": "can_modify_event",
@@ -32,9 +33,6 @@ func buildEventData(runtime *common.RuntimeContext, startTs, endTs string) map[s
 	if rrule := runtime.Str("rrule"); rrule != "" {
 		eventData["recurrence"] = rrule
 	}
-	if description := descriptionToSend(runtime); description != "" {
-		eventData["description_rich"] = description
-	}
 	return eventData
 }
 
@@ -120,7 +118,7 @@ var CalendarCreate = common.Shortcut{
 		{Name: "summary", Desc: "event title"},
 		{Name: "start", Desc: "start time (ISO 8601)", Required: true},
 		{Name: "end", Desc: "end time (ISO 8601)", Required: true},
-		{Name: "description", Desc: "event description as Markdown (@file or - for stdin); the unified description field. Supports bold/italic/underline/strikethrough, links, headings (`#`..`###`), blockquotes (`>`), ordered/unordered lists, horizontal rules (`---`), GFM tables, and images (`![name](url)`; a remote URL is used as-is, and a local image path relative to and inside the current working directory is auto-uploaded to Lark drive and rendered inline — absolute/out-of-cwd paths are rejected). A Lark doc URL (bare or as a Markdown link) is auto-resolved to an inline doc-mention chip showing its title. Inside a GFM table cell, stack multiple lines with `<br>`; each line may itself be an ordered/unordered list item, image or styled text (e.g. `1. a<br>2. b`, `- x<br>- y`, `![p](url)<br>**bold**`).", Input: []string{common.File, common.Stdin}},
+		{Name: "description", Desc: "event description"},
 		{Name: "attendee-ids", Desc: "attendee IDs, comma-separated (supports user ou_, chat oc_, room omm_)"},
 		{Name: "calendar-id", Desc: "calendar ID (default: primary)"},
 		{Name: "rrule", Desc: "recurrence rule (rfc5545)"},
@@ -233,9 +231,6 @@ var CalendarCreate = common.Shortcut{
 		if err != nil {
 			return errs.NewValidationError(errs.SubtypeInvalidArgument, "--end: %v", err).WithParam("--end")
 		}
-		if err := resolveDescriptionImages(runtime, calendarId); err != nil {
-			return err
-		}
 
 		eventData := buildEventData(runtime, startTs, endTs)
 

shortcuts/calendar/calendar_get.go

@@ -81,7 +81,6 @@ type calendarEvent struct {
 	OrganizerCalendarID string                    `json:"organizer_calendar_id,omitempty"`
 	Summary             string                    `json:"summary,omitempty"`
 	Description         string                    `json:"description,omitempty"`
-	DescriptionRich     string                    `json:"description_rich,omitempty"`
 	StartTime           *calendarEventTime        `json:"start_time,omitempty"`
 	EndTime             *calendarEventTime        `json:"end_time,omitempty"`
 	VChat               *calendarEventVChat       `json:"vchat,omitempty"`
@@ -170,7 +169,7 @@ func buildCalendarEventOutput(event *calendarEvent) (map[string]interface{}, err
 	if status, _ := out["status"].(string); status != "cancelled" {
 		delete(out, "status")
 	}
-	collapseDescription(out)
+
 	return out, nil
 }
 

shortcuts/calendar/calendar_test.go

@@ -988,15 +988,9 @@ func TestUpdate_PatchEventOnly(t *testing.T) {
 	if err := json.Unmarshal(stub.CapturedBody, &body); err != nil {
 		t.Fatalf("unmarshal captured patch body: %v", err)
 	}
-	// --description is the unified field, treated as rich text and sent as
-	// description_rich; the CLI never sends the plain description field
-	// (mutually exclusive downstream).
-	if body["summary"] != "Updated Meeting" || body["description_rich"] != "Updated description" {
+	if body["summary"] != "Updated Meeting" || body["description"] != "Updated description" {
 		t.Fatalf("unexpected patch body: %#v", body)
 	}
-	if _, ok := body["description"]; ok {
-		t.Fatalf("plain description must not be sent, got: %#v", body)
-	}
 	if body["need_notification"] != false {
 		t.Fatalf("need_notification = %#v, want false", body["need_notification"])
 	}
@@ -1370,62 +1364,6 @@ func TestAgenda_Success(t *testing.T) {
 	}
 }
 
-func TestAgenda_UnifiesDescriptionRich(t *testing.T) {
-	f, stdout, _, reg := cmdutil.TestFactory(t, defaultConfig())
-
-	reg.Register(&httpmock.Stub{
-		Method: "GET",
-		URL:    "/events/instance_view",
-		Body: map[string]interface{}{
-			"code": 0, "msg": "ok",
-			"data": map[string]interface{}{
-				"items": []interface{}{
-					map[string]interface{}{
-						"event_id":         "evt_rich",
-						"summary":          "Rich",
-						"status":           "confirmed",
-						"description":      "[测试]\n友情提醒",
-						"description_rich": "友情提醒",
-						"start_time":       map[string]interface{}{"timestamp": "1742515200"},
-						"end_time":         map[string]interface{}{"timestamp": "1742518800"},
-					},
-					map[string]interface{}{
-						"event_id":    "evt_plain",
-						"summary":     "Plain",
-						"status":      "confirmed",
-						"description": "just text",
-						"start_time":  map[string]interface{}{"timestamp": "1742515200"},
-						"end_time":    map[string]interface{}{"timestamp": "1742518800"},
-					},
-				},
-			},
-		},
-	})
-
-	err := mountAndRun(t, CalendarAgenda, []string{
-		"+agenda",
-		"--start", "2025-03-21",
-		"--end", "2025-03-21",
-		"--as", "bot",
-	}, f, stdout)
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	out := stdout.String()
-	// Read exposes a single unified description field: it carries the rich
-	// (Markdown) value when present, and the plain text otherwise. The internal
-	// description_rich key is never surfaced.
-	if !strings.Contains(out, "\"description\": \"友情提醒\"") {
-		t.Errorf("expected rich value surfaced under description, got: %s", out)
-	}
-	if !strings.Contains(out, "\"description\": \"just text\"") {
-		t.Errorf("expected plain description surfaced for plain-only event, got: %s", out)
-	}
-	if strings.Contains(out, "description_rich") {
-		t.Errorf("description_rich must not appear in output, got: %s", out)
-	}
-}
-
 func TestAgenda_EmptyResult(t *testing.T) {
 	f, stdout, _, reg := cmdutil.TestFactory(t, defaultConfig())
 
@@ -3437,72 +3375,6 @@ func TestGet_Success_FlattensAndConvertsTimes(t *testing.T) {
 	}
 }
 
-func TestGet_UnifiesDescriptionRich(t *testing.T) {
-	// Read exposes a single unified description field carrying the rich value
-	// when present, and the plain text otherwise; description_rich is dropped.
-	t.Run("rich present", func(t *testing.T) {
-		f, stdout, _, reg := cmdutil.TestFactory(t, defaultConfig())
-		reg.Register(&httpmock.Stub{
-			Method: "GET",
-			URL:    "/open-apis/calendar/v4/calendars/cal_test123/events/evt_rich",
-			Body: map[string]interface{}{
-				"code": 0, "msg": "success",
-				"data": map[string]interface{}{
-					"event": map[string]interface{}{
-						"event_id":         "evt_rich",
-						"summary":          "Rich",
-						"description":      "[表格]",
-						"description_rich": "| a | b |\n| --- | --- |\n| c | d |",
-						"start_time":       map[string]interface{}{"timestamp": "1742515200", "timezone": "Asia/Shanghai"},
-						"end_time":         map[string]interface{}{"timestamp": "1742518800", "timezone": "Asia/Shanghai"},
-					},
-				},
-			},
-		})
-		if err := mountAndRun(t, CalendarGet, []string{"+get", "--calendar-id", "cal_test123", "--event-id", "evt_rich", "--as", "bot"}, f, stdout); err != nil {
-			t.Fatalf("unexpected error: %v", err)
-		}
-		out := stdout.String()
-		if !strings.Contains(out, "| a | b |") {
-			t.Errorf("expected rich value surfaced under description, got: %s", out)
-		}
-		if strings.Contains(out, "description_rich") {
-			t.Errorf("description_rich must not appear in output, got: %s", out)
-		}
-	})
-
-	// When only a plain description exists, it is surfaced under description.
-	t.Run("only plain surfaces under description", func(t *testing.T) {
-		f, stdout, _, reg := cmdutil.TestFactory(t, defaultConfig())
-		reg.Register(&httpmock.Stub{
-			Method: "GET",
-			URL:    "/open-apis/calendar/v4/calendars/cal_test123/events/evt_plain",
-			Body: map[string]interface{}{
-				"code": 0, "msg": "success",
-				"data": map[string]interface{}{
-					"event": map[string]interface{}{
-						"event_id":    "evt_plain",
-						"summary":     "Plain",
-						"description": "just text",
-						"start_time":  map[string]interface{}{"timestamp": "1742515200", "timezone": "Asia/Shanghai"},
-						"end_time":    map[string]interface{}{"timestamp": "1742518800", "timezone": "Asia/Shanghai"},
-					},
-				},
-			},
-		})
-		if err := mountAndRun(t, CalendarGet, []string{"+get", "--calendar-id", "cal_test123", "--event-id", "evt_plain", "--as", "bot"}, f, stdout); err != nil {
-			t.Fatalf("unexpected error: %v", err)
-		}
-		out := stdout.String()
-		if !strings.Contains(out, "\"description\": \"just text\"") {
-			t.Errorf("expected plain description surfaced, got: %s", out)
-		}
-		if strings.Contains(out, "description_rich") {
-			t.Errorf("description_rich must not appear in output, got: %s", out)
-		}
-	})
-}
-
 func TestGet_CancelledStatus_PreservesStatus(t *testing.T) {
 	f, stdout, _, reg := cmdutil.TestFactory(t, defaultConfig())
 

shortcuts/calendar/calendar_update.go

@@ -29,7 +29,7 @@ var CalendarUpdate = common.Shortcut{
 		{Name: "event-id", Desc: "event ID to update", Required: true},
 		{Name: "calendar-id", Desc: "calendar ID (default: primary)"},
 		{Name: "summary", Desc: "event title"},
-		{Name: "description", Desc: "event description as Markdown (@file or - for stdin); the unified description field. Supports bold/italic/underline/strikethrough, links, headings (`#`..`###`), blockquotes (`>`), ordered/unordered lists, horizontal rules (`---`), GFM tables, and images (`![name](url)`; a remote URL is used as-is, and a local image path relative to and inside the current working directory is auto-uploaded to Lark drive and rendered inline — absolute/out-of-cwd paths are rejected). A Lark doc URL (bare or as a Markdown link) is auto-resolved to an inline doc-mention chip showing its title. Inside a GFM table cell, stack multiple lines with `<br>`; each line may itself be an ordered/unordered list item, image or styled text (e.g. `1. a<br>2. b`, `- x<br>- y`, `![p](url)<br>**bold**`). Passing an empty string clears the description.", Input: []string{common.File, common.Stdin}},
+		{Name: "description", Desc: "event description"},
 		{Name: "start", Desc: "new start time (ISO 8601); requires --end"},
 		{Name: "end", Desc: "new end time (ISO 8601); requires --start"},
 		{Name: "rrule", Desc: "recurrence rule (rfc5545)"},
@@ -109,13 +109,11 @@ func buildCalendarUpdateEventData(runtime *common.RuntimeContext) (map[string]in
 	body := map[string]interface{}{}
 	hasFields := false
 
-	if runtime.Cmd.Flags().Changed("summary") {
-		body["summary"] = runtime.Str("summary")
-		hasFields = true
-	}
-	if runtime.Cmd.Flags().Changed("description") {
-		body["description_rich"] = runtime.Str("description")
-		hasFields = true
+	for _, field := range []string{"summary", "description"} {
+		if runtime.Cmd.Flags().Changed(field) {
+			body[field] = runtime.Str(field)
+			hasFields = true
+		}
 	}
 	if runtime.Cmd.Flags().Changed("rrule") {
 		rrule := strings.TrimSpace(runtime.Str("rrule"))
@@ -358,12 +356,6 @@ func executeCalendarUpdate(ctx context.Context, runtime *common.RuntimeContext)
 		return errs.NewValidationError(errs.SubtypeInvalidArgument, "specify --event-id").WithParam("--event-id")
 	}
 
-	if runtime.Cmd.Flags().Changed("description") {
-		if err := resolveDescriptionImages(runtime, calendarID); err != nil {
-			return err
-		}
-	}
-
 	body, hasEventFields, err := buildCalendarUpdateEventData(runtime)
 	if err != nil {
 		return err
@@ -436,10 +428,8 @@ func calendarUpdateResult(eventID string, event map[string]interface{}, addedCou
 	if summary, _ := event["summary"].(string); summary != "" {
 		result["summary"] = summary
 	}
-	if rich, _ := event["description_rich"].(string); rich != "" {
-		result["description"] = rich
-	} else if plain, _ := event["description"].(string); plain != "" {
-		result["description"] = plain
+	if description, _ := event["description"].(string); description != "" {
+		result["description"] = description
 	}
 	if start := formatCalendarEventTime(event["start_time"]); start != "" {
 		result["start"] = start

shortcuts/calendar/description_rich_images.go

@@ -1,172 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package calendar
-
-import (
-	"fmt"
-	"image"
-
-	// Register the common image decoders so DecodeConfig can read intrinsic
-	// dimensions for PNG/JPEG/GIF sources.
-	_ "image/gif"
-	_ "image/jpeg"
-	_ "image/png"
-	"net/url"
-	"path/filepath"
-	"regexp"
-	"strings"
-
-	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/core"
-	"github.com/larksuite/cli/internal/validate"
-	"github.com/larksuite/cli/shortcuts/common"
-)
-
-const calendarMediaParentType = "calendar"
-
-var markdownImageRe = regexp.MustCompile(`!\[([^\]]*)\]\(([^)]*)\)`)
-
-func resolveDescriptionImages(runtime *common.RuntimeContext, calendarID string) error {
-	md := runtime.Str("description")
-	if md == "" || !strings.Contains(md, "![") {
-		return nil
-	}
-	rewritten, changed, err := uploadLocalDescriptionImages(runtime, calendarID, md)
-	if err != nil {
-		return err
-	}
-	if changed {
-		if err := runtime.Cmd.Flags().Set("description", rewritten); err != nil {
-			return errs.NewInternalError(errs.SubtypeUnknown, "failed to update --description after image upload: %v", err).WithCause(err)
-		}
-	}
-	return nil
-}
-
-func uploadLocalDescriptionImages(runtime *common.RuntimeContext, calendarID, md string) (string, bool, error) {
-	matches := markdownImageRe.FindAllStringSubmatchIndex(md, -1)
-	if len(matches) == 0 {
-		return md, false, nil
-	}
-	var out strings.Builder
-	last := 0
-	changed := false
-	cache := map[string]string{}
-	for _, m := range matches {
-		altStart, altEnd, srcStart, srcEnd := m[2], m[3], m[4], m[5]
-		src := strings.TrimSpace(md[srcStart:srcEnd])
-		if !isLocalImageSrc(src) {
-			continue
-		}
-		alt := md[altStart:altEnd]
-		uploadedURL, err := resolveLocalImage(runtime, calendarID, src, alt, cache)
-		if err != nil {
-			return "", false, err
-		}
-		out.WriteString(md[last:srcStart])
-		out.WriteString(uploadedURL)
-		last = srcEnd
-		changed = true
-	}
-	if !changed {
-		return md, false, nil
-	}
-	out.WriteString(md[last:])
-	return out.String(), true, nil
-}
-
-func resolveLocalImage(runtime *common.RuntimeContext, calendarID, src, alt string, cache map[string]string) (string, error) {
-	localPath := localImagePath(src)
-	if cached, ok := cache[localPath]; ok {
-		return cached, nil
-	}
-
-	safePath, err := validate.SafeInputPath(localPath)
-	if err != nil {
-		return "", errs.NewValidationError(errs.SubtypeInvalidArgument,
-			"--description image %q could not be read: %v", src, err).
-			WithParam("--description").
-			WithHint("reference local images by a path inside the current working directory (e.g. ./images/pic.png; cd there first), or use an already-uploaded Lark image URL").
-			WithCause(err)
-	}
-
-	info, err := runtime.FileIO().Stat(localPath)
-	if err != nil {
-		return "", common.WrapInputStatErrorTyped(err)
-	}
-
-	fileToken, err := common.UploadDriveMediaAllTyped(runtime, common.DriveMediaUploadAllConfig{
-		FilePath:   localPath,
-		FileName:   filepath.Base(safePath),
-		FileSize:   info.Size(),
-		ParentType: calendarMediaParentType,
-		ParentNode: &calendarID,
-	})
-	if err != nil {
-		return "", err
-	}
-
-	width, height := decodeImageDimensions(runtime, localPath)
-	uploadedURL := buildCalendarImagePreviewURL(runtime.Config.Brand, fileToken, width, height, info.Size())
-	cache[localPath] = uploadedURL
-	return uploadedURL, nil
-}
-
-func decodeImageDimensions(runtime *common.RuntimeContext, path string) (int, int) {
-	f, err := runtime.FileIO().Open(path)
-	if err != nil {
-		return 0, 0
-	}
-	defer f.Close()
-	cfg, _, err := image.DecodeConfig(f)
-	if err != nil {
-		return 0, 0
-	}
-	return cfg.Width, cfg.Height
-}
-
-func isLocalImageSrc(src string) bool {
-	if src == "" {
-		return false
-	}
-	lower := strings.ToLower(src)
-	switch {
-	case strings.HasPrefix(lower, "http://"), strings.HasPrefix(lower, "https://"), strings.HasPrefix(lower, "data:"):
-		return false
-	case strings.HasPrefix(lower, "file://"):
-		return true
-	}
-	if i := strings.Index(src, "://"); i > 0 {
-		return false
-	}
-	return true
-}
-
-func localImagePath(src string) string {
-	s := strings.TrimSpace(src)
-	if strings.HasPrefix(strings.ToLower(s), "file://") {
-		if u, err := url.Parse(s); err == nil && u.Path != "" {
-			s = u.Path
-		}
-	}
-	if decoded, err := url.PathUnescape(s); err == nil {
-		return decoded
-	}
-	return s
-}
-
-func buildCalendarImagePreviewURL(brand core.LarkBrand, fileToken string, width, height int, size int64) string {
-	host := "internal-api-drive-stream.feishu.cn"
-	if brand == core.BrandLark {
-		host = "internal-api-drive-stream.larksuite.com"
-	}
-	u := fmt.Sprintf("https://%s/space/api/box/stream/download/preview/%s?preview_type=16", host, fileToken)
-	if width > 0 && height > 0 {
-		u += fmt.Sprintf("&im_w=%d&im_h=%d", width, height)
-	}
-	if size > 0 {
-		u += fmt.Sprintf("&im_size=%d", size)
-	}
-	return u
-}

shortcuts/calendar/description_rich_images_test.go

@@ -1,279 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package calendar
-
-import (
-	"bytes"
-	"encoding/json"
-	"errors"
-	"image"
-	"image/png"
-	"net/url"
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-
-	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
-	"github.com/larksuite/cli/internal/httpmock"
-)
-
-func TestIsLocalImageSrc(t *testing.T) {
-	cases := []struct {
-		src  string
-		want bool
-	}{
-		{"./images/pic.png", true},
-		{"images/pic.png", true},
-		{"../assets/a.png", true},
-		{"/Users/me/Desktop/a.png", true},
-		{`C:\Users\me\a.png`, true},
-		{"file:///Users/me/a.png", true},
-		{"图片和附件/测试图片.png", true},
-		{"https://example.com/a.png", false},
-		{"http://example.com/a.png", false},
-		{"HTTPS://EXAMPLE.com/a.png", false},
-		{"data:image/png;base64,iVBOR", false},
-		{"ftp://host/a.png", false},
-		{"", false},
-	}
-	for _, c := range cases {
-		if got := isLocalImageSrc(c.src); got != c.want {
-			t.Errorf("isLocalImageSrc(%q) = %v, want %v", c.src, got, c.want)
-		}
-	}
-}
-
-func TestLocalImagePath(t *testing.T) {
-	cases := []struct{ in, want string }{
-		{"images/pic.png", "images/pic.png"},
-		{"images/my%20pic.png", "images/my pic.png"},
-		{"file:///Users/me/a.png", "/Users/me/a.png"},
-	}
-	for _, c := range cases {
-		if got := localImagePath(c.in); got != c.want {
-			t.Errorf("localImagePath(%q) = %q, want %q", c.in, got, c.want)
-		}
-	}
-}
-
-// TestBuildCalendarImagePreviewURL guards the contract the OpenAPI service
-// relies on: a Lark host (so token extraction triggers) whose final path
-// segment is exactly the uploaded file token.
-func TestBuildCalendarImagePreviewURL(t *testing.T) {
-	for _, tc := range []struct {
-		brand    core.LarkBrand
-		hostFrag string
-	}{
-		{core.BrandFeishu, "feishu.cn"},
-		{core.BrandLark, "larksuite"},
-	} {
-		raw := buildCalendarImagePreviewURL(tc.brand, "boxcnTOKEN123", 416, 306, 142568)
-		u, err := url.Parse(raw)
-		if err != nil {
-			t.Fatalf("built URL not parseable: %v", err)
-		}
-		if !strings.Contains(u.Host, tc.hostFrag) {
-			t.Errorf("brand %s host = %q, want fragment %q", tc.brand, u.Host, tc.hostFrag)
-		}
-		segs := strings.Split(strings.Trim(u.Path, "/"), "/")
-		if last := segs[len(segs)-1]; last != "boxcnTOKEN123" {
-			t.Errorf("last path segment = %q, want token", last)
-		}
-		q := u.Query()
-		if q.Get("im_w") != "416" || q.Get("im_h") != "306" || q.Get("im_size") != "142568" {
-			t.Errorf("dimension params missing: im_w=%q im_h=%q im_size=%q", q.Get("im_w"), q.Get("im_h"), q.Get("im_size"))
-		}
-	}
-
-	// With unknown dimensions the helper params are omitted entirely.
-	raw := buildCalendarImagePreviewURL(core.BrandFeishu, "boxcnTOKEN123", 0, 0, 0)
-	if strings.Contains(raw, "im_w") || strings.Contains(raw, "im_size") {
-		t.Errorf("expected no dimension params for unknown size, got %q", raw)
-	}
-}
-
-// TestUploadLocalDescriptionImages_RemoteUntouched verifies remote/data images
-// pass through unchanged and never trigger an upload (runtime unused → nil).
-func TestUploadLocalDescriptionImages_RemoteUntouched(t *testing.T) {
-	md := "text ![a](https://example.com/a.png) more ![b](data:image/png;base64,xx)"
-	got, changed, err := uploadLocalDescriptionImages(nil, "cal", md)
-	if err != nil {
-		t.Fatalf("unexpected err: %v", err)
-	}
-	if changed {
-		t.Errorf("changed = true, want false")
-	}
-	if got != md {
-		t.Errorf("markdown mutated: %q", got)
-	}
-}
-
-// TestCreate_UploadsLocalDescriptionImage runs +create with a local image path,
-// mocks the drive upload, and asserts the create body's description_rich carries
-// the uploaded token (not the local path).
-func TestCreate_UploadsLocalDescriptionImage(t *testing.T) {
-	dir := t.TempDir()
-	orig, err := os.Getwd()
-	if err != nil {
-		t.Fatal(err)
-	}
-	if err := os.Chdir(dir); err != nil {
-		t.Fatal(err)
-	}
-	defer os.Chdir(orig)
-	if err := os.WriteFile(filepath.Join(dir, "pic.png"), []byte("PNGDATA"), 0600); err != nil {
-		t.Fatal(err)
-	}
-
-	f, stdout, _, reg := cmdutil.TestFactory(t, defaultConfig())
-
-	uploadStub := &httpmock.Stub{
-		Method: "POST",
-		URL:    "/open-apis/drive/v1/medias/upload_all",
-		Body:   map[string]interface{}{"code": 0, "msg": "ok", "data": map[string]interface{}{"file_token": "boxcnTOKEN123"}},
-	}
-	reg.Register(uploadStub)
-
-	createStub := &httpmock.Stub{
-		Method: "POST",
-		URL:    "/open-apis/calendar/v4/calendars/cal_test123/events",
-		Body: map[string]interface{}{"code": 0, "msg": "ok", "data": map[string]interface{}{
-			"event": map[string]interface{}{
-				"event_id":   "evt_001",
-				"summary":    "Pic",
-				"start_time": map[string]interface{}{"timestamp": "1742515200"},
-				"end_time":   map[string]interface{}{"timestamp": "1742518800"},
-			},
-		}},
-	}
-	reg.Register(createStub)
-
-	runErr := mountAndRun(t, CalendarCreate, []string{
-		"+create",
-		"--summary", "Pic",
-		"--start", "2025-03-21T00:00:00+08:00",
-		"--end", "2025-03-21T01:00:00+08:00",
-		"--calendar-id", "cal_test123",
-		"--description", "![pic](./pic.png)",
-		"--as", "bot",
-	}, f, stdout)
-	if runErr != nil {
-		t.Fatalf("unexpected error: %v", runErr)
-	}
-
-	if uploadStub.CapturedBody == nil {
-		t.Fatalf("expected drive upload to be called")
-	}
-	if createStub.CapturedBody == nil {
-		t.Fatalf("expected create event to be called")
-	}
-	var body map[string]interface{}
-	if err := json.Unmarshal(createStub.CapturedBody, &body); err != nil {
-		t.Fatalf("create body unmarshal: %v", err)
-	}
-	dr, _ := body["description_rich"].(string)
-	if !strings.Contains(dr, "boxcnTOKEN123") {
-		t.Fatalf("description_rich should contain uploaded token, got %q", dr)
-	}
-	if strings.Contains(dr, "./pic.png") {
-		t.Fatalf("local path should be rewritten away, got %q", dr)
-	}
-}
-
-// TestCreate_LocalImageCarriesDimensions verifies a real decodable image's
-// intrinsic width/height and byte size are appended to the rewritten drive URL
-// (so the facade can populate originalWidth/originalHeight and the client can
-// render the image inline).
-func TestCreate_LocalImageCarriesDimensions(t *testing.T) {
-	dir := t.TempDir()
-	orig, err := os.Getwd()
-	if err != nil {
-		t.Fatal(err)
-	}
-	if err := os.Chdir(dir); err != nil {
-		t.Fatal(err)
-	}
-	defer os.Chdir(orig)
-
-	var buf bytes.Buffer
-	if err := png.Encode(&buf, image.NewRGBA(image.Rect(0, 0, 5, 7))); err != nil {
-		t.Fatal(err)
-	}
-	if err := os.WriteFile(filepath.Join(dir, "pic.png"), buf.Bytes(), 0600); err != nil {
-		t.Fatal(err)
-	}
-
-	f, stdout, _, reg := cmdutil.TestFactory(t, defaultConfig())
-	reg.Register(&httpmock.Stub{
-		Method: "POST",
-		URL:    "/open-apis/drive/v1/medias/upload_all",
-		Body:   map[string]interface{}{"code": 0, "msg": "ok", "data": map[string]interface{}{"file_token": "boxcnTOKEN123"}},
-	})
-	createStub := &httpmock.Stub{
-		Method: "POST",
-		URL:    "/open-apis/calendar/v4/calendars/cal_test123/events",
-		Body: map[string]interface{}{"code": 0, "msg": "ok", "data": map[string]interface{}{
-			"event": map[string]interface{}{
-				"event_id":   "evt_001",
-				"summary":    "Pic",
-				"start_time": map[string]interface{}{"timestamp": "1742515200"},
-				"end_time":   map[string]interface{}{"timestamp": "1742518800"},
-			},
-		}},
-	}
-	reg.Register(createStub)
-
-	runErr := mountAndRun(t, CalendarCreate, []string{
-		"+create",
-		"--summary", "Pic",
-		"--start", "2025-03-21T00:00:00+08:00",
-		"--end", "2025-03-21T01:00:00+08:00",
-		"--calendar-id", "cal_test123",
-		"--description", "![pic](./pic.png)",
-		"--as", "bot",
-	}, f, stdout)
-	if runErr != nil {
-		t.Fatalf("unexpected error: %v", runErr)
-	}
-	var body map[string]interface{}
-	if err := json.Unmarshal(createStub.CapturedBody, &body); err != nil {
-		t.Fatalf("create body unmarshal: %v", err)
-	}
-	dr, _ := body["description_rich"].(string)
-	if !strings.Contains(dr, "im_w=5") || !strings.Contains(dr, "im_h=7") {
-		t.Fatalf("description_rich should carry image dimensions, got %q", dr)
-	}
-	if !strings.Contains(dr, "im_size=") {
-		t.Fatalf("description_rich should carry image byte size, got %q", dr)
-	}
-}
-
-// TestCreate_LocalImageAbsolutePathRejected verifies an out-of-cwd absolute path
-// yields a typed --description validation error before any API call.
-func TestCreate_LocalImageAbsolutePathRejected(t *testing.T) {
-	f, stdout, _, _ := cmdutil.TestFactory(t, defaultConfig())
-
-	runErr := mountAndRun(t, CalendarCreate, []string{
-		"+create",
-		"--summary", "Pic",
-		"--start", "2025-03-21T00:00:00+08:00",
-		"--end", "2025-03-21T01:00:00+08:00",
-		"--calendar-id", "cal_test123",
-		"--description", "![p](/etc/hosts)",
-		"--as", "bot",
-	}, f, stdout)
-	if runErr == nil {
-		t.Fatalf("expected error for absolute image path")
-	}
-	var ve *errs.ValidationError
-	if !errors.As(runErr, &ve) {
-		t.Fatalf("expected *errs.ValidationError, got %T: %v", runErr, runErr)
-	}
-	if ve.Param != "--description" {
-		t.Errorf("param = %q, want --description", ve.Param)
-	}
-}

shortcuts/calendar/helpers.go

@@ -30,26 +30,6 @@ func resolveStartEnd(runtime *common.RuntimeContext) (string, string) {
 	return startInput, endInput
 }
 
-func collapseDescription(event map[string]interface{}) {
-	if event == nil {
-		return
-	}
-	rich, _ := event["description_rich"].(string)
-	plain, _ := event["description"].(string)
-	delete(event, "description_rich")
-	switch {
-	case rich != "":
-		event["description"] = rich
-	case plain != "":
-		event["description"] = plain
-	default:
-		delete(event, "description")
-	}
-}
-func descriptionToSend(runtime *common.RuntimeContext) string {
-	return runtime.Str("description")
-}
-
 func hasExplicitBotFlag(cmd *cobra.Command) bool {
 	if cmd == nil {
 		return false

shortcuts/drive/drive_member_list.go

@@ -1,325 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package drive
-
-import (
-	"context"
-	"fmt"
-	"io"
-	"net/url"
-	"strings"
-
-	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/validate"
-	"github.com/larksuite/cli/shortcuts/common"
-)
-
-type driveMemberListSpec struct {
-	Token    string
-	Type     string
-	Fields   string
-	PermType string
-}
-
-var driveMemberListTypes = []string{
-	"doc", "sheet", "file", "wiki", "bitable", "docx",
-	"mindnote", "minutes", "slides", "folder",
-}
-
-var driveMemberListFields = []string{"name", "type", "avatar", "external_label"}
-var driveMemberListPermTypes = []string{"container", "single_page"}
-
-var driveMemberListURLPathToType = []struct {
-	Prefix string
-	Type   string
-}{
-	{"/drive/folder/", "folder"},
-	{"/docx/", "docx"},
-	{"/doc/", "doc"},
-	{"/sheets/", "sheet"},
-	{"/base/", "bitable"},
-	{"/bitable/", "bitable"},
-	{"/wiki/", "wiki"},
-	{"/file/", "file"},
-	{"/mindnotes/", "mindnote"},
-	{"/slides/", "slides"},
-	{"/minutes/", "minutes"},
-}
-
-func readDriveMemberListSpec(runtime *common.RuntimeContext) (driveMemberListSpec, error) {
-	token, resourceType, err := resolveDriveMemberListTarget(runtime.Str("token"), runtime.Str("type"))
-	if err != nil {
-		return driveMemberListSpec{}, err
-	}
-	fields, err := normalizeDriveMemberListFields(runtime.Str("fields"), runtime.Changed("fields"))
-	if err != nil {
-		return driveMemberListSpec{}, err
-	}
-	permType, err := normalizeDriveMemberListPermType(runtime.Str("perm-type"), resourceType, runtime.Changed("perm-type"))
-	if err != nil {
-		return driveMemberListSpec{}, err
-	}
-	return driveMemberListSpec{
-		Token:    token,
-		Type:     resourceType,
-		Fields:   fields,
-		PermType: permType,
-	}, nil
-}
-
-func resolveDriveMemberListTarget(raw, explicitType string) (token, resourceType string, err error) {
-	raw = strings.TrimSpace(raw)
-	if raw == "" {
-		return "", "", errs.NewValidationError(errs.SubtypeInvalidArgument, "--token is required").WithParam("--token")
-	}
-
-	explicitType, err = normalizeDriveMemberListEnumValue(explicitType, driveMemberListTypes, "--type")
-	if err != nil {
-		return "", "", err
-	}
-
-	if strings.Contains(raw, "://") {
-		parsed, parseErr := url.Parse(raw)
-		if parseErr != nil || parsed.Hostname() == "" {
-			return "", "", errs.NewValidationError(errs.SubtypeInvalidArgument, "--token URL is malformed: %q", raw).WithParam("--token")
-		}
-		ref, ok := parseDriveMemberListResourceURLPath(parsed.Path)
-		if !ok {
-			return "", "", errs.NewValidationError(
-				errs.SubtypeInvalidArgument,
-				"unsupported --token URL %q: pass a recognized Lark Drive document/folder URL or a bare token with --type",
-				raw,
-			).WithParam("--token")
-		}
-		if explicitType != "" && explicitType != ref.Type {
-			return "", "", errs.NewValidationError(
-				errs.SubtypeInvalidArgument,
-				"--type %q conflicts with URL path type %q; remove --type or use a matching value",
-				explicitType,
-				ref.Type,
-			).WithParam("--type")
-		}
-		if err := validate.ResourceName(ref.Token, "--token"); err != nil {
-			return "", "", errs.NewValidationError(errs.SubtypeInvalidArgument, "%s", err).WithParam("--token")
-		}
-		return ref.Token, ref.Type, nil
-	}
-
-	if explicitType == "" {
-		return "", "", errs.NewValidationError(
-			errs.SubtypeInvalidArgument,
-			"--type is required when --token is a bare token; accepted values: %s",
-			strings.Join(driveMemberListTypes, ", "),
-		).WithParam("--type")
-	}
-	if err := validate.ResourceName(raw, "--token"); err != nil {
-		return "", "", errs.NewValidationError(errs.SubtypeInvalidArgument, "%s", err).WithParam("--token")
-	}
-	return raw, explicitType, nil
-}
-
-func parseDriveMemberListResourceURLPath(path string) (common.ResourceRef, bool) {
-	for _, mapping := range driveMemberListURLPathToType {
-		if !strings.HasPrefix(path, mapping.Prefix) {
-			continue
-		}
-		token := path[len(mapping.Prefix):]
-		token = strings.TrimRight(token, "/")
-		if idx := strings.IndexByte(token, '/'); idx >= 0 {
-			token = token[:idx]
-		}
-		token = strings.TrimSpace(token)
-		if token == "" {
-			return common.ResourceRef{}, false
-		}
-		return common.ResourceRef{Type: mapping.Type, Token: token}, true
-	}
-	return common.ResourceRef{}, false
-}
-
-func normalizeDriveMemberListFields(raw string, changed bool) (string, error) {
-	raw = strings.TrimSpace(raw)
-	if raw == "" {
-		if changed {
-			return "", errs.NewValidationError(errs.SubtypeInvalidArgument, "--fields cannot be blank; allowed: %s, *", strings.Join(driveMemberListFields, ", ")).WithParam("--fields")
-		}
-		return "", nil
-	}
-
-	parts := strings.Split(raw, ",")
-	fields := make([]string, 0, len(parts))
-	seen := make(map[string]bool, len(parts))
-	for _, part := range parts {
-		field := strings.ToLower(strings.TrimSpace(part))
-		if field == "" {
-			return "", errs.NewValidationError(errs.SubtypeInvalidArgument, "--fields contains an empty field; allowed: %s, *", strings.Join(driveMemberListFields, ", ")).WithParam("--fields")
-		}
-		if field == "*" {
-			if len(parts) != 1 {
-				return "", errs.NewValidationError(errs.SubtypeInvalidArgument, "--fields=* cannot be combined with other fields").WithParam("--fields")
-			}
-			return "*", nil
-		}
-		if !driveMemberListFieldAllowed(field) {
-			return "", errs.NewValidationError(
-				errs.SubtypeInvalidArgument,
-				"invalid value %q for --fields, allowed: %s, *",
-				strings.TrimSpace(part),
-				strings.Join(driveMemberListFields, ", "),
-			).WithParam("--fields")
-		}
-		if !seen[field] {
-			fields = append(fields, field)
-			seen[field] = true
-		}
-	}
-	return strings.Join(fields, ","), nil
-}
-
-func driveMemberListFieldAllowed(field string) bool {
-	for _, allowed := range driveMemberListFields {
-		if field == allowed {
-			return true
-		}
-	}
-	return false
-}
-
-func normalizeDriveMemberListPermType(raw, resourceType string, changed bool) (string, error) {
-	permType, err := normalizeDriveMemberListEnumValue(raw, driveMemberListPermTypes, "--perm-type")
-	if err != nil {
-		return "", err
-	}
-	if resourceType != "wiki" && changed {
-		return "", errs.NewValidationError(errs.SubtypeInvalidArgument, "--perm-type only applies when resource type is wiki; got %q", resourceType).WithParam("--perm-type")
-	}
-	return permType, nil
-}
-
-func normalizeDriveMemberListEnumValue(raw string, allowed []string, flagName string) (string, error) {
-	value := strings.TrimSpace(raw)
-	if value == "" {
-		return "", nil
-	}
-	for _, candidate := range allowed {
-		if strings.EqualFold(value, candidate) {
-			return candidate, nil
-		}
-	}
-	return "", errs.NewValidationError(
-		errs.SubtypeInvalidArgument,
-		"invalid value %q for %s, allowed: %s",
-		value,
-		flagName,
-		strings.Join(allowed, ", "),
-	).WithParam(flagName)
-}
-
-func (s driveMemberListSpec) apiPath() string {
-	return fmt.Sprintf("/open-apis/drive/v1/permissions/%s/members", validate.EncodePathSegment(s.Token))
-}
-
-func (s driveMemberListSpec) params() map[string]interface{} {
-	params := map[string]interface{}{"type": s.Type}
-	if s.Fields != "" {
-		params["fields"] = s.Fields
-	}
-	if s.PermType != "" {
-		params["perm_type"] = s.PermType
-	}
-	return params
-}
-
-// DriveMemberList lists collaborator/member permissions on a Drive resource.
-var DriveMemberList = common.Shortcut{
-	Service:     "drive",
-	Command:     "+member-list",
-	Description: "List collaborator/member permissions on a Drive document, file, folder, or wiki node",
-	Risk:        "read",
-	Scopes:      []string{"docs:permission.member:retrieve"},
-	AuthTypes:   []string{"user", "bot"},
-	HasFormat:   true,
-	Flags: []common.Flag{
-		{Name: "token", Desc: "target URL or bare token (doc/sheet/file/wiki/bitable/docx/mindnote/minutes/slides/folder)", Required: true},
-		{Name: "type", Desc: "target type; auto-inferred from URL, required for bare tokens"},
-		{Name: "fields", Desc: "optional collaborator fields to return: name,type,avatar,external_label or *"},
-		{Name: "perm-type", Desc: "wiki permission scope filter; one of container|single_page"},
-	},
-	Tips: []string{
-		"--token accepts a Lark URL or bare token; pass --type when using a bare token.",
-		"Use --type folder for Drive folders.",
-		"--fields is omitted by default; pass --fields '*' or a comma-separated subset when extra collaborator fields are needed.",
-		"--perm-type only applies to wiki nodes.",
-	},
-	Validate: func(ctx context.Context, runtime *common.RuntimeContext) error {
-		_, err := readDriveMemberListSpec(runtime)
-		return err
-	},
-	DryRun: func(ctx context.Context, runtime *common.RuntimeContext) *common.DryRunAPI {
-		spec, err := readDriveMemberListSpec(runtime)
-		if err != nil {
-			return common.NewDryRunAPI().Set("error", err.Error())
-		}
-		return common.NewDryRunAPI().
-			Desc("List Drive collaborator/member permissions").
-			GET(spec.apiPath()).
-			Params(spec.params())
-	},
-	Execute: func(ctx context.Context, runtime *common.RuntimeContext) error {
-		spec, err := readDriveMemberListSpec(runtime)
-		if err != nil {
-			return err
-		}
-
-		fmt.Fprintf(runtime.IO().ErrOut, "Listing Drive members for %s %s...\n", spec.Type, common.MaskToken(spec.Token))
-		data, err := runtime.CallAPITyped("GET", spec.apiPath(), spec.params(), nil)
-		if err != nil {
-			return err
-		}
-		if items, ok := data["items"].([]interface{}); ok {
-			fmt.Fprintf(runtime.IO().ErrOut, "Found %d Drive member(s)\n", len(items))
-		}
-		runtime.OutFormat(data, nil, func(w io.Writer) {
-			renderDriveMemberListPretty(w, data)
-		})
-		return nil
-	},
-}
-
-func renderDriveMemberListPretty(w io.Writer, data map[string]interface{}) {
-	items, _ := data["items"].([]interface{})
-	if len(items) == 0 {
-		fmt.Fprintln(w, "No Drive members found.")
-		return
-	}
-	for i, raw := range items {
-		member, _ := raw.(map[string]interface{})
-		fmt.Fprintf(w, "[%d] %s\n", i+1, driveMemberListValue(member["member_id"]))
-		fmt.Fprintf(w, "    member_type: %s\n", driveMemberListValue(member["member_type"]))
-		fmt.Fprintf(w, "    perm:        %s\n", driveMemberListValue(member["perm"]))
-		if permType := driveMemberListValue(member["perm_type"]); permType != "-" {
-			fmt.Fprintf(w, "    perm_type:   %s\n", permType)
-		}
-		if memberType := driveMemberListValue(member["type"]); memberType != "-" {
-			fmt.Fprintf(w, "    type:        %s\n", memberType)
-		}
-		if name := driveMemberListValue(member["name"]); name != "-" {
-			fmt.Fprintf(w, "    name:        %s\n", name)
-		}
-		if avatar := driveMemberListValue(member["avatar"]); avatar != "-" {
-			fmt.Fprintf(w, "    avatar:      %s\n", avatar)
-		}
-		if label, ok := member["external_label"]; ok {
-			fmt.Fprintf(w, "    external_label: %v\n", label)
-		}
-		fmt.Fprintln(w)
-	}
-}
-
-func driveMemberListValue(v interface{}) string {
-	if s, ok := v.(string); ok && s != "" {
-		return s
-	}
-	return "-"
-}

shortcuts/drive/drive_member_list_test.go

@@ -1,426 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package drive
-
-import (
-	"encoding/json"
-	"net/http"
-	"reflect"
-	"strings"
-	"testing"
-
-	"github.com/spf13/cobra"
-
-	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/httpmock"
-	"github.com/larksuite/cli/shortcuts/common"
-)
-
-func newDriveMemberListRuntime(t *testing.T, token, docType, fields, permType string) *common.RuntimeContext {
-	t.Helper()
-
-	cmd := &cobra.Command{Use: "drive +member-list"}
-	cmd.Flags().String("token", "", "")
-	cmd.Flags().String("type", "", "")
-	cmd.Flags().String("fields", "", "")
-	cmd.Flags().String("perm-type", "", "")
-	for name, value := range map[string]string{
-		"token":     token,
-		"type":      docType,
-		"fields":    fields,
-		"perm-type": permType,
-	} {
-		if value == "" {
-			continue
-		}
-		if err := cmd.Flags().Set(name, value); err != nil {
-			t.Fatalf("set --%s: %v", name, err)
-		}
-	}
-	return common.TestNewRuntimeContext(cmd, driveTestConfig())
-}
-
-func TestDriveMemberListSpecResolvesTargets(t *testing.T) {
-	t.Parallel()
-
-	tests := []struct {
-		name     string
-		token    string
-		docType  string
-		wantTok  string
-		wantType string
-	}{
-		{
-			name:     "folder URL",
-			token:    "https://example.feishu.cn/drive/folder/fldTok?from=share",
-			wantTok:  "fldTok",
-			wantType: "folder",
-		},
-		{
-			name:     "docx URL",
-			token:    "https://example.feishu.cn/docx/doxTok",
-			wantTok:  "doxTok",
-			wantType: "docx",
-		},
-		{
-			name:     "bare folder token",
-			token:    " fldTok ",
-			docType:  " folder ",
-			wantTok:  "fldTok",
-			wantType: "folder",
-		},
-		{
-			name:     "mindnotes URL",
-			token:    "https://example.feishu.cn/mindnotes/mndTok",
-			wantTok:  "mndTok",
-			wantType: "mindnote",
-		},
-		{
-			name:     "minutes URL",
-			token:    "https://example.feishu.cn/minutes/obTok",
-			wantTok:  "obTok",
-			wantType: "minutes",
-		},
-	}
-
-	for _, temp := range tests {
-		tt := temp
-		t.Run(tt.name, func(t *testing.T) {
-			t.Parallel()
-
-			runtime := newDriveMemberListRuntime(t, tt.token, tt.docType, "", "")
-			spec, err := readDriveMemberListSpec(runtime)
-			if err != nil {
-				t.Fatalf("read spec: %v", err)
-			}
-			if spec.Token != tt.wantTok || spec.Type != tt.wantType {
-				t.Fatalf("spec token/type = %q/%q, want %q/%q", spec.Token, spec.Type, tt.wantTok, tt.wantType)
-			}
-		})
-	}
-}
-
-func TestDriveMemberListSpecValidationErrorsAreTyped(t *testing.T) {
-	t.Parallel()
-
-	tests := []struct {
-		name        string
-		token       string
-		docType     string
-		fields      string
-		permType    string
-		wantParam   string
-		wantMessage string
-	}{
-		{
-			name:        "missing token",
-			wantParam:   "--token",
-			wantMessage: "--token is required",
-		},
-		{
-			name:        "bare token without type",
-			token:       "doxTok",
-			wantParam:   "--type",
-			wantMessage: "--type is required",
-		},
-		{
-			name:        "unsupported URL",
-			token:       "https://example.feishu.cn/calendar/calTok",
-			wantParam:   "--token",
-			wantMessage: "unsupported --token URL",
-		},
-		{
-			name:        "URL type conflict",
-			token:       "https://example.feishu.cn/docx/doxTok",
-			docType:     "folder",
-			wantParam:   "--type",
-			wantMessage: "conflicts with URL path type",
-		},
-		{
-			name:        "invalid bare token",
-			token:       "../bad",
-			docType:     "folder",
-			wantParam:   "--token",
-			wantMessage: "--token",
-		},
-		{
-			name:        "invalid type",
-			token:       "doxTok",
-			docType:     "comment",
-			wantParam:   "--type",
-			wantMessage: "invalid value",
-		},
-		{
-			name:        "invalid fields",
-			token:       "doxTok",
-			docType:     "docx",
-			fields:      "name,unknown",
-			wantParam:   "--fields",
-			wantMessage: "invalid value",
-		},
-		{
-			name:        "star mixed with fields",
-			token:       "doxTok",
-			docType:     "docx",
-			fields:      "*,name",
-			wantParam:   "--fields",
-			wantMessage: "cannot be combined",
-		},
-		{
-			name:        "perm type rejected for non-wiki",
-			token:       "doxTok",
-			docType:     "docx",
-			permType:    "single_page",
-			wantParam:   "--perm-type",
-			wantMessage: "only applies when resource type is wiki",
-		},
-	}
-
-	for _, temp := range tests {
-		tt := temp
-		t.Run(tt.name, func(t *testing.T) {
-			t.Parallel()
-
-			runtime := newDriveMemberListRuntime(t, tt.token, tt.docType, tt.fields, tt.permType)
-			_, err := readDriveMemberListSpec(runtime)
-			if err == nil {
-				t.Fatal("expected validation error, got nil")
-			}
-			problem, ok := errs.ProblemOf(err)
-			if !ok {
-				t.Fatalf("error is not typed: %T %v", err, err)
-			}
-			if problem.Category != errs.CategoryValidation || problem.Subtype != errs.SubtypeInvalidArgument {
-				t.Fatalf("problem = %s/%s, want validation/invalid_argument", problem.Category, problem.Subtype)
-			}
-			validationErr, ok := err.(*errs.ValidationError)
-			if !ok {
-				t.Fatalf("error type = %T, want *errs.ValidationError", err)
-			}
-			if validationErr.Param != tt.wantParam {
-				t.Fatalf("param = %q, want %q", validationErr.Param, tt.wantParam)
-			}
-			if !strings.Contains(err.Error(), tt.wantMessage) {
-				t.Fatalf("error = %q, want substring %q", err.Error(), tt.wantMessage)
-			}
-		})
-	}
-}
-
-func TestDriveMemberListSpecParams(t *testing.T) {
-	t.Parallel()
-
-	tests := []struct {
-		name     string
-		token    string
-		docType  string
-		fields   string
-		permType string
-		want     map[string]interface{}
-	}{
-		{
-			name:    "default omits optional params",
-			token:   "doxTok",
-			docType: "docx",
-			want:    map[string]interface{}{"type": "docx"},
-		},
-		{
-			name:    "fields canonicalized and deduplicated",
-			token:   "doxTok",
-			docType: "docx",
-			fields:  "Name,avatar,name",
-			want:    map[string]interface{}{"type": "docx", "fields": "name,avatar"},
-		},
-		{
-			name:     "wiki accepts perm type",
-			token:    "wikTok",
-			docType:  "WIKI",
-			fields:   "*",
-			permType: "SINGLE_PAGE",
-			want:     map[string]interface{}{"type": "wiki", "fields": "*", "perm_type": "single_page"},
-		},
-	}
-
-	for _, temp := range tests {
-		tt := temp
-		t.Run(tt.name, func(t *testing.T) {
-			t.Parallel()
-
-			runtime := newDriveMemberListRuntime(t, tt.token, tt.docType, tt.fields, tt.permType)
-			spec, err := readDriveMemberListSpec(runtime)
-			if err != nil {
-				t.Fatalf("read spec: %v", err)
-			}
-			if got := spec.params(); !reflect.DeepEqual(got, tt.want) {
-				t.Fatalf("params = %#v, want %#v", got, tt.want)
-			}
-		})
-	}
-}
-
-func TestDriveMemberListDryRunIncludesGETRequest(t *testing.T) {
-	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
-
-	f, stdout, _, _ := cmdutil.TestFactory(t, driveTestConfig())
-	err := mountAndRunDrive(t, DriveMemberList, []string{
-		"+member-list",
-		"--token", "https://example.feishu.cn/drive/folder/fldTok",
-		"--fields", "*",
-		"--dry-run",
-		"--as", "bot",
-	}, f, stdout)
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-
-	var got struct {
-		Data struct {
-			API []struct {
-				Method string                 `json:"method"`
-				URL    string                 `json:"url"`
-				Params map[string]interface{} `json:"params"`
-			} `json:"api"`
-		} `json:"data"`
-	}
-	if err := json.Unmarshal(stdout.Bytes(), &got); err != nil {
-		t.Fatalf("decode dry-run output: %v\n%s", err, stdout.String())
-	}
-	if len(got.Data.API) != 1 {
-		t.Fatalf("api count = %d, want 1", len(got.Data.API))
-	}
-	api := got.Data.API[0]
-	if api.Method != "GET" || api.URL != "/open-apis/drive/v1/permissions/fldTok/members" {
-		t.Fatalf("api = %#v", api)
-	}
-	if api.Params["type"] != "folder" || api.Params["fields"] != "*" {
-		t.Fatalf("params = %#v", api.Params)
-	}
-	if _, ok := api.Params["perm_type"]; ok {
-		t.Fatalf("perm_type should be omitted for folder: %#v", api.Params)
-	}
-}
-
-func TestDriveMemberListExecutePreservesRawData(t *testing.T) {
-	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
-
-	f, stdout, stderr, reg := cmdutil.TestFactory(t, driveTestConfig())
-
-	var capturedQuery string
-	reg.Register(&httpmock.Stub{
-		Method: "GET",
-		URL:    "/open-apis/drive/v1/permissions/doxTok/members",
-		OnMatch: func(req *http.Request) {
-			capturedQuery = req.URL.RawQuery
-		},
-		Body: map[string]interface{}{
-			"code": 0,
-			"msg":  "success",
-			"data": map[string]interface{}{
-				"items": []interface{}{
-					map[string]interface{}{
-						"member_id":      "ou_x",
-						"member_type":    "openid",
-						"perm":           "view",
-						"type":           "user",
-						"name":           "zhangsan",
-						"server_future":  "preserved",
-						"external_label": true,
-					},
-				},
-				"server_top_level": "preserved",
-			},
-		},
-	})
-
-	err := mountAndRunDrive(t, DriveMemberList, []string{
-		"+member-list",
-		"--token", "doxTok",
-		"--type", "docx",
-		"--fields", "name,type,external_label",
-		"--as", "bot",
-	}, f, stdout)
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if !strings.Contains(capturedQuery, "type=docx") ||
-		!strings.Contains(capturedQuery, "fields=name%2Ctype%2Cexternal_label") {
-		t.Fatalf("captured query = %q", capturedQuery)
-	}
-	data := decodeDriveEnvelope(t, stdout)
-	if data["server_top_level"] != "preserved" {
-		t.Fatalf("server_top_level = %#v", data["server_top_level"])
-	}
-	for _, key := range []string{"token", "type", "count"} {
-		if _, ok := data[key]; ok {
-			t.Fatalf("data[%s] = %#v, want omitted", key, data[key])
-		}
-	}
-	items, _ := data["items"].([]interface{})
-	if len(items) != 1 {
-		t.Fatalf("items = %#v, want one item", data["items"])
-	}
-	item, _ := items[0].(map[string]interface{})
-	if item["server_future"] != "preserved" || item["external_label"] != true {
-		t.Fatalf("item future fields not preserved: %#v", item)
-	}
-	if !strings.Contains(stderr.String(), "Found 1 Drive member") {
-		t.Fatalf("stderr = %q, want count log", stderr.String())
-	}
-}
-
-func TestDriveMemberListDeclaresScopeAndIdentities(t *testing.T) {
-	t.Parallel()
-
-	if !reflect.DeepEqual(DriveMemberList.Scopes, []string{"docs:permission.member:retrieve"}) {
-		t.Fatalf("Scopes = %v, want docs:permission.member:retrieve", DriveMemberList.Scopes)
-	}
-	if !reflect.DeepEqual(DriveMemberList.AuthTypes, []string{"user", "bot"}) {
-		t.Fatalf("AuthTypes = %v, want [user bot]", DriveMemberList.AuthTypes)
-	}
-}
-
-func TestDriveMemberListPrettyOutput(t *testing.T) {
-	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
-
-	f, stdout, _, reg := cmdutil.TestFactory(t, driveTestConfig())
-	reg.Register(&httpmock.Stub{
-		Method: "GET",
-		URL:    "/open-apis/drive/v1/permissions/wikTok/members",
-		Body: map[string]interface{}{
-			"code": 0,
-			"msg":  "success",
-			"data": map[string]interface{}{
-				"items": []interface{}{
-					map[string]interface{}{
-						"member_id":   "ou_x",
-						"member_type": "openid",
-						"perm":        "view",
-						"perm_type":   "single_page",
-						"type":        "user",
-						"name":        "zhangsan",
-					},
-				},
-			},
-		},
-	})
-
-	err := mountAndRunDrive(t, DriveMemberList, []string{
-		"+member-list",
-		"--token", "wikTok",
-		"--type", "wiki",
-		"--perm-type", "single_page",
-		"--format", "pretty",
-		"--as", "bot",
-	}, f, stdout)
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	out := stdout.String()
-	for _, want := range []string{"[1] ou_x", "member_type: openid", "perm_type:   single_page", "name:        zhangsan"} {
-		if !strings.Contains(out, want) {
-			t.Fatalf("pretty output missing %q:\n%s", want, out)
-		}
-	}
-}

shortcuts/drive/drive_permission_get_setting.go

@@ -1,241 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package drive
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"io"
-	"net/url"
-	"strings"
-
-	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/validate"
-	"github.com/larksuite/cli/shortcuts/common"
-)
-
-type drivePermissionGetSettingSpec struct {
-	Token string
-	Type  string
-}
-
-var drivePermissionGetSettingTypes = []string{
-	"doc", "sheet", "file", "wiki", "bitable", "docx",
-	"mindnote", "minutes", "slides", "folder",
-}
-
-var drivePermissionGetSettingURLPathToType = []struct {
-	Prefix string
-	Type   string
-}{
-	{"/drive/folder/", "folder"},
-	{"/docx/", "docx"},
-	{"/doc/", "doc"},
-	{"/sheets/", "sheet"},
-	{"/base/", "bitable"},
-	{"/bitable/", "bitable"},
-	{"/wiki/", "wiki"},
-	{"/file/", "file"},
-	{"/mindnotes/", "mindnote"},
-	{"/slides/", "slides"},
-	{"/minutes/", "minutes"},
-}
-
-func readDrivePermissionGetSettingSpec(runtime *common.RuntimeContext) (drivePermissionGetSettingSpec, error) {
-	rawToken := strings.TrimSpace(runtime.Str("token"))
-	explicitType := strings.ToLower(strings.TrimSpace(runtime.Str("type")))
-
-	if rawToken == "" {
-		return drivePermissionGetSettingSpec{}, errs.NewValidationError(
-			errs.SubtypeInvalidArgument,
-			"--token is required",
-		).WithParam("--token")
-	}
-
-	if explicitType != "" && !drivePermissionGetSettingTypeAllowed(explicitType) {
-		return drivePermissionGetSettingSpec{}, errs.NewValidationError(
-			errs.SubtypeInvalidArgument,
-			"invalid --type %q: allowed values are %s",
-			explicitType,
-			strings.Join(drivePermissionGetSettingTypes, ", "),
-		).WithParam("--type")
-	}
-
-	if strings.Contains(rawToken, "://") {
-		ref, ok := parseDrivePermissionGetSettingResourceURL(rawToken)
-		if !ok {
-			return drivePermissionGetSettingSpec{}, errs.NewValidationError(
-				errs.SubtypeInvalidArgument,
-				"unsupported --token URL %q: pass a recognized Lark Drive document/folder URL or a bare token with --type",
-				rawToken,
-			).WithParam("--token")
-		}
-		if explicitType != "" && explicitType != ref.Type {
-			return drivePermissionGetSettingSpec{}, errs.NewValidationError(
-				errs.SubtypeInvalidArgument,
-				"--type %q conflicts with URL path type %q; remove --type or use a matching value",
-				explicitType,
-				ref.Type,
-			).WithParam("--type")
-		}
-		if err := validate.ResourceName(ref.Token, "--token"); err != nil {
-			return drivePermissionGetSettingSpec{}, errs.NewValidationError(errs.SubtypeInvalidArgument, "%s", err).WithParam("--token")
-		}
-		return drivePermissionGetSettingSpec{Token: ref.Token, Type: ref.Type}, nil
-	}
-
-	if explicitType == "" {
-		return drivePermissionGetSettingSpec{}, errs.NewValidationError(
-			errs.SubtypeInvalidArgument,
-			"--type is required when --token is a bare token (allowed: %s)",
-			strings.Join(drivePermissionGetSettingTypes, ", "),
-		).WithParam("--type")
-	}
-
-	if err := validate.ResourceName(rawToken, "--token"); err != nil {
-		return drivePermissionGetSettingSpec{}, errs.NewValidationError(errs.SubtypeInvalidArgument, "%s", err).WithParam("--token")
-	}
-	return drivePermissionGetSettingSpec{Token: rawToken, Type: explicitType}, nil
-}
-
-func parseDrivePermissionGetSettingResourceURL(rawURL string) (common.ResourceRef, bool) {
-	parsed, err := url.Parse(strings.TrimSpace(rawURL))
-	if err != nil || parsed.Hostname() == "" {
-		return common.ResourceRef{}, false
-	}
-
-	for _, mapping := range drivePermissionGetSettingURLPathToType {
-		if !strings.HasPrefix(parsed.Path, mapping.Prefix) {
-			continue
-		}
-		token := parsed.Path[len(mapping.Prefix):]
-		token = strings.TrimRight(token, "/")
-		if idx := strings.IndexByte(token, '/'); idx >= 0 {
-			token = token[:idx]
-		}
-		token = strings.TrimSpace(token)
-		if token == "" {
-			return common.ResourceRef{}, false
-		}
-		return common.ResourceRef{Type: mapping.Type, Token: token}, true
-	}
-
-	return common.ResourceRef{}, false
-}
-
-func drivePermissionGetSettingTypeAllowed(docType string) bool {
-	for _, allowed := range drivePermissionGetSettingTypes {
-		if docType == allowed {
-			return true
-		}
-	}
-	return false
-}
-
-func (s drivePermissionGetSettingSpec) url(runtime *common.RuntimeContext) string {
-	if runtime != nil && runtime.Config != nil {
-		if u := common.BuildResourceURL(runtime.Config.Brand, s.Type, s.Token); u != "" {
-			return u
-		}
-	}
-	return common.BuildResourceURL("", s.Type, s.Token)
-}
-
-func (s drivePermissionGetSettingSpec) params() map[string]interface{} {
-	return map[string]interface{}{"type": s.Type}
-}
-
-func (s drivePermissionGetSettingSpec) apiPath() string {
-	return drivePermissionPublicV2Path(s.Token)
-}
-
-func drivePermissionPublicV2Path(token string) string {
-	return fmt.Sprintf("/open-apis/drive/v2/permissions/%s/public", validate.EncodePathSegment(token))
-}
-
-func drivePermissionGetSettingPermissionPublic(data map[string]interface{}) (map[string]interface{}, error) {
-	permissionPublic := common.GetMap(data, "permission_public")
-	if permissionPublic == nil {
-		return nil, errs.NewInternalError(
-			errs.SubtypeInvalidResponse,
-			"drive permission get response missing data.permission_public",
-		)
-	}
-	return permissionPublic, nil
-}
-
-// DrivePermissionGetSetting queries permission_public settings for a Drive
-// document, file, wiki node, or folder.
-var DrivePermissionGetSetting = common.Shortcut{
-	Service:     "drive",
-	Command:     "+permission-get-setting",
-	Description: "Get public access, sharing, collaborator management, security, and comment permission settings",
-	Risk:        "read",
-	Scopes:      []string{"docs:permission.setting:read"},
-	AuthTypes:   []string{"user", "bot"},
-	HasFormat:   true,
-	Flags: []common.Flag{
-		{Name: "token", Desc: "target URL or bare token (doc/sheet/file/wiki/bitable/docx/mindnote/minutes/slides/folder)", Required: true},
-		{Name: "type", Desc: "target type; auto-inferred from URL, required for bare tokens", Enum: drivePermissionGetSettingTypes},
-	},
-	Tips: []string{
-		"--token accepts a Lark URL or bare token; pass --type when using a bare token.",
-		"Use --type folder for Drive folders. This shortcut reads the target's own permission settings; it does not recurse into child documents.",
-	},
-	Validate: func(ctx context.Context, runtime *common.RuntimeContext) error {
-		_, err := readDrivePermissionGetSettingSpec(runtime)
-		return err
-	},
-	DryRun: func(ctx context.Context, runtime *common.RuntimeContext) *common.DryRunAPI {
-		spec, err := readDrivePermissionGetSettingSpec(runtime)
-		if err != nil {
-			return common.NewDryRunAPI().Set("error", err.Error())
-		}
-		return common.NewDryRunAPI().
-			Desc("Get Drive permission settings").
-			GET(spec.apiPath()).
-			Params(spec.params())
-	},
-	Execute: func(ctx context.Context, runtime *common.RuntimeContext) error {
-		spec, err := readDrivePermissionGetSettingSpec(runtime)
-		if err != nil {
-			return err
-		}
-
-		fmt.Fprintf(runtime.IO().ErrOut, "Getting permission settings for %s %s...\n", spec.Type, common.MaskToken(spec.Token))
-		data, err := runtime.CallAPITyped(
-			"GET",
-			spec.apiPath(),
-			spec.params(),
-			nil,
-		)
-		if err != nil {
-			return err
-		}
-
-		permissionPublic, err := drivePermissionGetSettingPermissionPublic(data)
-		if err != nil {
-			return err
-		}
-		permissionPublicPretty, err := json.MarshalIndent(permissionPublic, "", "  ")
-		if err != nil {
-			return errs.NewInternalError(
-				errs.SubtypeInvalidResponse,
-				"encode drive permission settings for pretty output",
-			).WithCause(err)
-		}
-
-		out := map[string]interface{}{"permission_public": permissionPublic}
-		runtime.OutFormat(out, nil, func(w io.Writer) {
-			fmt.Fprintf(w, "Type:  %s\n", spec.Type)
-			fmt.Fprintf(w, "Token: %s\n", spec.Token)
-			if url := spec.url(runtime); url != "" {
-				fmt.Fprintf(w, "URL:   %s\n", url)
-			}
-			fmt.Fprintf(w, "Permission settings:\n%s\n", permissionPublicPretty)
-		})
-		return nil
-	},
-}

shortcuts/drive/drive_permission_get_setting_test.go

@@ -1,438 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package drive
-
-import (
-	"context"
-	"encoding/json"
-	"reflect"
-	"strings"
-	"testing"
-
-	"github.com/spf13/cobra"
-
-	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/httpmock"
-	"github.com/larksuite/cli/shortcuts/common"
-)
-
-func newDrivePermissionGetSettingRuntime(t *testing.T, token, docType string) *common.RuntimeContext {
-	t.Helper()
-
-	cmd := &cobra.Command{Use: "drive +permission-get-setting"}
-	cmd.Flags().String("token", "", "")
-	cmd.Flags().String("type", "", "")
-	if token != "" {
-		if err := cmd.Flags().Set("token", token); err != nil {
-			t.Fatalf("set --token: %v", err)
-		}
-	}
-	if docType != "" {
-		if err := cmd.Flags().Set("type", docType); err != nil {
-			t.Fatalf("set --type: %v", err)
-		}
-	}
-	return common.TestNewRuntimeContext(cmd, driveTestConfig())
-}
-
-func TestDrivePermissionGetSettingSpecResolvesTargets(t *testing.T) {
-	t.Parallel()
-
-	tests := []struct {
-		name     string
-		token    string
-		docType  string
-		wantTok  string
-		wantType string
-	}{
-		{
-			name:     "folder URL",
-			token:    "https://example.feishu.cn/drive/folder/fldTok?from=share",
-			wantTok:  "fldTok",
-			wantType: "folder",
-		},
-		{
-			name:     "docx URL",
-			token:    "https://example.feishu.cn/docx/doxTok",
-			wantTok:  "doxTok",
-			wantType: "docx",
-		},
-		{
-			name:     "file URL",
-			token:    "https://example.feishu.cn/file/boxTok",
-			wantTok:  "boxTok",
-			wantType: "file",
-		},
-		{
-			name:     "wiki URL",
-			token:    "https://example.feishu.cn/wiki/wikTok",
-			wantTok:  "wikTok",
-			wantType: "wiki",
-		},
-		{
-			name:     "minutes URL",
-			token:    "https://example.feishu.cn/minutes/obTok",
-			wantTok:  "obTok",
-			wantType: "minutes",
-		},
-		{
-			name:     "mindnotes URL",
-			token:    "https://example.feishu.cn/mindnotes/mndTok",
-			wantTok:  "mndTok",
-			wantType: "mindnote",
-		},
-		{
-			name:     "bare folder token",
-			token:    " fldTok ",
-			docType:  " folder ",
-			wantTok:  "fldTok",
-			wantType: "folder",
-		},
-		{
-			name:     "bare file token",
-			token:    "boxTok",
-			docType:  "file",
-			wantTok:  "boxTok",
-			wantType: "file",
-		},
-		{
-			name:     "bare wiki token",
-			token:    "wikTok",
-			docType:  "wiki",
-			wantTok:  "wikTok",
-			wantType: "wiki",
-		},
-	}
-
-	for _, temp := range tests {
-		tt := temp
-		t.Run(tt.name, func(t *testing.T) {
-			t.Parallel()
-
-			runtime := newDrivePermissionGetSettingRuntime(t, tt.token, tt.docType)
-			spec, err := readDrivePermissionGetSettingSpec(runtime)
-			if err != nil {
-				t.Fatalf("read spec: %v", err)
-			}
-			if spec.Token != tt.wantTok {
-				t.Fatalf("Token = %q, want %q", spec.Token, tt.wantTok)
-			}
-			if spec.Type != tt.wantType {
-				t.Fatalf("Type = %q, want %q", spec.Type, tt.wantType)
-			}
-		})
-	}
-}
-
-func TestDrivePermissionGetSettingSpecValidationErrorsAreTyped(t *testing.T) {
-	t.Parallel()
-
-	tests := []struct {
-		name        string
-		token       string
-		docType     string
-		wantParam   string
-		wantMessage string
-	}{
-		{
-			name:        "missing token",
-			wantParam:   "--token",
-			wantMessage: "--token is required",
-		},
-		{
-			name:        "bare token without type",
-			token:       "doxTok",
-			wantParam:   "--type",
-			wantMessage: "--type is required",
-		},
-		{
-			name:        "unsupported URL",
-			token:       "https://example.feishu.cn/calendar/calTok",
-			wantParam:   "--token",
-			wantMessage: "unsupported --token URL",
-		},
-		{
-			name:        "URL type conflict",
-			token:       "https://example.feishu.cn/docx/doxTok",
-			docType:     "sheet",
-			wantParam:   "--type",
-			wantMessage: "conflicts with URL path type",
-		},
-		{
-			name:        "invalid bare token",
-			token:       "../bad",
-			docType:     "folder",
-			wantParam:   "--token",
-			wantMessage: "--token",
-		},
-		{
-			name:        "invalid type",
-			token:       "doxTok",
-			docType:     "comment",
-			wantParam:   "--type",
-			wantMessage: "invalid --type",
-		},
-	}
-
-	for _, temp := range tests {
-		tt := temp
-		t.Run(tt.name, func(t *testing.T) {
-			t.Parallel()
-
-			runtime := newDrivePermissionGetSettingRuntime(t, tt.token, tt.docType)
-			_, err := readDrivePermissionGetSettingSpec(runtime)
-			if err == nil {
-				t.Fatal("expected validation error, got nil")
-			}
-			problem, ok := errs.ProblemOf(err)
-			if !ok {
-				t.Fatalf("error is not typed: %T %v", err, err)
-			}
-			if problem.Category != errs.CategoryValidation || problem.Subtype != errs.SubtypeInvalidArgument {
-				t.Fatalf("problem = %s/%s, want validation/invalid_argument", problem.Category, problem.Subtype)
-			}
-			if validationErr, ok := err.(*errs.ValidationError); ok {
-				if validationErr.Param != tt.wantParam {
-					t.Fatalf("param = %q, want %q", validationErr.Param, tt.wantParam)
-				}
-			} else {
-				t.Fatalf("error type = %T, want *errs.ValidationError", err)
-			}
-			if !strings.Contains(err.Error(), tt.wantMessage) {
-				t.Fatalf("error = %q, want substring %q", err.Error(), tt.wantMessage)
-			}
-		})
-	}
-}
-
-func TestDrivePermissionGetSettingDryRunIncludesGETRequest(t *testing.T) {
-	t.Parallel()
-
-	tests := []struct {
-		name     string
-		token    string
-		docType  string
-		wantURL  string
-		wantType string
-	}{
-		{
-			name:     "folder URL",
-			token:    "https://example.feishu.cn/drive/folder/fldTok",
-			wantURL:  "/open-apis/drive/v2/permissions/fldTok/public",
-			wantType: "folder",
-		},
-		{
-			name:     "bare folder token",
-			token:    "fldTok",
-			docType:  "folder",
-			wantURL:  "/open-apis/drive/v2/permissions/fldTok/public",
-			wantType: "folder",
-		},
-		{
-			name:     "docx URL",
-			token:    "https://example.feishu.cn/docx/doxTok",
-			wantURL:  "/open-apis/drive/v2/permissions/doxTok/public",
-			wantType: "docx",
-		},
-		{
-			name:     "bare wiki token",
-			token:    "wikTok",
-			docType:  "wiki",
-			wantURL:  "/open-apis/drive/v2/permissions/wikTok/public",
-			wantType: "wiki",
-		},
-		{
-			name:     "file URL",
-			token:    "https://example.feishu.cn/file/boxTok",
-			wantURL:  "/open-apis/drive/v2/permissions/boxTok/public",
-			wantType: "file",
-		},
-		{
-			name:     "minutes URL",
-			token:    "https://example.feishu.cn/minutes/obTok",
-			wantURL:  "/open-apis/drive/v2/permissions/obTok/public",
-			wantType: "minutes",
-		},
-		{
-			name:     "mindnotes URL",
-			token:    "https://example.feishu.cn/mindnotes/mndTok",
-			wantURL:  "/open-apis/drive/v2/permissions/mndTok/public",
-			wantType: "mindnote",
-		},
-	}
-
-	for _, temp := range tests {
-		tt := temp
-		t.Run(tt.name, func(t *testing.T) {
-			t.Parallel()
-
-			runtime := newDrivePermissionGetSettingRuntime(t, tt.token, tt.docType)
-			dry := DrivePermissionGetSetting.DryRun(context.Background(), runtime)
-			if dry == nil {
-				t.Fatal("DryRun returned nil")
-			}
-			data, err := json.Marshal(dry)
-			if err != nil {
-				t.Fatalf("marshal dry-run: %v", err)
-			}
-			out := string(data)
-			for _, want := range []string{
-				`"` + tt.wantURL + `"`,
-				`"GET"`,
-				`"type":"` + tt.wantType + `"`,
-			} {
-				if !strings.Contains(out, want) {
-					t.Fatalf("dry-run output missing %q:\n%s", want, out)
-				}
-			}
-			if strings.Contains(out, `"folder_token"`) {
-				t.Fatalf("dry-run output contains folder_token, want omitted:\n%s", out)
-			}
-		})
-	}
-}
-
-func TestDrivePermissionGetSettingExecutePreservesPermissionPublic(t *testing.T) {
-	f, stdout, _, reg := cmdutil.TestFactory(t, driveTestConfig())
-	reg.Register(&httpmock.Stub{
-		Method: "GET",
-		URL:    "/open-apis/drive/v2/permissions/doxTok/public?type=docx",
-		Body: map[string]interface{}{
-			"code": 0,
-			"msg":  "ok",
-			"data": map[string]interface{}{
-				"permission_public": map[string]interface{}{
-					"link_share_entity":          "closed",
-					"external_access_entity":     "closed",
-					"security_entity":            "anyone_can_view",
-					"comment_entity":             "anyone_can_view",
-					"share_entity":               "anyone",
-					"manage_collaborator_entity": "collaborator_can_view",
-					"lock_switch":                false,
-					"server_future_field":        "preserved",
-				},
-			},
-		},
-	})
-
-	err := mountAndRunDrive(t, DrivePermissionGetSetting, []string{
-		"+permission-get-setting",
-		"--token", "doxTok",
-		"--type", "docx",
-		"--as", "bot",
-	}, f, stdout)
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-
-	data := decodeDriveEnvelope(t, stdout)
-	for _, key := range []string{"type", "token", "url"} {
-		if _, ok := data[key]; ok {
-			t.Fatalf("data[%s] = %#v, want field omitted", key, data[key])
-		}
-	}
-	permissionPublic, _ := data["permission_public"].(map[string]interface{})
-	if permissionPublic == nil {
-		t.Fatalf("permission_public missing in output: %#v", data)
-	}
-	for key, want := range map[string]interface{}{
-		"link_share_entity":          "closed",
-		"external_access_entity":     "closed",
-		"security_entity":            "anyone_can_view",
-		"comment_entity":             "anyone_can_view",
-		"share_entity":               "anyone",
-		"manage_collaborator_entity": "collaborator_can_view",
-		"lock_switch":                false,
-		"server_future_field":        "preserved",
-	} {
-		if permissionPublic[key] != want {
-			t.Fatalf("permission_public[%s] = %#v, want %#v", key, permissionPublic[key], want)
-		}
-	}
-}
-
-func TestDrivePermissionGetSettingExecuteRejectsMissingPermissionPublic(t *testing.T) {
-	f, stdout, _, reg := cmdutil.TestFactory(t, driveTestConfig())
-	reg.Register(&httpmock.Stub{
-		Method: "GET",
-		URL:    "/open-apis/drive/v2/permissions/doxTok/public?type=docx",
-		Body: map[string]interface{}{
-			"code": 0,
-			"msg":  "ok",
-			"data": map[string]interface{}{"unexpected": "response"},
-		},
-	})
-
-	err := mountAndRunDrive(t, DrivePermissionGetSetting, []string{
-		"+permission-get-setting",
-		"--token", "doxTok",
-		"--type", "docx",
-		"--as", "bot",
-	}, f, stdout)
-	if err == nil {
-		t.Fatal("expected invalid response error, got nil")
-	}
-	problem, ok := errs.ProblemOf(err)
-	if !ok || problem.Category != errs.CategoryInternal || problem.Subtype != errs.SubtypeInvalidResponse {
-		t.Fatalf("problem = %#v, want internal/invalid_response", problem)
-	}
-	if stdout.Len() != 0 {
-		t.Fatalf("stdout should be empty on invalid response, got %s", stdout.String())
-	}
-}
-
-func TestDrivePermissionGetSettingExecutePrettyFormatIncludesPermissionPublic(t *testing.T) {
-	f, stdout, _, reg := cmdutil.TestFactory(t, driveTestConfig())
-	reg.Register(&httpmock.Stub{
-		Method: "GET",
-		URL:    "/open-apis/drive/v2/permissions/doxTok/public?type=docx",
-		Body: map[string]interface{}{
-			"code": 0,
-			"msg":  "ok",
-			"data": map[string]interface{}{
-				"permission_public": map[string]interface{}{
-					"link_share_entity":   "closed",
-					"server_future_field": "preserved",
-				},
-			},
-		},
-	})
-
-	err := mountAndRunDrive(t, DrivePermissionGetSetting, []string{
-		"+permission-get-setting",
-		"--token", "doxTok",
-		"--type", "docx",
-		"--format", "pretty",
-		"--as", "bot",
-	}, f, stdout)
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	for _, want := range []string{
-		"Permission settings:",
-		`"link_share_entity": "closed"`,
-		`"server_future_field": "preserved"`,
-	} {
-		if !strings.Contains(stdout.String(), want) {
-			t.Fatalf("pretty output missing %q:\n%s", want, stdout.String())
-		}
-	}
-}
-
-func TestDrivePermissionGetSettingDeclaresScopeAndIdentities(t *testing.T) {
-	t.Parallel()
-
-	if !reflect.DeepEqual(DrivePermissionGetSetting.Scopes, []string{"docs:permission.setting:read"}) {
-		t.Fatalf("Scopes = %v, want docs:permission.setting:read", DrivePermissionGetSetting.Scopes)
-	}
-	if !reflect.DeepEqual(DrivePermissionGetSetting.AuthTypes, []string{"user", "bot"}) {
-		t.Fatalf("AuthTypes = %v, want [user bot]", DrivePermissionGetSetting.AuthTypes)
-	}
-	for _, flag := range DrivePermissionGetSetting.Flags {
-		if flag.Name == "token" && !flag.Required {
-			t.Fatal("--token must be declared required")
-		}
-	}
-}

shortcuts/drive/shortcuts.go

@@ -32,8 +32,6 @@ func Shortcuts() []common.Shortcut {
 		DriveTaskResult,
 		DriveApplyPermission,
 		DriveMemberAdd,
-		DriveMemberList,
-		DrivePermissionGetSetting,
 		DriveSecureLabelList,
 		DriveSecureLabelUpdate,
 		DriveSearch,

shortcuts/drive/shortcuts_test.go

@@ -39,8 +39,6 @@ func TestShortcutsIncludesExpectedCommands(t *testing.T) {
 		"+task_result",
 		"+apply-permission",
 		"+member-add",
-		"+member-list",
-		"+permission-get-setting",
 		"+secure-label-list",
 		"+secure-label-update",
 		"+search",

shortcuts/sheets/backward/lark_sheets_float_images.go

@@ -17,10 +17,9 @@ import (
 )
 
 // Drive media parent_type values for uploading an image into a spreadsheet.
-// Native spreadsheets use "sheet_image"; imported "office" spreadsheets use a
-// legacy synthetic-token prefix or a 28-character token whose interleaved
-// product/region marker is "OFL0X". The backend requires
-// "office_sheet_file" for those imported spreadsheets.
+// Native spreadsheets use "sheet_image"; imported "office" spreadsheets carry a
+// synthetic token prefixed with "fake_office_" (being renamed to
+// "local_office_") and the backend requires "office_sheet_file" instead.
 const (
 	sheetImageParentType      = "sheet_image"
 	officeSheetFileParentType = "office_sheet_file"
@@ -28,37 +27,22 @@ const (
 	localOfficePrefix         = "local_office_"
 )
 
-// officePrefixes are the legacy synthetic token prefixes an imported "office"
-// spreadsheet may carry.
+// officePrefixes are the synthetic token prefixes an imported "office"
+// spreadsheet may carry. The prefix is being renamed from "fake_office_" to
+// "local_office_"; accept either so image uploads keep working across the
+// rename.
 var officePrefixes = []string{fakeOfficePrefix, localOfficePrefix}
 
-func isOfficeSpreadsheet(spreadsheetToken string) bool {
+// sheetMediaParentType returns the drive media parent_type to use when
+// uploading an image whose parent_node is spreadsheetToken, mapping either the
+// "fake_office_" or "local_office_" imported-spreadsheet token prefix to
+// "office_sheet_file".
+func sheetMediaParentType(spreadsheetToken string) string {
 	for _, prefix := range officePrefixes {
 		if strings.HasPrefix(spreadsheetToken, prefix) {
-			return true
+			return officeSheetFileParentType
 		}
 	}
-	if len(spreadsheetToken) != 28 {
-		return false
-	}
-	// The five-character marker occupies positions 5, 10, 15, 20, and 25
-	// (1-based) in the interleaved token.
-	marker := []byte{
-		spreadsheetToken[4],
-		spreadsheetToken[9],
-		spreadsheetToken[14],
-		spreadsheetToken[19],
-		spreadsheetToken[24],
-	}
-	return string(marker) == "OFL0X"
-}
-
-// sheetMediaParentType returns the drive media parent_type to use when
-// uploading an image whose parent_node is spreadsheetToken.
-func sheetMediaParentType(spreadsheetToken string) string {
-	if isOfficeSpreadsheet(spreadsheetToken) {
-		return officeSheetFileParentType
-	}
 	return sheetImageParentType
 }
 

shortcuts/sheets/backward/lark_sheets_sheet_media_upload_test.go

@@ -105,7 +105,7 @@ func TestSheetMediaUploadDryRunSmallFileOfficeParentType(t *testing.T) {
 	f, stdout, _, _ := cmdutil.TestFactory(t, sheetsTestConfig())
 	err := mountAndRunSheets(t, SheetMediaUpload, []string{
 		"+media-upload",
-		"--spreadsheet-token", "aaaaOaaaaFaaaaLaaaa0aaaaXaaa",
+		"--spreadsheet-token", "fake_office_abc123",
 		"--file", "img.png",
 		"--dry-run", "--as", "user",
 	}, f, stdout)
@@ -117,10 +117,10 @@ func TestSheetMediaUploadDryRunSmallFileOfficeParentType(t *testing.T) {
 		t.Fatalf("dry-run should use upload_all for small file, got: %s", out)
 	}
 	if !strings.Contains(out, `"office_sheet_file"`) {
-		t.Fatalf("dry-run should include parent_type=office_sheet_file for interleaved OFL0X token, got: %s", out)
+		t.Fatalf("dry-run should include parent_type=office_sheet_file for fake_office_ token, got: %s", out)
 	}
 	if strings.Contains(out, `"sheet_image"`) {
-		t.Fatalf("dry-run must not emit sheet_image for interleaved OFL0X token, got: %s", out)
+		t.Fatalf("dry-run must not emit sheet_image for fake_office_ token, got: %s", out)
 	}
 }
 
@@ -239,7 +239,7 @@ func TestSheetMediaUploadExecuteSuccess(t *testing.T) {
 }
 
 // TestSheetMediaUploadExecuteOfficeParentType confirms that an imported
-// "office" spreadsheet (token carrying the interleaved "OFL0X" marker) uploads with
+// "office" spreadsheet (token prefixed with "fake_office_") uploads with
 // parent_type=office_sheet_file instead of the native sheet_image.
 func TestSheetMediaUploadExecuteOfficeParentType(t *testing.T) {
 	dir := t.TempDir()
@@ -259,7 +259,7 @@ func TestSheetMediaUploadExecuteOfficeParentType(t *testing.T) {
 	}
 	reg.Register(stub)
 
-	const officeToken = "aaaaOaaaaFaaaaLaaaa0aaaaXaaa"
+	const officeToken = "fake_office_abc123"
 	err := mountAndRunSheets(t, SheetMediaUpload, []string{
 		"+media-upload",
 		"--spreadsheet-token", officeToken,

shortcuts/sheets/helpers.go

@@ -53,10 +53,9 @@ func sheetsInputStatError(flag string, err error) error {
 }
 
 // Drive media parent_type values for uploading an image into a spreadsheet.
-// Native spreadsheets use "sheet_image"; imported "office" spreadsheets use a
-// legacy synthetic-token prefix or a 28-character token whose interleaved
-// product/region marker is "OFL0X". The backend requires
-// "office_sheet_file" for those imported spreadsheets.
+// Native spreadsheets use "sheet_image"; imported "office" spreadsheets carry a
+// synthetic token prefixed with "fake_office_" (being renamed to
+// "local_office_") and the backend requires "office_sheet_file" instead.
 const (
 	sheetImageParentType      = "sheet_image"
 	officeSheetFileParentType = "office_sheet_file"
@@ -64,38 +63,21 @@ const (
 	localOfficePrefix         = "local_office_"
 )
 
-// officePrefixes are the legacy synthetic token prefixes an imported "office"
-// spreadsheet may carry.
+// officePrefixes are the synthetic token prefixes an imported "office"
+// spreadsheet may carry. The prefix is being renamed from "fake_office_" to
+// "local_office_"; accept either so image uploads keep working across the
+// rename.
 var officePrefixes = []string{fakeOfficePrefix, localOfficePrefix}
 
-func isOfficeSpreadsheet(spreadsheetToken string) bool {
-	for _, prefix := range officePrefixes {
-		if strings.HasPrefix(spreadsheetToken, prefix) {
-			return true
-		}
-	}
-	if len(spreadsheetToken) != 28 {
-		return false
-	}
-	// The five-character marker occupies positions 5, 10, 15, 20, and 25
-	// (1-based) in the interleaved token.
-	marker := []byte{
-		spreadsheetToken[4],
-		spreadsheetToken[9],
-		spreadsheetToken[14],
-		spreadsheetToken[19],
-		spreadsheetToken[24],
-	}
-	return string(marker) == "OFL0X"
-}
-
 // sheetMediaParentType returns the drive media parent_type to use when
 // uploading an image whose parent_node is spreadsheetToken. It is the single
 // place that maps a spreadsheet token to its parent_type so every image-upload
 // entry point (and its dry-run preview) stays consistent.
 func sheetMediaParentType(spreadsheetToken string) string {
-	if isOfficeSpreadsheet(spreadsheetToken) {
-		return officeSheetFileParentType
+	for _, prefix := range officePrefixes {
+		if strings.HasPrefix(spreadsheetToken, prefix) {
+			return officeSheetFileParentType
+		}
 	}
 	return sheetImageParentType
 }

shortcuts/sheets/sheet_media_parent_type_test.go

@@ -25,9 +25,8 @@ import (
 
 // TestSheetMediaParentType pins the token→parent_type mapping that every
 // sheets image-upload entry point funnels through. Native spreadsheet tokens
-// use "sheet_image"; imported "office" spreadsheets use either a legacy
-// prefix or the interleaved "OFL0X" marker and must upload with
-// "office_sheet_file".
+// use "sheet_image"; imported "office" spreadsheets carry a "fake_office_" or
+// "local_office_" synthetic token and must upload with "office_sheet_file".
 func TestSheetMediaParentType(t *testing.T) {
 	t.Parallel()
 	cases := []struct {
@@ -41,13 +40,6 @@ func TestSheetMediaParentType(t *testing.T) {
 		{"fake_office token, only the prefix", fakeOfficePrefix, officeSheetFileParentType},
 		{"local_office imported token", "local_office_abc123", officeSheetFileParentType},
 		{"local_office token, only the prefix", localOfficePrefix, officeSheetFileParentType},
-		{"interleaved OFL0X office token", "aaaaOaaaaFaaaaLaaaa0aaaaXaaa", officeSheetFileParentType},
-		{"interleaved exlcn token", "abcdeefghxijkllmnopcqrstnuv", sheetImageParentType},
-		{"interleaved shtcn native token", "abcdsefghhijkltmnopcqrstnuv", sheetImageParentType},
-		{"interleaved pptcn token", "abcdpefghpijkltmnopcqrstnuv", sheetImageParentType},
-		{"interleaved wodcn token", "abcdwefghoijkldmnopcqrstnuv", sheetImageParentType},
-		{"interleaved OFL0X marker with short length", "aaaaOaaaaFaaaaLaaaa0aaaaXaa", sheetImageParentType},
-		{"interleaved OFL0X marker with long length", "aaaaOaaaaFaaaaLaaaa0aaaaXaaaa", sheetImageParentType},
 		{"fake_office prefix mid-string is not matched", "shtfake_office_abc", sheetImageParentType},
 		{"local_office prefix mid-string is not matched", "shtlocal_office_abc", sheetImageParentType},
 	}
@@ -65,7 +57,7 @@ func TestSheetMediaParentType(t *testing.T) {
 // to end (the Execute path the dry-run tests don't reach), asserting the
 // parent_type that actually goes out on the wire is derived from the token: a
 // native spreadsheet uploads as sheet_image, an imported "office" spreadsheet
-// (legacy prefix or interleaved OFL0X marker) as office_sheet_file.
+// (fake_office_-prefixed token) as office_sheet_file.
 func TestUploadSheetImage_ParentType(t *testing.T) {
 	cases := []struct {
 		name           string
@@ -75,7 +67,6 @@ func TestUploadSheetImage_ParentType(t *testing.T) {
 		{"native spreadsheet", "shtcnTOK123", sheetImageParentType},
 		{"fake_office imported spreadsheet", "fake_office_abc123", officeSheetFileParentType},
 		{"local_office imported spreadsheet", "local_office_abc123", officeSheetFileParentType},
-		{"interleaved OFL0X imported spreadsheet", "aaaaOaaaaFaaaaLaaaa0aaaaXaaa", officeSheetFileParentType},
 	}
 	for _, tc := range cases {
 		t.Run(tc.name, func(t *testing.T) {

shortcuts/slides/slides_screenshot.go

@@ -37,13 +37,15 @@ var SlidesScreenshot = common.Shortcut{
 	Command:     "+screenshot",
 	Description: "Save up to 10 slide screenshots to local files without printing Base64 image data",
 	Risk:        "read",
-	Scopes:      []string{"slides:presentation:screenshot"},
+	Scopes:      []string{},
+	// The screenshot API is allowlist-gated for only a few apps, so do not
+	// advertise/preflight its scope. Let the API fail and let callers degrade.
 	// wiki:node:read is required only when --presentation is a wiki URL.
 	ConditionalScopes: []string{"wiki:node:read"},
 	AuthTypes:         []string{"user", "bot"},
 	Flags: []common.Flag{
 		{Name: "presentation", Desc: "xml_presentation_id, slides URL, or wiki URL that resolves to slides; list mode only"},
-		{Name: "slide-id", Type: "string_slice", Desc: "slide page identifier (repeat or comma-separated for multiple slides; max 10 pages per request)"},
+		{Name: "slide-id", Type: "string_array", Desc: "slide page identifier (repeat for multiple slides; max 10 pages per request)"},
 		{Name: "slide-number", Type: "int_array", Desc: "slide page number (repeat for multiple slides; max 10 pages per request)"},
 		{Name: "content", Desc: "slide XML content to render directly instead of fetching existing slides", Input: []string{common.File, common.Stdin}},
 		{Name: "output-dir", Default: defaultSlidesScreenshotDir, Desc: "relative directory for saved screenshots"},
@@ -55,7 +57,7 @@ var SlidesScreenshot = common.Shortcut{
 			if strings.TrimSpace(runtime.Str("content")) == "" {
 				return slidesScreenshotFlagErrorf("--content cannot be empty")
 			}
-			if len(normalizeSlideIDs(runtime.StrSlice("slide-id"))) > 0 || len(runtime.IntArray("slide-number")) > 0 {
+			if len(normalizeSlideIDs(runtime.StrArray("slide-id"))) > 0 || len(runtime.IntArray("slide-number")) > 0 {
 				return slidesScreenshotFlagErrorf("--content cannot be used with --slide-id or --slide-number")
 			}
 			if runtime.Changed("presentation") {
@@ -71,7 +73,7 @@ var SlidesScreenshot = common.Shortcut{
 					return err
 				}
 			}
-			slideIDs := normalizeSlideIDs(runtime.StrSlice("slide-id"))
+			slideIDs := normalizeSlideIDs(runtime.StrArray("slide-id"))
 			slideNumbers, err := normalizeSlideNumbers(runtime.IntArray("slide-number"))
 			if err != nil {
 				return err
@@ -96,7 +98,7 @@ var SlidesScreenshot = common.Shortcut{
 		if err != nil {
 			return common.NewDryRunAPI().Set("error", err.Error())
 		}
-		slideIDs := normalizeSlideIDs(runtime.StrSlice("slide-id"))
+		slideIDs := normalizeSlideIDs(runtime.StrArray("slide-id"))
 		slideNumbers, err := normalizeSlideNumbers(runtime.IntArray("slide-number"))
 		if err != nil {
 			return common.NewDryRunAPI().Set("error", err.Error())
@@ -146,7 +148,7 @@ var SlidesScreenshot = common.Shortcut{
 			return err
 		}
 
-		slideIDs := normalizeSlideIDs(runtime.StrSlice("slide-id"))
+		slideIDs := normalizeSlideIDs(runtime.StrArray("slide-id"))
 		slideNumbers, err := normalizeSlideNumbers(runtime.IntArray("slide-number"))
 		if err != nil {
 			return err
@@ -198,7 +200,7 @@ func dryRunRenderScreenshot(runtime *common.RuntimeContext) *common.DryRunAPI {
 	if strings.TrimSpace(content) == "" {
 		return common.NewDryRunAPI().Set("error", "--content cannot be empty")
 	}
-	if len(normalizeSlideIDs(runtime.StrSlice("slide-id"))) > 0 || len(runtime.IntArray("slide-number")) > 0 {
+	if len(normalizeSlideIDs(runtime.StrArray("slide-id"))) > 0 || len(runtime.IntArray("slide-number")) > 0 {
 		return common.NewDryRunAPI().Set("error", "--content cannot be used with --slide-id or --slide-number")
 	}
 	if runtime.Changed("presentation") {
@@ -217,7 +219,7 @@ func executeRenderScreenshot(runtime *common.RuntimeContext) error {
 	if strings.TrimSpace(content) == "" {
 		return slidesScreenshotFlagErrorf("--content cannot be empty")
 	}
-	if len(normalizeSlideIDs(runtime.StrSlice("slide-id"))) > 0 || len(runtime.IntArray("slide-number")) > 0 {
+	if len(normalizeSlideIDs(runtime.StrArray("slide-id"))) > 0 || len(runtime.IntArray("slide-number")) > 0 {
 		return slidesScreenshotFlagErrorf("--content cannot be used with --slide-id or --slide-number")
 	}
 	if runtime.Changed("presentation") {

shortcuts/slides/slides_screenshot_test.go

@@ -8,7 +8,6 @@ import (
 	"encoding/json"
 	"os"
 	"path/filepath"
-	"reflect"
 	"strings"
 	"testing"
 
@@ -18,19 +17,23 @@ import (
 )
 
 func TestSlidesScreenshotDeclaredScopes(t *testing.T) {
-	base := []string{"slides:presentation:screenshot"}
-	if got := SlidesScreenshot.ScopesForIdentity("user"); !reflect.DeepEqual(got, base) {
-		t.Fatalf("user preflight scopes = %#v, want %#v", got, base)
+	if got := SlidesScreenshot.ScopesForIdentity("user"); len(got) != 0 {
+		t.Fatalf("user preflight scopes = %#v, want empty", got)
 	}
-	if got := SlidesScreenshot.ScopesForIdentity("bot"); !reflect.DeepEqual(got, base) {
-		t.Fatalf("bot preflight scopes = %#v, want %#v", got, base)
+	if got := SlidesScreenshot.ScopesForIdentity("bot"); len(got) != 0 {
+		t.Fatalf("bot preflight scopes = %#v, want empty", got)
 	}
 
 	got := SlidesScreenshot.DeclaredScopesForIdentity("user")
-	want := []string{"slides:presentation:screenshot", "wiki:node:read"}
-	if !reflect.DeepEqual(got, want) {
+	want := []string{"wiki:node:read"}
+	if len(got) != len(want) || got[0] != want[0] {
 		t.Fatalf("declared scopes = %#v, want %#v", got, want)
 	}
+	for _, scope := range got {
+		if scope == "slides:presentation:screenshot" {
+			t.Fatalf("declared scopes must not advertise screenshot scope: %#v", got)
+		}
+	}
 }
 
 func TestSlidesScreenshotWritesFilesAndSuppressesBase64(t *testing.T) {
@@ -185,139 +188,6 @@ func TestSlidesScreenshotListBySlideNumber(t *testing.T) {
 	}
 }
 
-func TestSlidesScreenshotListBySlideIDCSV(t *testing.T) {
-	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
-	dir := t.TempDir()
-	withSlidesTestWorkingDir(t, dir)
-
-	f, stdout, _, reg := cmdutil.TestFactory(t, slidesTestConfig(t, ""))
-	stub := &httpmock.Stub{
-		Method: "POST",
-		URL:    "/open-apis/slides_ai/v1/xml_presentations/pres_abc/slide_images",
-		Body: map[string]interface{}{
-			"code": 0,
-			"data": map[string]interface{}{
-				"slide_images": []map[string]interface{}{
-					{
-						"slide_id": "slide_1",
-						"format":   1,
-						"data":     base64.StdEncoding.EncodeToString([]byte("png-bytes-1")),
-					},
-					{
-						"slide_id": "slide_2",
-						"format":   1,
-						"data":     base64.StdEncoding.EncodeToString([]byte("png-bytes-2")),
-					},
-				},
-			},
-		},
-	}
-	reg.Register(stub)
-
-	err := runSlidesShortcut(t, f, stdout, SlidesScreenshot, []string{
-		"+screenshot",
-		"--presentation", "pres_abc",
-		"--slide-id", "slide_1,slide_2",
-		"--as", "user",
-	})
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-
-	var body struct {
-		SlideIDs []string `json:"slide_ids"`
-	}
-	if err := json.Unmarshal(stub.CapturedBody, &body); err != nil {
-		t.Fatalf("decode request body: %v", err)
-	}
-	if len(body.SlideIDs) != 2 || body.SlideIDs[0] != "slide_1" || body.SlideIDs[1] != "slide_2" {
-		t.Fatalf("slide_ids = %#v, want [slide_1 slide_2]", body.SlideIDs)
-	}
-
-	path1 := filepath.Join(dir, defaultSlidesScreenshotDir, "pres_abc_slide_1.png")
-	if _, err := os.ReadFile(path1); err != nil {
-		t.Fatalf("read first CSV slide screenshot: %v", err)
-	}
-	path2 := filepath.Join(dir, defaultSlidesScreenshotDir, "pres_abc_slide_2.png")
-	if _, err := os.ReadFile(path2); err != nil {
-		t.Fatalf("read second CSV slide screenshot: %v", err)
-	}
-}
-
-func TestSlidesScreenshotListBySlideIDCSVDeduplicatesAndTrims(t *testing.T) {
-	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
-	dir := t.TempDir()
-	withSlidesTestWorkingDir(t, dir)
-
-	f, stdout, _, reg := cmdutil.TestFactory(t, slidesTestConfig(t, ""))
-	stub := &httpmock.Stub{
-		Method: "POST",
-		URL:    "/open-apis/slides_ai/v1/xml_presentations/pres_abc/slide_images",
-		Body: map[string]interface{}{
-			"code": 0,
-			"data": map[string]interface{}{
-				"slide_images": []map[string]interface{}{
-					{
-						"slide_id": "slide_1",
-						"format":   1,
-						"data":     base64.StdEncoding.EncodeToString([]byte("png-bytes-1")),
-					},
-					{
-						"slide_id": "slide_2",
-						"format":   1,
-						"data":     base64.StdEncoding.EncodeToString([]byte("png-bytes-2")),
-					},
-				},
-			},
-		},
-	}
-	reg.Register(stub)
-
-	// CSV with a duplicate and blank segments should normalize the same way
-	// normalizeSlideIDs already does for repeated --slide-id flags.
-	err := runSlidesShortcut(t, f, stdout, SlidesScreenshot, []string{
-		"+screenshot",
-		"--presentation", "pres_abc",
-		"--slide-id", "slide_1, slide_2,slide_1,",
-		"--as", "user",
-	})
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-
-	var body struct {
-		SlideIDs []string `json:"slide_ids"`
-	}
-	if err := json.Unmarshal(stub.CapturedBody, &body); err != nil {
-		t.Fatalf("decode request body: %v", err)
-	}
-	if len(body.SlideIDs) != 2 || body.SlideIDs[0] != "slide_1" || body.SlideIDs[1] != "slide_2" {
-		t.Fatalf("slide_ids = %#v, want deduplicated [slide_1 slide_2]", body.SlideIDs)
-	}
-}
-
-func TestSlidesScreenshotListRejectsMoreThanTenSlideIDsCSV(t *testing.T) {
-	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
-	f, stdout, _, _ := cmdutil.TestFactory(t, slidesTestConfig(t, ""))
-
-	err := runSlidesShortcut(t, f, stdout, SlidesScreenshot, []string{
-		"+screenshot",
-		"--presentation", "pres_abc",
-		"--slide-id", "s1,s2,s3,s4,s5,s6,s7,s8,s9,s10,s11",
-		"--as", "user",
-	})
-	if err == nil {
-		t.Fatal("expected error")
-	}
-	problem, ok := errs.ProblemOf(err)
-	if !ok {
-		t.Fatalf("error = %v, want typed validation error", err)
-	}
-	if problem.Hint != "request at most 10 pages at a time" {
-		t.Fatalf("hint = %q, want max 10 pages guidance", problem.Hint)
-	}
-}
-
 func TestSlidesScreenshotAvoidsOverwritingExistingFile(t *testing.T) {
 	dir := t.TempDir()
 	withSlidesTestWorkingDir(t, dir)
@@ -520,27 +390,6 @@ func TestSlidesScreenshotRenderRejectsSlideSelectors(t *testing.T) {
 	}
 }
 
-func TestSlidesScreenshotRenderRejectsSlideNumberSelector(t *testing.T) {
-	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
-	f, stdout, _, _ := cmdutil.TestFactory(t, slidesTestConfig(t, ""))
-
-	// Exercises the --slide-number-only side of the --content conflict check
-	// (TestSlidesScreenshotRenderRejectsSlideSelectors above only covers the
-	// --slide-id side of that same `||` condition).
-	err := runSlidesShortcut(t, f, stdout, SlidesScreenshot, []string{
-		"+screenshot",
-		"--content", `<slide xmlns="http://www.larkoffice.com/sml/2.0"><data></data></slide>`,
-		"--slide-number", "1",
-		"--as", "user",
-	})
-	if err == nil {
-		t.Fatal("expected error")
-	}
-	if !strings.Contains(err.Error(), "--content cannot be used with --slide-id or --slide-number") {
-		t.Fatalf("error = %v, want content/slide selector conflict", err)
-	}
-}
-
 func TestSlidesScreenshotRenderRejectsListOnlyFlags(t *testing.T) {
 	f, stdout, _, _ := cmdutil.TestFactory(t, slidesTestConfig(t, ""))
 

shortcuts/task/task_query_helpers.go

@@ -24,14 +24,6 @@ func splitAndTrimCSV(input string) []string {
 	return out
 }
 
-func buildSearchPageParams(pageToken string) map[string]interface{} {
-	params := map[string]interface{}{}
-	if pageToken != "" {
-		params["page_token"] = pageToken
-	}
-	return params
-}
-
 func parseTimeRangeMillis(input string) (string, string, error) {
 	if strings.TrimSpace(input) == "" {
 		return "", "", nil

shortcuts/task/task_query_helpers_test.go

@@ -37,31 +37,6 @@ func TestSplitAndTrimCSV(t *testing.T) {
 	}
 }
 
-func TestBuildSearchPageParams(t *testing.T) {
-	tests := []struct {
-		name      string
-		pageToken string
-		wantToken string
-		wantKey   bool
-	}{
-		{name: "first page omits token"},
-		{name: "subsequent page includes token", pageToken: "pt_123", wantToken: "pt_123", wantKey: true},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			params := buildSearchPageParams(tt.pageToken)
-			got, present := params["page_token"]
-			if present != tt.wantKey {
-				t.Fatalf("page_token present = %v, want %v; params = %#v", present, tt.wantKey, params)
-			}
-			if tt.wantKey && got != tt.wantToken {
-				t.Fatalf("page_token = %v, want %q", got, tt.wantToken)
-			}
-		})
-	}
-}
-
 func TestOutputTaskSummary(t *testing.T) {
 	tests := []struct {
 		name string

shortcuts/task/task_search.go

@@ -44,10 +44,8 @@ var SearchTask = common.Shortcut{
 		if err != nil {
 			return common.NewDryRunAPI().Set("error", err.Error())
 		}
-		params := buildSearchPageParams(runtime.Str("page-token"))
 		return common.NewDryRunAPI().
 			POST("/open-apis/task/v2/tasks/search").
-			Params(params).
 			Body(body).
 			Desc("Then GET /open-apis/task/v2/tasks/:guid for each search hit to render standard output")
 	},
@@ -76,9 +74,9 @@ var SearchTask = common.Shortcut{
 		var lastPageToken string
 		var lastHasMore bool
 		var notice string
-		params := buildSearchPageParams(runtime.Str("page-token"))
+		currentBody := body
 		for page := 0; page < pageLimit; page++ {
-			data, err := callTaskAPITyped(runtime, http.MethodPost, "/open-apis/task/v2/tasks/search", params, body)
+			data, err := callTaskAPITyped(runtime, http.MethodPost, "/open-apis/task/v2/tasks/search", nil, currentBody)
 			if err != nil {
 				return err
 			}
@@ -92,7 +90,7 @@ var SearchTask = common.Shortcut{
 			if !lastHasMore || lastPageToken == "" {
 				break
 			}
-			params["page_token"] = lastPageToken
+			currentBody["page_token"] = lastPageToken
 		}
 
 		enriched := make([]map[string]interface{}, 0, len(rawItems))
@@ -185,6 +183,9 @@ func buildTaskSearchBody(runtime *common.RuntimeContext) (map[string]interface{}
 	if len(filter) > 0 {
 		body["filter"] = filter
 	}
+	if pageToken := runtime.Str("page-token"); pageToken != "" {
+		body["page_token"] = pageToken
+	}
 	return body, nil
 }
 

shortcuts/task/task_search_pagination_test.go

@@ -1,129 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package task
-
-import (
-	"encoding/json"
-	"io"
-	"net/http"
-	"reflect"
-	"testing"
-
-	"github.com/larksuite/cli/internal/httpmock"
-	"github.com/larksuite/cli/shortcuts/common"
-)
-
-func TestSearchPaginationUsesQueryToken(t *testing.T) {
-	tests := []struct {
-		name     string
-		shortcut common.Shortcut
-		command  string
-		url      string
-	}{
-		{
-			name:     "tasks",
-			shortcut: SearchTask,
-			command:  "+search",
-			url:      "/open-apis/task/v2/tasks/search",
-		},
-		{
-			name:     "tasklists",
-			shortcut: SearchTasklist,
-			command:  "+tasklist-search",
-			url:      "/open-apis/task/v2/tasklists/search",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			f, stdout, _, reg := taskShortcutTestFactory(t)
-			warmTenantToken(t, f, reg)
-
-			var pageTokens []string
-			reg.Register(searchPaginationStub(t, tt.url, "next_pt", true, &pageTokens))
-			reg.Register(searchPaginationStub(t, tt.url, "", false, &pageTokens))
-
-			shortcut := tt.shortcut
-			shortcut.AuthTypes = []string{"bot", "user"}
-			err := runMountedTaskShortcut(t, shortcut, []string{
-				tt.command,
-				"--query", "pagination",
-				"--page-token", "initial_pt",
-				"--page-limit", "2",
-				"--as", "bot",
-				"--format", "json",
-			}, f, stdout)
-			if err != nil {
-				t.Fatalf("search command failed: %v", err)
-			}
-
-			want := []string{"initial_pt", "next_pt"}
-			if !reflect.DeepEqual(pageTokens, want) {
-				t.Fatalf("search page tokens = %#v, want %#v", pageTokens, want)
-			}
-		})
-	}
-}
-
-func assertSearchDryRunPageToken(t *testing.T, preview *common.DryRunAPI, want string) {
-	t.Helper()
-
-	data, err := preview.MarshalJSON()
-	if err != nil {
-		t.Fatalf("marshal search dry-run preview: %v", err)
-	}
-	var envelope struct {
-		API []struct {
-			Params map[string]interface{} `json:"params"`
-			Body   map[string]interface{} `json:"body"`
-		} `json:"api"`
-	}
-	if err := json.Unmarshal(data, &envelope); err != nil {
-		t.Fatalf("decode search dry-run preview: %v", err)
-	}
-	if len(envelope.API) != 1 {
-		t.Fatalf("search dry-run API call count = %d, want 1; preview = %s", len(envelope.API), data)
-	}
-	call := envelope.API[0]
-	if got, _ := call.Params["page_token"].(string); got != want {
-		t.Fatalf("search dry-run params.page_token = %q, want %q; preview = %s", got, want, data)
-	}
-	if _, present := call.Body["page_token"]; present {
-		t.Fatalf("search dry-run body unexpectedly contains page_token; preview = %s", data)
-	}
-}
-
-func searchPaginationStub(t *testing.T, endpoint, responseToken string, hasMore bool, capturedTokens *[]string) *httpmock.Stub {
-	t.Helper()
-	return &httpmock.Stub{
-		Method: http.MethodPost,
-		URL:    endpoint,
-		OnMatch: func(req *http.Request) {
-			*capturedTokens = append(*capturedTokens, req.URL.Query().Get("page_token"))
-
-			body, err := io.ReadAll(req.Body)
-			if err != nil {
-				t.Errorf("read search request body: %v", err)
-				return
-			}
-			var payload map[string]interface{}
-			if err := json.Unmarshal(body, &payload); err != nil {
-				t.Errorf("decode search request body: %v", err)
-				return
-			}
-			if _, present := payload["page_token"]; present {
-				t.Errorf("search request body unexpectedly contains page_token: %s", body)
-			}
-		},
-		Body: map[string]interface{}{
-			"code": 0,
-			"msg":  "success",
-			"data": map[string]interface{}{
-				"has_more":   hasMore,
-				"page_token": responseToken,
-				"items":      []interface{}{},
-			},
-		},
-	}
-}

shortcuts/task/task_search_test.go

@@ -37,12 +37,9 @@ func TestBuildTaskSearchBody(t *testing.T) {
 			check: func(t *testing.T, body map[string]interface{}) {
 				filter := body["filter"].(map[string]interface{})
 				dueTime := filter["due_time"].(map[string]interface{})
-				if body["query"] != "release" {
+				if body["query"] != "release" || body["page_token"] != "pt_123" {
 					t.Fatalf("unexpected body: %#v", body)
 				}
-				if _, present := body["page_token"]; present {
-					t.Fatalf("body unexpectedly contains page_token: %#v", body)
-				}
 				if len(filter["creator_ids"].([]string)) != 2 || filter["is_completed"] != true {
 					t.Fatalf("unexpected filter: %#v", filter)
 				}
@@ -107,10 +104,9 @@ func TestBuildTaskSearchBody(t *testing.T) {
 
 func TestSearchTask_DryRun(t *testing.T) {
 	tests := []struct {
-		name          string
-		setup         func(*cobra.Command)
-		wantPageToken string
-		wantParts     []string
+		name      string
+		setup     func(*cobra.Command)
+		wantParts []string
 	}{
 		{
 			name: "valid dry run",
@@ -118,8 +114,7 @@ func TestSearchTask_DryRun(t *testing.T) {
 				_ = cmd.Flags().Set("query", "demo")
 				_ = cmd.Flags().Set("page-token", "pt_demo")
 			},
-			wantPageToken: "pt_demo",
-			wantParts:     []string{`"query":"demo"`},
+			wantParts: []string{"POST /open-apis/task/v2/tasks/search", `"query":"demo"`},
 		},
 		{
 			name: "dry run error on invalid due",
@@ -148,11 +143,7 @@ func TestSearchTask_DryRun(t *testing.T) {
 					t.Fatalf("Validate() error = %v", err)
 				}
 			}
-			preview := SearchTask.DryRun(nil, runtime)
-			if tt.wantPageToken != "" {
-				assertSearchDryRunPageToken(t, preview, tt.wantPageToken)
-			}
-			out := preview.Format()
+			out := SearchTask.DryRun(nil, runtime).Format()
 			for _, want := range tt.wantParts {
 				if !strings.Contains(out, want) {
 					t.Fatalf("dry run output missing %q: %s", want, out)

shortcuts/task/task_tasklist_search.go

@@ -41,10 +41,8 @@ var SearchTasklist = common.Shortcut{
 		if err != nil {
 			return common.NewDryRunAPI().Set("error", err.Error())
 		}
-		params := buildSearchPageParams(runtime.Str("page-token"))
 		return common.NewDryRunAPI().
 			POST("/open-apis/task/v2/tasklists/search").
-			Params(params).
 			Body(body).
 			Desc("Then GET /open-apis/task/v2/tasklists/:guid for each search hit to render standard output")
 	},
@@ -73,9 +71,9 @@ var SearchTasklist = common.Shortcut{
 		var lastPageToken string
 		var lastHasMore bool
 		var notice string
-		params := buildSearchPageParams(runtime.Str("page-token"))
+		currentBody := body
 		for page := 0; page < pageLimit; page++ {
-			data, err := callTaskAPITyped(runtime, http.MethodPost, "/open-apis/task/v2/tasklists/search", params, body)
+			data, err := callTaskAPITyped(runtime, http.MethodPost, "/open-apis/task/v2/tasklists/search", nil, currentBody)
 			if err != nil {
 				return err
 			}
@@ -89,7 +87,7 @@ var SearchTasklist = common.Shortcut{
 			if !lastHasMore || lastPageToken == "" {
 				break
 			}
-			params["page_token"] = lastPageToken
+			currentBody["page_token"] = lastPageToken
 		}
 
 		tasklists := make([]map[string]interface{}, 0, len(rawItems))
@@ -172,6 +170,9 @@ func buildTasklistSearchBody(runtime *common.RuntimeContext) (map[string]interfa
 	if len(filter) > 0 {
 		body["filter"] = filter
 	}
+	if pageToken := runtime.Str("page-token"); pageToken != "" {
+		body["page_token"] = pageToken
+	}
 	return body, nil
 }
 

shortcuts/task/task_tasklist_search_test.go

@@ -33,8 +33,8 @@ func TestBuildTasklistSearchBody(t *testing.T) {
 			check: func(t *testing.T, body map[string]interface{}) {
 				filter := body["filter"].(map[string]interface{})
 				createTime := filter["create_time"].(map[string]interface{})
-				if _, present := body["page_token"]; present {
-					t.Fatalf("body unexpectedly contains page_token: %#v", body)
+				if body["page_token"] != "pt_tl" {
+					t.Fatalf("unexpected body: %#v", body)
 				}
 				if filter["user_id"].([]string)[0] != "ou_creator" {
 					t.Fatalf("unexpected filter: %#v", filter)
@@ -80,10 +80,9 @@ func TestBuildTasklistSearchBody(t *testing.T) {
 
 func TestSearchTasklist_DryRun(t *testing.T) {
 	tests := []struct {
-		name          string
-		setup         func(*cobra.Command)
-		wantPageToken string
-		wantParts     []string
+		name      string
+		setup     func(*cobra.Command)
+		wantParts []string
 	}{
 		{
 			name: "valid dry run",
@@ -91,8 +90,7 @@ func TestSearchTasklist_DryRun(t *testing.T) {
 				_ = cmd.Flags().Set("query", "Q2")
 				_ = cmd.Flags().Set("page-token", "pt_tl")
 			},
-			wantPageToken: "pt_tl",
-			wantParts:     []string{`"query":"Q2"`},
+			wantParts: []string{"POST /open-apis/task/v2/tasklists/search", `"query":"Q2"`},
 		},
 		{
 			name: "dry run error on invalid create time",
@@ -118,11 +116,7 @@ func TestSearchTasklist_DryRun(t *testing.T) {
 					t.Fatalf("Validate() error = %v", err)
 				}
 			}
-			preview := SearchTasklist.DryRun(nil, runtime)
-			if tt.wantPageToken != "" {
-				assertSearchDryRunPageToken(t, preview, tt.wantPageToken)
-			}
-			out := preview.Format()
+			out := SearchTasklist.DryRun(nil, runtime).Format()
 			for _, want := range tt.wantParts {
 				if !strings.Contains(out, want) {
 					t.Fatalf("dry run output missing %q: %s", want, out)

skills/lark-base/SKILL.md

@@ -57,12 +57,12 @@ metadata:
 | 写记录 | `+record-upsert` / `+record-batch-create` / `+record-batch-update` | 必读 [lark-base-record-upsert.md](references/lark-base-record-upsert.md) / [lark-base-record-batch-create.md](references/lark-base-record-batch-create.md) / [lark-base-record-batch-update.md](references/lark-base-record-batch-update.md) 和 [lark-base-cell-value.md](references/lark-base-cell-value.md) |
 | 附件字段 | `+record-upload-attachment` / `+record-download-attachment` / `+record-remove-attachment` | 附件不要伪造成普通 CellValue；上传走本地文件，下载/删除按 file token 或字段定位 |
 | 删除记录 / 分享记录链接 / 历史 | `+record-delete` / `+record-share-link-create` / `+record-history-list` | 删除前确认 record；分享链接最多 100 条；历史读 [lark-base-record-history-list.md](references/lark-base-record-history-list.md)，只查单条记录，不做整表审计 |
-| 管理视图 | `+view-*` | `+view-set-filter` 读 [lark-base-view-set-filter.md](references/lark-base-view-set-filter.md)（filter 条件结构见公共协议 [lark-base-filter-condition.md](references/lark-base-filter-condition.md)）；其余配置先 get 现状，再按返回结构更新 |
+| 管理视图 | `+view-*` | `+view-set-filter` 读 [lark-base-view-set-filter.md](references/lark-base-view-set-filter.md)；其余配置先 get 现状，再按返回结构更新 |
 | 一次性聚合统计 | `+data-query` | 必读 [lark-base-data-analysis-sop.md](references/lark-base-data-analysis-sop.md) 和入口 [lark-base-data-query-guide.md](references/lark-base-data-query-guide.md)；完整 DSL 再读 [lark-base-data-query.md](references/lark-base-data-query.md) |
 | 公式字段 | `+field-create/update --json '{"type":"formula",...}'` | 必读 [formula-field-guide.md](references/formula-field-guide.md)，读后再加隐藏确认 flag `--i-have-read-guide` |
 | Lookup 字段 | `+field-create/update --json '{"type":"lookup",...}'` | 必读 [lookup-field-guide.md](references/lookup-field-guide.md)，读后再加隐藏确认 flag `--i-have-read-guide` |
 | 表单提交 | `+form-submit` | 先读 [lark-base-form-detail.md](references/lark-base-form-detail.md) 获取题目、filter 和附件所需 `base_token`；提交 JSON 读 [lark-base-form-submit.md](references/lark-base-form-submit.md) |
-| 表单题目创建/更新 | `+form-questions-create` / `+form-questions-update` | 读 [lark-base-form-questions-create.md](references/lark-base-form-questions-create.md) / [lark-base-form-questions-update.md](references/lark-base-form-questions-update.md)；题目显隐条件 `visible_rule` 结构见公共协议 [lark-base-filter-condition.md](references/lark-base-filter-condition.md) |
+| 表单题目创建/更新 | `+form-questions-create` / `+form-questions-update` | 读 [lark-base-form-questions-create.md](references/lark-base-form-questions-create.md) / [lark-base-form-questions-update.md](references/lark-base-form-questions-update.md) |
 | 其他表单管理 | `+form-list/get/detail/create/update/delete` / `+form-questions-list/delete` | `+form-detail` 读 [lark-base-form-detail.md](references/lark-base-form-detail.md)；删除前确认目标表单 |
 | 仪表盘与组件 | `+dashboard-*` / `+dashboard-block-*` | 提到图表/看板/block 时先读 [lark-base-dashboard.md](references/lark-base-dashboard.md)；组件 `data_config` 读 [dashboard-block-data-config.md](references/dashboard-block-data-config.md)；读取图表计算结果用 `+dashboard-block-get-data` |
 | Workflow | `+workflow-*` | 创建/更新或理解 steps 时读入口 [lark-base-workflow-guide.md](references/lark-base-workflow-guide.md) 和 steps JSON SSOT [lark-base-workflow-schema.md](references/lark-base-workflow-schema.md)；list/get/enable/disable 只处理 workflow ID 与启停状态 |
@@ -116,7 +116,6 @@ metadata:
 ## 表单与视图细节
 
 - `+form-submit` 是高风险写操作，必须带 `--yes` 确认；调用前必须先跑 `+form-detail`，读取 `questions[].type`、`required`、`filter` 和附件场景需要的 `base_token`；不要填写被 filter 隐藏的问题。
-- `+form-questions-update` 是题目配置全量覆盖，不是 patch；未传字段会回落默认值，传空字符串 / `null` / 空数组会直接写入空或清空。更新前先 `+form-questions-list` 读取当前题目，把要保留的 `title` / `description` / `required` / `option_display_mode` / `visible_rule` 等字段带回请求。
 - 表单附件不要写进 `fields`，放在 `--json.attachments`；提交附件时必须同时传表单所属 Base 的 `--base-token`。
 - `+view-set-filter` 是唯一保留的 view reference；sort/group/card/timebar/visible-fields 这类配置先用对应 get 命令读现状，保留未修改字段，只替换用户要求变更的配置。
 - 视图适合持久化、共享和 UI 复用；一次性筛选/排序可先用 `+record-list` / `+record-search` 的 filter/sort 验证结果，再按需要沉淀为持久视图。
@@ -147,14 +146,13 @@ metadata:
 ## 保留 Reference
 
 - [lark-base-data-analysis-sop.md](references/lark-base-data-analysis-sop.md)：查询/统计/全局结论的选路 SOP
-- [lark-base-data-query-guide.md](references/lark-base-data-query-guide.md) / [lark-base-data-query.md](references/lark-base-data-query.md)：聚合查询入口 fewshot 与 DSL SSOT；`+data-query` 的 `filters` 结构是独立对象 DSL，不使用公共 tuple filter 协议
+- [lark-base-data-query-guide.md](references/lark-base-data-query-guide.md) / [lark-base-data-query.md](references/lark-base-data-query.md)：聚合查询入口 fewshot 与 DSL SSOT
 - [lark-base-cell-value.md](references/lark-base-cell-value.md)：记录 CellValue 构造
 - [lark-base-field-json.md](references/lark-base-field-json.md)：字段 JSON 构造
 - [formula-field-guide.md](references/formula-field-guide.md) / [lookup-field-guide.md](references/lookup-field-guide.md)：公式与 lookup 字段
 - [lark-base-field-create.md](references/lark-base-field-create.md) / [lark-base-field-update.md](references/lark-base-field-update.md)：字段创建/更新命令级补充
 - [lark-base-record-upsert.md](references/lark-base-record-upsert.md) / [lark-base-record-batch-create.md](references/lark-base-record-batch-create.md) / [lark-base-record-batch-update.md](references/lark-base-record-batch-update.md) / [lark-base-record-history-list.md](references/lark-base-record-history-list.md)：记录写入 JSON 与历史返回解释
 - [lark-base-view-set-filter.md](references/lark-base-view-set-filter.md)：视图筛选 JSON
-- [lark-base-filter-condition.md](references/lark-base-filter-condition.md)：视图 filter、记录 `--filter-json`、表单 `visible_rule` 的 tuple 条件结构公共协议 SSOT；不适用于 `+data-query`
 - [lark-base-form-detail.md](references/lark-base-form-detail.md) / [lark-base-form-submit.md](references/lark-base-form-submit.md) / [lark-base-form-questions-create.md](references/lark-base-form-questions-create.md) / [lark-base-form-questions-update.md](references/lark-base-form-questions-update.md)：表单详情、提交和复杂 JSON
 - [lark-base-dashboard.md](references/lark-base-dashboard.md) / [dashboard-block-data-config.md](references/dashboard-block-data-config.md) / [lark-base-dashboard-block-get-data.md](references/lark-base-dashboard-block-get-data.md)：仪表盘、组件配置与图表结果协议
 - [lark-base-workflow-guide.md](references/lark-base-workflow-guide.md) / [lark-base-workflow-schema.md](references/lark-base-workflow-schema.md)：workflow 入口与 steps JSON SSOT

skills/lark-base/references/lark-base-filter-condition.md

@@ -1,179 +0,0 @@
-# Base Filter 条件结构（公共协议）
-
-Filter 是一组「字段/操作符/值」条件的组合，用 `logic`（`and` / `or`）把多条 `conditions` 连接起来，用于描述「满足什么条件」。视图筛选 `filter`、记录读取/搜索的 `--filter-json`、表单题目显隐条件 `visible_rule` 复用同一套 tuple 结构，本文件是其公共协议（SSOT）。
-
-## 0. 适用范围
-
-本协议只适用于以下场景：
-
-- `+view-set-filter` / `+view-get-filter` 的视图筛选配置。
-- `+record-list --filter-json` / `+record-search --filter-json` 的结构化记录筛选。
-- `+form-questions-create` / `+form-questions-update` 中的 `visible_rule` 显隐条件。
-
-本协议**不适用于 `+data-query`**。`+data-query` 支持过滤，但使用的是 LiteQuery DSL 的 `filters` 对象结构：`{"type":1,"conjunction":"and","conditions":[{"field_name":"状态","operator":"is","value":["有效"]}]}`，不是这里的 tuple 条件 `["状态","==","有效"]`。构造 `+data-query --dsl` 时请阅读 [lark-base-data-query.md](lark-base-data-query.md) 的 FilterGroup / Condition 章节。
-
-## 1. 顶层结构
-
-- 必须是 JSON 对象。
-- 顶层结构是 `{logic?, conditions?}`。
-- `logic` 默认 `and`；推荐只用 canonical 值 `and` / `or`。
-- `conditions` 默认空数组。
-- 每条条件写成 tuple：`[field, operator, value?]`。
-- `empty` / `non_empty` 可写成 2 项：`[field, "empty"]`、`[field, "non_empty"]`。
-
-```json
-{
-  "logic": "and",
-  "conditions": [
-    ["状态", "intersects", ["Doing"]],
-    ["负责人", "intersects", [{ "id": "ou_xxx" }]],
-    ["截止时间", "empty"]
-  ]
-}
-```
-
-清空写法：
-
-```json
-{
-  "conditions": []
-}
-```
-
-## 2. operator
-
-可用 operator：
-- `==`
-- `!=`
-- `>`
-- `>=`
-- `<`
-- `<=`
-- `intersects`
-- `disjoint`
-- `empty`
-- `non_empty`
-
-## 3. value 写法
-
-value 类型取决于条件引用对象（字段 / 题目）的类型。
-
-### `text`
-
-用字符串：
-
-```json
-["标题", "intersects", "发布"]
-```
-
-### `location`
-
-location 筛选只按 `full_address` 字符串匹配，不能直接按经纬度筛选；优先使用 `intersects` 做包含匹配，例如查深圳：
-
-```json
-["位置", "intersects", "深圳"]
-```
-
-不推荐写 `["位置", "==", "深圳"]` 这类精确匹配，除非确保筛选值与完整 `full_address` 完全一致。
-
-### `number` / `auto_number`
-
-用数字：
-
-```json
-["工时", ">=", 3.5]
-```
-
-### `select`
-
-用选项名数组：
-
-```json
-["状态", "intersects", ["Doing", "Blocked"]]
-```
-
-### `user` / `created_by` / `updated_by`
-
-用对象数组：
-
-> **人员筛选：不要猜 ID。** 不知道 `open_id` 时，先用 `lark-contact` 查 id：`lark-cli contact +search-user --query "<姓名/邮箱/手机号>" --as user`。
-
-```json
-["负责人", "intersects", [{ "id": "ou_xxx" }]]
-```
-
-### `group_chat`
-
-用对象数组：
-
-> **群组筛选：不要猜 ID。** 不知道 `chat_id` 时，先用 `lark-im` 搜群：`lark-cli im +chat-search --query "<群名关键词>" --as user`；取结果里的 `oc_xxx`。
-
-```json
-["负责群", "intersects", [{ "id": "oc_xxx" }]]
-```
-
-### `link`
-
-用记录 id 对象数组：
-
-```json
-["关联任务", "intersects", [{ "id": "rec_xxx" }]]
-```
-
-### `checkbox`
-
-用布尔值：
-
-```json
-["完成", "==", true]
-```
-
-### `datetime` / `created_at` / `updated_at`
-
-用相对时间关键字或 `ExactDate(...)`：
-
-```json
-["截止时间", "==", "ExactDate(2026-01-01)"]
-```
-
-```json
-["截止时间", "==", "ExactDate(2026-01-01 11:30)"]
-```
-
-```json
-["截止时间", "==", "Today"]
-```
-
-可用关键字：
-- `Today`
-- `Yesterday`
-- `Tomorrow`
-
-### `formula` / `lookup`
-
-- 筛选值类型由字段计算结果类型动态决定。
-- 拿不准时，先把 `value` 当作单个字符串填入做一次尝试。
-- 如果报错，再按错误提示把 `value` 改成对应类型。
-
-字符串示例：
-
-```json
-["风险说明", "intersects", "高风险"]
-```
-
-数字示例：
-
-```json
-["汇总分", ">=", 80]
-```
-
-## 4. 易错点
-
-- 不要再写旧对象风格：`{"field_name":...,"operator":...}`。
-- `user` / `group_chat` / `link` 不要写成单个标量。
-- `empty` / `non_empty` 不要硬塞无意义的 value。
-- 日期条件稳定写法用 `ExactDate(...)` 或 `Today` / `Yesterday` / `Tomorrow`。
-- `formula` / `lookup` 的 value 形状不固定；拿不准时先读当前配置或字段定义，或根据错误提示修正类型。
-
-## 5. 参考
-- [lookup-field-guide.md](lookup-field-guide.md)

skills/lark-base/references/lark-base-form-questions-create.md

@@ -19,7 +19,10 @@ lark-cli base +form-questions-create \
   --base-token <base_token> \
   --table-id <table_id> \
   --form-id <form_id> \
-  --questions '[{"type":"text","title":"您的姓名是？","required":true},{"type":"text","title":"您的联系方式是？","required":false}]'
+  --questions '[
+    {"type":"text","title":"您的姓名是？","required":true},
+    {"type":"text","title":"您的联系方式是？","required":false}
+  ]'
 
 # 添加单选题（带选项）
 lark-cli base +form-questions-create \
@@ -47,13 +50,6 @@ lark-cli base +form-questions-create \
   --table-id <table_id> \
   --form-id <form_id> \
   --questions '[{"type":"text","title":"反馈建议","description":"更多详情请查看[帮助文档](https://example.com/help)"}]'  
-
-# 添加带显隐条件（visible_rule）的问题：当「是否需要发票」选择「是」时才显示「发票抬头」
-lark-cli base +form-questions-create \
-  --base-token <base_token> \
-  --table-id <table_id> \
-  --form-id <form_id> \
-  --questions '[{"type":"select","title":"是否需要发票","required":true,"options":[{"name":"是","hue":"Blue"},{"name":"否","hue":"Gray"}]},{"type":"text","title":"发票抬头","visible_rule":{"logic":"and","conditions":[["是否需要发票","==","是"]]}}]'
 ```
 
 ## 参数
@@ -82,7 +78,6 @@ lark-cli base +form-questions-create \
 | `multiple`            | 否 | 是否多选（`select`/`user` 类型有效，bool） |
 | `options`             | 否 | 选项列表（仅 `select` 有效）：`[{"name":"选项1","hue":"Blue"}]`，hue 可选：`Red`/`Orange`/`Yellow`/`Green`/`Blue`/`Purple`/`Gray` |
 | `style`               | 否 | 字段样式配置（见下方说明） |
-| `visible_rule`        | 否 | 题目显隐条件（见下方「`visible_rule` 显隐条件」） |
 
 ### `style` 字段说明
 
@@ -93,30 +88,6 @@ lark-cli base +form-questions-create \
 | `number`（评分） | `{"type":"rating","icon":"star","min":1,"max":5}` | icon 可选：`star`/`heart`/`thumbsup`/`fire`/`smile`/`lightning`/`flower`/`number` |
 | `datetime` | `{"format":"yyyy/MM/dd"}` | format 可选：`yyyy/MM/dd`、`yyyy/MM/dd HH:mm`、`MM-dd`、`MM/dd/yyyy`、`dd/MM/yyyy` |
 
-### `visible_rule` 显隐条件
-
-> **仅当用户明确要求为题目设置显隐条件（显示/隐藏逻辑）时，才需要读下面的结构说明；否则忽略本节。**
-
-`visible_rule` 控制题目在表单中的显示/隐藏：当条件满足时题目显示，不满足时隐藏；不传或 `conditions` 为空数组则题目始终显示。
-
-- **结构与视图筛选 `filter` 完全一致**，即 `{logic?, conditions?}`，共用同一套公共协议。
-- 与视图 `filter` 唯一的区别：`conditions` 中的 `field` 引用的是**同一表单内其他题目的题目名称或题目 ID**（推荐用题目 ID 以避免重名歧义），而不是数据表字段。
-- **只能引用前序题目**：条件只能引用排在当前题目之前的题目——创建时按 `questions` 数组顺序判定（可引用同批次更靠前的新题目或表单中已有题目），不支持循环引用。
-- 引用的题目必须真实存在，否则会报错。
-- 列出题目（`+form-questions-list`）会在每个题目对象中**原样返回** `visible_rule`；未设置显隐条件的题目返回 `null` 或 `conditions` 为空数组。
-
-```json
-{
-  "logic": "and",
-  "conditions": [
-    ["是否需要发票", "==", "是"],
-    ["报销金额", ">=", 1000]
-  ]
-}
-```
-
-详细的 `visible_rule` 结构（顶层规则、operator 列表、各题目类型的 value 写法）请阅读 [lark-base-filter-condition.md](lark-base-filter-condition.md)。
-
 ## 输出格式
 
 返回创建成功的问题列表：
@@ -144,5 +115,4 @@ lark-cli base +form-questions-create \
 ## 参考
 
 - [lark-base](../SKILL.md) — 多维表格全部命令
-- [lark-base-filter-condition.md](lark-base-filter-condition.md) — `visible_rule` / `filter` 条件结构公共协议
 - [lark-shared](../../lark-shared/SKILL.md) — 认证和全局参数

skills/lark-base/references/lark-base-form-questions-update.md

@@ -2,60 +2,40 @@
 
 > **前置条件：** 先阅读 [`../lark-shared/SKILL.md`](../../lark-shared/SKILL.md) 了解认证、全局参数和安全规则。
 
-批量更新多维表格表单/问卷中的问题配置（标题、描述、是否必填、显隐条件等）。
-
-> [!CAUTION]
-> `+form-questions-update` 是**题目配置全量覆盖**，不是 patch。对每个传入的题目，未携带的属性会回落为默认值，显式传空字符串 / `null` / 空数组会直接写入空或清空；如果要保留现有属性，必须先用 `+form-questions-list` 查出现状，再把要保留的字段一起带回 `--questions`。
+批量更新多维表格表单/问卷中的问题（标题、描述、是否必填）。
 
 ## 命令
 
 ```bash
-# 先读取现有题目配置，作为 read-modify-write 的基线
-lark-cli base +form-questions-list \
-  --base-token <base_token> \
-  --table-id <table_id> \
-  --form-id <form_id>
-
-# 更新一个问题的标题，同时带回要保留的 required / description / visible_rule 等字段
+# 更新一个问题的标题
 lark-cli base +form-questions-update \
   --base-token <base_token> \
   --table-id <table_id> \
   --form-id <form_id> \
-  --questions '[{"id":"q_001","title":"您的真实姓名是？","description":"请填写真实姓名","required":true,"visible_rule":null}]'
+  --questions '[{"id":"q_001","title":"您的真实姓名是？"}]'
 
-# 同时更新多个问题；每个对象都应是该题目的目标完整配置
+# 同时更新多个问题
 lark-cli base +form-questions-update \
   --base-token <base_token> \
   --table-id <table_id> \
   --form-id <form_id> \
-  --questions '[{"id":"q_001","title":"姓名（必填）","required":true},{"id":"q_002","title":"联系方式","required":false}]'
+  --questions '[
+    {"id":"q_001","title":"姓名（必填）","required":true},
+    {"id":"q_002","title":"联系方式","required":false}
+  ]'
   
-# 更新问题描述（纯文本），同时带回要保留的 title / required / visible_rule
+# 更新问题描述（纯文本）
 lark-cli base +form-questions-update \
   --base-token <base_token> \
   --table-id <table_id> \
   --form-id <form_id> \
-  --questions '[{"id":"q_001","title":"您的姓名","description":"请填写您的真实姓名","required":true,"visible_rule":null}]'
-# 更新问题描述（含链接），同时带回要保留的 title / required / visible_rule
+  --questions '[{"id":"q_001","description":"请填写您的真实姓名"}]'
+# 更新问题描述（含链接）
 lark-cli base +form-questions-update \
   --base-token <base_token> \
   --table-id <table_id> \
   --form-id <form_id> \
-  --questions '[{"id":"q_001","title":"反馈建议","description":"更多说明请参考[帮助文档](https://example.com/help)","required":false,"visible_rule":null}]'
-
-# 更新题目显隐条件（visible_rule），同时带回要保留的 title / description / required
-lark-cli base +form-questions-update \
-  --base-token <base_token> \
-  --table-id <table_id> \
-  --form-id <form_id> \
-  --questions '[{"id":"q_002","title":"发票抬头","description":"","required":false,"visible_rule":{"logic":"and","conditions":[["q_001","==","是"]]}}]'
-
-# 清空题目显隐条件（使题目始终显示），同时带回要保留的 title / description / required
-lark-cli base +form-questions-update \
-  --base-token <base_token> \
-  --table-id <table_id> \
-  --form-id <form_id> \
-  --questions '[{"id":"q_002","title":"发票抬头","description":"","required":false,"visible_rule":null}]'
+  --questions '[{"id":"q_001","description":"更多说明请参考[帮助文档](https://example.com/help)"}]'  
 ```
 
 ## 参数
@@ -72,46 +52,15 @@ lark-cli base +form-questions-update \
 
 ## `--questions` 格式
 
-每个问题对象必须包含 `id`。注意：对象不是增量 patch，而是该题目的目标完整配置；未携带字段会按服务端默认值重建。
+每个问题对象必须包含 `id`，其余字段按需传入：
 
 | 字段 | 必填 | 说明 |
 |------|------|------|
 | `id` | **是** | 问题 ID（field_id），不可修改 |
-| `title` | 否 | 目标问题标题；省略会回落为字段名，传空字符串会写入空标题（若服务端允许） |
-| `description` | 否 | 目标问题描述（纯文本或 Markdown 链接，如 `[文本](https://example.com)`）；省略或传空字符串都会清空描述 |
-| `required` | 否 | 目标是否必填；省略会回落为 `false` |
-| `option_display_mode` | 否 | 目标选项展示方式（仅 `select` 有效）：`0`=下拉，`1`=纵向（默认），`2`=横向；省略会回落默认展示方式 |
-| `visible_rule` | 否 | 目标题目显隐条件；传完整 `{logic, conditions}` 对象覆盖，传 `null` 或省略都会清空（见下方说明） |
-
-## 全量覆盖语义
-
-- 先执行 `+form-questions-list`，读取被更新题目的当前 `id`、`title`、`description`、`required`、`option_display_mode`、`visible_rule`。
-- 构造 `--questions` 时，只改用户明确要求变化的字段；所有仍要保留的字段必须按当前值一并传回。
-- 不要用“只传要改的字段”的方式更新题目。比如只传 `{"id":"q_002","title":"新标题"}` 会让 `description` 清空、`required` 回落为 `false`、`visible_rule` 清空。
-- 用户明确要求清空时才传空值：`description:""` 清空描述，`visible_rule:null` 清空显隐条件，`conditions:[]` 也表示无条件显示。
-
-### `visible_rule` 显隐条件
-
-> **仅当用户明确要求为题目设置或修改显隐条件（显示/隐藏逻辑）时，才需要读下面的结构说明；否则忽略本节。**
-
-`visible_rule` 控制题目显示/隐藏，**结构与视图筛选 `filter` 完全一致**（`{logic?, conditions?}`），共用同一套公共协议。
-
-- `conditions` 中的 `field` 引用**同一表单内其他题目的题目名称或题目 ID**（推荐用题目 ID）。
-- 更新时按表单中题目的**实际顺序**判定，只能引用排在当前题目之前的题目；不支持循环引用。
-- 更新 `visible_rule` 需传**完整**的 `{logic, conditions}` 对象（整体覆盖）；要保留现有显隐条件就必须把当前 `visible_rule` 原样带回；传 `null`、省略 `visible_rule` 或传空 `conditions` 都会使题目始终显示。
-- 列出题目（`+form-questions-list`）会在每个题目对象中**原样返回** `visible_rule`；未设置显隐条件的题目返回 `null` 或 `conditions` 为空数组。
-
-```json
-{
-  "logic": "and",
-  "conditions": [
-    ["q_001", "==", "是"],
-    ["q_003", ">=", 1000]
-  ]
-}
-```
-
-详细的 `visible_rule` 结构（顶层规则、operator 列表、各题目类型的 value 写法）请阅读 [lark-base-filter-condition.md](lark-base-filter-condition.md)。
+| `title` | 否 | 新的问题标题 |
+| `description` | 否 | 新的问题描述（纯文本或 Markdown 链接，如 `[文本](https://example.com)`） |
+| `required` | 否 | 是否必填 |
+| `option_display_mode` | 否 | 选项展示方式（仅 `select` 有效）：`0`=下拉，`1`=纵向（默认），`2`=横向 |
 
 ## 输出格式
 
@@ -133,13 +82,11 @@ lark-cli base +form-questions-update \
 > [!CAUTION]
 > 这是**写入操作** — 执行前必须向用户确认。
 
-1. 先用 `+form-questions-list` 获取现有问题及其 `id` 和完整配置。
-2. 以现有配置为基线，只修改用户明确要求变化的字段；要保留的字段必须原样带回。
-3. 构造包含 `id` 和目标完整配置的更新数组。
-4. 执行命令并报告更新结果。
+1. 先用 `+form-questions-list` 获取现有问题及其 `id`
+2. 构造包含 `id` 的更新数组
+3. 执行命令并报告更新结果
 
 ## 参考
 
 - [lark-base](../SKILL.md) — 多维表格全部命令
-- [lark-base-filter-condition.md](lark-base-filter-condition.md) — `visible_rule` / `filter` 条件结构公共协议
 - [lark-shared](../../lark-shared/SKILL.md) — 认证和全局参数

skills/lark-base/references/lark-base-view-set-filter.md

@@ -4,13 +4,142 @@
 
 更新视图筛选配置。
 
-## 1. filter 结构
-
-`--json` 就是一个 filter 条件对象，结构见公共协议 SSOT [lark-base-filter-condition.md](lark-base-filter-condition.md)，即 `{logic?, conditions?}`。此处 `conditions` 中的 `field` 引用**数据表字段名或字段 id**。
+## 1. 顶层规则
 
+- `--json` 必须是 JSON 对象。
+- 顶层结构是 `{logic?, conditions?}`。
+- `logic` 默认 `and`；推荐只用 canonical 值 `and` / `or`。
+- `conditions` 默认空数组。
+- 每条条件写成 tuple：`[field, operator, value?]`。
+- `empty` / `non_empty` 可写成 2 项：`[field, "empty"]`、`[field, "non_empty"]`。
 - 支持 `filter` 的视图类型：`grid`、`kanban`、`gallery`、`calendar`、`gantt`。
 
-## 2. 推荐命令
+## 2. operator
+
+可用 operator：
+- `==`
+- `!=`
+- `>`
+- `>=`
+- `<`
+- `<=`
+- `intersects`
+- `disjoint`
+- `empty`
+- `non_empty`
+
+## 3. value 写法
+
+### `text`
+
+用字符串：
+
+```json
+["标题", "intersects", "发布"]
+```
+
+### `location`
+
+location 筛选只按 `full_address` 字符串匹配，不能直接按经纬度筛选；优先使用 `intersects` 做包含匹配，例如查深圳：
+
+```json
+["位置", "intersects", "深圳"]
+```
+
+不推荐写 `["位置", "==", "深圳"]` 这类精确匹配，除非确保筛选值与完整 `full_address` 完全一致。
+
+### `number` / `auto_number`
+
+用数字：
+
+```json
+["工时", ">=", 3.5]
+```
+
+### `select`
+
+用选项名数组：
+
+```json
+["状态", "intersects", ["Doing", "Blocked"]]
+```
+
+### `user` / `created_by` / `updated_by`
+
+用对象数组：
+
+> **人员筛选：不要猜 ID。** 不知道 `open_id` 时，先用 `lark-contact` 查 id：`lark-cli contact +search-user --query "<姓名/邮箱/手机号>" --as user`。
+
+```json
+["负责人", "intersects", [{ "id": "ou_xxx" }]]
+```
+
+### `group_chat`
+
+用对象数组：
+
+> **群组筛选：不要猜 ID。** 不知道 `chat_id` 时，先用 `lark-im` 搜群：`lark-cli im +chat-search --query "<群名关键词>" --as user`；取结果里的 `oc_xxx`。
+
+```json
+["负责群", "intersects", [{ "id": "oc_xxx" }]]
+```
+
+### `link`
+
+用记录 id 对象数组：
+
+```json
+["关联任务", "intersects", [{ "id": "rec_xxx" }]]
+```
+
+### `checkbox`
+
+用布尔值：
+
+```json
+["完成", "==", true]
+```
+
+### `datetime` / `created_at` / `updated_at`
+
+用相对时间关键字或 `ExactDate(...)`：
+
+```json
+["截止时间", "==", "ExactDate(2026-01-01)"]
+```
+
+```json
+["截止时间", "==", "ExactDate(2026-01-01 11:30)"]
+```
+
+```json
+["截止时间", "==", "Today"]
+```
+
+可用关键字：
+- `Today`
+- `Yesterday`
+- `Tomorrow`
+
+### `formula` / `lookup`
+
+- 筛选值类型由字段计算结果类型动态决定。
+- 拿不准时，先把 `value` 当作单个字符串填入做一次尝试。
+- 如果报错，再按错误提示把 `value` 改成对应类型。
+
+字符串示例：
+
+```json
+["风险说明", "intersects", "高风险"]
+```
+
+数字示例：
+
+```json
+["汇总分", ">=", 80]
+```
+
+## 4. 推荐命令
 
 ```bash
 lark-cli base +view-set-filter \
@@ -20,7 +149,7 @@ lark-cli base +view-set-filter \
   --json '{"logic":"and","conditions":[["状态","intersects",["Doing"]],["负责人","intersects",[{"id":"ou_xxx"}]],["截止时间","empty"]]}'
 ```
 
-## 3. JSON 写法
+## 5. JSON 写法
 
 ```json
 {
@@ -41,16 +170,14 @@ lark-cli base +view-set-filter \
 }
 ```
 
-完整的 operator 列表与各字段类型的 value 写法（`text` / `number` / `select` / `user` / `datetime` / `formula` / `lookup` 等），见 [lark-base-filter-condition.md](lark-base-filter-condition.md)。
-
-## 4. 使用建议
+## 6. 使用建议
 
 - 先读取当前筛选配置，理解现有 `logic` 和 `conditions` 的组合关系；只替换用户要求变更的条件，未提到的条件默认保留。
 - 优先传字段 id，不要依赖字段名。
 - 拿不准字段 type 或真实取值时，先用 `+field-list` / `+record-list` 确认，再按对应字段类型的 value 写法构造条件；别按字段名猜 type、凭印象猜枚举取值。
 - 需要清空全部筛选时，直接传 `{"conditions":[]}`。
 
-## 5. 易错点
+## 7. 易错点
 
 - 本 tuple DSL 由 `+view-set-filter` 与 `+record-list` / `+record-search` 的 `--filter-json` 共用；不要写成 `+data-query` 的对象风格 `{"field_name":...,"operator":...}`（会报校验失败）。
 - 标量类字段（`text` / `number` / `datetime` 等）的 value 用标量、别包成数组（各类型详见 value 写法一节）。
@@ -59,7 +186,6 @@ lark-cli base +view-set-filter \
 - 日期条件稳定写法用 `ExactDate(...)` 或 `Today` / `Yesterday` / `Tomorrow`。
 - `formula` / `lookup` 的 value 形状不固定；拿不准时先读当前 filter 或字段定义，或根据错误提示修正类型。
 
-## 6. 参考
+## 8. 参考
 
-- [lark-base-filter-condition.md](lark-base-filter-condition.md)：filter/visible_rule 条件结构公共协议 SSOT
 - [lookup-field-guide.md](lookup-field-guide.md)

skills/lark-calendar/SKILL.md

@@ -16,16 +16,14 @@ metadata:
 
 ## 身份
 
-按**日程归属**选身份：
-
-- 查看/管理登录用户本人的日程 → `--as user`（默认，绝大多数场景）。
-- 查看/管理 bot 自己创建/拥有的日程 → `--as bot` 
+日程操作默认使用 `--as user`（查看和管理当前用户的日程）。`--as bot` 只能访问 bot 自己的（空）日历，会拿到空结果——不要用 bot 身份查用户日程。
 
 ```bash
-# 用户本人日程 → user
-lark-cli calendar +agenda --as user
-# bot 自建或参与的日程 → bot
+# BAD — bot 身份查用户日程，返回空列表
 lark-cli calendar +agenda --as bot
+
+# GOOD — user 身份查日程
+lark-cli calendar +agenda --as user
 ```
 
 ## Shortcuts
@@ -50,8 +48,6 @@ lark-cli calendar +agenda --as bot
 lark-cli calendar +get --calendar-id <calendar_id> --event-id <event_id>
 ```
 
-日程描述统一使用 `description` 一个字段，按 **Markdown** 富文本处理。读取日程时 `description` 返回 Markdown 富文本（仅有纯文本描述时返回该纯文本）；创建/更新日程时也通过 `--description` 传入 Markdown。
-
 ### `+search-event` — 按关键词、时间范围和参会人搜索日程
 
 仅返回基础字段（`event_id`/`summary`/`start`/`end` 等），需要详情请走 `+get`。
@@ -190,8 +186,6 @@ lark-cli contact +search-user --query <query> --as user
 lark-cli im +chat-search --query <query> --as user
 ```
 
-> 搜索用户接口不支持 bot 身份，必须用 `--as user`；搜到的 `ou_` open_id 用于日程参与人操作（如添加日程参与人）。
-
 ## 不在本 skill 范围
 
 - 查询过去的视频会议记录 → [lark-vc](../lark-vc/SKILL.md)

skills/lark-calendar/references/lark-calendar-create.md

@@ -32,19 +32,19 @@ lark-cli calendar +create --summary "..." --start "..." --end "..." \
 | `--summary <text>` | 否 | 日程标题。注意：标题中不应该出现时间、地点、人物信息 |
 | `--start <time>` | 是 | 开始时间（ISO 8601，如 `2026-03-12T14:00+08:00`） |
 | `--end <time>` | 是 | 结束时间（ISO 8601） |
-| `--description <markdown>` | 否 | 日程描述，统一使用此字段，格式为 **Markdown**。提供会议议程、活动内容、注意事项或链接等。支持加粗、斜体、下划线（`<u>...</u>`）、删除线、链接 `[文本](url)`、标题（`# ` 到 `### `，最多三级）、引用（`> `）、有序/无序列表、GFM 表格（`\| 列1 \| 列2 \|` + 分隔行 `\| --- \| --- \|`）、以及图片 `![图片名](图片URL)`（标准 Markdown 图片语法：远程 URL 原样使用；**本地图片路径**（相对路径、且位于当前工作目录内）会自动上传到云盘并在端上内联渲染——绝对路径或工作目录之外的路径会报错；端上已有图片读回为 Markdown 图片）。飞书文档 URL（直接粘贴裸链接，或写成 `[文本](url)`）会自动解析为内联文档，端上展示文档标题而非裸链接。支持 `@文件路径` 或 `-`（stdin）读取。**禁止**用 `***文本***` 同时表示加粗+斜体（端上会残留 `*`）；应嵌套书写，如 `**<u>*~~文本~~*</u>**` 或 `*<u>**~~文本~~**</u>*`。|
-| `--attendee-ids <id_list>` | 否 | 参与人 ID 列表（逗号分隔）。支持用户（`ou_`）、群组（`oc_`）和会议室（`omm_`）。AI 提取时请务必保留对应前缀。bot 可作为合法参会人，无需剔除 |
+| `--description <text>` | 否 | 日程详细描述。提供会议议程、活动内容、注意事项或链接等。与 summary 配合使用，仅关注当前日程信息 |
+| `--attendee-ids <id_list>` | 否 | 参与人 ID 列表（逗号分隔）。支持用户（`ou_`）、群组（`oc_`）和会议室（`omm_`）。AI 提取时请务必保留对应前缀 |
 | `--calendar-id <id>` | 否 | 日历 ID（省略则使用主日历） |
 | `--rrule <rrule>` | 否 | 重复日程的重复性规则，规则设置方式参考rfc5545。示例值："FREQ=DAILY;INTERVAL=1;UNTIL=<具体日期>" |
 | `--dry-run` | 否 | 预览 API 调用，不执行 |
 
 > 当用户表达'每周 X'、'每周重复'、'连续 N 周'时，必须使用 rrule 创建重复性日程，而非创建多个独立日程
-> `--description` 行内同时加粗和斜体时，**禁止**写 `***文本***`（端上会残留 `*`）；必须让 `**` 与 `*` 各自成对嵌套，例如 `**<u>*~~文本~~*</u>**` 或 `*<u>**~~文本~~**</u>*`。
 > 自动设置 `attendee_ability: "can_modify_event"`，参会人可查看彼此并编辑日程。
 > 自动设置 `free_busy_status: "busy"`，默认日程忙闲状态为忙碌。
 > 自动设置 `reminders: [{"minutes": 5}]`，默认日程开始前 5 分钟提醒。
 > 自动设置 `vchat: {"vc_type": "vc"}`，默认日程包含飞书视频会议。如需其他视频会议类型或不含视频会议，请使用完整 API 命令。
 > 失败保护：若添加参会人失败（如 open_id 错误），CLI 会自动删除刚创建的空日程（回滚，不通知参会人）。
+> 搜索用户接口不支持 bot 身份，需用 `--as user` 进行搜索。
 > 审批会议室：`+create` 不暴露低频字段 `attendees[].approval_reason`。如果会议室要求审批，请使用用户身份先创建日程，再用完整 API `calendar event.attendees create --as user` 添加会议室并传 `approval_reason`。
 
 ## 高级用法（完整 API 命令）

skills/lark-calendar/references/lark-calendar-room-find.md

@@ -50,13 +50,12 @@ lark-cli calendar +room-find \
 | `--room-name <text>` | 否 | 会议室名称约束，支持以**英文逗号**分隔传入多个名称。仅当用户明确提到会议室专名、会议室号或编号区间时使用。 |
 | `--min-capacity <n>` | 否 | 会议室最小容纳人数。当用户明确参会人数或提出“至少容纳N人”等要求时，提取数字放入此参数，必须为正整数。 |
 | `--max-capacity <n>` | 否 | 会议室最大容纳人数。用于过滤过大空间，必须为正整数。 |
-| `--attendee-ids <id_list>` | 否 | 参会对象 ID 列表。支持用户 ID（`ou_` 前缀）和群组 ID（`oc_` 前缀），多个 ID 以逗号分隔。**不要传入 bot 的 open_id**：bot 是虚拟身份，不占会议室席位、无会议室偏好，传入只会干扰推荐结果。 |
+| `--attendee-ids <id_list>` | 否 | 参会对象 ID 列表。支持用户 ID（`ou_` 前缀）和群组 ID（`oc_` 前缀），多个 ID 以逗号分隔。 |
 | `--event-rrule <rrule>` | 否 | 重复日程的重复性规则，规则设置方式参考rfc5545。**【⚠️注意：系统绝对不支持 COUNT，如需限制重复次数，必须转为 UNTIL】**。示例值："FREQ=DAILY;INTERVAL=1" |
 | `--timezone <tz>` | 否 | 对话中明确提及的预约日程所使用的时区（默认取用户设备时区，例如 `Asia/Shanghai`） |
 
 ## 规则
 
-- 构造 `--attendee-ids` 前，先剔除 bot 参会人：bot 不占席位、无偏好，不应参与会议室推荐。
 - 多个 `--slot` 会由 CLI 内部并发调用单时间块接口，再聚合成一次输出
 - `+room-find` 的时间输入必须是**确定时间块**，不是时间区间搜索。
 - 如果是重复性日程，必须校验返回中的 `reserve_until_time`（该会议室最晚可预约时间）是否覆盖 `event-rrule` 对应的重复范围。

skills/lark-calendar/references/lark-calendar-schedule-clear-time.md

@@ -39,7 +39,6 @@ lark-cli calendar +freebusy --start "<start>" --end "<end>"
 ```
 
 规则：
-- 参与人含 **bot**：无需为 bot 查询忙闲。bot 是虚拟身份，可并行多个会议、无忙闲语义，检查它没有意义。
 - 参与人过多（超过 5 人）：仅查询**当前用户**及少数核心人员忙闲即可
 - 参与人含**群组**：无需展开群组成员查询忙闲
 - 如果用户是从 `+suggestion` 确认了时间块后进入本分支的，**无需再调用 `+freebusy`**

skills/lark-calendar/references/lark-calendar-suggestion.md

@@ -45,7 +45,7 @@ lark-cli calendar +suggestion \
 | ------------------------------- | ----- | ------------------------------------------------------------------- |
 | `--start <time>`                | 否     | 搜索区间开始时间（支持日期/ISO 8601等格式，默认**当前时间**）                                |
 | `--end <time>`                  | 否     | 搜索区间结束时间（默认与 `--start` 属于同一天，自动取当天结束时间）                                                     |
-| `--attendee-ids <id_list>`     | 否     | 目标参与人 ID 列表。提取对应实体的 ID。支持用户（`ou_` 前缀）和群组（`oc_` 前缀）。多个 ID 使用英文逗号分隔。**不要传入 bot 的 open_id**：bot 是虚拟身份，可并行多个会议、无忙闲语义，传入会干扰推荐时段的忙闲计算。 |
+| `--attendee-ids <id_list>`     | 否     | 目标参与人 ID 列表。提取对应实体的 ID。支持用户（`ou_` 前缀）和群组（`oc_` 前缀）。多个 ID 使用英文逗号分隔 |
 | `--event-rrule <rrule>`         | 否     | 重复日程的重复性规则，规则设置方式参考rfc5545。**【⚠️注意：系统绝对不支持 COUNT，如需限制重复次数，必须转为 UNTIL】**。示例值："FREQ=DAILY;INTERVAL=1"                                              |
 | `--duration-minutes <min>`      | 否     | 会议时长（分钟）。优先使用用户显式指定的值，若未指定则尝试根据上下文推断，推断失败则不传                                        |
 | `--timezone <tz>`               | 否     | 对话中明确提及的预约日程所使用的时区（默认取用户设备时区，例如 `Asia/Shanghai`）                                |

skills/lark-calendar/references/lark-calendar-update.md

@@ -43,7 +43,7 @@ lark-cli calendar +update \
 | `--event-id <id>` | 是 | 要更新的日程 ID。重复性日程请根据操作范围选择 ID，详见 [重复性日程操作规范](lark-calendar-recurring.md) |
 | `--calendar-id <id>` | 否 | 日历 ID（省略则使用 `primary`） |
 | `--summary <text>` | 否 | 新日程标题。仅在显式传入 `--summary` 时更新；若传空字符串，会把标题清空 |
-| `--description <markdown>` | 否 | 新日程描述，统一使用此字段，格式为 **Markdown**（加粗、斜体、下划线 `<u>...</u>`、删除线、链接 `[文本](url)`、标题 `# `~`### `（最多三级）、引用 `> `、有序/无序列表、GFM 表格 `\| 列1 \| 列2 \|` + 分隔行 `\| --- \| --- \|`、以及图片 `![图片名](图片URL)`（标准 Markdown 图片语法：远程 URL 原样使用；**本地图片路径**（相对路径、且位于当前工作目录内）会自动上传到云盘并在端上内联渲染——绝对路径或工作目录之外的路径会报错；端上已有图片读回为 Markdown 图片）。飞书文档 URL（裸链接或 `[文本](url)`）会自动解析为内联文档，端上展示文档标题。支持 `@文件路径` 或 `-`（stdin）读取。仅在显式传入时更新；传空字符串 `""` 会清空描述。**禁止**用 `***文本***` 同时表示加粗+斜体（端上会残留 `*`）；应嵌套书写，如 `**<u>*~~文本~~*</u>**` 或 `*<u>**~~文本~~**</u>*`。 |
+| `--description <text>` | 否 | 新日程描述。目前 API 方式不支持编辑富文本描述；如果日程描述通过客户端编辑为富文本内容，则使用 API 更新描述会导致富文本格式丢失。仅在显式传入 `--description` 时更新；若传空字符串，会把描述清空 |
 | `--start <time>` | 否 | 新开始时间（ISO 8601，如 `2026-03-12T14:00+08:00`）。更新日程时间时必须同时传 `--end` |
 | `--end <time>` | 否 | 新结束时间（ISO 8601）。更新日程时间时必须同时传 `--start` |
 | `--rrule <rrule>` | 否 | 新重复规则（RFC5545）。**不要使用 COUNT；如需限制次数，推算后转为 UNTIL** |
@@ -58,12 +58,9 @@ lark-cli calendar +update \
 
 - `--add-attendee-ids` 是**增量添加**，不是替换最终参与人列表。不要用它表达“只保留这些人”。
 - 对 `--summary`、`--description`，CLI 以“是否显式传入该 flag”判断是否更新，而不是以“值是否为空”判断；如果显式传入空字符串，会把对应字段清空。
-- 日程描述统一走 `--description`（按 Markdown 富文本处理）。
-- 行内同时加粗和斜体时，**禁止**写 `***文本***`（端上会残留 `*`）；必须让 `**` 与 `*` 各自成对嵌套，例如 `**<u>*~~文本~~*</u>**` 或 `*<u>**~~文本~~**</u>*`。
 - 只想增删参会人或会议室时，不需要同时传 `--summary`、`--start`、`--end` 等日程字段。
 - 只想修改标题、描述、时间或重复规则时，不需要同时传 `--add-attendee-ids` 或 `--remove-attendee-ids`。
 - 如需替换某个参与人、群组或会议室，使用 `--remove-attendee-ids <旧ID>` + `--add-attendee-ids <新ID>`。
-- bot 可作为合法参会人添加，无需剔除。
 - 会议室是 resource attendee，必须使用 `omm_` ID 添加到参会人列表，不能脱离日程单独预定。
 - 更新重复性日程时，必须先确定操作范围（仅此次/全部/此次及后续），然后按 [重复性日程操作规范](lark-calendar-recurring.md) 执行。
 - 当同一次命令组合多个动作时，执行顺序为“日程字段 -> 移除参会人 -> 添加参会人”。若中途失败，不会自动回滚已成功步骤；错误信息会说明已完成的步骤。

skills/lark-doc/references/lark-doc-xml.md

@@ -13,7 +13,7 @@ p, h1-h9, ul, ol, li, table, thead, tbody, tr, th, td, blockquote, pre, code, hr
 ## 容器标签
 |标签|说明|关键属性|
 |-|-|-|
-| `<callout>` | 高亮框，子块仅支持文本块（如 `<p>`）、标题、列表、待办、引用；禁止裸文本及 `<table>`、`<img>`、`<pre>`、`<hr>`、`<grid>`、`<whiteboard>`、`<sheet>` 等其他块级标签或资源块 | `emoji`(默认 bulb), `background-color`, `border-color`, `text-color` |
+| `<callout>` | 高亮框，子块仅支持文本、标题、列表、待办、引用 | `emoji`(默认 bulb), `background-color`, `border-color`, `text-color` |
 | `<grid>` + `<column>` | 分栏布局，各列 width-ratio 之和为 1 | `width-ratio` |
 | `<whiteboard>` | 嵌入画板 | `type`: `blank` \| `mermaid` \| `plantuml` \| `svg` |
 | `<pre>` | （代码块，内含 `code`）| `lang`, `caption` |

skills/lark-drive/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: lark-drive
 version: 1.0.0
-description: "飞书云空间（云盘/云存储）：管理 Drive 文件和文件夹，包含上传/下载、创建文件夹、复制/移动/删除、查看元数据、查询权限设置、评论/权限/订阅、标题、版本、飞书文档密级标签（secure labels）和本地文件导入。用户需要整理云盘目录、处理云空间资源 URL/token、判断链接类型/真实 token/标题，或导入 Word/Markdown/Excel/CSV/PPTX/.base 为 docx/sheet/bitable/slides 时使用；doubao.com 云空间 URL/token 也按资源路径和 token 路由，不回退 WebFetch。不负责：文档内容编辑（走 lark-doc）、表格/Base 表内数据操作（走 lark-sheets/lark-base）、知识空间节点/成员管理（走 lark-wiki）、原生 Markdown 文件读写/patch/diff（走 lark-markdown）。"
+description: "飞书云空间（云盘/云存储）：管理 Drive 文件和文件夹，包含上传/下载、创建文件夹、复制/移动/删除、查看元数据、评论/权限/订阅、标题、版本、飞书文档密级标签（secure labels）和本地文件导入。用户需要整理云盘目录、处理云空间资源 URL/token、判断链接类型/真实 token/标题，或导入 Word/Markdown/Excel/CSV/PPTX/.base 为 docx/sheet/bitable/slides 时使用；doubao.com 云空间 URL/token 也按资源路径和 token 路由，不回退 WebFetch。不负责：文档内容编辑（走 lark-doc）、表格/Base 表内数据操作（走 lark-sheets/lark-base）、知识空间节点/成员管理（走 lark-wiki）、原生 Markdown 文件读写/patch/diff（走 lark-markdown）。"
 metadata:
   requires:
     bins: ["lark-cli"]
@@ -27,7 +27,6 @@ metadata:
 - 用户要**检查 / 治理文档权限、公开范围、链接分享、外部访问、复制下载权限、密级标签、owner 转移**，或要”权限风险报告、收紧权限、申请查看 / 编辑权限、转移 / 批量转移 owner”，必须先阅读 [`references/lark-drive-workflow.md`](references/lark-drive-workflow.md)，再按其中 `Workflow Registry` 进入 [`permission_governance`](references/lark-drive-workflow-permission-governance.md) workflow。
 - 用户要为指定飞书文档**设置 / 修改密级标签（secure label）**，或查询当前用户可用的密级标签，直接读取 [`references/lark-drive-secure-label.md`](references/lark-drive-secure-label.md)；这是 Drive 文件治理能力。
 - 用户要**检查 / 治理文档权限、公开范围、链接分享、外部访问、复制下载权限、密级标签、owner 转移**，或要“权限风险报告、收紧权限、申请查看 / 编辑权限、转移 / 批量转移 owner”，必须先阅读 [`references/lark-drive-workflow.md`](references/lark-drive-workflow.md)，再按其中 `Workflow Registry` 进入 [`permission_governance`](references/lark-drive-workflow-permission-governance.md) workflow。
-- 用户要**查询文件、文件夹或云文档自身的公开访问、分享、协作者管理、安全与评论权限设置**，优先使用 `lark-cli drive +permission-get-setting`；它只读取目标自身设置，不递归审计文件夹子文档权限。裸 token 必须显式传 `--type`。
 - 用户要**按特定主题、关键词或内容线索跨容器查找资料，并统一收集到 Drive 文件夹或 Wiki 节点**，必须先阅读 [`references/lark-drive-workflow.md`](references/lark-drive-workflow.md)，再按其中 `Workflow Registry` 进入 [`topic_move_collector`](references/lark-drive-workflow-topic-move-collector.md) workflow。该 workflow 负责搜索召回、内容验证、相关性分类、移动计划、写前确认和结果验证；禁止直接从 `drive +search` 或 `drive +move` 开始。
 - 用户要**整理云盘 / 文件夹 / 文档库 / 知识库 / 个人文档库**，或要“盘点目录结构、找出未归档/临时/重复/空目录、生成整理方案”，必须先阅读 [`references/lark-drive-workflow.md`](references/lark-drive-workflow.md)，再按其中 `Workflow Registry` 进入 [`knowledge_organize`](references/lark-drive-workflow-knowledge-organize.md) workflow。默认只生成方案；创建目录、移动资源、申请权限都必须单独确认。
 - 按主题跨范围查找并集中归档，进入 `topic_move_collector`；对已知文件夹、文档库或知识库做目录盘点和结构重组，进入 `knowledge_organize`；只移动一个已明确资源时仍使用原子移动命令。
@@ -121,7 +120,6 @@ lark-cli drive +inspect --url 'https://xxx.feishu.cn/wiki/wikcnXXX'
 ### 权限能力入口
 
 - 用户要管理 Drive 文档/文件协作者、公开权限、授权当前应用访问文档，或处理 `permission.public.patch` 的 `91009` / `91010` / `91011` / `91012` 错误时，先读 [`lark-drive-permission-guide.md`](references/lark-drive-permission-guide.md)。
-- 用户要查询文件、文件夹或云文档自身的公开访问、分享、协作者管理、安全与评论权限设置，使用 [`+permission-get-setting`](references/lark-drive-permission-get-setting.md)；如果要递归审计文件夹下子文档权限，再进入 [`permission_governance`](references/lark-drive-workflow-permission-governance.md) workflow。
 - 用户只是没有访问权限并希望向 owner 申请访问，优先使用 [`+apply-permission`](references/lark-drive-apply-permission.md)。
 - 普通 scope、身份或登录问题仍按 [`lark-shared`](../lark-shared/SKILL.md) 处理；不要把租户安全策略、对外分享、密级拦截简单归类为缺 scope。
 
@@ -165,8 +163,6 @@ Shortcut 是对常用操作的高级封装（`lark-cli drive +<verb> [flags]`）
 | [`+inspect`](references/lark-drive-inspect.md) | 检视 URL 的类型、标题和 canonical token；wiki URL 会自动解包到底层文档。 |
 | [`+apply-permission`](references/lark-drive-apply-permission.md) | 以 user 身份向文档 owner 申请访问权限。 |
 | [`+member-add`](references/lark-drive-member-add.md) | 添加一个或最多 10 个 Drive 文档、文件、文件夹或 wiki 节点协作者/授权成员；封装 Drive permission member create/batch_create，真实写入需要 `--yes`。 |
-| [`+member-list`](references/lark-drive-member-list.md) | 查询 Drive 文档、文件、文件夹或 wiki 节点的协作者/授权成员列表。 |
-| [`+permission-get-setting`](references/lark-drive-permission-get-setting.md) | 查询文件、文件夹或云文档自身的公开访问、分享、协作者管理、安全与评论权限设置；支持 URL 或裸 token + `--type`；不递归读取文件夹子文档权限。 |
 | [`+secure-label-list`](references/lark-drive-secure-label.md) | 列出当前用户可用的密级标签。 |
 | [`+secure-label-update`](references/lark-drive-secure-label.md) | 更新 Drive 文件或文档的密级标签。 |
 

skills/lark-drive/references/lark-drive-member-list.md

@@ -1,65 +0,0 @@
-# drive +member-list（查询协作者/授权成员列表）
-
-本 skill 对应 shortcut：`lark-cli drive +member-list`。它读取 Drive 文档、文件、文件夹或 wiki 节点的协作者/授权成员列表。
-
-## 命令
-
-```bash
-#  URL 自动推断 type
-lark-cli drive +member-list \
-  --token 'https://example.feishu.cn/drive/folder/<folder_token>' \
-  --as user --format json
-
-# 查询附加字段
-lark-cli drive +member-list \
-  --token '<token>' \
-  --type docx \
-  --fields 'name,type,external_label' \
-  --as user --format json
-
-```
-
-## 参数
-
-| 参数 | 必填 | 说明 |
-|------|------|------|
-| `--token` | 是 | 裸 token 或完整 URL。URL 路径支持 `/folder/`、`/docx/`、`/doc/`、`/sheets/`、`/base/`、`/bitable/`、`/wiki/`、`/file/`、`/mindnotes/`、`/slides/`、`/minutes/`。 |
-| `--type` | 裸 token 必填 | 目标类型：`doc` / `sheet` / `file` / `wiki` / `bitable` / `docx` / `mindnote` / `minutes` / `slides` / `folder`。URL 可自动推断；如果同时传 URL 和冲突的 `--type`，CLI 会拒绝。 |
-| `--fields` | 否 | 默认不传。可取 `name` / `type` / `avatar` / `external_label`，支持逗号分隔；也可传 `*` 请求当前支持的所有附加字段。该参数只声明期望返回的字段，不授予字段级权限。 |
-| `--perm-type` | 否 | 仅 `--type wiki` 有效；取值 `container` / `single_page`。 |
-| `--dry-run` | 否 | 只打印请求，不调用 API。 |
-
-## 输出
-
-JSON 输出原样透传 API 的 `data` ：
-
-```json
-{
-  "ok": true,
-  "identity": "user",
-  "data": {
-    "items": [
-      {
-        "member_type": "openid",
-        "member_id": "ou_xxx",
-        "perm": "view",
-        "perm_type": "container",
-        "type": "user",
-        "name": "zhangsan",
-        "external_label": false
-      }
-    ]
-  }
-}
-```
-
-`--format pretty` 会轻量展示成员 ID、成员类型、权限、wiki `perm_type` 和已返回的附加字段。机器读取优先使用 `--format json`。
-
-## 行为说明
-
-- **身份支持**：`--as user` 和 `--as bot` 均可用；缺 scope 或目标权限时按统一 permission 错误路径处理。
-- **接口 scope**：查询成员列表需要 `docs:permission.member:retrieve`。
-- **fields 默认**：不传 `--fields` 时按官方 API 默认，不请求姓名、头像、外部标签等附加字段；需要时显式指定。
-- **字段级权限**：`--fields` 只控制请求哪些附加字段，不保证服务端一定返回。请求用户的 `name` / `avatar` 时，应用还需开通 `contact:user.base:readonly`（“获取用户基本信息”；已具备官方兼容的历史通讯录权限也可满足要求）。
-- **缺字段语义**：字段级权限或数据可见性不足时，接口仍可能成功，但会省略相应敏感字段。响应中缺少已请求字段表示“服务端未返回”，不能解释为字段值为空，也不能据此认定成员信息完整。
-- **folder 支持**：CLI 支持 `--type folder` 并会按需求发送 `type=folder`；部分环境的后端如果尚未放开 folder 枚举，可能返回 `99992402 field validation failed`。

skills/lark-drive/references/lark-drive-permission-get-setting.md

@@ -1,48 +0,0 @@
-# drive +permission-get-setting（查询权限设置）
-
-本 skill 对应 shortcut：`lark-cli drive +permission-get-setting`。它读取单个 Drive 资源自身的公开访问、分享、协作者管理、安全与评论权限设置，不递归读取文件夹中的子资源。
-
-## 命令
-
-```bash
-# 通过 URL 自动推断 type
-lark-cli drive +permission-get-setting \
-  --token 'https://example.feishu.cn/drive/folder/<folder_token>' \
-  --as user --format json
-
-# 通过 bare token 显式指定 type
-lark-cli drive +permission-get-setting \
-  --token '<folder_token>' \
-  --type folder \
-  --as user --format json
-```
-
-## 参数
-
-| 参数 | 必填 | 说明 |
-|------|------|------|
-| `--token` | 是 | bare token 或完整 URL。URL 路径支持 `/folder/`、`/docx/`、`/doc/`、`/sheets/`、`/base/`、`/bitable/`、`/wiki/`、`/file/`、`/mindnotes/`、`/slides/`、`/minutes/`。 |
-| `--type` | bare token 必填 | 目标类型：`doc` / `sheet` / `file` / `wiki` / `bitable` / `docx` / `mindnote` / `minutes` / `slides` / `folder`。URL 可自动推断；如果同时传 URL 和冲突的 `--type`，CLI 会拒绝。 |
-| `--dry-run` | 否 | 只打印请求，不调用 API。 |
-
-## 输出
-
-JSON 输出中的 `data.permission_public` 是目标当前的权限设置；服务端未返回该字段时，命令会报响应结构错误，而不会把其他字段伪装成权限设置。
-
-```json
-{
-  "ok": true,
-  "identity": "user",
-  "data": {
-    "permission_public": {}
-  }
-}
-```
-
-`--format pretty` 会展示完整的 `permission_public` 对象，包括服务端将来新增的字段。
-
-## 行为说明
-
-- **身份支持**：`--as user` 和 `--as bot` 均可用。
-- **所需 scope**：`docs:permission.setting:read`。
-- **单目标读取**：命令只读取 `--token` 指向资源自身的权限设置；`--type folder` 不会递归读取子资源。

skills/lark-drive/references/lark-drive-search.md

@@ -26,16 +26,11 @@
 > **`--query` 最长 30 个字符**：按字符数（Unicode 码点）算，中文每字算 1 个，与 ASCII 同口径；超过 30 会被服务端拒绝（`99992402 field validation failed`，**是报错不是截断**）。长关键词必须先压缩成核心实体 + 主题词（如把整句问题压成「项目名 + 主题」再搜），不要把整句原问塞进 `--query`。
 >
 > **列表型请求不要硬塞关键词**：如果用户只是要求"我这月创建的所有文档"、"最近半年我编辑过的文档"、"按类型分类统计"这类范围浏览 / 汇总请求，且没有给出标题片段或业务关键词，应使用 `--query ""` 搭配 `--created-by-me`、`--mine`、`--created-*`、`--edited-*`、`--doc-types` 等过滤条件。不要把"查找"、"所有文档"、"最近更新过"、"按类型分类统计"这类动作词或统计意图放进 `--query`，否则会把本来应靠 filter 命中的结果过度收窄。
->
-> **标题词 + 正文词联合搜索**：如果用户同时给出标题关键词和正文关键词，并要求同一资源同时满足两项条件，优先执行一条普通联合搜索：`lark-cli drive +search --query "标题词 正文词"`，并在同一条命令中叠加用户指定的 `--folder-tokens`、`--doc-types` 等过滤条件。不要把这种联合搜索拆成“标题搜索 + 正文搜索”后自行拼交集；也不要把 `--only-title` 或 `intitle:` 用作主候选路径。只有用户明确只查标题时，才使用 `--only-title` 或 `intitle:`。
->
-> 用户要求最终返回 N 条时，N 是输出上限，不等于 `--page-size N`。逐页根据 `title` 和 `summary_highlighted` 保留同时满足两项条件的候选；有效候选不足 N 且 `has_more=true` 时，保持同一 query 和过滤条件，使用 `--page-token` 继续，最多检查 3 页。摘要不足以判断正文条件时，只对标题已匹配的候选串行读取正文，确认一个再处理下一个，找到 N 条后停止；不要并发拉取正文。检查 3 页后仍不足时，返回已确认结果并建议用户调整标题词、正文词或搜索范围，不要无界扫描。
 
 ### 自然语言 → 命令映射速查
 
 | 用户说 | 命令 |
 |---|---|
-| 标题含某词且正文含某词，限定文件夹内最多 N 个结果（N 为最终输出上限；按上文规则分页筛选，勿作为 `--page-size`） | `lark-cli drive +search --query "标题词 正文词" --folder-tokens <FOLDER_TOKEN>` |
 | 我这月创建的所有文档，按类型分类统计 | `lark-cli drive +search --query "" --created-by-me --created-since "<YYYY-MM-DD>" --created-until "<YYYY-MM-DD>"` |
 | 最近半年我编辑过的文档，看看哪些最近更新过 | `lark-cli drive +search --query "" --edited-since 6m --sort edit_time` |
 | 最近一个月我编辑过的文档 | `lark-cli drive +search --query "" --edited-since 1m` |
@@ -222,7 +217,7 @@ stdout 的 JSON 输出不受影响。`open_time` / `create_time` 不做 snap。
   - **日历表达**（"上个月"、"上周"、"本月"、"前年"、"今年 3 月"等明确日历单位）→ **必须算出绝对 `YYYY-MM-DD` 边界**（如"上个月" = 上一个日历月的 1 号 → 当月 1 号），**不要近似成 `1m`/`2m`**：CLI 里 `m` 是固定 30 天、`y` 固定 365 天，跟日历差 0-3 天，月末月初尤其容易偏出去
   - 文档中的 `"<YYYY-MM-DD>"` 是运行时占位符：执行命令前按当前日期计算并替换。例如"本月"应替换为本月第一天和下月第一天，不要把示例生成时的月份硬编码进答案
   - 绝对日期 → 直接 `YYYY-MM-DD` 或 RFC3339
-- **分页策略**：默认只返回第一页，并说明 `has_more` 和下一页命令。用户明确要"全部 / 全量 / 继续翻"时继续；标题词 + 正文词联合搜索尚未找到足够的有效 Top N 候选时，按上文规则最多检查 3 页。其他场景单轮翻页上限 5 页。
+- **分页策略**：默认只返回第一页，并说明 `has_more` 和下一页命令。只有用户明确要"全部 / 全量 / 继续翻"才继续。单轮翻页上限 5 页。
 - **原始返回**：用户要求"原始数据"、"接口返回"时用 `--format json`，不做客户端精确过滤或摘要重写。
 
 ## 权限

skills/lark-drive/references/lark-drive-secure-label.md

@@ -28,7 +28,7 @@ lark-cli drive +secure-label-list --page-size 10 --lang zh
 ```bash
 lark-cli drive +secure-label-update \
   --token "https://example.feishu.cn/docx/doxcnxxxx" \
-  --label-id '<label-id>' # replace $LABEL_ID before running
+  --label-id "7217780879644737539"
 ```
 
 参数：

skills/lark-drive/references/lark-drive-workflow-permission-governance-commands.md

@@ -15,8 +15,6 @@
 lark-cli drive +inspect --url '<url>' --as user --format json
 ```
 
-`drive +inspect` 支持 Drive folder，并且是受支持 Drive URL 的统一解析入口。对文件夹自身权限设置，先通过 `+inspect` 解析 URL，或直接使用 `drive +permission-get-setting --token '<folder_url>'`；传 bare folder token 时必须显式传 `--type folder`。
-
 `/wiki/space/<space_id>` URL 是 Wiki space 范围，不要用 `drive +inspect` 当作单文档解析；直接提取 `space_id` 后进入 `DISCOVER_TARGETS`。
 
 ## 目标发现
@@ -27,16 +25,16 @@ lark-cli drive +inspect --url '<url>' --as user --format json
 lark-cli wiki +node-list \
   --space-id '<space_id>' --page-size 50 \
   --page-all --page-limit 0 \
-  --as user --format json # replace $SPACE_ID before running
+  --as user --format json
 
 lark-cli wiki +node-list \
   --space-id '<space_id>' --parent-node-token '<node_token>' --page-size 50 \
   --page-all --page-limit 0 \
-  --as user --format json # replace $SPACE_ID before running
+  --as user --format json
 
 lark-cli wiki +node-list \
   --space-id '<space_id>' --page-token '<PAGE_TOKEN>' --page-size 50 \
-  --as user --format json # replace $SPACE_ID before running
+  --as user --format json
 ```
 
 解析返回时使用 `data.nodes`，不要读取顶层 `items`。`--page-limit 0` 表示当前层分页不设页数上限；`--page-all` 只覆盖当前 `space-id` / `parent-node-token` 范围内的分页，不会递归子节点。节点 `has_child=true` 时，必须继续以该节点的 `node_token` 作为 `--parent-node-token` 递归读取。
@@ -63,42 +61,14 @@ lark-cli drive metas batch_query \
   --as user --format json
 ```
 
-读取权限设置：
+读取 public permission：
 
 ```bash
-lark-cli drive +permission-get-setting \
-  --token '<url-or-token>' --type '<type>' \
+lark-cli drive permission.public get \
+  --params '{"token":"<token>","type":"<type>"}' \
   --as user --format json
 ```
 
-裸 folder token 必须显式传 `--type folder`：
-
-```bash
-lark-cli drive +permission-get-setting \
-  --token '<folder_token>' --type folder \
-  --as user --format json
-```
-
-通过 URL 读取权限设置时可以省略 `--type`：
-
-```bash
-lark-cli drive +permission-get-setting \
-  --token '<url>' \
-  --as user --format json # replace $LARK_DRIVE_URL before running
-```
-
-按需读取直接协作者/授权成员列表：
-
-```bash
-lark-cli drive +member-list \
-  --token '<token_or_url>' \
-  --type '<type>' \
-  --fields 'name,type,external_label' \
-  --as user --format json
-```
-
-`--fields` 默认不传；只有需要名称、协作者类型、头像或外部标签时才显式传。它只声明期望返回的字段，不授予字段级权限：请求用户的 `name` / `avatar` 时还需 `contact:user.base:readonly`（“获取用户基本信息”）。字段权限或数据可见性不足时，接口仍可能成功但省略相应字段；缺字段不能解释为空值。
-
 按需读取访问统计：
 
 ```bash
@@ -190,9 +160,9 @@ lark-cli drive +secure-label-list \
 ```bash
 lark-cli drive +secure-label-update \
   --token '<url>' \
-  --label-id '<label-id>' --as user --format json # replace $LABEL_ID before running
+  --label-id '<label-id>' --as user --format json
 
 lark-cli drive +secure-label-update \
   --token '<bare-token>' --type '<type>' \
-  --label-id '<label-id>' --as user --format json # replace $LABEL_ID before running
+  --label-id '<label-id>' --as user --format json
 ```

skills/lark-drive/references/lark-drive-workflow-permission-governance-outputs.md

@@ -27,7 +27,7 @@
 - 多目标明确列表默认输出逐目标诊断摘要；不要因为目标数大于 1 就套用容器递归发现报告。
 - 用户可见结论默认跟随用户当前语言。用户用中文提问时输出中文，用户用英文提问时输出英文；混合语言时跟随主要语言。
 - 单目标公开性判断默认输出业务表达，不直接展示 `link_share_entity`、`external_access_entity`、`external_access` 等底层字段名；只有用户要求 raw evidence、排障，或完整清单 / artifact 场景才展示底层字段。
-- 中文用户可见输出中，`permission_public` / `public permission` 默认译为“目标公共访问和协作权限设置”；可在摘要里简称“公共访问与协作设置”。优先按实际返回字段解释公开访问、分享、协作者管理、安全与评论设置；复制内容、创建副本、打印、下载等字段只有在当前 CLI schema 和实际响应返回时才可判断。只有命令名、schema 字段、raw evidence、排障信息和完整 artifact 字段名保留英文原文。
+- 中文用户可见输出中，`permission_public` / `public permission` 默认译为“文档公共访问和协作权限设置”；可在摘要里简称“公共访问与协作设置”。它在官方语义中包含链接分享、对外分享、协作者管理、复制内容、创建副本、打印、下载和评论；具体可判断字段以当前 CLI schema 和实际响应为准。只有命令名、schema 字段、raw evidence、排障信息和完整 artifact 字段名保留英文原文。
 - 容器目标默认输出安全诊断报告摘要：一句话结论、覆盖情况、风险分级、优先处理对象、建议下一步和剩余限制。
 - 容器目标不要把风险按数量机械排序；外部公开、允许对外分享、缺失密级标签优先于复制 / 下载 / 评论这类依赖策略的候选项。
 - 用户没有提供明确 policy 时，使用“候选风险 / 待复核 / 待策略确认”，不要写“违规 / 已泄露 / 已外部访问”。
@@ -36,7 +36,7 @@
 - 当摘要未展示全部风险对象时，必须明确“完整清单包含 <count> 条”，并提供生成 Markdown / CSV / 飞书文档风险清单或整改 dry-run 的下一步。
 - 只要发现需要处理的对象，最终回复必须给出可执行下一步 CTA。不能因为默认只读，就只报告风险后结束。
 - 完整风险清单是后续治理选择的输入；Markdown / CSV / 飞书文档报告必须使用同一套字段和稳定 `risk_id`。
-- 写入前必须使用确认模板；权限申请、目标公共访问和协作权限设置修改、owner 转移、密级标签更新分别确认。
+- 写入前必须使用确认模板；权限申请、文档公共访问和协作权限设置修改、owner 转移、密级标签更新分别确认。
 - 最终回复必须包含已完成事项、验证结果和剩余限制；异步权限申请审批不能表述为已完成授权。
 
 ## Semantic Rendering
@@ -75,7 +75,7 @@
 | `lock_switch=true` | `lock_state=locked_not_inheriting` | 已限制权限，不再继承父级页面权限 | The node is locked and no longer inherits parent-page permissions |
 | `lock_switch=false` | `lock_state=not_locked_or_inheriting` | 未限制权限，可能继承父级页面权限 | The node is not locked and may inherit parent-page permissions |
 | field absent / unsupported | `<state>=unknown` | 当前 schema 未返回，无法判断 | The current schema did not return this field, so it is unknown |
-| `check_scope=current_public_permission_only` | `check_scope=current_public_permission_only` | 本次判断的是当前目标公共访问和协作权限设置，不是协作者名单或历史权限变更审计 | This check covers the target's current public access and collaboration settings, not collaborator-list or historical permission-change auditing |
+| `check_scope=current_public_permission_only` | `check_scope=current_public_permission_only` | 本次判断的是当前文档公共访问和协作权限设置，不是协作者名单或历史权限变更审计 | This check covers current public access and collaboration settings, not collaborator-list or historical permission-change auditing |
 | `sec_label_name` missing | `sec_label=missing` | 缺少密级标签 | Security label is missing |
 
 ## 定位与治理动作
@@ -165,7 +165,7 @@ Evidence fields:
 
 覆盖情况：
 - 用户提供目标：<input_target_count>；成功解析：<resolved_count>
-- 成功读取目标公共访问和协作权限设置：<permission_checked_count>；读取失败 / 不支持 / 无权限：<failed_or_unsupported_count>
+- 成功读取文档公共访问和协作权限设置：<permission_checked_count>；读取失败 / 不支持 / 无权限：<failed_or_unsupported_count>
 
 逐目标结果（1-10 个目标默认全部展示；超过 10 个时按 `摘要清单展开规则` 展示，并提示生成完整风险清单）：
 
@@ -233,7 +233,7 @@ URL：<url-or-token-if-url-unavailable>
 
 覆盖情况：
 - 当前身份可见目标：<visible_count>
-- 已成功检查目标公共访问和协作权限设置：<permission_checked_count>
+- 已成功检查文档公共访问和协作权限设置：<permission_checked_count>
 - 读取失败 / 已删除 / 无权限：<failed_count>
 - 未覆盖能力：<collaborator_list / inheritance / audit_log / view_records / none>
 
@@ -355,8 +355,8 @@ Agent 必须回复：
 - 字段变更：
   - <risk_id> <path> (<url-or-token>): <field> <old> -> <new>
 - 跳过项：<unsupported / no manage_public / unsupported type / missing policy>
-- 验证方式：执行后重新读取 <元数据 / 目标公共访问和协作权限设置>
-- 有限回滚范围：<目标公共访问和协作权限设置快照字段 / 不适用>
+- 验证方式：执行后重新读取 <元数据 / 文档公共访问和协作权限设置>
+- 有限回滚范围：<文档公共访问和协作权限设置快照字段 / 不适用>
 
 请确认是否进入写入确认。
 ```
@@ -407,8 +407,8 @@ Agent 必须回复：
 - 风险：<risk_level>
 - 字段变更：
   - <field>: <old> -> <new>
-- 验证方式：执行后重新读取 <元数据 / 目标公共访问和协作权限设置>
-- 有限回滚材料：<目标公共访问和协作权限设置快照 / 不适用>
+- 验证方式：执行后重新读取 <元数据 / 文档公共访问和协作权限设置>
+- 有限回滚材料：<文档公共访问和协作权限设置快照 / 不适用>
 
 请确认是否执行。
 ```
@@ -419,6 +419,6 @@ Agent 必须回复：
 已完成：<read checks / writes>
 验证：<fresh read result or async permission-request approval note>
 清单状态：<risk_id status updates / not applicable>
-回滚材料：<目标公共访问和协作权限设置快照 / 不适用>
+回滚材料：<文档公共访问和协作权限设置快照 / 不适用>
 剩余限制：<unsupported_checks / partial facts / approvals>
 ```

skills/lark-drive/references/lark-drive-workflow-permission-governance.md

@@ -38,11 +38,11 @@ Risk / Structure: `R2` / `S2`
 - 目录组织、迁移、归档或清理；这类需求应使用知识整理 workflow。
 - 内容审查、过期内容判断或知识质量评分。
 - backup owner 补充、部门 / 项目负责人绑定、协作者创建 / 撤销、成员列表审计；本 workflow 只支持把 owner 转移给每个目标明确指定的新 owner，不建模 backup owner 或负责人绑定关系。
-- 文件夹自身公开权限审计或修复。文件夹自身权限设置可以用 `drive +permission-get-setting` 读取；写入是否支持必须以运行时 schema 和明确需求为准，不能猜测执行 `patch type=folder`。
+- 文件夹自身公开权限审计或修复。`drive permission.public get` / `patch` 不支持 `type=folder`；必须记录到 `unsupported_checks`，然后继续读取文件夹下其他支持的文档事实。
 - 当前身份无法枚举到的不可见文档的完整发现；只能处理已发现目标，或用户显式提供的 URL / token。
 - 未按范围确认的批量写入。
 
-协作者列表读取只覆盖当前目标的直接协作者/授权成员：可使用 `drive +member-list` 。
+不要声称已完成协作者列表验证：当前 CLI surface 没有 `permission.members list` shortcut。
 
 ## Progressive Load Map
 
@@ -53,7 +53,7 @@ Risk / Structure: `R2` / `S2`
 | `PARSE_INTENT` | 本文件、[`lark-drive-workflow.md`](lark-drive-workflow.md)、[`../../lark-shared/SKILL.md`](../../lark-shared/SKILL.md) |
 | `TARGET_INSPECT` | [`lark-drive-inspect.md`](lark-drive-inspect.md) |
 | `DISCOVER_TARGETS` | 容器范围时读取 [`../../lark-wiki/references/lark-wiki-node-list.md`](../../lark-wiki/references/lark-wiki-node-list.md) 或 [`lark-drive-files-list.md`](lark-drive-files-list.md) |
-| `FACT_READ` | `lark-cli schema drive.metas.batch_query`；涉及权限设置读取时使用 `drive +permission-get-setting`；涉及活跃度、访问复核或生命周期判断时再读取 `lark-cli schema drive.file.statistics.get` 和 `lark-cli schema drive.file.view_records.list` |
+| `FACT_READ` | `lark-cli schema drive.metas.batch_query`；涉及公开权限时再读取 `lark-cli schema drive.permission.public.get`；涉及活跃度、访问复核或生命周期判断时再读取 `lark-cli schema drive.file.statistics.get` 和 `lark-cli schema drive.file.view_records.list` |
 | `RISK_ASSESS` | 本文件的 `Risk Classification` |
 | `EXEC_CONFIRM` | 只为用户选择的动作读取 [`lark-drive-apply-permission.md`](lark-drive-apply-permission.md)、[`lark-drive-secure-label.md`](lark-drive-secure-label.md)，或 `lark-cli schema drive.permission.public.patch` / `lark-cli schema drive.permission.members.transfer_owner`；需要确认模板时读取 [`lark-drive-workflow-permission-governance-outputs.md`](lark-drive-workflow-permission-governance-outputs.md) |
 | `EXECUTE` | 复用 `EXEC_CONFIRM` 已加载且已确认的写命令上下文 |
@@ -76,9 +76,9 @@ Risk / Structure: `R2` / `S2`
 | State | Protocol Step | Agent MUST Do | User-Facing Output | wait_for_user | Next State |
 |-------|---------------|---------------|--------------------|---------------|------------|
 | `PARSE_INTENT` | `route` / `scope` | 解析 intent、target scope、desired policy，以及只读审计、单目标公开性判断、权限申请、owner 转移还是修复模式；单目标公开性判断设置 `intent=public_exposure_check`、`target_scope=single_resource` | 范围确认；如果缺少目标、新 owner 或期望动作，只问一个澄清问题 | 缺少 target / new owner / action，或容器范围需要用户确认时为 `true` | `TARGET_INSPECT` |
-| `TARGET_INSPECT` | `scope` | 解析单资源、明确列表、Wiki space / node、Drive folder；Drive folder 直接从 URL 路径或显式 `type=folder` 解析，不调用 `drive +inspect`；保留原始 URL、scope type、canonical token/type | 目标范围表，包含 scope、title/type/token status | 除非解析失败，否则为 `false` | `DISCOVER_TARGETS` or `FACT_READ` |
+| `TARGET_INSPECT` | `scope` | 解析单资源、明确列表、Wiki space / node、Drive folder；保留原始 URL、scope type、canonical token/type | 目标范围表，包含 scope、title/type/token status | 除非解析失败，否则为 `false` | `DISCOVER_TARGETS` or `FACT_READ` |
 | `DISCOVER_TARGETS` | `scope` / `read` | 对 Wiki space / node 或 Drive folder 递归只读枚举，归一化为 `discovered_targets`；记录 `discovery_blockers` | 发现进度和覆盖摘要；不展示内部 cursor/token，除非用户要求 | 除非发现范围无法确认或全部被阻断，否则为 `false` | `FACT_READ` |
-| `FACT_READ` | `read` | 对直接目标或 `discovered_targets` 执行 `drive metas batch_query`；对支持的文件、文件夹或云文档目标执行 `drive +permission-get-setting` 读取自身权限设置；当 `intent=public_exposure_check` 且 `target_scope=single_resource` 时，可复用 `drive +inspect` 返回的 title / URL / type，只补读目标公共访问和协作权限设置；在用户要求活跃度 / 访问复核 / 生命周期判断时读取访问统计和访问记录 | 权限事实摘要、coverage summary、activity facts 和 unsupported checks | 除非所有目标都被 auth 阻断，否则为 `false` | `RISK_ASSESS` |
+| `FACT_READ` | `read` | 对直接目标或 `discovered_targets` 执行 `drive metas batch_query`；对支持的非 folder 目标执行 `drive permission.public get`；当 `intent=public_exposure_check` 且 `target_scope=single_resource` 时，可复用 `drive +inspect` 返回的 title / URL / type，只补读文档公共访问和协作权限设置；在用户要求活跃度 / 访问复核 / 生命周期判断时读取访问统计和访问记录 | 权限事实摘要、coverage summary、activity facts 和 unsupported checks | 除非所有目标都被 auth 阻断，否则为 `false` | `RISK_ASSESS` |
 | `RISK_ASSESS` | `assess/plan` | 对每个可审计目标生成 `per_target_permission_assessment` 并分类证据；如用户提供 policy，则对照 policy；`public_exposure_check + single_resource` 只渲染单目标结论，不生成 `risk_id`；owner 转移路径生成 `owner_transfer_candidates` / `owner_transfer_plan`；治理路径构建可定位风险清单、访问复核清单、dry-run 整改计划或候选修复计划，完整清单必须生成稳定 `risk_id` | 带 priority、URL、risk_id、owner、sec_label 的 findings、confidence、review items、建议动作和下一步 CTA；单目标公开性判断只输出结论和关键字段 | 治理路径为 `true`，单目标公开性判断为 `false` | `EXEC_CONFIRM` or `DONE` |
 | `EXEC_CONFIRM` | `confirm` | 展示准确写入范围、command family、target count、risk、verification method | 确认请求 | `true` | `EXECUTE` or `DONE` |
 | `EXECUTE` | `execute` | 只执行 `Command Map` 中已确认的写入 | 进度 / 结果摘要 | 除非被阻断，否则为 `false` | `VERIFY` |
@@ -91,23 +91,21 @@ Risk / Structure: `R2` / `S2`
 
 | State | Allowed Command Families | Purpose |
 |-------|--------------------------|---------|
-| `TARGET_INSPECT` | `drive +inspect` | 解析非 folder URL、type、canonical token、title 和 wiki unwrap data；Drive folder 不支持 `+inspect`，必须从 URL 路径或显式 `type=folder` 直接解析 |
+| `TARGET_INSPECT` | `drive +inspect` | 解析 URL、type、canonical token、title 和 wiki unwrap data |
 | `DISCOVER_TARGETS` | `wiki +node-list` | 递归发现 Wiki space / node 下当前身份可见的节点 |
 | `DISCOVER_TARGETS` | `drive files list` | 递归发现 Drive folder 下当前身份可见的文件和子文件夹 |
 | `FACT_READ` | `drive metas batch_query` | 读取 title、URL、owner 和 secure-label metadata |
 | `FACT_READ` | `drive permission.public get` | 读取支持类型的文档公共访问和协作权限设置，包括链接分享、对外分享、协作者管理、复制内容、创建副本、打印、下载和评论 |
-| `FACT_READ` | `drive +member-list` | 读取用户显式要求的单目标直接协作者/授权成员列表；不代表完整继承链或历史权限审计 |
-| `FACT_READ` | `drive +permission-get-setting` | 读取支持类型的文件、文件夹或云文档自身权限设置，包括公开访问、分享、协作者管理、安全与评论 |
 | `FACT_READ` | `drive file.statistics get` | 在用户要求活跃度、闲置暴露、生命周期或访问复核时读取文件访问统计 |
 | `FACT_READ` | `drive file.view_records list` | 在用户要求最近访问人、访问复核或低活跃证据时读取访问记录 |
 | `EXEC_CONFIRM` | `drive +secure-label-list` | 提议 label update 前解析可用 secure-label IDs |
-| `EXEC_CONFIRM` | `drive permission.members auth` | 目标公共访问和协作权限设置修改前检查 `action=manage_public` |
+| `EXEC_CONFIRM` | `drive permission.members auth` | 文档公共访问和协作权限设置修改前检查 `action=manage_public` |
 | `EXEC_CONFIRM` | `lark-cli schema drive.permission.members.transfer_owner` | owner 转移前读取当前字段、支持类型和高风险写入门禁 |
 | `EXECUTE` | `drive +apply-permission` | 向 owner 提交 view/edit access request；只允许单目标、小列表或已明确确认的候选列表逐个执行 |
 | `EXECUTE` | `drive permission.public patch` | 修改已确认的 public/link settings；必须传 `--yes` |
 | `EXECUTE` | `drive permission.members transfer_owner` | 转移已确认目标的 owner；必须传 `--yes` |
 | `EXECUTE` | `drive +secure-label-update` | 设置已确认的 secure-label ID |
-| `VERIFY` | `drive metas batch_query`, `drive +permission-get-setting` | 验证支持的 metadata，包括 owner、secure-label 和目标公共访问与协作权限设置变更；权限申请只能表述为已发起 |
+| `VERIFY` | `drive metas batch_query`, `drive permission.public get` | 验证支持的 metadata，包括 owner、secure-label 和文档公共访问与协作权限设置变更；权限申请只能表述为已发起 |
 
 ## Command Patterns
 
@@ -121,9 +119,9 @@ Risk / Structure: `R2` / `S2`
 
 1. "所有文档"只表示当前身份在确认范围内可枚举到的文档。不可见、无权限、API 不返回或工具预算不足的部分必须进入 `discovery_blockers` 或 `unsupported_checks`。
 2. 发现阶段必须生成稳定 `path`。不要只保存 title；同名文档必须能通过 path 或 token 区分。
-3. 权限设置读取使用 `drive +permission-get-setting`，目标类型包括 `doc`、`sheet`、`file`、`wiki`、`bitable`、`docx`、`mindnote`、`minutes`、`slides`、`folder`；未来新增类型以 shortcut 和 OpenAPI 元数据为准。
+3. 只把 `drive.permission.public.get` 当前 schema 支持的类型加入公开权限可审计目标。已知支持包括 `doc`、`sheet`、`file`、`wiki`、`bitable`、`docx`、`mindnote`、`minutes`、`slides`；未来新增类型以运行时 schema 为准。
 4. `minutes` 只能作为 `partial_public_permission` 目标：可读取 / 修改公开权限和 owner 转移能力以运行时 schema 为准，但 `drive metas batch_query` 当前不支持 `minutes`，URL、owner、密级等 metadata 可能进入 `unsupported_checks`。
-5. `folder` 作为递归容器时先枚举子资源；如用户明确要查询文件夹自身权限设置，可对该文件夹单独执行 `drive +permission-get-setting --token <folder_token> --type folder`。不要执行 raw `permission.public patch type=folder`，除非 schema 和需求都明确支持。`shortcut`、`catalog` 或缺少 stable token/type 的条目必须记录为 unsupported，除非后续 API 明确解析出支持目标。
+5. `folder` 只作为递归容器，不执行 `permission.public get` / `patch`。如果用户明确要求 owner 转移且 schema 支持 `folder`，必须按 owner-transfer 写入规则单独确认。`shortcut`、`catalog` 或缺少 stable token/type 的条目必须记录为 unsupported，除非后续 API 明确解析出支持目标。
 6. 对大范围目标输出进度时，只展示已扫描容器数、已发现目标数、已审计目标数、剩余队列或 blocker；不要默认展示内部 page token / cursor。
 
 Wiki space / node 发现：
@@ -135,7 +133,7 @@ Wiki space / node 发现：
 
 Drive folder 发现：
 
-1. `/drive/folder/<folder_token>` 解析为 `target_scope=drive_folder`。默认继续枚举其子文档；只有用户明确要求文件夹自身权限设置时，才额外调用 `drive +permission-get-setting --token <folder_token> --type folder` 读取该文件夹自身设置。
+1. `/drive/folder/<folder_token>` 解析为 `target_scope=drive_folder`。文件夹自身公开权限不支持；继续枚举其子文档。
 2. 按 [`lark-drive-files-list.md`](lark-drive-files-list.md) 递归处理 `data.files`、`has_more` 和 `next_page_token`。不要把第一页数量当作完整范围。
 3. 只对返回项中的 `folder` 继续递归；对子文档按 `type + token` 归一化为 `discovered_targets`。
 4. 如果某个目录分页失败、无 continuation token、权限不足或 API 报错，只阻断该目录分支，并在 `discovery_blockers` 中记录；继续处理其他可枚举分支。
@@ -143,11 +141,11 @@ Drive folder 发现：
 ## Fact Read Rules
 
 1. `drive metas batch_query` 单次最多 200 个 `request_docs`；当 `targets` 或 `discovered_targets` 超过 200 个时，必须分批读取并合并结果。
-2. `drive +permission-get-setting` 没有批量读取接口；对支持目标逐个读取。单个目标失败时记录 `unsupported_checks` 或 `partial`，不要阻断其他目标。
+2. `drive permission.public get` 没有批量读取接口；对支持目标逐个读取。单个目标失败时记录 `unsupported_checks` 或 `partial`，不要阻断其他目标。
 3. 对 Wiki 发现目标，公开权限读取优先使用 `type=wiki` + `node_token`；metadata 可使用 `obj_type` + `obj_token` 补充 title、owner、URL 和 `sec_label_name`。
 4. 当 intent 是 `list_permission_settings` 时，只输出权限设置清单和覆盖限制，不主动生成修复计划。
 5. 单目标、多目标明确列表和容器发现目标都必须复用同一套逐目标事实读取与语义归一逻辑；差异只体现在目标来源、coverage summary 和输出聚合。
-6. `permission_public` 用户可见含义是“目标公共访问和协作权限设置”，语义以官方 OpenAPI 字段说明为准，同时兼容当前 CLI schema 返回的字段：优先使用 `external_access_entity`，缺失时才用 `external_access` boolean 映射为 `open` / `closed`；`manage_collaborator_entity`、`copy_entity`、`lock_switch` 等字段缺失时标记为 unknown，不要伪造；未识别字段保留在 raw evidence / partial note 中。
+6. `permission_public` 用户可见含义是“文档公共访问和协作权限设置”，语义以官方 OpenAPI 字段说明为准，同时兼容当前 CLI schema 返回的字段：优先使用 `external_access_entity`，缺失时才用 `external_access` boolean 映射为 `open` / `closed`；`manage_collaborator_entity`、`copy_entity`、`lock_switch` 等字段缺失时标记为 unknown，不要伪造；未识别字段保留在 raw evidence / partial note 中。
 7. `drive file.statistics get` 和 `drive file.view_records list` 只在用户要求最近访问、活跃度、闲置暴露、访问复核，或用户提供的 policy 明确依赖活跃度时执行；不要为普通权限审计默认读取访问记录。
 8. 访问统计 / 访问记录当前只对 `doc`、`docx`、`sheet`、`bitable`、`mindnote`、`wiki`、`file` 作为支持类型处理。其他类型必须进入 `unsupported_checks`，不能推断活跃度。
 9. `view_records` 是访问证据，不是权限列表。没有返回访问记录只能表述为“未获得最近访问证据”或“低活跃候选”，不能表述为“无人有权限”。
@@ -164,17 +162,17 @@ Drive folder 发现：
 - `PolicyReview`：复制、创建副本、打印、下载、评论等依赖 policy 的设置；没有明确 policy 时不要称为高风险。
 - `Unknown`：读取失败、已删除、无权限、API 不支持、协作者名单 / 继承链 / DLP / AI 索引 / 审计日志未覆盖。
 
-每个可审计目标都必须先归一化为 `per_target_permission_assessment`，再按 [`lark-drive-workflow-permission-governance-outputs.md`](lark-drive-workflow-permission-governance-outputs.md) 的 `Semantic Rendering` 渲染。`public_exposure_check` 只是 `target_count=1` 的轻量渲染模式；它和多目标、容器诊断复用同一套语义字段与风险分类。该判断只覆盖当前目标公共访问和协作权限设置，不审计协作者名单、历史权限变更、完整继承链或审计日志。
+每个可审计目标都必须先归一化为 `per_target_permission_assessment`，再按 [`lark-drive-workflow-permission-governance-outputs.md`](lark-drive-workflow-permission-governance-outputs.md) 的 `Semantic Rendering` 渲染。`public_exposure_check` 只是 `target_count=1` 的轻量渲染模式；它和多目标、容器诊断复用同一套语义字段与风险分类。该判断只覆盖当前文档公共访问和协作权限设置，不审计协作者名单、历史权限变更、完整继承链或审计日志。
 
 `AI 检索暴露候选风险` 只是基于权限和标签的代理标签。除非另有工具明确返回索引状态，否则不要声称某个文档已经被 Agent、Copilot 或 RAG 索引。
 
 ## 写入规则
 
-- 目标公共访问和协作权限设置修改（`drive permission.public patch`）属于高风险写入。请求确认前，必须展示 target title、token、current setting、desired setting 和准确 field changes。
+- 文档公共访问和协作权限设置修改（`drive permission.public patch`）属于高风险写入。请求确认前，必须展示 target title、token、current setting、desired setting 和准确 field changes。
 - 如果 `manage_public_auth.auth_result=false`，禁止 patch。告诉用户需要具备 manage-public 权限的用户，或由 owner 操作。
-- 权限设置读取使用 `drive +permission-get-setting`；裸 token 必须传 `--type`，URL 可以自动推断。写入仍使用 `drive permission.public patch`，只 patch 已解析且 schema 明确支持的类型和字段，不要把读取支持的 `folder` 自动外推为可写入。
+- `drive permission.public get` 只用于 `drive +inspect` 或 `DISCOVER_TARGETS` 可解析且运行时 schema 支持的目标类型；类型集合不要硬编码，执行时以 `lark-cli schema drive.permission.public.get` 为准。
 - 不要 patch 已解析类型不支持的字段。对于 wiki 目标，必须省略 schema 明确标注为 wiki 不支持的字段。
-- 不要在同一个写入确认中合并密级标签更新和目标公共访问与协作权限设置修改；必须分别确认。
+- 不要在同一个写入确认中合并密级标签更新和文档公共访问与协作权限设置修改；必须分别确认。
 - `drive +apply-permission` 默认不批量执行；每次调用都会向 owner 发送通知。
 - `permission_request_candidates` 可以来自用户直接提供的目标、明确列表或容器发现目标；只要能构造 token、type、权限类型和申请理由，就可以进入候选。不要因为目标不在 `discovered_targets` 中而拒绝单目标 / 小列表权限申请。
 - 容器范围内的"统一申请权限"必须先产出 `permission_request_candidates`。未展示候选目标、数量、权限类型和 owner 通知影响前，禁止调用 `drive +apply-permission`。
@@ -184,8 +182,8 @@ Drive folder 发现：
 - 批量 owner 转移必须逐个顺序执行；失败项进入结果清单，不要重复执行已成功目标。`remove_old_owner=true` 或 `old_owner_perm` 降权必须单独在确认中高亮。
 - 用户要求“生成整改方案 / dry-run / 先看看会改什么”时，只生成 `remediation_plan`，不执行任何写命令。dry-run 必须包含 target count、field changes、跳过原因、验证方式和有限回滚范围。
 - 用户基于完整风险清单选择对象时，必须先解析 `risk_id`、风险分组、URL 或 artifact 中 `selected=true` 的行，生成 `selected_risk_items`。无法匹配到当前 `risk_manifest` 的选择必须要求用户重新确认或重新读取清单。
-- 针对 `selected_risk_items` 生成 dry-run 前，必须重新读取所选目标的 `drive +permission-get-setting`；如果当前设置和清单快照不同，标记为 `changed_since_report` 并跳过或要求用户确认更新后的计划。
-- 执行 `drive permission.public patch` 前，必须把当前 `public_permission_facts` 中会被改动的字段保存为 `public_permission_snapshots`。该快照只用于目标公共访问和协作权限设置字段的有限回滚说明，不覆盖协作者、owner、继承权限或密级标签。
+- 针对 `selected_risk_items` 生成 dry-run 前，必须重新读取所选目标的 `drive permission.public get`；如果当前设置和清单快照不同，标记为 `changed_since_report` 并跳过或要求用户确认更新后的计划。
+- 执行 `drive permission.public patch` 前，必须把当前 `public_permission_facts` 中会被改动的字段保存为 `public_permission_snapshots`。该快照只用于文档公共访问和协作权限设置字段的有限回滚说明，不覆盖协作者、owner、继承权限或密级标签。
 - 如果用户要求批量收紧权限，必须按风险分层和目标顺序逐个执行；失败项进入结果清单，不要因为单个失败而重复执行已成功目标。
 - 遇到 secure-label downgrade error `1063013` 时，停止重试，并告诉用户需要在文档 UI 中完成审批。
 
@@ -196,7 +194,7 @@ Drive folder 发现：
 - `drive permission.members create` 可创建协作者权限，但当前 workflow 不做协作者 grant / update / revoke；未来需要单独定义授权对象解析、最小权限、确认模板和验证方式。
 - backup owner、部门 / 项目负责人绑定没有当前 workflow 可执行写入面；如用户要落地为 owner 转移，必须先给出明确目标和新 owner，并走本 workflow 的 owner-transfer 确认。
 - `wiki +member-list` 可作为 Wiki space 成员治理的读侧事实来源；当前 workflow 只治理文档 / 节点 / 文件夹下可发现文档的权限，不做 space member governance。
-- `drive +member-list` 可读取单目标直接协作者/授权成员；当前 CLI 仍没有完整继承链、DLP 扫描、AI 索引状态、审计日志和跨平台权限事实。遇到这些需求必须记录为 `unsupported_checks` 或建议新增独立 workflow。
+- 当前 CLI 没有 `permission.members list`、完整继承链、DLP 扫描、AI 索引状态、审计日志和跨平台权限事实。遇到这些需求必须记录为 `unsupported_checks` 或建议新增独立 workflow。
 
 ## 输出策略
 

skills/lark-slides/SKILL.md

@@ -75,17 +75,15 @@ metadata:
 
 ## Quick Reference
 
-**本表只定位「场景 → 用哪条命令、读哪份文档」。参数以「执行前必做」里对应的文档和 `lark-cli slides +<verb> --help` 为准，不要凭记忆或按别的命令类比补参数。**
-
 | 用户需求 | 优先动作 | 关键文档 / 命令 |
 |----------|----------|-----------------|
-| 新建 PPT | 先规划 `slide_plan.json`，再按复杂度选择一步或两步创建 | `planning-layer.md`、`visual-planning.md`、`asset-planning.md`、`lark-slides-create.md`、`slides +create` |
-| 用户要求使用模板，或提供 PPTX 文件要求修改、美化 | 将模板导入为 Slides 再编辑 | `lark-slides-pptx-template-workflows.md` |
+| 新建 PPT | 先规划 `slide_plan.json`，再按复杂度选择一步或两步创建 | `planning-layer.md`、`visual-planning.md`、`asset-planning.md`、`slides +create` |
+| 用户要求使用模板 | 将模板导入为 Slides 再编辑 | `lark-slides-pptx-template-workflows.md` |
 | 编辑单个标题、文本块、图片或局部元素 | 优先块级替换/插入，不改页序 | `slides +replace-slide`、`lark-slides-replace-slide.md` |
 | 读取或分析已有 PPT | 解析 slides/wiki token，用 shortcut 回读全文 XML 或读取单页 XML，保存 `xml_presentation_id`、`slide_id`、`revision_id` | `slides +xml-get`、`xml_presentation.slide.get`、`lark-slides-xml-presentations-get.md` |
 | 查看或回滚历史版本 | 先用 `+history-list` 找 `history_version_id`，再 `+history-revert`，必要时 `+history-revert-status` 轮询 | [`lark-slides-history.md`](references/lark-slides-history.md) |
 | 获取幻灯片页面截图 | 用 `slide_id` 或页号指定页面，一次不超过 10 页 | `slides +screenshot`、`lark-slides-screenshot.md` |
-| 上传或使用图片 | 先上传为 `file_token`，禁止直接写 http(s) 外链 | `slides +media-upload`、`lark-slides-media-upload.md`，或 `+create --slides` 的 XML 里写 `<img src="@./path">` 占位符 |
+| 上传或使用图片 | 先上传为 `file_token`，禁止直接写 http(s) 外链 | `slides +media-upload`、`lark-slides-media-upload.md`，或 `+create --slides` 的 `@./path` 占位符 |
 | 绘制图表 | 原生图表（柱状、条形、折线、面积、饼（环）、雷达、组合图）用 `<chart>`，其他（漏斗图、金字塔图、象限图、矩阵图等）用 `<shape>` + `<line>` 模拟 | `xml-schema-quick-ref.md`、`slides_chart_demo.xml` |
 | 绘制表格 | 优先用 `rect` 和 `text` 模拟，其他用 `<table>` | `xml-schema-quick-ref.md` |
 | 使用图标 | 禁止盲猜 iconType，必须先检索 IconPark，再写 `<icon iconType="...">`，图标必须填充颜色并和背景有足够对比，禁止使用 emoji 图标 | `iconpark_tool.py search → resolve`、`iconpark.md` |
@@ -143,9 +141,9 @@ lark-cli auth login --domain slides
 - [asset-planning.md](references/asset-planning.md)（新建 / 大幅改写）
 - [validation-checklist.md](references/validation-checklist.md)（创建 / 大幅改写后）
 
-调用相关命令前必须读取相关的文档以了解命令的使用方式：
+按需再读：
 
-- 创建：[`lark-slides-create.md`](references/lark-slides-create.md)、[`lark-slides-xml-presentation-slide-create.md`](references/lark-slides-xml-presentation-slide-create.md)（逐页添加）
+- 创建：[`lark-slides-create.md`](references/lark-slides-create.md)
 - 阅读：[`lark-slides-xml-presentations-get.md`](references/lark-slides-xml-presentations-get.md)
 - 编辑：[`lark-slides-edit-workflows.md`](references/lark-slides-edit-workflows.md)、[`lark-slides-replace-slide.md`](references/lark-slides-replace-slide.md)、[`lark-slides-replace-pages.md`](references/lark-slides-replace-pages.md)
 - 历史版本：[`lark-slides-history.md`](references/lark-slides-history.md)
@@ -191,6 +189,20 @@ lark-cli auth login --domain slides
 - 不要在任何位置使用 emoji 图标。
 
 
+### 创建方式选择
+
+| 场景 | 推荐方式 |
+|------|----------|
+| 简单 XML（1-3 页、结构简单、几乎无复杂中文和特殊字符） | `slides +create --slides '[...]'` 一步创建 |
+| 复杂 XML（多页、含中文、大段文本、复杂布局、嵌套引号、特殊字符较多） | **两步创建**：先 `slides +create` 创建空白 PPT，再用 `xml_presentation.slide create` 逐页添加 |
+| 已有 PPT 继续追加或插入页面 | 使用 `xml_presentation.slide create`，必要时配合 `before_slide_id` |
+
+> [!WARNING]
+> `--slides '[...]'` 的风险点主要在 shell 参数传递，而不是单纯页数。即使只有 1 页，只要 XML 足够复杂，也建议使用两步创建法。
+
+> [!IMPORTANT]
+> `slides +create --slides` 底层会逐页创建，不是原子操作。中途失败时先记录 `xml_presentation_id`，回读确认当前状态，再继续修复或追加。
+
 ### 生成流程
 
 ```text
@@ -208,18 +220,17 @@ Step 2: 生成大纲 → 写入 slide_plan.json
 Step 3: 按 slide_plan.json 生成 XML → 创建
   - 逐页消费 plan：key_message 定主结论，layout_type 定几何，visual_focus 定主视觉，text_density 定文本量
   - 缺少真实素材时必须用 `fallback_if_missing` 生成替代图片，不要留空
-  - 读 lark-slides-create.md 定一步创建还是两步创建，并据此构造 `slides +create`；两步创建再读 lark-slides-xml-presentation-slide-create.md 逐页添加
-  - 图片按 lark-slides-media-upload.md 处理；复杂 XML、转义和 3350001 排查按 troubleshooting.md 执行
+  - 创建方式按“创建方式选择”判断；图片、复杂 XML、转义和 3350001 排查按 lark-slides-create.md、media-upload.md、troubleshooting.md 执行
 
 Step 4: 审查 & 交付
-  - 创建完成后，必须用 `slides +xml-get --presentation <xml_presentation_id>` 读取全文 XML，并按 validation-checklist.md 做显式验证记录，包括 XML 文本重叠检查
+  - 创建完成后，必须用 `slides +xml-get` 读取全文 XML，并按 validation-checklist.md 做显式验证记录，包括 XML 文本重叠检查
   - 失败或部分成功按 troubleshooting.md 处理；局部问题优先用 `+replace-slide` 修正
   - 没问题 → 交付：使用 NotifyHuman 工具交付 PPT 链接
 ```
 
 ### jq 命令模板（编辑已有 PPT 时使用）
 
-以下 jq 模板适用于向已有演示文稿追加页面的场景，可以避免手动转义双引号：
+新建 PPT 推荐用 `+create --slides`。以下 jq 模板适用于向已有演示文稿追加页面的场景，可以避免手动转义双引号：
 
 ```bash
 # 追加到末尾
@@ -302,9 +313,8 @@ Shortcut 是对常用操作的高级封装（`lark-cli slides +<verb> [flags]`
 
 | Shortcut | 说明 |
 |----------|------|
-| [`+create`](references/lark-slides-create.md) | 创建 PPT，可选一步添加页面 |
-| [`+xml-get`](references/lark-slides-xml-presentations-get.md) | 读取全文 XML，用 `--presentation` 指定演示文稿的 `xml_presentation_id`，用 `--output` 把 XML 存到本地文件（必须是 CWD 内的相对路径，如 `.lark-slides/plan/<deck>/readback.xml`） |
-| [`+screenshot`](references/lark-slides-screenshot.md) | 把幻灯片页面截图保存为本地图片，用 `--slide-number` 指定页号（从 1 开始，多页重复传入，一次最多 10 页），用 `--output-dir` 指定保存目录（必须是 CWD 内的相对路径，默认 `.lark-slides/screenshots`），失败时降级到 XML 回读等非截图检查 |
+| [`+create`](references/lark-slides-create.md) | 创建 PPT（可选 `--slides` 一步添加页面，支持 `<img src="@./local.png">` 占位符自动上传） |
+| [`+xml-get`](references/lark-slides-xml-presentations-get.md) | 读取全文 XML 并保存到本地文件，避免终端输出被截断 |
 | [`+media-upload`](references/lark-slides-media-upload.md) | 上传本地图片到指定演示文稿，返回 `file_token`（用作 `<img src="...">`），最大 20 MB |
 | [`+replace-slide`](references/lark-slides-replace-slide.md) | 对已有幻灯片页面进行块级替换/插入（`block_replace` / `block_insert`），自动注入 id 和 `<content/>`，不改变页序 |
 | [`+replace-pages`](references/lark-slides-replace-pages.md) | 在原演示文稿内批量重建多个页面：先创建新页到旧页前，再删除旧页；适合已有 Slides 的多页大改，不新建链接 |
@@ -321,12 +331,12 @@ lark-cli slides <resource> <method> [flags] # 调用 API
 ## 核心规则
 
 1. **先规划再写 XML**：新建演示文稿或大幅改写页面时，必须先写入 `.lark-slides/plan/<deck-or-task-id>/slide_plan.json`；模板、风格和大纲只能作为规划输入，不能绕过规划层
-2. **创建流程**：新建演示文稿用 `slides +create`，一步创建还是两步创建按 [`lark-slides-create.md`](references/lark-slides-create.md) 判断
+2. **创建流程**：简单短 XML（1-3 页、结构简单、特殊字符少）可用 `slides +create --slides '[...]'` 一步创建；复杂内容、含图片/中文大段文本/嵌套引号/较多特殊字符，或超过 10 页时，默认先 `slides +create` 创建空白 PPT，再用 `xml_presentation.slide.create` 逐页添加
 3. **`<slide>` 直接子元素只有 `<style>`、`<data>`、`<note>`**：文本和图形必须放在 `<data>` 内
 4. **文本通过 `<content>` 表达**：必须用 `<content><p>...</p></content>`，不能把文字直接写在 shape 内
 5. **保存关键 ID**：后续操作需要 `xml_presentation_id`、`slide_id`、`revision_id`
 6. **删除谨慎**：删除操作不可逆，且至少保留一页幻灯片
 7. **编辑已有页面优先原链接更新**：修改单个 shape/img 用 `+replace-slide`（`block_replace` / `block_insert`），不要整页重建；已有 Slides 的多页整页重建用 `+replace-pages`，不要用 `slides +create` 新建整份 PPT；只有没有 shortcut 覆盖的特殊单页整页操作才手动 `slide.create` + `slide.delete`
-8. **`<img src>` 只能用上传到飞书 drive 的 `file_token`，禁止使用 http(s) 外链 URL**：飞书 slides 渲染端不会代理外链图片，外链 src 在 PPT 里通常不显示或显示破图。流程必须是「先把图存到本地 → 用 `slides +media-upload` 上传，或在 `+create --slides` 的 XML 里写 `<img src="@./path">` 占位符自动上传 → 拿 `file_token` 写进 `<img src>`」。如果用户给了网图链接，先 `curl`/下载到 CWD 内再走上传流程，不要直接把外链 URL 塞进 `src`。**图片最大 20 MB**（slides upload API 不支持分片上传）。
+8. **`<img src>` 只能用上传到飞书 drive 的 `file_token`，禁止使用 http(s) 外链 URL**：飞书 slides 渲染端不会代理外链图片，外链 src 在 PPT 里通常不显示或显示破图。流程必须是「先把图存到本地 → 用 `slides +media-upload` 上传或 `+create --slides` 的 `@./path` 占位符自动上传 → 拿 `file_token` 写进 `<img src>`」。如果用户给了网图链接，先 `curl`/下载到 CWD 内再走上传流程，不要直接把外链 URL 塞进 `src`。**图片最大 20 MB**（slides upload API 不支持分片上传）。
 
 > **注意**：如果 md 内容与 `slides_xml_schema_definition.xml` 或 `lark-cli schema slides.<resource>.<method>` 输出不一致，以后两者为准。

skills/lark-slides/pie_chart_demo.xml

@@ -1,63 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<presentation xmlns="http://www.larkoffice.com/sml/2.0" width="960" height="540">
-  <title>资产处置类型分布</title>
-  <theme>
-    <textStyles>
-      <headline fontColor="rgba(31, 35, 41, 1)"/>
-      <body fontColor="rgba(31, 35, 41, 1)"/>
-      <caption fontColor="rgba(155, 158, 162, 1)" fontSize="14"/>
-    </textStyles>
-  </theme>
-  <slide>
-    <style>
-      <fill>
-        <fillColor color="rgba(250, 248, 242, 1)"/>
-      </fill>
-    </style>
-    <data>
-      <shape width="800" height="40" topLeftX="80" topLeftY="40" type="text">
-        <content textType="headline" fontSize="24" fontFamily="思源黑体" color="rgba(31, 35, 41, 1)" bold="true">
-          <p>资产处置类型分布</p>
-        </content>
-      </shape>
-      <chart width="700" height="440" topLeftX="130" topLeftY="80">
-        <chartPlotArea>
-          <chartPlot type="pie" yAxisPosition="right">
-            <chartExtra/>
-            <chartLabels position="outside" category="false" value="true" percentage="true" fontSize="14" color="rgba(60, 60, 60, 1)"/>
-            <chartSeriesList>
-              <chartSeries index="1">
-                <chartSectors innerRadius="0.5" offsetRadius="0" startAngle="90"/>
-              </chartSeries>
-            </chartSeriesList>
-          </chartPlot>
-        </chartPlotArea>
-        <chartLegend position="right" fontSize="16" color="rgba(60, 60, 60, 1)"/>
-        <chartData>
-          <dim1>
-            <chartField name="类型">股权处置,土地经营权,停车泊位,供水污水,房产处置,保障房,林水经营</chartField>
-          </dim1>
-          <dim2>
-            <chartField name="规模">24,19,8.5,7.5,5,4.15,2.7</chartField>
-          </dim2>
-        </chartData>
-        <chartStyle>
-          <chartBackground color="rgba(0, 0, 0, 0)"/>
-          <chartBorder color="rgb(222, 224, 227)" width="0"/>
-          <chartColorTheme>
-            <color value="rgb(178, 34, 34)"/>
-            <color value="rgb(205, 50, 50)"/>
-            <color value="rgb(224, 80, 80)"/>
-            <color value="rgb(238, 110, 110)"/>
-            <color value="rgb(218, 165, 32)"/>
-            <color value="rgb(238, 195, 55)"/>
-            <color value="rgb(248, 222, 100)"/>
-          </chartColorTheme>
-        </chartStyle>
-      </chart>
-    </data>
-    <note>
-      <content/>
-    </note>
-  </slide>
-</presentation>

skills/lark-slides/pie_chart_slide.xml

@@ -1,52 +0,0 @@
-<slide xmlns="http://www.larkoffice.com/sml/2.0">
-  <style>
-    <fill>
-      <fillColor color="rgba(250, 248, 242, 1)"/>
-    </fill>
-  </style>
-  <data>
-    <shape width="800" height="40" topLeftX="80" topLeftY="40" type="text">
-      <content textType="headline" fontSize="24" fontFamily="思源黑体" color="rgba(31, 35, 41, 1)" bold="true">
-        <p>资产处置类型分布</p>
-      </content>
-    </shape>
-    <chart width="700" height="440" topLeftX="130" topLeftY="80">
-      <chartPlotArea>
-        <chartPlot type="pie" yAxisPosition="right">
-          <chartExtra/>
-          <chartLabels position="outside" category="false" value="true" percentage="true" fontSize="14" color="rgba(60, 60, 60, 1)"/>
-          <chartSeriesList>
-            <chartSeries index="1">
-              <chartSectors innerRadius="0.5" offsetRadius="0" startAngle="90"/>
-            </chartSeries>
-          </chartSeriesList>
-        </chartPlot>
-      </chartPlotArea>
-      <chartLegend position="right" fontSize="16" color="rgba(60, 60, 60, 1)"/>
-      <chartData>
-        <dim1>
-          <chartField name="类型">股权处置,土地经营权,停车泊位,供水污水,房产处置,保障房,林水经营</chartField>
-        </dim1>
-        <dim2>
-          <chartField name="规模">24,19,8.5,7.5,5,4.15,2.7</chartField>
-        </dim2>
-      </chartData>
-      <chartStyle>
-        <chartBackground color="rgba(0, 0, 0, 0)"/>
-        <chartBorder color="rgb(222, 224, 227)" width="0"/>
-        <chartColorTheme>
-          <color value="rgb(178, 34, 34)"/>
-          <color value="rgb(205, 50, 50)"/>
-          <color value="rgb(224, 80, 80)"/>
-          <color value="rgb(238, 110, 110)"/>
-          <color value="rgb(218, 165, 32)"/>
-          <color value="rgb(238, 195, 55)"/>
-          <color value="rgb(248, 222, 100)"/>
-        </chartColorTheme>
-      </chartStyle>
-    </chart>
-  </data>
-  <note>
-    <content/>
-  </note>
-</slide>