fix(slides): reindent xml-get output with a stdlib-only formatter

Reland of #1987 (reverted in #2013 over the BSD attribution gap of
github.com/beevik/etree) with the formatter rebuilt on the Go standard
library only — no third-party dependency.

encoding/xml serves purely as a tokenizer; the output is assembled
exclusively from verbatim byte slices of the server content plus
indentation inserted between structural elements. Nothing is
parsed-and-reserialized, so CDATA sections, whitespace character
references in any spelling, entity lexical forms, attribute quoting,
and in-tag whitespace survive byte-for-byte — the character-reference
masking machinery of the etree implementation is no longer needed.

Behavior is unchanged from the reverted PR: --raw stdout and --output
files are reindented (never inside the schema's mixed-content
text-bearing elements), the default JSON envelope carries the server's
XML verbatim without parsing, and formatting failures fall back to the
original content with a stderr warning and pretty_printed: false in
--output file metadata. All contract tests carry over unweakened; a
differential probe against the etree implementation over 53 inputs was
byte-identical except six cases where the new formatter preserves the
original bytes more faithfully (each pinned in tests).

.github/workflows/semantic-review.yml

@@ -25,16 +25,19 @@ jobs:
         with:
           script: |
             const run = context.payload.workflow_run;
-            const workflowId = Number(run.workflow_id || 0);
-            if (!Number.isInteger(workflowId) || workflowId <= 0) throw new Error("missing workflow id");
-            const { data: workflow } = await github.rest.actions.getWorkflow({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              workflow_id: workflowId,
-            });
-            if (workflow.name !== "CI") throw new Error(`unexpected workflow name: ${workflow.name}`);
-            if (workflow.path !== ".github/workflows/ci.yml") throw new Error(`unexpected workflow path: ${workflow.path}`);
-            if (run.path && run.path !== workflow.path) throw new Error(`workflow path mismatch: ${run.path}`);
+            if (run.name !== "CI") throw new Error(`unexpected workflow name: ${run.name}`);
+            let workflowPath = run.path || "";
+            if (!workflowPath) {
+              const workflowId = Number(run.workflow_id || 0);
+              if (!Number.isInteger(workflowId) || workflowId <= 0) throw new Error("missing workflow id");
+              const { data: workflow } = await github.rest.actions.getWorkflow({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                workflow_id: workflowId,
+              });
+              workflowPath = workflow.path || "";
+            }
+            if (workflowPath !== ".github/workflows/ci.yml") throw new Error(`unexpected workflow path: ${workflowPath}`);
             if (run.event !== "pull_request") throw new Error(`unexpected event: ${run.event}`);
             if (run.repository.id !== context.payload.repository.id) throw new Error("repository id mismatch");
             if (run.repository.full_name !== context.payload.repository.full_name) throw new Error("repository name mismatch");
@@ -250,16 +253,19 @@ jobs:
         with:
           script: |
             const run = context.payload.workflow_run;
-            const workflowId = Number(run.workflow_id || 0);
-            if (!Number.isInteger(workflowId) || workflowId <= 0) throw new Error("missing workflow id");
-            const { data: workflow } = await github.rest.actions.getWorkflow({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              workflow_id: workflowId,
-            });
-            if (workflow.name !== "CI") throw new Error(`unexpected workflow name: ${workflow.name}`);
-            if (workflow.path !== ".github/workflows/ci.yml") throw new Error(`unexpected workflow path: ${workflow.path}`);
-            if (run.path && run.path !== workflow.path) throw new Error(`workflow path mismatch: ${run.path}`);
+            if (run.name !== "CI") throw new Error(`unexpected workflow name: ${run.name}`);
+            let workflowPath = run.path || "";
+            if (!workflowPath) {
+              const workflowId = Number(run.workflow_id || 0);
+              if (!Number.isInteger(workflowId) || workflowId <= 0) throw new Error("missing workflow id");
+              const { data: workflow } = await github.rest.actions.getWorkflow({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                workflow_id: workflowId,
+              });
+              workflowPath = workflow.path || "";
+            }
+            if (workflowPath !== ".github/workflows/ci.yml") throw new Error(`unexpected workflow path: ${workflowPath}`);
             if (run.event !== "pull_request") throw new Error(`unexpected event: ${run.event}`);
             if (run.conclusion !== "success") throw new Error(`unexpected conclusion: ${run.conclusion}`);
             if (run.repository.id !== context.payload.repository.id) throw new Error("repository id mismatch");

CHANGELOG.md

@@ -2,69 +2,6 @@
 
 All notable changes to this project will be documented in this file.
 
-## [v1.0.79] - 2026-07-28
-
-### Features
-
-- **slides**: update xsd (#2067)
-
-### Bug Fixes
-
-- **ci**: validate static workflow identity (#2015)
-- **sheets**: recognize OFL0X local office tokens (#2063)
-
-### Documentation
-
-- **calendar**: clarify identity selection by event ownership (#2071)
-- **slides**: add formula inline element syntax to quick-ref (#2077)
-
-## [v1.0.78] - 2026-07-27
-
-### Features
-
-- event description support rich text (#1975)
-
-### Bug Fixes
-
-- **slides**: restrict canvas overflow checks
-- **slides**: upgrade text overflow to error above 10px threshold
-- **slides**: detect letterSpacing-driven text overflow
-- **slides**: downgrade background-decoration text overflow to info
-- **slides**: allow chartParsedValues roundtrip tag
-- refine character width estimation for lark-slides text lint
-- **slides**: preserve info lint severity
-- **slides**: text may over flow shape
-- exempt ghost text from slides lint
-
-## [v1.0.77] - 2026-07-24
-
-### Features
-
-- introducing official card icon (#1973)
-- **apps**: validate +file-list --page-size against server (0, 200] range (#2007)
-- **apps**: support absolute and relative upload paths (#2005)
-- **slides**: fill xml-schema-quick-ref gaps that forced XSD fallback (#2026)
-- **slides**: add layout density lint for sparse/empty containers (#2022)
-- add risk-control protection (#1910)
-
-### Bug Fixes
-
-- **slides**: normalize presentation flag aliases (#2032)
-- **base**: classify +form-submit as high-risk-write (#1969)
-- **slides**: declare screenshot scope
-- **slides**: support CSV multi-value for --slide-id in screenshot (#2047)
-
-### Documentation
-
-- **skill**: clarify scope handling for query expansion (#2030)
-- **base**: clarify complete and partial updates (#1993)
-- **skills**: clarify callout child rules (#2048)
-
-### Misc
-
-- fix/task id handling (#2023)
-- fix/task search pagination (#2041)
-
 ## [v1.0.75] - 2026-07-22
 
 ### Features
@@ -1701,9 +1638,6 @@ Bundled AI agent skills for intelligent assistance:
 - Bilingual documentation (English & Chinese).
 - CI/CD pipelines: linting, testing, coverage reporting, and automated releases.
 
-[v1.0.79]: https://github.com/larksuite/cli/releases/tag/v1.0.79
-[v1.0.78]: https://github.com/larksuite/cli/releases/tag/v1.0.78
-[v1.0.77]: https://github.com/larksuite/cli/releases/tag/v1.0.77
 [v1.0.75]: https://github.com/larksuite/cli/releases/tag/v1.0.75
 [v1.0.74]: https://github.com/larksuite/cli/releases/tag/v1.0.74
 [v1.0.73]: https://github.com/larksuite/cli/releases/tag/v1.0.73

README.md

@@ -285,29 +285,6 @@ To reduce these risks, the tool enables default security protections at multiple
 
 We recommend using the Lark/Feishu bot integrated with this tool as a private conversational assistant. Do not add it to group chats or allow other users to interact with it, to avoid abuse of permissions or data leakage.
 
-To reduce the security risks associated with access token theft, the CLI sends a minimal set of risk-control signals with OpenAPI requests made to exact official Feishu/Lark HTTPS domains. These signals are used to help identify anomalous API activity. This protection is enabled by default. The information sent is limited to:
-
-- Operating system type: macOS, Windows, or Linux
-- Device hardware model: for example, Mac17,9
-
-To disable this protection for the current workspace, run:
-
-```bash
-lark-cli config risk-control off
-```
-
-To enable this protection for the current workspace, run:
-
-```bash
-lark-cli config risk-control on
-```
-
-To restore the default policy for the current workspace, run:
-
-```bash
-lark-cli config risk-control default
-```
-
 Please fully understand all usage risks. By using this tool, you are deemed to voluntarily assume all related responsibilities.
 
 ## Star History

README.zh.md

@@ -286,29 +286,6 @@ lark-cli schema im.messages.delete
 
 我们建议您将对接本工具的飞书机器人作为私人对话助手使用，请勿将其拉入群聊或允许其他用户与其交互，以避免权限被滥用或数据泄露。
 
-为降低访问令牌被盗用后的安全风险，CLI 在向飞书/Lark 官方 HTTPS 精确域名发起 OpenAPI 请求时，会随请求发送一组最小化的风控信号，用于辅助识别异常调用行为。该保护默认开启，发送的信息仅包括：
-
-- 操作系统类型：macOS、Windows 或 Linux
-- 设备的硬件产品型号：例如 Mac17,9
-
-如需让当前 workspace 退出该保护，可执行以下命令：
-
-```bash
-lark-cli config risk-control off
-```
-
-如需开启当前 workspace 的保护，可执行以下命令：
-
-```bash
-lark-cli config risk-control on
-```
-
-恢复当前 workspace 默认策略可执行：
-
-```bash
-lark-cli config risk-control default
-```
-
 请您充分知悉全部使用风险，使用本工具即视为您自愿承担相关所有责任。
 
 ## Star History

cmd/config/config.go

@@ -31,7 +31,6 @@ func NewCmdConfig(f *cmdutil.Factory) *cobra.Command {
 	cmd.AddCommand(NewCmdConfigShow(f, nil))
 	cmd.AddCommand(NewCmdConfigDefaultAs(f))
 	cmd.AddCommand(NewCmdConfigStrictMode(f))
-	cmd.AddCommand(NewCmdConfigRiskControl(f))
 	cmd.AddCommand(NewCmdConfigPolicy(f))
 	cmd.AddCommand(NewCmdConfigPlugins(f))
 	cmd.AddCommand(NewCmdConfigKeychainDowngrade(f))

cmd/config/risk_control.go

@@ -1,80 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package config
-
-import (
-	"fmt"
-
-	"github.com/spf13/cobra"
-
-	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
-)
-
-// NewCmdConfigRiskControl creates the workspace risk-control policy command.
-func NewCmdConfigRiskControl(f *cmdutil.Factory) *cobra.Command {
-	cmd := &cobra.Command{
-		Use:   "risk-control [on|off|default]",
-		Short: "Manage workspace account-protection policy",
-		Long: `View or set the account-protection risk-control policy for this workspace.
-
-Account protection is on by default. Use off to opt this workspace out, on to
-opt it back in explicitly, or default to remove the explicit preference.`,
-		Args: cobra.MaximumNArgs(1),
-		// This is persistent workspace policy, not credential management.
-		PersistentPreRunE: func(cmd *cobra.Command, _ []string) error {
-			cmd.SilenceUsage = true
-			return nil
-		},
-		RunE: func(cmd *cobra.Command, args []string) error {
-			config, err := core.LoadOrNotConfigured()
-			if err != nil {
-				return err
-			}
-			if len(args) == 0 {
-				printRiskControl(f, config)
-				return nil
-			}
-
-			switch args[0] {
-			case "on":
-				enabled := true
-				config.RiskControl = &enabled
-			case "off":
-				enabled := false
-				config.RiskControl = &enabled
-			case "default":
-				config.RiskControl = nil
-			default:
-				return errs.NewValidationError(errs.SubtypeInvalidArgument,
-					"invalid risk-control value %q, valid values: on | off | default", args[0])
-			}
-
-			if err := core.SaveMultiAppConfig(config); err != nil {
-				return errs.NewInternalError(errs.SubtypeStorage,
-					"failed to save risk-control policy: %v", err).WithCause(err)
-			}
-			fmt.Fprintf(f.IOStreams.ErrOut, "Risk control set to %s (workspace)\n", args[0])
-			return nil
-		},
-	}
-	cmdutil.SetRisk(cmd, cmdutil.RiskWrite)
-	return cmd
-}
-
-func printRiskControl(f *cmdutil.Factory, config *core.MultiAppConfig) {
-	source := "default"
-	if config.RiskControl != nil {
-		source = "workspace"
-	}
-	fmt.Fprintf(f.IOStreams.Out, "risk-control: %s (source: %s)\n", riskControlState(config.RiskControlEnabled()), source)
-}
-
-func riskControlState(enabled bool) string {
-	if enabled {
-		return "on"
-	}
-	return "off"
-}

cmd/config/risk_control_test.go

@@ -1,130 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package config
-
-import (
-	"errors"
-	"strings"
-	"testing"
-
-	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
-)
-
-func TestRiskControlWorkspacePolicy(t *testing.T) {
-	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
-	config := &core.MultiAppConfig{Apps: []core.AppConfig{{
-		AppId: "cli_test", AppSecret: core.PlainSecret("secret"), Brand: core.BrandFeishu,
-	}}}
-	if err := core.SaveMultiAppConfig(config); err != nil {
-		t.Fatal(err)
-	}
-
-	f, stdout, stderr, _ := cmdutil.TestFactory(t, nil)
-	cmd := NewCmdConfigRiskControl(f)
-	cmd.SetArgs([]string{"off"})
-	if err := cmd.Execute(); err != nil {
-		t.Fatalf("set off: %v", err)
-	}
-	loaded, err := core.LoadMultiAppConfig()
-	if err != nil {
-		t.Fatal(err)
-	}
-	if loaded.RiskControl == nil || *loaded.RiskControl {
-		t.Fatalf("RiskControl = %v, want explicit false", loaded.RiskControl)
-	}
-	if !strings.Contains(stderr.String(), "set to off") {
-		t.Fatalf("stderr = %q", stderr.String())
-	}
-
-	stdout.Reset()
-	cmd = NewCmdConfigRiskControl(f)
-	if err := cmd.Execute(); err != nil {
-		t.Fatalf("show: %v", err)
-	}
-	if got := stdout.String(); got != "risk-control: off (source: workspace)\n" {
-		t.Fatalf("stdout = %q", got)
-	}
-
-	cmd = NewCmdConfigRiskControl(f)
-	cmd.SetArgs([]string{"on"})
-	if err := cmd.Execute(); err != nil {
-		t.Fatalf("set on: %v", err)
-	}
-	loaded, err = core.LoadMultiAppConfig()
-	if err != nil {
-		t.Fatal(err)
-	}
-	if loaded.RiskControl == nil || !*loaded.RiskControl {
-		t.Fatalf("RiskControl = %v, want explicit true", loaded.RiskControl)
-	}
-
-	cmd = NewCmdConfigRiskControl(f)
-	cmd.SetArgs([]string{"default"})
-	if err := cmd.Execute(); err != nil {
-		t.Fatalf("reset default: %v", err)
-	}
-	loaded, err = core.LoadMultiAppConfig()
-	if err != nil {
-		t.Fatal(err)
-	}
-	if loaded.RiskControl != nil {
-		t.Fatalf("RiskControl = %v, want nil", loaded.RiskControl)
-	}
-
-	stdout.Reset()
-	cmd = NewCmdConfigRiskControl(f)
-	if err := cmd.Execute(); err != nil {
-		t.Fatalf("show default: %v", err)
-	}
-	if got := stdout.String(); got != "risk-control: on (source: default)\n" {
-		t.Fatalf("stdout = %q", got)
-	}
-}
-
-func TestRiskControlWorkspacePolicyRejectsInvalidValue(t *testing.T) {
-	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
-	if err := core.SaveMultiAppConfig(&core.MultiAppConfig{Apps: []core.AppConfig{{
-		AppId: "cli_test", AppSecret: core.PlainSecret("secret"), Brand: core.BrandFeishu,
-	}}}); err != nil {
-		t.Fatal(err)
-	}
-
-	f, _, _, _ := cmdutil.TestFactory(t, nil)
-	cmd := NewCmdConfigRiskControl(f)
-	cmd.SetArgs([]string{"invalid"})
-	err := cmd.Execute()
-	var validationErr *errs.ValidationError
-	if !errors.As(err, &validationErr) {
-		t.Fatalf("error = %T %v, want *errs.ValidationError", err, err)
-	}
-	if validationErr.Subtype != errs.SubtypeInvalidArgument {
-		t.Fatalf("subtype = %q, want %q", validationErr.Subtype, errs.SubtypeInvalidArgument)
-	}
-}
-
-func TestRiskControlWorkspacePolicyAllowedWithExternalCredentials(t *testing.T) {
-	f := newConfigFactoryWithExternalProvider(t)
-	config := &core.MultiAppConfig{Apps: []core.AppConfig{{
-		AppId: "cli_test", AppSecret: core.PlainSecret("secret"), Brand: core.BrandFeishu,
-	}}}
-	if err := core.SaveMultiAppConfig(config); err != nil {
-		t.Fatal(err)
-	}
-
-	cmd := NewCmdConfig(f)
-	cmd.SetArgs([]string{"risk-control", "off"})
-	if err := cmd.Execute(); err != nil {
-		t.Fatalf("set off with external credentials: %v", err)
-	}
-
-	loaded, err := core.LoadMultiAppConfig()
-	if err != nil {
-		t.Fatal(err)
-	}
-	if loaded.RiskControl == nil || *loaded.RiskControl {
-		t.Fatalf("RiskControl = %v, want explicit false", loaded.RiskControl)
-	}
-}

internal/cmdutil/factory_default.go

@@ -22,7 +22,6 @@ import (
 	"github.com/larksuite/cli/internal/credential"
 	"github.com/larksuite/cli/internal/keychain"
 	"github.com/larksuite/cli/internal/registry"
-	"github.com/larksuite/cli/internal/riskcontrol"
 	_ "github.com/larksuite/cli/internal/security/contentsafety" // register content safety provider
 	"github.com/larksuite/cli/internal/transport"
 	_ "github.com/larksuite/cli/internal/vfs/localfileio" // register default FileIO provider
@@ -34,7 +33,7 @@ import (
 //	Phase 1: HttpClient (no credential dependency)
 //	Phase 2: Credential (sole data source for account info)
 //	Phase 3: Config derived from Credential
-//	Phase 4: LarkClient derived from Credential and workspace policy
+//	Phase 4: LarkClient derived from Credential
 func NewDefault(streams *IOStreams, inv InvocationContext) *Factory {
 	streams = normalizeStreams(streams)
 	f := &Factory{
@@ -55,10 +54,9 @@ func NewDefault(streams *IOStreams, inv InvocationContext) *Factory {
 
 	// Phase 0: FileIO provider (no dependency)
 	f.FileIOProvider = fileio.GetProvider()
-	workspaceConfig := core.NewConfigSnapshot()
 
 	// Phase 1: HttpClient (no credential dependency)
-	f.HttpClient = cachedHttpClientFunc(f, workspaceConfig)
+	f.HttpClient = cachedHttpClientFunc(f)
 
 	// Phase 2: Credential (sole data source)
 	// Keychain is read via closure so callers can replace f.Keychain after construction.
@@ -69,7 +67,7 @@ func NewDefault(streams *IOStreams, inv InvocationContext) *Factory {
 		ErrOut:     f.IOStreams.ErrOut,
 	})
 
-	// Phase 3: Runtime config contains resolved account data only.
+	// Phase 3: Config derived from Credential via an explicit conversion boundary.
 	f.Config = sync.OnceValues(func() (*core.CliConfig, error) {
 		acct, err := f.Credential.ResolveAccount(context.Background())
 		if err != nil {
@@ -80,9 +78,8 @@ func NewDefault(streams *IOStreams, inv InvocationContext) *Factory {
 		return cfg, nil
 	})
 
-	// Phase 4: LarkClient composes account data and workspace policy at the SDK
-	// transport boundary.
-	f.LarkClient = cachedLarkClientFunc(f, workspaceConfig)
+	// Phase 4: LarkClient from Credential (placeholder AppSecret)
+	f.LarkClient = cachedLarkClientFunc(f)
 
 	return f
 }
@@ -111,16 +108,13 @@ func safeRedirectPolicy(req *http.Request, via []*http.Request) error {
 // .StderrIsTerminal field, which tests set directly.
 var warnIfProxied = transport.WarnIfProxied
 
-func cachedHttpClientFunc(f *Factory, workspaceConfig workspaceConfigSource) func() (*http.Client, error) {
+func cachedHttpClientFunc(f *Factory) func() (*http.Client, error) {
 	return sync.OnceValues(func() (*http.Client, error) {
 		if f.IOStreams.StderrIsTerminal {
 			warnIfProxied(f.IOStreams.ErrOut)
 		}
 
-		hostSignalSource := resolveSDKHostSignalSource(workspaceConfig)
-
 		var rt http.RoundTripper = transport.Shared()
-		rt = riskcontrol.NewTransport(rt, hostSignalSource)
 		rt = &RetryTransport{Base: rt}
 		rt = &SecurityHeaderTransport{Base: rt}
 		rt = &auth.SecurityPolicyTransport{Base: rt} // Add our global response interceptor
@@ -134,7 +128,7 @@ func cachedHttpClientFunc(f *Factory, workspaceConfig workspaceConfigSource) fun
 	})
 }
 
-func cachedLarkClientFunc(f *Factory, workspaceConfig workspaceConfigSource) func() (*lark.Client, error) {
+func cachedLarkClientFunc(f *Factory) func() (*lark.Client, error) {
 	return sync.OnceValues(func() (*lark.Client, error) {
 		acct, err := f.Credential.ResolveAccount(context.Background())
 		if err != nil {
@@ -148,15 +142,8 @@ func cachedLarkClientFunc(f *Factory, workspaceConfig workspaceConfigSource) fun
 		if f.IOStreams.StderrIsTerminal {
 			warnIfProxied(f.IOStreams.ErrOut)
 		}
-		hostSignalSource := resolveSDKHostSignalSource(workspaceConfig)
-		var sdkBase http.RoundTripper = transport.Shared()
-		// The innermost SDK boundary always strips reserved host-signal headers;
-		// a nil source makes it strip-only when workspace policy disables signal
-		// collection.
-		sdkBase = riskcontrol.NewTransport(sdkBase, hostSignalSource)
-		sdkTransport := wrapSDKTransport(sdkBase)
 		opts = append(opts, lark.WithHttpClient(&http.Client{
-			Transport:     sdkTransport,
+			Transport:     buildSDKTransport(),
 			CheckRedirect: safeRedirectPolicy,
 		}))
 		ep := core.ResolveEndpoints(acct.Brand)
@@ -165,8 +152,9 @@ func cachedLarkClientFunc(f *Factory, workspaceConfig workspaceConfigSource) fun
 	})
 }
 
-func wrapSDKTransport(next http.RoundTripper) http.RoundTripper {
-	var sdkTransport http.RoundTripper = &RetryTransport{Base: next}
+func buildSDKTransport() http.RoundTripper {
+	var sdkTransport http.RoundTripper = transport.Shared()
+	sdkTransport = &RetryTransport{Base: sdkTransport}
 	sdkTransport = &UserAgentTransport{Base: sdkTransport}
 	sdkTransport = &BuildHeaderTransport{Base: sdkTransport}
 	sdkTransport = &auth.SecurityPolicyTransport{Base: sdkTransport}

internal/cmdutil/factory_http_test.go

@@ -6,15 +6,10 @@ package cmdutil
 import (
 	"io"
 	"testing"
-
-	"github.com/larksuite/cli/internal/core"
 )
 
 func TestCachedHttpClientFunc_ReturnsSameInstance(t *testing.T) {
-	isEnabled := false
-	f, _, _, _ := TestFactory(t, &core.CliConfig{AppID: "test-app"})
-	f.IOStreams.ErrOut = io.Discard
-	fn := cachedHttpClientFunc(f, staticWorkspaceConfig{config: &core.MultiAppConfig{RiskControl: &isEnabled}})
+	fn := cachedHttpClientFunc(&Factory{IOStreams: &IOStreams{ErrOut: io.Discard}})
 
 	c1, err := fn()
 	if err != nil {
@@ -34,10 +29,7 @@ func TestCachedHttpClientFunc_ReturnsSameInstance(t *testing.T) {
 }
 
 func TestCachedHttpClientFunc_HasTimeout(t *testing.T) {
-	isEnabled := false
-	f, _, _, _ := TestFactory(t, &core.CliConfig{AppID: "test-app"})
-	f.IOStreams.ErrOut = io.Discard
-	fn := cachedHttpClientFunc(f, staticWorkspaceConfig{config: &core.MultiAppConfig{RiskControl: &isEnabled}})
+	fn := cachedHttpClientFunc(&Factory{IOStreams: &IOStreams{ErrOut: io.Discard}})
 	c, _ := fn()
 	if c.Timeout == 0 {
 		t.Error("expected non-zero timeout")
@@ -45,10 +37,7 @@ func TestCachedHttpClientFunc_HasTimeout(t *testing.T) {
 }
 
 func TestCachedHttpClientFunc_HasRedirectPolicy(t *testing.T) {
-	isEnabled := false
-	f, _, _, _ := TestFactory(t, &core.CliConfig{AppID: "test-app"})
-	f.IOStreams.ErrOut = io.Discard
-	fn := cachedHttpClientFunc(f, staticWorkspaceConfig{config: &core.MultiAppConfig{RiskControl: &isEnabled}})
+	fn := cachedHttpClientFunc(&Factory{IOStreams: &IOStreams{ErrOut: io.Discard}})
 	c, _ := fn()
 	if c.CheckRedirect == nil {
 		t.Error("expected CheckRedirect to be set (safeRedirectPolicy)")

internal/cmdutil/factory_proxy_warn_test.go

@@ -8,7 +8,6 @@ import (
 	"testing"
 
 	_ "github.com/larksuite/cli/extension/credential/env" // registers the env-backed account provider
-	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/envvars"
 )
 
@@ -37,15 +36,13 @@ var proxyWarnGateCases = []struct {
 // TestCachedHttpClientFunc_ProxyWarnGate verifies the http-client init path
 // invokes WarnIfProxied only when stderr is an interactive terminal.
 func TestCachedHttpClientFunc_ProxyWarnGate(t *testing.T) {
-	isEnabled := false
 	for _, tc := range proxyWarnGateCases {
 		t.Run(tc.name, func(t *testing.T) {
 			calls := installProxyWarnSpy(t)
 
-			f, _, _, _ := TestFactory(t, &core.CliConfig{AppID: "test-app"})
-			f.IOStreams.ErrOut = io.Discard
-			f.IOStreams.StderrIsTerminal = tc.terminal
-			fn := cachedHttpClientFunc(f, staticWorkspaceConfig{config: &core.MultiAppConfig{RiskControl: &isEnabled}})
+			fn := cachedHttpClientFunc(&Factory{IOStreams: &IOStreams{
+				ErrOut: io.Discard, StderrIsTerminal: tc.terminal,
+			}})
 			if _, err := fn(); err != nil {
 				t.Fatalf("http client init: %v", err)
 			}
@@ -76,7 +73,7 @@ func TestCachedLarkClientFunc_ProxyWarnGate(t *testing.T) {
 			// normalizeStreams copies the struct (out := *s), so the
 			// StderrIsTerminal field survives into f.IOStreams.
 			f := NewDefault(&IOStreams{ErrOut: io.Discard, StderrIsTerminal: tc.terminal}, InvocationContext{})
-			if _, err := cachedLarkClientFunc(f, nil)(); err != nil {
+			if _, err := cachedLarkClientFunc(f)(); err != nil {
 				t.Fatalf("lark client init: %v", err)
 			}
 

internal/cmdutil/localfile.go

@@ -1,36 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package cmdutil
-
-import (
-	"io/fs"
-
-	"github.com/larksuite/cli/extension/fileio"
-	"github.com/larksuite/cli/internal/validate"
-	"github.com/larksuite/cli/internal/vfs"
-)
-
-// StatLocalFile returns metadata for a path in the process filesystem namespace.
-// It is intended for advisory validation; callers must validate the opened file
-// again before using its contents.
-func StatLocalFile(path string) (fs.FileInfo, error) {
-	localPath, err := validate.LocalInputPath(path)
-	if err != nil {
-		return nil, &fileio.PathValidationError{Err: err}
-	}
-	return vfs.Stat(localPath)
-}
-
-// OpenLocalFile opens a path in the process filesystem namespace.
-// Absolute and relative paths are accepted. It is the shared replacement for
-// direct os.Open/os.ReadFile use in commands that intentionally read local
-// paths outside the workspace sandbox. Callers inspect the returned descriptor
-// before reading so validation and use apply to the same opened file.
-func OpenLocalFile(path string) (fs.File, error) {
-	localPath, err := validate.LocalInputPath(path)
-	if err != nil {
-		return nil, &fileio.PathValidationError{Err: err}
-	}
-	return vfs.Open(localPath)
-}

internal/cmdutil/localfile_test.go

@@ -1,96 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package cmdutil
-
-import (
-	"errors"
-	"io"
-	"io/fs"
-	"os"
-	"path/filepath"
-	"testing"
-
-	"github.com/larksuite/cli/extension/fileio"
-	"github.com/larksuite/cli/internal/vfs"
-)
-
-func TestOpenLocalFile_AcceptsAbsoluteAndParentRelativePaths(t *testing.T) {
-	root := t.TempDir()
-	workDir := filepath.Join(root, "work")
-	if err := os.Mkdir(workDir, 0o755); err != nil {
-		t.Fatal(err)
-	}
-	path := filepath.Join(root, "input.txt")
-	if err := os.WriteFile(path, []byte("content"), 0o600); err != nil {
-		t.Fatal(err)
-	}
-	TestChdir(t, workDir)
-
-	for _, input := range []string{path, filepath.Join("..", "input.txt")} {
-		f, err := OpenLocalFile(input)
-		if err != nil {
-			t.Fatalf("OpenLocalFile(%q) error = %v", input, err)
-		}
-		got, readErr := io.ReadAll(f)
-		closeErr := f.Close()
-		if readErr != nil || closeErr != nil || string(got) != "content" {
-			t.Fatalf("OpenLocalFile(%q) content=%q read=%v close=%v", input, got, readErr, closeErr)
-		}
-	}
-}
-
-func TestOpenLocalFile_RejectsInvalidInput(t *testing.T) {
-	if _, err := OpenLocalFile("input\n.txt"); !errors.Is(err, fileio.ErrPathValidation) {
-		t.Fatalf("OpenLocalFile() error = %v, want ErrPathValidation", err)
-	}
-}
-
-func TestStatLocalFile_ReturnsMetadata(t *testing.T) {
-	info, err := StatLocalFile(t.TempDir())
-	if err != nil {
-		t.Fatalf("StatLocalFile() error = %v", err)
-	}
-	if !info.IsDir() {
-		t.Fatalf("StatLocalFile() mode = %v, want directory", info.Mode())
-	}
-}
-
-func TestOpenLocalFile_DoesNotStatBeforeOpen(t *testing.T) {
-	path := filepath.Join(t.TempDir(), "input.txt")
-	if err := os.WriteFile(path, []byte("content"), 0o600); err != nil {
-		t.Fatal(err)
-	}
-
-	previous := vfs.DefaultFS
-	counting := &countingLocalFileFS{FS: previous}
-	vfs.DefaultFS = counting
-	t.Cleanup(func() { vfs.DefaultFS = previous })
-
-	f, err := OpenLocalFile(path)
-	if err != nil {
-		t.Fatalf("OpenLocalFile() error = %v", err)
-	}
-	if err := f.Close(); err != nil {
-		t.Fatal(err)
-	}
-	if counting.openCalls != 1 || counting.statCalls != 0 {
-		t.Fatalf("OpenLocalFile() calls: Open=%d Stat=%d, want Open=1 Stat=0", counting.openCalls, counting.statCalls)
-	}
-}
-
-type countingLocalFileFS struct {
-	vfs.FS
-	openCalls int
-	statCalls int
-}
-
-func (f *countingLocalFileFS) Open(name string) (*os.File, error) {
-	f.openCalls++
-	return f.FS.Open(name)
-}
-
-func (f *countingLocalFileFS) Stat(name string) (fs.FileInfo, error) {
-	f.statCalls++
-	return f.FS.Stat(name)
-}

internal/cmdutil/risk_control.go

@@ -1,28 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package cmdutil
-
-import (
-	"github.com/larksuite/cli/internal/core"
-	"github.com/larksuite/cli/internal/riskcontrol"
-)
-
-type workspaceConfigSource interface {
-	MultiAppConfig() (*core.MultiAppConfig, error)
-}
-
-// resolveSDKHostSignalSource applies workspace policy at the SDK transport
-// boundary.
-func resolveSDKHostSignalSource(config workspaceConfigSource) riskcontrol.Source {
-	if config == nil {
-		return nil
-	}
-	workspace, configErr := config.MultiAppConfig()
-	// Default-on means an existing config with no explicit preference. Absent
-	// or unreadable config cannot authorize host-signal collection.
-	if configErr != nil || !workspace.RiskControlEnabled() {
-		return nil
-	}
-	return riskcontrol.NewHostSource()
-}

internal/cmdutil/risk_control_test.go

@@ -1,45 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package cmdutil
-
-import (
-	"errors"
-	"testing"
-
-	"github.com/larksuite/cli/internal/core"
-)
-
-type staticWorkspaceConfig struct {
-	config *core.MultiAppConfig
-	err    error
-}
-
-func (s staticWorkspaceConfig) MultiAppConfig() (*core.MultiAppConfig, error) {
-	return s.config, s.err
-}
-
-func TestResolveSDKHostSignalSource(t *testing.T) {
-	disabled := false
-	tests := []struct {
-		name       string
-		config     workspaceConfigSource
-		wantSource bool
-	}{
-		{name: "workspace default on", config: staticWorkspaceConfig{config: &core.MultiAppConfig{}}, wantSource: true},
-		{name: "workspace opt-out", config: staticWorkspaceConfig{config: &core.MultiAppConfig{RiskControl: &disabled}}},
-		{name: "missing config", config: staticWorkspaceConfig{err: errors.New("file does not exist")}},
-		{name: "unreadable config", config: staticWorkspaceConfig{err: errors.New("permission denied")}},
-		{name: "nil config value", config: staticWorkspaceConfig{}},
-		{name: "nil config source"},
-	}
-
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			got := resolveSDKHostSignalSource(test.config)
-			if (got != nil) != test.wantSource {
-				t.Fatalf("resolveSDKHostSignalSource() = %T, wantSource %t", got, test.wantSource)
-			}
-		})
-	}
-}

internal/cmdutil/transport_test.go

@@ -15,7 +15,6 @@ import (
 
 	exttransport "github.com/larksuite/cli/extension/transport"
 	internalauth "github.com/larksuite/cli/internal/auth"
-	"github.com/larksuite/cli/internal/riskcontrol"
 )
 
 type roundTripFunc func(*http.Request) (*http.Response, error)
@@ -92,13 +91,13 @@ func TestRetryTransport_DefaultNoRetry(t *testing.T) {
 }
 
 // ---------------------------------------------------------------------------
-// wrapSDKTransport chain composition
+// buildSDKTransport chain composition
 // ---------------------------------------------------------------------------
 
-func TestWrapSDKTransport_IncludesRetryTransport(t *testing.T) {
-	transport := wrapSDKTransport(riskcontrol.NewTransport(http.DefaultTransport, nil))
+func TestBuildSDKTransport_IncludesRetryTransport(t *testing.T) {
+	transport := buildSDKTransport()
 
-	// Chain: SecurityPolicy → BuildHeader → UserAgent → Retry → RiskControl → Base
+	// Chain: SecurityPolicy → BuildHeader → UserAgent → Retry → Base
 	sec, ok := transport.(*internalauth.SecurityPolicyTransport)
 	if !ok {
 		t.Fatalf("outer transport type = %T, want *auth.SecurityPolicyTransport", transport)
@@ -111,23 +110,18 @@ func TestWrapSDKTransport_IncludesRetryTransport(t *testing.T) {
 	if !ok {
 		t.Fatalf("layer after BuildHeader = %T, want *UserAgentTransport", bh.Base)
 	}
-	retry, ok := ua.Base.(*RetryTransport)
-	if !ok {
+	if _, ok := ua.Base.(*RetryTransport); !ok {
 		t.Fatalf("inner transport type = %T, want *RetryTransport", ua.Base)
 	}
-	if _, ok := retry.Base.(*riskcontrol.Transport); !ok {
-		t.Fatalf("layer after Retry = %T, want *riskcontrol.Transport", retry.Base)
-	}
 }
 
-func TestWrapSDKTransport_WithExtension(t *testing.T) {
-	previous := exttransport.GetProvider()
+func TestBuildSDKTransport_WithExtension(t *testing.T) {
 	exttransport.Register(&stubTransportProvider{})
-	t.Cleanup(func() { exttransport.Register(previous) })
+	t.Cleanup(func() { exttransport.Register(nil) })
 
-	transport := wrapSDKTransport(riskcontrol.NewTransport(http.DefaultTransport, nil))
+	transport := buildSDKTransport()
 
-	// Chain: extensionMiddleware → SecurityPolicy → BuildHeader → UserAgent → Retry → RiskControl → Base
+	// Chain: extensionMiddleware → SecurityPolicy → BuildHeader → UserAgent → Retry → Base
 	mid, ok := transport.(*extensionMiddleware)
 	if !ok {
 		t.Fatalf("outer transport type = %T, want *extensionMiddleware", transport)
@@ -144,23 +138,17 @@ func TestWrapSDKTransport_WithExtension(t *testing.T) {
 	if !ok {
 		t.Fatalf("layer after BuildHeader = %T, want *UserAgentTransport", bh.Base)
 	}
-	retry, ok := ua.Base.(*RetryTransport)
-	if !ok {
+	if _, ok := ua.Base.(*RetryTransport); !ok {
 		t.Fatalf("innermost transport type = %T, want *RetryTransport", ua.Base)
 	}
-	if _, ok := retry.Base.(*riskcontrol.Transport); !ok {
-		t.Fatalf("layer after Retry = %T, want *riskcontrol.Transport", retry.Base)
-	}
 }
 
-func TestWrapSDKTransport_WithoutExtension(t *testing.T) {
-	previous := exttransport.GetProvider()
+func TestBuildSDKTransport_WithoutExtension(t *testing.T) {
 	exttransport.Register(nil)
-	t.Cleanup(func() { exttransport.Register(previous) })
 
-	transport := wrapSDKTransport(riskcontrol.NewTransport(http.DefaultTransport, nil))
+	transport := buildSDKTransport()
 
-	// Chain: SecurityPolicy → BuildHeader → UserAgent → Retry → RiskControl → Base
+	// Chain: SecurityPolicy → BuildHeader → UserAgent → Retry → Base
 	sec, ok := transport.(*internalauth.SecurityPolicyTransport)
 	if !ok {
 		t.Fatalf("outer transport type = %T, want *auth.SecurityPolicyTransport", transport)
@@ -173,13 +161,9 @@ func TestWrapSDKTransport_WithoutExtension(t *testing.T) {
 	if !ok {
 		t.Fatalf("layer after BuildHeader = %T, want *UserAgentTransport", bh.Base)
 	}
-	retry, ok := ua.Base.(*RetryTransport)
-	if !ok {
+	if _, ok := ua.Base.(*RetryTransport); !ok {
 		t.Fatalf("inner transport type = %T, want *RetryTransport", ua.Base)
 	}
-	if _, ok := retry.Base.(*riskcontrol.Transport); !ok {
-		t.Fatalf("layer after Retry = %T, want *riskcontrol.Transport", retry.Base)
-	}
 }
 
 // ---------------------------------------------------------------------------
@@ -277,40 +261,6 @@ func (buildTamperingInterceptor) PreRoundTrip(req *http.Request) func(*http.Resp
 	return nil
 }
 
-type riskHeaderTamperingInterceptor struct{}
-
-func (riskHeaderTamperingInterceptor) PreRoundTrip(req *http.Request) func(*http.Response, error) {
-	req.Header.Set(riskcontrol.HeaderOSType, "extension-value")
-	req.Header.Set(riskcontrol.HeaderProductModel, "extension-value")
-	return nil
-}
-
-func TestWrapSDKTransport_StripsExtensionRiskHeaders(t *testing.T) {
-	previous := exttransport.GetProvider()
-	exttransport.Register(&stubTransportProvider{interceptor: riskHeaderTamperingInterceptor{}})
-	t.Cleanup(func() { exttransport.Register(previous) })
-
-	var received http.Header
-	network := roundTripFunc(func(req *http.Request) (*http.Response, error) {
-		received = req.Header.Clone()
-		return &http.Response{StatusCode: http.StatusOK, Body: http.NoBody}, nil
-	})
-	req, err := http.NewRequest(http.MethodGet, "https://open.feishu.cn/open-apis/test", nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-	req.Header.Set("Authorization", "Bearer token")
-
-	resp, err := wrapSDKTransport(riskcontrol.NewTransport(network, nil)).RoundTrip(req)
-	if err != nil {
-		t.Fatal(err)
-	}
-	resp.Body.Close()
-	if received.Get(riskcontrol.HeaderOSType) != "" || received.Get(riskcontrol.HeaderProductModel) != "" {
-		t.Fatalf("extension risk headers reached network: %v", received)
-	}
-}
-
 // TestBuildHeaderTransport_SDKChain_OverridesTamperedHeader verifies that the
 // X-Cli-Build header is force-written by BuildHeaderTransport in the SDK
 // transport chain, even when an extension tries to delete or spoof it. This
@@ -327,7 +277,7 @@ func TestBuildHeaderTransport_SDKChain_OverridesTamperedHeader(t *testing.T) {
 	exttransport.Register(&stubTransportProvider{interceptor: buildTamperingInterceptor{}})
 	t.Cleanup(func() { exttransport.Register(nil) })
 
-	// Replicate the SDK chain layering used by wrapSDKTransport.
+	// Replicate the SDK chain layering used by buildSDKTransport.
 	var base http.RoundTripper = http.DefaultTransport
 	base = &RetryTransport{Base: base}
 	base = &UserAgentTransport{Base: base}

internal/core/config.go

@@ -60,18 +60,11 @@ func (a *AppConfig) ProfileName() string {
 // MultiAppConfig is the multi-app config file format.
 type MultiAppConfig struct {
 	StrictMode  StrictMode  `json:"strictMode,omitempty"`
-	RiskControl *bool       `json:"riskControl,omitempty"`
 	CurrentApp  string      `json:"currentApp,omitempty"`
 	PreviousApp string      `json:"previousApp,omitempty"`
 	Apps        []AppConfig `json:"apps"`
 }
 
-// RiskControlEnabled resolves the workspace policy. An omitted preference
-// keeps the default-on account-protection behavior.
-func (m *MultiAppConfig) RiskControlEnabled() bool {
-	return m != nil && (m.RiskControl == nil || *m.RiskControl)
-}
-
 // CurrentAppConfig returns the currently active app config.
 // Resolution priority: profileOverride > CurrentApp field > Apps[0].
 func (m *MultiAppConfig) CurrentAppConfig(profileOverride string) *AppConfig {

internal/core/config_snapshot.go

@@ -1,37 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package core
-
-import (
-	"io/fs"
-	"sync"
-)
-
-// ConfigSnapshot lazily captures one stable view of config.json for a CLI
-// invocation. All runtime consumers share the same load result so account and
-// workspace policy resolution cannot observe different file revisions. Callers
-// must treat the returned config as read-only.
-type ConfigSnapshot struct {
-	load func() (*MultiAppConfig, error)
-}
-
-// NewConfigSnapshot creates a lazily loaded invocation-scoped config snapshot.
-func NewConfigSnapshot() *ConfigSnapshot {
-	return newConfigSnapshot(LoadMultiAppConfig)
-}
-
-func newConfigSnapshot(load func() (*MultiAppConfig, error)) *ConfigSnapshot {
-	if load == nil {
-		return &ConfigSnapshot{}
-	}
-	return &ConfigSnapshot{load: sync.OnceValues(load)}
-}
-
-// MultiAppConfig returns the captured persistent config and load error.
-func (s *ConfigSnapshot) MultiAppConfig() (*MultiAppConfig, error) {
-	if s == nil || s.load == nil {
-		return nil, fs.ErrNotExist
-	}
-	return s.load()
-}

internal/core/config_snapshot_test.go

@@ -1,58 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package core
-
-import (
-	"errors"
-	"io/fs"
-	"testing"
-)
-
-func TestConfigSnapshotLoadsOnce(t *testing.T) {
-	calls := 0
-	want := &MultiAppConfig{}
-	snapshot := newConfigSnapshot(func() (*MultiAppConfig, error) {
-		calls++
-		return want, nil
-	})
-
-	for range 2 {
-		config, err := snapshot.MultiAppConfig()
-		if err != nil {
-			t.Fatal(err)
-		}
-		if config != want {
-			t.Fatal("snapshot returned a different config instance")
-		}
-	}
-	if calls != 1 {
-		t.Fatalf("config loads = %d, want 1", calls)
-	}
-}
-
-func TestConfigSnapshotZeroValueIsMissing(t *testing.T) {
-	config, err := (&ConfigSnapshot{}).MultiAppConfig()
-	if config != nil || !errors.Is(err, fs.ErrNotExist) {
-		t.Fatalf("MultiAppConfig() = (%v, %v), want (nil, fs.ErrNotExist)", config, err)
-	}
-}
-
-func TestConfigSnapshotCachesError(t *testing.T) {
-	calls := 0
-	want := errors.New("load failed")
-	snapshot := newConfigSnapshot(func() (*MultiAppConfig, error) {
-		calls++
-		return nil, want
-	})
-
-	for range 2 {
-		config, err := snapshot.MultiAppConfig()
-		if config != nil || !errors.Is(err, want) {
-			t.Fatalf("MultiAppConfig() = (%v, %v), want (nil, %v)", config, err, want)
-		}
-	}
-	if calls != 1 {
-		t.Fatalf("config loads = %d, want 1", calls)
-	}
-}

internal/core/config_test.go

@@ -60,9 +60,7 @@ func TestAppConfig_LangOmitEmpty(t *testing.T) {
 }
 
 func TestMultiAppConfig_RoundTrip(t *testing.T) {
-	disabled := false
 	config := &MultiAppConfig{
-		RiskControl: &disabled,
 		Apps: []AppConfig{{
 			AppId: "cli_test", AppSecret: PlainSecret("s"),
 			Brand: BrandLark, Lang: "zh", Users: []AppUser{},
@@ -86,9 +84,6 @@ func TestMultiAppConfig_RoundTrip(t *testing.T) {
 	if got.Apps[0].Brand != BrandLark {
 		t.Errorf("Brand = %q, want %q", got.Apps[0].Brand, BrandLark)
 	}
-	if got.RiskControl == nil || *got.RiskControl {
-		t.Errorf("RiskControl = %v, want explicit false", got.RiskControl)
-	}
 }
 
 func TestResolveConfigFromMulti_RejectsSecretKeyMismatch(t *testing.T) {

internal/riskcontrol/osmodel.go

@@ -1,142 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-// Package deviceinfo collects the platform hardware product model and the
-// platform values used by device-related risk-control headers.
-package riskcontrol
-
-import (
-	"runtime"
-	"strings"
-	"sync"
-	"unicode"
-	"unicode/utf8"
-
-	"golang.org/x/net/http/httpguts"
-)
-
-// OSType is the server-side risk-control operating-system enum.
-type OSType string
-
-// OS type enum values for X-Agent-Os-Type.
-const (
-	OSTypeUnknown = "0"
-	OSTypeWindows = "1"
-	OSTypeLinux   = "2"
-	OSTypeMacOS   = "3"
-)
-
-const (
-	// TerminalTypePC is the fixed X-Agent-Terminal-Type value for the CLI.
-	TerminalTypePC = "1"
-
-	// Unknown is used when the hardware product model cannot be collected.
-	Unknown = "Unknown"
-
-	// deviceModelMaxBytes bounds the value added to X-Agent-Device-Type.
-	// Device models are short identifiers; a larger value is treated as
-	// malformed rather than truncated so the header never misrepresents it.
-	deviceModelMaxBytes = 256
-)
-
-// Snapshot contains the deliberately small risk-control signal set.
-// ProductModel is omitted when the platform cannot provide a safe value.
-type Snapshot struct {
-	OSType       OSType
-	ProductModel string
-}
-
-// Source supplies one immutable process-level snapshot.
-type Source interface {
-	Snapshot() Snapshot
-}
-
-// HostSource lazily reads host signals once, after outbound policy authorizes
-// the first request. Failed probes are cached and are not retried per request.
-type HostSource struct {
-	once      sync.Once
-	value     Snapshot
-	readModel func() string
-}
-
-// NewHostSource creates the production host signal source.
-func NewHostSource() *HostSource {
-	return &HostSource{readModel: readDeviceModel}
-}
-
-// Snapshot returns the cached host signal snapshot.
-func (s *HostSource) Snapshot() Snapshot {
-	if s == nil {
-		return Snapshot{}
-	}
-	s.once.Do(func() {
-		readModel := s.readModel
-		if readModel == nil {
-			readModel = readDeviceModel
-		}
-		s.value = Snapshot{
-			OSType:       GetOSType(OSName()),
-			ProductModel: normalizeDeviceModel(readModel()),
-		}
-	})
-	return s.value
-}
-
-// normalizeModel removes non-printable characters and returns a model only
-// when the remaining text is safe to use as an HTTP header value. Input that
-// cannot produce a valid model is rejected so Get can fall back to Unknown.
-func normalizeDeviceModel(model string) string {
-	if !utf8.ValidString(model) {
-		return ""
-	}
-	model = strings.Map(func(r rune) rune {
-		switch {
-		case r == '\r' || r == '\n' || r == '\x00':
-			return -1
-		case unicode.IsSpace(r):
-			return ' '
-		case unicode.IsPrint(r):
-			return r
-		default:
-			return -1
-		}
-	}, model)
-
-	model = strings.Join(strings.Fields(model), " ")
-
-	if model == "" || len(model) > deviceModelMaxBytes {
-		return ""
-	}
-	if !httpguts.ValidHeaderFieldValue(model) {
-		return ""
-	}
-	return model
-}
-
-// GetOSType maps a platform name to the X-Agent-Os-Type enum.
-func GetOSType(osName string) OSType {
-	switch osName {
-	case "Windows":
-		return OSTypeWindows
-	case "Linux":
-		return OSTypeLinux
-	case "MacOS":
-		return OSTypeMacOS
-	default:
-		return OSTypeUnknown
-	}
-}
-
-// OSName returns the platform name used by GetOSType.
-func OSName() string {
-	switch runtime.GOOS {
-	case "darwin":
-		return "MacOS"
-	case "windows":
-		return "Windows"
-	case "linux":
-		return "Linux"
-	default:
-		return runtime.GOOS
-	}
-}

internal/riskcontrol/osmodel_darwin.go

@@ -1,27 +0,0 @@
-//go:build darwin
-
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package riskcontrol
-
-import "golang.org/x/sys/unix"
-
-// readDeviceModel reads the current product key first and falls back to the
-// legacy model key. Trying both keys is more robust than branching on a macOS
-// version because virtualized or restricted environments may expose only one.
-func readDeviceModel() string {
-	return readDarwinDeviceModel(unix.Sysctl)
-}
-
-func readDarwinDeviceModel(readSysctl func(string) (string, error)) string {
-	for _, key := range [...]string{"hw.product", "hw.model"} {
-		model, err := readSysctl(key)
-		if err == nil {
-			if model = normalizeDeviceModel(model); model != "" {
-				return model
-			}
-		}
-	}
-	return ""
-}

internal/riskcontrol/osmodel_darwin_test.go

@@ -1,48 +0,0 @@
-//go:build darwin
-
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package riskcontrol
-
-import (
-	"errors"
-	"reflect"
-	"testing"
-)
-
-func TestReadDarwinDeviceModelPrefersProductAndFallsBackToModel(t *testing.T) {
-	t.Run("product available", func(t *testing.T) {
-		var keys []string
-		got := readDarwinDeviceModel(func(key string) (string, error) {
-			keys = append(keys, key)
-			if key == "hw.product" {
-				return "Mac16,1", nil
-			}
-			return "", errors.New("unexpected fallback")
-		})
-		if got != "Mac16,1" {
-			t.Fatalf("model = %q, want %q", got, "Mac16,1")
-		}
-		if want := []string{"hw.product"}; !reflect.DeepEqual(keys, want) {
-			t.Fatalf("sysctl keys = %v, want %v", keys, want)
-		}
-	})
-
-	t.Run("product unavailable", func(t *testing.T) {
-		var keys []string
-		got := readDarwinDeviceModel(func(key string) (string, error) {
-			keys = append(keys, key)
-			if key == "hw.model" {
-				return "MacBookPro18,3", nil
-			}
-			return "", errors.New("not available")
-		})
-		if got != "MacBookPro18,3" {
-			t.Fatalf("model = %q, want %q", got, "MacBookPro18,3")
-		}
-		if want := []string{"hw.product", "hw.model"}; !reflect.DeepEqual(keys, want) {
-			t.Fatalf("sysctl keys = %v, want %v", keys, want)
-		}
-	})
-}

internal/riskcontrol/osmodel_linux.go

@@ -1,17 +0,0 @@
-//go:build linux
-
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package riskcontrol
-
-// readDeviceModel returns a stable device model for Linux. DMI and device-tree
-// values vary widely and can expose the host or virtualization platform when
-// the CLI runs in a container or sandbox.
-func readDeviceModel() string {
-	return readLinuxDeviceModel()
-}
-
-func readLinuxDeviceModel() string {
-	return "linux"
-}

internal/riskcontrol/osmodel_linux_test.go

@@ -1,20 +0,0 @@
-//go:build linux
-
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package riskcontrol
-
-import "testing"
-
-func TestReadDeviceModelReturnsLinux(t *testing.T) {
-	if got := readDeviceModel(); got != "linux" {
-		t.Fatalf("readDeviceModel() = %q, want %q", got, "linux")
-	}
-}
-
-func TestReadLinuxDeviceModel(t *testing.T) {
-	if got := readLinuxDeviceModel(); got != "linux" {
-		t.Fatalf("readLinuxDeviceModel() = %q, want %q", got, "linux")
-	}
-}

internal/riskcontrol/osmodel_other.go

@@ -1,11 +0,0 @@
-//go:build !darwin && !windows && !linux
-
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package riskcontrol
-
-// readDeviceModel returns an empty model on unsupported platforms.
-func readDeviceModel() string {
-	return ""
-}

internal/riskcontrol/osmodel_test.go

@@ -1,143 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package riskcontrol
-
-import (
-	"fmt"
-	"strings"
-	"sync"
-	"sync/atomic"
-	"testing"
-	"unicode"
-)
-
-func TestHostSourceCachesNonEmptyModel(t *testing.T) {
-	calls := 0
-	s := &HostSource{readModel: func() string {
-		calls++
-		return "  MacBookPro18,3\n"
-	}}
-
-	if got := s.Snapshot(); got.ProductModel != "MacBookPro18,3" {
-		t.Fatalf("first Snapshot().ProductModel = %q, want %q", got.ProductModel, "MacBookPro18,3")
-	}
-	if got := s.Snapshot(); got.ProductModel != "MacBookPro18,3" {
-		t.Fatalf("second Snapshot().ProductModel = %q, want cached model", got.ProductModel)
-	}
-	if calls != 1 {
-		t.Fatalf("read called %d times, want 1", calls)
-	}
-}
-
-func TestHostSourceCachesEmptyModel(t *testing.T) {
-	calls := 0
-	s := &HostSource{readModel: func() string {
-		calls++
-		return ""
-	}}
-
-	if got := s.Snapshot(); got.ProductModel != "" {
-		t.Fatalf("first Snapshot().ProductModel = %q, want empty", got.ProductModel)
-	}
-	if got := s.Snapshot(); got.ProductModel != "" {
-		t.Fatalf("second Snapshot().ProductModel = %q, want cached empty result", got.ProductModel)
-	}
-	if calls != 1 {
-		t.Fatalf("read called %d times, want 1", calls)
-	}
-}
-
-func TestHostSourceReadsOnceAcrossConcurrentCalls(t *testing.T) {
-	var calls atomic.Int32
-	s := &HostSource{readModel: func() string {
-		calls.Add(1)
-		return "ThinkPad X1 Carbon"
-	}}
-
-	const goroutines = 32
-	var wg sync.WaitGroup
-	wg.Add(goroutines)
-	for i := 0; i < goroutines; i++ {
-		go func() {
-			defer wg.Done()
-			snapshot := s.Snapshot()
-			if snapshot.ProductModel != "ThinkPad X1 Carbon" {
-				t.Errorf("Snapshot().ProductModel = %q, want %q", snapshot.ProductModel, "ThinkPad X1 Carbon")
-			}
-		}()
-	}
-	wg.Wait()
-
-	if got := calls.Load(); got != 1 {
-		t.Fatalf("read called %d times, want 1", got)
-	}
-}
-
-func TestNormalizeDeviceModel(t *testing.T) {
-	tests := []struct {
-		name  string
-		model string
-		want  string
-	}{
-		{name: "trims surrounding whitespace", model: "  MacBookPro18,3\n", want: "MacBookPro18,3"},
-		{name: "trims device tree terminator", model: "Raspberry Pi 5\x00", want: "Raspberry Pi 5"},
-		{name: "allows printable Unicode", model: "联想 ThinkPad X1", want: "联想 ThinkPad X1"},
-		{name: "rejects empty", model: " \t\r\n"},
-		{name: "rejects invalid UTF-8", model: string([]byte{'M', 0xff, '1'})},
-		{name: "removes CRLF", model: "model\r\nname", want: "modelname"},
-		{name: "normalizes tab", model: "model\tname", want: "model name"},
-		{name: "removes NUL", model: "model\x00name", want: "modelname"},
-		{name: "removes control character", model: "model\x1fname", want: "modelname"},
-		{name: "removes DEL", model: "model\x7fname", want: "modelname"},
-		{name: "normalizes Unicode line separator", model: "model\u2028name", want: "model name"},
-		{name: "collapses whitespace", model: "  model\t \u00a0 name  ", want: "model name"},
-		{name: "accepts maximum byte length", model: strings.Repeat("a", deviceModelMaxBytes), want: strings.Repeat("a", deviceModelMaxBytes)},
-		{name: "rejects overlong value", model: strings.Repeat("a", deviceModelMaxBytes+1)},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			if got := normalizeDeviceModel(tt.model); got != tt.want {
-				t.Fatalf("normalizeDeviceModel(%q) = %q, want %q", tt.model, got, tt.want)
-			}
-		})
-	}
-}
-
-func TestNormalizeDeviceModelRemovesHTTPControlBytes(t *testing.T) {
-	for value := 0; value <= 0x7f; value++ {
-		if value >= 0x20 && value < 0x7f {
-			continue
-		}
-		t.Run(fmt.Sprintf("0x%02x", value), func(t *testing.T) {
-			model := "model" + string(rune(value)) + "name"
-			want := "modelname"
-			if value != '\r' && value != '\n' && value != '\x00' && unicode.IsSpace(rune(value)) {
-				want = "model name"
-			}
-			if got := normalizeDeviceModel(model); got != want {
-				t.Fatalf("normalizeDeviceModel(%q) = %q, want %q", model, got, want)
-			}
-		})
-	}
-}
-
-func TestGetOSType(t *testing.T) {
-	tests := []struct {
-		name string
-		want OSType
-	}{
-		{name: "Windows", want: OSTypeWindows},
-		{name: "Linux", want: OSTypeLinux},
-		{name: "MacOS", want: OSTypeMacOS},
-		{name: "unknown", want: OSTypeUnknown},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			if got := GetOSType(tt.name); got != tt.want {
-				t.Errorf("GetOSType(%q) = %q, want %q", tt.name, got, tt.want)
-			}
-		})
-	}
-}

internal/riskcontrol/osmodel_windows.go

@@ -1,44 +0,0 @@
-//go:build windows
-
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package riskcontrol
-
-import "golang.org/x/sys/windows/registry"
-
-// systemInfoRegistryPaths lists registry locations in device-model lookup order.
-var systemInfoRegistryPaths = [...]string{
-	`HARDWARE\DESCRIPTION\System\BIOS`,
-	`SYSTEM\CurrentControlSet\Control\SystemInformation`,
-	`SYSTEM\HardwareConfig\Current`,
-}
-
-// readDeviceModel returns the first product name found in the Windows registry.
-func readDeviceModel() string {
-	return readWindowsDeviceModel(readWindowsRegistryModel)
-}
-
-func readWindowsRegistryModel(path string) (string, error) {
-	key, err := registry.OpenKey(registry.LOCAL_MACHINE, path, registry.READ)
-	if err != nil {
-		return "", err
-	}
-	defer key.Close()
-
-	model, _, err := key.GetStringValue("SystemProductName")
-	return model, err
-}
-
-func readWindowsDeviceModel(readRegistryModel func(string) (string, error)) string {
-	for _, path := range systemInfoRegistryPaths {
-		model, err := readRegistryModel(path)
-		if err != nil {
-			continue
-		}
-		if model = normalizeDeviceModel(model); model != "" {
-			return model
-		}
-	}
-	return ""
-}

internal/riskcontrol/osmodel_windows_test.go

@@ -1,78 +0,0 @@
-//go:build windows
-
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package riskcontrol
-
-import (
-	"errors"
-	"reflect"
-	"testing"
-)
-
-func TestReadWindowsDeviceModelFallback(t *testing.T) {
-	readError := errors.New("registry read failed")
-	tests := []struct {
-		name      string
-		values    map[string]string
-		errors    map[string]error
-		want      string
-		wantPaths []string
-	}{
-		{
-			name:      "first path wins",
-			values:    map[string]string{systemInfoRegistryPaths[0]: "Surface Laptop"},
-			want:      "Surface Laptop",
-			wantPaths: []string{systemInfoRegistryPaths[0]},
-		},
-		{
-			name: "read failure falls back",
-			errors: map[string]error{
-				systemInfoRegistryPaths[0]: readError,
-			},
-			values: map[string]string{
-				systemInfoRegistryPaths[1]: "ThinkPad X1 Carbon",
-			},
-			want:      "ThinkPad X1 Carbon",
-			wantPaths: systemInfoRegistryPaths[:2],
-		},
-		{
-			name: "empty normalized value falls back",
-			values: map[string]string{
-				systemInfoRegistryPaths[0]: " \r\n\x00",
-				systemInfoRegistryPaths[1]: "Latitude 7450",
-			},
-			want:      "Latitude 7450",
-			wantPaths: systemInfoRegistryPaths[:2],
-		},
-		{
-			name: "all paths fail",
-			errors: map[string]error{
-				systemInfoRegistryPaths[0]: readError,
-				systemInfoRegistryPaths[1]: readError,
-				systemInfoRegistryPaths[2]: readError,
-			},
-			wantPaths: systemInfoRegistryPaths[:],
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			var paths []string
-			got := readWindowsDeviceModel(func(path string) (string, error) {
-				paths = append(paths, path)
-				if err := tt.errors[path]; err != nil {
-					return "", err
-				}
-				return tt.values[path], nil
-			})
-			if got != tt.want {
-				t.Fatalf("model = %q, want %q", got, tt.want)
-			}
-			if !reflect.DeepEqual(paths, tt.wantPaths) {
-				t.Fatalf("registry paths = %v, want %v", paths, tt.wantPaths)
-			}
-		})
-	}
-}

internal/riskcontrol/transport.go

@@ -1,138 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package riskcontrol
-
-import (
-	"net/http"
-	"net/url"
-	"strings"
-
-	"github.com/larksuite/cli/internal/core"
-	internaltransport "github.com/larksuite/cli/internal/transport"
-)
-
-const (
-	HeaderProductModel = "X-Agent-Device-Type"
-	HeaderOSType       = "X-Agent-Os-Type"
-)
-
-var restrictedHeaders = [...]string{HeaderProductModel, HeaderOSType}
-
-// Transport is the feature's final outbound boundary. It removes caller- or
-// extension-supplied signal headers first and writes trusted values only after
-// authorizing an official SDK origin and authentication state.
-type Transport struct {
-	next   http.RoundTripper
-	source Source
-}
-
-// NewTransport creates the final SDK outbound policy boundary. A nil source
-// disables collection and injection while preserving restricted-header
-// stripping for opt-out and extension-credential requests.
-func NewTransport(next http.RoundTripper, source Source) *Transport {
-	if next == nil {
-		next = internaltransport.Fallback()
-	}
-	return &Transport{
-		next:   next,
-		source: source,
-	}
-}
-
-// RoundTrip implements http.RoundTripper.
-func (t *Transport) RoundTrip(req *http.Request) (*http.Response, error) {
-	req = req.Clone(req.Context())
-	if req.Header == nil {
-		req.Header = make(http.Header)
-	}
-	stripRestrictedHeaders(req.Header)
-
-	if t.source != nil && t.routeAllowsSignals(req) {
-		snapshot := t.source.Snapshot()
-		if isSupportedOSType(snapshot.OSType) {
-			req.Header.Set(HeaderOSType, string(snapshot.OSType))
-		}
-		if model := normalizeDeviceModel(snapshot.ProductModel); model != "" {
-			req.Header.Set(HeaderProductModel, model)
-		}
-	}
-	return t.next.RoundTrip(req)
-}
-
-func isSupportedOSType(value OSType) bool {
-	switch value {
-	case OSTypeWindows, OSTypeLinux, OSTypeMacOS:
-		return true
-	default:
-		return false
-	}
-}
-
-func stripRestrictedHeaders(header http.Header) {
-	for name := range header {
-		for _, restricted := range restrictedHeaders {
-			if strings.EqualFold(name, restricted) {
-				delete(header, name)
-				break
-			}
-		}
-	}
-}
-
-type origin struct {
-	scheme string
-	host   string
-	port   string
-}
-
-var officialFeishuOrigins = [...]origin{
-	apiOrigin(core.BrandFeishu, core.ResolveEndpoints(core.BrandFeishu).Open),
-	apiOrigin(core.BrandLark, core.ResolveEndpoints(core.BrandLark).Open),
-	apiOrigin(core.BrandFeishu, core.ResolveEndpoints(core.BrandFeishu).Accounts),
-	apiOrigin(core.BrandLark, core.ResolveEndpoints(core.BrandLark).Accounts),
-}
-
-func (t *Transport) routeAllowsSignals(req *http.Request) bool {
-	if req == nil || req.URL == nil {
-		return false
-	}
-	return isOfficialFeishuOrigin(originOf(req.URL))
-}
-
-func originOf(value *url.URL) origin {
-	if value == nil {
-		return origin{}
-	}
-	scheme := strings.ToLower(value.Scheme)
-	port := value.Port()
-	if port == "" {
-		switch scheme {
-		case "https":
-			port = "443"
-		case "http":
-			port = "80"
-		}
-	}
-	return origin{scheme: scheme, host: strings.ToLower(value.Hostname()), port: port}
-}
-
-func apiOrigin(brand core.LarkBrand, endpointURL string) origin {
-	endpoint, err := url.Parse(endpointURL)
-	if err != nil {
-		return origin{}
-	}
-	return originOf(endpoint)
-}
-
-func isOfficialFeishuOrigin(candidate origin) bool {
-	if candidate.scheme != "https" || candidate.port != "443" {
-		return false
-	}
-	for _, official := range officialFeishuOrigins {
-		if candidate == official {
-			return true
-		}
-	}
-	return false
-}

internal/riskcontrol/transport_test.go

@@ -1,124 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package riskcontrol
-
-import (
-	"net/http"
-	"strings"
-	"sync/atomic"
-	"testing"
-)
-
-type roundTripFunc func(*http.Request) (*http.Response, error)
-
-func (f roundTripFunc) RoundTrip(req *http.Request) (*http.Response, error) {
-	return f(req)
-}
-
-type countingSource struct {
-	calls atomic.Int32
-}
-
-func (s *countingSource) Snapshot() Snapshot {
-	s.calls.Add(1)
-	return Snapshot{OSType: OSTypeMacOS, ProductModel: "Mac16,1"}
-}
-
-type staticSource Snapshot
-
-func (s staticSource) Snapshot() Snapshot { return Snapshot(s) }
-
-func TestTransportAuthorizesBeforeCollecting(t *testing.T) {
-	tests := []struct {
-		name          string
-		requestURL    string
-		authorization string
-		wantSignals   bool
-	}{
-		{name: "authenticated official HTTPS", requestURL: "https://open.feishu.cn/open-apis/test", authorization: "Bearer token", wantSignals: true},
-		{name: "Lark official HTTPS", requestURL: "https://open.larksuite.com/open-apis/test", authorization: "Bearer token", wantSignals: true},
-		{name: "official explicit HTTPS port", requestURL: "https://OPEN.FEISHU.CN:443/open-apis/test", authorization: "Bearer token", wantSignals: true},
-		{name: "unauthenticated", requestURL: "https://open.feishu.cn/open-apis/test", wantSignals: true},
-		{name: "official non-OpenAPI origin", requestURL: "https://accounts.feishu.cn/open-apis/test", authorization: "Bearer token", wantSignals: true},
-		{name: "off domain", requestURL: "https://example.com/test", authorization: "Bearer token", wantSignals: false},
-		{name: "lookalike", requestURL: "https://open.feishu.cn.evil.example/test", authorization: "Bearer token", wantSignals: false},
-		{name: "plain HTTP", requestURL: "http://open.feishu.cn/test", authorization: "Bearer token", wantSignals: false},
-		{name: "non-default port", requestURL: "https://open.feishu.cn:8443/test", authorization: "Bearer token", wantSignals: false},
-	}
-
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			source := &countingSource{}
-			var received http.Header
-			base := roundTripFunc(func(req *http.Request) (*http.Response, error) {
-				received = req.Header.Clone()
-				return &http.Response{StatusCode: http.StatusOK, Body: http.NoBody}, nil
-			})
-			req, err := http.NewRequest(http.MethodGet, test.requestURL, nil)
-			if err != nil {
-				t.Fatal(err)
-			}
-			req.Header.Set("Authorization", test.authorization)
-			req.Header.Set(HeaderOSType, "caller-value")
-			req.Header.Set(HeaderProductModel, "caller-value")
-			req.Header["x-agent-device-type"] = []string{"non-canonical-caller-value"}
-
-			resp, err := NewTransport(base, source).RoundTrip(req)
-			if err != nil {
-				t.Fatal(err)
-			}
-			resp.Body.Close()
-
-			gotSignals := received.Get(HeaderOSType) != ""
-			if gotSignals != test.wantSignals {
-				t.Fatalf("signals present = %t, want %t; headers=%v", gotSignals, test.wantSignals, received)
-			}
-			wantCalls := int32(0)
-			if test.wantSignals {
-				wantCalls = 1
-			}
-			if got := source.calls.Load(); got != wantCalls {
-				t.Fatalf("Snapshot calls = %d, want %d", got, wantCalls)
-			}
-			if got := req.Header.Get(HeaderOSType); got != "caller-value" {
-				t.Fatalf("caller request OS header = %q, want unchanged", got)
-			}
-			if got := req.Header.Get(HeaderProductModel); got != "caller-value" {
-				t.Fatalf("caller request product-model header = %q, want unchanged", got)
-			}
-			if !test.wantSignals {
-				for name := range received {
-					if strings.EqualFold(name, HeaderProductModel) || strings.EqualFold(name, HeaderOSType) {
-						t.Fatalf("restricted header leaked as %q", name)
-					}
-				}
-			}
-		})
-	}
-}
-
-func TestTransportValidatesSourceSnapshot(t *testing.T) {
-	var received http.Header
-	base := roundTripFunc(func(req *http.Request) (*http.Response, error) {
-		received = req.Header.Clone()
-		return &http.Response{StatusCode: http.StatusOK, Body: http.NoBody}, nil
-	})
-	req, err := http.NewRequest(http.MethodGet, "https://open.feishu.cn/open-apis/test", nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-	req.Header.Set("Authorization", "Bearer token")
-
-	resp, err := NewTransport(base, staticSource{
-		OSType:       OSType("unsupported"),
-		ProductModel: "unsafe\nvalue",
-	}).RoundTrip(req)
-	if err != nil {
-		t.Fatal(err)
-	}
-	resp.Body.Close()
-	if received.Get(HeaderOSType) == "" && received.Get(HeaderProductModel) == "" {
-		t.Fatalf("no signals collected: %v", received)
-	}
-}

internal/validate/path.go

@@ -17,13 +17,6 @@ func SafeInputPath(path string) (string, error) {
 	return localfileio.SafeInputPath(path)
 }
 
-// LocalInputPath validates a local input path without restricting it to the
-// current working directory. It delegates to localfileio.LocalInputPath so
-// command validation and shared local-file readers use one policy.
-func LocalInputPath(path string) (string, error) {
-	return localfileio.LocalInputPath(path)
-}
-
 // SafeEnvDirPath validates an environment-provided application directory path.
 // Delegates to localfileio.SafeEnvDirPath.
 func SafeEnvDirPath(path, envName string) (string, error) {

internal/validate/path_test.go

@@ -211,18 +211,6 @@ func TestSafeLocalFlagPath(t *testing.T) {
 	}
 }
 
-func TestLocalInputPath_AllowsLocalPathsAndRejectsUnsafeCharacters(t *testing.T) {
-	for _, path := range []string{"/tmp/report.pdf", "../report.pdf"} {
-		got, err := LocalInputPath(path)
-		if err != nil || got != path {
-			t.Fatalf("LocalInputPath(%q) = %q, %v; want unchanged path", path, got, err)
-		}
-	}
-	if _, err := LocalInputPath("report\n.pdf"); err == nil {
-		t.Fatal("LocalInputPath() unexpectedly accepted a control character")
-	}
-}
-
 func TestSafeUploadPath_AllowsTempFileAbsolutePath(t *testing.T) {
 	// GIVEN: a real temp file (absolute path under os.TempDir())
 	f, err := os.CreateTemp("", "upload-test-*.bin")

internal/vfs/localfileio/path.go

@@ -7,7 +7,6 @@ import (
 	"fmt"
 	"path/filepath"
 	"strings"
-	"unicode"
 
 	"github.com/larksuite/cli/internal/charcheck"
 	"github.com/larksuite/cli/internal/vfs"
@@ -23,32 +22,6 @@ func SafeInputPath(path string) (string, error) {
 	return safePath(path, "--file")
 }
 
-// LocalInputPath validates an input path in the process local filesystem
-// namespace. It intentionally does not impose cwd containment or canonicalize
-// the path: absolute paths, parent-relative paths, and symlink traversal retain
-// their normal OS semantics. Character validation remains mandatory because
-// paths are user-controlled and may appear in errors or progress output.
-func LocalInputPath(path string) (string, error) {
-	if strings.TrimSpace(path) == "" {
-		return "", fmt.Errorf("local input path must not be empty")
-	}
-	if strings.IndexFunc(path, unicode.IsControl) >= 0 {
-		return "", fmt.Errorf("local input path must not contain control characters")
-	}
-	if err := charcheck.RejectControlChars(path, "local input path"); err != nil {
-		return "", err
-	}
-	if err := validateLocalInputPlatform(path); err != nil {
-		return "", err
-	}
-	return path, nil
-}
-
-func isWindowsNonLocalNamespace(path string) bool {
-	normalized := strings.ReplaceAll(path, "/", `\`)
-	return strings.HasPrefix(normalized, `\\`) || strings.HasPrefix(normalized, `\??\`)
-}
-
 // SafeLocalFlagPath validates a flag value as a local file path.
 // Empty values and http/https URLs are returned unchanged without validation.
 func SafeLocalFlagPath(flagName, value string) (string, error) {
@@ -56,7 +29,7 @@ func SafeLocalFlagPath(flagName, value string) (string, error) {
 		return value, nil
 	}
 	if _, err := SafeInputPath(value); err != nil {
-		return "", fmt.Errorf("%s: %w", flagName, err)
+		return "", fmt.Errorf("%s: %v", flagName, err)
 	}
 	return value, nil
 }

internal/vfs/localfileio/path_local_other.go

@@ -1,8 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-//go:build !windows
-
-package localfileio
-
-func validateLocalInputPlatform(string) error { return nil }

internal/vfs/localfileio/path_local_windows.go

@@ -1,33 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-//go:build windows
-
-package localfileio
-
-import (
-	"fmt"
-	"path/filepath"
-	"strings"
-)
-
-func validateLocalInputPlatform(path string) error {
-	if isWindowsNonLocalNamespace(path) {
-		return fmt.Errorf("local input path must not use a Windows network or device namespace")
-	}
-
-	cleaned := filepath.Clean(path)
-	volume := filepath.VolumeName(cleaned)
-	remainder := strings.TrimLeft(cleaned[len(volume):], `\/`)
-	for _, component := range strings.FieldsFunc(remainder, func(r rune) bool {
-		return r == '\\' || r == '/'
-	}) {
-		if component == "." || component == ".." {
-			continue
-		}
-		if !filepath.IsLocal(component) {
-			return fmt.Errorf("local input path contains a reserved Windows path component %q", component)
-		}
-	}
-	return nil
-}

internal/vfs/localfileio/path_local_windows_test.go

@@ -1,27 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-//go:build windows
-
-package localfileio
-
-import "testing"
-
-func TestLocalInputPath_RejectsWindowsNetworkDeviceAndReservedPaths(t *testing.T) {
-	for _, input := range []string{
-		`\\server\share\report.pdf`,
-		`//server/share/report.pdf`,
-		`\\.\pipe\upload`,
-		`\\?\C:\Users\agent\report.pdf`,
-		`\\?\UNC\server\share\report.pdf`,
-		`\??\C:\Users\agent\report.pdf`,
-		`C:\Users\agent\NUL.txt`,
-		`CON`,
-	} {
-		t.Run(input, func(t *testing.T) {
-			if _, err := LocalInputPath(input); err == nil {
-				t.Fatalf("LocalInputPath(%q) unexpectedly succeeded", input)
-			}
-		})
-	}
-}

internal/vfs/localfileio/path_test.go

@@ -4,7 +4,6 @@
 package localfileio
 
 import (
-	"fmt"
 	"os"
 	"path/filepath"
 	"strings"
@@ -72,72 +71,6 @@ func TestSafeOutputPath_RejectsPathTraversalAndDangerousInput(t *testing.T) {
 	}
 }
 
-func TestLocalInputPath_AllowsLocalNamespaceWithoutRewriting(t *testing.T) {
-	for _, input := range []string{
-		"/tmp/report.pdf",
-		"../outside/report.pdf",
-		"./report.pdf",
-		"nested/../report.pdf",
-		`C:\Users\agent\report.pdf`,
-		"报告.pdf",
-	} {
-		t.Run(input, func(t *testing.T) {
-			got, err := LocalInputPath(input)
-			if err != nil {
-				t.Fatalf("LocalInputPath(%q) error = %v", input, err)
-			}
-			if got != input {
-				t.Fatalf("LocalInputPath(%q) = %q, want path preserved verbatim", input, got)
-			}
-		})
-	}
-}
-
-func TestWindowsNonLocalNamespace(t *testing.T) {
-	for _, input := range []string{
-		`\\server\share\report.pdf`,
-		`//server/share/report.pdf`,
-		`\\.\pipe\upload`,
-		`\\?\C:\Users\agent\report.pdf`,
-		`\\?\UNC\server\share\report.pdf`,
-		`\??\C:\Users\agent\report.pdf`,
-	} {
-		if !isWindowsNonLocalNamespace(input) {
-			t.Errorf("isWindowsNonLocalNamespace(%q) = false, want true", input)
-		}
-	}
-
-	for _, input := range []string{
-		`C:\Users\agent\report.pdf`,
-		`C:/Users/agent/report.pdf`,
-		`..\outside\report.pdf`,
-		`.\report.pdf`,
-	} {
-		if isWindowsNonLocalNamespace(input) {
-			t.Errorf("isWindowsNonLocalNamespace(%q) = true, want false", input)
-		}
-	}
-}
-
-func TestLocalInputPath_RejectsEmptyControlAndDangerousUnicode(t *testing.T) {
-	for _, input := range []string{
-		"",
-		"   ",
-		"file\x00.txt",
-		"file\tname.txt",
-		"file\nname.txt",
-		"file\rname.txt",
-		"file\u202Ename.txt",
-		"file\u200Bname.txt",
-	} {
-		t.Run(fmt.Sprintf("%q", input), func(t *testing.T) {
-			if _, err := LocalInputPath(input); err == nil {
-				t.Fatalf("LocalInputPath(%q) unexpectedly succeeded", input)
-			}
-		})
-	}
-}
-
 func TestSafeOutputPath_ReturnsCanonicalAbsolutePath(t *testing.T) {
 	// GIVEN: a clean temp directory as CWD
 	dir := t.TempDir()

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@larksuite/cli",
-  "version": "1.0.79",
+  "version": "1.0.76",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@larksuite/cli",
-      "version": "1.0.79",
+      "version": "1.0.76",
       "cpu": [
         "x64",
         "arm64",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@larksuite/cli",
-  "version": "1.0.79",
+  "version": "1.0.76",
   "description": "The official CLI for Lark/Feishu open platform",
   "bin": {
     "lark-cli": "scripts/run.js"

scripts/semantic-review-workflow.test.sh

@@ -176,15 +176,7 @@ if ! grep -Fq "if: always() && github.event.workflow_run.conclusion == 'success'
   exit 1
 fi
 
-if grep -Fq 'run.name !== "CI"' "$workflow"; then
-  echo "semantic-review must not use the dynamic workflow run name as workflow identity" >&2
-  exit 1
-fi
-
-require_in_step "$summary_verify_step" 'github.rest.actions.getWorkflow' "PR quality summary must resolve static workflow metadata"
-require_in_step "$summary_verify_step" 'workflow.name !== "CI"' "PR quality summary must verify the static workflow name"
-require_in_step "$summary_verify_step" 'workflow.path !== ".github/workflows/ci.yml"' "PR quality summary must verify the static workflow path"
-require_in_step "$summary_verify_step" 'run.path && run.path !== workflow.path' "PR quality summary must reject workflow path metadata mismatches"
+require_in_step "$summary_verify_step" 'workflowPath !== ".github/workflows/ci.yml"' "PR quality summary must verify the triggering workflow path"
 require_in_step "$summary_verify_step" 'run.event !== "pull_request"' "PR quality summary must only handle pull_request workflow_run events"
 require_in_step "$summary_verify_step" 'run.repository.id !== context.payload.repository.id' "PR quality summary must verify workflow_run repository id"
 require_in_step "$summary_verify_step" 'const targetHeadSha = run.head_sha' "PR quality summary must use the CI run head SHA as the verified PR head"
@@ -209,10 +201,7 @@ require_in_step "$summary_publish_step" 'CI_QUALITY_SUMMARY_BASE_SHA' "PR qualit
 require_in_step "$summary_publish_step" 'CI_QUALITY_SUMMARY_RUN_ID' "PR quality summary publisher must receive verified workflow run id"
 require_in_step "$summary_publish_step" 'require("./scripts/ci-quality-summary-publish.js")' "PR quality summary publisher must use the shared CI publisher script"
 
-require_in_step "$verify_step" 'github.rest.actions.getWorkflow' "semantic-review must resolve static workflow metadata"
-require_in_step "$verify_step" 'workflow.name !== "CI"' "semantic-review must verify the static workflow name"
-require_in_step "$verify_step" 'workflow.path !== ".github/workflows/ci.yml"' "semantic-review must verify the static workflow path"
-require_in_step "$verify_step" 'run.path && run.path !== workflow.path' "semantic-review must reject workflow path metadata mismatches"
+require_in_step "$verify_step" 'workflowPath !== ".github/workflows/ci.yml"' "semantic-review must verify the triggering workflow path"
 require_in_step "$verify_step" 'run.repository.id !== context.payload.repository.id' "semantic-review must verify workflow_run repository id"
 require_in_step "$verify_step" 'run.event !== "pull_request"' "semantic-review must only handle pull_request workflow_run events"
 require_in_step "$verify_step" 'run.conclusion !== "success"' "semantic-review must only consume successful CI runs"

shortcuts/apps/apps_file_list.go

@@ -12,23 +12,10 @@ import (
 	"github.com/larksuite/cli/shortcuts/common"
 )
 
-// maxFileListPageSize 是 file_list 分页上限，与后端 paas_storage checkMaxKeys 的 (0, 200] 契约对齐：
-// page_size > 200 服务端直接返回 ErrInvalidRequest("maxKeys not in range (0, 200]")。CLI 前置校验避免无谓往返。
-// 注：服务端对 page_size<=0 会兜底为默认值，但 CLI 默认已是 20、显式传 <1 属误用，故与其它 list 命令一致地按 [1, 200] 校验。
-const maxFileListPageSize = 200
-
-// validateFileListPageSize 前置校验 --page-size ∈ [1, maxFileListPageSize]，与后端 checkMaxKeys 的 (0, 200] 契约对齐。
-func validateFileListPageSize(n int) error {
-	if n < 1 || n > maxFileListPageSize {
-		return appsValidationParamError("--page-size", "--page-size must be between 1 and %d", maxFileListPageSize)
-	}
-	return nil
-}
-
 // AppsFileList lists files in a Miaoda app's storage (cursor pagination)。
 //
 // GET /apps/{app_id}/storage/file_list。过滤器：--name / --path / --type / --size-gt /
-// --size-lt / --uploaded-since / --uploaded-until（精确或区间），分页 --page-size(1..200)/--page-token。
+// --size-lt / --uploaded-since / --uploaded-until（精确或区间），分页 --page-size/--page-token。
 // file 域不分 dev/online，无 --env。
 //
 // pretty 渲染 5 列：file_name / path / size / type / uploaded_at；空结果打 "No files found."。
@@ -54,17 +41,13 @@ var AppsFileList = common.Shortcut{
 		{Name: "size-lt", Type: "int", Desc: "filter: size less than (bytes)"},
 		{Name: "uploaded-since", Desc: "filter: uploaded at or after; relative (7d/2h/30s) | date (2026-04-15) | datetime (2026-04-15T10:00:00) | ISO 8601 w/ TZ (bare date/datetime read in local timezone)"},
 		{Name: "uploaded-until", Desc: "filter: uploaded at or before; relative (7d/2h/30s) | date (2026-04-15) | datetime (2026-04-15T10:00:00) | ISO 8601 w/ TZ (bare date/datetime read in local timezone)"},
-		{Name: "page-size", Type: "int", Default: "20", Desc: "page size (1..200)"},
+		{Name: "page-size", Type: "int", Default: "20", Desc: "page size"},
 		{Name: "page-token", Desc: "pagination cursor from previous response"},
 	},
 	Validate: func(ctx context.Context, rctx *common.RuntimeContext) error {
 		if _, err := requireAppID(rctx.Str("app-id")); err != nil {
 			return err
 		}
-		// page_size 前置校验：对齐后端 checkMaxKeys 的 (0, 200] 契约，避免 >200 触发服务端 ErrInvalidRequest。
-		if err := validateFileListPageSize(rctx.Int("page-size")); err != nil {
-			return err
-		}
 		// 设计原则三：<timestamp> 多格式 → 归一化为 RFC3339 UTC，回写到 flag 供 buildFileListParams 透传。
 		for _, f := range []string{"uploaded-since", "uploaded-until"} {
 			if strings.TrimSpace(rctx.Str(f)) == "" {

shortcuts/apps/apps_file_list_test.go

@@ -82,34 +82,6 @@ func TestAppsFileList_RequiresAppID(t *testing.T) {
 	}
 }
 
-// TestAppsFileList_PageSizeOutOfRange 验证 --page-size 超出 (0, 200] 契约时前置报 --page-size 校验错误，不发请求。
-func TestAppsFileList_PageSizeOutOfRange(t *testing.T) {
-	for _, ps := range []string{"0", "201", "500"} {
-		factory, stdout, _ := newAppsExecuteFactory(t)
-		err := runAppsShortcut(t, AppsFileList,
-			[]string{"+file-list", "--app-id", "app_x", "--page-size", ps, "--as", "user"}, factory, stdout)
-		var ve *errs.ValidationError
-		if !errors.As(err, &ve) {
-			t.Fatalf("page-size=%s: err = %T %v, want *errs.ValidationError", ps, err, err)
-		}
-		if ve.Param != "--page-size" {
-			t.Fatalf("page-size=%s: Param = %q, want --page-size", ps, ve.Param)
-		}
-	}
-}
-
-// TestAppsFileList_PageSizeBoundaryOK 验证边界值 1 与 200 通过校验（dry-run 不报错并把 page_size 下发）。
-func TestAppsFileList_PageSizeBoundaryOK(t *testing.T) {
-	for _, ps := range []string{"1", "200"} {
-		factory, stdout, _ := newAppsExecuteFactory(t)
-		if err := runAppsShortcut(t, AppsFileList,
-			[]string{"+file-list", "--app-id", "app_x", "--page-size", ps, "--dry-run", "--as", "user"},
-			factory, stdout); err != nil {
-			t.Fatalf("page-size=%s: dry-run err=%v", ps, err)
-		}
-	}
-}
-
 // 过滤器 + 分页全部进 query（size-gt/lt 走 int，uploaded_since/until 原样）。
 func TestAppsFileList_DryRunSendsFiltersAndPagination(t *testing.T) {
 	factory, stdout, _ := newAppsExecuteFactory(t)

shortcuts/apps/apps_file_upload.go

@@ -14,6 +14,7 @@ import (
 	"strings"
 
 	"github.com/larksuite/cli/errs"
+	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/shortcuts/common"
 )
 
@@ -46,7 +47,21 @@ var AppsFileUpload = common.Shortcut{
 		if _, err := requireAppID(rctx.Str("app-id")); err != nil {
 			return err
 		}
-		return rctx.ValidateLocalFileFlag("file", fileUploadMaxBytes)
+		f := strings.TrimSpace(rctx.Str("file"))
+		if f == "" {
+			return errs.NewValidationError(errs.SubtypeInvalidArgument, "--file is required").WithParam("--file")
+		}
+		st, err := rctx.FileIO().Stat(f)
+		if err != nil {
+			return errs.NewValidationError(errs.SubtypeInvalidArgument, "--file: %v", err).WithParam("--file").WithCause(err)
+		}
+		if st.IsDir() {
+			return errs.NewValidationError(errs.SubtypeInvalidArgument, "--file must be a file, not a directory").WithParam("--file")
+		}
+		if st.Size() > fileUploadMaxBytes {
+			return errs.NewValidationError(errs.SubtypeInvalidArgument, "file size %d bytes exceeds the 100 MB upload limit", st.Size()).WithParam("--file")
+		}
+		return nil
 	},
 	DryRun: func(ctx context.Context, rctx *common.RuntimeContext) *common.DryRunAPI {
 		appID, _ := requireAppID(rctx.Str("app-id"))
@@ -61,9 +76,9 @@ var AppsFileUpload = common.Shortcut{
 			return err
 		}
 		localPath := strings.TrimSpace(rctx.Str("file"))
-		content, err := rctx.ReadLocalFileFlag("file", fileUploadMaxBytes)
+		content, err := cmdutil.ReadInputFile(rctx.FileIO(), localPath)
 		if err != nil {
-			return err
+			return errs.NewValidationError(errs.SubtypeInvalidArgument, "--file: %v", err).WithParam("--file").WithCause(err)
 		}
 		fileName := filepath.Base(localPath)
 		contentType := mimeByExt(fileName)

shortcuts/apps/apps_file_upload_test.go

@@ -12,7 +12,6 @@ import (
 	"net/http/httptest"
 	"os"
 	"path/filepath"
-	"runtime"
 	"strings"
 	"testing"
 
@@ -59,17 +58,22 @@ func TestAppsFileUpload_RejectsDirectory(t *testing.T) {
 	}
 }
 
-// TestAppsFileUpload_DryRunPreUpload verifies that dry-run validates the local
-// file and previews the pre-upload request without reading or uploading it.
+// TestAppsFileUpload_DryRunPreUpload 验证 dry-run 输出 POST file_pre_upload，body.file_name 取文件 basename。
 func TestAppsFileUpload_DryRunPreUpload(t *testing.T) {
-	absolutePath := filepath.Join(t.TempDir(), "logo.png")
-	if err := os.WriteFile(absolutePath, []byte("not-read-by-dry-run"), 0o600); err != nil {
+	// Validate 会 Stat --file（在 DryRun 之前），故 dry-run 也需要真实存在的文件。
+	dir := t.TempDir()
+	if err := os.WriteFile(filepath.Join(dir, "logo.png"), []byte("x"), 0o600); err != nil {
 		t.Fatal(err)
 	}
+	oldWD, _ := os.Getwd()
+	if err := os.Chdir(dir); err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = os.Chdir(oldWD) })
 
 	factory, stdout, _ := newAppsExecuteFactory(t)
 	if err := runAppsShortcut(t, AppsFileUpload,
-		[]string{"+file-upload", "--app-id", "app_x", "--file", absolutePath, "--dry-run", "--as", "user"}, factory, stdout); err != nil {
+		[]string{"+file-upload", "--app-id", "app_x", "--file", "logo.png", "--dry-run", "--as", "user"}, factory, stdout); err != nil {
 		t.Fatalf("dry-run err=%v", err)
 	}
 	var env dryRunAPIEnvelope
@@ -83,18 +87,6 @@ func TestAppsFileUpload_DryRunPreUpload(t *testing.T) {
 	}
 }
 
-func TestAppsFileUpload_DryRunRejectsMissingFile(t *testing.T) {
-	missingAbsolutePath := filepath.Join(t.TempDir(), "does-not-exist", "logo.png")
-
-	factory, stdout, _ := newAppsExecuteFactory(t)
-	err := runAppsShortcut(t, AppsFileUpload,
-		[]string{"+file-upload", "--app-id", "app_x", "--file", missingAbsolutePath, "--dry-run", "--as", "user"}, factory, stdout)
-	var validationErr *errs.ValidationError
-	if !errors.As(err, &validationErr) || validationErr.Subtype != errs.SubtypeInvalidArgument || validationErr.Param != "--file" {
-		t.Fatalf("error = %T %v, want invalid_argument for --file", err, err)
-	}
-}
-
 // 三步直传：pre-upload → 客户端 PUT 字节 → callback。
 func TestAppsFileUpload_EndToEnd(t *testing.T) {
 	var putBody []byte
@@ -157,142 +149,6 @@ func TestAppsFileUpload_EndToEnd(t *testing.T) {
 	}
 }
 
-// TestAppsFileUpload_AcceptsAbsolutePath verifies that file-upload can read an
-// absolute path outside the current working directory.
-func TestAppsFileUpload_AcceptsAbsolutePath(t *testing.T) {
-	var putBody []byte
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if r.Method != http.MethodPut {
-			w.WriteHeader(http.StatusMethodNotAllowed)
-			return
-		}
-		putBody, _ = io.ReadAll(r.Body)
-		w.Header().Set("ETag", `"etag-abs"`)
-		w.WriteHeader(http.StatusOK)
-	}))
-	defer srv.Close()
-
-	// Keep the process cwd unchanged so the temporary file is outside it.
-	dir := t.TempDir()
-	absFile := filepath.Join(dir, "report.pdf")
-	if !filepath.IsAbs(absFile) {
-		t.Fatalf("test setup: %q is not absolute", absFile)
-	}
-	if err := os.WriteFile(absFile, []byte("PDFBYTES"), 0o600); err != nil {
-		t.Fatal(err)
-	}
-
-	factory, stdout, reg := newAppsExecuteFactory(t)
-	reg.Register(&httpmock.Stub{
-		Method: "POST", URL: "/open-apis/spark/v1/apps/app_x/storage/file_pre_upload",
-		Body: map[string]interface{}{"code": 0, "data": map[string]interface{}{"upload_url": srv.URL, "upload_id": "up-abs"}},
-	})
-	reg.Register(&httpmock.Stub{
-		Method: "POST", URL: "/open-apis/spark/v1/apps/app_x/storage/file_upload_callback",
-		Body: map[string]interface{}{"code": 0, "data": map[string]interface{}{
-			"file_name": "report.pdf", "path": "/1858537546760999.pdf", "size_bytes": 8,
-		}},
-	})
-
-	if err := runAppsShortcut(t, AppsFileUpload,
-		[]string{"+file-upload", "--app-id", "app_x", "--file", absFile, "--as", "user"}, factory, stdout); err != nil {
-		t.Fatalf("execute with absolute path err=%v", err)
-	}
-	if string(putBody) != "PDFBYTES" {
-		t.Fatalf("PUT body = %q, want file bytes", putBody)
-	}
-}
-
-func TestAppsFileUpload_AcceptsParentRelativePathOutsideCWD(t *testing.T) {
-	var putBody []byte
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		putBody, _ = io.ReadAll(r.Body)
-		w.Header().Set("ETag", `"etag-parent"`)
-		w.WriteHeader(http.StatusOK)
-	}))
-	defer srv.Close()
-
-	root := t.TempDir()
-	workDir := filepath.Join(root, "work")
-	if err := os.Mkdir(workDir, 0o755); err != nil {
-		t.Fatal(err)
-	}
-	if err := os.WriteFile(filepath.Join(root, "report.pdf"), []byte("PARENT"), 0o600); err != nil {
-		t.Fatal(err)
-	}
-	oldWD, _ := os.Getwd()
-	if err := os.Chdir(workDir); err != nil {
-		t.Fatal(err)
-	}
-	t.Cleanup(func() { _ = os.Chdir(oldWD) })
-
-	factory, stdout, reg := newAppsExecuteFactory(t)
-	reg.Register(&httpmock.Stub{
-		Method: "POST", URL: "/open-apis/spark/v1/apps/app_x/storage/file_pre_upload",
-		Body: map[string]interface{}{"code": 0, "data": map[string]interface{}{"upload_url": srv.URL, "upload_id": "up-parent"}},
-	})
-	reg.Register(&httpmock.Stub{
-		Method: "POST", URL: "/open-apis/spark/v1/apps/app_x/storage/file_upload_callback",
-		Body: map[string]interface{}{"code": 0, "data": map[string]interface{}{
-			"file_name": "report.pdf", "path": "/parent.pdf", "size_bytes": 6,
-		}},
-	})
-
-	if err := runAppsShortcut(t, AppsFileUpload,
-		[]string{"+file-upload", "--app-id", "app_x", "--file", filepath.Join("..", "report.pdf"), "--as", "user"}, factory, stdout); err != nil {
-		t.Fatalf("execute with parent-relative path err=%v", err)
-	}
-	if string(putBody) != "PARENT" {
-		t.Fatalf("PUT body = %q, want PARENT", putBody)
-	}
-}
-
-func TestAppsFileUpload_RejectsFileAboveLimit(t *testing.T) {
-	path := filepath.Join(t.TempDir(), "too-large.bin")
-	f, err := os.Create(path)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if err := f.Truncate(fileUploadMaxBytes + 1); err != nil {
-		_ = f.Close()
-		t.Fatal(err)
-	}
-	if err := f.Close(); err != nil {
-		t.Fatal(err)
-	}
-
-	factory, stdout, _ := newAppsExecuteFactory(t)
-	err = runAppsShortcut(t, AppsFileUpload,
-		[]string{"+file-upload", "--app-id", "app_x", "--file", path, "--as", "user"}, factory, stdout)
-	var validationErr *errs.ValidationError
-	if !errors.As(err, &validationErr) || validationErr.Param != "--file" {
-		t.Fatalf("error = %T %v, want --file ValidationError", err, err)
-	}
-	if !strings.Contains(validationErr.Error(), "limit") {
-		t.Fatalf("error = %v, want size limit context", validationErr)
-	}
-}
-
-func TestAppsFileUpload_RejectsDeviceWithoutReadingIt(t *testing.T) {
-	if runtime.GOOS == "windows" {
-		t.Skip("/dev/zero is unavailable on Windows")
-	}
-	if _, err := os.Stat("/dev/zero"); err != nil {
-		t.Skipf("/dev/zero unavailable: %v", err)
-	}
-
-	factory, stdout, _ := newAppsExecuteFactory(t)
-	err := runAppsShortcut(t, AppsFileUpload,
-		[]string{"+file-upload", "--app-id", "app_x", "--file", "/dev/zero", "--as", "user"}, factory, stdout)
-	var validationErr *errs.ValidationError
-	if !errors.As(err, &validationErr) || validationErr.Param != "--file" {
-		t.Fatalf("error = %T %v, want --file ValidationError", err, err)
-	}
-	if !strings.Contains(validationErr.Error(), "regular file") {
-		t.Fatalf("error = %v, want non-regular-file context", validationErr)
-	}
-}
-
 // TestSanitizeUploadFileName_Cases 验证 sanitizeUploadFileName：空格转 %20、去 TOS 非法字符、全非法兜底、非 ASCII 百分号编码。
 func TestSanitizeUploadFileName_Cases(t *testing.T) {
 	cases := []struct{ in, want string }{

shortcuts/base/base_form_submit.go

@@ -26,7 +26,7 @@ var BaseFormSubmit = common.Shortcut{
 	Service:     "base",
 	Command:     "+form-submit",
 	Description: "Submit a form (fill and submit form data)",
-	Risk:        "high-risk-write",
+	Risk:        "write",
 	Scopes:      []string{"base:form:update", "docs:document.media:upload"},
 	AuthTypes:   authTypes(),
 	HasFormat:   true,
@@ -39,7 +39,6 @@ var BaseFormSubmit = common.Shortcut{
 		`Example (no attachments): --share-token shrXXXX --json '{"fields":{"Service Rating":5,"Review":"Good service"}}'`,
 		`Example (with attachments): --share-token shrXXXX --base-token basXXX --json '{"fields":{"Service Rating":5},"attachments":{"Attachment":["./report.pdf"]}}'`,
 		`Cell values in "fields" follow lark-base-cell-value.md conventions; "attachments" maps field names to local file path arrays — the CLI uploads them in parallel and merges them into the submission.`,
-		baseHighRiskYesTip,
 	},
 	Validate: func(ctx context.Context, runtime *common.RuntimeContext) error {
 		return validateFormSubmit(runtime)

shortcuts/base/base_shortcuts_test.go

@@ -2056,8 +2056,8 @@ func TestBaseFormSubmitShortcut(t *testing.T) {
 		if s.Service != "base" {
 			t.Fatalf("Service=%q want base", s.Service)
 		}
-		if s.Risk != "high-risk-write" {
-			t.Fatalf("Risk=%q want high-risk-write", s.Risk)
+		if s.Risk != "write" {
+			t.Fatalf("Risk=%q want write", s.Risk)
 		}
 		if !s.HasFormat {
 			t.Fatal("HasFormat should be true")
@@ -2357,7 +2357,6 @@ func TestExecuteFormSubmit(t *testing.T) {
 			"+form-submit",
 			"--share-token", "shr_exec1",
 			"--json", `{"fields":{"Name":"Alice","Rating":5}}`,
-			"--yes",
 		}
 		if err := runShortcut(t, BaseFormSubmit, args, factory, stdout); err != nil {
 			t.Fatalf("err=%v", err)
@@ -2426,7 +2425,6 @@ func TestExecuteFormSubmit(t *testing.T) {
 			"--share-token", "shr_exec6",
 			"--base-token", "bas_exec6",
 			"--json", `{"attachments":{"File":["./nonexistent.pdf"]}}`,
-			"--yes",
 		}
 		err := runShortcut(t, BaseFormSubmit, args, factory, stdout)
 		if err == nil {
@@ -2475,7 +2473,6 @@ func TestExecuteFormSubmit(t *testing.T) {
 			"--share-token", "shr_dedup",
 			"--base-token", "bas_dedup",
 			"--json", `{"attachments":{"FieldA":["./shared.pdf"],"FieldB":["./shared.pdf"]}}`,
-			"--yes",
 		}
 		if err := runShortcut(t, BaseFormSubmit, args, factory, stdout); err != nil {
 			t.Fatalf("err=%v", err)
@@ -2487,33 +2484,6 @@ func TestExecuteFormSubmit(t *testing.T) {
 	})
 }
 
-// TestFormSubmitRequiresConfirmation pins the high-risk-write classification:
-// without --yes the runner's confirmation gate must fire before Execute runs,
-// returning a typed confirmation_required error and touching no API.
-func TestFormSubmitRequiresConfirmation(t *testing.T) {
-	if BaseFormSubmit.Risk != "high-risk-write" {
-		t.Fatalf("Risk=%q want high-risk-write", BaseFormSubmit.Risk)
-	}
-
-	factory, stdout, _ := newExecuteFactory(t)
-	args := []string{
-		"+form-submit",
-		"--share-token", "shr_confirm",
-		"--json", `{"fields":{"Rating":5}}`,
-	}
-	err := runShortcut(t, BaseFormSubmit, args, factory, stdout)
-	if err == nil {
-		t.Fatal("expected confirmation_required error without --yes")
-	}
-	problem, ok := errs.ProblemOf(err)
-	if !ok {
-		t.Fatalf("expected typed error, got %T: %v", err, err)
-	}
-	if problem.Subtype != errs.SubtypeConfirmationRequired {
-		t.Fatalf("subtype=%q want %q", problem.Subtype, errs.SubtypeConfirmationRequired)
-	}
-}
-
 func TestUploadAttachmentsParallel(t *testing.T) {
 	t.Run("single file upload via execute path", func(t *testing.T) {
 		tmpDir := t.TempDir()
@@ -2550,7 +2520,6 @@ func TestUploadAttachmentsParallel(t *testing.T) {
 			"--share-token", "shr_para1",
 			"--base-token", "bas_para1",
 			"--json", `{"attachments":{"Doc":["./doc.txt"]}}`,
-			"--yes",
 		}
 		if err := runShortcut(t, BaseFormSubmit, args, factory, stdout); err != nil {
 			t.Fatalf("err=%v", err)
@@ -2585,7 +2554,6 @@ func TestUploadAttachmentsParallel(t *testing.T) {
 			"--share-token", "shr_err",
 			"--base-token", "bas_err",
 			"--json", `{"attachments":{"Bad":["./bad.txt"]}}`,
-			"--yes",
 		}
 		err := runShortcut(t, BaseFormSubmit, args, factory, stdout)
 		if err == nil {

shortcuts/calendar/calendar_agenda.go

@@ -250,8 +250,6 @@ var CalendarAgenda = common.Shortcut{
 					}
 				}
 
-				collapseDescription(e)
-
 				filtered = append(filtered, e)
 			}
 		}

shortcuts/calendar/calendar_create.go

@@ -20,6 +20,7 @@ import (
 func buildEventData(runtime *common.RuntimeContext, startTs, endTs string) map[string]interface{} {
 	eventData := map[string]interface{}{
 		"summary":          runtime.Str("summary"),
+		"description":      runtime.Str("description"),
 		"start_time":       map[string]string{"timestamp": startTs},
 		"end_time":         map[string]string{"timestamp": endTs},
 		"attendee_ability": "can_modify_event",
@@ -32,9 +33,6 @@ func buildEventData(runtime *common.RuntimeContext, startTs, endTs string) map[s
 	if rrule := runtime.Str("rrule"); rrule != "" {
 		eventData["recurrence"] = rrule
 	}
-	if description := descriptionToSend(runtime); description != "" {
-		eventData["description_rich"] = description
-	}
 	return eventData
 }
 
@@ -120,7 +118,7 @@ var CalendarCreate = common.Shortcut{
 		{Name: "summary", Desc: "event title"},
 		{Name: "start", Desc: "start time (ISO 8601)", Required: true},
 		{Name: "end", Desc: "end time (ISO 8601)", Required: true},
-		{Name: "description", Desc: "event description as Markdown (@file or - for stdin); the unified description field. Supports bold/italic/underline/strikethrough, links, headings (`#`..`###`), blockquotes (`>`), ordered/unordered lists, horizontal rules (`---`), GFM tables, and images (`![name](url)`; a remote URL is used as-is, and a local image path relative to and inside the current working directory is auto-uploaded to Lark drive and rendered inline — absolute/out-of-cwd paths are rejected). A Lark doc URL (bare or as a Markdown link) is auto-resolved to an inline doc-mention chip showing its title. Inside a GFM table cell, stack multiple lines with `<br>`; each line may itself be an ordered/unordered list item, image or styled text (e.g. `1. a<br>2. b`, `- x<br>- y`, `![p](url)<br>**bold**`).", Input: []string{common.File, common.Stdin}},
+		{Name: "description", Desc: "event description"},
 		{Name: "attendee-ids", Desc: "attendee IDs, comma-separated (supports user ou_, chat oc_, room omm_)"},
 		{Name: "calendar-id", Desc: "calendar ID (default: primary)"},
 		{Name: "rrule", Desc: "recurrence rule (rfc5545)"},
@@ -233,9 +231,6 @@ var CalendarCreate = common.Shortcut{
 		if err != nil {
 			return errs.NewValidationError(errs.SubtypeInvalidArgument, "--end: %v", err).WithParam("--end")
 		}
-		if err := resolveDescriptionImages(runtime, calendarId); err != nil {
-			return err
-		}
 
 		eventData := buildEventData(runtime, startTs, endTs)
 

shortcuts/calendar/calendar_get.go

@@ -81,7 +81,6 @@ type calendarEvent struct {
 	OrganizerCalendarID string                    `json:"organizer_calendar_id,omitempty"`
 	Summary             string                    `json:"summary,omitempty"`
 	Description         string                    `json:"description,omitempty"`
-	DescriptionRich     string                    `json:"description_rich,omitempty"`
 	StartTime           *calendarEventTime        `json:"start_time,omitempty"`
 	EndTime             *calendarEventTime        `json:"end_time,omitempty"`
 	VChat               *calendarEventVChat       `json:"vchat,omitempty"`
@@ -170,7 +169,7 @@ func buildCalendarEventOutput(event *calendarEvent) (map[string]interface{}, err
 	if status, _ := out["status"].(string); status != "cancelled" {
 		delete(out, "status")
 	}
-	collapseDescription(out)
+
 	return out, nil
 }
 

shortcuts/calendar/calendar_test.go

@@ -988,15 +988,9 @@ func TestUpdate_PatchEventOnly(t *testing.T) {
 	if err := json.Unmarshal(stub.CapturedBody, &body); err != nil {
 		t.Fatalf("unmarshal captured patch body: %v", err)
 	}
-	// --description is the unified field, treated as rich text and sent as
-	// description_rich; the CLI never sends the plain description field
-	// (mutually exclusive downstream).
-	if body["summary"] != "Updated Meeting" || body["description_rich"] != "Updated description" {
+	if body["summary"] != "Updated Meeting" || body["description"] != "Updated description" {
 		t.Fatalf("unexpected patch body: %#v", body)
 	}
-	if _, ok := body["description"]; ok {
-		t.Fatalf("plain description must not be sent, got: %#v", body)
-	}
 	if body["need_notification"] != false {
 		t.Fatalf("need_notification = %#v, want false", body["need_notification"])
 	}
@@ -1370,62 +1364,6 @@ func TestAgenda_Success(t *testing.T) {
 	}
 }
 
-func TestAgenda_UnifiesDescriptionRich(t *testing.T) {
-	f, stdout, _, reg := cmdutil.TestFactory(t, defaultConfig())
-
-	reg.Register(&httpmock.Stub{
-		Method: "GET",
-		URL:    "/events/instance_view",
-		Body: map[string]interface{}{
-			"code": 0, "msg": "ok",
-			"data": map[string]interface{}{
-				"items": []interface{}{
-					map[string]interface{}{
-						"event_id":         "evt_rich",
-						"summary":          "Rich",
-						"status":           "confirmed",
-						"description":      "[测试]\n友情提醒",
-						"description_rich": "友情提醒",
-						"start_time":       map[string]interface{}{"timestamp": "1742515200"},
-						"end_time":         map[string]interface{}{"timestamp": "1742518800"},
-					},
-					map[string]interface{}{
-						"event_id":    "evt_plain",
-						"summary":     "Plain",
-						"status":      "confirmed",
-						"description": "just text",
-						"start_time":  map[string]interface{}{"timestamp": "1742515200"},
-						"end_time":    map[string]interface{}{"timestamp": "1742518800"},
-					},
-				},
-			},
-		},
-	})
-
-	err := mountAndRun(t, CalendarAgenda, []string{
-		"+agenda",
-		"--start", "2025-03-21",
-		"--end", "2025-03-21",
-		"--as", "bot",
-	}, f, stdout)
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	out := stdout.String()
-	// Read exposes a single unified description field: it carries the rich
-	// (Markdown) value when present, and the plain text otherwise. The internal
-	// description_rich key is never surfaced.
-	if !strings.Contains(out, "\"description\": \"友情提醒\"") {
-		t.Errorf("expected rich value surfaced under description, got: %s", out)
-	}
-	if !strings.Contains(out, "\"description\": \"just text\"") {
-		t.Errorf("expected plain description surfaced for plain-only event, got: %s", out)
-	}
-	if strings.Contains(out, "description_rich") {
-		t.Errorf("description_rich must not appear in output, got: %s", out)
-	}
-}
-
 func TestAgenda_EmptyResult(t *testing.T) {
 	f, stdout, _, reg := cmdutil.TestFactory(t, defaultConfig())
 
@@ -3437,72 +3375,6 @@ func TestGet_Success_FlattensAndConvertsTimes(t *testing.T) {
 	}
 }
 
-func TestGet_UnifiesDescriptionRich(t *testing.T) {
-	// Read exposes a single unified description field carrying the rich value
-	// when present, and the plain text otherwise; description_rich is dropped.
-	t.Run("rich present", func(t *testing.T) {
-		f, stdout, _, reg := cmdutil.TestFactory(t, defaultConfig())
-		reg.Register(&httpmock.Stub{
-			Method: "GET",
-			URL:    "/open-apis/calendar/v4/calendars/cal_test123/events/evt_rich",
-			Body: map[string]interface{}{
-				"code": 0, "msg": "success",
-				"data": map[string]interface{}{
-					"event": map[string]interface{}{
-						"event_id":         "evt_rich",
-						"summary":          "Rich",
-						"description":      "[表格]",
-						"description_rich": "| a | b |\n| --- | --- |\n| c | d |",
-						"start_time":       map[string]interface{}{"timestamp": "1742515200", "timezone": "Asia/Shanghai"},
-						"end_time":         map[string]interface{}{"timestamp": "1742518800", "timezone": "Asia/Shanghai"},
-					},
-				},
-			},
-		})
-		if err := mountAndRun(t, CalendarGet, []string{"+get", "--calendar-id", "cal_test123", "--event-id", "evt_rich", "--as", "bot"}, f, stdout); err != nil {
-			t.Fatalf("unexpected error: %v", err)
-		}
-		out := stdout.String()
-		if !strings.Contains(out, "| a | b |") {
-			t.Errorf("expected rich value surfaced under description, got: %s", out)
-		}
-		if strings.Contains(out, "description_rich") {
-			t.Errorf("description_rich must not appear in output, got: %s", out)
-		}
-	})
-
-	// When only a plain description exists, it is surfaced under description.
-	t.Run("only plain surfaces under description", func(t *testing.T) {
-		f, stdout, _, reg := cmdutil.TestFactory(t, defaultConfig())
-		reg.Register(&httpmock.Stub{
-			Method: "GET",
-			URL:    "/open-apis/calendar/v4/calendars/cal_test123/events/evt_plain",
-			Body: map[string]interface{}{
-				"code": 0, "msg": "success",
-				"data": map[string]interface{}{
-					"event": map[string]interface{}{
-						"event_id":    "evt_plain",
-						"summary":     "Plain",
-						"description": "just text",
-						"start_time":  map[string]interface{}{"timestamp": "1742515200", "timezone": "Asia/Shanghai"},
-						"end_time":    map[string]interface{}{"timestamp": "1742518800", "timezone": "Asia/Shanghai"},
-					},
-				},
-			},
-		})
-		if err := mountAndRun(t, CalendarGet, []string{"+get", "--calendar-id", "cal_test123", "--event-id", "evt_plain", "--as", "bot"}, f, stdout); err != nil {
-			t.Fatalf("unexpected error: %v", err)
-		}
-		out := stdout.String()
-		if !strings.Contains(out, "\"description\": \"just text\"") {
-			t.Errorf("expected plain description surfaced, got: %s", out)
-		}
-		if strings.Contains(out, "description_rich") {
-			t.Errorf("description_rich must not appear in output, got: %s", out)
-		}
-	})
-}
-
 func TestGet_CancelledStatus_PreservesStatus(t *testing.T) {
 	f, stdout, _, reg := cmdutil.TestFactory(t, defaultConfig())
 

shortcuts/calendar/calendar_update.go

@@ -29,7 +29,7 @@ var CalendarUpdate = common.Shortcut{
 		{Name: "event-id", Desc: "event ID to update", Required: true},
 		{Name: "calendar-id", Desc: "calendar ID (default: primary)"},
 		{Name: "summary", Desc: "event title"},
-		{Name: "description", Desc: "event description as Markdown (@file or - for stdin); the unified description field. Supports bold/italic/underline/strikethrough, links, headings (`#`..`###`), blockquotes (`>`), ordered/unordered lists, horizontal rules (`---`), GFM tables, and images (`![name](url)`; a remote URL is used as-is, and a local image path relative to and inside the current working directory is auto-uploaded to Lark drive and rendered inline — absolute/out-of-cwd paths are rejected). A Lark doc URL (bare or as a Markdown link) is auto-resolved to an inline doc-mention chip showing its title. Inside a GFM table cell, stack multiple lines with `<br>`; each line may itself be an ordered/unordered list item, image or styled text (e.g. `1. a<br>2. b`, `- x<br>- y`, `![p](url)<br>**bold**`). Passing an empty string clears the description.", Input: []string{common.File, common.Stdin}},
+		{Name: "description", Desc: "event description"},
 		{Name: "start", Desc: "new start time (ISO 8601); requires --end"},
 		{Name: "end", Desc: "new end time (ISO 8601); requires --start"},
 		{Name: "rrule", Desc: "recurrence rule (rfc5545)"},
@@ -109,13 +109,11 @@ func buildCalendarUpdateEventData(runtime *common.RuntimeContext) (map[string]in
 	body := map[string]interface{}{}
 	hasFields := false
 
-	if runtime.Cmd.Flags().Changed("summary") {
-		body["summary"] = runtime.Str("summary")
-		hasFields = true
-	}
-	if runtime.Cmd.Flags().Changed("description") {
-		body["description_rich"] = runtime.Str("description")
-		hasFields = true
+	for _, field := range []string{"summary", "description"} {
+		if runtime.Cmd.Flags().Changed(field) {
+			body[field] = runtime.Str(field)
+			hasFields = true
+		}
 	}
 	if runtime.Cmd.Flags().Changed("rrule") {
 		rrule := strings.TrimSpace(runtime.Str("rrule"))
@@ -358,12 +356,6 @@ func executeCalendarUpdate(ctx context.Context, runtime *common.RuntimeContext)
 		return errs.NewValidationError(errs.SubtypeInvalidArgument, "specify --event-id").WithParam("--event-id")
 	}
 
-	if runtime.Cmd.Flags().Changed("description") {
-		if err := resolveDescriptionImages(runtime, calendarID); err != nil {
-			return err
-		}
-	}
-
 	body, hasEventFields, err := buildCalendarUpdateEventData(runtime)
 	if err != nil {
 		return err
@@ -436,10 +428,8 @@ func calendarUpdateResult(eventID string, event map[string]interface{}, addedCou
 	if summary, _ := event["summary"].(string); summary != "" {
 		result["summary"] = summary
 	}
-	if rich, _ := event["description_rich"].(string); rich != "" {
-		result["description"] = rich
-	} else if plain, _ := event["description"].(string); plain != "" {
-		result["description"] = plain
+	if description, _ := event["description"].(string); description != "" {
+		result["description"] = description
 	}
 	if start := formatCalendarEventTime(event["start_time"]); start != "" {
 		result["start"] = start

shortcuts/calendar/description_rich_images.go

@@ -1,172 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package calendar
-
-import (
-	"fmt"
-	"image"
-
-	// Register the common image decoders so DecodeConfig can read intrinsic
-	// dimensions for PNG/JPEG/GIF sources.
-	_ "image/gif"
-	_ "image/jpeg"
-	_ "image/png"
-	"net/url"
-	"path/filepath"
-	"regexp"
-	"strings"
-
-	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/core"
-	"github.com/larksuite/cli/internal/validate"
-	"github.com/larksuite/cli/shortcuts/common"
-)
-
-const calendarMediaParentType = "calendar"
-
-var markdownImageRe = regexp.MustCompile(`!\[([^\]]*)\]\(([^)]*)\)`)
-
-func resolveDescriptionImages(runtime *common.RuntimeContext, calendarID string) error {
-	md := runtime.Str("description")
-	if md == "" || !strings.Contains(md, "![") {
-		return nil
-	}
-	rewritten, changed, err := uploadLocalDescriptionImages(runtime, calendarID, md)
-	if err != nil {
-		return err
-	}
-	if changed {
-		if err := runtime.Cmd.Flags().Set("description", rewritten); err != nil {
-			return errs.NewInternalError(errs.SubtypeUnknown, "failed to update --description after image upload: %v", err).WithCause(err)
-		}
-	}
-	return nil
-}
-
-func uploadLocalDescriptionImages(runtime *common.RuntimeContext, calendarID, md string) (string, bool, error) {
-	matches := markdownImageRe.FindAllStringSubmatchIndex(md, -1)
-	if len(matches) == 0 {
-		return md, false, nil
-	}
-	var out strings.Builder
-	last := 0
-	changed := false
-	cache := map[string]string{}
-	for _, m := range matches {
-		altStart, altEnd, srcStart, srcEnd := m[2], m[3], m[4], m[5]
-		src := strings.TrimSpace(md[srcStart:srcEnd])
-		if !isLocalImageSrc(src) {
-			continue
-		}
-		alt := md[altStart:altEnd]
-		uploadedURL, err := resolveLocalImage(runtime, calendarID, src, alt, cache)
-		if err != nil {
-			return "", false, err
-		}
-		out.WriteString(md[last:srcStart])
-		out.WriteString(uploadedURL)
-		last = srcEnd
-		changed = true
-	}
-	if !changed {
-		return md, false, nil
-	}
-	out.WriteString(md[last:])
-	return out.String(), true, nil
-}
-
-func resolveLocalImage(runtime *common.RuntimeContext, calendarID, src, alt string, cache map[string]string) (string, error) {
-	localPath := localImagePath(src)
-	if cached, ok := cache[localPath]; ok {
-		return cached, nil
-	}
-
-	safePath, err := validate.SafeInputPath(localPath)
-	if err != nil {
-		return "", errs.NewValidationError(errs.SubtypeInvalidArgument,
-			"--description image %q could not be read: %v", src, err).
-			WithParam("--description").
-			WithHint("reference local images by a path inside the current working directory (e.g. ./images/pic.png; cd there first), or use an already-uploaded Lark image URL").
-			WithCause(err)
-	}
-
-	info, err := runtime.FileIO().Stat(localPath)
-	if err != nil {
-		return "", common.WrapInputStatErrorTyped(err)
-	}
-
-	fileToken, err := common.UploadDriveMediaAllTyped(runtime, common.DriveMediaUploadAllConfig{
-		FilePath:   localPath,
-		FileName:   filepath.Base(safePath),
-		FileSize:   info.Size(),
-		ParentType: calendarMediaParentType,
-		ParentNode: &calendarID,
-	})
-	if err != nil {
-		return "", err
-	}
-
-	width, height := decodeImageDimensions(runtime, localPath)
-	uploadedURL := buildCalendarImagePreviewURL(runtime.Config.Brand, fileToken, width, height, info.Size())
-	cache[localPath] = uploadedURL
-	return uploadedURL, nil
-}
-
-func decodeImageDimensions(runtime *common.RuntimeContext, path string) (int, int) {
-	f, err := runtime.FileIO().Open(path)
-	if err != nil {
-		return 0, 0
-	}
-	defer f.Close()
-	cfg, _, err := image.DecodeConfig(f)
-	if err != nil {
-		return 0, 0
-	}
-	return cfg.Width, cfg.Height
-}
-
-func isLocalImageSrc(src string) bool {
-	if src == "" {
-		return false
-	}
-	lower := strings.ToLower(src)
-	switch {
-	case strings.HasPrefix(lower, "http://"), strings.HasPrefix(lower, "https://"), strings.HasPrefix(lower, "data:"):
-		return false
-	case strings.HasPrefix(lower, "file://"):
-		return true
-	}
-	if i := strings.Index(src, "://"); i > 0 {
-		return false
-	}
-	return true
-}
-
-func localImagePath(src string) string {
-	s := strings.TrimSpace(src)
-	if strings.HasPrefix(strings.ToLower(s), "file://") {
-		if u, err := url.Parse(s); err == nil && u.Path != "" {
-			s = u.Path
-		}
-	}
-	if decoded, err := url.PathUnescape(s); err == nil {
-		return decoded
-	}
-	return s
-}
-
-func buildCalendarImagePreviewURL(brand core.LarkBrand, fileToken string, width, height int, size int64) string {
-	host := "internal-api-drive-stream.feishu.cn"
-	if brand == core.BrandLark {
-		host = "internal-api-drive-stream.larksuite.com"
-	}
-	u := fmt.Sprintf("https://%s/space/api/box/stream/download/preview/%s?preview_type=16", host, fileToken)
-	if width > 0 && height > 0 {
-		u += fmt.Sprintf("&im_w=%d&im_h=%d", width, height)
-	}
-	if size > 0 {
-		u += fmt.Sprintf("&im_size=%d", size)
-	}
-	return u
-}

shortcuts/calendar/description_rich_images_test.go

@@ -1,279 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package calendar
-
-import (
-	"bytes"
-	"encoding/json"
-	"errors"
-	"image"
-	"image/png"
-	"net/url"
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-
-	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
-	"github.com/larksuite/cli/internal/httpmock"
-)
-
-func TestIsLocalImageSrc(t *testing.T) {
-	cases := []struct {
-		src  string
-		want bool
-	}{
-		{"./images/pic.png", true},
-		{"images/pic.png", true},
-		{"../assets/a.png", true},
-		{"/Users/me/Desktop/a.png", true},
-		{`C:\Users\me\a.png`, true},
-		{"file:///Users/me/a.png", true},
-		{"图片和附件/测试图片.png", true},
-		{"https://example.com/a.png", false},
-		{"http://example.com/a.png", false},
-		{"HTTPS://EXAMPLE.com/a.png", false},
-		{"data:image/png;base64,iVBOR", false},
-		{"ftp://host/a.png", false},
-		{"", false},
-	}
-	for _, c := range cases {
-		if got := isLocalImageSrc(c.src); got != c.want {
-			t.Errorf("isLocalImageSrc(%q) = %v, want %v", c.src, got, c.want)
-		}
-	}
-}
-
-func TestLocalImagePath(t *testing.T) {
-	cases := []struct{ in, want string }{
-		{"images/pic.png", "images/pic.png"},
-		{"images/my%20pic.png", "images/my pic.png"},
-		{"file:///Users/me/a.png", "/Users/me/a.png"},
-	}
-	for _, c := range cases {
-		if got := localImagePath(c.in); got != c.want {
-			t.Errorf("localImagePath(%q) = %q, want %q", c.in, got, c.want)
-		}
-	}
-}
-
-// TestBuildCalendarImagePreviewURL guards the contract the OpenAPI service
-// relies on: a Lark host (so token extraction triggers) whose final path
-// segment is exactly the uploaded file token.
-func TestBuildCalendarImagePreviewURL(t *testing.T) {
-	for _, tc := range []struct {
-		brand    core.LarkBrand
-		hostFrag string
-	}{
-		{core.BrandFeishu, "feishu.cn"},
-		{core.BrandLark, "larksuite"},
-	} {
-		raw := buildCalendarImagePreviewURL(tc.brand, "boxcnTOKEN123", 416, 306, 142568)
-		u, err := url.Parse(raw)
-		if err != nil {
-			t.Fatalf("built URL not parseable: %v", err)
-		}
-		if !strings.Contains(u.Host, tc.hostFrag) {
-			t.Errorf("brand %s host = %q, want fragment %q", tc.brand, u.Host, tc.hostFrag)
-		}
-		segs := strings.Split(strings.Trim(u.Path, "/"), "/")
-		if last := segs[len(segs)-1]; last != "boxcnTOKEN123" {
-			t.Errorf("last path segment = %q, want token", last)
-		}
-		q := u.Query()
-		if q.Get("im_w") != "416" || q.Get("im_h") != "306" || q.Get("im_size") != "142568" {
-			t.Errorf("dimension params missing: im_w=%q im_h=%q im_size=%q", q.Get("im_w"), q.Get("im_h"), q.Get("im_size"))
-		}
-	}
-
-	// With unknown dimensions the helper params are omitted entirely.
-	raw := buildCalendarImagePreviewURL(core.BrandFeishu, "boxcnTOKEN123", 0, 0, 0)
-	if strings.Contains(raw, "im_w") || strings.Contains(raw, "im_size") {
-		t.Errorf("expected no dimension params for unknown size, got %q", raw)
-	}
-}
-
-// TestUploadLocalDescriptionImages_RemoteUntouched verifies remote/data images
-// pass through unchanged and never trigger an upload (runtime unused → nil).
-func TestUploadLocalDescriptionImages_RemoteUntouched(t *testing.T) {
-	md := "text ![a](https://example.com/a.png) more ![b](data:image/png;base64,xx)"
-	got, changed, err := uploadLocalDescriptionImages(nil, "cal", md)
-	if err != nil {
-		t.Fatalf("unexpected err: %v", err)
-	}
-	if changed {
-		t.Errorf("changed = true, want false")
-	}
-	if got != md {
-		t.Errorf("markdown mutated: %q", got)
-	}
-}
-
-// TestCreate_UploadsLocalDescriptionImage runs +create with a local image path,
-// mocks the drive upload, and asserts the create body's description_rich carries
-// the uploaded token (not the local path).
-func TestCreate_UploadsLocalDescriptionImage(t *testing.T) {
-	dir := t.TempDir()
-	orig, err := os.Getwd()
-	if err != nil {
-		t.Fatal(err)
-	}
-	if err := os.Chdir(dir); err != nil {
-		t.Fatal(err)
-	}
-	defer os.Chdir(orig)
-	if err := os.WriteFile(filepath.Join(dir, "pic.png"), []byte("PNGDATA"), 0600); err != nil {
-		t.Fatal(err)
-	}
-
-	f, stdout, _, reg := cmdutil.TestFactory(t, defaultConfig())
-
-	uploadStub := &httpmock.Stub{
-		Method: "POST",
-		URL:    "/open-apis/drive/v1/medias/upload_all",
-		Body:   map[string]interface{}{"code": 0, "msg": "ok", "data": map[string]interface{}{"file_token": "boxcnTOKEN123"}},
-	}
-	reg.Register(uploadStub)
-
-	createStub := &httpmock.Stub{
-		Method: "POST",
-		URL:    "/open-apis/calendar/v4/calendars/cal_test123/events",
-		Body: map[string]interface{}{"code": 0, "msg": "ok", "data": map[string]interface{}{
-			"event": map[string]interface{}{
-				"event_id":   "evt_001",
-				"summary":    "Pic",
-				"start_time": map[string]interface{}{"timestamp": "1742515200"},
-				"end_time":   map[string]interface{}{"timestamp": "1742518800"},
-			},
-		}},
-	}
-	reg.Register(createStub)
-
-	runErr := mountAndRun(t, CalendarCreate, []string{
-		"+create",
-		"--summary", "Pic",
-		"--start", "2025-03-21T00:00:00+08:00",
-		"--end", "2025-03-21T01:00:00+08:00",
-		"--calendar-id", "cal_test123",
-		"--description", "![pic](./pic.png)",
-		"--as", "bot",
-	}, f, stdout)
-	if runErr != nil {
-		t.Fatalf("unexpected error: %v", runErr)
-	}
-
-	if uploadStub.CapturedBody == nil {
-		t.Fatalf("expected drive upload to be called")
-	}
-	if createStub.CapturedBody == nil {
-		t.Fatalf("expected create event to be called")
-	}
-	var body map[string]interface{}
-	if err := json.Unmarshal(createStub.CapturedBody, &body); err != nil {
-		t.Fatalf("create body unmarshal: %v", err)
-	}
-	dr, _ := body["description_rich"].(string)
-	if !strings.Contains(dr, "boxcnTOKEN123") {
-		t.Fatalf("description_rich should contain uploaded token, got %q", dr)
-	}
-	if strings.Contains(dr, "./pic.png") {
-		t.Fatalf("local path should be rewritten away, got %q", dr)
-	}
-}
-
-// TestCreate_LocalImageCarriesDimensions verifies a real decodable image's
-// intrinsic width/height and byte size are appended to the rewritten drive URL
-// (so the facade can populate originalWidth/originalHeight and the client can
-// render the image inline).
-func TestCreate_LocalImageCarriesDimensions(t *testing.T) {
-	dir := t.TempDir()
-	orig, err := os.Getwd()
-	if err != nil {
-		t.Fatal(err)
-	}
-	if err := os.Chdir(dir); err != nil {
-		t.Fatal(err)
-	}
-	defer os.Chdir(orig)
-
-	var buf bytes.Buffer
-	if err := png.Encode(&buf, image.NewRGBA(image.Rect(0, 0, 5, 7))); err != nil {
-		t.Fatal(err)
-	}
-	if err := os.WriteFile(filepath.Join(dir, "pic.png"), buf.Bytes(), 0600); err != nil {
-		t.Fatal(err)
-	}
-
-	f, stdout, _, reg := cmdutil.TestFactory(t, defaultConfig())
-	reg.Register(&httpmock.Stub{
-		Method: "POST",
-		URL:    "/open-apis/drive/v1/medias/upload_all",
-		Body:   map[string]interface{}{"code": 0, "msg": "ok", "data": map[string]interface{}{"file_token": "boxcnTOKEN123"}},
-	})
-	createStub := &httpmock.Stub{
-		Method: "POST",
-		URL:    "/open-apis/calendar/v4/calendars/cal_test123/events",
-		Body: map[string]interface{}{"code": 0, "msg": "ok", "data": map[string]interface{}{
-			"event": map[string]interface{}{
-				"event_id":   "evt_001",
-				"summary":    "Pic",
-				"start_time": map[string]interface{}{"timestamp": "1742515200"},
-				"end_time":   map[string]interface{}{"timestamp": "1742518800"},
-			},
-		}},
-	}
-	reg.Register(createStub)
-
-	runErr := mountAndRun(t, CalendarCreate, []string{
-		"+create",
-		"--summary", "Pic",
-		"--start", "2025-03-21T00:00:00+08:00",
-		"--end", "2025-03-21T01:00:00+08:00",
-		"--calendar-id", "cal_test123",
-		"--description", "![pic](./pic.png)",
-		"--as", "bot",
-	}, f, stdout)
-	if runErr != nil {
-		t.Fatalf("unexpected error: %v", runErr)
-	}
-	var body map[string]interface{}
-	if err := json.Unmarshal(createStub.CapturedBody, &body); err != nil {
-		t.Fatalf("create body unmarshal: %v", err)
-	}
-	dr, _ := body["description_rich"].(string)
-	if !strings.Contains(dr, "im_w=5") || !strings.Contains(dr, "im_h=7") {
-		t.Fatalf("description_rich should carry image dimensions, got %q", dr)
-	}
-	if !strings.Contains(dr, "im_size=") {
-		t.Fatalf("description_rich should carry image byte size, got %q", dr)
-	}
-}
-
-// TestCreate_LocalImageAbsolutePathRejected verifies an out-of-cwd absolute path
-// yields a typed --description validation error before any API call.
-func TestCreate_LocalImageAbsolutePathRejected(t *testing.T) {
-	f, stdout, _, _ := cmdutil.TestFactory(t, defaultConfig())
-
-	runErr := mountAndRun(t, CalendarCreate, []string{
-		"+create",
-		"--summary", "Pic",
-		"--start", "2025-03-21T00:00:00+08:00",
-		"--end", "2025-03-21T01:00:00+08:00",
-		"--calendar-id", "cal_test123",
-		"--description", "![p](/etc/hosts)",
-		"--as", "bot",
-	}, f, stdout)
-	if runErr == nil {
-		t.Fatalf("expected error for absolute image path")
-	}
-	var ve *errs.ValidationError
-	if !errors.As(runErr, &ve) {
-		t.Fatalf("expected *errs.ValidationError, got %T: %v", runErr, runErr)
-	}
-	if ve.Param != "--description" {
-		t.Errorf("param = %q, want --description", ve.Param)
-	}
-}

shortcuts/calendar/helpers.go

@@ -30,26 +30,6 @@ func resolveStartEnd(runtime *common.RuntimeContext) (string, string) {
 	return startInput, endInput
 }
 
-func collapseDescription(event map[string]interface{}) {
-	if event == nil {
-		return
-	}
-	rich, _ := event["description_rich"].(string)
-	plain, _ := event["description"].(string)
-	delete(event, "description_rich")
-	switch {
-	case rich != "":
-		event["description"] = rich
-	case plain != "":
-		event["description"] = plain
-	default:
-		delete(event, "description")
-	}
-}
-func descriptionToSend(runtime *common.RuntimeContext) string {
-	return runtime.Str("description")
-}
-
 func hasExplicitBotFlag(cmd *cobra.Command) bool {
 	if cmd == nil {
 		return false

shortcuts/common/call_api_typed_test.go

@@ -288,18 +288,3 @@ func TestDoAPIJSONTyped_NonZeroCode(t *testing.T) {
 		t.Errorf("LogID = %q, want lz", p.LogID)
 	}
 }
-
-func TestRuntimeContextMarkFileEventReported(t *testing.T) {
-	rt := &RuntimeContext{}
-	if !rt.MarkFileEventReported() {
-		t.Fatal("first mark should report")
-	}
-	if rt.MarkFileEventReported() {
-		t.Fatal("second mark should be skipped")
-	}
-
-	var nilRT *RuntimeContext
-	if nilRT.MarkFileEventReported() {
-		t.Fatal("nil receiver should not report")
-	}
-}

shortcuts/common/drive_media_upload.go

@@ -23,13 +23,6 @@ const (
 	driveMediaUploadFinishAction = "upload media finish failed"
 )
 
-const (
-	driveMediaUploadAllPath     = "/open-apis/drive/v1/medias/upload_all"
-	driveMediaUploadPreparePath = "/open-apis/drive/v1/medias/upload_prepare"
-	driveMediaUploadPartPath    = "/open-apis/drive/v1/medias/upload_part"
-	driveMediaUploadFinishPath  = "/open-apis/drive/v1/medias/upload_finish"
-)
-
 type DriveMediaMultipartUploadSession struct {
 	UploadID  string
 	BlockSize int64
@@ -90,33 +83,20 @@ func UploadDriveMediaAllTyped(runtime *RuntimeContext, cfg DriveMediaUploadAllCo
 	}
 	fd.AddFile("file", fileReader)
 
-	meta := LarkCLIFileEventMeta{
-		APIPath:      driveMediaUploadAllPath,
-		UploadMode:   "singlepart",
-		ResourceType: "media",
-		ParentType:   cfg.ParentType,
-	}
-
 	apiResp, err := runtime.DoAPI(&larkcore.ApiReq{
 		HttpMethod: http.MethodPost,
-		ApiPath:    driveMediaUploadAllPath,
+		ApiPath:    "/open-apis/drive/v1/medias/upload_all",
 		Body:       fd,
 	}, larkcore.WithFileUpload())
 	if err != nil {
-		return "", ReportUploadFileEventOnError(runtime, prefixDriveMediaUploadProblem(client.WrapDoAPIError(err), driveMediaUploadAllAction), meta)
+		return "", prefixDriveMediaUploadProblem(client.WrapDoAPIError(err), driveMediaUploadAllAction)
 	}
 
 	data, err := runtime.ClassifyAPIResponse(apiResp)
 	if err != nil {
-		return "", ReportUploadFileEventOnError(runtime, prefixDriveMediaUploadProblem(err, driveMediaUploadAllAction), meta)
+		return "", prefixDriveMediaUploadProblem(err, driveMediaUploadAllAction)
 	}
-	fileToken, err := extractDriveMediaUploadFileTokenTyped(data, driveMediaUploadAllAction)
-	if err != nil {
-		return "", ReportUploadFileEventOnError(runtime, err, meta)
-	}
-	meta.FileToken = fileToken
-	ReportUploadFileEvent(runtime, meta)
-	return fileToken, nil
+	return extractDriveMediaUploadFileTokenTyped(data, driveMediaUploadAllAction)
 }
 
 // UploadDriveMediaMultipartTyped uploads a file in server-planned chunks:
@@ -138,37 +118,22 @@ func UploadDriveMediaMultipartTyped(runtime *RuntimeContext, cfg DriveMediaMulti
 		prepareBody["extra"] = cfg.Extra
 	}
 
-	meta := LarkCLIFileEventMeta{
-		APIPath:      driveMediaUploadPreparePath,
-		UploadMode:   "multipart",
-		ResourceType: "media",
-		ParentType:   cfg.ParentType,
-	}
-
-	data, err := runtime.CallAPITyped("POST", driveMediaUploadPreparePath, nil, prepareBody)
+	data, err := runtime.CallAPITyped("POST", "/open-apis/drive/v1/medias/upload_prepare", nil, prepareBody)
 	if err != nil {
-		return "", ReportUploadFileEventOnError(runtime, err, meta)
+		return "", err
 	}
 
 	session, err := parseDriveMediaMultipartUploadSessionTyped(data)
 	if err != nil {
-		return "", ReportUploadFileEventOnError(runtime, err, meta)
+		return "", err
 	}
 	fmt.Fprintf(runtime.IO().ErrOut, "Multipart upload initialized: %d chunks x %s\n", session.BlockNum, FormatSize(session.BlockSize))
 
-	meta.APIPath = driveMediaUploadPartPath
 	if err = uploadDriveMediaMultipartPartsTyped(runtime, cfg, session); err != nil {
-		return "", ReportUploadFileEventOnError(runtime, err, meta)
+		return "", err
 	}
 
-	meta.APIPath = driveMediaUploadFinishPath
-	fileToken, err := finishDriveMediaMultipartUploadTyped(runtime, session.UploadID, session.BlockNum)
-	if err != nil {
-		return "", ReportUploadFileEventOnError(runtime, err, meta)
-	}
-	meta.FileToken = fileToken
-	ReportUploadFileEvent(runtime, meta)
-	return fileToken, nil
+	return finishDriveMediaMultipartUploadTyped(runtime, session.UploadID, session.BlockNum)
 }
 
 // prefixDriveMediaUploadProblem prepends the upload action to a typed error's
@@ -270,7 +235,7 @@ func uploadDriveMediaMultipartPartTyped(runtime *RuntimeContext, uploadID string
 
 	apiResp, err := runtime.DoAPI(&larkcore.ApiReq{
 		HttpMethod: http.MethodPost,
-		ApiPath:    driveMediaUploadPartPath,
+		ApiPath:    "/open-apis/drive/v1/medias/upload_part",
 		Body:       fd,
 	}, larkcore.WithFileUpload())
 	if err != nil {
@@ -284,7 +249,7 @@ func uploadDriveMediaMultipartPartTyped(runtime *RuntimeContext, uploadID string
 }
 
 func finishDriveMediaMultipartUploadTyped(runtime *RuntimeContext, uploadID string, blockNum int) (string, error) {
-	data, err := runtime.CallAPITyped("POST", driveMediaUploadFinishPath, nil, map[string]interface{}{
+	data, err := runtime.CallAPITyped("POST", "/open-apis/drive/v1/medias/upload_finish", nil, map[string]interface{}{
 		"upload_id": uploadID,
 		"block_num": blockNum,
 	})

shortcuts/common/drive_media_upload_typed_test.go

@@ -304,274 +304,3 @@ func TestUploadDriveMediaMultipartTypedFinishRequiresFileToken(t *testing.T) {
 		t.Fatalf("message = %q", p.Message)
 	}
 }
-
-// registerDriveMediaReportStub registers a successful report_file_event stub.
-func registerDriveMediaReportStub(t *testing.T, reg *httpmock.Registry) *httpmock.Stub {
-	t.Helper()
-	return registerDriveMediaReportStubWithMsg(t, reg, "")
-}
-
-// registerDriveMediaReportStubWithMsg registers a report_file_event stub that
-// returns code 0 and, when msg is non-empty, carries it as the top-level msg
-// (the capacity-expansion URL for tenant-capacity-exceeded uploads).
-func registerDriveMediaReportStubWithMsg(t *testing.T, reg *httpmock.Registry, msg string) *httpmock.Stub {
-	t.Helper()
-	body := map[string]interface{}{"code": 0, "data": map[string]interface{}{}}
-	if msg != "" {
-		body["msg"] = msg
-	}
-	stub := &httpmock.Stub{
-		Method:   "POST",
-		URL:      larkCLIReportFileEventPath,
-		Body:     body,
-		Reusable: true,
-	}
-	reg.Register(stub)
-	return stub
-}
-
-// assertSingleReport verifies one upload report with the expected status and
-// returns its decoded tags for additional assertions.
-func assertSingleReport(t *testing.T, reportStub *httpmock.Stub, wantStatus string) map[string]interface{} {
-	t.Helper()
-	if len(reportStub.CapturedBodies) != 1 {
-		t.Fatalf("report call count = %d, want 1", len(reportStub.CapturedBodies))
-	}
-	body := decodeCapturedDriveMediaJSONBody(t, reportStub)
-	assertReportEnvelope(t, body)
-	if _, ok := body["user_id"]; ok {
-		t.Fatalf("user_id must be omitted, got %v", body["user_id"])
-	}
-	if _, ok := body["tenant_id"]; ok {
-		t.Fatalf("tenant_id must be omitted, got %v", body["tenant_id"])
-	}
-	tags := assertTagsObject(t, body)
-	if got := tags["status"]; got != wantStatus {
-		t.Fatalf("tags.status = %v, want %s", got, wantStatus)
-	}
-	return tags
-}
-
-func TestUploadDriveMediaAllTypedReportsFileEventOnSuccess(t *testing.T) {
-	runtime, reg := newDriveMediaUploadTestRuntime(t)
-	withDriveMediaUploadWorkingDir(t, t.TempDir())
-	reportStub := registerDriveMediaReportStub(t, reg)
-
-	reg.Register(&httpmock.Stub{
-		Method: "POST",
-		URL:    "/open-apis/drive/v1/medias/upload_all",
-		Body: map[string]interface{}{
-			"code": 0,
-			"data": map[string]interface{}{"file_token": "file_ok"},
-		},
-	})
-
-	payload := []byte{0x89, 0x50}
-	fileToken, err := UploadDriveMediaAllTyped(runtime, DriveMediaUploadAllConfig{
-		Reader:     bytes.NewReader(payload),
-		FileName:   "clipboard.png",
-		FileSize:   int64(len(payload)),
-		ParentType: "docx_image",
-		ParentNode: strPtr("blk_parent"),
-	})
-	if err != nil {
-		t.Fatalf("UploadDriveMediaAllTyped() error: %v", err)
-	}
-	if fileToken != "file_ok" {
-		t.Fatalf("fileToken = %q, want file_ok", fileToken)
-	}
-
-	tags := assertSingleReport(t, reportStub, uploadFileEventStatusSuccess)
-	if got := tags["api_path"]; got != "/open-apis/drive/v1/medias/upload_all" {
-		t.Fatalf("tags.api_path = %v", got)
-	}
-	if got := tags["upload_mode"]; got != "singlepart" {
-		t.Fatalf("tags.upload_mode = %v, want singlepart", got)
-	}
-	if got := tags["resource_type"]; got != "media" {
-		t.Fatalf("tags.resource_type = %v, want media", got)
-	}
-	if got := tags["mount_point"]; got != "docx_image" {
-		t.Fatalf("tags.mount_point = %v, want docx_image", got)
-	}
-	if got := tags["file_token"]; got != "file_ok" {
-		t.Fatalf("tags.file_token = %v, want file_ok", got)
-	}
-}
-
-func TestUploadDriveMediaAllTypedReportsFileEventOnError(t *testing.T) {
-	runtime, reg := newDriveMediaUploadTestRuntime(t)
-	withDriveMediaUploadWorkingDir(t, t.TempDir())
-	reportStub := registerDriveMediaReportStub(t, reg)
-
-	reg.Register(&httpmock.Stub{
-		Method: "POST",
-		URL:    "/open-apis/drive/v1/medias/upload_all",
-		Body:   map[string]interface{}{"code": 999, "msg": "upload rejected"},
-	})
-
-	payload := []byte{0x01}
-	_, err := UploadDriveMediaAllTyped(runtime, DriveMediaUploadAllConfig{
-		Reader:     bytes.NewReader(payload),
-		FileName:   "clipboard.png",
-		FileSize:   int64(len(payload)),
-		ParentType: "docx_image",
-		ParentNode: strPtr("blk_parent"),
-	})
-	if err == nil {
-		t.Fatal("expected error, got nil")
-	}
-	p, ok := errs.ProblemOf(err)
-	if !ok || p.Code != 999 {
-		t.Fatalf("expected typed api error code 999, got %T (%v)", err, err)
-	}
-
-	tags := assertSingleReport(t, reportStub, uploadFileEventStatusError)
-	if got := tags["code"]; got != "999" {
-		t.Fatalf("tags.code = %v, want 999", got)
-	}
-}
-
-func TestUploadDriveMediaAllTypedReportFailureKeepsUploadError(t *testing.T) {
-	runtime, reg := newDriveMediaUploadTestRuntime(t)
-	withDriveMediaUploadWorkingDir(t, t.TempDir())
-	reg.Register(&httpmock.Stub{
-		Method:   "POST",
-		URL:      larkCLIReportFileEventPath,
-		Body:     map[string]interface{}{"code": 500, "msg": "report rejected"},
-		Reusable: true,
-	})
-	reg.Register(&httpmock.Stub{
-		Method: "POST",
-		URL:    "/open-apis/drive/v1/medias/upload_all",
-		Body:   map[string]interface{}{"code": 1061101, "msg": "tenant capacity exceeded"},
-	})
-
-	payload := []byte{0x01}
-	_, err := UploadDriveMediaAllTyped(runtime, DriveMediaUploadAllConfig{
-		Reader:     bytes.NewReader(payload),
-		FileName:   "clipboard.png",
-		FileSize:   int64(len(payload)),
-		ParentType: "docx_image",
-		ParentNode: strPtr("blk_parent"),
-	})
-	if err == nil {
-		t.Fatal("expected error, got nil")
-	}
-	p, ok := errs.ProblemOf(err)
-	if !ok {
-		t.Fatalf("expected typed problem, got %T (%v)", err, err)
-	}
-	if p.Code != 1061101 {
-		t.Fatalf("code = %d, want original 1061101", p.Code)
-	}
-	// The report failed (code 500), so no capacity-expansion URL is available.
-	// Keep the quota hint produced by API error classification unchanged.
-	const wantHint = "reduce the request volume or free quota, then retry after the relevant quota resets"
-	if p.Hint != wantHint {
-		t.Fatalf("hint = %q, want original classified hint %q", p.Hint, wantHint)
-	}
-}
-
-func TestUploadDriveMediaMultipartTypedReportsFileEventOnPrepareError(t *testing.T) {
-	runtime, reg := newDriveMediaUploadTestRuntime(t)
-	withDriveMediaUploadWorkingDir(t, t.TempDir())
-	reportStub := registerDriveMediaReportStubWithMsg(t, reg, testCapacityExpansionURL)
-
-	reg.Register(&httpmock.Stub{
-		Method: "POST",
-		URL:    "/open-apis/drive/v1/medias/upload_prepare",
-		Body:   map[string]interface{}{"code": 1061101, "msg": "tenant capacity exceeded"},
-	})
-
-	filePath := writeDriveMediaUploadSizedFile(t, "large.bin", MaxDriveMediaUploadSinglePartSize+1)
-	_, err := UploadDriveMediaMultipartTyped(runtime, DriveMediaMultipartUploadConfig{
-		FilePath:   filePath,
-		FileName:   "large.bin",
-		FileSize:   MaxDriveMediaUploadSinglePartSize + 1,
-		ParentType: "ccm_import_open",
-		ParentNode: "",
-	})
-	if err == nil {
-		t.Fatal("expected error, got nil")
-	}
-	p, ok := errs.ProblemOf(err)
-	if !ok || p.Code != 1061101 {
-		t.Fatalf("expected typed api error code 1061101, got %T (%v)", err, err)
-	}
-	if !strings.Contains(p.Hint, testCapacityExpansionURL) {
-		t.Fatalf("hint = %q, want capacity expansion URL", p.Hint)
-	}
-
-	tags := assertSingleReport(t, reportStub, uploadFileEventStatusError)
-	if got := tags["upload_mode"]; got != "multipart" {
-		t.Fatalf("tags.upload_mode = %v, want multipart", got)
-	}
-	if got := tags["api_path"]; got != "/open-apis/drive/v1/medias/upload_prepare" {
-		t.Fatalf("tags.api_path = %v, want upload_prepare", got)
-	}
-	if got := tags["code"]; got != "1061101" {
-		t.Fatalf("tags.code = %v, want 1061101", got)
-	}
-}
-
-func TestUploadDriveMediaMultipartTypedReportsFileEventOnSuccess(t *testing.T) {
-	runtime, reg := newDriveMediaUploadTestRuntime(t)
-	withDriveMediaUploadWorkingDir(t, t.TempDir())
-	reportStub := registerDriveMediaReportStub(t, reg)
-
-	size := MaxDriveMediaUploadSinglePartSize + 1
-	reg.Register(&httpmock.Stub{
-		Method: "POST",
-		URL:    "/open-apis/drive/v1/medias/upload_prepare",
-		Body: map[string]interface{}{
-			"code": 0,
-			"data": map[string]interface{}{
-				"upload_id":  "upload_ok",
-				"block_size": float64(4 * 1024 * 1024),
-				"block_num":  float64(6),
-			},
-		},
-	})
-	for i := 0; i < 6; i++ {
-		reg.Register(&httpmock.Stub{
-			Method: "POST",
-			URL:    "/open-apis/drive/v1/medias/upload_part",
-			Body:   map[string]interface{}{"code": 0, "msg": "ok"},
-		})
-	}
-	reg.Register(&httpmock.Stub{
-		Method: "POST",
-		URL:    "/open-apis/drive/v1/medias/upload_finish",
-		Body: map[string]interface{}{
-			"code": 0,
-			"data": map[string]interface{}{"file_token": "file_multi_ok"},
-		},
-	})
-
-	payload := bytes.Repeat([]byte{0xCD}, int(size))
-	fileToken, err := UploadDriveMediaMultipartTyped(runtime, DriveMediaMultipartUploadConfig{
-		Reader:     bytes.NewReader(payload),
-		FileName:   "clipboard.png",
-		FileSize:   size,
-		ParentType: "docx_image",
-		ParentNode: "",
-	})
-	if err != nil {
-		t.Fatalf("UploadDriveMediaMultipartTyped() error: %v", err)
-	}
-	if fileToken != "file_multi_ok" {
-		t.Fatalf("fileToken = %q, want file_multi_ok", fileToken)
-	}
-
-	tags := assertSingleReport(t, reportStub, uploadFileEventStatusSuccess)
-	if got := tags["upload_mode"]; got != "multipart" {
-		t.Fatalf("tags.upload_mode = %v, want multipart", got)
-	}
-	if got := tags["api_path"]; got != "/open-apis/drive/v1/medias/upload_finish" {
-		t.Fatalf("tags.api_path = %v, want upload_finish", got)
-	}
-	if got := tags["file_token"]; got != "file_multi_ok" {
-		t.Fatalf("tags.file_token = %v, want file_multi_ok", got)
-	}
-}

shortcuts/common/lark_cli_file_event.go

@@ -1,261 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package common
-
-import (
-	"context"
-	"net/http"
-	"net/url"
-	"strconv"
-	"strings"
-	"time"
-
-	larkcore "github.com/larksuite/oapi-sdk-go/v3/core"
-
-	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/client"
-)
-
-const (
-	larkCLIReportFileEventPath   = "/open-apis/drive/v1/lark_cli_file_event/report"
-	uploadFileEventReportTimeout = 3 * time.Second
-
-	uploadFileEventStatusSuccess = "success"
-	uploadFileEventStatusError   = "error"
-)
-
-// LarkCLIFileEventMeta describes the upload context attached to a best-effort
-// report_file_event call. Identity (user_id / tenant_id) is intentionally
-// omitted: the server derives it from the authenticated request context.
-type LarkCLIFileEventMeta struct {
-	APIPath      string
-	Command      string
-	UploadMode   string
-	ResourceType string
-	Status       string
-	Code         string
-	// ParentType is the upload request's parent_type (explorer / wiki /
-	// docx_file / sheet_image / slide_file / email / bitable_file /
-	// ccm_import_open ...). It is reported verbatim as the tags mount_point.
-	ParentType string
-	// FileToken is the uploaded file's token, set only on success paths and
-	// reported as the tags file_token. Empty on failure paths.
-	FileToken string
-}
-
-// IsTenantCapacityExceeded reports whether err is a typed API error carrying a
-// tenant-capacity-exceeded code recognized by the CLI upload reporting flow.
-// The code set mirrors the storage service source of truth.
-func IsTenantCapacityExceeded(err error) bool {
-	p, ok := errs.ProblemOf(err)
-	if !ok || p == nil {
-		return false
-	}
-	switch p.Code {
-	case 1061101:
-		return true
-	default:
-		return false
-	}
-}
-
-// ReportUploadFileEvent best-effort reports a successful upload file event once
-// per RuntimeContext. The report call's failure is swallowed; it never affects
-// the caller's success path.
-func ReportUploadFileEvent(runtime *RuntimeContext, meta LarkCLIFileEventMeta) {
-	if runtime == nil {
-		return
-	}
-	if strings.TrimSpace(meta.Status) == "" {
-		meta.Status = uploadFileEventStatusSuccess
-	}
-	if !runtime.MarkFileEventReported() {
-		return
-	}
-	_ = postUploadFileEvent(runtime, meta)
-}
-
-// ReportUploadFileEventOnError best-effort reports a failed upload once per
-// RuntimeContext, then returns the original uploadErr. The report call's own
-// failure never replaces uploadErr. When uploadErr is a tenant-capacity-exceeded
-// error, the capacity-expansion URL carried by the report response's msg is
-// appended to its .hint (only when the report returns a non-empty msg), without
-// altering type / subtype / code / message.
-func ReportUploadFileEventOnError(runtime *RuntimeContext, uploadErr error, meta LarkCLIFileEventMeta) error {
-	if uploadErr == nil {
-		return nil
-	}
-	if strings.TrimSpace(meta.Status) == "" {
-		meta.Status = uploadFileEventStatusError
-	}
-	if strings.TrimSpace(meta.Code) == "" {
-		if p, ok := errs.ProblemOf(uploadErr); ok && p != nil && p.Code != 0 {
-			meta.Code = strconv.Itoa(p.Code)
-		}
-	}
-	var reportMsg string
-	if runtime != nil && runtime.MarkFileEventReported() {
-		reportMsg = postUploadFileEvent(runtime, meta)
-	}
-	return appendTenantCapacityHint(uploadErr, reportMsg)
-}
-
-// postUploadFileEvent sends the best-effort report and returns the report
-// response's capacity-expansion URL. The server currently carries this URL in
-// data.msg; some responses also include a generic top-level msg like "success",
-// which must not be mistaken for a URL. Any transport / parse failure or a
-// non-zero response code yields an empty string, and the report never affects
-// the caller's flow.
-func postUploadFileEvent(runtime *RuntimeContext, meta LarkCLIFileEventMeta) string {
-	return postUploadFileEventWithTimeout(runtime, meta, uploadFileEventReportTimeout)
-}
-
-// postUploadFileEventWithTimeout sends the report within the supplied timeout
-// and returns a validated capacity-expansion URL from a successful response.
-func postUploadFileEventWithTimeout(runtime *RuntimeContext, meta LarkCLIFileEventMeta, timeout time.Duration) string {
-	reportCtx, cancel := context.WithTimeout(runtime.Ctx(), timeout)
-	defer cancel()
-
-	resp, err := runtime.DoAPIWithContext(reportCtx, &larkcore.ApiReq{
-		HttpMethod: http.MethodPost,
-		ApiPath:    larkCLIReportFileEventPath,
-		Body:       buildUploadReportRequest(runtime, meta),
-	})
-	if err != nil || resp == nil {
-		return ""
-	}
-	parsed, err := client.ParseJSONResponse(resp)
-	if err != nil {
-		return ""
-	}
-	envelope, ok := parsed.(map[string]interface{})
-	if !ok {
-		return ""
-	}
-	if GetFloat(envelope, "code") != 0 {
-		return ""
-	}
-	return extractCapacityExpansionURL(envelope)
-}
-
-// extractCapacityExpansionURL returns the first valid capacity-expansion URL
-// carried by the report response, preferring data.msg over the top-level msg.
-func extractCapacityExpansionURL(envelope map[string]interface{}) string {
-	for _, candidate := range []string{
-		GetString(envelope, "data", "msg"),
-		GetString(envelope, "msg"),
-	} {
-		if u := sanitizeCapacityExpansionURL(candidate); u != "" {
-			return u
-		}
-	}
-	return ""
-}
-
-// sanitizeCapacityExpansionURL accepts absolute HTTP(S) URLs and rejects empty,
-// relative, or malformed report response values.
-func sanitizeCapacityExpansionURL(raw string) string {
-	raw = strings.TrimSpace(raw)
-	if raw == "" {
-		return ""
-	}
-	u, err := url.Parse(raw)
-	if err != nil {
-		return ""
-	}
-	if (u.Scheme != "http" && u.Scheme != "https") ||
-		strings.TrimSpace(u.Host) == "" ||
-		strings.TrimSpace(u.Hostname()) == "" ||
-		strings.HasSuffix(u.Host, ":") ||
-		strings.HasPrefix(u.Path, "//") {
-		return ""
-	}
-	return u.String()
-}
-
-// AppendUploadFileEventDryRun describes the success-path report request that
-// follows an upload. Error-path reporting uses the same envelope with status
-// and code populated from the typed upload error at runtime.
-func AppendUploadFileEventDryRun(dry *DryRunAPI, runtime *RuntimeContext, meta LarkCLIFileEventMeta) {
-	if dry == nil {
-		return
-	}
-	if strings.TrimSpace(meta.Status) == "" {
-		meta.Status = uploadFileEventStatusSuccess
-	}
-	dry.POST(larkCLIReportFileEventPath).
-		Desc("Best-effort report of the completed upload").
-		Body(buildUploadReportRequest(runtime, meta))
-}
-
-// buildUploadReportRequest assembles the minimal report body: fixed event
-// fields plus tags. Identity fields are never included.
-func buildUploadReportRequest(runtime *RuntimeContext, meta LarkCLIFileEventMeta) map[string]interface{} {
-	command := strings.TrimSpace(meta.Command)
-	if command == "" {
-		command = commandPathOrName(runtime)
-	}
-	tags := map[string]string{
-		"code":          strings.TrimSpace(meta.Code),
-		"api_path":      strings.TrimSpace(meta.APIPath),
-		"command":       command,
-		"upload_mode":   strings.TrimSpace(meta.UploadMode),
-		"resource_type": strings.TrimSpace(meta.ResourceType),
-		"status":        strings.TrimSpace(meta.Status),
-		"mount_point":   strings.TrimSpace(meta.ParentType),
-		"file_token":    strings.TrimSpace(meta.FileToken),
-	}
-	return map[string]interface{}{
-		"file_scene": "lark-cli",
-		"scene":      "upload",
-		"operation":  "upload",
-		"tags":       tags,
-	}
-}
-
-// appendTenantCapacityHint adds the capacity-expansion URL (carried by the
-// report response's msg) to a tenant-capacity-exceeded error's hint, preserving
-// any existing hint and never touching type / subtype / code / message. It is a
-// no-op for non-quota errors and when the report returned no URL.
-func appendTenantCapacityHint(err error, reportMsg string) error {
-	if !IsTenantCapacityExceeded(err) {
-		return err
-	}
-	url := strings.TrimSpace(reportMsg)
-	if url == "" {
-		return err
-	}
-	p, ok := errs.ProblemOf(err)
-	if !ok || p == nil {
-		return err
-	}
-	hint := "tenant storage capacity is exceeded. Open this URL to expand capacity: " + url
-	switch {
-	case strings.TrimSpace(p.Hint) == "":
-		p.Hint = hint
-	case strings.Contains(p.Hint, url):
-		// already present; do not duplicate
-	default:
-		p.Hint = p.Hint + "\n" + hint
-	}
-	return err
-}
-
-// commandPathOrName returns the best-effort command identifier for upload
-// reporting, preferring the full command path and falling back to the shortcut
-// name. Empty is allowed for low-level helpers used outside a mounted shortcut.
-func commandPathOrName(runtime *RuntimeContext) string {
-	if runtime == nil {
-		return ""
-	}
-	if runtime.Cmd != nil {
-		path := strings.TrimSpace(runtime.Cmd.CommandPath())
-		path = strings.TrimPrefix(path, "lark-cli ")
-		path = strings.TrimPrefix(path, "lark ")
-		if path != "" {
-			return path
-		}
-	}
-	return runtime.Command()
-}

shortcuts/common/lark_cli_file_event_test.go

@@ -1,369 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package common
-
-import (
-	"context"
-	"net/http"
-	"strings"
-	"testing"
-	"time"
-
-	lark "github.com/larksuite/oapi-sdk-go/v3"
-
-	"github.com/spf13/cobra"
-
-	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
-	"github.com/larksuite/cli/internal/httpmock"
-)
-
-// newUploadFileEventRuntime creates an isolated runtime and HTTP stub registry
-// for upload file-event reporting tests.
-func newUploadFileEventRuntime(t *testing.T) (*RuntimeContext, *httpmock.Registry) {
-	t.Helper()
-	cfg := &core.CliConfig{Brand: core.BrandFeishu, AppID: "cli_x"}
-	f, _, _, reg := cmdutil.TestFactory(t, cfg)
-	rt := TestNewRuntimeContextForAPI(context.Background(), &cobra.Command{Use: "+upload"}, cfg, f, core.AsUser)
-	return rt, reg
-}
-
-// testCapacityExpansionURL is a placeholder capacity-expansion URL used in
-// tests. It intentionally uses example.com so no internal endpoint is embedded
-// in the repository.
-const testCapacityExpansionURL = "https://example.com/space/upload/pay/prepare"
-
-// registerReportStub registers a report_file_event response with no message.
-func registerReportStub(t *testing.T, reg *httpmock.Registry, code int) *httpmock.Stub {
-	t.Helper()
-	return registerReportStubWithMsg(t, reg, code, "")
-}
-
-// registerReportStubWithMsg registers a report_file_event stub returning the
-// given top-level code and msg.
-func registerReportStubWithMsg(t *testing.T, reg *httpmock.Registry, code int, msg string) *httpmock.Stub {
-	t.Helper()
-	return registerReportStubWithBody(t, reg, map[string]interface{}{
-		"code": code,
-		"data": map[string]interface{}{},
-		"msg":  msg,
-	})
-}
-
-// registerReportStubWithBody registers the supplied report_file_event response.
-func registerReportStubWithBody(t *testing.T, reg *httpmock.Registry, body map[string]interface{}) *httpmock.Stub {
-	t.Helper()
-	stub := &httpmock.Stub{
-		Method:   "POST",
-		URL:      larkCLIReportFileEventPath,
-		Body:     body,
-		Reusable: true,
-	}
-	reg.Register(stub)
-	return stub
-}
-
-func TestIsTenantCapacityExceeded(t *testing.T) {
-	if !IsTenantCapacityExceeded(errs.NewAPIError(errs.SubtypeQuotaExceeded, "quota exceeded").WithCode(1061101)) {
-		t.Fatal("code 1061101 should be recognized as tenant capacity exceeded")
-	}
-
-	// Legacy quota codes are intentionally no longer recognized: only the
-	// tenant-capacity-exceeded code 1061101 gates the expansion hint.
-	for _, code := range []int{11001, 90008072, 90003081, 10690008072, 10690003081} {
-		err := errs.NewAPIError(errs.SubtypeQuotaExceeded, "quota exceeded").WithCode(code)
-		if IsTenantCapacityExceeded(err) {
-			t.Fatalf("code %d must not be recognized as tenant capacity exceeded", code)
-		}
-	}
-
-	if IsTenantCapacityExceeded(errs.NewAPIError(errs.SubtypeQuotaExceeded, "quota exceeded").WithCode(12345)) {
-		t.Fatal("unexpected recognition for unrelated quota code")
-	}
-	if IsTenantCapacityExceeded(errs.NewValidationError(errs.SubtypeInvalidArgument, "bad input")) {
-		t.Fatal("non api error must not be recognized")
-	}
-}
-
-func TestReportUploadFileEvent_Success_ReportsOnceWithMinimalBody(t *testing.T) {
-	runtime, reg := newUploadFileEventRuntime(t)
-	reportStub := registerReportStub(t, reg, 0)
-
-	meta := LarkCLIFileEventMeta{
-		APIPath:      "/open-apis/drive/v1/medias/upload_all",
-		Command:      "drive +upload",
-		UploadMode:   "singlepart",
-		ResourceType: "media",
-		ParentType:   "docx_file",
-		FileToken:    "boxcnabc123",
-	}
-	ReportUploadFileEvent(runtime, meta)
-	ReportUploadFileEvent(runtime, meta)
-
-	if len(reportStub.CapturedBodies) != 1 {
-		t.Fatalf("report call count = %d, want 1", len(reportStub.CapturedBodies))
-	}
-	body := decodeCapturedDriveMediaJSONBody(t, reportStub)
-	assertReportEnvelope(t, body)
-	if _, ok := body["user_id"]; ok {
-		t.Fatalf("user_id must be omitted, got %v", body["user_id"])
-	}
-	if _, ok := body["tenant_id"]; ok {
-		t.Fatalf("tenant_id must be omitted, got %v", body["tenant_id"])
-	}
-	tags := assertTagsObject(t, body)
-	if got := tags["status"]; got != uploadFileEventStatusSuccess {
-		t.Fatalf("tags.status = %v, want success", got)
-	}
-	if got := tags["api_path"]; got != meta.APIPath {
-		t.Fatalf("tags.api_path = %v, want %s", got, meta.APIPath)
-	}
-	if got := tags["command"]; got != meta.Command {
-		t.Fatalf("tags.command = %v, want %s", got, meta.Command)
-	}
-	if got := tags["upload_mode"]; got != meta.UploadMode {
-		t.Fatalf("tags.upload_mode = %v, want %s", got, meta.UploadMode)
-	}
-	if got := tags["resource_type"]; got != meta.ResourceType {
-		t.Fatalf("tags.resource_type = %v, want %s", got, meta.ResourceType)
-	}
-	if got := tags["mount_point"]; got != meta.ParentType {
-		t.Fatalf("tags.mount_point = %v, want %s", got, meta.ParentType)
-	}
-	if got := tags["file_token"]; got != meta.FileToken {
-		t.Fatalf("tags.file_token = %v, want %s", got, meta.FileToken)
-	}
-}
-
-func TestBuildUploadReportRequest_CommandOmitsBinaryName(t *testing.T) {
-	root := &cobra.Command{Use: "lark-cli"}
-	drive := &cobra.Command{Use: "drive"}
-	upload := &cobra.Command{Use: "+upload"}
-	root.AddCommand(drive)
-	drive.AddCommand(upload)
-
-	body := buildUploadReportRequest(&RuntimeContext{Cmd: upload}, LarkCLIFileEventMeta{})
-	tags := assertTagsObject(t, body)
-	if got := tags["command"]; got != "drive +upload" {
-		t.Fatalf("tags.command = %v, want drive +upload", got)
-	}
-}
-
-func TestReportUploadFileEventOnError_ReportsAndPreservesError(t *testing.T) {
-	runtime, reg := newUploadFileEventRuntime(t)
-	reportStub := registerReportStub(t, reg, 0)
-
-	uploadErr := errs.NewAPIError(errs.SubtypeUnknown, "boom").WithCode(42)
-	meta := LarkCLIFileEventMeta{APIPath: "/open-apis/drive/v1/files/upload_all"}
-
-	returned := ReportUploadFileEventOnError(runtime, uploadErr, meta)
-	if returned != uploadErr {
-		t.Fatalf("returned error changed: got %v want original %v", returned, uploadErr)
-	}
-	returned = ReportUploadFileEventOnError(runtime, uploadErr, meta)
-	if returned != uploadErr {
-		t.Fatalf("second call changed error: got %v want original %v", returned, uploadErr)
-	}
-	if len(reportStub.CapturedBodies) != 1 {
-		t.Fatalf("report call count = %d, want 1", len(reportStub.CapturedBodies))
-	}
-	tags := assertTagsObject(t, decodeCapturedDriveMediaJSONBody(t, reportStub))
-	if got := tags["status"]; got != uploadFileEventStatusError {
-		t.Fatalf("tags.status = %v, want error", got)
-	}
-	if got := tags["code"]; got != "42" {
-		t.Fatalf("tags.code = %v, want 42", got)
-	}
-}
-
-func TestReportUploadFileEventOnError_ReportFailureDoesNotReplaceUploadError(t *testing.T) {
-	runtime, reg := newUploadFileEventRuntime(t)
-	reg.Register(&httpmock.Stub{
-		Method: "POST",
-		URL:    larkCLIReportFileEventPath,
-		Body:   map[string]interface{}{"code": 999, "msg": "report rejected"},
-	})
-
-	uploadErr := errs.NewAPIError(errs.SubtypeQuotaExceeded, "quota exceeded").WithCode(10690008072)
-	returned := ReportUploadFileEventOnError(runtime, uploadErr, LarkCLIFileEventMeta{APIPath: "/open-apis/drive/v1/files/upload_prepare"})
-	if returned != uploadErr {
-		t.Fatalf("returned error changed: got %v want original %v", returned, uploadErr)
-	}
-}
-
-func TestReportUploadFileEventOnError_AppendsCapacityExpansionHint(t *testing.T) {
-	runtime, reg := newUploadFileEventRuntime(t)
-	registerReportStubWithBody(t, reg, map[string]interface{}{
-		"code": 0,
-		"msg":  "success",
-		"data": map[string]interface{}{
-			"msg": testCapacityExpansionURL,
-		},
-	})
-
-	uploadErr := errs.NewAPIError(errs.SubtypeQuotaExceeded, "quota exceeded").WithCode(1061101)
-	returned := ReportUploadFileEventOnError(runtime, uploadErr, LarkCLIFileEventMeta{APIPath: "/open-apis/drive/v1/files/upload_prepare"})
-
-	p, ok := errs.ProblemOf(returned)
-	if !ok || p == nil {
-		t.Fatalf("expected typed problem, got %T (%v)", returned, returned)
-	}
-	if !strings.Contains(p.Hint, testCapacityExpansionURL) {
-		t.Fatalf("hint = %q, want it to contain %q", p.Hint, testCapacityExpansionURL)
-	}
-	if p.Code != 1061101 {
-		t.Fatalf("code changed: got %d, want 1061101", p.Code)
-	}
-	if p.Subtype != errs.SubtypeQuotaExceeded {
-		t.Fatalf("subtype changed: got %q, want %q", p.Subtype, errs.SubtypeQuotaExceeded)
-	}
-}
-
-func TestReportUploadFileEventOnError_TopLevelSuccessMsgDoesNotBecomeHint(t *testing.T) {
-	runtime, reg := newUploadFileEventRuntime(t)
-	registerReportStubWithMsg(t, reg, 0, "success")
-
-	uploadErr := errs.NewAPIError(errs.SubtypeQuotaExceeded, "quota exceeded").WithCode(1061101)
-	returned := ReportUploadFileEventOnError(runtime, uploadErr, LarkCLIFileEventMeta{APIPath: "/open-apis/drive/v1/files/upload_prepare"})
-
-	p, ok := errs.ProblemOf(returned)
-	if !ok || p == nil {
-		t.Fatalf("expected typed problem, got %T (%v)", returned, returned)
-	}
-	if strings.TrimSpace(p.Hint) != "" {
-		t.Fatalf("top-level success msg must not become hint, got %q", p.Hint)
-	}
-}
-
-func TestReportUploadFileEventOnError_InvalidURLInDataMsgIsIgnored(t *testing.T) {
-	runtime, reg := newUploadFileEventRuntime(t)
-	registerReportStubWithBody(t, reg, map[string]interface{}{
-		"code": 0,
-		"msg":  "success",
-		"data": map[string]interface{}{
-			"msg": "https://https://example.com/space/upload/pay/prepare",
-		},
-	})
-
-	uploadErr := errs.NewAPIError(errs.SubtypeQuotaExceeded, "quota exceeded").WithCode(1061101)
-	returned := ReportUploadFileEventOnError(runtime, uploadErr, LarkCLIFileEventMeta{APIPath: "/open-apis/drive/v1/files/upload_prepare"})
-
-	p, ok := errs.ProblemOf(returned)
-	if !ok || p == nil {
-		t.Fatalf("expected typed problem, got %T (%v)", returned, returned)
-	}
-	if strings.TrimSpace(p.Hint) != "" {
-		t.Fatalf("invalid data.msg URL must be ignored, got %q", p.Hint)
-	}
-}
-
-func TestReportUploadFileEventOnError_EmptyReportMsgYieldsNoHint(t *testing.T) {
-	runtime, reg := newUploadFileEventRuntime(t)
-	// report returns code 0 but no msg: no capacity-expansion URL to surface.
-	registerReportStub(t, reg, 0)
-
-	uploadErr := errs.NewAPIError(errs.SubtypeQuotaExceeded, "quota exceeded").WithCode(1061101)
-	returned := ReportUploadFileEventOnError(runtime, uploadErr, LarkCLIFileEventMeta{APIPath: "/open-apis/drive/v1/files/upload_prepare"})
-
-	p, ok := errs.ProblemOf(returned)
-	if !ok || p == nil {
-		t.Fatalf("expected typed problem, got %T (%v)", returned, returned)
-	}
-	if strings.TrimSpace(p.Hint) != "" {
-		t.Fatalf("empty report msg must yield no hint, got %q", p.Hint)
-	}
-	if p.Code != 1061101 {
-		t.Fatalf("code changed: got %d, want 1061101", p.Code)
-	}
-}
-
-func TestReportUploadFileEventOnError_NonQuotaErrorKeepsHint(t *testing.T) {
-	runtime, reg := newUploadFileEventRuntime(t)
-	registerReportStubWithMsg(t, reg, 0, testCapacityExpansionURL)
-
-	uploadErr := errs.NewAPIError(errs.SubtypeUnknown, "boom").WithCode(42)
-	returned := ReportUploadFileEventOnError(runtime, uploadErr, LarkCLIFileEventMeta{})
-	p, ok := errs.ProblemOf(returned)
-	if !ok || p == nil {
-		t.Fatalf("expected typed problem, got %T (%v)", returned, returned)
-	}
-	if strings.Contains(p.Hint, testCapacityExpansionURL) {
-		t.Fatalf("non-quota error must not get expansion hint, got %q", p.Hint)
-	}
-}
-
-func TestReportUploadFileEventOnError_NilErrorIsNoop(t *testing.T) {
-	runtime, _ := newUploadFileEventRuntime(t)
-
-	// No report stub is registered: a nil upload error must not attempt a
-	// report at all (an unexpected POST would fail with "no stub").
-	if err := ReportUploadFileEventOnError(runtime, nil, LarkCLIFileEventMeta{}); err != nil {
-		t.Fatalf("nil upload error should return nil, got %v", err)
-	}
-	// The reporting mark must remain unconsumed, proving no report fired.
-	if !runtime.MarkFileEventReported() {
-		t.Fatal("nil error path must not consume the file-event report mark")
-	}
-}
-
-type contextBlockingRoundTripper struct{}
-
-// RoundTrip blocks until the request context expires, allowing timeout behavior
-// to be tested without performing a network request.
-func (contextBlockingRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) {
-	<-req.Context().Done()
-	return nil, req.Context().Err()
-}
-
-func TestPostUploadFileEventWithTimeout_BoundsBestEffortRequest(t *testing.T) {
-	cfg := &core.CliConfig{Brand: core.BrandFeishu, AppID: "cli_x"}
-	f, _, _, _ := cmdutil.TestFactory(t, cfg)
-	f.LarkClient = func() (*lark.Client, error) {
-		return lark.NewClient("cli_x", "test-secret", lark.WithHttpClient(&http.Client{
-			Transport: contextBlockingRoundTripper{},
-		})), nil
-	}
-	runtime := TestNewRuntimeContextForAPI(context.Background(), &cobra.Command{Use: "+upload"}, cfg, f, core.AsUser)
-
-	started := time.Now()
-	if got := postUploadFileEventWithTimeout(runtime, LarkCLIFileEventMeta{}, 10*time.Millisecond); got != "" {
-		t.Fatalf("postUploadFileEventWithTimeout() = %q, want empty result on timeout", got)
-	}
-	if elapsed := time.Since(started); elapsed > time.Second {
-		t.Fatalf("best-effort report took %s, want it bounded by the request context", elapsed)
-	}
-}
-
-// assertReportEnvelope verifies the fixed fields in an upload report body.
-func assertReportEnvelope(t *testing.T, body map[string]interface{}) {
-	t.Helper()
-	if got := body["file_scene"]; got != "lark-cli" {
-		t.Fatalf("file_scene = %v, want lark-cli", got)
-	}
-	if got := body["scene"]; got != "upload" {
-		t.Fatalf("scene = %v, want upload", got)
-	}
-	if got := body["operation"]; got != "upload" {
-		t.Fatalf("operation = %v, want upload", got)
-	}
-}
-
-// assertTagsObject returns the report tags as a generic JSON-style object.
-func assertTagsObject(t *testing.T, body map[string]interface{}) map[string]interface{} {
-	t.Helper()
-	switch tags := body["tags"].(type) {
-	case map[string]interface{}:
-		return tags
-	case map[string]string:
-		result := make(map[string]interface{}, len(tags))
-		for key, value := range tags {
-			result[key] = value
-		}
-		return result
-	default:
-		t.Fatalf("tags = %#v, want object", body["tags"])
-		return nil
-	}
-}

shortcuts/common/localfile.go

@@ -1,146 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package common
-
-import (
-	"errors"
-	"io"
-	"io/fs"
-	"math"
-	"strings"
-
-	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/extension/fileio"
-	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/validate"
-)
-
-// ValidateLocalFileFlag validates that a local input path exists, is a regular
-// file, and does not exceed maxBytes. Absolute and relative paths use
-// the process filesystem namespace.
-func (ctx *RuntimeContext) ValidateLocalFileFlag(flagName string, maxBytes int64) error {
-	path, param, err := ctx.localFileFlag(flagName, maxBytes)
-	if err != nil {
-		return err
-	}
-
-	info, err := cmdutil.StatLocalFile(path)
-	if err != nil {
-		return localFileReadError(param, path, "inspect", err)
-	}
-	if err := localFileRegularError(param, path, info.Mode()); err != nil {
-		return err
-	}
-	if info.Size() > maxBytes {
-		return localFileSizeError(param, path, info.Size(), maxBytes)
-	}
-	return nil
-}
-
-// ReadLocalFileFlag is the shared replacement for direct os.ReadFile calls in
-// shortcuts. It accepts absolute and relative paths, enforces a hard size
-// limit, and returns command-facing typed errors.
-func (ctx *RuntimeContext) ReadLocalFileFlag(flagName string, maxBytes int64) (data []byte, retErr error) {
-	path, param, err := ctx.localFileFlag(flagName, maxBytes)
-	if err != nil {
-		return nil, err
-	}
-	f, err := cmdutil.OpenLocalFile(path)
-	if err != nil {
-		return nil, localFileReadError(param, path, "open", err)
-	}
-	defer func() {
-		if err := f.Close(); err != nil && retErr == nil {
-			data = nil
-			retErr = errs.NewInternalError(errs.SubtypeFileIO, "cannot close %s %q: %v", param, path, err).WithCause(err)
-		}
-	}()
-
-	openedInfo, err := f.Stat()
-	if err != nil {
-		return nil, localFileReadError(param, path, "inspect opened", err)
-	}
-	if err := localFileRegularError(param, path, openedInfo.Mode()); err != nil {
-		return nil, err
-	}
-	if openedInfo.Size() > maxBytes {
-		return nil, localFileSizeError(param, path, openedInfo.Size(), maxBytes)
-	}
-
-	readLimit := maxBytes + 1
-	if maxBytes == math.MaxInt64 {
-		readLimit = maxBytes
-	}
-	data, err = io.ReadAll(io.LimitReader(f, readLimit))
-	if err != nil {
-		return nil, localFileReadError(param, path, "read", err)
-	}
-	if int64(len(data)) > maxBytes {
-		return nil, errs.NewValidationError(errs.SubtypeInvalidArgument,
-			"%s %q grew beyond the %d-byte limit while being read", param, path, maxBytes).
-			WithParam(param)
-	}
-	return data, nil
-}
-
-func (ctx *RuntimeContext) localFileFlag(flagName string, maxBytes int64) (path, param string, err error) {
-	name, param, err := localFileFlagNames(flagName)
-	if err != nil {
-		return "", "", err
-	}
-	if ctx == nil || ctx.Cmd == nil {
-		return "", param, errs.NewInternalError(errs.SubtypeUnknown, "cannot read %s: runtime command is unavailable", param)
-	}
-
-	path = strings.TrimSpace(ctx.Str(name))
-	if path == "" {
-		return "", param, errs.NewValidationError(errs.SubtypeInvalidArgument, "%s is required", param).WithParam(param)
-	}
-	if _, err := validate.LocalInputPath(path); err != nil {
-		return "", param, errs.NewValidationError(errs.SubtypeInvalidArgument, "invalid %s path: %v", param, err).
-			WithParam(param).
-			WithCause(err)
-	}
-	if maxBytes < 0 {
-		return "", param, errs.NewInternalError(errs.SubtypeUnknown, "invalid read limit configured for %s", param)
-	}
-	return path, param, nil
-}
-
-func localFileRegularError(param, path string, mode fs.FileMode) error {
-	if mode.IsRegular() {
-		return nil
-	}
-	return errs.NewValidationError(errs.SubtypeInvalidArgument,
-		"%s %q is not a regular file", param, path).
-		WithParam(param)
-}
-
-func localFileReadError(param, path, op string, cause error) error {
-	if errors.Is(cause, fileio.ErrPathValidation) {
-		return errs.NewValidationError(errs.SubtypeInvalidArgument, "invalid %s %q: %v", param, path, cause).
-			WithParam(param).
-			WithCause(cause)
-	}
-	if errors.Is(cause, fs.ErrNotExist) {
-		return errs.NewValidationError(errs.SubtypeInvalidArgument, "%s %q does not exist", param, path).
-			WithParam(param).
-			WithCause(cause)
-	}
-	return errs.NewInternalError(errs.SubtypeFileIO, "cannot %s %s %q: %v", op, param, path, cause).WithCause(cause)
-}
-
-func localFileSizeError(param, path string, size, limit int64) error {
-	return errs.NewValidationError(errs.SubtypeInvalidArgument,
-		"%s %q is %d bytes; limit is %d bytes", param, path, size, limit).
-		WithParam(param)
-}
-
-func localFileFlagNames(flagName string) (name, param string, err error) {
-	name = strings.TrimLeft(strings.TrimSpace(flagName), "-")
-	if name == "" {
-		return "", "", errs.NewInternalError(errs.SubtypeUnknown, "local file flag name must not be empty")
-	}
-	return name, "--" + name, nil
-}

shortcuts/common/localfile_test.go

@@ -1,95 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package common
-
-import (
-	"context"
-	"errors"
-	"os"
-	"path/filepath"
-	"testing"
-
-	"github.com/larksuite/cli/errs"
-	"github.com/spf13/cobra"
-)
-
-func TestReadLocalFileFlag_AcceptsAbsolutePath(t *testing.T) {
-	path := filepath.Join(t.TempDir(), "input.txt")
-	if err := os.WriteFile(path, []byte("content"), 0o600); err != nil {
-		t.Fatal(err)
-	}
-	rctx := localFileTestRuntime(t, path)
-
-	if err := rctx.ValidateLocalFileFlag("file", 7); err != nil {
-		t.Fatalf("ValidateLocalFileFlag() error = %v", err)
-	}
-	got, err := rctx.ReadLocalFileFlag("file", 7)
-	if err != nil || string(got) != "content" {
-		t.Fatalf("ReadLocalFileFlag() = %q, %v; want content", got, err)
-	}
-}
-
-func TestValidateLocalFileFlag_ReturnsTypedInputErrors(t *testing.T) {
-	for _, tc := range []struct {
-		name string
-		path func(t *testing.T) string
-		max  int64
-	}{
-		{name: "invalid characters", path: func(*testing.T) string { return "input\n.txt" }, max: 10},
-		{name: "missing file", path: func(t *testing.T) string { return filepath.Join(t.TempDir(), "missing") }, max: 10},
-		{name: "directory", path: func(t *testing.T) string { return t.TempDir() }, max: 10},
-		{name: "too large", path: func(t *testing.T) string {
-			path := filepath.Join(t.TempDir(), "large")
-			if err := os.WriteFile(path, []byte("123456"), 0o600); err != nil {
-				t.Fatal(err)
-			}
-			return path
-		}, max: 5},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			err := localFileTestRuntime(t, tc.path(t)).ValidateLocalFileFlag("file", tc.max)
-			var validationErr *errs.ValidationError
-			if !errors.As(err, &validationErr) || validationErr.Subtype != errs.SubtypeInvalidArgument || validationErr.Param != "--file" {
-				t.Fatalf("error = %T %v, want invalid_argument for --file", err, err)
-			}
-		})
-	}
-}
-
-func TestReadLocalFileFlag_ReturnsTypedInputErrors(t *testing.T) {
-	for _, tc := range []struct {
-		name string
-		path func(t *testing.T) string
-		max  int64
-	}{
-		{name: "invalid characters", path: func(*testing.T) string { return "input\n.txt" }, max: 10},
-		{name: "missing file", path: func(t *testing.T) string { return filepath.Join(t.TempDir(), "missing") }, max: 10},
-		{name: "directory", path: func(t *testing.T) string { return t.TempDir() }, max: 10},
-		{name: "too large", path: func(t *testing.T) string {
-			path := filepath.Join(t.TempDir(), "large")
-			if err := os.WriteFile(path, []byte("123456"), 0o600); err != nil {
-				t.Fatal(err)
-			}
-			return path
-		}, max: 5},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			_, err := localFileTestRuntime(t, tc.path(t)).ReadLocalFileFlag("file", tc.max)
-			var validationErr *errs.ValidationError
-			if !errors.As(err, &validationErr) || validationErr.Subtype != errs.SubtypeInvalidArgument || validationErr.Param != "--file" {
-				t.Fatalf("error = %T %v, want invalid_argument for --file", err, err)
-			}
-		})
-	}
-}
-
-func localFileTestRuntime(t *testing.T, path string) *RuntimeContext {
-	t.Helper()
-	cmd := &cobra.Command{Use: "test"}
-	cmd.Flags().String("file", "", "")
-	if err := cmd.Flags().Set("file", path); err != nil {
-		t.Fatal(err)
-	}
-	return &RuntimeContext{ctx: context.Background(), Cmd: cmd}
-}

shortcuts/common/runner.go

@@ -40,19 +40,16 @@ type RuntimeContext struct {
 	Config        *core.CliConfig
 	Cmd           *cobra.Command
 	Format        string
-	JqExpr        string        // --jq expression; empty = no filter
-	outputErrOnce sync.Once     // guards first-error capture in Out()/OutFormat()
-	outputErr     error         // deferred error from jq filtering; written at most once
-	botOnly       bool          // set by framework for bot-only shortcuts
-	resolvedAs    core.Identity // effective identity resolved by framework
-	// fileEventReportOnce guards best-effort upload file-event reporting so it is
-	// emitted at most once per command run (see MarkFileEventReported).
-	fileEventReportOnce sync.Once
-	Factory             *cmdutil.Factory                  // injected by framework
-	apiClientFunc       func() (*client.APIClient, error) // sync.OnceValues; initialized in newRuntimeContext
-	botInfoFunc         func() (*BotInfo, error)          // sync.OnceValues; lazy bot identity from /bot/v3/info
-	larkSDK             *lark.Client                      // eagerly initialized in mountDeclarative
-	stdinConsumed       bool                              // set when an Input flag has consumed stdin (`-`); guards against a second flag also using `-` within the same call
+	JqExpr        string                            // --jq expression; empty = no filter
+	outputErrOnce sync.Once                         // guards first-error capture in Out()/OutFormat()
+	outputErr     error                             // deferred error from jq filtering; written at most once
+	botOnly       bool                              // set by framework for bot-only shortcuts
+	resolvedAs    core.Identity                     // effective identity resolved by framework
+	Factory       *cmdutil.Factory                  // injected by framework
+	apiClientFunc func() (*client.APIClient, error) // sync.OnceValues; initialized in newRuntimeContext
+	botInfoFunc   func() (*BotInfo, error)          // sync.OnceValues; lazy bot identity from /bot/v3/info
+	larkSDK       *lark.Client                      // eagerly initialized in mountDeclarative
+	stdinConsumed bool                              // set when an Input flag has consumed stdin (`-`); guards against a second flag also using `-` within the same call
 }
 
 // ── Identity ──
@@ -78,20 +75,6 @@ func (ctx *RuntimeContext) IsBot() bool {
 	return ctx.As().IsBot()
 }
 
-// MarkFileEventReported returns true only on the first successful mark within
-// this RuntimeContext. Upload file-event reporting is best-effort and should
-// happen at most once per command execution.
-func (ctx *RuntimeContext) MarkFileEventReported() bool {
-	if ctx == nil {
-		return false
-	}
-	report := false
-	ctx.fileEventReportOnce.Do(func() {
-		report = true
-	})
-	return report
-}
-
 // Command returns the shortcut command name as cobra knows it (e.g.
 // "+pivot-create"). Used by per-service helpers (e.g. sheets schema
 // validation) that key off the shortcut identity.
@@ -467,24 +450,14 @@ func (ctx *RuntimeContext) callRaw(method, url string, params map[string]interfa
 // Auth resolution is delegated to APIClient.DoSDKRequest to avoid duplicating
 // the identity → token logic across the generic and shortcut API paths.
 func (ctx *RuntimeContext) DoAPI(req *larkcore.ApiReq, opts ...larkcore.RequestOptionFunc) (*larkcore.ApiResp, error) {
-	return ctx.DoAPIWithContext(ctx.ctx, req, opts...)
-}
-
-// DoAPIWithContext executes a raw Lark SDK request with an explicit context.
-// Callers that perform best-effort or otherwise bounded side requests can use
-// this without changing the RuntimeContext's command-wide context.
-func (ctx *RuntimeContext) DoAPIWithContext(callCtx context.Context, req *larkcore.ApiReq, opts ...larkcore.RequestOptionFunc) (*larkcore.ApiResp, error) {
-	if callCtx == nil {
-		callCtx = ctx.ctx
-	}
 	ac, err := ctx.getAPIClient()
 	if err != nil {
 		return nil, err
 	}
-	if optFn := cmdutil.ShortcutHeaderOpts(callCtx); optFn != nil {
+	if optFn := cmdutil.ShortcutHeaderOpts(ctx.ctx); optFn != nil {
 		opts = append(opts, optFn)
 	}
-	return ac.DoSDKRequest(callCtx, req, ctx.As(), opts...)
+	return ac.DoSDKRequest(ctx.ctx, req, ctx.As(), opts...)
 }
 
 // DoAPIAsBot executes a raw Lark SDK request using bot identity (tenant access token),

shortcuts/drive/drive_import.go

@@ -105,7 +105,6 @@ func PlanImportDryRun(runtime *common.RuntimeContext, p ImportParams) *common.Dr
 
 	appendDriveImportFolderTokenWikiCheckDryRun(dry, spec)
 	appendDriveImportUploadDryRun(dry, spec, fileSize)
-	appendDriveImportUploadReportDryRun(dry, runtime, fileSize)
 
 	dry.POST("/open-apis/drive/v1/import_tasks").
 		Desc("[2] Create import task").
@@ -260,24 +259,6 @@ func appendDriveImportUploadDryRun(dry *common.DryRunAPI, spec driveImportSpec,
 		})
 }
 
-// appendDriveImportUploadReportDryRun adds the best-effort upload report to an
-// import dry-run plan, matching the single-part or multipart upload path.
-func appendDriveImportUploadReportDryRun(dry *common.DryRunAPI, runtime *common.RuntimeContext, fileSize int64) {
-	apiPath := "/open-apis/drive/v1/medias/upload_all"
-	uploadMode := "singlepart"
-	if fileSize > common.MaxDriveMediaUploadSinglePartSize {
-		apiPath = "/open-apis/drive/v1/medias/upload_finish"
-		uploadMode = "multipart"
-	}
-	common.AppendUploadFileEventDryRun(dry, runtime, common.LarkCLIFileEventMeta{
-		APIPath:      apiPath,
-		UploadMode:   uploadMode,
-		ResourceType: "media",
-		ParentType:   "ccm_import_open",
-		FileToken:    "<file_token from upload response>",
-	})
-}
-
 // normalizeDriveImportKindForURL maps the server's import "type" field to a
 // canonical kind BuildResourceURL recognizes. status.DocType comes straight
 // from the API and isn't normalized; if it ever returns aliases like "sheets"

shortcuts/drive/drive_import_test.go

@@ -109,15 +109,14 @@ func TestDriveImportDryRunUsesExtensionlessDefaultName(t *testing.T) {
 	var got struct {
 		API []struct {
 			Desc string                 `json:"desc"`
-			URL  string                 `json:"url"`
 			Body map[string]interface{} `json:"body"`
 		} `json:"api"`
 	}
 	if err := json.Unmarshal(data, &got); err != nil {
 		t.Fatalf("unmarshal dry run json: %v", err)
 	}
-	if len(got.API) != 5 {
-		t.Fatalf("expected 5 API calls, got %d", len(got.API))
+	if len(got.API) != 4 {
+		t.Fatalf("expected 4 API calls, got %d", len(got.API))
 	}
 	wantDesc := "After the import result returns the final cloud document target in bot mode, the CLI will also try to grant the current CLI user full_access on it."
 	if got.API[len(got.API)-1].Desc != wantDesc {
@@ -133,11 +132,7 @@ func TestDriveImportDryRunUsesExtensionlessDefaultName(t *testing.T) {
 		t.Fatalf("upload file_name = %q, want %q", uploadName, "base-import.xlsx")
 	}
 
-	if got.API[2].URL != "/open-apis/drive/v1/lark_cli_file_event/report" {
-		t.Fatalf("report URL = %q, want lark_cli_file_event/report", got.API[2].URL)
-	}
-
-	importName, _ := got.API[3].Body["file_name"].(string)
+	importName, _ := got.API[2].Body["file_name"].(string)
 	if importName != "base-import" {
 		t.Fatalf("import task file_name = %q, want %q", importName, "base-import")
 	}
@@ -191,8 +186,8 @@ func TestDriveImportDryRunShowsMultipartUploadForLargeFile(t *testing.T) {
 	if err := json.Unmarshal(data, &got); err != nil {
 		t.Fatalf("unmarshal dry run json: %v", err)
 	}
-	if len(got.API) != 6 {
-		t.Fatalf("expected 6 API calls, got %d", len(got.API))
+	if len(got.API) != 5 {
+		t.Fatalf("expected 5 API calls, got %d", len(got.API))
 	}
 	if got.API[0].URL != "/open-apis/drive/v1/medias/upload_prepare" {
 		t.Fatalf("dry-run first URL = %q, want upload_prepare", got.API[0].URL)
@@ -203,9 +198,6 @@ func TestDriveImportDryRunShowsMultipartUploadForLargeFile(t *testing.T) {
 	if got.API[2].URL != "/open-apis/drive/v1/medias/upload_finish" {
 		t.Fatalf("dry-run third URL = %q, want upload_finish", got.API[2].URL)
 	}
-	if got.API[3].URL != "/open-apis/drive/v1/lark_cli_file_event/report" {
-		t.Fatalf("report URL = %q, want lark_cli_file_event/report", got.API[3].URL)
-	}
 }
 
 func TestDriveImportDryRunReturnsErrorForUnsafePath(t *testing.T) {
@@ -483,16 +475,12 @@ func TestDriveImportDryRunWithTargetToken(t *testing.T) {
 	if err := json.Unmarshal(data, &got); err != nil {
 		t.Fatalf("unmarshal dry run json: %v", err)
 	}
-	if len(got.API) != 4 {
-		t.Fatalf("expected 4 API calls, got %d", len(got.API))
+	if len(got.API) != 3 {
+		t.Fatalf("expected 3 API calls, got %d", len(got.API))
 	}
 
-	if got.API[1].URL != "/open-apis/drive/v1/lark_cli_file_event/report" {
-		t.Fatalf("report URL = %q, want lark_cli_file_event/report", got.API[1].URL)
-	}
-
-	// The import task body (API[2]) should contain target_token in point.
-	importTaskBody := got.API[2].Body
+	// The import task body (API[1]) should contain target_token in point
+	importTaskBody := got.API[1].Body
 	point, ok := importTaskBody["point"].(map[string]interface{})
 	if !ok {
 		t.Fatalf("point = %#v, want map", importTaskBody["point"])

shortcuts/drive/drive_io_test.go

@@ -1109,8 +1109,8 @@ func TestDriveUploadDryRunUsesWikiTarget(t *testing.T) {
 	if err := json.Unmarshal(data, &got); err != nil {
 		t.Fatalf("unmarshal dry run json: %v", err)
 	}
-	if len(got.API) != 3 {
-		t.Fatalf("expected 3 API calls, got %d", len(got.API))
+	if len(got.API) != 2 {
+		t.Fatalf("expected 2 API calls, got %d", len(got.API))
 	}
 	if got.API[0].Body["parent_type"] != driveUploadParentTypeWiki {
 		t.Fatalf("parent_type = %#v, want %q", got.API[0].Body["parent_type"], driveUploadParentTypeWiki)
@@ -1118,14 +1118,11 @@ func TestDriveUploadDryRunUsesWikiTarget(t *testing.T) {
 	if got.API[0].Body["parent_node"] != "wikcn_dryrun_upload_target" {
 		t.Fatalf("parent_node = %#v, want %q", got.API[0].Body["parent_node"], "wikcn_dryrun_upload_target")
 	}
-	if got.API[1].URL != "/open-apis/drive/v1/lark_cli_file_event/report" {
-		t.Fatalf("report URL = %q, want lark_cli_file_event/report", got.API[1].URL)
+	if got.API[1].URL != "/open-apis/drive/v1/metas/batch_query" {
+		t.Fatalf("metadata URL = %q, want metas/batch_query", got.API[1].URL)
 	}
-	if got.API[2].URL != "/open-apis/drive/v1/metas/batch_query" {
-		t.Fatalf("metadata URL = %q, want metas/batch_query", got.API[2].URL)
-	}
-	if got.API[2].Body["with_url"] != true {
-		t.Fatalf("metadata with_url = %#v, want true", got.API[2].Body["with_url"])
+	if got.API[1].Body["with_url"] != true {
+		t.Fatalf("metadata with_url = %#v, want true", got.API[1].Body["with_url"])
 	}
 	wantPostUploadNote := "After file upload succeeds in bot mode, the CLI will also try to grant the current CLI user full_access on the new file."
 	if got.PostUploadNote != wantPostUploadNote {
@@ -1213,20 +1210,17 @@ func TestDriveUploadDryRunIncludesFileToken(t *testing.T) {
 	if err := json.Unmarshal(data, &got); err != nil {
 		t.Fatalf("unmarshal dry run json: %v", err)
 	}
-	if len(got.API) != 3 {
-		t.Fatalf("expected 3 API calls, got %d", len(got.API))
+	if len(got.API) != 2 {
+		t.Fatalf("expected 2 API calls, got %d", len(got.API))
 	}
 	if got.API[0].Body["file_token"] != "boxcn_dryrun_overwrite" {
 		t.Fatalf("file_token = %#v, want %q", got.API[0].Body["file_token"], "boxcn_dryrun_overwrite")
 	}
-	if got.API[1].URL != "/open-apis/drive/v1/lark_cli_file_event/report" {
-		t.Fatalf("report URL = %q, want lark_cli_file_event/report", got.API[1].URL)
+	if got.API[1].URL != "/open-apis/drive/v1/metas/batch_query" {
+		t.Fatalf("metadata URL = %q, want metas/batch_query", got.API[1].URL)
 	}
-	if got.API[2].URL != "/open-apis/drive/v1/metas/batch_query" {
-		t.Fatalf("metadata URL = %q, want metas/batch_query", got.API[2].URL)
-	}
-	if got.API[2].Body["with_url"] != true {
-		t.Fatalf("metadata with_url = %#v, want true", got.API[2].Body["with_url"])
+	if got.API[1].Body["with_url"] != true {
+		t.Fatalf("metadata with_url = %#v, want true", got.API[1].Body["with_url"])
 	}
 }
 
@@ -1270,8 +1264,8 @@ func TestDriveUploadDryRunBotOverwriteSkipsPermissionGrantHint(t *testing.T) {
 	if err := json.Unmarshal(data, &got); err != nil {
 		t.Fatalf("unmarshal dry run json: %v", err)
 	}
-	if len(got.API) != 3 {
-		t.Fatalf("expected 3 API calls, got %d", len(got.API))
+	if len(got.API) != 2 {
+		t.Fatalf("expected 2 API calls, got %d", len(got.API))
 	}
 	if got.API[0].Body["file_token"] != "boxcn_dryrun_overwrite" {
 		t.Fatalf("file_token = %#v, want %q", got.API[0].Body["file_token"], "boxcn_dryrun_overwrite")
@@ -1602,254 +1596,3 @@ func decodeDriveMultipartBody(t *testing.T, stub *httpmock.Stub) capturedDriveMu
 	}
 	return body
 }
-
-const driveReportFileEventPath = "/open-apis/drive/v1/lark_cli_file_event/report"
-
-// testDriveCapacityExpansionURL is a placeholder capacity-expansion URL used in
-// tests. It intentionally uses example.com so no internal endpoint is embedded
-// in the repository.
-const testDriveCapacityExpansionURL = "https://example.com/space/upload/pay/prepare"
-
-// registerDriveReportStub registers a successful report_file_event stub.
-func registerDriveReportStub(t *testing.T, reg *httpmock.Registry) *httpmock.Stub {
-	t.Helper()
-	return registerDriveReportStubWithMsg(t, reg, "")
-}
-
-// registerDriveReportStubWithMsg registers a report_file_event stub returning
-// code 0 and, when msg is non-empty, carrying it as data.msg.
-func registerDriveReportStubWithMsg(t *testing.T, reg *httpmock.Registry, msg string) *httpmock.Stub {
-	t.Helper()
-	body := map[string]interface{}{"code": 0, "data": map[string]interface{}{}}
-	if msg != "" {
-		body["msg"] = "success"
-		body["data"] = map[string]interface{}{"msg": msg}
-	}
-	stub := &httpmock.Stub{
-		Method:   "POST",
-		URL:      driveReportFileEventPath,
-		Body:     body,
-		Reusable: true,
-	}
-	reg.Register(stub)
-	return stub
-}
-
-// decodeDriveReportTags verifies one captured Drive report and returns its tags.
-func decodeDriveReportTags(t *testing.T, stub *httpmock.Stub) map[string]interface{} {
-	t.Helper()
-	if len(stub.CapturedBodies) != 1 {
-		t.Fatalf("report call count = %d, want 1", len(stub.CapturedBodies))
-	}
-	var body map[string]interface{}
-	if err := json.Unmarshal(stub.CapturedBodies[0], &body); err != nil {
-		t.Fatalf("decode report body: %v", err)
-	}
-	if got := body["file_scene"]; got != "lark-cli" {
-		t.Fatalf("file_scene = %v, want lark-cli", got)
-	}
-	if got := body["scene"]; got != "upload" {
-		t.Fatalf("scene = %v, want upload", got)
-	}
-	if _, ok := body["user_id"]; ok {
-		t.Fatalf("user_id must be omitted, got %v", body["user_id"])
-	}
-	if _, ok := body["tenant_id"]; ok {
-		t.Fatalf("tenant_id must be omitted, got %v", body["tenant_id"])
-	}
-	tags, ok := body["tags"].(map[string]interface{})
-	if !ok {
-		t.Fatalf("tags = %#v, want object", body["tags"])
-	}
-	return tags
-}
-
-func TestDriveUploadSmallFileReportFileEventOnSuccess(t *testing.T) {
-	uploadTestConfig := &core.CliConfig{
-		AppID: "drive-upload-report-small-ok", AppSecret: "test-secret", Brand: core.BrandFeishu,
-	}
-	f, stdout, _, reg := cmdutil.TestFactory(t, uploadTestConfig)
-	reportStub := registerDriveReportStub(t, reg)
-
-	reg.Register(&httpmock.Stub{
-		Method: "POST",
-		URL:    "/open-apis/drive/v1/files/upload_all",
-		Body: map[string]interface{}{
-			"code": 0, "msg": "ok",
-			"data": map[string]interface{}{"file_token": "file_report_ok"},
-		},
-	})
-
-	withDriveWorkingDir(t, t.TempDir())
-	if err := os.WriteFile("small.bin", make([]byte, 1024), 0644); err != nil {
-		t.Fatalf("WriteFile() error: %v", err)
-	}
-
-	err := mountAndRunDrive(t, DriveUpload, []string{
-		"+upload", "--file", "small.bin", "--as", "bot",
-	}, f, stdout)
-	if err != nil {
-		t.Fatalf("expected upload to succeed, got error: %v", err)
-	}
-
-	tags := decodeDriveReportTags(t, reportStub)
-	if got := tags["status"]; got != "success" {
-		t.Fatalf("tags.status = %v, want success", got)
-	}
-	if got := tags["api_path"]; got != "/open-apis/drive/v1/files/upload_all" {
-		t.Fatalf("tags.api_path = %v", got)
-	}
-	if got := tags["upload_mode"]; got != "singlepart" {
-		t.Fatalf("tags.upload_mode = %v, want singlepart", got)
-	}
-	if got := tags["resource_type"]; got != "file" {
-		t.Fatalf("tags.resource_type = %v, want file", got)
-	}
-	if got := tags["mount_point"]; got != driveUploadParentTypeExplorer {
-		t.Fatalf("tags.mount_point = %v, want %s", got, driveUploadParentTypeExplorer)
-	}
-	if got := tags["file_token"]; got != "file_report_ok" {
-		t.Fatalf("tags.file_token = %v, want file_report_ok", got)
-	}
-}
-
-func TestDriveUploadSmallFileReportFileEventOnError(t *testing.T) {
-	uploadTestConfig := &core.CliConfig{
-		AppID: "drive-upload-report-small-err", AppSecret: "test-secret", Brand: core.BrandFeishu,
-	}
-	f, stdout, _, reg := cmdutil.TestFactory(t, uploadTestConfig)
-	reportStub := registerDriveReportStubWithMsg(t, reg, testDriveCapacityExpansionURL)
-
-	reg.Register(&httpmock.Stub{
-		Method: "POST",
-		URL:    "/open-apis/drive/v1/files/upload_all",
-		Body:   map[string]interface{}{"code": 1061101, "msg": "tenant capacity exceeded"},
-	})
-
-	withDriveWorkingDir(t, t.TempDir())
-	if err := os.WriteFile("small.bin", make([]byte, 1024), 0644); err != nil {
-		t.Fatalf("WriteFile() error: %v", err)
-	}
-
-	err := mountAndRunDrive(t, DriveUpload, []string{
-		"+upload", "--file", "small.bin", "--as", "bot",
-	}, f, stdout)
-	if err == nil {
-		t.Fatal("expected error, got nil")
-	}
-	p, ok := errs.ProblemOf(err)
-	if !ok {
-		t.Fatalf("expected typed problem, got %T (%v)", err, err)
-	}
-	if p.Code != 1061101 {
-		t.Fatalf("code = %d, want original 1061101", p.Code)
-	}
-	if !strings.Contains(p.Hint, testDriveCapacityExpansionURL) {
-		t.Fatalf("hint = %q, want capacity expansion URL", p.Hint)
-	}
-
-	tags := decodeDriveReportTags(t, reportStub)
-	if got := tags["status"]; got != "error" {
-		t.Fatalf("tags.status = %v, want error", got)
-	}
-	if got := tags["code"]; got != "1061101" {
-		t.Fatalf("tags.code = %v, want 1061101", got)
-	}
-}
-
-func TestDriveUploadLargeFileReportFileEventOnPrepareError(t *testing.T) {
-	uploadTestConfig := &core.CliConfig{
-		AppID: "drive-upload-report-large-prepare-err", AppSecret: "test-secret", Brand: core.BrandFeishu,
-	}
-	f, stdout, _, reg := cmdutil.TestFactory(t, uploadTestConfig)
-	reportStub := registerDriveReportStubWithMsg(t, reg, testDriveCapacityExpansionURL)
-
-	reg.Register(&httpmock.Stub{
-		Method: "POST",
-		URL:    "/open-apis/drive/v1/files/upload_prepare",
-		Body:   map[string]interface{}{"code": 1061101, "msg": "tenant capacity exceeded"},
-	})
-
-	origDir, _ := os.Getwd()
-	tmpDir := t.TempDir()
-	if err := os.Chdir(tmpDir); err != nil {
-		t.Fatalf("Chdir() error: %v", err)
-	}
-	defer os.Chdir(origDir)
-
-	fh, err := os.Create("large.bin")
-	if err != nil {
-		t.Fatalf("Create() error: %v", err)
-	}
-	if err := fh.Truncate(common.MaxDriveMediaUploadSinglePartSize + 1); err != nil {
-		t.Fatalf("Truncate() error: %v", err)
-	}
-	if err := fh.Close(); err != nil {
-		t.Fatalf("Close() error: %v", err)
-	}
-
-	err = mountAndRunDrive(t, DriveUpload, []string{
-		"+upload", "--file", "large.bin", "--as", "bot",
-	}, f, stdout)
-	if err == nil {
-		t.Fatal("expected error, got nil")
-	}
-	p, ok := errs.ProblemOf(err)
-	if !ok || p.Code != 1061101 {
-		t.Fatalf("expected typed api error code 1061101, got %T (%v)", err, err)
-	}
-	if !strings.Contains(p.Hint, testDriveCapacityExpansionURL) {
-		t.Fatalf("hint = %q, want capacity expansion URL", p.Hint)
-	}
-
-	tags := decodeDriveReportTags(t, reportStub)
-	if got := tags["status"]; got != "error" {
-		t.Fatalf("tags.status = %v, want error", got)
-	}
-	if got := tags["upload_mode"]; got != "multipart" {
-		t.Fatalf("tags.upload_mode = %v, want multipart", got)
-	}
-	if got := tags["api_path"]; got != "/open-apis/drive/v1/files/upload_prepare" {
-		t.Fatalf("tags.api_path = %v, want upload_prepare", got)
-	}
-}
-
-func TestDriveUploadReportFileEventFailureKeepsUploadError(t *testing.T) {
-	uploadTestConfig := &core.CliConfig{
-		AppID: "drive-upload-report-keeps-err", AppSecret: "test-secret", Brand: core.BrandFeishu,
-	}
-	f, stdout, _, reg := cmdutil.TestFactory(t, uploadTestConfig)
-	reg.Register(&httpmock.Stub{
-		Method:   "POST",
-		URL:      driveReportFileEventPath,
-		Body:     map[string]interface{}{"code": 500, "msg": "report rejected"},
-		Reusable: true,
-	})
-	reg.Register(&httpmock.Stub{
-		Method: "POST",
-		URL:    "/open-apis/drive/v1/files/upload_all",
-		Body:   map[string]interface{}{"code": 1001, "msg": "quota exceeded"},
-	})
-
-	withDriveWorkingDir(t, t.TempDir())
-	if err := os.WriteFile("small.bin", make([]byte, 1024), 0644); err != nil {
-		t.Fatalf("WriteFile() error: %v", err)
-	}
-
-	err := mountAndRunDrive(t, DriveUpload, []string{
-		"+upload", "--file", "small.bin", "--as", "bot",
-	}, f, stdout)
-	if err == nil {
-		t.Fatal("expected error, got nil")
-	}
-	p, ok := errs.ProblemOf(err)
-	if !ok {
-		t.Fatalf("expected typed problem, got %T (%v)", err, err)
-	}
-	if p.Code != 1001 {
-		t.Fatalf("code = %d, want original upload code 1001", p.Code)
-	}
-	if !strings.Contains(err.Error(), "quota exceeded") {
-		t.Fatalf("error lost original message: %v", err)
-	}
-}

shortcuts/drive/drive_upload.go

@@ -23,13 +23,6 @@ const (
 	driveUploadParentTypeWiki     = "wiki"
 )
 
-const (
-	driveUploadAllPath     = "/open-apis/drive/v1/files/upload_all"
-	driveUploadPreparePath = "/open-apis/drive/v1/files/upload_prepare"
-	driveUploadPartPath    = "/open-apis/drive/v1/files/upload_part"
-	driveUploadFinishPath  = "/open-apis/drive/v1/files/upload_finish"
-)
-
 type driveUploadSpec struct {
 	FilePath    string
 	FileToken   string
@@ -130,15 +123,8 @@ var DriveUpload = common.Shortcut{
 		}
 		d := common.NewDryRunAPI().
 			Desc("multipart/form-data upload (files > 20MB use chunked 3-step upload), then fetch the real Drive URL via metadata").
-			POST(driveUploadAllPath).
+			POST("/open-apis/drive/v1/files/upload_all").
 			Body(body)
-		common.AppendUploadFileEventDryRun(d, runtime, common.LarkCLIFileEventMeta{
-			APIPath:      driveUploadAllPath,
-			UploadMode:   "singlepart",
-			ResourceType: "file",
-			ParentType:   target.ParentType,
-			FileToken:    "<file_token from upload response>",
-		})
 		d.POST("/open-apis/drive/v1/metas/batch_query").
 			Desc("Fetch the uploaded file's real access URL").
 			Body(map[string]interface{}{
@@ -267,35 +253,26 @@ func uploadFileToDrive(ctx context.Context, runtime *common.RuntimeContext, file
 	}
 	fd.AddFile("file", f)
 
-	meta := common.LarkCLIFileEventMeta{
-		APIPath:      driveUploadAllPath,
-		UploadMode:   "singlepart",
-		ResourceType: "file",
-		ParentType:   target.ParentType,
-	}
-
 	apiResp, err := runtime.DoAPI(&larkcore.ApiReq{
 		HttpMethod: http.MethodPost,
-		ApiPath:    driveUploadAllPath,
+		ApiPath:    "/open-apis/drive/v1/files/upload_all",
 		Body:       fd,
 	}, larkcore.WithFileUpload())
 	if err != nil {
 		if errs.IsTyped(err) {
-			return driveUploadResult{}, common.ReportUploadFileEventOnError(runtime, err, meta)
+			return driveUploadResult{}, err
 		}
-		return driveUploadResult{}, common.ReportUploadFileEventOnError(runtime, wrapDriveNetworkErr(err, "upload failed: %v", err), meta)
+		return driveUploadResult{}, wrapDriveNetworkErr(err, "upload failed: %v", err)
 	}
 
 	data, err := runtime.ClassifyAPIResponse(apiResp)
 	if err != nil {
-		return driveUploadResult{}, common.ReportUploadFileEventOnError(runtime, err, meta)
+		return driveUploadResult{}, err
 	}
 	fileToken := common.GetString(data, "file_token")
 	if fileToken == "" {
-		return driveUploadResult{}, common.ReportUploadFileEventOnError(runtime, errs.NewInternalError(errs.SubtypeInvalidResponse, "upload failed: no file_token returned"), meta)
+		return driveUploadResult{}, errs.NewInternalError(errs.SubtypeInvalidResponse, "upload failed: no file_token returned")
 	}
-	meta.FileToken = fileToken
-	common.ReportUploadFileEvent(runtime, meta)
 	return driveUploadResult{
 		FileToken: fileToken,
 		Version:   driveUploadVersionFromData(data),
@@ -317,17 +294,9 @@ func uploadFileMultipart(_ context.Context, runtime *common.RuntimeContext, file
 	if existingFileToken != "" {
 		prepareBody["file_token"] = existingFileToken
 	}
-
-	meta := common.LarkCLIFileEventMeta{
-		APIPath:      driveUploadPreparePath,
-		UploadMode:   "multipart",
-		ResourceType: "file",
-		ParentType:   target.ParentType,
-	}
-
-	prepareResult, err := runtime.CallAPITyped("POST", driveUploadPreparePath, nil, prepareBody)
+	prepareResult, err := runtime.CallAPITyped("POST", "/open-apis/drive/v1/files/upload_prepare", nil, prepareBody)
 	if err != nil {
-		return driveUploadResult{}, common.ReportUploadFileEventOnError(runtime, err, meta)
+		return driveUploadResult{}, err
 	}
 
 	uploadID := common.GetString(prepareResult, "upload_id")
@@ -337,16 +306,15 @@ func uploadFileMultipart(_ context.Context, runtime *common.RuntimeContext, file
 	blockNum := int(blockNumF)
 
 	if uploadID == "" || blockSize <= 0 || blockNum <= 0 {
-		return driveUploadResult{}, common.ReportUploadFileEventOnError(runtime, errs.NewInternalError(errs.SubtypeInvalidResponse,
+		return driveUploadResult{}, errs.NewInternalError(errs.SubtypeInvalidResponse,
 			"upload_prepare returned invalid data: upload_id=%q, block_size=%d, block_num=%d",
-			uploadID, blockSize, blockNum), meta)
+			uploadID, blockSize, blockNum)
 	}
 
 	fmt.Fprintf(runtime.IO().ErrOut, "Multipart upload: %s, block size %s, %d block(s)\n",
 		common.FormatSize(fileSize), common.FormatSize(blockSize), blockNum)
 
 	// Step 2: Upload parts
-	meta.APIPath = driveUploadPartPath
 	for seq := 0; seq < blockNum; seq++ {
 		offset := int64(seq) * blockSize
 		partSize := blockSize
@@ -356,7 +324,7 @@ func uploadFileMultipart(_ context.Context, runtime *common.RuntimeContext, file
 
 		partFile, err := runtime.FileIO().Open(filePath)
 		if err != nil {
-			return driveUploadResult{}, common.ReportUploadFileEventOnError(runtime, driveInputStatError(err), meta)
+			return driveUploadResult{}, driveInputStatError(err)
 		}
 
 		fd := larkcore.NewFormdata()
@@ -367,42 +335,39 @@ func uploadFileMultipart(_ context.Context, runtime *common.RuntimeContext, file
 
 		apiResp, err := runtime.DoAPI(&larkcore.ApiReq{
 			HttpMethod: http.MethodPost,
-			ApiPath:    driveUploadPartPath,
+			ApiPath:    "/open-apis/drive/v1/files/upload_part",
 			Body:       fd,
 		}, larkcore.WithFileUpload())
 		partFile.Close()
 		if err != nil {
 			if errs.IsTyped(err) {
-				return driveUploadResult{}, common.ReportUploadFileEventOnError(runtime, err, meta)
+				return driveUploadResult{}, err
 			}
-			return driveUploadResult{}, common.ReportUploadFileEventOnError(runtime, wrapDriveNetworkErr(err, "upload part %d/%d failed: %v", seq+1, blockNum, err), meta)
+			return driveUploadResult{}, wrapDriveNetworkErr(err, "upload part %d/%d failed: %v", seq+1, blockNum, err)
 		}
 
 		if _, err := runtime.ClassifyAPIResponse(apiResp); err != nil {
-			return driveUploadResult{}, common.ReportUploadFileEventOnError(runtime, err, meta)
+			return driveUploadResult{}, err
 		}
 
 		fmt.Fprintf(runtime.IO().ErrOut, "  Block %d/%d uploaded (%s)\n", seq+1, blockNum, common.FormatSize(partSize))
 	}
 
 	// Step 3: Finish
-	meta.APIPath = driveUploadFinishPath
 	finishBody := map[string]interface{}{
 		"upload_id": uploadID,
 		"block_num": blockNum,
 	}
-	finishResult, err := runtime.CallAPITyped("POST", driveUploadFinishPath, nil, finishBody)
+	finishResult, err := runtime.CallAPITyped("POST", "/open-apis/drive/v1/files/upload_finish", nil, finishBody)
 	if err != nil {
-		return driveUploadResult{}, common.ReportUploadFileEventOnError(runtime, err, meta)
+		return driveUploadResult{}, err
 	}
 
 	fileToken := common.GetString(finishResult, "file_token")
 	if fileToken == "" {
-		return driveUploadResult{}, common.ReportUploadFileEventOnError(runtime, errs.NewInternalError(errs.SubtypeInvalidResponse, "upload_finish succeeded but no file_token returned"), meta)
+		return driveUploadResult{}, errs.NewInternalError(errs.SubtypeInvalidResponse, "upload_finish succeeded but no file_token returned")
 	}
 
-	meta.FileToken = fileToken
-	common.ReportUploadFileEvent(runtime, meta)
 	return driveUploadResult{
 		FileToken: fileToken,
 		Version:   driveUploadVersionFromData(finishResult),

shortcuts/sheets/backward/lark_sheets_float_images.go

@@ -17,10 +17,9 @@ import (
 )
 
 // Drive media parent_type values for uploading an image into a spreadsheet.
-// Native spreadsheets use "sheet_image"; imported "office" spreadsheets use a
-// legacy synthetic-token prefix or a 28-character token whose interleaved
-// product/region marker is "OFL0X". The backend requires
-// "office_sheet_file" for those imported spreadsheets.
+// Native spreadsheets use "sheet_image"; imported "office" spreadsheets carry a
+// synthetic token prefixed with "fake_office_" (being renamed to
+// "local_office_") and the backend requires "office_sheet_file" instead.
 const (
 	sheetImageParentType      = "sheet_image"
 	officeSheetFileParentType = "office_sheet_file"
@@ -28,37 +27,22 @@ const (
 	localOfficePrefix         = "local_office_"
 )
 
-// officePrefixes are the legacy synthetic token prefixes an imported "office"
-// spreadsheet may carry.
+// officePrefixes are the synthetic token prefixes an imported "office"
+// spreadsheet may carry. The prefix is being renamed from "fake_office_" to
+// "local_office_"; accept either so image uploads keep working across the
+// rename.
 var officePrefixes = []string{fakeOfficePrefix, localOfficePrefix}
 
-func isOfficeSpreadsheet(spreadsheetToken string) bool {
+// sheetMediaParentType returns the drive media parent_type to use when
+// uploading an image whose parent_node is spreadsheetToken, mapping either the
+// "fake_office_" or "local_office_" imported-spreadsheet token prefix to
+// "office_sheet_file".
+func sheetMediaParentType(spreadsheetToken string) string {
 	for _, prefix := range officePrefixes {
 		if strings.HasPrefix(spreadsheetToken, prefix) {
-			return true
+			return officeSheetFileParentType
 		}
 	}
-	if len(spreadsheetToken) != 28 {
-		return false
-	}
-	// The five-character marker occupies positions 5, 10, 15, 20, and 25
-	// (1-based) in the interleaved token.
-	marker := []byte{
-		spreadsheetToken[4],
-		spreadsheetToken[9],
-		spreadsheetToken[14],
-		spreadsheetToken[19],
-		spreadsheetToken[24],
-	}
-	return string(marker) == "OFL0X"
-}
-
-// sheetMediaParentType returns the drive media parent_type to use when
-// uploading an image whose parent_node is spreadsheetToken.
-func sheetMediaParentType(spreadsheetToken string) string {
-	if isOfficeSpreadsheet(spreadsheetToken) {
-		return officeSheetFileParentType
-	}
 	return sheetImageParentType
 }
 

shortcuts/sheets/backward/lark_sheets_sheet_media_upload_test.go

@@ -105,7 +105,7 @@ func TestSheetMediaUploadDryRunSmallFileOfficeParentType(t *testing.T) {
 	f, stdout, _, _ := cmdutil.TestFactory(t, sheetsTestConfig())
 	err := mountAndRunSheets(t, SheetMediaUpload, []string{
 		"+media-upload",
-		"--spreadsheet-token", "aaaaOaaaaFaaaaLaaaa0aaaaXaaa",
+		"--spreadsheet-token", "fake_office_abc123",
 		"--file", "img.png",
 		"--dry-run", "--as", "user",
 	}, f, stdout)
@@ -117,10 +117,10 @@ func TestSheetMediaUploadDryRunSmallFileOfficeParentType(t *testing.T) {
 		t.Fatalf("dry-run should use upload_all for small file, got: %s", out)
 	}
 	if !strings.Contains(out, `"office_sheet_file"`) {
-		t.Fatalf("dry-run should include parent_type=office_sheet_file for interleaved OFL0X token, got: %s", out)
+		t.Fatalf("dry-run should include parent_type=office_sheet_file for fake_office_ token, got: %s", out)
 	}
 	if strings.Contains(out, `"sheet_image"`) {
-		t.Fatalf("dry-run must not emit sheet_image for interleaved OFL0X token, got: %s", out)
+		t.Fatalf("dry-run must not emit sheet_image for fake_office_ token, got: %s", out)
 	}
 }
 
@@ -239,7 +239,7 @@ func TestSheetMediaUploadExecuteSuccess(t *testing.T) {
 }
 
 // TestSheetMediaUploadExecuteOfficeParentType confirms that an imported
-// "office" spreadsheet (token carrying the interleaved "OFL0X" marker) uploads with
+// "office" spreadsheet (token prefixed with "fake_office_") uploads with
 // parent_type=office_sheet_file instead of the native sheet_image.
 func TestSheetMediaUploadExecuteOfficeParentType(t *testing.T) {
 	dir := t.TempDir()
@@ -259,7 +259,7 @@ func TestSheetMediaUploadExecuteOfficeParentType(t *testing.T) {
 	}
 	reg.Register(stub)
 
-	const officeToken = "aaaaOaaaaFaaaaLaaaa0aaaaXaaa"
+	const officeToken = "fake_office_abc123"
 	err := mountAndRunSheets(t, SheetMediaUpload, []string{
 		"+media-upload",
 		"--spreadsheet-token", officeToken,

shortcuts/sheets/helpers.go

@@ -53,10 +53,9 @@ func sheetsInputStatError(flag string, err error) error {
 }
 
 // Drive media parent_type values for uploading an image into a spreadsheet.
-// Native spreadsheets use "sheet_image"; imported "office" spreadsheets use a
-// legacy synthetic-token prefix or a 28-character token whose interleaved
-// product/region marker is "OFL0X". The backend requires
-// "office_sheet_file" for those imported spreadsheets.
+// Native spreadsheets use "sheet_image"; imported "office" spreadsheets carry a
+// synthetic token prefixed with "fake_office_" (being renamed to
+// "local_office_") and the backend requires "office_sheet_file" instead.
 const (
 	sheetImageParentType      = "sheet_image"
 	officeSheetFileParentType = "office_sheet_file"
@@ -64,38 +63,21 @@ const (
 	localOfficePrefix         = "local_office_"
 )
 
-// officePrefixes are the legacy synthetic token prefixes an imported "office"
-// spreadsheet may carry.
+// officePrefixes are the synthetic token prefixes an imported "office"
+// spreadsheet may carry. The prefix is being renamed from "fake_office_" to
+// "local_office_"; accept either so image uploads keep working across the
+// rename.
 var officePrefixes = []string{fakeOfficePrefix, localOfficePrefix}
 
-func isOfficeSpreadsheet(spreadsheetToken string) bool {
-	for _, prefix := range officePrefixes {
-		if strings.HasPrefix(spreadsheetToken, prefix) {
-			return true
-		}
-	}
-	if len(spreadsheetToken) != 28 {
-		return false
-	}
-	// The five-character marker occupies positions 5, 10, 15, 20, and 25
-	// (1-based) in the interleaved token.
-	marker := []byte{
-		spreadsheetToken[4],
-		spreadsheetToken[9],
-		spreadsheetToken[14],
-		spreadsheetToken[19],
-		spreadsheetToken[24],
-	}
-	return string(marker) == "OFL0X"
-}
-
 // sheetMediaParentType returns the drive media parent_type to use when
 // uploading an image whose parent_node is spreadsheetToken. It is the single
 // place that maps a spreadsheet token to its parent_type so every image-upload
 // entry point (and its dry-run preview) stays consistent.
 func sheetMediaParentType(spreadsheetToken string) string {
-	if isOfficeSpreadsheet(spreadsheetToken) {
-		return officeSheetFileParentType
+	for _, prefix := range officePrefixes {
+		if strings.HasPrefix(spreadsheetToken, prefix) {
+			return officeSheetFileParentType
+		}
 	}
 	return sheetImageParentType
 }

shortcuts/sheets/sheet_media_parent_type_test.go

@@ -25,9 +25,8 @@ import (
 
 // TestSheetMediaParentType pins the token→parent_type mapping that every
 // sheets image-upload entry point funnels through. Native spreadsheet tokens
-// use "sheet_image"; imported "office" spreadsheets use either a legacy
-// prefix or the interleaved "OFL0X" marker and must upload with
-// "office_sheet_file".
+// use "sheet_image"; imported "office" spreadsheets carry a "fake_office_" or
+// "local_office_" synthetic token and must upload with "office_sheet_file".
 func TestSheetMediaParentType(t *testing.T) {
 	t.Parallel()
 	cases := []struct {
@@ -41,13 +40,6 @@ func TestSheetMediaParentType(t *testing.T) {
 		{"fake_office token, only the prefix", fakeOfficePrefix, officeSheetFileParentType},
 		{"local_office imported token", "local_office_abc123", officeSheetFileParentType},
 		{"local_office token, only the prefix", localOfficePrefix, officeSheetFileParentType},
-		{"interleaved OFL0X office token", "aaaaOaaaaFaaaaLaaaa0aaaaXaaa", officeSheetFileParentType},
-		{"interleaved exlcn token", "abcdeefghxijkllmnopcqrstnuv", sheetImageParentType},
-		{"interleaved shtcn native token", "abcdsefghhijkltmnopcqrstnuv", sheetImageParentType},
-		{"interleaved pptcn token", "abcdpefghpijkltmnopcqrstnuv", sheetImageParentType},
-		{"interleaved wodcn token", "abcdwefghoijkldmnopcqrstnuv", sheetImageParentType},
-		{"interleaved OFL0X marker with short length", "aaaaOaaaaFaaaaLaaaa0aaaaXaa", sheetImageParentType},
-		{"interleaved OFL0X marker with long length", "aaaaOaaaaFaaaaLaaaa0aaaaXaaaa", sheetImageParentType},
 		{"fake_office prefix mid-string is not matched", "shtfake_office_abc", sheetImageParentType},
 		{"local_office prefix mid-string is not matched", "shtlocal_office_abc", sheetImageParentType},
 	}
@@ -65,7 +57,7 @@ func TestSheetMediaParentType(t *testing.T) {
 // to end (the Execute path the dry-run tests don't reach), asserting the
 // parent_type that actually goes out on the wire is derived from the token: a
 // native spreadsheet uploads as sheet_image, an imported "office" spreadsheet
-// (legacy prefix or interleaved OFL0X marker) as office_sheet_file.
+// (fake_office_-prefixed token) as office_sheet_file.
 func TestUploadSheetImage_ParentType(t *testing.T) {
 	cases := []struct {
 		name           string
@@ -75,7 +67,6 @@ func TestUploadSheetImage_ParentType(t *testing.T) {
 		{"native spreadsheet", "shtcnTOK123", sheetImageParentType},
 		{"fake_office imported spreadsheet", "fake_office_abc123", officeSheetFileParentType},
 		{"local_office imported spreadsheet", "local_office_abc123", officeSheetFileParentType},
-		{"interleaved OFL0X imported spreadsheet", "aaaaOaaaaFaaaaLaaaa0aaaaXaaa", officeSheetFileParentType},
 	}
 	for _, tc := range cases {
 		t.Run(tc.name, func(t *testing.T) {

shortcuts/slides/shortcuts.go

@@ -3,24 +3,11 @@
 
 package slides
 
-import (
-	"github.com/larksuite/cli/shortcuts/common"
-	"github.com/spf13/cobra"
-	"github.com/spf13/pflag"
-)
-
-var presentationFlagAliases = []string{
-	"presentation-id",
-	"presentation-token",
-	"token",
-	"presentation_id",
-	"xml-presentation-id",
-	"url",
-}
+import "github.com/larksuite/cli/shortcuts/common"
 
 // Shortcuts returns all slides shortcuts.
 func Shortcuts() []common.Shortcut {
-	all := []common.Shortcut{
+	return []common.Shortcut{
 		SlidesCreate,
 		SlidesMediaUpload,
 		SlidesReplaceSlide,
@@ -31,39 +18,4 @@ func Shortcuts() []common.Shortcut {
 		SlidesHistoryRevert,
 		SlidesHistoryRevertStatus,
 	}
-	for i := range all {
-		if hasPresentationFlag(all[i].Flags) {
-			all[i].PostMount = withPresentationFlagAliases(all[i].PostMount)
-		}
-	}
-	return all
-}
-
-func hasPresentationFlag(flags []common.Flag) bool {
-	for _, flag := range flags {
-		if flag.Name == "presentation" {
-			return true
-		}
-	}
-	return false
-}
-
-// withPresentationFlagAliases accepts common agent-generated spellings for
-// --presentation without registering extra flags. The aliases therefore stay
-// out of help and completion while resolving to the canonical flag at parse
-// time, matching the zero-round-trip compatibility used by Sheets.
-func withPresentationFlagAliases(prev func(cmd *cobra.Command)) func(cmd *cobra.Command) {
-	return func(cmd *cobra.Command) {
-		if prev != nil {
-			prev(cmd)
-		}
-		cmd.Flags().SetNormalizeFunc(func(_ *pflag.FlagSet, name string) pflag.NormalizedName {
-			for _, alias := range presentationFlagAliases {
-				if name == alias {
-					return pflag.NormalizedName("presentation")
-				}
-			}
-			return pflag.NormalizedName(name)
-		})
-	}
 }

shortcuts/slides/shortcuts_alias_test.go

@@ -1,68 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package slides
-
-import (
-	"strings"
-	"testing"
-
-	"github.com/spf13/cobra"
-)
-
-func TestWithPresentationFlagAliases(t *testing.T) {
-	for _, alias := range presentationFlagAliases {
-		t.Run(alias, func(t *testing.T) {
-			cmd := &cobra.Command{Use: "test"}
-			cmd.Flags().String("presentation", "", "presentation reference")
-			withPresentationFlagAliases(nil)(cmd)
-
-			if err := cmd.Flags().Parse([]string{"--" + alias, "presABC"}); err != nil {
-				t.Fatalf("--%s should resolve to --presentation: %v", alias, err)
-			}
-			got, err := cmd.Flags().GetString("presentation")
-			if err != nil {
-				t.Fatalf("read --presentation: %v", err)
-			}
-			if got != "presABC" {
-				t.Fatalf("--%s set --presentation to %q, want presABC", alias, got)
-			}
-			if usage := cmd.Flags().FlagUsages(); strings.Contains(usage, "--"+alias) {
-				t.Fatalf("hidden compatibility alias --%s leaked into help:\n%s", alias, usage)
-			}
-		})
-	}
-}
-
-func TestShortcutsAttachPresentationFlagAliases(t *testing.T) {
-	count := 0
-	for _, shortcut := range Shortcuts() {
-		if !hasPresentationFlag(shortcut.Flags) {
-			continue
-		}
-		count++
-		if shortcut.PostMount == nil {
-			t.Errorf("%s has --presentation but no compatibility normalizer", shortcut.Command)
-			continue
-		}
-
-		cmd := &cobra.Command{Use: shortcut.Command}
-		cmd.Flags().String("presentation", "", "presentation reference")
-		shortcut.PostMount(cmd)
-		if err := cmd.Flags().Parse([]string{"--token", "presABC"}); err != nil {
-			t.Errorf("%s did not normalize --token: %v", shortcut.Command, err)
-			continue
-		}
-		got, err := cmd.Flags().GetString("presentation")
-		if err != nil {
-			t.Errorf("%s could not read --presentation: %v", shortcut.Command, err)
-			continue
-		}
-		if got != "presABC" {
-			t.Errorf("%s normalized --token to %q, want presABC", shortcut.Command, got)
-		}
-	}
-	if count == 0 {
-		t.Fatal("expected at least one slides shortcut with --presentation")
-	}
-}

shortcuts/slides/slides_screenshot.go

@@ -37,13 +37,15 @@ var SlidesScreenshot = common.Shortcut{
 	Command:     "+screenshot",
 	Description: "Save up to 10 slide screenshots to local files without printing Base64 image data",
 	Risk:        "read",
-	Scopes:      []string{"slides:presentation:screenshot"},
+	Scopes:      []string{},
+	// The screenshot API is allowlist-gated for only a few apps, so do not
+	// advertise/preflight its scope. Let the API fail and let callers degrade.
 	// wiki:node:read is required only when --presentation is a wiki URL.
 	ConditionalScopes: []string{"wiki:node:read"},
 	AuthTypes:         []string{"user", "bot"},
 	Flags: []common.Flag{
 		{Name: "presentation", Desc: "xml_presentation_id, slides URL, or wiki URL that resolves to slides; list mode only"},
-		{Name: "slide-id", Type: "string_slice", Desc: "slide page identifier (repeat or comma-separated for multiple slides; max 10 pages per request)"},
+		{Name: "slide-id", Type: "string_array", Desc: "slide page identifier (repeat for multiple slides; max 10 pages per request)"},
 		{Name: "slide-number", Type: "int_array", Desc: "slide page number (repeat for multiple slides; max 10 pages per request)"},
 		{Name: "content", Desc: "slide XML content to render directly instead of fetching existing slides", Input: []string{common.File, common.Stdin}},
 		{Name: "output-dir", Default: defaultSlidesScreenshotDir, Desc: "relative directory for saved screenshots"},
@@ -55,7 +57,7 @@ var SlidesScreenshot = common.Shortcut{
 			if strings.TrimSpace(runtime.Str("content")) == "" {
 				return slidesScreenshotFlagErrorf("--content cannot be empty")
 			}
-			if len(normalizeSlideIDs(runtime.StrSlice("slide-id"))) > 0 || len(runtime.IntArray("slide-number")) > 0 {
+			if len(normalizeSlideIDs(runtime.StrArray("slide-id"))) > 0 || len(runtime.IntArray("slide-number")) > 0 {
 				return slidesScreenshotFlagErrorf("--content cannot be used with --slide-id or --slide-number")
 			}
 			if runtime.Changed("presentation") {
@@ -71,7 +73,7 @@ var SlidesScreenshot = common.Shortcut{
 					return err
 				}
 			}
-			slideIDs := normalizeSlideIDs(runtime.StrSlice("slide-id"))
+			slideIDs := normalizeSlideIDs(runtime.StrArray("slide-id"))
 			slideNumbers, err := normalizeSlideNumbers(runtime.IntArray("slide-number"))
 			if err != nil {
 				return err
@@ -96,7 +98,7 @@ var SlidesScreenshot = common.Shortcut{
 		if err != nil {
 			return common.NewDryRunAPI().Set("error", err.Error())
 		}
-		slideIDs := normalizeSlideIDs(runtime.StrSlice("slide-id"))
+		slideIDs := normalizeSlideIDs(runtime.StrArray("slide-id"))
 		slideNumbers, err := normalizeSlideNumbers(runtime.IntArray("slide-number"))
 		if err != nil {
 			return common.NewDryRunAPI().Set("error", err.Error())
@@ -146,7 +148,7 @@ var SlidesScreenshot = common.Shortcut{
 			return err
 		}
 
-		slideIDs := normalizeSlideIDs(runtime.StrSlice("slide-id"))
+		slideIDs := normalizeSlideIDs(runtime.StrArray("slide-id"))
 		slideNumbers, err := normalizeSlideNumbers(runtime.IntArray("slide-number"))
 		if err != nil {
 			return err
@@ -198,7 +200,7 @@ func dryRunRenderScreenshot(runtime *common.RuntimeContext) *common.DryRunAPI {
 	if strings.TrimSpace(content) == "" {
 		return common.NewDryRunAPI().Set("error", "--content cannot be empty")
 	}
-	if len(normalizeSlideIDs(runtime.StrSlice("slide-id"))) > 0 || len(runtime.IntArray("slide-number")) > 0 {
+	if len(normalizeSlideIDs(runtime.StrArray("slide-id"))) > 0 || len(runtime.IntArray("slide-number")) > 0 {
 		return common.NewDryRunAPI().Set("error", "--content cannot be used with --slide-id or --slide-number")
 	}
 	if runtime.Changed("presentation") {
@@ -217,7 +219,7 @@ func executeRenderScreenshot(runtime *common.RuntimeContext) error {
 	if strings.TrimSpace(content) == "" {
 		return slidesScreenshotFlagErrorf("--content cannot be empty")
 	}
-	if len(normalizeSlideIDs(runtime.StrSlice("slide-id"))) > 0 || len(runtime.IntArray("slide-number")) > 0 {
+	if len(normalizeSlideIDs(runtime.StrArray("slide-id"))) > 0 || len(runtime.IntArray("slide-number")) > 0 {
 		return slidesScreenshotFlagErrorf("--content cannot be used with --slide-id or --slide-number")
 	}
 	if runtime.Changed("presentation") {

shortcuts/slides/slides_screenshot_test.go

@@ -8,7 +8,6 @@ import (
 	"encoding/json"
 	"os"
 	"path/filepath"
-	"reflect"
 	"strings"
 	"testing"
 
@@ -18,19 +17,23 @@ import (
 )
 
 func TestSlidesScreenshotDeclaredScopes(t *testing.T) {
-	base := []string{"slides:presentation:screenshot"}
-	if got := SlidesScreenshot.ScopesForIdentity("user"); !reflect.DeepEqual(got, base) {
-		t.Fatalf("user preflight scopes = %#v, want %#v", got, base)
+	if got := SlidesScreenshot.ScopesForIdentity("user"); len(got) != 0 {
+		t.Fatalf("user preflight scopes = %#v, want empty", got)
 	}
-	if got := SlidesScreenshot.ScopesForIdentity("bot"); !reflect.DeepEqual(got, base) {
-		t.Fatalf("bot preflight scopes = %#v, want %#v", got, base)
+	if got := SlidesScreenshot.ScopesForIdentity("bot"); len(got) != 0 {
+		t.Fatalf("bot preflight scopes = %#v, want empty", got)
 	}
 
 	got := SlidesScreenshot.DeclaredScopesForIdentity("user")
-	want := []string{"slides:presentation:screenshot", "wiki:node:read"}
-	if !reflect.DeepEqual(got, want) {
+	want := []string{"wiki:node:read"}
+	if len(got) != len(want) || got[0] != want[0] {
 		t.Fatalf("declared scopes = %#v, want %#v", got, want)
 	}
+	for _, scope := range got {
+		if scope == "slides:presentation:screenshot" {
+			t.Fatalf("declared scopes must not advertise screenshot scope: %#v", got)
+		}
+	}
 }
 
 func TestSlidesScreenshotWritesFilesAndSuppressesBase64(t *testing.T) {
@@ -185,139 +188,6 @@ func TestSlidesScreenshotListBySlideNumber(t *testing.T) {
 	}
 }
 
-func TestSlidesScreenshotListBySlideIDCSV(t *testing.T) {
-	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
-	dir := t.TempDir()
-	withSlidesTestWorkingDir(t, dir)
-
-	f, stdout, _, reg := cmdutil.TestFactory(t, slidesTestConfig(t, ""))
-	stub := &httpmock.Stub{
-		Method: "POST",
-		URL:    "/open-apis/slides_ai/v1/xml_presentations/pres_abc/slide_images",
-		Body: map[string]interface{}{
-			"code": 0,
-			"data": map[string]interface{}{
-				"slide_images": []map[string]interface{}{
-					{
-						"slide_id": "slide_1",
-						"format":   1,
-						"data":     base64.StdEncoding.EncodeToString([]byte("png-bytes-1")),
-					},
-					{
-						"slide_id": "slide_2",
-						"format":   1,
-						"data":     base64.StdEncoding.EncodeToString([]byte("png-bytes-2")),
-					},
-				},
-			},
-		},
-	}
-	reg.Register(stub)
-
-	err := runSlidesShortcut(t, f, stdout, SlidesScreenshot, []string{
-		"+screenshot",
-		"--presentation", "pres_abc",
-		"--slide-id", "slide_1,slide_2",
-		"--as", "user",
-	})
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-
-	var body struct {
-		SlideIDs []string `json:"slide_ids"`
-	}
-	if err := json.Unmarshal(stub.CapturedBody, &body); err != nil {
-		t.Fatalf("decode request body: %v", err)
-	}
-	if len(body.SlideIDs) != 2 || body.SlideIDs[0] != "slide_1" || body.SlideIDs[1] != "slide_2" {
-		t.Fatalf("slide_ids = %#v, want [slide_1 slide_2]", body.SlideIDs)
-	}
-
-	path1 := filepath.Join(dir, defaultSlidesScreenshotDir, "pres_abc_slide_1.png")
-	if _, err := os.ReadFile(path1); err != nil {
-		t.Fatalf("read first CSV slide screenshot: %v", err)
-	}
-	path2 := filepath.Join(dir, defaultSlidesScreenshotDir, "pres_abc_slide_2.png")
-	if _, err := os.ReadFile(path2); err != nil {
-		t.Fatalf("read second CSV slide screenshot: %v", err)
-	}
-}
-
-func TestSlidesScreenshotListBySlideIDCSVDeduplicatesAndTrims(t *testing.T) {
-	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
-	dir := t.TempDir()
-	withSlidesTestWorkingDir(t, dir)
-
-	f, stdout, _, reg := cmdutil.TestFactory(t, slidesTestConfig(t, ""))
-	stub := &httpmock.Stub{
-		Method: "POST",
-		URL:    "/open-apis/slides_ai/v1/xml_presentations/pres_abc/slide_images",
-		Body: map[string]interface{}{
-			"code": 0,
-			"data": map[string]interface{}{
-				"slide_images": []map[string]interface{}{
-					{
-						"slide_id": "slide_1",
-						"format":   1,
-						"data":     base64.StdEncoding.EncodeToString([]byte("png-bytes-1")),
-					},
-					{
-						"slide_id": "slide_2",
-						"format":   1,
-						"data":     base64.StdEncoding.EncodeToString([]byte("png-bytes-2")),
-					},
-				},
-			},
-		},
-	}
-	reg.Register(stub)
-
-	// CSV with a duplicate and blank segments should normalize the same way
-	// normalizeSlideIDs already does for repeated --slide-id flags.
-	err := runSlidesShortcut(t, f, stdout, SlidesScreenshot, []string{
-		"+screenshot",
-		"--presentation", "pres_abc",
-		"--slide-id", "slide_1, slide_2,slide_1,",
-		"--as", "user",
-	})
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-
-	var body struct {
-		SlideIDs []string `json:"slide_ids"`
-	}
-	if err := json.Unmarshal(stub.CapturedBody, &body); err != nil {
-		t.Fatalf("decode request body: %v", err)
-	}
-	if len(body.SlideIDs) != 2 || body.SlideIDs[0] != "slide_1" || body.SlideIDs[1] != "slide_2" {
-		t.Fatalf("slide_ids = %#v, want deduplicated [slide_1 slide_2]", body.SlideIDs)
-	}
-}
-
-func TestSlidesScreenshotListRejectsMoreThanTenSlideIDsCSV(t *testing.T) {
-	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
-	f, stdout, _, _ := cmdutil.TestFactory(t, slidesTestConfig(t, ""))
-
-	err := runSlidesShortcut(t, f, stdout, SlidesScreenshot, []string{
-		"+screenshot",
-		"--presentation", "pres_abc",
-		"--slide-id", "s1,s2,s3,s4,s5,s6,s7,s8,s9,s10,s11",
-		"--as", "user",
-	})
-	if err == nil {
-		t.Fatal("expected error")
-	}
-	problem, ok := errs.ProblemOf(err)
-	if !ok {
-		t.Fatalf("error = %v, want typed validation error", err)
-	}
-	if problem.Hint != "request at most 10 pages at a time" {
-		t.Fatalf("hint = %q, want max 10 pages guidance", problem.Hint)
-	}
-}
-
 func TestSlidesScreenshotAvoidsOverwritingExistingFile(t *testing.T) {
 	dir := t.TempDir()
 	withSlidesTestWorkingDir(t, dir)
@@ -520,27 +390,6 @@ func TestSlidesScreenshotRenderRejectsSlideSelectors(t *testing.T) {
 	}
 }
 
-func TestSlidesScreenshotRenderRejectsSlideNumberSelector(t *testing.T) {
-	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
-	f, stdout, _, _ := cmdutil.TestFactory(t, slidesTestConfig(t, ""))
-
-	// Exercises the --slide-number-only side of the --content conflict check
-	// (TestSlidesScreenshotRenderRejectsSlideSelectors above only covers the
-	// --slide-id side of that same `||` condition).
-	err := runSlidesShortcut(t, f, stdout, SlidesScreenshot, []string{
-		"+screenshot",
-		"--content", `<slide xmlns="http://www.larkoffice.com/sml/2.0"><data></data></slide>`,
-		"--slide-number", "1",
-		"--as", "user",
-	})
-	if err == nil {
-		t.Fatal("expected error")
-	}
-	if !strings.Contains(err.Error(), "--content cannot be used with --slide-id or --slide-number") {
-		t.Fatalf("error = %v, want content/slide selector conflict", err)
-	}
-}
-
 func TestSlidesScreenshotRenderRejectsListOnlyFlags(t *testing.T) {
 	f, stdout, _, _ := cmdutil.TestFactory(t, slidesTestConfig(t, ""))
 

shortcuts/slides/slides_xml_get.go

@@ -16,9 +16,10 @@ import (
 )
 
 // SlidesXMLGet fetches the full XML presentation content. When --output is
-// provided it writes to a local file; otherwise it returns the XML in the
-// standard JSON envelope. Use --slide-id or --slide-number to fetch one page,
-// and use --raw for direct XML stdout.
+// provided it writes reindented XML to a local file, and --raw prints
+// reindented XML to stdout; otherwise it returns the server's original
+// content unmodified in the standard JSON envelope. Use --slide-id or
+// --slide-number to fetch one page.
 var SlidesXMLGet = common.Shortcut{
 	Service:     "slides",
 	Command:     "+xml-get",
@@ -30,8 +31,8 @@ var SlidesXMLGet = common.Shortcut{
 	AuthTypes:         []string{"user", "bot"},
 	Flags: []common.Flag{
 		{Name: "presentation", Desc: "xml_presentation_id, slides URL, or wiki URL that resolves to slides", Required: true},
-		{Name: "output", Desc: "local XML output path; must be a relative path within the current directory; existing file is overwritten; omit to return XML in the JSON envelope"},
-		{Name: "raw", Type: "bool", Desc: "print raw XML to stdout instead of the JSON envelope; incompatible with --output and --jq"},
+		{Name: "output", Desc: "local XML output path; the saved file is formatted for readability; must be a relative path within the current directory; existing file is overwritten; omit to return the server's original XML in the JSON envelope"},
+		{Name: "raw", Type: "bool", Desc: "print formatted XML to stdout without the JSON envelope; incompatible with --output and --jq"},
 		{Name: "slide-id", Desc: "slide page identifier; omit both slide selectors to fetch full presentation XML"},
 		{Name: "slide-number", Type: "int", Desc: "1-based slide page number; omit both slide selectors to fetch full presentation XML"},
 		{Name: "revision-id", Type: "int", Default: "-1", Desc: "presentation revision_id; -1 means latest"},
@@ -108,10 +109,10 @@ var SlidesXMLGet = common.Shortcut{
 		}
 		dry.GET(path).Params(params)
 		if outputPath := strings.TrimSpace(runtime.Str("output")); outputPath != "" {
-			return dry.Set("output", outputPath).Set("stdout_content", "suppressed; XML content is saved to --output during execution")
+			return dry.Set("output", outputPath).Set("stdout_content", "suppressed; formatted XML content is saved to --output during execution")
 		}
 		if runtime.Bool("raw") {
-			return dry.Set("output", "<stdout>").Set("stdout_content", "raw XML content is printed to stdout during execution")
+			return dry.Set("output", "<stdout>").Set("stdout_content", "formatted XML content is printed to stdout during execution")
 		}
 		return dry.Set("output", "<stdout>").Set("stdout_content", "JSON envelope with XML content is printed to stdout during execution")
 	},
@@ -250,22 +251,31 @@ func fetchSlidesXMLGetContent(runtime *common.RuntimeContext, presentationID str
 	return content, out, nil
 }
 
+// outputSlidesXMLGetContent routes the fetched XML to its output surface.
+// Only the text surfaces are reindented: --raw stdout and --output files are
+// read directly by humans and line tools. The JSON envelope carries the
+// server content verbatim instead -- inside a JSON string every newline is
+// escaped to \n, so formatting there buys no readability and only inflates
+// the payload, while passthrough keeps that read path byte-exact without
+// even parsing the content.
 func outputSlidesXMLGetContent(runtime *common.RuntimeContext, content string, outputPath string, out map[string]interface{}) error {
 	if outputPath == "" {
 		if !runtime.Bool("raw") {
 			runtime.OutFormatRaw(out, nil, nil)
 			return nil
 		}
-		if _, err := fmt.Fprint(runtime.IO().Out, content); err != nil {
+		formatted, _ := prettyPrintXMLOrOriginal(runtime, content)
+		if _, err := fmt.Fprint(runtime.IO().Out, formatted); err != nil {
 			return errs.NewInternalError(errs.SubtypeFileIO, "write XML content to stdout: %v", err).WithCause(err)
 		}
 		return nil
 	}
 
+	formatted, prettyPrinted := prettyPrintXMLOrOriginal(runtime, content)
 	result, err := runtime.FileIO().Save(outputPath, fileio.SaveOptions{
 		ContentType:   "application/xml",
-		ContentLength: int64(len(content)),
-	}, bytes.NewReader([]byte(content)))
+		ContentLength: int64(len(formatted)),
+	}, bytes.NewReader([]byte(formatted)))
 	if err != nil {
 		return common.WrapSaveErrorTyped(err)
 	}
@@ -280,6 +290,7 @@ func outputSlidesXMLGetContent(runtime *common.RuntimeContext, content string, o
 		"path":                resolvedPath,
 		"size":                result.Size(),
 		"content_saved":       true,
+		"pretty_printed":      prettyPrinted,
 	}
 	for _, key := range []string{"revision_id", "remove_attr_id", "slide_id", "slide_number"} {
 		if value, ok := out[key]; ok {
@@ -289,3 +300,17 @@ func outputSlidesXMLGetContent(runtime *common.RuntimeContext, content string, o
 	runtime.Out(fileOut, nil)
 	return nil
 }
+
+// prettyPrintXMLOrOriginal keeps xml-get best-effort: if the server returns
+// content that is not strictly valid XML, callers still receive the original
+// content and a warning on stderr instead of losing the read path. The bool
+// reports whether pretty-printing succeeded, surfaced as pretty_printed in
+// --output file metadata.
+func prettyPrintXMLOrOriginal(runtime *common.RuntimeContext, xmlContent string) (string, bool) {
+	out, err := prettyPrintXML(xmlContent)
+	if err != nil {
+		fmt.Fprintf(runtime.IO().ErrOut, "warning: XML pretty-print skipped; returning original server content: %v\n", err)
+		return xmlContent, false
+	}
+	return out, true
+}

shortcuts/slides/slides_xml_get_test.go

@@ -23,6 +23,10 @@ func TestSlidesXMLGetWritesContentToFileAndSuppressesXML(t *testing.T) {
 	withSlidesTestWorkingDir(t, dir)
 
 	xml := `<presentation><slide id="s1"><shape id="a">hello</shape></slide></presentation>`
+	// Golden value computed independently of prettyPrintXML (not derived by
+	// calling it): a bug in prettyPrintXML itself must not be able to make
+	// this assertion pass by construction.
+	wantXML := "<presentation>\n  <slide id=\"s1\">\n    <shape id=\"a\">hello</shape>\n  </slide>\n</presentation>\n"
 	var capturedQuery url.Values
 	f, stdout, _, reg := cmdutil.TestFactory(t, slidesTestConfig(t, ""))
 	reg.Register(&httpmock.Stub{
@@ -60,10 +64,10 @@ func TestSlidesXMLGetWritesContentToFileAndSuppressesXML(t *testing.T) {
 	if err != nil {
 		t.Fatalf("read saved XML: %v", err)
 	}
-	if string(got) != xml {
-		t.Fatalf("saved XML = %q, want %q", got, xml)
+	if string(got) != wantXML {
+		t.Fatalf("saved XML = %q, want %q", got, wantXML)
 	}
-	if strings.Contains(stdout.String(), xml) {
+	if strings.Contains(stdout.String(), wantXML) {
 		t.Fatalf("stdout leaked full XML content: %s", stdout.String())
 	}
 	if got := capturedQuery.Get("revision_id"); got != "7" {
@@ -80,8 +84,11 @@ func TestSlidesXMLGetWritesContentToFileAndSuppressesXML(t *testing.T) {
 	if data["revision_id"] != float64(7) {
 		t.Fatalf("revision_id = %v, want 7", data["revision_id"])
 	}
-	if data["size"] != float64(len(xml)) {
-		t.Fatalf("size = %v, want %d", data["size"], len(xml))
+	if data["pretty_printed"] != true {
+		t.Fatalf("pretty_printed = %v, want true", data["pretty_printed"])
+	}
+	if data["size"] != float64(len(wantXML)) {
+		t.Fatalf("size = %v, want %d", data["size"], len(wantXML))
 	}
 	gotPath, _ := data["path"].(string)
 	if !filepath.IsAbs(gotPath) {
@@ -96,7 +103,12 @@ func TestSlidesXMLGetReturnsContentEnvelopeWhenOutputOmitted(t *testing.T) {
 	dir := t.TempDir()
 	withSlidesTestWorkingDir(t, dir)
 
-	xml := `<presentation><slide id="s1"><shape id="a">hello</shape></slide></presentation>`
+	// The JSON envelope carries the server content verbatim: no reindentation
+	// and no parse/reserialize cycle. Reintroducing the in-repo formatter
+	// would fail this by inserting indentation; the &#32; reference
+	// additionally guards against a naive parse-and-reserialize round trip,
+	// which would decode it to a literal space.
+	xml := `<presentation><slide id="s1"><shape id="a"><content><p><span>Hello</span>&#32;<strong>World</strong></p></content></shape></slide></presentation>`
 	f, stdout, _, reg := cmdutil.TestFactory(t, slidesTestConfig(t, ""))
 	reg.Register(&httpmock.Stub{
 		Method: "GET",
@@ -122,11 +134,14 @@ func TestSlidesXMLGetReturnsContentEnvelopeWhenOutputOmitted(t *testing.T) {
 	data := decodeShortcutData(t, stdout)
 	presentation := data["xml_presentation"].(map[string]interface{})
 	if got := presentation["content"]; got != xml {
-		t.Fatalf("content = %q, want %q", got, xml)
+		t.Fatalf("content = %q, want the server content verbatim %q", got, xml)
 	}
 	if got := data["xml_presentation_id"]; got != "pres_abc" {
 		t.Fatalf("xml_presentation_id = %v, want pres_abc", got)
 	}
+	if _, ok := data["pretty_printed"]; ok {
+		t.Fatalf("pretty_printed should not appear in the envelope: %#v", data)
+	}
 	if strings.Contains(stdout.String(), "content_saved") {
 		t.Fatalf("stdout should not contain file metadata: %s", stdout.String())
 	}
@@ -136,6 +151,8 @@ func TestSlidesXMLGetJqFiltersContentEnvelopeWhenOutputOmitted(t *testing.T) {
 	dir := t.TempDir()
 	withSlidesTestWorkingDir(t, dir)
 
+	// --jq extracts fields from the envelope, and the envelope carries the
+	// server content verbatim, so the filter yields the single-line original.
 	xml := `<presentation><slide id="s1"><shape id="a">hello</shape></slide></presentation>`
 	f, stdout, _, reg := cmdutil.TestFactory(t, slidesTestConfig(t, ""))
 	reg.Register(&httpmock.Stub{
@@ -161,15 +178,18 @@ func TestSlidesXMLGetJqFiltersContentEnvelopeWhenOutputOmitted(t *testing.T) {
 		t.Fatalf("unexpected error: %v", err)
 	}
 	if got := strings.TrimSpace(stdout.String()); got != xml {
-		t.Fatalf("stdout = %q, want XML content %q", got, xml)
+		t.Fatalf("stdout = %q, want the server content verbatim %q", got, xml)
 	}
 }
 
-func TestSlidesXMLGetPrintsRawContentWhenRaw(t *testing.T) {
+func TestSlidesXMLGetPrintsFormattedContentWithoutEnvelopeWhenRaw(t *testing.T) {
 	dir := t.TempDir()
 	withSlidesTestWorkingDir(t, dir)
 
 	xml := `<presentation><slide id="s1"><shape id="a">hello</shape></slide></presentation>`
+	// Golden value computed independently of prettyPrintXML; see the comment
+	// in TestSlidesXMLGetWritesContentToFileAndSuppressesXML.
+	wantXML := "<presentation>\n  <slide id=\"s1\">\n    <shape id=\"a\">hello</shape>\n  </slide>\n</presentation>\n"
 	f, stdout, _, reg := cmdutil.TestFactory(t, slidesTestConfig(t, ""))
 	reg.Register(&httpmock.Stub{
 		Method: "GET",
@@ -193,16 +213,32 @@ func TestSlidesXMLGetPrintsRawContentWhenRaw(t *testing.T) {
 	if err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
-	if got := stdout.String(); got != xml {
-		t.Fatalf("stdout = %q, want raw XML %q", got, xml)
+	if got := stdout.String(); got != wantXML {
+		t.Fatalf("stdout = %q, want formatted XML %q", got, wantXML)
 	}
 }
 
+func TestSlidesXMLGetRawFlagDocumentsFormattedOutput(t *testing.T) {
+	for _, flag := range SlidesXMLGet.Flags {
+		if flag.Name != "raw" {
+			continue
+		}
+		if !strings.Contains(flag.Desc, "formatted XML") || strings.Contains(flag.Desc, "raw XML") {
+			t.Fatalf("--raw description = %q, want formatted XML without a raw-payload claim", flag.Desc)
+		}
+		return
+	}
+	t.Fatal("--raw flag not found")
+}
+
 func TestSlidesXMLGetFetchesSingleSlideByIDToFile(t *testing.T) {
 	dir := t.TempDir()
 	withSlidesTestWorkingDir(t, dir)
 
 	xml := `<slide id="slide_1"><data><shape id="a"/></data></slide>`
+	// Golden value computed independently of prettyPrintXML; see the comment
+	// in TestSlidesXMLGetWritesContentToFileAndSuppressesXML.
+	wantXML := "<slide id=\"slide_1\">\n  <data>\n    <shape id=\"a\"/>\n  </data>\n</slide>\n"
 	var capturedQuery url.Values
 	f, stdout, _, reg := cmdutil.TestFactory(t, slidesTestConfig(t, ""))
 	reg.Register(&httpmock.Stub{
@@ -244,8 +280,8 @@ func TestSlidesXMLGetFetchesSingleSlideByIDToFile(t *testing.T) {
 	if err != nil {
 		t.Fatalf("read saved slide XML: %v", err)
 	}
-	if string(got) != xml {
-		t.Fatalf("saved XML = %q, want %q", got, xml)
+	if string(got) != wantXML {
+		t.Fatalf("saved XML = %q, want %q", got, wantXML)
 	}
 	data := decodeShortcutData(t, stdout)
 	if data["scope"] != "slide" {
@@ -263,6 +299,8 @@ func TestSlidesXMLGetFetchesSingleSlideByNumberEnvelope(t *testing.T) {
 	dir := t.TempDir()
 	withSlidesTestWorkingDir(t, dir)
 
+	// The slide envelope carries the server content verbatim, like the
+	// presentation envelope.
 	xml := `<slide id="slide_2"><data><shape id="b"/></data></slide>`
 	var capturedQuery url.Values
 	f, stdout, _, reg := cmdutil.TestFactory(t, slidesTestConfig(t, ""))
@@ -305,11 +343,14 @@ func TestSlidesXMLGetFetchesSingleSlideByNumberEnvelope(t *testing.T) {
 	}
 	slide := data["slide"].(map[string]interface{})
 	if slide["content"] != xml {
-		t.Fatalf("content = %q, want %q", slide["content"], xml)
+		t.Fatalf("content = %q, want the server content verbatim %q", slide["content"], xml)
 	}
 	if slide["slide_id"] != "slide_2" {
 		t.Fatalf("slide.slide_id = %v, want slide_2", slide["slide_id"])
 	}
+	if _, ok := data["pretty_printed"]; ok {
+		t.Fatalf("pretty_printed should not appear in the envelope: %#v", data)
+	}
 }
 
 func TestSlidesXMLGetResolvesWikiPresentation(t *testing.T) {
@@ -515,3 +556,341 @@ func TestSlidesXMLGetRejectsRemoveAttrIDForSingleSlide(t *testing.T) {
 		t.Fatalf("param = %q, want --remove-attr-id", validationErr.Param)
 	}
 }
+
+func TestPrettyPrintXML(t *testing.T) {
+	input := `<presentation id="p1" xmlns="http://www.larkoffice.com/sml/2.0" width="960"><slide id="s1"><style><fill id="f1"><fillColor color="rgba(0,0,0,1)"/></fill></style><data/></slide></presentation>`
+
+	got, err := prettyPrintXML(input)
+	if err != nil {
+		t.Fatalf("prettyPrintXML: %v", err)
+	}
+	if !strings.Contains(got, "\n") {
+		t.Fatalf("expected reindented output with newlines, got %q", got)
+	}
+	if n := strings.Count(got, `xmlns="http://www.larkoffice.com/sml/2.0"`); n != 1 {
+		t.Fatalf("expected the xmlns declaration to appear exactly once, got %d occurrences in %q", n, got)
+	}
+	if !strings.Contains(got, "<data/>") {
+		t.Fatalf("expected empty <data/> to stay self-closing, got %q", got)
+	}
+	if !strings.Contains(got, `<fillColor color="rgba(0,0,0,1)"/>`) {
+		t.Fatalf("expected attributes to be preserved on their element, got %q", got)
+	}
+}
+
+func TestPrettyPrintXMLRejectsMalformedInput(t *testing.T) {
+	if _, err := prettyPrintXML(`<presentation><slide></presentation>`); err == nil {
+		t.Fatal("expected an error for malformed XML, got nil")
+	}
+}
+
+// TestPrettyPrintXMLPreservesEscapedWhitespaceReferences covers the schema's
+// documented space/tab escape idiom (slides_xml_schema_definition.xml, <p>
+// element docs) and CR/LF references whose lexical form is needed to avoid
+// XML line-ending normalization on a later parse. An XML parser decodes the
+// references into literal whitespace. The formatter must preserve their
+// lexical representation for safe read-modify-write workflows.
+func TestPrettyPrintXMLPreservesEscapedWhitespaceReferences(t *testing.T) {
+	tests := []struct {
+		name  string
+		input string
+		want  string
+	}{
+		{"space in p", `<content><p>&#32;</p></content>`, "<content>\n  <p>&#32;</p>\n</content>\n"},
+		{"tab in p", `<content><p>&#9;</p></content>`, "<content>\n  <p>&#9;</p>\n</content>\n"},
+		{"space in nested span", `<content><p><span>&#32;</span></p></content>`, "<content>\n  <p><span>&#32;</span></p>\n</content>\n"},
+		{"hex space", `<content><p>&#x20;</p></content>`, "<content>\n  <p>&#x20;</p>\n</content>\n"},
+		{"zero-padded tab", `<content><p>&#0009;</p></content>`, "<content>\n  <p>&#0009;</p>\n</content>\n"},
+		{"carriage return", `<content><p>A&#13;B</p></content>`, "<content>\n  <p>A&#13;B</p>\n</content>\n"},
+		{"line feed", `<content><p>A&#10;B</p></content>`, "<content>\n  <p>A&#10;B</p>\n</content>\n"},
+		{"hex carriage return", `<content><p>A&#xD;B</p></content>`, "<content>\n  <p>A&#xD;B</p>\n</content>\n"},
+		{"hex line feed", `<content><p>A&#xA;B</p></content>`, "<content>\n  <p>A&#xA;B</p>\n</content>\n"},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := prettyPrintXML(tt.input)
+			if err != nil {
+				t.Fatalf("prettyPrintXML(%q): %v", tt.input, err)
+			}
+			if got != tt.want {
+				t.Fatalf("prettyPrintXML(%q) = %q, want %q", tt.input, got, tt.want)
+			}
+		})
+	}
+}
+
+func TestPrettyPrintXMLPreservesTextOnlyLeafWhitespace(t *testing.T) {
+	tests := []struct {
+		name  string
+		input string
+		want  string
+	}{
+		{
+			name:  "title literal space",
+			input: `<presentation><title> </title><slide/></presentation>`,
+			want:  "<presentation>\n  <title> </title>\n  <slide/>\n</presentation>\n",
+		},
+		{
+			name:  "title escaped space",
+			input: `<presentation><title>&#32;</title><slide/></presentation>`,
+			want:  "<presentation>\n  <title>&#32;</title>\n  <slide/>\n</presentation>\n",
+		},
+		{
+			name:  "title whitespace CDATA",
+			input: `<presentation><title><![CDATA[   ]]></title><slide/></presentation>`,
+			want:  "<presentation>\n  <title><![CDATA[   ]]></title>\n  <slide/>\n</presentation>\n",
+		},
+		{
+			name:  "chart field literal space",
+			input: `<chartData><chartField name="x"> </chartField></chartData>`,
+			want:  "<chartData>\n  <chartField name=\"x\"> </chartField>\n</chartData>\n",
+		},
+		{
+			name:  "title adjacent text and CDATA",
+			input: `<presentation><title> <![CDATA[ ]]></title><slide/></presentation>`,
+			want:  "<presentation>\n  <title> <![CDATA[ ]]></title>\n  <slide/>\n</presentation>\n",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := prettyPrintXML(tt.input)
+			if err != nil {
+				t.Fatalf("prettyPrintXML(%q): %v", tt.input, err)
+			}
+			if got != tt.want {
+				t.Fatalf("prettyPrintXML(%q) = %q, want %q", tt.input, got, tt.want)
+			}
+		})
+	}
+}
+
+// TestPrettyPrintXMLPreservesEscapedSpaceBetweenInlineSiblings is the
+// critical case: &#32; sitting as a bare sibling text node directly between
+// two inline elements, not wrapped in its own tag -- the literal reading of
+// the schema's "标签之间...请使用&#32;" guidance, e.g. a plain-styled space
+// between two differently formatted words at a pptx run boundary. A fix
+// that only special-cases "element whose sole content is whitespace" does
+// not cover this: the whitespace here is one of several children of <p>,
+// not the sole child of <span>.
+func TestPrettyPrintXMLPreservesEscapedSpaceBetweenInlineSiblings(t *testing.T) {
+	input := `<content><p><span>Hello</span>&#32;<strong>World</strong></p></content>`
+	want := "<content>\n  <p><span>Hello</span>&#32;<strong>World</strong></p>\n</content>\n"
+	got, err := prettyPrintXML(input)
+	if err != nil {
+		t.Fatalf("prettyPrintXML: %v", err)
+	}
+	if got != want {
+		t.Fatalf("prettyPrintXML(%q) = %q, want %q", input, got, want)
+	}
+}
+
+func TestPrettyPrintXMLPreservesCDATA(t *testing.T) {
+	input := `<content><p><![CDATA[a-->b & <c>]]></p></content>`
+	want := "<content>\n  <p><![CDATA[a-->b & <c>]]></p>\n</content>\n"
+	got, err := prettyPrintXML(input)
+	if err != nil {
+		t.Fatalf("prettyPrintXML: %v", err)
+	}
+	if got != want {
+		t.Fatalf("prettyPrintXML(%q) = %q, want %q", input, got, want)
+	}
+}
+
+// TestPrettyPrintXMLSeparatesParagraphsWithoutTouchingTheirText is the
+// feature's actual point: a shape with many paragraphs becomes navigable
+// (each <p> on its own indented line), while every paragraph's own rich
+// text -- including an inline formatting boundary -- stays byte-for-byte
+// unchanged.
+func TestPrettyPrintXMLSeparatesParagraphsWithoutTouchingTheirText(t *testing.T) {
+	input := `<content><p>First paragraph.</p><p>Second <strong>paragraph</strong>.</p></content>`
+	want := "<content>\n  <p>First paragraph.</p>\n  <p>Second <strong>paragraph</strong>.</p>\n</content>\n"
+	got, err := prettyPrintXML(input)
+	if err != nil {
+		t.Fatalf("prettyPrintXML: %v", err)
+	}
+	if got != want {
+		t.Fatalf("prettyPrintXML(%q) = %q, want %q", input, got, want)
+	}
+}
+
+func TestPrettyPrintXMLIdempotent(t *testing.T) {
+	input := `<presentation><slide id="s1"><shape id="a"><content><p>A&#32;&#32;B&#9;C&#13;D&#10;E</p></content><style/></shape></slide></presentation>`
+	once, err := prettyPrintXML(input)
+	if err != nil {
+		t.Fatalf("prettyPrintXML (first pass): %v", err)
+	}
+	twice, err := prettyPrintXML(once)
+	if err != nil {
+		t.Fatalf("prettyPrintXML (second pass): %v", err)
+	}
+	if once != twice {
+		t.Fatalf("not idempotent:\nonce:  %q\ntwice: %q", once, twice)
+	}
+}
+
+func TestSlidesXMLGetFallsBackToOriginalPresentationWhenReformatFails(t *testing.T) {
+	content := "<presentation><title>\x0b</title><slide/></presentation>"
+	f, stdout, stderr, reg := cmdutil.TestFactory(t, slidesTestConfig(t, ""))
+	reg.Register(&httpmock.Stub{
+		Method: "GET",
+		URL:    "/open-apis/slides_ai/v1/xml_presentations/pres_abc",
+		Body: map[string]interface{}{
+			"code": 0,
+			"data": map[string]interface{}{
+				"xml_presentation": map[string]interface{}{
+					"content": content,
+				},
+			},
+		},
+	})
+
+	err := runSlidesShortcut(t, f, stdout, SlidesXMLGet, []string{
+		"+xml-get",
+		"--presentation", "pres_abc",
+		"--raw",
+		"--as", "user",
+	})
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if got := stdout.String(); got != content {
+		t.Fatalf("stdout = %q, want original content %q", got, content)
+	}
+	if got := stderr.String(); !strings.Contains(got, "warning: XML pretty-print skipped; returning original server content:") {
+		t.Fatalf("stderr = %q, want explicit pretty-print fallback warning", got)
+	}
+}
+
+// TestSlidesXMLGetEnvelopePassesThroughMalformedSlideContent pins the
+// envelope contract: the content is never parsed, so even malformed XML
+// flows through byte for byte with no fallback warning and no
+// pretty_printed field.
+func TestSlidesXMLGetEnvelopePassesThroughMalformedSlideContent(t *testing.T) {
+	content := `<slide><data></slide>`
+	f, stdout, stderr, reg := cmdutil.TestFactory(t, slidesTestConfig(t, ""))
+	reg.Register(&httpmock.Stub{
+		Method: "GET",
+		URL:    "/open-apis/slides_ai/v1/xml_presentations/pres_abc/slide",
+		Body: map[string]interface{}{
+			"code": 0,
+			"data": map[string]interface{}{
+				"slide": map[string]interface{}{
+					"slide_id": "slide_1",
+					"content":  content,
+				},
+			},
+		},
+	})
+
+	err := runSlidesShortcut(t, f, stdout, SlidesXMLGet, []string{
+		"+xml-get",
+		"--presentation", "pres_abc",
+		"--slide-id", "slide_1",
+		"--as", "user",
+	})
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	data := decodeShortcutData(t, stdout)
+	slide, _ := data["slide"].(map[string]interface{})
+	if slide == nil {
+		t.Fatalf("missing slide: %#v", data)
+	}
+	if got, _ := slide["content"].(string); got != content {
+		t.Fatalf("slide.content = %q, want the server content verbatim %q", got, content)
+	}
+	if _, ok := data["pretty_printed"]; ok {
+		t.Fatalf("pretty_printed should not appear in the envelope: %#v", data)
+	}
+	if got := stderr.String(); got != "" {
+		t.Fatalf("stderr = %q, want empty: the envelope path must not parse the content", got)
+	}
+}
+
+// TestSlidesXMLGetEnvelopePassesThroughMalformedPresentationContent mirrors
+// the slide-scope passthrough test for the presentation-scope fetch branch,
+// which is a separate code path.
+func TestSlidesXMLGetEnvelopePassesThroughMalformedPresentationContent(t *testing.T) {
+	content := `<presentation><slide></presentation>`
+	f, stdout, stderr, reg := cmdutil.TestFactory(t, slidesTestConfig(t, ""))
+	reg.Register(&httpmock.Stub{
+		Method: "GET",
+		URL:    "/open-apis/slides_ai/v1/xml_presentations/pres_abc",
+		Body: map[string]interface{}{
+			"code": 0,
+			"data": map[string]interface{}{
+				"xml_presentation": map[string]interface{}{
+					"content": content,
+				},
+			},
+		},
+	})
+
+	err := runSlidesShortcut(t, f, stdout, SlidesXMLGet, []string{
+		"+xml-get",
+		"--presentation", "pres_abc",
+		"--as", "user",
+	})
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	data := decodeShortcutData(t, stdout)
+	presentation, _ := data["xml_presentation"].(map[string]interface{})
+	if presentation == nil {
+		t.Fatalf("missing xml_presentation: %#v", data)
+	}
+	if got, _ := presentation["content"].(string); got != content {
+		t.Fatalf("content = %q, want the server content verbatim %q", got, content)
+	}
+	if _, ok := data["pretty_printed"]; ok {
+		t.Fatalf("pretty_printed should not appear in the envelope: %#v", data)
+	}
+	if got := stderr.String(); got != "" {
+		t.Fatalf("stderr = %q, want empty: the envelope path must not parse the content", got)
+	}
+}
+
+func TestSlidesXMLGetFileMetadataReportsPrettyPrintFallback(t *testing.T) {
+	dir := t.TempDir()
+	withSlidesTestWorkingDir(t, dir)
+
+	content := `<presentation><slide></presentation>`
+	f, stdout, stderr, reg := cmdutil.TestFactory(t, slidesTestConfig(t, ""))
+	reg.Register(&httpmock.Stub{
+		Method: "GET",
+		URL:    "/open-apis/slides_ai/v1/xml_presentations/pres_abc",
+		Body: map[string]interface{}{
+			"code": 0,
+			"data": map[string]interface{}{
+				"xml_presentation": map[string]interface{}{
+					"content": content,
+				},
+			},
+		},
+	})
+
+	err := runSlidesShortcut(t, f, stdout, SlidesXMLGet, []string{
+		"+xml-get",
+		"--presentation", "pres_abc",
+		"--output", "fallback.xml",
+		"--as", "user",
+	})
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	got, err := os.ReadFile(filepath.Join(dir, "fallback.xml"))
+	if err != nil {
+		t.Fatalf("read fallback XML: %v", err)
+	}
+	if string(got) != content {
+		t.Fatalf("saved XML = %q, want original content %q", got, content)
+	}
+	data := decodeShortcutData(t, stdout)
+	if data["pretty_printed"] != false {
+		t.Fatalf("pretty_printed = %v, want false", data["pretty_printed"])
+	}
+	if got := stderr.String(); !strings.Contains(got, "warning: XML pretty-print skipped; returning original server content:") {
+		t.Fatalf("stderr = %q, want explicit pretty-print fallback warning", got)
+	}
+}

shortcuts/slides/slides_xml_prettyprint.go

@@ -0,0 +1,260 @@
+// Copyright (c) 2026 Lark Technologies Pte. Ltd.
+// SPDX-License-Identifier: MIT
+
+package slides
+
+import (
+	"encoding/xml"
+	"errors"
+	"io"
+	"slices"
+	"strings"
+)
+
+// textBearingTags are the SML elements whose schema content model is
+// mixed (arbitrary text interleaved with inline markup): the <p> paragraph
+// container and its inline formatting children, plus chart title/subtitle.
+// See slides_xml_schema_definition.xml, <p> element docs: a deliberate space
+// or tab is represented via &#32;/&#9; character references. Reindentation
+// never descends into these elements; their entire subtree is copied
+// verbatim from the input, so those references keep their exact spelling.
+var textBearingTags = map[string]bool{
+	"p":             true,
+	"strong":        true,
+	"em":            true,
+	"u":             true,
+	"span":          true,
+	"del":           true,
+	"a":             true,
+	"shadow":        true,
+	"outline":       true,
+	"chartTitle":    true,
+	"chartSubTitle": true,
+}
+
+// tokenKind classifies a raw XML token for reindentation purposes.
+type tokenKind uint8
+
+const (
+	tokenStartElement tokenKind = iota // <name ...> or <name .../>
+	tokenEndElement                    // </name>, or zero-width after <name .../>
+	tokenCharData                      // text, character/entity references, or one CDATA section
+	tokenOther                         // comment, processing instruction, or directive
+)
+
+// rawToken records where one XML token lives inside the original input:
+// input[start:end] is the token's exact source bytes. The decoded token
+// value is deliberately discarded (only the element's local name is kept),
+// which is the core invariant of this formatter: output can only ever be
+// assembled from verbatim slices of the input, never from re-encoded data.
+type rawToken struct {
+	kind  tokenKind
+	start int    // byte offset of the token's first source byte
+	end   int    // byte offset one past the token's last source byte
+	local string // local element name (namespace prefix stripped); start elements only
+	match int    // start element: index of its matching end token; -1 otherwise
+}
+
+// tokenize runs encoding/xml over the whole input purely as a tokenizer and
+// returns every token annotated with its raw byte range. Ranges come from
+// Decoder.InputOffset, which counts bytes (multi-byte UTF-8 content cannot
+// skew them), and consecutive tokens tile the input exactly, so slicing
+// between them loses nothing.
+//
+// The full document is decoded before anything is emitted: any syntax error
+// (mismatched or unclosed tags, invalid characters such as \x0b, undefined
+// entities, bare ]]> in text, ...) fails the whole pretty-print, keeping the
+// strict-parse behavior the fallback path in prettyPrintXMLOrOriginal
+// depends on.
+func tokenize(input string) ([]rawToken, error) {
+	decoder := xml.NewDecoder(strings.NewReader(input))
+	var tokens []rawToken
+	var openElements []int // indices into tokens of currently open start elements
+	pos := 0
+	for {
+		token, err := decoder.Token()
+		if err == io.EOF {
+			break
+		}
+		if err != nil {
+			return nil, err
+		}
+		end := int(decoder.InputOffset())
+		raw := rawToken{start: pos, end: end, match: -1}
+		switch t := token.(type) {
+		case xml.StartElement:
+			raw.kind = tokenStartElement
+			raw.local = t.Name.Local
+			openElements = append(openElements, len(tokens))
+		case xml.EndElement:
+			// A strict decoder never emits an end element without its start
+			// element; guard anyway so a decoder change cannot panic here.
+			if len(openElements) == 0 {
+				return nil, errors.New("xml: unexpected end element")
+			}
+			raw.kind = tokenEndElement
+			startIndex := openElements[len(openElements)-1]
+			openElements = openElements[:len(openElements)-1]
+			tokens[startIndex].match = len(tokens)
+		case xml.CharData:
+			raw.kind = tokenCharData
+		default: // xml.Comment, xml.ProcInst, xml.Directive
+			raw.kind = tokenOther
+		}
+		tokens = append(tokens, raw)
+		pos = end
+	}
+	// A strict decoder reports unclosed elements as a syntax error before
+	// returning io.EOF; guard anyway so truncated output is impossible.
+	if len(openElements) != 0 {
+		return nil, errors.New("xml: unexpected EOF: unclosed element")
+	}
+	return tokens, nil
+}
+
+// prettyPrintXML reindents xmlContent so structural elements (presentation,
+// slide, shape, style, ...) each sit on their own line. The server returns
+// XML as a single unbroken line, and this is what makes the --raw and
+// --output text surfaces readable; the JSON envelope path never calls it
+// (see outputSlidesXMLGetContent).
+//
+// Offset-slicing invariant: encoding/xml serves purely as a tokenizer, and
+// every byte of the output is either a verbatim slice of the input or an
+// inserted "\n"+indent run between the children of a structural element.
+// Nothing is parsed-and-reserialized, so CDATA sections, whitespace
+// character references in any spelling (&#32;, &#x20;, &#0009;, &#13;,
+// &#10;, ...), entity lexical forms, attribute quoting, and in-tag
+// whitespace all survive byte-for-byte.
+//
+// Reindentation never enters a textBearingTags element and never touches a
+// leaf element (one with no element children), so document text — including
+// whitespace-only leaves such as <title> </title> — is never altered.
+func prettyPrintXML(xmlContent string) (string, error) {
+	tokens, err := tokenize(xmlContent)
+	if err != nil {
+		return "", err
+	}
+	// The decoder tolerates element-free input (plain text, a lone comment,
+	// nothing at all). A document without a root element is not XML the
+	// formatter should claim success on; erroring routes it to the
+	// original-content fallback instead of reporting pretty_printed: true.
+	if !slices.ContainsFunc(tokens, func(t rawToken) bool { return t.kind == tokenStartElement }) {
+		return "", errors.New("xml: no root element")
+	}
+	var out strings.Builder
+	out.Grow(len(xmlContent) + len(xmlContent)/8)
+	reindented := false
+	for i := 0; i < len(tokens); {
+		token := tokens[i]
+		if token.kind == tokenStartElement {
+			if reindented {
+				// Any top-level element after the first is copied verbatim;
+				// well-formed XML has a single root, so this arm only runs
+				// on technically invalid multi-root input the decoder
+				// happens to tolerate.
+				out.WriteString(xmlContent[token.start:tokens[token.match].end])
+			} else {
+				writeElement(&out, xmlContent, tokens, i, 0)
+				reindented = true
+			}
+			i = token.match + 1
+			continue
+		}
+		// Document-level prolog and epilog (XML declaration, DOCTYPE,
+		// comments, whitespace) pass through verbatim.
+		out.WriteString(xmlContent[token.start:token.end])
+		i++
+	}
+	formatted := out.String()
+	if !strings.HasSuffix(formatted, "\n") {
+		formatted += "\n"
+	}
+	return formatted, nil
+}
+
+// writeElement emits the element whose start token is tokens[startIndex],
+// indented as if at the given depth (two spaces per level).
+//
+// Text-bearing elements and leaf elements (no element children) are emitted
+// as a single verbatim input slice from open tag through close tag; for a
+// self-closing tag the synthesized end token is zero-width and the slice is
+// exactly the open tag. Structural elements (at least one element child,
+// not text-bearing) are reindented: text children that are pure literal
+// whitespace are dropped as pre-existing formatting, "\n"+indent is
+// inserted before every element, comment, and processing-instruction child,
+// kept text children stay glued in place with no indentation around them,
+// and the close tag moves to its own line unless the last kept child is
+// text.
+//
+// The whitespace-only test runs on the child's RAW source bytes: a
+// character reference (&#32;) or a CDATA section is not literal whitespace
+// there, so it is kept and its lexical form survives.
+func writeElement(out *strings.Builder, input string, tokens []rawToken, startIndex, depth int) {
+	start := tokens[startIndex]
+	end := tokens[start.match]
+	if textBearingTags[start.local] || !hasElementChild(tokens, startIndex) {
+		out.WriteString(input[start.start:end.end])
+		return
+	}
+
+	out.WriteString(input[start.start:start.end])
+	childIndent := "\n" + strings.Repeat("  ", depth+1)
+	lastKeptIsText := false
+	for i := startIndex + 1; i < start.match; {
+		child := tokens[i]
+		switch child.kind {
+		case tokenCharData:
+			if !isAllWhitespace(input[child.start:child.end]) {
+				out.WriteString(input[child.start:child.end])
+				lastKeptIsText = true
+			}
+			i++
+		case tokenStartElement:
+			out.WriteString(childIndent)
+			writeElement(out, input, tokens, i, depth+1)
+			lastKeptIsText = false
+			i = child.match + 1
+		default: // comment, processing instruction, directive
+			out.WriteString(childIndent)
+			out.WriteString(input[child.start:child.end])
+			lastKeptIsText = false
+			i++
+		}
+	}
+	if !lastKeptIsText {
+		out.WriteString("\n")
+		out.WriteString(strings.Repeat("  ", depth))
+	}
+	out.WriteString(input[end.start:end.end])
+}
+
+// hasElementChild reports whether the element starting at tokens[startIndex]
+// has at least one direct element child. The first start-element token that
+// appears before the matching end token is necessarily a direct child, so a
+// linear scan without depth tracking suffices.
+func hasElementChild(tokens []rawToken, startIndex int) bool {
+	for i := startIndex + 1; i < tokens[startIndex].match; i++ {
+		if tokens[i].kind == tokenStartElement {
+			return true
+		}
+	}
+	return false
+}
+
+// isAllWhitespace reports whether s is non-empty and consists only of
+// literal XML whitespace bytes (space, tab, CR, LF). It is applied to raw
+// source bytes, where character references and CDATA markers count as
+// non-whitespace by construction.
+func isAllWhitespace(s string) bool {
+	if s == "" {
+		return false
+	}
+	for i := 0; i < len(s); i++ {
+		switch s[i] {
+		case ' ', '\t', '\n', '\r':
+		default:
+			return false
+		}
+	}
+	return true
+}

shortcuts/slides/slides_xml_prettyprint_test.go

@@ -0,0 +1,416 @@
+// Copyright (c) 2026 Lark Technologies Pte. Ltd.
+// SPDX-License-Identifier: MIT
+
+package slides
+
+import (
+	"os"
+	"strings"
+	"testing"
+)
+
+// The pure-function contract tests for prettyPrintXML (golden strings,
+// whitespace character references, leaf whitespace, CDATA, idempotency,
+// malformed rejection) live in slides_xml_get_test.go, unchanged from the
+// original etree-based implementation. This file adds engine-level cases
+// specific to the offset-slicing implementation.
+
+func TestPrettyPrintXMLGoldenPresentation(t *testing.T) {
+	input := `<presentation><slide id="s1"><shape id="a">hello</shape></slide></presentation>`
+	want := "<presentation>\n  <slide id=\"s1\">\n    <shape id=\"a\">hello</shape>\n  </slide>\n</presentation>\n"
+	got, err := prettyPrintXML(input)
+	if err != nil {
+		t.Fatalf("prettyPrintXML: %v", err)
+	}
+	if got != want {
+		t.Fatalf("prettyPrintXML(%q) = %q, want %q", input, got, want)
+	}
+}
+
+func TestPrettyPrintXMLGoldenSlide(t *testing.T) {
+	input := `<slide id="slide_1"><data><shape id="a"/></data></slide>`
+	want := "<slide id=\"slide_1\">\n  <data>\n    <shape id=\"a\"/>\n  </data>\n</slide>\n"
+	got, err := prettyPrintXML(input)
+	if err != nil {
+		t.Fatalf("prettyPrintXML: %v", err)
+	}
+	if got != want {
+		t.Fatalf("prettyPrintXML(%q) = %q, want %q", input, got, want)
+	}
+}
+
+// TestPrettyPrintXMLRejectsMalformedInputTable pins that the whole document
+// is decoded before anything is emitted: even a late syntax error yields no
+// partial output, only the error the fallback path reports.
+func TestPrettyPrintXMLRejectsMalformedInputTable(t *testing.T) {
+	tests := []struct {
+		name  string
+		input string
+	}{
+		{"mismatched close tag", `<presentation><slide></presentation>`},
+		{"unclosed slide from fallback test", `<slide><data></slide>`},
+		{"invalid control character", "<presentation><title>\x0b</title><slide/></presentation>"},
+		{"unclosed root", `<presentation><slide/>`},
+		{"undefined entity", `<presentation><title>&nbsp;</title></presentation>`},
+		{"bare close tag", `</presentation>`},
+		{"unescaped cdata terminator in text", `<presentation><title>a]]>b</title></presentation>`},
+		{"late error after valid prefix", `<presentation><slide/><slide/><slide id=></presentation>`},
+		{"empty input", ``},
+		{"whitespace-only input", `   `},
+		{"plain text without markup", `hello`},
+		{"comment-only document", `<!-- only a comment -->`},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := prettyPrintXML(tt.input)
+			if err == nil {
+				t.Fatalf("prettyPrintXML(%q) = %q, want error", tt.input, got)
+			}
+			if got != "" {
+				t.Fatalf("prettyPrintXML(%q) returned partial output %q alongside error %v", tt.input, got, err)
+			}
+		})
+	}
+}
+
+// TestPrettyPrintXMLIgnoresMaskingEraPlaceholderText pins that user content
+// resembling the previous implementation's masking placeholders
+// (LARKCLI_XML_WHITESPACE_REFERENCE_<n>_) flows through untouched now that
+// no masking exists at all.
+func TestPrettyPrintXMLIgnoresMaskingEraPlaceholderText(t *testing.T) {
+	tests := []struct {
+		name  string
+		input string
+		want  string
+	}{
+		{
+			name:  "placeholder-shaped text in p",
+			input: `<content><p>LARKCLI_XML_WHITESPACE_REFERENCE_0_&#32;end</p></content>`,
+			want:  "<content>\n  <p>LARKCLI_XML_WHITESPACE_REFERENCE_0_&#32;end</p>\n</content>\n",
+		},
+		{
+			name:  "placeholder-shaped text in leaf",
+			input: `<presentation><title>LARKCLI_XML_WHITESPACE_REFERENCE_1_</title><slide/></presentation>`,
+			want:  "<presentation>\n  <title>LARKCLI_XML_WHITESPACE_REFERENCE_1_</title>\n  <slide/>\n</presentation>\n",
+		},
+		{
+			name:  "placeholder-shaped attribute value",
+			input: `<presentation><slide note="LARKCLI_XML_WHITESPACE_REFERENCE_0_"><shape/></slide></presentation>`,
+			want:  "<presentation>\n  <slide note=\"LARKCLI_XML_WHITESPACE_REFERENCE_0_\">\n    <shape/>\n  </slide>\n</presentation>\n",
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := prettyPrintXML(tt.input)
+			if err != nil {
+				t.Fatalf("prettyPrintXML(%q): %v", tt.input, err)
+			}
+			if got != tt.want {
+				t.Fatalf("prettyPrintXML(%q) = %q, want %q", tt.input, got, tt.want)
+			}
+		})
+	}
+}
+
+// TestPrettyPrintXMLStructuralTable covers comments, processing
+// instructions, prolog/DOCTYPE, mixed text between structural children,
+// CRLF pre-formatting, and multi-byte UTF-8 around offset boundaries.
+// Expected outputs were verified byte-identical against the previous
+// etree-based implementation via a differential probe.
+func TestPrettyPrintXMLStructuralTable(t *testing.T) {
+	tests := []struct {
+		name  string
+		input string
+		want  string
+		// wantSecond is the expected output of formatting the output again.
+		// Usually equal to want (idempotent); the mixed-content rows pin the
+		// one known non-idempotent shape, where kept text merges with the
+		// inserted indent on reparse — byte-identical to the previous
+		// implementation's behavior on the same inputs. Real SML structural
+		// elements carry no mixed text, so the contract's idempotency
+		// guarantee is unaffected.
+		wantSecond string
+	}{
+		{
+			name:  "comment child is indented like an element",
+			input: `<presentation><!-- deck notes --><slide/></presentation>`,
+			want:  "<presentation>\n  <!-- deck notes -->\n  <slide/>\n</presentation>\n",
+		},
+		{
+			name:  "processing instruction child is indented like an element",
+			input: `<presentation><?pi data?><slide/></presentation>`,
+			want:  "<presentation>\n  <?pi data?>\n  <slide/>\n</presentation>\n",
+		},
+		{
+			name:  "xml declaration prolog stays glued to the root",
+			input: `<?xml version="1.0" encoding="UTF-8"?><presentation><slide/></presentation>`,
+			want:  "<?xml version=\"1.0\" encoding=\"UTF-8\"?><presentation>\n  <slide/>\n</presentation>\n",
+		},
+		{
+			name:  "prolog with doctype and trailing newline preserved verbatim",
+			input: "<?xml version=\"1.0\"?>\n<!DOCTYPE presentation>\n<presentation><slide/></presentation>\n",
+			want:  "<?xml version=\"1.0\"?>\n<!DOCTYPE presentation>\n<presentation>\n  <slide/>\n</presentation>\n",
+		},
+		{
+			name:  "document-level trailing comment preserved verbatim",
+			input: "<presentation><slide/></presentation><!-- tail -->",
+			want:  "<presentation>\n  <slide/>\n</presentation><!-- tail -->\n",
+		},
+		{
+			name:       "kept mixed text glues to previous sibling and close tag",
+			input:      `<data>x<child/>y</data>`,
+			want:       "<data>x\n  <child/>y</data>\n",
+			wantSecond: "<data>x\n  \n  <child/>y</data>\n",
+		},
+		{
+			name:       "kept mixed text does not suppress indent of next element",
+			input:      `<data>x<child/>y<child/></data>`,
+			want:       "<data>x\n  <child/>y\n  <child/>\n</data>\n",
+			wantSecond: "<data>x\n  \n  <child/>y\n  \n  <child/>\n</data>\n",
+		},
+		{
+			name:  "pre-existing CRLF formatting is dropped and rebuilt",
+			input: "<presentation>\r\n\t<slide/>\r\n</presentation>",
+			want:  "<presentation>\n  <slide/>\n</presentation>\n",
+		},
+		{
+			name:  "multi-byte UTF-8 text and attributes keep exact bytes",
+			input: `<presentation><title>原生图表 📊 Chart</title><slide 备注="中文värde"><shape/></slide></presentation>`,
+			want:  "<presentation>\n  <title>原生图表 📊 Chart</title>\n  <slide 备注=\"中文värde\">\n    <shape/>\n  </slide>\n</presentation>\n",
+		},
+		{
+			name:  "namespace-prefixed p is still text-bearing",
+			input: `<content xmlns:sml="urn:x"><sml:p><span>a</span>&#32;<span>b</span></sml:p></content>`,
+			want:  "<content xmlns:sml=\"urn:x\">\n  <sml:p><span>a</span>&#32;<span>b</span></sml:p>\n</content>\n",
+		},
+		{
+			name:  "already formatted input is preserved",
+			input: "<presentation>\n  <slide id=\"s1\">\n    <shape id=\"a\">hello</shape>\n  </slide>\n</presentation>\n",
+			want:  "<presentation>\n  <slide id=\"s1\">\n    <shape id=\"a\">hello</shape>\n  </slide>\n</presentation>\n",
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := prettyPrintXML(tt.input)
+			if err != nil {
+				t.Fatalf("prettyPrintXML(%q): %v", tt.input, err)
+			}
+			if got != tt.want {
+				t.Fatalf("prettyPrintXML(%q) = %q, want %q", tt.input, got, tt.want)
+			}
+			wantSecond := tt.wantSecond
+			if wantSecond == "" {
+				wantSecond = tt.want
+			}
+			again, err := prettyPrintXML(got)
+			if err != nil {
+				t.Fatalf("prettyPrintXML(second pass, %q): %v", got, err)
+			}
+			if again != wantSecond {
+				t.Fatalf("second pass:\nonce:  %q\ntwice: %q\nwant:  %q", got, again, wantSecond)
+			}
+		})
+	}
+}
+
+// TestPrettyPrintXMLPreservesLexicalFormsEtreeChanged pins the cases where
+// slicing original bytes intentionally differs from the previous
+// etree-based parse-and-reserialize implementation. Each case preserves the
+// input MORE faithfully than before; none is covered by the original
+// contract tests. The etree field records the old output for the record.
+func TestPrettyPrintXMLPreservesLexicalFormsEtreeChanged(t *testing.T) {
+	tests := []struct {
+		name  string
+		input string
+		want  string // current behavior: original bytes preserved
+		etree string // what the etree-based implementation produced
+	}{
+		{
+			name:  "whitespace-only CDATA between structural children is kept",
+			input: `<data><![CDATA[ ]]><child/></data>`,
+			want:  "<data><![CDATA[ ]]>\n  <child/>\n</data>\n",
+			etree: "<data>\n  <child/>\n</data>\n",
+		},
+		{
+			name:  "empty element with explicit close tag is not collapsed",
+			input: `<slide><data></data><shape/></slide>`,
+			want:  "<slide>\n  <data></data>\n  <shape/>\n</slide>\n",
+			etree: "<slide>\n  <data/>\n  <shape/>\n</slide>\n",
+		},
+		{
+			name:  "non-whitespace character reference keeps its lexical form",
+			input: `<presentation><title>&#65;&amp;&#x4E2D;</title><slide/></presentation>`,
+			want:  "<presentation>\n  <title>&#65;&amp;&#x4E2D;</title>\n  <slide/>\n</presentation>\n",
+			etree: "<presentation>\n  <title>A&amp;中</title>\n  <slide/>\n</presentation>\n",
+		},
+		{
+			name:  "single-quoted attributes keep their quoting",
+			input: `<presentation><slide id='s1'><shape/></slide></presentation>`,
+			want:  "<presentation>\n  <slide id='s1'>\n    <shape/>\n  </slide>\n</presentation>\n",
+			etree: "<presentation>\n  <slide id=\"s1\">\n    <shape/>\n  </slide>\n</presentation>\n",
+		},
+		{
+			name:  "in-tag whitespace is preserved verbatim",
+			input: "<presentation><slide  id=\"s1\" ><shape/></slide ></presentation>",
+			want:  "<presentation>\n  <slide  id=\"s1\" >\n    <shape/>\n  </slide >\n</presentation>\n",
+			etree: "<presentation>\n  <slide id=\"s1\">\n    <shape/>\n  </slide>\n</presentation>\n",
+		},
+		{
+			name:  "literal > in leaf text is not re-escaped",
+			input: `<presentation><title>a>b</title><slide/></presentation>`,
+			want:  "<presentation>\n  <title>a>b</title>\n  <slide/>\n</presentation>\n",
+			etree: "<presentation>\n  <title>a&gt;b</title>\n  <slide/>\n</presentation>\n",
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := prettyPrintXML(tt.input)
+			if err != nil {
+				t.Fatalf("prettyPrintXML(%q): %v", tt.input, err)
+			}
+			if got != tt.want {
+				t.Fatalf("prettyPrintXML(%q) = %q, want %q", tt.input, got, tt.want)
+			}
+			if tt.want == tt.etree {
+				t.Fatalf("case is not a divergence: want == etree == %q", tt.want)
+			}
+			again, err := prettyPrintXML(got)
+			if err != nil {
+				t.Fatalf("prettyPrintXML(second pass, %q): %v", got, err)
+			}
+			if again != got {
+				t.Fatalf("not idempotent:\nonce:  %q\ntwice: %q", got, again)
+			}
+		})
+	}
+}
+
+// loadChartDemo reads the real-world chart demo shipped with the
+// lark-slides skill (~60KB, pretty-printed): the closest in-repo stand-in
+// for a full presentation read.
+func loadChartDemo(t testing.TB) string {
+	t.Helper()
+	data, err := os.ReadFile("../../skills/lark-slides/references/slides_chart_demo.xml")
+	if err != nil {
+		t.Fatalf("read chart demo fixture: %v", err)
+	}
+	return string(data)
+}
+
+// minifyXML strips whitespace-only text children of structural (non
+// text-bearing, element-bearing) elements — the exact text nodes
+// prettyPrintXML treats as disposable formatting — producing the
+// single-line element shape the slides server actually returns.
+// Document-level tokens (prolog, trailing newline) pass through verbatim,
+// because the formatter preserves them verbatim too.
+func minifyXML(t testing.TB, input string) string {
+	t.Helper()
+	tokens, err := tokenize(input)
+	if err != nil {
+		t.Fatalf("tokenize for minify: %v", err)
+	}
+	var out strings.Builder
+	var emitElement func(startIndex int)
+	emitElement = func(startIndex int) {
+		start := tokens[startIndex]
+		end := tokens[start.match]
+		if textBearingTags[start.local] || !hasElementChild(tokens, startIndex) {
+			out.WriteString(input[start.start:end.end])
+			return
+		}
+		out.WriteString(input[start.start:start.end])
+		for i := startIndex + 1; i < start.match; {
+			child := tokens[i]
+			switch child.kind {
+			case tokenCharData:
+				if !isAllWhitespace(input[child.start:child.end]) {
+					out.WriteString(input[child.start:child.end])
+				}
+				i++
+			case tokenStartElement:
+				emitElement(i)
+				i = child.match + 1
+			default:
+				out.WriteString(input[child.start:child.end])
+				i++
+			}
+		}
+		out.WriteString(input[end.start:end.end])
+	}
+	for i := 0; i < len(tokens); {
+		token := tokens[i]
+		if token.kind == tokenStartElement {
+			emitElement(i)
+			i = token.match + 1
+			continue
+		}
+		out.WriteString(input[token.start:token.end])
+		i++
+	}
+	return out.String()
+}
+
+// TestPrettyPrintXMLChartDemoFixture formats the real chart demo both as
+// shipped (pretty-printed) and minified to the single-line shape the server
+// returns; both must converge on the same idempotent output.
+func TestPrettyPrintXMLChartDemoFixture(t *testing.T) {
+	original := loadChartDemo(t)
+
+	formattedOriginal, err := prettyPrintXML(original)
+	if err != nil {
+		t.Fatalf("prettyPrintXML(original): %v", err)
+	}
+	twice, err := prettyPrintXML(formattedOriginal)
+	if err != nil {
+		t.Fatalf("prettyPrintXML(second pass): %v", err)
+	}
+	if twice != formattedOriginal {
+		t.Fatal("prettyPrintXML is not idempotent on the chart demo fixture")
+	}
+
+	minified := minifyXML(t, original)
+	if strings.Contains(minified, ">\n  <") {
+		t.Fatalf("minified fixture still contains structural indentation: %q", minified[:200])
+	}
+	// Only the doc-level newline after the XML declaration and the trailing
+	// newline may remain; the whole element tree must be one line.
+	if got := strings.Count(minified, "\n"); got > 2 {
+		t.Fatalf("minified fixture has %d newlines, want <= 2", got)
+	}
+	formattedMinified, err := prettyPrintXML(minified)
+	if err != nil {
+		t.Fatalf("prettyPrintXML(minified): %v", err)
+	}
+	// Formatting drops exactly the whitespace minification dropped, so both
+	// paths must converge on the same output.
+	if formattedMinified != formattedOriginal {
+		t.Fatal("format(minified) != format(original) for the chart demo fixture")
+	}
+	if !strings.Contains(formattedMinified, "\n  <slide>") {
+		t.Fatal("formatted chart demo lacks expected slide indentation")
+	}
+}
+
+func BenchmarkPrettyPrintXMLChartDemoMinified(b *testing.B) {
+	minified := minifyXML(b, loadChartDemo(b))
+	b.SetBytes(int64(len(minified)))
+	b.ReportAllocs()
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		if _, err := prettyPrintXML(minified); err != nil {
+			b.Fatal(err)
+		}
+	}
+}
+
+func BenchmarkPrettyPrintXMLChartDemoPreformatted(b *testing.B) {
+	original := loadChartDemo(b)
+	b.SetBytes(int64(len(original)))
+	b.ReportAllocs()
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		if _, err := prettyPrintXML(original); err != nil {
+			b.Fatal(err)
+		}
+	}
+}

shortcuts/task/shortcuts.go

@@ -10,7 +10,6 @@ import (
 	"io"
 	"net/http"
 	"net/url"
-	"regexp"
 	"strings"
 	"time"
 
@@ -101,40 +100,6 @@ func extractTaskGuid(input string) string {
 	return extractTasklistGuid(input)
 }
 
-var taskDisplayNumberPattern = regexp.MustCompile(`^t[0-9]+$`)
-
-func parseTaskGUID(input string) (string, error) {
-	input = strings.TrimSpace(input)
-	invalid := func(format string, args ...interface{}) *errs.ValidationError {
-		return errs.NewValidationError(errs.SubtypeInvalidArgument, format, args...).
-			WithParam("--task-id").
-			WithHint("provide the Task OpenAPI GUID or a task applink containing guid=")
-	}
-
-	if input == "" {
-		return "", invalid("task ID is empty")
-	}
-
-	lowerInput := strings.ToLower(input)
-	if strings.HasPrefix(lowerInput, "http://") || strings.HasPrefix(lowerInput, "https://") {
-		u, err := url.Parse(input)
-		if err != nil {
-			return "", invalid("invalid task applink: %v", err).WithCause(err)
-		}
-		guid := strings.TrimSpace(u.Query().Get("guid"))
-		if guid == "" {
-			return "", invalid("task applink is missing a non-empty guid query parameter")
-		}
-		return guid, nil
-	}
-
-	if taskDisplayNumberPattern.MatchString(input) {
-		return "", invalid("task display number %q is not a Task OpenAPI GUID", input)
-	}
-
-	return input, nil
-}
-
 func buildTaskCreateBody(runtime *common.RuntimeContext) (map[string]interface{}, error) {
 	body := make(map[string]interface{})
 

shortcuts/task/shortcuts_test.go

@@ -4,11 +4,8 @@
 package task
 
 import (
-	"errors"
-	"net/url"
 	"testing"
 
-	"github.com/larksuite/cli/errs"
 	"github.com/smartystreets/goconvey/convey"
 )
 
@@ -18,80 +15,3 @@ func TestShortcutsRegistration(t *testing.T) {
 		convey.So(len(list), convey.ShouldBeGreaterThan, 0)
 	})
 }
-
-func TestParseTaskGUID(t *testing.T) {
-	t.Run("accepts GUIDs and task applinks", func(t *testing.T) {
-		tests := []struct {
-			name  string
-			input string
-			want  string
-		}{
-			{name: "opaque GUID", input: "task-guid-123", want: "task-guid-123"},
-			{name: "trimmed GUID", input: "  task-guid-123  ", want: "task-guid-123"},
-			{
-				name:  "task applink",
-				input: "https://applink.larksuite.com/client/todo/detail?guid=task-guid-123",
-				want:  "task-guid-123",
-			},
-		}
-
-		for _, tt := range tests {
-			t.Run(tt.name, func(t *testing.T) {
-				got, err := parseTaskGUID(tt.input)
-				if err != nil {
-					t.Fatalf("parseTaskGUID(%q) error = %v", tt.input, err)
-				}
-				if got != tt.want {
-					t.Fatalf("parseTaskGUID(%q) = %q, want %q", tt.input, got, tt.want)
-				}
-			})
-		}
-	})
-
-	t.Run("rejects unusable task identifiers", func(t *testing.T) {
-		for _, input := range []string{
-			"",
-			"https://applink.larksuite.com/client/todo/detail",
-			"https://%",
-			"t12345",
-		} {
-			t.Run(input, func(t *testing.T) {
-				_, err := parseTaskGUID(input)
-				if err == nil {
-					t.Fatalf("parseTaskGUID(%q) error = nil, want typed validation error", input)
-				}
-
-				problem, ok := errs.ProblemOf(err)
-				if !ok {
-					t.Fatalf("parseTaskGUID(%q) error type = %T, want typed error", input, err)
-				}
-				if problem.Category != errs.CategoryValidation || problem.Subtype != errs.SubtypeInvalidArgument {
-					t.Fatalf("problem = %s/%s, want %s/%s", problem.Category, problem.Subtype, errs.CategoryValidation, errs.SubtypeInvalidArgument)
-				}
-				if problem.Hint == "" {
-					t.Fatal("problem hint is empty")
-				}
-
-				var validationErr *errs.ValidationError
-				if !errors.As(err, &validationErr) {
-					t.Fatalf("error type = %T, want *errs.ValidationError", err)
-				}
-				if validationErr.Param != "--task-id" {
-					t.Fatalf("param = %q, want %q", validationErr.Param, "--task-id")
-				}
-			})
-		}
-	})
-
-	t.Run("preserves applink parse cause", func(t *testing.T) {
-		_, err := parseTaskGUID("https://%")
-		if err == nil {
-			t.Fatal("parseTaskGUID() error = nil, want URL parse error")
-		}
-
-		var urlErr *url.Error
-		if !errors.As(err, &urlErr) {
-			t.Fatalf("error chain = %T %v, want *url.Error cause", err, err)
-		}
-	})
-}

shortcuts/task/task_complete.go

@@ -25,59 +25,45 @@ var CompleteTask = common.Shortcut{
 	HasFormat:   true,
 
 	Flags: []common.Flag{
-		{Name: "task-id", Desc: "task GUID or task applink URL", Required: true},
-	},
-
-	Validate: func(ctx context.Context, runtime *common.RuntimeContext) error {
-		_, err := parseTaskGUID(runtime.Str("task-id"))
-		return err
+		{Name: "task-id", Desc: "task id", Required: true},
 	},
 
 	DryRun: func(ctx context.Context, runtime *common.RuntimeContext) *common.DryRunAPI {
 		body := buildCompleteBody()
-		taskGUID, err := parseTaskGUID(runtime.Str("task-id"))
-		if err != nil {
-			return common.NewDryRunAPI().Set("error", err.Error())
-		}
-		taskID := url.PathEscape(taskGUID)
+		taskId := url.PathEscape(runtime.Str("task-id"))
 		return common.NewDryRunAPI().
-			GET("/open-apis/task/v2/tasks/" + taskID).
+			GET("/open-apis/task/v2/tasks/" + taskId).
 			Desc("get current task status").
 			Params(map[string]interface{}{"user_id_type": "open_id"}).
-			PATCH("/open-apis/task/v2/tasks/" + taskID).
+			PATCH("/open-apis/task/v2/tasks/" + taskId).
 			Desc("complete task if not completed").
 			Params(map[string]interface{}{"user_id_type": "open_id"}).
 			Body(body)
 	},
 
 	Execute: func(ctx context.Context, runtime *common.RuntimeContext) error {
-		taskGUID, err := parseTaskGUID(runtime.Str("task-id"))
-		if err != nil {
-			return err
-		}
-		taskID := url.PathEscape(taskGUID)
+		taskId := url.PathEscape(runtime.Str("task-id"))
 
 		params := map[string]interface{}{"user_id_type": "open_id"}
 
 		var data map[string]interface{}
 
 		// 1. Get current task status
-		getData, err := callTaskAPITyped(runtime, http.MethodGet, "/open-apis/task/v2/tasks/"+taskID, params, nil)
+		getData, err := callTaskAPITyped(runtime, http.MethodGet, "/open-apis/task/v2/tasks/"+taskId, params, nil)
 		if err != nil {
 			return err
 		}
 
 		taskData, _ := getData["task"].(map[string]interface{})
 		completedAtStr, _ := taskData["completed_at"].(string)
-		alreadyCompleted := completedAtStr != "" && completedAtStr != "0"
 
 		// 2. If already completed, directly return success
-		if alreadyCompleted {
+		if completedAtStr != "" && completedAtStr != "0" {
 			data = getData
 		} else {
 			// 3. Complete the task
 			body := buildCompleteBody()
-			data, err = callTaskAPITyped(runtime, http.MethodPatch, "/open-apis/task/v2/tasks/"+taskID, params, body)
+			data, err = callTaskAPITyped(runtime, http.MethodPatch, "/open-apis/task/v2/tasks/"+taskId, params, body)
 			if err != nil {
 				return err
 			}
@@ -87,19 +73,11 @@ var CompleteTask = common.Shortcut{
 		guid, _ := task["guid"].(string)
 		urlVal, _ := task["url"].(string)
 		urlVal = truncateTaskURL(urlVal)
-		completedAt, _ := task["completed_at"].(string)
-		status := "todo"
-		if completedAt != "" && completedAt != "0" {
-			status = "done"
-		}
 
 		// Standardized write output: return resource identifiers
 		outData := map[string]interface{}{
-			"guid":              guid,
-			"url":               urlVal,
-			"status":            status,
-			"completed_at":      completedAt,
-			"already_completed": alreadyCompleted,
+			"guid": guid,
+			"url":  urlVal,
 		}
 
 		runtime.OutFormat(outData, nil, func(w io.Writer) {

shortcuts/task/task_complete_test.go

@@ -4,12 +4,9 @@
 package task
 
 import (
-	"encoding/json"
-	"errors"
 	"strings"
 	"testing"
 
-	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/httpmock"
 )
 
@@ -48,9 +45,6 @@ func TestCompleteTask(t *testing.T) {
 			formatFlag:  "json",
 			expectedOutput: []string{
 				`"guid": "task-789"`,
-				`"status": "done"`,
-				`"completed_at": "1775174400000"`,
-				`"already_completed": false`,
 			},
 		},
 	}
@@ -115,98 +109,3 @@ func TestCompleteTask(t *testing.T) {
 		})
 	}
 }
-
-func TestTaskCompleteAcceptsTaskApplink(t *testing.T) {
-	f, stdout, _, reg := taskShortcutTestFactory(t)
-	warmTenantToken(t, f, reg)
-
-	for _, method := range []string{"GET", "PATCH"} {
-		reg.Register(&httpmock.Stub{
-			Method: method,
-			URL:    "/open-apis/task/v2/tasks/task-guid-applink",
-			Body: map[string]interface{}{
-				"code": 0, "msg": "success",
-				"data": map[string]interface{}{
-					"task": map[string]interface{}{
-						"guid":         "task-guid-applink",
-						"summary":      "Applink task",
-						"completed_at": map[string]string{"GET": "0", "PATCH": "1775174400000"}[method],
-						"url":          "https://example.com/task-guid-applink",
-					},
-				},
-			},
-		})
-	}
-
-	err := runMountedTaskShortcut(t, CompleteTask, []string{
-		"+complete",
-		"--task-id", "https://applink.larksuite.com/client/todo/detail?guid=task-guid-applink",
-		"--format", "json",
-		"--as", "bot",
-	}, f, stdout)
-	if err != nil {
-		t.Fatalf("CompleteTask error = %v", err)
-	}
-	reg.Verify(t)
-	if !strings.Contains(stdout.String(), `"guid": "task-guid-applink"`) {
-		t.Fatalf("output = %s, want normalized task GUID", stdout.String())
-	}
-}
-
-func TestTaskCompleteAlreadyCompletedReturnsServerState(t *testing.T) {
-	f, stdout, _, reg := taskShortcutTestFactory(t)
-	warmTenantToken(t, f, reg)
-
-	reg.Register(&httpmock.Stub{
-		Method: "GET",
-		URL:    "/open-apis/task/v2/tasks/task-guid-done",
-		Body: map[string]interface{}{
-			"code": 0, "msg": "success",
-			"data": map[string]interface{}{
-				"task": map[string]interface{}{
-					"guid":         "task-guid-done",
-					"summary":      "Already done",
-					"completed_at": "1775174400000",
-					"url":          "https://example.com/task-guid-done",
-				},
-			},
-		},
-	})
-
-	err := runMountedTaskShortcut(t, CompleteTask, []string{
-		"+complete", "--task-id", "task-guid-done", "--format", "json", "--as", "bot",
-	}, f, stdout)
-	if err != nil {
-		t.Fatalf("CompleteTask error = %v", err)
-	}
-	reg.Verify(t)
-
-	var envelope map[string]interface{}
-	if err := json.Unmarshal(stdout.Bytes(), &envelope); err != nil {
-		t.Fatalf("decode output: %v\n%s", err, stdout.String())
-	}
-	data, _ := envelope["data"].(map[string]interface{})
-	if data["status"] != "done" || data["completed_at"] != "1775174400000" || data["already_completed"] != true {
-		t.Fatalf("completion state = %#v, want done/already_completed server state", data)
-	}
-}
-
-func TestTaskCompleteRejectsDisplayNumberBeforeRead(t *testing.T) {
-	f, stdout, _, reg := taskShortcutTestFactory(t)
-	warmTenantToken(t, f, reg)
-
-	err := runMountedTaskShortcut(t, CompleteTask, []string{
-		"+complete", "--task-id", "t12345", "--format", "json", "--as", "bot",
-	}, f, stdout)
-	if err == nil {
-		t.Fatal("CompleteTask error = nil, want invalid task ID error")
-	}
-	problem, ok := errs.ProblemOf(err)
-	if !ok || problem.Category != errs.CategoryValidation || problem.Subtype != errs.SubtypeInvalidArgument {
-		t.Fatalf("error = %T %v, want typed invalid-argument error", err, err)
-	}
-	var validationErr *errs.ValidationError
-	if !errors.As(err, &validationErr) || validationErr.Param != "--task-id" {
-		t.Fatalf("error param = %#v, want --task-id", validationErr)
-	}
-}

shortcuts/task/task_query_helpers.go

@@ -24,14 +24,6 @@ func splitAndTrimCSV(input string) []string {
 	return out
 }
 
-func buildSearchPageParams(pageToken string) map[string]interface{} {
-	params := map[string]interface{}{}
-	if pageToken != "" {
-		params["page_token"] = pageToken
-	}
-	return params
-}
-
 func parseTimeRangeMillis(input string) (string, string, error) {
 	if strings.TrimSpace(input) == "" {
 		return "", "", nil

shortcuts/task/task_query_helpers_test.go

@@ -37,31 +37,6 @@ func TestSplitAndTrimCSV(t *testing.T) {
 	}
 }
 
-func TestBuildSearchPageParams(t *testing.T) {
-	tests := []struct {
-		name      string
-		pageToken string
-		wantToken string
-		wantKey   bool
-	}{
-		{name: "first page omits token"},
-		{name: "subsequent page includes token", pageToken: "pt_123", wantToken: "pt_123", wantKey: true},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			params := buildSearchPageParams(tt.pageToken)
-			got, present := params["page_token"]
-			if present != tt.wantKey {
-				t.Fatalf("page_token present = %v, want %v; params = %#v", present, tt.wantKey, params)
-			}
-			if tt.wantKey && got != tt.wantToken {
-				t.Fatalf("page_token = %v, want %q", got, tt.wantToken)
-			}
-		})
-	}
-}
-
 func TestOutputTaskSummary(t *testing.T) {
 	tests := []struct {
 		name string

shortcuts/task/task_search.go

@@ -44,10 +44,8 @@ var SearchTask = common.Shortcut{
 		if err != nil {
 			return common.NewDryRunAPI().Set("error", err.Error())
 		}
-		params := buildSearchPageParams(runtime.Str("page-token"))
 		return common.NewDryRunAPI().
 			POST("/open-apis/task/v2/tasks/search").
-			Params(params).
 			Body(body).
 			Desc("Then GET /open-apis/task/v2/tasks/:guid for each search hit to render standard output")
 	},
@@ -76,9 +74,9 @@ var SearchTask = common.Shortcut{
 		var lastPageToken string
 		var lastHasMore bool
 		var notice string
-		params := buildSearchPageParams(runtime.Str("page-token"))
+		currentBody := body
 		for page := 0; page < pageLimit; page++ {
-			data, err := callTaskAPITyped(runtime, http.MethodPost, "/open-apis/task/v2/tasks/search", params, body)
+			data, err := callTaskAPITyped(runtime, http.MethodPost, "/open-apis/task/v2/tasks/search", nil, currentBody)
 			if err != nil {
 				return err
 			}
@@ -92,7 +90,7 @@ var SearchTask = common.Shortcut{
 			if !lastHasMore || lastPageToken == "" {
 				break
 			}
-			params["page_token"] = lastPageToken
+			currentBody["page_token"] = lastPageToken
 		}
 
 		enriched := make([]map[string]interface{}, 0, len(rawItems))
@@ -185,6 +183,9 @@ func buildTaskSearchBody(runtime *common.RuntimeContext) (map[string]interface{}
 	if len(filter) > 0 {
 		body["filter"] = filter
 	}
+	if pageToken := runtime.Str("page-token"); pageToken != "" {
+		body["page_token"] = pageToken
+	}
 	return body, nil
 }
 

shortcuts/task/task_search_pagination_test.go

@@ -1,129 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package task
-
-import (
-	"encoding/json"
-	"io"
-	"net/http"
-	"reflect"
-	"testing"
-
-	"github.com/larksuite/cli/internal/httpmock"
-	"github.com/larksuite/cli/shortcuts/common"
-)
-
-func TestSearchPaginationUsesQueryToken(t *testing.T) {
-	tests := []struct {
-		name     string
-		shortcut common.Shortcut
-		command  string
-		url      string
-	}{
-		{
-			name:     "tasks",
-			shortcut: SearchTask,
-			command:  "+search",
-			url:      "/open-apis/task/v2/tasks/search",
-		},
-		{
-			name:     "tasklists",
-			shortcut: SearchTasklist,
-			command:  "+tasklist-search",
-			url:      "/open-apis/task/v2/tasklists/search",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			f, stdout, _, reg := taskShortcutTestFactory(t)
-			warmTenantToken(t, f, reg)
-
-			var pageTokens []string
-			reg.Register(searchPaginationStub(t, tt.url, "next_pt", true, &pageTokens))
-			reg.Register(searchPaginationStub(t, tt.url, "", false, &pageTokens))
-
-			shortcut := tt.shortcut
-			shortcut.AuthTypes = []string{"bot", "user"}
-			err := runMountedTaskShortcut(t, shortcut, []string{
-				tt.command,
-				"--query", "pagination",
-				"--page-token", "initial_pt",
-				"--page-limit", "2",
-				"--as", "bot",
-				"--format", "json",
-			}, f, stdout)
-			if err != nil {
-				t.Fatalf("search command failed: %v", err)
-			}
-
-			want := []string{"initial_pt", "next_pt"}
-			if !reflect.DeepEqual(pageTokens, want) {
-				t.Fatalf("search page tokens = %#v, want %#v", pageTokens, want)
-			}
-		})
-	}
-}
-
-func assertSearchDryRunPageToken(t *testing.T, preview *common.DryRunAPI, want string) {
-	t.Helper()
-
-	data, err := preview.MarshalJSON()
-	if err != nil {
-		t.Fatalf("marshal search dry-run preview: %v", err)
-	}
-	var envelope struct {
-		API []struct {
-			Params map[string]interface{} `json:"params"`
-			Body   map[string]interface{} `json:"body"`
-		} `json:"api"`
-	}
-	if err := json.Unmarshal(data, &envelope); err != nil {
-		t.Fatalf("decode search dry-run preview: %v", err)
-	}
-	if len(envelope.API) != 1 {
-		t.Fatalf("search dry-run API call count = %d, want 1; preview = %s", len(envelope.API), data)
-	}
-	call := envelope.API[0]
-	if got, _ := call.Params["page_token"].(string); got != want {
-		t.Fatalf("search dry-run params.page_token = %q, want %q; preview = %s", got, want, data)
-	}
-	if _, present := call.Body["page_token"]; present {
-		t.Fatalf("search dry-run body unexpectedly contains page_token; preview = %s", data)
-	}
-}
-
-func searchPaginationStub(t *testing.T, endpoint, responseToken string, hasMore bool, capturedTokens *[]string) *httpmock.Stub {
-	t.Helper()
-	return &httpmock.Stub{
-		Method: http.MethodPost,
-		URL:    endpoint,
-		OnMatch: func(req *http.Request) {
-			*capturedTokens = append(*capturedTokens, req.URL.Query().Get("page_token"))
-
-			body, err := io.ReadAll(req.Body)
-			if err != nil {
-				t.Errorf("read search request body: %v", err)
-				return
-			}
-			var payload map[string]interface{}
-			if err := json.Unmarshal(body, &payload); err != nil {
-				t.Errorf("decode search request body: %v", err)
-				return
-			}
-			if _, present := payload["page_token"]; present {
-				t.Errorf("search request body unexpectedly contains page_token: %s", body)
-			}
-		},
-		Body: map[string]interface{}{
-			"code": 0,
-			"msg":  "success",
-			"data": map[string]interface{}{
-				"has_more":   hasMore,
-				"page_token": responseToken,
-				"items":      []interface{}{},
-			},
-		},
-	}
-}

shortcuts/task/task_search_test.go

@@ -37,12 +37,9 @@ func TestBuildTaskSearchBody(t *testing.T) {
 			check: func(t *testing.T, body map[string]interface{}) {
 				filter := body["filter"].(map[string]interface{})
 				dueTime := filter["due_time"].(map[string]interface{})
-				if body["query"] != "release" {
+				if body["query"] != "release" || body["page_token"] != "pt_123" {
 					t.Fatalf("unexpected body: %#v", body)
 				}
-				if _, present := body["page_token"]; present {
-					t.Fatalf("body unexpectedly contains page_token: %#v", body)
-				}
 				if len(filter["creator_ids"].([]string)) != 2 || filter["is_completed"] != true {
 					t.Fatalf("unexpected filter: %#v", filter)
 				}
@@ -107,10 +104,9 @@ func TestBuildTaskSearchBody(t *testing.T) {
 
 func TestSearchTask_DryRun(t *testing.T) {
 	tests := []struct {
-		name          string
-		setup         func(*cobra.Command)
-		wantPageToken string
-		wantParts     []string
+		name      string
+		setup     func(*cobra.Command)
+		wantParts []string
 	}{
 		{
 			name: "valid dry run",
@@ -118,8 +114,7 @@ func TestSearchTask_DryRun(t *testing.T) {
 				_ = cmd.Flags().Set("query", "demo")
 				_ = cmd.Flags().Set("page-token", "pt_demo")
 			},
-			wantPageToken: "pt_demo",
-			wantParts:     []string{`"query":"demo"`},
+			wantParts: []string{"POST /open-apis/task/v2/tasks/search", `"query":"demo"`},
 		},
 		{
 			name: "dry run error on invalid due",
@@ -148,11 +143,7 @@ func TestSearchTask_DryRun(t *testing.T) {
 					t.Fatalf("Validate() error = %v", err)
 				}
 			}
-			preview := SearchTask.DryRun(nil, runtime)
-			if tt.wantPageToken != "" {
-				assertSearchDryRunPageToken(t, preview, tt.wantPageToken)
-			}
-			out := preview.Format()
+			out := SearchTask.DryRun(nil, runtime).Format()
 			for _, want := range tt.wantParts {
 				if !strings.Contains(out, want) {
 					t.Fatalf("dry run output missing %q: %s", want, out)

shortcuts/task/task_tasklist_search.go

@@ -41,10 +41,8 @@ var SearchTasklist = common.Shortcut{
 		if err != nil {
 			return common.NewDryRunAPI().Set("error", err.Error())
 		}
-		params := buildSearchPageParams(runtime.Str("page-token"))
 		return common.NewDryRunAPI().
 			POST("/open-apis/task/v2/tasklists/search").
-			Params(params).
 			Body(body).
 			Desc("Then GET /open-apis/task/v2/tasklists/:guid for each search hit to render standard output")
 	},
@@ -73,9 +71,9 @@ var SearchTasklist = common.Shortcut{
 		var lastPageToken string
 		var lastHasMore bool
 		var notice string
-		params := buildSearchPageParams(runtime.Str("page-token"))
+		currentBody := body
 		for page := 0; page < pageLimit; page++ {
-			data, err := callTaskAPITyped(runtime, http.MethodPost, "/open-apis/task/v2/tasklists/search", params, body)
+			data, err := callTaskAPITyped(runtime, http.MethodPost, "/open-apis/task/v2/tasklists/search", nil, currentBody)
 			if err != nil {
 				return err
 			}
@@ -89,7 +87,7 @@ var SearchTasklist = common.Shortcut{
 			if !lastHasMore || lastPageToken == "" {
 				break
 			}
-			params["page_token"] = lastPageToken
+			currentBody["page_token"] = lastPageToken
 		}
 
 		tasklists := make([]map[string]interface{}, 0, len(rawItems))
@@ -172,6 +170,9 @@ func buildTasklistSearchBody(runtime *common.RuntimeContext) (map[string]interfa
 	if len(filter) > 0 {
 		body["filter"] = filter
 	}
+	if pageToken := runtime.Str("page-token"); pageToken != "" {
+		body["page_token"] = pageToken
+	}
 	return body, nil
 }
 

shortcuts/task/task_tasklist_search_test.go

@@ -33,8 +33,8 @@ func TestBuildTasklistSearchBody(t *testing.T) {
 			check: func(t *testing.T, body map[string]interface{}) {
 				filter := body["filter"].(map[string]interface{})
 				createTime := filter["create_time"].(map[string]interface{})
-				if _, present := body["page_token"]; present {
-					t.Fatalf("body unexpectedly contains page_token: %#v", body)
+				if body["page_token"] != "pt_tl" {
+					t.Fatalf("unexpected body: %#v", body)
 				}
 				if filter["user_id"].([]string)[0] != "ou_creator" {
 					t.Fatalf("unexpected filter: %#v", filter)
@@ -80,10 +80,9 @@ func TestBuildTasklistSearchBody(t *testing.T) {
 
 func TestSearchTasklist_DryRun(t *testing.T) {
 	tests := []struct {
-		name          string
-		setup         func(*cobra.Command)
-		wantPageToken string
-		wantParts     []string
+		name      string
+		setup     func(*cobra.Command)
+		wantParts []string
 	}{
 		{
 			name: "valid dry run",
@@ -91,8 +90,7 @@ func TestSearchTasklist_DryRun(t *testing.T) {
 				_ = cmd.Flags().Set("query", "Q2")
 				_ = cmd.Flags().Set("page-token", "pt_tl")
 			},
-			wantPageToken: "pt_tl",
-			wantParts:     []string{`"query":"Q2"`},
+			wantParts: []string{"POST /open-apis/task/v2/tasklists/search", `"query":"Q2"`},
 		},
 		{
 			name: "dry run error on invalid create time",
@@ -118,11 +116,7 @@ func TestSearchTasklist_DryRun(t *testing.T) {
 					t.Fatalf("Validate() error = %v", err)
 				}
 			}
-			preview := SearchTasklist.DryRun(nil, runtime)
-			if tt.wantPageToken != "" {
-				assertSearchDryRunPageToken(t, preview, tt.wantPageToken)
-			}
-			out := preview.Format()
+			out := SearchTasklist.DryRun(nil, runtime).Format()
 			for _, want := range tt.wantParts {
 				if !strings.Contains(out, want) {
 					t.Fatalf("dry run output missing %q: %s", want, out)

shortcuts/task/task_update.go

@@ -27,42 +27,27 @@ var UpdateTask = common.Shortcut{
 	HasFormat:   true,
 
 	Flags: []common.Flag{
-		{Name: "task-id", Desc: "task GUID or task applink URL (comma-separated for multiple)", Required: true},
+		{Name: "task-id", Desc: "task id (comma-separated for multiple)", Required: true},
 		{Name: "summary", Desc: "task title"},
 		{Name: "description", Desc: "task description"},
 		{Name: "due", Desc: "due date (ISO 8601 / date:YYYY-MM-DD / relative:+2d / ms timestamp)"},
 		{Name: "data", Desc: "JSON payload for task object"},
 	},
 
-	Validate: func(ctx context.Context, runtime *common.RuntimeContext) error {
-		_, err := parseTaskGUIDs(runtime.Str("task-id"))
-		return err
-	},
-
 	DryRun: func(ctx context.Context, runtime *common.RuntimeContext) *common.DryRunAPI {
 		body, err := buildTaskUpdateBody(runtime)
 		if err != nil {
 			return common.NewDryRunAPI().Set("error", err.Error())
 		}
-		taskIDs, err := parseTaskGUIDs(runtime.Str("task-id"))
-		if err != nil {
-			return common.NewDryRunAPI().Set("error", err.Error())
-		}
-		preview := common.NewDryRunAPI()
-		for _, taskID := range taskIDs {
-			preview.PATCH("/open-apis/task/v2/tasks/" + url.PathEscape(taskID)).
-				Params(map[string]interface{}{"user_id_type": "open_id"}).
-				Body(body)
-		}
-		return preview
+		taskIds := strings.Split(runtime.Str("task-id"), ",")
+		taskId := url.PathEscape(strings.TrimSpace(taskIds[0]))
+		return common.NewDryRunAPI().
+			PATCH("/open-apis/task/v2/tasks/" + taskId).
+			Params(map[string]interface{}{"user_id_type": "open_id"}).
+			Body(body)
 	},
 
 	Execute: func(ctx context.Context, runtime *common.RuntimeContext) error {
-		taskIDs, err := parseTaskGUIDs(runtime.Str("task-id"))
-		if err != nil {
-			return err
-		}
-
 		body, err := buildTaskUpdateBody(runtime)
 		if err != nil {
 			// buildTaskUpdateBody already returns a typed validation error;
@@ -70,11 +55,17 @@ var UpdateTask = common.Shortcut{
 			return err
 		}
 
+		taskIds := strings.Split(runtime.Str("task-id"), ",")
 		var updatedTasks []map[string]interface{}
 
-		for _, taskID := range taskIDs {
+		for _, taskId := range taskIds {
+			taskId = strings.TrimSpace(taskId)
+			if taskId == "" {
+				continue
+			}
+
 			params := map[string]interface{}{"user_id_type": "open_id"}
-			data, err := callTaskAPITyped(runtime, http.MethodPatch, "/open-apis/task/v2/tasks/"+url.PathEscape(taskID), params, body)
+			data, err := callTaskAPITyped(runtime, http.MethodPatch, "/open-apis/task/v2/tasks/"+url.PathEscape(taskId), params, body)
 			if err != nil {
 				return err
 			}
@@ -85,28 +76,19 @@ var UpdateTask = common.Shortcut{
 			}
 		}
 
-		updateFields, _ := body["update_fields"].([]string)
 		var tasks []map[string]interface{}
 		for _, task := range updatedTasks {
 			guid, _ := task["guid"].(string)
 			urlVal, _ := task["url"].(string)
 			urlVal = truncateTaskURL(urlVal)
-			confirmed := make(map[string]interface{})
-			for _, field := range updateFields {
-				if value, ok := task[field]; ok {
-					confirmed[field] = value
-				}
-			}
 			tasks = append(tasks, map[string]interface{}{
-				"guid":      guid,
-				"url":       urlVal,
-				"confirmed": confirmed,
+				"guid": guid,
+				"url":  urlVal,
 			})
 		}
 		// Standardized write output: return resource identifiers
 		outData := map[string]interface{}{
-			"updated_fields": updateFields,
-			"tasks":          tasks,
+			"tasks": tasks,
 		}
 
 		runtime.OutFormat(outData, &output.Meta{Count: len(updatedTasks)}, func(w io.Writer) {
@@ -130,26 +112,6 @@ var UpdateTask = common.Shortcut{
 	},
 }
 
-func parseTaskGUIDs(input string) ([]string, error) {
-	parts := strings.Split(input, ",")
-	taskGUIDs := make([]string, 0, len(parts))
-	for _, part := range parts {
-		if strings.TrimSpace(part) == "" {
-			continue
-		}
-		guid, err := parseTaskGUID(part)
-		if err != nil {
-			return nil, err
-		}
-		taskGUIDs = append(taskGUIDs, guid)
-	}
-	if len(taskGUIDs) == 0 {
-		_, err := parseTaskGUID("")
-		return nil, err
-	}
-	return taskGUIDs, nil
-}
-
 func buildTaskUpdateBody(runtime *common.RuntimeContext) (map[string]interface{}, error) {
 	taskObj := make(map[string]interface{})
 	var updateFields []string

shortcuts/task/task_update_test.go

@@ -1,201 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package task
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"reflect"
-	"testing"
-
-	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/httpmock"
-	"github.com/larksuite/cli/shortcuts/common"
-	"github.com/spf13/cobra"
-)
-
-func TestParseTaskGUIDs(t *testing.T) {
-	got, err := parseTaskGUIDs(" task-guid-1, https://applink.larksuite.com/client/todo/detail?guid=task-guid-2 ")
-	if err != nil {
-		t.Fatalf("parseTaskGUIDs() error = %v", err)
-	}
-	want := []string{"task-guid-1", "task-guid-2"}
-	if !reflect.DeepEqual(got, want) {
-		t.Fatalf("parseTaskGUIDs() = %v, want %v", got, want)
-	}
-
-	_, err = parseTaskGUIDs("task-guid-1,t12345")
-	if err == nil {
-		t.Fatal("parseTaskGUIDs() error = nil, want invalid display-number error")
-	}
-}
-
-func TestTaskUpdateDryRunPreviewsEveryTaskID(t *testing.T) {
-	cmd := &cobra.Command{}
-	cmd.Flags().String("task-id", "task-guid-1,https://applink.larksuite.com/client/todo/detail?guid=task-guid-2", "")
-	cmd.Flags().String("summary", "updated", "")
-	cmd.Flags().String("description", "", "")
-	cmd.Flags().String("due", "", "")
-	cmd.Flags().String("data", "", "")
-
-	preview := UpdateTask.DryRun(context.Background(), &common.RuntimeContext{Cmd: cmd})
-	payload, err := json.Marshal(preview)
-	if err != nil {
-		t.Fatalf("marshal dry-run preview: %v", err)
-	}
-
-	var got struct {
-		API []struct {
-			Method string                 `json:"method"`
-			URL    string                 `json:"url"`
-			Params map[string]interface{} `json:"params"`
-			Body   map[string]interface{} `json:"body"`
-		} `json:"api"`
-	}
-	if err := json.Unmarshal(payload, &got); err != nil {
-		t.Fatalf("decode dry-run preview: %v", err)
-	}
-	if len(got.API) != 2 {
-		t.Fatalf("dry-run API calls = %d, want 2; payload: %s", len(got.API), payload)
-	}
-
-	wantURLs := []string{
-		"/open-apis/task/v2/tasks/task-guid-1",
-		"/open-apis/task/v2/tasks/task-guid-2",
-	}
-	for i, call := range got.API {
-		if call.Method != "PATCH" {
-			t.Errorf("api[%d].method = %q, want PATCH", i, call.Method)
-		}
-		if call.URL != wantURLs[i] {
-			t.Errorf("api[%d].url = %q, want %q", i, call.URL, wantURLs[i])
-		}
-		if !reflect.DeepEqual(call.Params, map[string]interface{}{"user_id_type": "open_id"}) {
-			t.Errorf("api[%d].params = %#v", i, call.Params)
-		}
-		if !reflect.DeepEqual(call.Body, got.API[0].Body) {
-			t.Errorf("api[%d].body = %#v, want same body as first call %#v", i, call.Body, got.API[0].Body)
-		}
-	}
-}
-
-func TestTaskUpdateNormalizesAllIDsAndReturnsConfirmedFields(t *testing.T) {
-	f, stdout, _, reg := taskShortcutTestFactory(t)
-	warmTenantToken(t, f, reg)
-
-	first := &httpmock.Stub{
-		Method: "PATCH",
-		URL:    "/open-apis/task/v2/tasks/task-guid-1",
-		Body: map[string]interface{}{
-			"code": 0, "msg": "success",
-			"data": map[string]interface{}{
-				"task": map[string]interface{}{
-					"guid":        "task-guid-1",
-					"url":         "https://example.com/task-guid-1",
-					"summary":     "server summary one",
-					"description": "server description one",
-				},
-			},
-		},
-	}
-	second := &httpmock.Stub{
-		Method: "PATCH",
-		URL:    "/open-apis/task/v2/tasks/task-guid-2",
-		Body: map[string]interface{}{
-			"code": 0, "msg": "success",
-			"data": map[string]interface{}{
-				"task": map[string]interface{}{
-					"guid":    "task-guid-2",
-					"url":     "https://example.com/task-guid-2",
-					"summary": "server summary two",
-				},
-			},
-		},
-	}
-	reg.Register(first)
-	reg.Register(second)
-
-	err := runMountedTaskShortcut(t, UpdateTask, []string{
-		"+update",
-		"--task-id", "task-guid-1,https://applink.larksuite.com/client/todo/detail?guid=task-guid-2",
-		"--summary", "requested summary",
-		"--description", "requested description",
-		"--format", "json",
-		"--as", "bot",
-	}, f, stdout)
-	if err != nil {
-		t.Fatalf("UpdateTask error = %v", err)
-	}
-	reg.Verify(t)
-
-	var envelope map[string]interface{}
-	if err := json.Unmarshal(stdout.Bytes(), &envelope); err != nil {
-		t.Fatalf("decode output: %v\n%s", err, stdout.String())
-	}
-	data, ok := envelope["data"].(map[string]interface{})
-	if !ok {
-		t.Fatalf("data = %#v, want object", envelope["data"])
-	}
-	if got := stringSlice(data["updated_fields"]); !reflect.DeepEqual(got, []string{"summary", "description"}) {
-		t.Fatalf("updated_fields = %v, want [summary description]", got)
-	}
-
-	tasks, ok := data["tasks"].([]interface{})
-	if !ok || len(tasks) != 2 {
-		t.Fatalf("tasks = %#v, want two tasks", data["tasks"])
-	}
-	firstTask := tasks[0].(map[string]interface{})
-	if firstTask["guid"] != "task-guid-1" || firstTask["url"] != "https://example.com/task-guid-1" {
-		t.Fatalf("first task identifiers = %#v", firstTask)
-	}
-	if got := firstTask["confirmed"]; !reflect.DeepEqual(got, map[string]interface{}{
-		"summary": "server summary one", "description": "server description one",
-	}) {
-		t.Fatalf("first confirmed = %#v", got)
-	}
-
-	secondTask := tasks[1].(map[string]interface{})
-	if got := secondTask["confirmed"]; !reflect.DeepEqual(got, map[string]interface{}{
-		"summary": "server summary two",
-	}) {
-		t.Fatalf("second confirmed = %#v; omitted server fields must not be echoed from the request", got)
-	}
-}
-
-func TestTaskUpdateValidatesEveryIDBeforeFirstWrite(t *testing.T) {
-	f, stdout, _, reg := taskShortcutTestFactory(t)
-	warmTenantToken(t, f, reg)
-
-	err := runMountedTaskShortcut(t, UpdateTask, []string{
-		"+update",
-		"--task-id", "task-guid-1,t12345",
-		"--summary", "must not be written",
-		"--format", "json",
-		"--as", "bot",
-	}, f, stdout)
-	if err == nil {
-		t.Fatal("UpdateTask error = nil, want invalid task ID error")
-	}
-
-	problem, ok := errs.ProblemOf(err)
-	if !ok || problem.Category != errs.CategoryValidation || problem.Subtype != errs.SubtypeInvalidArgument {
-		t.Fatalf("error = %T %v, want typed invalid-argument error", err, err)
-	}
-	var validationErr *errs.ValidationError
-	if !errors.As(err, &validationErr) || validationErr.Param != "--task-id" {
-		t.Fatalf("error param = %#v, want --task-id", validationErr)
-	}
-}
-
-func stringSlice(value interface{}) []string {
-	items, _ := value.([]interface{})
-	result := make([]string, 0, len(items))
-	for _, item := range items {
-		if str, ok := item.(string); ok {
-			result = append(result, str)
-		}
-	}
-	return result
-}

skills/lark-apps/references/lark-apps-file.md

@@ -28,7 +28,7 @@
 ## 各命令
 
 ### +file-list
-列出应用文件，支持精确过滤：`--name`（文件名）、`--path`（远端路径）、`--type`（MIME 类型）、`--size-gt`/`--size-lt`（字节）、`--uploaded-since`/`--uploaded-until`（上传时间区间，时间格式见末尾）。分页 `--page-size`（默认 20，范围 1..200）/ `--page-token`。列表每项给名称、路径、大小、类型、上传时间（pretty 表格即这 5 列）；上传者、下载地址（如有）仅在 JSON 输出里，单文件详情用 `+file-get`。
+列出应用文件，支持精确过滤：`--name`（文件名）、`--path`（远端路径）、`--type`（MIME 类型）、`--size-gt`/`--size-lt`（字节）、`--uploaded-since`/`--uploaded-until`（上传时间区间，时间格式见末尾）。分页 `--page-size`（默认 20）/ `--page-token`。列表每项给名称、路径、大小、类型、上传时间（pretty 表格即这 5 列）；上传者、下载地址（如有）仅在 JSON 输出里，单文件详情用 `+file-get`。
 
 ```bash
 lark-cli apps +file-list --app-id app_xxx

skills/lark-base/SKILL.md

@@ -29,7 +29,7 @@ metadata:
 ## 使用边界
 
 - Base 业务操作只使用 `lark-cli base +...` shortcut，不使用旧聚合式 `+table / +field / +record / +view / +history / +workspace`。
-- 执行 update 前必须先查当前 shortcut 的 `--help` 或对应 reference。若命令要求完整配置，首次请求必须基于可信的当前配置执行 read-modify-write：只修改用户明确指定的内容，保留其他仍适用的可写配置，并按命令要求的结构提交。若命令支持局部／delta update，按其契约提交最小合法 payload；不得以不完整请求试错补参。
+- 本轮 Base 不依赖 `lark-cli schema`。SKILL 只保留路由、风险和复杂 JSON/DSL；简单命令由命令自身的参数、tips 和错误恢复承接。
 - 用户要把 Excel / CSV / `.base` 导入成 Base 时，先转 `lark-cli drive +import --type bitable`，导入完成后再回到 Base 命令。
 - 认证、初始化、scope、身份切换、权限不足恢复属于 `lark-shared`；Base 文档只保留会影响 Base 路径选择的权限规则。
 
@@ -104,18 +104,19 @@ metadata:
 
 ## 写入前置规则
 
+- 更新前先看命令说明：需要完整提交时，先读取并补齐当前配置，只改用户指定的内容，再按命令要求提交；支持局部修改时，按命令说明和 reference 提交最小合法 payload。
 - 优先用写入返回确认结果；返回信息不足或任务明确要求核验时，再读回。
 - 写记录前先读字段结构；只写存储字段。系统字段、附件字段、`formula`、`lookup` 不作为普通记录写入目标。
 - 附件上传、下载、删除走专用 `+record-*-attachment` 命令。
 - 写字段前先读 [lark-base-field-json.md](references/lark-base-field-json.md)；涉及 `formula` / `lookup` 时必须读 [formula-field-guide.md](references/formula-field-guide.md) / [lookup-field-guide.md](references/lookup-field-guide.md)。
 - 表名、字段名、视图名、workflow 配置中的名称必须来自真实返回；跨表场景还要读取目标表结构。
-- 删除、角色更新、字段更新、表单提交（`+form-submit`）等高风险操作遵循 CLI 的 confirmation gate，必须带 `--yes`；目标不明确时先用 get/list 消歧。
+- 删除、角色更新、字段更新等高风险操作遵循 CLI 的 confirmation gate；目标不明确时先用 get/list 消歧。
 - 批量写入单批最多 200 条；连续写同一表时串行执行，遇到 `1254291` 按短暂等待后重试处理。
 - `select` 字段只支持写入字段中已有的选项；构造 CellValue 前先用 `+field-list` 或 `+field-search-options` 确认目标选项存在。
 
 ## 表单与视图细节
 
-- `+form-submit` 是高风险写操作，必须带 `--yes` 确认；调用前必须先跑 `+form-detail`，读取 `questions[].type`、`required`、`filter` 和附件场景需要的 `base_token`；不要填写被 filter 隐藏的问题。
+- `+form-submit` 前必须先跑 `+form-detail`，读取 `questions[].type`、`required`、`filter` 和附件场景需要的 `base_token`；不要填写被 filter 隐藏的问题。
 - 表单附件不要写进 `fields`，放在 `--json.attachments`；提交附件时必须同时传表单所属 Base 的 `--base-token`。
 - `+view-set-filter` 是唯一保留的 view reference；sort/group/card/timebar/visible-fields 这类配置先用对应 get 命令读现状，保留未修改字段，只替换用户要求变更的配置。
 - 视图适合持久化、共享和 UI 复用；一次性筛选/排序可先用 `+record-list` / `+record-search` 的 filter/sort 验证结果，再按需要沉淀为持久视图。

skills/lark-base/references/lark-base-form-submit.md

@@ -4,8 +4,6 @@
 
 通过表单分享链接填写并提交多维表格表单。仅支持分享模式（share_token），支持填写普通字段值和上传本地文件作为附件。
 
-> **⚠️ 高风险写操作（high-risk-write）：** 本命令会向表单写入并提交数据，属于高风险写操作，必须额外传递 `--yes` 进行确认，否则会返回 `confirmation_required` 错误并退出。当用户明确要求提交且目标表单无歧义时，直接附加 `--yes`，无需再次询问。
-
 ## 填写前必读：先获取表单详情
 
 **在调用 `+form-submit` 之前，必须先使用 `+form-detail` 获取表单详情。** 原因如下：
@@ -23,11 +21,10 @@ lark-cli base +form-detail --share-token <share_token>
 
 # 2️⃣ 根据返回的 questions 列表，按 type 格式化值、检查 required、判断 filter 条件
 
-# 3️⃣ 再提交（高风险写操作，必须带 --yes）
+# 3️⃣ 再提交
 lark-cli base +form-submit \
   --share-token <share_token> \
-  --json '{"fields":{...}}' \
-  --yes
+  --json '{"fields":{...}}'
 ```
 
 `+form-detail` 的返回中要重点读取 `questions[].type`、`questions[].required`、题目 `filter` 和附件场景所需的 `data.base_token`。
@@ -38,8 +35,7 @@ lark-cli base +form-submit \
 # 基本提交（填写普通字段）
 lark-cli base +form-submit \
   --share-token <share_token> \
-  --json '{"fields":{"服务评分":5,"评价内容":"服务态度好"}}' \
-  --yes
+  --json '{"fields":{"服务评分":5,"评价内容":"服务态度好"}}'
 
 # 带附件提交（需要额外提供 --base-token）
 lark-cli base +form-submit \
@@ -51,17 +47,15 @@ lark-cli base +form-submit \
       "附件字段名": ["./report.pdf", "./photo.png"],
       "另一个附件字段": ["./doc.docx"]
     }
-  }' \
-  --yes
+  }'
 
 # 使用应用身份（bot）
 lark-cli base +form-submit \
   --share-token <share_token> \
   --json '{"fields":{...}}' \
-  --as bot \
-  --yes
+  --as bot
 
-# 预览 API 调用（不实际执行，dry-run 无需 --yes）
+# 预览 API 调用（不实际执行）
 lark-cli base +form-submit \
   --share-token <share_token> \
   --json '{"fields":{...}}' \
@@ -75,7 +69,6 @@ lark-cli base +form-submit \
 | `--share-token <token>` | 是 | 表单分享 Token（必填），从表单分享链接中提取 |
 | `--base-token <token>` | 条件必填 | Base token；**当 `--json` 包含 `attachments` 时必须提供**，用于将附件上传到 Base Drive Media |
 | `--json <json>` | 是 | JSON 对象，包含 `"fields"`（普通字段值）和 `"attachments"`（附件上传），详见下方说明 |
-| `--yes` | 是 | 确认高风险写操作。本命令为 high-risk-write，不带 `--yes` 会返回 `confirmation_required` |
 | `--format` | 否 | 输出格式：json（默认）\| pretty \| table \| ndjson \| csv |
 | `--as` | 否 | 身份：user（默认）\| bot |
 | `--dry-run` | 否 | 预览 API 调用，不执行 |
@@ -145,8 +138,7 @@ https://www.example.com/share/base/form/shrbcvST8eZy0vk8zjVZ1CAXNye
 ```bash
 lark-cli base +form-submit \
   --share-token shrbcvST8eZy0vk8zjVZ1CAXNye \
-  --json '{"fields":{...}}' \
-  --yes
+  --json '{"fields":{...}}'
 ```
 
 ## 输出格式
@@ -166,7 +158,6 @@ lark-cli base +form-submit \
 
 ## 提示
 
-- **本命令为高风险写操作（high-risk-write），必须额外传递 `--yes` 确认**，否则返回 `confirmation_required` 并以非零码退出；`--dry-run` 预览除外
 - 本命令仅支持通过表单分享链接（share_token）提交，不支持通过 base_token + table_id + view_id 方式提交
 - **当 `--json` 包含 `attachments` 时，必须额外提供 `--base-token`**，因为附件上传到 Base Drive Media 需要指定目标 Base
 - 附件字段只需在 `--json.attachments` 中提供本地路径即可，CLI 自动完成校验、并行上传、Token 获取和合并写入

skills/lark-calendar/SKILL.md

@@ -16,16 +16,14 @@ metadata:
 
 ## 身份
 
-按**日程归属**选身份：
-
-- 查看/管理登录用户本人的日程 → `--as user`（默认，绝大多数场景）。
-- 查看/管理 bot 自己创建/拥有的日程 → `--as bot` 
+日程操作默认使用 `--as user`（查看和管理当前用户的日程）。`--as bot` 只能访问 bot 自己的（空）日历，会拿到空结果——不要用 bot 身份查用户日程。
 
 ```bash
-# 用户本人日程 → user
-lark-cli calendar +agenda --as user
-# bot 自建或参与的日程 → bot
+# BAD — bot 身份查用户日程，返回空列表
 lark-cli calendar +agenda --as bot
+
+# GOOD — user 身份查日程
+lark-cli calendar +agenda --as user
 ```
 
 ## Shortcuts
@@ -50,8 +48,6 @@ lark-cli calendar +agenda --as bot
 lark-cli calendar +get --calendar-id <calendar_id> --event-id <event_id>
 ```
 
-日程描述统一使用 `description` 一个字段，按 **Markdown** 富文本处理。读取日程时 `description` 返回 Markdown 富文本（仅有纯文本描述时返回该纯文本）；创建/更新日程时也通过 `--description` 传入 Markdown。
-
 ### `+search-event` — 按关键词、时间范围和参会人搜索日程
 
 仅返回基础字段（`event_id`/`summary`/`start`/`end` 等），需要详情请走 `+get`。
@@ -190,8 +186,6 @@ lark-cli contact +search-user --query <query> --as user
 lark-cli im +chat-search --query <query> --as user
 ```
 
-> 搜索用户接口不支持 bot 身份，必须用 `--as user`；搜到的 `ou_` open_id 用于日程参与人操作（如添加日程参与人）。
-
 ## 不在本 skill 范围
 
 - 查询过去的视频会议记录 → [lark-vc](../lark-vc/SKILL.md)

skills/lark-calendar/references/lark-calendar-create.md

@@ -32,19 +32,19 @@ lark-cli calendar +create --summary "..." --start "..." --end "..." \
 | `--summary <text>` | 否 | 日程标题。注意：标题中不应该出现时间、地点、人物信息 |
 | `--start <time>` | 是 | 开始时间（ISO 8601，如 `2026-03-12T14:00+08:00`） |
 | `--end <time>` | 是 | 结束时间（ISO 8601） |
-| `--description <markdown>` | 否 | 日程描述，统一使用此字段，格式为 **Markdown**。提供会议议程、活动内容、注意事项或链接等。支持加粗、斜体、下划线（`<u>...</u>`）、删除线、链接 `[文本](url)`、标题（`# ` 到 `### `，最多三级）、引用（`> `）、有序/无序列表、GFM 表格（`\| 列1 \| 列2 \|` + 分隔行 `\| --- \| --- \|`）、以及图片 `![图片名](图片URL)`（标准 Markdown 图片语法：远程 URL 原样使用；**本地图片路径**（相对路径、且位于当前工作目录内）会自动上传到云盘并在端上内联渲染——绝对路径或工作目录之外的路径会报错；端上已有图片读回为 Markdown 图片）。飞书文档 URL（直接粘贴裸链接，或写成 `[文本](url)`）会自动解析为内联文档，端上展示文档标题而非裸链接。支持 `@文件路径` 或 `-`（stdin）读取。**禁止**用 `***文本***` 同时表示加粗+斜体（端上会残留 `*`）；应嵌套书写，如 `**<u>*~~文本~~*</u>**` 或 `*<u>**~~文本~~**</u>*`。|
-| `--attendee-ids <id_list>` | 否 | 参与人 ID 列表（逗号分隔）。支持用户（`ou_`）、群组（`oc_`）和会议室（`omm_`）。AI 提取时请务必保留对应前缀。bot 可作为合法参会人，无需剔除 |
+| `--description <text>` | 否 | 日程详细描述。提供会议议程、活动内容、注意事项或链接等。与 summary 配合使用，仅关注当前日程信息 |
+| `--attendee-ids <id_list>` | 否 | 参与人 ID 列表（逗号分隔）。支持用户（`ou_`）、群组（`oc_`）和会议室（`omm_`）。AI 提取时请务必保留对应前缀 |
 | `--calendar-id <id>` | 否 | 日历 ID（省略则使用主日历） |
 | `--rrule <rrule>` | 否 | 重复日程的重复性规则，规则设置方式参考rfc5545。示例值："FREQ=DAILY;INTERVAL=1;UNTIL=<具体日期>" |
 | `--dry-run` | 否 | 预览 API 调用，不执行 |
 
 > 当用户表达'每周 X'、'每周重复'、'连续 N 周'时，必须使用 rrule 创建重复性日程，而非创建多个独立日程
-> `--description` 行内同时加粗和斜体时，**禁止**写 `***文本***`（端上会残留 `*`）；必须让 `**` 与 `*` 各自成对嵌套，例如 `**<u>*~~文本~~*</u>**` 或 `*<u>**~~文本~~**</u>*`。
 > 自动设置 `attendee_ability: "can_modify_event"`，参会人可查看彼此并编辑日程。
 > 自动设置 `free_busy_status: "busy"`，默认日程忙闲状态为忙碌。
 > 自动设置 `reminders: [{"minutes": 5}]`，默认日程开始前 5 分钟提醒。
 > 自动设置 `vchat: {"vc_type": "vc"}`，默认日程包含飞书视频会议。如需其他视频会议类型或不含视频会议，请使用完整 API 命令。
 > 失败保护：若添加参会人失败（如 open_id 错误），CLI 会自动删除刚创建的空日程（回滚，不通知参会人）。
+> 搜索用户接口不支持 bot 身份，需用 `--as user` 进行搜索。
 > 审批会议室：`+create` 不暴露低频字段 `attendees[].approval_reason`。如果会议室要求审批，请使用用户身份先创建日程，再用完整 API `calendar event.attendees create --as user` 添加会议室并传 `approval_reason`。
 
 ## 高级用法（完整 API 命令）

skills/lark-calendar/references/lark-calendar-room-find.md

@@ -50,13 +50,12 @@ lark-cli calendar +room-find \
 | `--room-name <text>` | 否 | 会议室名称约束，支持以**英文逗号**分隔传入多个名称。仅当用户明确提到会议室专名、会议室号或编号区间时使用。 |
 | `--min-capacity <n>` | 否 | 会议室最小容纳人数。当用户明确参会人数或提出“至少容纳N人”等要求时，提取数字放入此参数，必须为正整数。 |
 | `--max-capacity <n>` | 否 | 会议室最大容纳人数。用于过滤过大空间，必须为正整数。 |
-| `--attendee-ids <id_list>` | 否 | 参会对象 ID 列表。支持用户 ID（`ou_` 前缀）和群组 ID（`oc_` 前缀），多个 ID 以逗号分隔。**不要传入 bot 的 open_id**：bot 是虚拟身份，不占会议室席位、无会议室偏好，传入只会干扰推荐结果。 |
+| `--attendee-ids <id_list>` | 否 | 参会对象 ID 列表。支持用户 ID（`ou_` 前缀）和群组 ID（`oc_` 前缀），多个 ID 以逗号分隔。 |
 | `--event-rrule <rrule>` | 否 | 重复日程的重复性规则，规则设置方式参考rfc5545。**【⚠️注意：系统绝对不支持 COUNT，如需限制重复次数，必须转为 UNTIL】**。示例值："FREQ=DAILY;INTERVAL=1" |
 | `--timezone <tz>` | 否 | 对话中明确提及的预约日程所使用的时区（默认取用户设备时区，例如 `Asia/Shanghai`） |
 
 ## 规则
 
-- 构造 `--attendee-ids` 前，先剔除 bot 参会人：bot 不占席位、无偏好，不应参与会议室推荐。
 - 多个 `--slot` 会由 CLI 内部并发调用单时间块接口，再聚合成一次输出
 - `+room-find` 的时间输入必须是**确定时间块**，不是时间区间搜索。
 - 如果是重复性日程，必须校验返回中的 `reserve_until_time`（该会议室最晚可预约时间）是否覆盖 `event-rrule` 对应的重复范围。

skills/lark-calendar/references/lark-calendar-schedule-clear-time.md

@@ -39,7 +39,6 @@ lark-cli calendar +freebusy --start "<start>" --end "<end>"
 ```
 
 规则：
-- 参与人含 **bot**：无需为 bot 查询忙闲。bot 是虚拟身份，可并行多个会议、无忙闲语义，检查它没有意义。
 - 参与人过多（超过 5 人）：仅查询**当前用户**及少数核心人员忙闲即可
 - 参与人含**群组**：无需展开群组成员查询忙闲
 - 如果用户是从 `+suggestion` 确认了时间块后进入本分支的，**无需再调用 `+freebusy`**

skills/lark-calendar/references/lark-calendar-suggestion.md

@@ -45,7 +45,7 @@ lark-cli calendar +suggestion \
 | ------------------------------- | ----- | ------------------------------------------------------------------- |
 | `--start <time>`                | 否     | 搜索区间开始时间（支持日期/ISO 8601等格式，默认**当前时间**）                                |
 | `--end <time>`                  | 否     | 搜索区间结束时间（默认与 `--start` 属于同一天，自动取当天结束时间）                                                     |
-| `--attendee-ids <id_list>`     | 否     | 目标参与人 ID 列表。提取对应实体的 ID。支持用户（`ou_` 前缀）和群组（`oc_` 前缀）。多个 ID 使用英文逗号分隔。**不要传入 bot 的 open_id**：bot 是虚拟身份，可并行多个会议、无忙闲语义，传入会干扰推荐时段的忙闲计算。 |
+| `--attendee-ids <id_list>`     | 否     | 目标参与人 ID 列表。提取对应实体的 ID。支持用户（`ou_` 前缀）和群组（`oc_` 前缀）。多个 ID 使用英文逗号分隔 |
 | `--event-rrule <rrule>`         | 否     | 重复日程的重复性规则，规则设置方式参考rfc5545。**【⚠️注意：系统绝对不支持 COUNT，如需限制重复次数，必须转为 UNTIL】**。示例值："FREQ=DAILY;INTERVAL=1"                                              |
 | `--duration-minutes <min>`      | 否     | 会议时长（分钟）。优先使用用户显式指定的值，若未指定则尝试根据上下文推断，推断失败则不传                                        |
 | `--timezone <tz>`               | 否     | 对话中明确提及的预约日程所使用的时区（默认取用户设备时区，例如 `Asia/Shanghai`）                                |

skills/lark-calendar/references/lark-calendar-update.md

@@ -43,7 +43,7 @@ lark-cli calendar +update \
 | `--event-id <id>` | 是 | 要更新的日程 ID。重复性日程请根据操作范围选择 ID，详见 [重复性日程操作规范](lark-calendar-recurring.md) |
 | `--calendar-id <id>` | 否 | 日历 ID（省略则使用 `primary`） |
 | `--summary <text>` | 否 | 新日程标题。仅在显式传入 `--summary` 时更新；若传空字符串，会把标题清空 |
-| `--description <markdown>` | 否 | 新日程描述，统一使用此字段，格式为 **Markdown**（加粗、斜体、下划线 `<u>...</u>`、删除线、链接 `[文本](url)`、标题 `# `~`### `（最多三级）、引用 `> `、有序/无序列表、GFM 表格 `\| 列1 \| 列2 \|` + 分隔行 `\| --- \| --- \|`、以及图片 `![图片名](图片URL)`（标准 Markdown 图片语法：远程 URL 原样使用；**本地图片路径**（相对路径、且位于当前工作目录内）会自动上传到云盘并在端上内联渲染——绝对路径或工作目录之外的路径会报错；端上已有图片读回为 Markdown 图片）。飞书文档 URL（裸链接或 `[文本](url)`）会自动解析为内联文档，端上展示文档标题。支持 `@文件路径` 或 `-`（stdin）读取。仅在显式传入时更新；传空字符串 `""` 会清空描述。**禁止**用 `***文本***` 同时表示加粗+斜体（端上会残留 `*`）；应嵌套书写，如 `**<u>*~~文本~~*</u>**` 或 `*<u>**~~文本~~**</u>*`。 |
+| `--description <text>` | 否 | 新日程描述。目前 API 方式不支持编辑富文本描述；如果日程描述通过客户端编辑为富文本内容，则使用 API 更新描述会导致富文本格式丢失。仅在显式传入 `--description` 时更新；若传空字符串，会把描述清空 |
 | `--start <time>` | 否 | 新开始时间（ISO 8601，如 `2026-03-12T14:00+08:00`）。更新日程时间时必须同时传 `--end` |
 | `--end <time>` | 否 | 新结束时间（ISO 8601）。更新日程时间时必须同时传 `--start` |
 | `--rrule <rrule>` | 否 | 新重复规则（RFC5545）。**不要使用 COUNT；如需限制次数，推算后转为 UNTIL** |
@@ -58,12 +58,9 @@ lark-cli calendar +update \
 
 - `--add-attendee-ids` 是**增量添加**，不是替换最终参与人列表。不要用它表达“只保留这些人”。
 - 对 `--summary`、`--description`，CLI 以“是否显式传入该 flag”判断是否更新，而不是以“值是否为空”判断；如果显式传入空字符串，会把对应字段清空。
-- 日程描述统一走 `--description`（按 Markdown 富文本处理）。
-- 行内同时加粗和斜体时，**禁止**写 `***文本***`（端上会残留 `*`）；必须让 `**` 与 `*` 各自成对嵌套，例如 `**<u>*~~文本~~*</u>**` 或 `*<u>**~~文本~~**</u>*`。
 - 只想增删参会人或会议室时，不需要同时传 `--summary`、`--start`、`--end` 等日程字段。
 - 只想修改标题、描述、时间或重复规则时，不需要同时传 `--add-attendee-ids` 或 `--remove-attendee-ids`。
 - 如需替换某个参与人、群组或会议室，使用 `--remove-attendee-ids <旧ID>` + `--add-attendee-ids <新ID>`。
-- bot 可作为合法参会人添加，无需剔除。
 - 会议室是 resource attendee，必须使用 `omm_` ID 添加到参会人列表，不能脱离日程单独预定。
 - 更新重复性日程时，必须先确定操作范围（仅此次/全部/此次及后续），然后按 [重复性日程操作规范](lark-calendar-recurring.md) 执行。
 - 当同一次命令组合多个动作时，执行顺序为“日程字段 -> 移除参会人 -> 添加参会人”。若中途失败，不会自动回滚已成功步骤；错误信息会说明已完成的步骤。