chore: route doubao vm cli to sheet ppe

os.Stdin.Stat is intentional here - pipe detection needs the real
process fd; IOStreams.In is a plain io.Reader without Stat. Clears the
lint failure left by the stdin-fallback commit.

.github/CODEOWNERS

@@ -1,7 +1,4 @@
-/go.mod @liangshuo-1
-/go.sum @liangshuo-1
 /internal/ @liangshuo-1
-/shortcuts/common/ @liangshuo-1
 
 # Last match wins: existing domains below are exempt, only new skills/ entries need review.
 /skills/ @liangshuo-1

.github/workflows/ci.yml

@@ -1,5 +1,4 @@
 name: CI
-run-name: ${{ github.event_name == 'pull_request' && format('CI / {0}', github.event.pull_request.number) || '' }}
 
 on:
   push:
@@ -9,12 +8,6 @@ on:
     types: [opened, synchronize, reopened, edited]
   workflow_dispatch:
 
-# PR metadata edits can retrigger full CI for the same head. Keep only the
-# newest run for a pull request; push and manual runs use a unique run ID.
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-
 permissions:
   contents: read
   actions: read
@@ -54,34 +47,6 @@ jobs:
             exit 1
           fi
 
-  plugin-integration:
-    needs: fast-gate
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
-        with:
-          persist-credentials: false
-      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
-        with:
-          go-version-file: go.mod
-      # No fetch_meta: the git-archive clean tree must embed only the
-      # committed meta_data stub (reproduces the bare-module customer state).
-      - name: Run plugin-integration L4 tests
-        run: go test -count=1 -timeout=15m ./tests/plugin_e2e/...
-
-  sidecar-integration:
-    needs: fast-gate
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
-        with:
-          persist-credentials: false
-      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
-        with:
-          go-version-file: go.mod
-      - name: Run sidecar tag build + HMAC round-trip
-        run: make sidecar-test
-
   # ── Layer 2: Quality Gate ──────────────────────────────────────────
   unit-test:
     needs: fast-gate
@@ -121,10 +86,8 @@ jobs:
         run: echo "QUALITY_GATE_CHANGED_FROM=$(bash scripts/resolve-changed-from.sh)" >> "$GITHUB_ENV"
       - name: Run golangci-lint
         run: go run github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.1.6 run --new-from-rev="$QUALITY_GATE_CHANGED_FROM"
-      - name: Run source-contract lint guards (lintcheck)
+      - name: Run errs/ lint guards (lintcheck)
         run: go run -C lint . --changed-from "$QUALITY_GATE_CHANGED_FROM" ..
-      - name: Run lint module tests
-        run: go test -C lint ./... -count=1
 
   script-test:
     needs: fast-gate
@@ -211,11 +174,7 @@ jobs:
         run: python3 scripts/fetch_meta.py
       - name: Run tests with coverage
         run: |
-          # tests/ holds only L3/L4 suites (cli_e2e, plugin_e2e, sidecar_e2e) that
-          # have dedicated jobs; exclude the whole subtree so none of them runs a
-          # second time here — and, crucially, so an observe-only suite's failure
-          # can never block merges through coverage's spot in the results loop.
-          packages=$(go list ./... | grep -v '^github.com/larksuite/cli/tests/')
+          packages=$(go list ./... | grep -v '^github.com/larksuite/cli/tests/cli_e2e$' | grep -v '^github.com/larksuite/cli/tests/cli_e2e/')
           go test -race -coverprofile=coverage.txt -covermode=atomic $packages
       - name: Upload coverage to Codecov
         if: ${{ github.event_name != 'pull_request' || !github.event.pull_request.head.repo.fork }}
@@ -302,43 +261,15 @@ jobs:
   e2e-dry-run:
     needs: [unit-test, lint, script-test, deterministic-gate]
     runs-on: ubuntu-latest
-    timeout-minutes: 20
-    outputs:
-      mode: ${{ steps.e2e_domains.outputs.mode }}
-      reason: ${{ steps.e2e_domains.outputs.reason }}
-      live_packages: ${{ steps.e2e_domains.outputs.live_packages }}
     steps:
       - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
-        with:
-          fetch-depth: 0
       - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
         with:
           go-version-file: go.mod
       - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
           python-version: '3.x'
-      - name: Resolve CLI E2E domains
-        id: e2e_domains
-        run: node scripts/e2e_domains.js
-      - name: Validate CLI E2E domain outputs
-        env:
-          E2E_MODE: ${{ steps.e2e_domains.outputs.mode }}
-          E2E_LIVE_PACKAGES: ${{ steps.e2e_domains.outputs.live_packages }}
-        run: |
-          case "$E2E_MODE" in
-            skip)
-              [ -z "$E2E_LIVE_PACKAGES" ] || { echo "::error::Skip mode must not resolve live packages"; exit 1; }
-              ;;
-            full|subset)
-              [ -n "$E2E_LIVE_PACKAGES" ] || { echo "::error::No live packages resolved for mode $E2E_MODE"; exit 1; }
-              ;;
-            *)
-              echo "::error::Invalid CLI E2E mode: $E2E_MODE"
-              exit 1
-              ;;
-          esac
       - name: Build lark-cli
-        if: ${{ steps.e2e_domains.outputs.mode != 'skip' }}
         run: make build
       - name: Run dry-run E2E tests
         env:
@@ -346,50 +277,21 @@ jobs:
           LARKSUITE_CLI_APP_ID: dry-run
           LARKSUITE_CLI_APP_SECRET: dry-run
           LARKSUITE_CLI_BRAND: feishu
-          E2E_MODE: ${{ steps.e2e_domains.outputs.mode }}
-          E2E_REASON: ${{ steps.e2e_domains.outputs.reason }}
-          E2E_DRY_ROOT_PACKAGE: ${{ steps.e2e_domains.outputs.dry_root_package }}
-          E2E_DRY_PACKAGES: ${{ steps.e2e_domains.outputs.dry_packages }}
-        run: |
-          if [ "$E2E_MODE" = "skip" ]; then
-            echo "No dry-run CLI E2E needed: $E2E_REASON"
-            exit 0
-          fi
-          if [ -z "$E2E_DRY_ROOT_PACKAGE" ] && [ -z "$E2E_DRY_PACKAGES" ]; then
-            echo "::error::No dry-run CLI E2E packages resolved for mode $E2E_MODE"
-            exit 1
-          fi
-          echo "Dry-run CLI E2E domains: $E2E_MODE ($E2E_REASON)"
-          if [ -n "$E2E_DRY_ROOT_PACKAGE" ]; then
-            echo "Dry-run CLI E2E root package: $E2E_DRY_ROOT_PACKAGE"
-            go test -v -count=1 -timeout=5m "$E2E_DRY_ROOT_PACKAGE"
-          fi
-          if [ -n "$E2E_DRY_PACKAGES" ]; then
-            echo "Dry-run CLI E2E packages: $E2E_DRY_PACKAGES"
-            go test -v -count=1 -timeout=5m $E2E_DRY_PACKAGES -run 'DryRun|Regression'
-          fi
+        run: go test -v -count=1 -timeout=5m ./tests/cli_e2e/... -run 'DryRun|Regression'
 
   e2e-live:
-    needs: [unit-test, lint, script-test, deterministic-gate, e2e-dry-run]
-    if: ${{ always() && (github.event_name != 'pull_request' || !github.event.pull_request.head.repo.fork) && needs.unit-test.result == 'success' && needs.lint.result == 'success' && needs.script-test.result == 'success' && needs.deterministic-gate.result == 'success' && needs.e2e-dry-run.result == 'success' && (needs.e2e-dry-run.outputs.mode == 'full' || needs.e2e-dry-run.outputs.mode == 'subset') && needs.e2e-dry-run.outputs.live_packages != '' }}
+    needs: [unit-test, lint, script-test, deterministic-gate]
+    if: ${{ github.event_name != 'pull_request' || !github.event.pull_request.head.repo.fork }}
     runs-on: ubuntu-latest
-    timeout-minutes: 30
-    # Live E2E uses one repository-wide execution slot.
-    concurrency:
-      group: lark-cli-e2e-live
-      cancel-in-progress: false
-      queue: max
     permissions:
-      actions: read
       contents: read
       checks: write
     env:
       TEST_BOT1_APP_ID: ${{ secrets.TEST_BOT1_APP_ID }}
-      LARKSUITE_CLI_BRAND: feishu
+      TEST_BOT1_APP_SECRET: ${{ secrets.TEST_BOT1_APP_SECRET }}
+      TEST_USER_ACCESS_TOKEN: ${{ secrets.TEST_USER_ACCESS_TOKEN }}
     steps:
       - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
-        with:
-          fetch-depth: 0
       - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
         with:
           go-version-file: go.mod
@@ -397,75 +299,25 @@ jobs:
         with:
           python-version: '3.x'
       - name: Build lark-cli
-        id: build_cli
         run: make build
-      - name: Prepare shared live E2E tenant token
-        id: live_e2e_tat
-        env:
-          LARKSUITE_CLI_APP_ID: ${{ secrets.TEST_BOT1_APP_ID }}
-          TEST_BOT1_APP_SECRET: ${{ secrets.TEST_BOT1_APP_SECRET }}
-        run: node scripts/fetch_e2e_tat.js
-      - name: Run CLI E2E tests
-        # Keep an active Go test alive so t.Cleanup can finish. A queued stale
-        # run is rejected below before it can start live E2E.
-        if: ${{ always() && steps.build_cli.outcome == 'success' && steps.live_e2e_tat.outcome == 'success' }}
-        shell: bash
-        env:
-          GH_TOKEN: ${{ github.token }}
-          REPOSITORY: ${{ github.repository }}
-          EVENT_NAME: ${{ github.event_name }}
-          RUN_ID: ${{ github.run_id }}
-          RUN_NUMBER: ${{ github.run_number }}
-          RUN_GENERATION: ${{ github.event_name == 'pull_request' && format('CI / {0}', github.event.pull_request.number) || '' }}
-          LARK_CLI_BIN: ${{ github.workspace }}/lark-cli
-          E2E_MODE: ${{ needs.e2e-dry-run.outputs.mode }}
-          E2E_REASON: ${{ needs.e2e-dry-run.outputs.reason }}
-          E2E_LIVE_PACKAGES: ${{ needs.e2e-dry-run.outputs.live_packages }}
-          E2E_TENANT_AUTH_FILE: ${{ steps.live_e2e_tat.outputs.path }}
-          TEST_USER_ACCESS_TOKEN: ${{ secrets.TEST_USER_ACCESS_TOKEN }}
+      - name: Configure bot credentials
         run: |
-          if [ "$EVENT_NAME" = "pull_request" ]; then
-            workflow_id="$(gh api "repos/$REPOSITORY/actions/runs/$RUN_ID" --jq '.workflow_id')"
-            newer_runs="$(
-              gh api --paginate -X GET "repos/$REPOSITORY/actions/workflows/$workflow_id/runs" \
-                -f event=pull_request -f branch="$GITHUB_HEAD_REF" -f per_page=100 |
-                jq -r --arg repository "$REPOSITORY" --arg generation "$RUN_GENERATION" --argjson run_number "$RUN_NUMBER" \
-                  '.workflow_runs[] | select(.head_repository.full_name == $repository and .display_title == $generation and .run_number > $run_number) | .id'
-            )"
-            if [ -n "$newer_runs" ]; then
-              echo "::error::Superseded before live E2E started by newer workflow run(s): $newer_runs"
-              exit 1
-            fi
-          fi
-          if [ -z "${E2E_TENANT_AUTH_FILE:-}" ] || [ ! -f "$E2E_TENANT_AUTH_FILE" ]; then
-            echo "::error::Missing shared live E2E tenant token file"
+          if [ -z "$TEST_BOT1_APP_ID" ] || [ -z "$TEST_BOT1_APP_SECRET" ]; then
+            echo "::error::Missing required secrets: TEST_BOT1_APP_ID / TEST_BOT1_APP_SECRET"
             exit 1
           fi
-          export TEST_TENANT_ACCESS_TOKEN="$(cat "$E2E_TENANT_AUTH_FILE")"
-          rm -f "$E2E_TENANT_AUTH_FILE"
-          if ! LARKSUITE_CLI_APP_ID="$TEST_BOT1_APP_ID" \
-            LARKSUITE_CLI_TENANT_ACCESS_TOKEN="$TEST_TENANT_ACCESS_TOKEN" \
-            ./lark-cli whoami --as bot | node -e '
-            let input = "";
-            process.stdin.setEncoding("utf8");
-            process.stdin.on("data", (chunk) => { input += chunk; });
-            process.stdin.on("end", () => {
-              const result = JSON.parse(input);
-              if (result.identity !== "bot" || result.available !== true || result.tokenStatus !== "ready") process.exit(1);
-            });
-          '; then
-            echo "::error::Tenant credential preflight failed"
-            exit 1
-          fi
-          echo "Tenant credential preflight succeeded"
-          packages="$E2E_LIVE_PACKAGES"
+          printf '%s\n' "$TEST_BOT1_APP_SECRET" | ./lark-cli config init --app-id "$TEST_BOT1_APP_ID" --app-secret-stdin
+      - name: Run CLI E2E tests
+        env:
+          LARK_CLI_BIN: ${{ github.workspace }}/lark-cli
+        run: |
+          packages=$(go list ./tests/cli_e2e/... | grep -v '^github.com/larksuite/cli/tests/cli_e2e$' | grep -v '/demo$')
           if [ -z "$packages" ]; then
-            echo "::error::No live CLI E2E packages resolved for mode $E2E_MODE"
+            echo "No CLI E2E packages to test after exclusions."
             exit 1
           fi
-          echo "Live CLI E2E domains: $E2E_MODE ($E2E_REASON)"
-          echo "Live CLI E2E packages: $packages"
-          go run gotest.tools/gotestsum@v1.12.3 --rerun-fails=2 --rerun-fails-max-failures=20 --packages="$packages" --format testname --junitfile cli-e2e-report.xml -- -count=1 -v
+          packages_arg=$(printf '%s\n' "$packages" | paste -sd' ' -)
+          go run gotest.tools/gotestsum@v1.12.3 --rerun-fails=2 --rerun-fails-max-failures=20 --packages="$packages_arg" --format testname --junitfile cli-e2e-report.xml -- -count=1 -v
       - name: Publish CLI E2E test report
         if: ${{ !cancelled() }}
         uses: dorny/test-reporter@a43b3a5f7366b97d083190328d2c652e1a8b6aa2 # v3.0.0
@@ -520,7 +372,7 @@ jobs:
   # ── Results Gate (single required check for branch protection) ─────
   results:
     if: ${{ always() }}
-    needs: [fast-gate, unit-test, lint, script-test, deterministic-gate, coverage, deadcode, e2e-dry-run, e2e-live, security, license-header, plugin-integration, sidecar-integration]
+    needs: [fast-gate, unit-test, lint, script-test, deterministic-gate, coverage, deadcode, e2e-dry-run, e2e-live, security, license-header]
     runs-on: ubuntu-latest
     steps:
       - name: Evaluate results
@@ -540,19 +392,10 @@ jobs:
           echo "| L3 | e2e-live | ${{ needs.e2e-live.result }} |" >> $GITHUB_STEP_SUMMARY
           echo "| L4 | security | ${{ needs.security.result }} |" >> $GITHUB_STEP_SUMMARY
           echo "| L4 | license-header | ${{ needs.license-header.result }} |" >> $GITHUB_STEP_SUMMARY
-          echo "| L4 | plugin-integration (observe-only) | ${{ needs.plugin-integration.result }} |" >> $GITHUB_STEP_SUMMARY
-          echo "| L4 | sidecar-integration (observe-only) | ${{ needs.sidecar-integration.result }} |" >> $GITHUB_STEP_SUMMARY
 
           # Any failure or cancellation in any job blocks the merge.
-          # Legitimately skipped jobs (deadcode on push, e2e-live when not
-          # needed or on a fork, license-header on push) are OK.
-          #
-          # plugin-integration and sidecar-integration are intentionally NOT
-          # in this loop yet: they run on every PR and their status is shown
-          # in the table above, but a failure is observe-only (non-blocking)
-          # during the initial soak. Graduation to required is tracked in
-          # https://github.com/larksuite/cli/issues/1894 (criteria: 4
-          # consecutive weeks with zero false positives).
+          # Legitimately skipped jobs (deadcode on push, e2e-live on fork,
+          # license-header on push) are OK.
           FAILED=0
           for result in \
             "${{ needs.fast-gate.result }}" \

.github/workflows/release.yml

@@ -9,40 +9,7 @@ permissions:
   contents: read
 
 jobs:
-  preflight:
-    runs-on: ubuntu-22.04
-    permissions:
-      contents: read
-    steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
-        with:
-          fetch-depth: 0
-
-      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
-        with:
-          node-version: '22.14.0'
-
-      - name: Validate tag and commit
-        env:
-          TAG: ${{ github.ref_name }}
-        run: |
-          set -euo pipefail
-          node scripts/release-preflight.js --tag "$TAG"
-          git fetch origin main
-          HEAD_SHA="$(git rev-parse --verify 'HEAD^{commit}')"
-          MAIN_SHA="$(git rev-parse --verify 'FETCH_HEAD^{commit}')"
-          TAG_SHA="$(git rev-parse --verify "refs/tags/${TAG}^{commit}")"
-          if [[ "$TAG_SHA" != "$HEAD_SHA" ]]; then
-            echo "Tag ${TAG} does not resolve to the checked-out HEAD commit." >&2
-            exit 1
-          fi
-          if ! git merge-base --is-ancestor "$HEAD_SHA" "$MAIN_SHA"; then
-            echo "Tag ${TAG} does not point to a commit contained in origin/main." >&2
-            exit 1
-          fi
-
-  build-release:
-    needs: preflight
+  goreleaser:
     runs-on: ubuntu-22.04
     permissions:
       contents: write
@@ -59,79 +26,35 @@ jobs:
         with:
           python-version: '3.x'
 
-      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
-        with:
-          node-version: '22.14.0'
-          registry-url: 'https://registry.npmjs.org'
-          package-manager-cache: false
-
-      - name: Install pinned npm
-        run: npm install --global npm@11.16.0
-
       - name: Run GoReleaser
         uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6
         with:
           version: '~> v2'
           args: release --clean
         env:
-          GITHUB_TOKEN: ${{ github.token }}
-
-      - name: Include release checksums
-        run: |
-          set -euo pipefail
-          test -s dist/checksums.txt
-          (cd dist && sha256sum --check checksums.txt)
-          cp dist/checksums.txt checksums.txt
-
-      - name: Collect release asset
-        run: |
-          set -euo pipefail
-          mkdir npm-publish-asset
-          cp dist/*.tar.gz dist/*.zip dist/checksums.txt npm-publish-asset/
-
-      - name: Upload release asset
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
-        with:
-          name: npm-publish-asset-${{ github.run_id }}
-          path: npm-publish-asset/
-          if-no-files-found: error
-          overwrite: true
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
   publish-npm:
-    needs: build-release
+    needs: goreleaser
     runs-on: ubuntu-22.04
-    environment: npm-production
-    permissions:
-      contents: read
-      id-token: write
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
-      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
-          node-version: '22.14.0'
+          node-version: '20'
           registry-url: 'https://registry.npmjs.org'
-          package-manager-cache: false
 
-      - name: Install pinned npm
-        run: npm install --global npm@11.16.0
-
-      - name: Download release asset
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
-        with:
-          name: npm-publish-asset-${{ github.run_id }}
-          path: npm-publish-asset
-
-      - name: Verify npm publish asset
+      - name: Download checksums from release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           set -euo pipefail
-          (cd npm-publish-asset && sha256sum --check checksums.txt)
-          cp npm-publish-asset/checksums.txt checksums.txt
-          PACK_JSON="$(npm pack --ignore-scripts --json)"
-          PACK_FILE="$(node -e 'const p=JSON.parse(process.argv[1]); if(p.length!==1 || !p[0].filename) process.exit(1); process.stdout.write(p[0].filename)' "$PACK_JSON")"
-          test -s "$PACK_FILE"
-          tar -tzf "$PACK_FILE" | grep -qx 'package/checksums.txt'
-          rm "$PACK_FILE"
+          TAG="${GITHUB_REF_NAME}"
+          gh release download "${TAG}" --pattern checksums.txt --dir .
+          test -s checksums.txt || { echo "checksums.txt missing or empty for ${TAG}"; exit 1; }
 
       - name: Publish to npm
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
         run: npm publish --access public

.github/workflows/semantic-review.yml

@@ -25,16 +25,19 @@ jobs:
         with:
           script: |
             const run = context.payload.workflow_run;
-            const workflowId = Number(run.workflow_id || 0);
-            if (!Number.isInteger(workflowId) || workflowId <= 0) throw new Error("missing workflow id");
-            const { data: workflow } = await github.rest.actions.getWorkflow({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              workflow_id: workflowId,
-            });
-            if (workflow.name !== "CI") throw new Error(`unexpected workflow name: ${workflow.name}`);
-            if (workflow.path !== ".github/workflows/ci.yml") throw new Error(`unexpected workflow path: ${workflow.path}`);
-            if (run.path && run.path !== workflow.path) throw new Error(`workflow path mismatch: ${run.path}`);
+            if (run.name !== "CI") throw new Error(`unexpected workflow name: ${run.name}`);
+            let workflowPath = run.path || "";
+            if (!workflowPath) {
+              const workflowId = Number(run.workflow_id || 0);
+              if (!Number.isInteger(workflowId) || workflowId <= 0) throw new Error("missing workflow id");
+              const { data: workflow } = await github.rest.actions.getWorkflow({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                workflow_id: workflowId,
+              });
+              workflowPath = workflow.path || "";
+            }
+            if (workflowPath !== ".github/workflows/ci.yml") throw new Error(`unexpected workflow path: ${workflowPath}`);
             if (run.event !== "pull_request") throw new Error(`unexpected event: ${run.event}`);
             if (run.repository.id !== context.payload.repository.id) throw new Error("repository id mismatch");
             if (run.repository.full_name !== context.payload.repository.full_name) throw new Error("repository name mismatch");
@@ -250,16 +253,19 @@ jobs:
         with:
           script: |
             const run = context.payload.workflow_run;
-            const workflowId = Number(run.workflow_id || 0);
-            if (!Number.isInteger(workflowId) || workflowId <= 0) throw new Error("missing workflow id");
-            const { data: workflow } = await github.rest.actions.getWorkflow({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              workflow_id: workflowId,
-            });
-            if (workflow.name !== "CI") throw new Error(`unexpected workflow name: ${workflow.name}`);
-            if (workflow.path !== ".github/workflows/ci.yml") throw new Error(`unexpected workflow path: ${workflow.path}`);
-            if (run.path && run.path !== workflow.path) throw new Error(`workflow path mismatch: ${run.path}`);
+            if (run.name !== "CI") throw new Error(`unexpected workflow name: ${run.name}`);
+            let workflowPath = run.path || "";
+            if (!workflowPath) {
+              const workflowId = Number(run.workflow_id || 0);
+              if (!Number.isInteger(workflowId) || workflowId <= 0) throw new Error("missing workflow id");
+              const { data: workflow } = await github.rest.actions.getWorkflow({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                workflow_id: workflowId,
+              });
+              workflowPath = workflow.path || "";
+            }
+            if (workflowPath !== ".github/workflows/ci.yml") throw new Error(`unexpected workflow path: ${workflowPath}`);
             if (run.event !== "pull_request") throw new Error(`unexpected event: ${run.event}`);
             if (run.conclusion !== "success") throw new Error(`unexpected conclusion: ${run.conclusion}`);
             if (run.repository.id !== context.payload.repository.id) throw new Error("repository id mismatch");

.gitignore

@@ -27,9 +27,6 @@ Thumbs.db
 # Go
 docs/ref
 docs/
-!tests/cli_e2e/docs/
-!tests/cli_e2e/docs/*.go
-!tests/cli_e2e/docs/*.md
 vendor/
 
 

AGENTS.md

@@ -10,10 +10,9 @@
 ## Build & Test
 
 ```bash
-make build             # Build (runs fetch_meta first)
-make unit-test         # Required before PR (runs with -race where supported, e.g. amd64/arm64)
-make live-skills-test  # Opt-in real Skills CLI tests; runs with isolated user directories
-make test              # Full: vet + unit + integration
+make build          # Build (runs fetch_meta first)
+make unit-test      # Required before PR (runs with -race where supported, e.g. amd64/arm64)
+make test           # Full: vet + unit + integration
 ```
 
 ## Notification Opt-Outs
@@ -106,20 +105,6 @@ Signatures that are easy to guess wrong:
 
 Program output (JSON envelopes) goes to stdout. Progress, warnings, hints go to stderr. Mixing them corrupts pipe chains.
 
-### Typed data over loose maps
-
-Parse `map[string]interface{}` into a typed struct at the boundary — one projection function per shape — and let everything downstream consume struct fields, not string keys. A typo'd map key compiles fine and fails at runtime, which an agent then debugs blind.
-
-Use distinct types when two values could be swapped silently: see `internal/meta.Token` — a bare string compiles on either side of a string/string signature, a distinct type does not.
-
-Legacy loose-map code exists in older paths. Match its call sites when touching it, but do not copy the pattern into new code.
-
-### Transcribe faithfully — no silent fallbacks
-
-When code echoes input onward (request previews, transformations, proxies), transcribe verbatim. A `default:` branch that coerces unrecognized input into a plausible value ("unknown HTTP verb → GET") makes the output lie, and an agent reasons from the lie.
-
-The same rule applies to flag combinations and internal wiring: if a requested option cannot be honored, return a typed validation error — never silently substitute another behavior and exit 0. Silent guesses (defaulting a missing identity, discarding writes on a nil writer) are bugs even when every current caller happens to avoid them.
-
 ### Use `vfs.*` instead of `os.*`
 
 All filesystem access goes through `internal/vfs`. This enables test mocking.
@@ -131,7 +116,6 @@ CLI arguments are untrusted (they come from AI agents). Call `validate.SafeInput
 ### Tests
 
 - Every behavior change needs a test alongside the change.
-- A contract test must fail if the implementation is reverted. If you can undo the code change and the suite stays green, the contract is not pinned — assert the new field/behavior directly, not a happy-path substring.
 - `cmdutil.TestFactory(t, config)` for test factories.
 - `t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())` to isolate config state.
 

CHANGELOG.md

@@ -2,402 +2,6 @@
 
 All notable changes to this project will be documented in this file.
 
-## [v1.0.81] - 2026-07-31
-
-### Features
-
-- support visible_rule for form questions (#1891)
-- **contact**: add bot search shortcut (#2083)
-- add SXSD schema validation to Slides lint (#2103)
-- **drive**: add comment-operation shortcuts (#1898)
-- **drive**: extend permission shortcuts for Miaoda (#2070)
-- **apps**: add cache debug commands (+cache-get/-delete/-clear) (#1896)
-- support source file preview artifacts (#2085)
-
-### Bug Fixes
-
-- **contact**: stop bot match segments carrying tags or empty entries (#2115)
-- **base**: resolve Base URL block types accurately (#2099)
-- **drive**: use title for default download filename (#2089)
-- drop stale target version from root upgrade prompt (#2100)
-
-### Documentation
-
-- **calendar**: warn against container-default timezone in time conversion (#2104)
-- **calendar**: confirm scope before editing recurring events (#2119)
-- **base**: clarify form and file operation routing (#2110)
-
-### Misc
-
-- add protected public domain allowlists (#2111)
-
-## [v1.0.80] - 2026-07-29
-
-### Features
-
-- **drive**: add +member-list shortcut (#1795)
-- **drive**: add +permission-get-setting shortcut (#1738)
-- propagate invocation metadata (#2097)
-
-### Documentation
-
-- **slides**: 补齐 shortcut 参数说明，修正 +xml-get --output 必填标注 (#2088)
-- **slides**: +create 的参数下沉到 create.md，主 skill 只留路由 (#2096)
-
-### Tests
-
-- **e2e**: wait for base role update visibility (#2087)
-
-### Misc
-
-- Feat/detect line text overlap (#2069)
-
-## [v1.0.79] - 2026-07-28
-
-### Features
-
-- **slides**: update xsd (#2067)
-
-### Bug Fixes
-
-- **ci**: validate static workflow identity (#2015)
-- **sheets**: recognize OFL0X local office tokens (#2063)
-
-### Documentation
-
-- **calendar**: clarify identity selection by event ownership (#2071)
-- **slides**: add formula inline element syntax to quick-ref (#2077)
-
-## [v1.0.78] - 2026-07-27
-
-### Features
-
-- event description support rich text (#1975)
-
-### Bug Fixes
-
-- **slides**: restrict canvas overflow checks
-- **slides**: upgrade text overflow to error above 10px threshold
-- **slides**: detect letterSpacing-driven text overflow
-- **slides**: downgrade background-decoration text overflow to info
-- **slides**: allow chartParsedValues roundtrip tag
-- refine character width estimation for lark-slides text lint
-- **slides**: preserve info lint severity
-- **slides**: text may over flow shape
-- exempt ghost text from slides lint
-
-## [v1.0.77] - 2026-07-24
-
-### Features
-
-- introducing official card icon (#1973)
-- **apps**: validate +file-list --page-size against server (0, 200] range (#2007)
-- **apps**: support absolute and relative upload paths (#2005)
-- **slides**: fill xml-schema-quick-ref gaps that forced XSD fallback (#2026)
-- **slides**: add layout density lint for sparse/empty containers (#2022)
-- add risk-control protection (#1910)
-
-### Bug Fixes
-
-- **slides**: normalize presentation flag aliases (#2032)
-- **base**: classify +form-submit as high-risk-write (#1969)
-- **slides**: declare screenshot scope
-- **slides**: support CSV multi-value for --slide-id in screenshot (#2047)
-
-### Documentation
-
-- **skill**: clarify scope handling for query expansion (#2030)
-- **base**: clarify complete and partial updates (#1993)
-- **skills**: clarify callout child rules (#2048)
-
-### Misc
-
-- fix/task id handling (#2023)
-- fix/task search pagination (#2041)
-
-## [v1.0.75] - 2026-07-22
-
-### Features
-
-- add okr single create shortcut & skill text opti (#1941)
-- **calendar**: auto-add bot self as attendee and note user-only search (#1991)
-
-### Bug Fixes
-
-- **base**: improve table shortcut behavior & guidance (#1803)
-- issue#1935 & whiteboard shortcut reformat (#1980)
-- remove legacy shortcut (#1997)
-- **e2e**: inject shared credentials by identity (#1995)
-
-### Documentation
-
-- **skill**: describe html5 block xml usage (#1380)
-- clarify fetch metadata and user cites (#1981)
-- add topic move collector workflow (#1473)
-- update lark doc HTML size limit (#2001)
-- **base**: align record write schema guidance (#2000)
-
-### Tests
-
-- **e2e**: declare request identities explicitly (#2004)
-
-### Misc
-
-- harden npm release publishing (#1918)
-
-## [v1.0.74] - 2026-07-21
-
-### Features
-
-- **slides**: add history rollback shortcuts (#1714)
-- **base**: support per-record batch updates (#1889)
-
-### Bug Fixes
-
-- preserve slides schema issues
-- allow jq examples in quality gate dry-runs
-- **im**: warn when flag pagination is truncated (#1906)
-- **slides**: warn on text shape overflow
-- **slides**: exempt chart roundtrip attributes from lint
-- **slides**: detect image text occlusion
-- **slides**: clarify xml-text-overlap-lint error for positional argument (#1986)
-
-### Documentation
-
-- clarify drive upload overwrite guidance (#1982)
-
-### Tests
-
-- isolate unit tests from user state (#1883)
-
-### Refactoring
-
-- converge success output through a single Emitter that owns the write (#1899)
-
-## [v1.0.73] - 2026-07-20
-
-### Features
-
-- **apps**: design_html support, creative-design skill, unified TOS publish (#1901)
-
-### Bug Fixes
-
-- **slides**: detect visual elements outside canvas
-- reduce public content credential fixture false positives
-- standardize CLI shortcut text in English (#1942)
-
-### Documentation
-
-- **base**: reduce filter and update retry loops (#1879)
-- **vc**: default transcript routing to smart notes over minutes (#1961)
-- clarify local trigger automation (#1958)
-
-### Tests
-
-- synchronize temporary Git maintenance (#1946)
-
-### Misc
-
-- **slides**: update lark-slides skill to 0715 snapshot (#1933)
-- [codex] support bot menu events (#1765)
-
-## [v1.0.72] - 2026-07-17
-
-### Features
-
-- **slides**: lint table out of canvas
-- **slides**: report resolved table size mismatches
-- **approval**: support approval event consumption (#1924)
-
-### Bug Fixes
-
-- **vc**: don't fail +detail for in-progress meetings (#1930)
-- stabilize drive delete E2E terminal-state checks (#1939)
-
-### Documentation
-
-- **slides**: document table dimensions
-- document base field default values (#1500)
-- **sheets**: use English placeholder in table-get guidance (#1936)
-
-### Tests
-
-- stabilize live e2e auth retries (#1904)
-- use tri-state wiki node identity in delete verification (#1931)
-- fix drive cover download retries (#1934)
-
-## [v1.0.71] - 2026-07-16
-
-### Features
-
-- add wiki move-to-drive shortcut (#1869)
-- **apps**: add role management shortcuts (#1881)
-- **drive**: add secure label support and clarify comment location API (#1913)
-
-### Bug Fixes
-
-- **base**: improve dashboard shortcut guidance (#1787)
-
-### Documentation
-
-- **apps**: add platform SQL authoring guide to the db-execute skill (#1912)
-
-### Misc
-
-- add L4 plugin-integration and sidecar-integration CI jobs (#1840)
-- **drive**: optimize drive +delete workflow (#1909)
-
-## [v1.0.70] - 2026-07-15
-
-### Features
-
-- add minutes permission application shortcut (#1876)
-- **drive**: support apps in list comments (#1877)
-- slide style
-- edit ppt template
-- **slides**: add sxsd validation to slides lint
-- **slides**: validate iconpark icon types in slides lint
-- **slides**: lint before create
-- **apps**: add automation trigger commands for Miaoda (#1886)
-
-### Bug Fixes
-
-- unify dry-run output contract (#1870)
-- **skills**: align skill guidance with the typed error contract (#1786)
-- **slides**: limit slides screenshot page requests
-- **slides**: detect lark slides text overflow overlap
-- **vc**: align meeting query scopes by identity (#1850)
-
-### Documentation
-
-- clarify task search relevance filters (#1884)
-- surface minutes permission application in skill description (#1890)
-- clarify okr progress children (#1861)
-- **slides**: prefer slides xml-get shortcut
-- **calendar**: document setting meeting owner via full API (#1903)
-
-### Refactoring
-
-- **slides**: streamline create workflow and validate SML namespaces
-
-### Misc
-
-- **slides**: address PR review feedback
-
-## [v1.0.69] - 2026-07-13
-
-### Features
-
-- support docs fetch selection anchors (#1815)
-- **apps**: support modern_html app type with TOS publish path and app type querying
-- **im**: show bot sender display names when reading messages (#1829)
-- add drive list comments shortcut (#1845)
-- support wiki sources in drive export (#1802)
-- add application domain with slash command management shortcuts (#1806)
-- validate IM idempotency key length (#1797)
-- surface reply context and mentions in im.message.receive_v1 (#1798)
-
-### Bug Fixes
-
-- route brand-sensitive endpoints through the resolver (#1836)
-
-### Documentation
-
-- document OKR block XML guidance (#1648)
-- refine doubao whiteboard workflow routing (#1841)
-- clarify Mindnote token handling (#1827)
-
-### Tests
-
-- isolate semantic waiver fixtures from wall clock
-
-### Misc
-
-- Merge lark sheets development branch (#1833)
-
-## [v1.0.68] - 2026-07-09
-
-### Features
-
-- **drive**: Strengthen lark-drive high-risk write operations and read-only recognition boundaries. (#1801)
-- **slides**: add slides chart demo reference
-
-### Bug Fixes
-
-- register and consume --json shorthand for custom-format shortcuts (#1737)
-- **drive**: abort push on parent sibling limit (#1813)
-
-### Documentation
-
-- require native charts in slide planning
-- register knowledge organize workflow (#1828)
-
-## [v1.0.67] - 2026-07-08
-
-### Features
-
-- **mail**: add message modify and trash shortcuts (#1567)
-- support whiteboard file inputs in docs XML (#1784)
-- **vc**: refine meeting-events output and reaction forwarding (#1674)
-- **affordance**: usage guidance for shortcuts and per-command skills (#1793)
-
-### Bug Fixes
-
-- accept opaque wiki node tokens (#1789)
-- **apps**: make db --environment optional, auto-select branch server-side (#1735)
-- preserve original filename in multipart file upload (#1767)
-
-### Documentation
-
-- restore one-time authorization guidance in lark-apps skill (#1794)
-
-### Misc
-
-- e2e: harden CLI E2E retry, cleanup, and domain selection (#1709)
-
-## [v1.0.66] - 2026-07-07
-
-### Features
-
-- support semantic recurring calendar operations (#1723)
-- minute wait (#1768)
-
-### Bug Fixes
-
-- guide drive import concurrency conflicts (#1751)
-- **calendar**: guide approval room booking fallback (#1637)
-- support pnpm global installs in self-update (#1705)
-- resolve schema against runtime metadata in plugin builds; gate cache overlay by version (#1764)
-
-### Documentation
-
-- tighten doc creation validation workflow (#1759)
-- clarify success envelope contract — judge success by ok, not code (#1730)
-
-### Refactoring
-
-- **envvars**: consolidate agent env value access (#1757)
-
-### Misc
-
-- Improve agent-facing error guidance for drive, markdown, and wiki (#1779)
-
-## [v1.0.65] - 2026-07-03
-
-### Features
-
-- **doc**: Add `+history-list`, `+history-revert`, and `+history-revert-status` shortcuts for document version history (#1612)
-
-### Bug Fixes
-
-- **minutes**: `+speaker-replace` no longer refetches the speaker list — `--from-speaker-id` is passed through as-is (#1731)
-
-### Documentation
-
-- **drive**: Document 30-char query limit for `+search` (#1560)
-- **doc**: Add mindnote guidance to lark-doc skill (#1581)
-- **doc**: Sync lark-doc skill content from online-doc (#1701)
-
 ## [v1.0.64] - 2026-07-02
 
 ### Features
@@ -1751,22 +1355,6 @@ Bundled AI agent skills for intelligent assistance:
 - Bilingual documentation (English & Chinese).
 - CI/CD pipelines: linting, testing, coverage reporting, and automated releases.
 
-[v1.0.81]: https://github.com/larksuite/cli/releases/tag/v1.0.81
-[v1.0.80]: https://github.com/larksuite/cli/releases/tag/v1.0.80
-[v1.0.79]: https://github.com/larksuite/cli/releases/tag/v1.0.79
-[v1.0.78]: https://github.com/larksuite/cli/releases/tag/v1.0.78
-[v1.0.77]: https://github.com/larksuite/cli/releases/tag/v1.0.77
-[v1.0.75]: https://github.com/larksuite/cli/releases/tag/v1.0.75
-[v1.0.74]: https://github.com/larksuite/cli/releases/tag/v1.0.74
-[v1.0.73]: https://github.com/larksuite/cli/releases/tag/v1.0.73
-[v1.0.72]: https://github.com/larksuite/cli/releases/tag/v1.0.72
-[v1.0.71]: https://github.com/larksuite/cli/releases/tag/v1.0.71
-[v1.0.70]: https://github.com/larksuite/cli/releases/tag/v1.0.70
-[v1.0.69]: https://github.com/larksuite/cli/releases/tag/v1.0.69
-[v1.0.68]: https://github.com/larksuite/cli/releases/tag/v1.0.68
-[v1.0.67]: https://github.com/larksuite/cli/releases/tag/v1.0.67
-[v1.0.66]: https://github.com/larksuite/cli/releases/tag/v1.0.66
-[v1.0.65]: https://github.com/larksuite/cli/releases/tag/v1.0.65
 [v1.0.64]: https://github.com/larksuite/cli/releases/tag/v1.0.64
 [v1.0.62]: https://github.com/larksuite/cli/releases/tag/v1.0.62
 [v1.0.61]: https://github.com/larksuite/cli/releases/tag/v1.0.61

Makefile

@@ -23,7 +23,7 @@ PREFIX   ?= /usr/local
 TEST_GOARCH := $(or $(GOARCH),$(shell go env GOARCH))
 RACE_FLAG := $(if $(filter riscv64,$(TEST_GOARCH)),,-race)
 
-.PHONY: all build vet fmt-check script-test test unit-test live-skills-test integration-test examples-build quality-gate install uninstall clean fetch_meta gitleaks sidecar-test
+.PHONY: all build vet fmt-check script-test test unit-test integration-test examples-build quality-gate install uninstall clean fetch_meta gitleaks
 
 all: test
 
@@ -51,27 +51,19 @@ script-test:
 	bash scripts/resolve-changed-from.test.sh
 	bash scripts/ci-workflow.test.sh
 	bash scripts/semantic-review-workflow.test.sh
-	$(NODE) --test scripts/e2e_domains.test.js scripts/fetch_e2e_tat.test.js scripts/install.test.js scripts/release-preflight.test.js scripts/semantic-review-verify-artifact.test.js scripts/pr-quality-summary.test.js scripts/semantic-review-publish.test.js scripts/ci-quality-summary-publish.test.js
+	$(NODE) --test scripts/semantic-review-verify-artifact.test.js scripts/pr-quality-summary.test.js scripts/semantic-review-publish.test.js scripts/ci-quality-summary-publish.test.js
 
 # ./extension/... keeps the public plugin SDK in the default test matrix.
 unit-test: fetch_meta
 	go test $(RACE_FLAG) -gcflags="all=-N -l" -count=1 \
 		./cmd/... ./internal/... ./shortcuts/... ./extension/...
 
-live-skills-test: fetch_meta
-	LARKSUITE_CLI_RUN_LIVE_SKILLS_TESTS=1 \
-	go test -v -count=1 ./cmd/update \
-		-run '^TestUpdateCommand_(RealSkillsSyncRewritesState|SkillsSyncColdStart)$$'
-
 # examples-build keeps the shipped plugin-SDK examples compilable. If this
 # breaks, the plugin author guide's "go build ./..." path is broken.
 examples-build:
 	go build ./extension/platform/examples/audit-observer
 	go build ./extension/platform/examples/readonly-policy
 
-# ./tests/... includes tests/plugin_e2e, which builds ~20 customer-fork
-# binaries (~1 min warm; a cold module cache also downloads via GOPROXY).
-# Deliberate: local `make test` exercises the L4 plugin contract by default.
 integration-test: build
 	go test -v -count=1 ./tests/...
 
@@ -113,14 +105,6 @@ uninstall:
 clean:
 	rm -f $(BINARY)
 
-# sidecar-test compiles and runs the authsidecar* build-tagged code that the
-# default CI matrix never sees (they carry //go:build tags).
-sidecar-test:
-	go build -tags authsidecar -o /dev/null .
-	go test $(RACE_FLAG) -count=1 -tags authsidecar ./extension/credential/sidecar/ ./extension/transport/sidecar/ ./internal/cmdutil/
-	go test $(RACE_FLAG) -count=1 -tags authsidecar_demo ./sidecar/server-demo/
-	go test $(RACE_FLAG) -count=1 -tags authsidecar ./tests/sidecar_e2e/
-
 # Run secret-leak checks locally before pushing.
 # Step 1: check-doc-tokens catches realistic-looking example tokens in reference
 #         docs and asks you to use _EXAMPLE_TOKEN placeholders instead.

README.md

@@ -233,24 +233,6 @@ lark-cli api POST /open-apis/im/v1/messages --params '{"receive_id_type":"chat_i
 --format csv       # Comma-separated values
 ```
 
-### JSON Output Contract
-
-With `--format json` (the default), success and error envelopes are distinct.
-
-Success goes to **stdout**, exit code `0`:
-
-```json
-{ "ok": true, "identity": "user", "data": { "guid": "..." }, "meta": { "count": 1 } }
-```
-
-Errors go to **stderr**, non-zero exit code:
-
-```json
-{ "ok": false, "identity": "user", "error": { "type": "api", "subtype": "...", "code": 99991679, "message": "...", "hint": "..." } }
-```
-
-To check whether a command succeeded, test `ok == true` (or the exit code) — **not** `code == 0`. Unlike raw OpenAPI responses (`{"code": 0, "msg": "ok", ...}`), the success envelope carries no `code` or `msg` field; `code` appears only inside `error` as the upstream OpenAPI code. See [errs/ERROR_CONTRACT.md](errs/ERROR_CONTRACT.md) for the full error taxonomy.
-
 ### Pagination
 
 ```bash
@@ -285,31 +267,12 @@ To reduce these risks, the tool enables default security protections at multiple
 
 We recommend using the Lark/Feishu bot integrated with this tool as a private conversational assistant. Do not add it to group chats or allow other users to interact with it, to avoid abuse of permissions or data leakage.
 
-To reduce the security risks associated with access token theft, the CLI sends a minimal set of risk-control signals with OpenAPI requests made to exact official Feishu/Lark HTTPS domains. These signals are used to help identify anomalous API activity. This protection is enabled by default. The information sent is limited to:
-
-- Operating system type: macOS, Windows, or Linux
-- Device hardware model: for example, Mac17,9
-
-To disable this protection for the current workspace, run:
-
-```bash
-lark-cli config risk-control off
-```
-
-To enable this protection for the current workspace, run:
-
-```bash
-lark-cli config risk-control on
-```
-
-To restore the default policy for the current workspace, run:
-
-```bash
-lark-cli config risk-control default
-```
-
 Please fully understand all usage risks. By using this tool, you are deemed to voluntarily assume all related responsibilities.
 
+## Star History
+
+[![Star History Chart](https://api.star-history.com/svg?repos=larksuite/cli&type=Date)](https://star-history.com/#larksuite/cli&Date)
+
 ## Contributing
 
 Community contributions are welcome! If you find a bug or have feature suggestions, please submit an [Issue](https://github.com/larksuite/cli/issues) or [Pull Request](https://github.com/larksuite/cli/pulls).

README.zh.md

@@ -234,24 +234,6 @@ lark-cli api POST /open-apis/im/v1/messages --params '{"receive_id_type":"chat_i
 --format csv       # 逗号分隔值
 ```
 
-### JSON 输出契约
-
-`--format json`（默认）下，成功与错误的信封结构不同。
-
-成功信封写入 **stdout**，退出码 0：
-
-```json
-{ "ok": true, "identity": "user", "data": { "guid": "..." }, "meta": { "count": 1 } }
-```
-
-错误信封写入 **stderr**，退出码非 0：
-
-```json
-{ "ok": false, "identity": "user", "error": { "type": "api", "subtype": "...", "code": 99991679, "message": "...", "hint": "..." } }
-```
-
-判断命令是否成功，请检查 `ok == true`（或进程退出码），**不要用 `code == 0`**。与原始 OpenAPI 响应（`{"code": 0, "msg": "ok", ...}`）不同，成功信封没有 `code` 和 `msg` 字段；`code` 只出现在错误信封的 `error` 内，含义是上游 OpenAPI 的 numeric code。完整错误分类见 [errs/ERROR_CONTRACT.md](errs/ERROR_CONTRACT.md)。
-
 ### 分页
 
 ```bash
@@ -286,31 +268,12 @@ lark-cli schema im.messages.delete
 
 我们建议您将对接本工具的飞书机器人作为私人对话助手使用，请勿将其拉入群聊或允许其他用户与其交互，以避免权限被滥用或数据泄露。
 
-为降低访问令牌被盗用后的安全风险，CLI 在向飞书/Lark 官方 HTTPS 精确域名发起 OpenAPI 请求时，会随请求发送一组最小化的风控信号，用于辅助识别异常调用行为。该保护默认开启，发送的信息仅包括：
-
-- 操作系统类型：macOS、Windows 或 Linux
-- 设备的硬件产品型号：例如 Mac17,9
-
-如需让当前 workspace 退出该保护，可执行以下命令：
-
-```bash
-lark-cli config risk-control off
-```
-
-如需开启当前 workspace 的保护，可执行以下命令：
-
-```bash
-lark-cli config risk-control on
-```
-
-恢复当前 workspace 默认策略可执行：
-
-```bash
-lark-cli config risk-control default
-```
-
 请您充分知悉全部使用风险，使用本工具即视为您自愿承担相关所有责任。
 
+## Star History
+
+[![Star History Chart](https://api.star-history.com/svg?repos=larksuite/cli&type=Date)](https://star-history.com/#larksuite/cli&Date)
+
 ## 贡献
 
 欢迎社区贡献！如果你发现 bug 或有功能建议，请提交 [Issue](https://github.com/larksuite/cli/issues) 或 [Pull Request](https://github.com/larksuite/cli/pulls)。

affordance/README.md

@@ -10,33 +10,18 @@ step. Maintain these files alongside `skills/` and `shortcuts/`.
 A small, fixed markdown subset; each file describes one domain:
 
     # <domain>            optional `> skill: <name>` applies to every command below
-    ## <command>          the command as typed, minus `lark-cli <domain>`; a
-                          +-prefixed heading (## +create) targets that shortcut
+    ## <command>          the command as typed, minus `lark-cli <domain>`
     <lead paragraph>      when to use this command
     ### Avoid when        when not to use it / which command to use instead
     ### Prerequisites     what you must have first (e.g. an id, and where it comes from)
     ### Tips              gotchas and constraints
     ### Examples          **description** lines, each followed by a fenced command
-    ### Skills            bullet skill names, or name/relpath references
-                          (lark-contact/references/x.md), to read for usage;
-                          merged with the domain `> skill:` default (deduped,
-                          domain first)
     ### <other heading>   a custom section; flows through verbatim
 
 Reference another command with `[[command]]` — it renders as `command` in help.
 Under `Avoid when` it means "use that one instead"; under `Prerequisites`
 ("… from [[command]]") it means "get the input there first".
 
-Both service-API commands (`## messages get`) and `+`-prefixed shortcuts
-(`## +create`) take entries. A `### Skills` entry is a skill name (validated
-against `<name>/SKILL.md`) or a `name/relpath` reference into that skill
-(validated against the path); help drops any that don't resolve, so a typo shows
-nothing. Point a command at its own reference (e.g. `+search-user` →
-`lark-contact/references/lark-contact-search-user.md`) rather than re-listing the
-domain skill, which the `> skill:` default already covers. When a shortcut also
-sets a hand-authored `Tips` list in Go, the overlay's `### Tips` win — they
-replace the Go tips (not merged), so keep tips in one place.
-
 ## Example
 
     ## messages get
@@ -62,5 +47,3 @@ replace the Go tips (not merged), so keep tips in one place.
   anything the schema and flags already show; the agent infers the rest.
 - Command-form headings resolve to method ids via the registry, so plural resource
   names (`messages`) map to the singular method id (`message`) automatically.
-  `+`-prefixed shortcut headings are matched verbatim (no plural/space folding),
-  so the heading must equal the shortcut command exactly (`## +history-revert`).

affordance/contact.md

@@ -1,77 +1,6 @@
 # contact
 > skill: lark-contact
 
-## +search-user
-The primary user lookup for user identity: search by keyword or email, resolve known ids with --user-ids, or get yourself with --user-ids me — it does by-id reads too, so as a user you rarely need `+get-user`. Each match returns an open_id and p2p_chat_id to chain into follow-ups.
-
-### Skills
-- lark-contact/references/lark-contact-search-user.md
-
-### Avoid when
-- Running as a bot — this shortcut is user-only; use [[+get-user]] instead (it supports bot identity)
-- You only need users' personal status for ids you already hold → use [[user_profiles batch_query]]
-
-### Examples
-
-**Find a user by name**
-```bash
-lark-cli contact +search-user --query "alice" --as user
-```
-
-**Fetch known users by open_id (me = yourself)**
-```bash
-lark-cli contact +search-user --user-ids "ou_3a8b****6a7b,me" --as user
-```
-
-## +search-bot
-Search bots (apps) by keyword. Pass `--query` or `--queries`; use `--chat-ids` to search within specific chats.
-
-### Skills
-- lark-contact/references/lark-contact-search-bot.md
-
-### Avoid when
-- Looking for a person rather than a bot → use [[+search-user]]
-- Running as a bot — this shortcut is user-only
-
-### Tips
-- `has_more=true` means the search is incomplete; refine the keyword or search scope instead of paginating
-
-### Examples
-
-**Find bots by keyword**
-```bash
-lark-cli contact +search-bot --query "会议助手" --as user
-```
-
-**Search inside one chat**
-```bash
-lark-cli contact +search-bot --query "助手" --chat-ids "oc_3a8b****6a7b" --as user
-```
-
-**Find bots you've chatted with**
-```bash
-lark-cli contact +search-bot --query "助手" --has-chatted --as user
-```
-
-**Search several bot keywords in one call**
-```bash
-lark-cli contact +search-bot --queries "会议助手,日报助手,审批助手" --as user
-```
-
-## +get-user
-Fetch one user's profile by id, or your own with --user-id omitted. Use it under bot identity — `+search-user` is user-only.
-
-### Skills
-- lark-contact/references/lark-contact-get-user.md
-
-### Avoid when
-- You don't have the user's id yet, or want to match by name/keyword → use [[+search-user]]
-- Running as a user — [[+search-user]] --user-ids covers by-id reads and more in one tool
-
-### Tips
-- Self lookup (omit --user-id) needs user identity; a bot must pass --user-id
-- --user-id-type must match the id you pass (default open_id)
-
 ## user_profiles batch_query
 Bulk-fetch personal status and signature for user ids you already have.
 

cmd/api/api.go

@@ -130,13 +130,6 @@ func buildAPIRequest(opts *APIOptions) (client.RawApiRequest, *cmdutil.FileUploa
 	stdin := opts.Factory.IOStreams.In
 	fileIO := opts.Factory.ResolveFileIO(opts.Ctx)
 
-	if opts.Method == "" {
-		return client.RawApiRequest{}, nil, errs.NewValidationError(errs.SubtypeInvalidArgument,
-			"HTTP method must not be empty").
-			WithHint("pass the verb as the first argument, e.g. lark-cli api GET /open-apis/...").
-			WithParam("<method>")
-	}
-
 	// Validate --file mutual exclusions first.
 	if err := cmdutil.ValidateFileFlag(opts.File, opts.Params, opts.Data, opts.Output, opts.PageAll, opts.Method); err != nil {
 		return client.RawApiRequest{}, nil, err
@@ -250,9 +243,9 @@ func apiRun(opts *APIOptions) error {
 
 	if opts.DryRun {
 		if fileMeta != nil {
-			return cmdutil.PrintDryRunWithFile(request, config, dryRunOutputOptions(f, opts), *fileMeta)
+			return cmdutil.PrintDryRunWithFile(f.IOStreams.Out, request, config, opts.Format, fileMeta.FieldName, fileMeta.FilePath, fileMeta.FormFields)
 		}
-		return apiDryRun(f, request, config, opts)
+		return apiDryRun(f, request, config, opts.Format)
 	}
 	// Identity info is now included in the JSON envelope; skip stderr printing.
 	// cmdutil.PrintIdentity(f.IOStreams.ErrOut, opts.As, config, f.IdentityAutoDetected)
@@ -304,19 +297,8 @@ func apiRun(opts *APIOptions) error {
 	return nil
 }
 
-func apiDryRun(f *cmdutil.Factory, request client.RawApiRequest, config *core.CliConfig, opts *APIOptions) error {
-	return cmdutil.PrintDryRun(request, config, dryRunOutputOptions(f, opts))
-}
-
-func dryRunOutputOptions(f *cmdutil.Factory, opts *APIOptions) cmdutil.DryRunOutputOptions {
-	return cmdutil.DryRunOutputOptions{
-		Format:      opts.Format,
-		JqExpr:      opts.JqExpr,
-		CommandPath: opts.Cmd.CommandPath(),
-		Identity:    opts.As,
-		Out:         f.IOStreams.Out,
-		ErrOut:      f.IOStreams.ErrOut,
-	}
+func apiDryRun(f *cmdutil.Factory, request client.RawApiRequest, config *core.CliConfig, format string) error {
+	return cmdutil.PrintDryRun(f.IOStreams.Out, request, config, format)
 }
 
 func apiPaginate(ctx context.Context, ac *client.APIClient, request client.RawApiRequest, format output.Format, jqExpr string, out, errOut io.Writer, commandPath string, pagOpts client.PaginationOptions) error {
@@ -344,18 +326,20 @@ func apiPaginate(ctx context.Context, ac *client.APIClient, request client.RawAp
 
 	switch format {
 	case output.FormatNDJSON, output.FormatTable, output.FormatCSV:
-		emitter := output.NewEmitter(output.EmitterConfig{
-			Out:            out,
-			ErrOut:         errOut,
-			CommandPath:    commandPath,
-			Identity:       string(pagOpts.Identity),
-			NoticeProvider: output.GetNotice,
-		})
+		pf := output.NewPaginatedFormatter(out, format)
 		result, hasItems, err := ac.StreamPages(ctx, request, func(items []interface{}) error {
 			// Streaming formats intentionally emit each page after that page has
 			// passed safety scanning. A later page may still fail, so callers
 			// must use the exit code to distinguish complete vs partial output.
-			return emitter.StreamPage(items, output.StreamOptions{Format: format.String()})
+			scanResult := output.ScanForSafety(commandPath, items, errOut)
+			if scanResult.Blocked {
+				return scanResult.BlockErr
+			}
+			if scanResult.Alert != nil {
+				output.WriteAlertWarning(errOut, scanResult.Alert)
+			}
+			pf.FormatPage(items)
+			return nil
 		}, pagOpts)
 		if err != nil {
 			return errs.MarkRaw(err)

cmd/api/api_paginate_test.go

@@ -1,396 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package api
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"io"
-	"net/http"
-	"testing"
-
-	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/client"
-	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
-	"github.com/larksuite/cli/internal/httpmock"
-	"github.com/larksuite/cli/internal/output"
-)
-
-type apiFailOnWriteWriter struct {
-	buf    bytes.Buffer
-	writes int
-	failAt int
-	err    error
-}
-
-func (w *apiFailOnWriteWriter) Write(p []byte) (int, error) {
-	w.writes++
-	if w.writes == w.failAt {
-		return 0, w.err
-	}
-	return w.buf.Write(p)
-}
-
-func newAPIPaginateTestHarness(t *testing.T) (*client.APIClient, *bytes.Buffer, *bytes.Buffer, *httpmock.Registry) {
-	t.Helper()
-	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
-	t.Setenv("LARKSUITE_CLI_CONTENT_SAFETY_MODE", "off")
-	previousNotice := output.PendingNotice
-	output.PendingNotice = nil
-	t.Cleanup(func() { output.PendingNotice = previousNotice })
-
-	config := &core.CliConfig{
-		AppID:     "test-app",
-		AppSecret: "test-secret",
-		Brand:     core.BrandFeishu,
-	}
-	f, out, errOut, reg := cmdutil.TestFactory(t, config)
-	ac, err := f.NewAPIClientWithConfig(config)
-	if err != nil {
-		t.Fatalf("NewAPIClientWithConfig() error = %v", err)
-	}
-	ac.ErrOut = io.Discard
-	return ac, out, errOut, reg
-}
-
-func apiPaginateRequest() client.RawApiRequest {
-	return client.RawApiRequest{
-		Method: "GET",
-		URL:    "/open-apis/test/v1/items",
-		As:     core.AsBot,
-	}
-}
-
-func assertAPIPaginateJSONBytes(t *testing.T, got []byte, want interface{}) {
-	t.Helper()
-	wantBytes, err := json.MarshalIndent(want, "", "  ")
-	if err != nil {
-		t.Fatalf("marshal expected JSON: %v", err)
-	}
-	wantBytes = append(wantBytes, '\n')
-	if !bytes.Equal(got, wantBytes) {
-		t.Fatalf("stdout bytes mismatch\ngot:\n%s\nwant:\n%s", got, wantBytes)
-	}
-}
-
-func TestAPIPaginate_DefaultAggregatesAllPages(t *testing.T) {
-	ac, out, errOut, reg := newAPIPaginateTestHarness(t)
-	calls := 0
-	wantTokens := []string{"", "next-1", "next-2"}
-	for i, wantToken := range wantTokens {
-		page := i + 1
-		hasMore := page < len(wantTokens)
-		data := map[string]interface{}{
-			"items":    []interface{}{map[string]interface{}{"id": string(rune('0' + page))}},
-			"has_more": hasMore,
-		}
-		if hasMore {
-			data["page_token"] = wantTokens[page]
-		}
-		reg.Register(&httpmock.Stub{
-			URL: "/open-apis/test/v1/items",
-			OnMatch: func(req *http.Request) {
-				calls++
-				if got := req.URL.Query().Get("page_token"); got != wantToken {
-					t.Errorf("request %d page_token = %q, want %q", page, got, wantToken)
-				}
-			},
-			Body: map[string]interface{}{
-				"code": 0,
-				"msg":  "ok",
-				"data": data,
-			},
-		})
-	}
-
-	err := apiPaginate(context.Background(), ac, apiPaginateRequest(),
-		output.FormatJSON, "", out, errOut, "lark-cli api GET", client.PaginationOptions{
-			PageLimit: 10,
-			PageDelay: -1,
-		})
-
-	if err != nil {
-		t.Fatalf("apiPaginate() error = %v, want nil", err)
-	}
-	if calls != 3 {
-		t.Fatalf("pagination requests = %d, want 3", calls)
-	}
-	assertAPIPaginateJSONBytes(t, out.Bytes(), output.Envelope{
-		OK:       true,
-		Identity: "bot",
-		Data: map[string]interface{}{
-			"items": []interface{}{
-				map[string]interface{}{"id": "1"},
-				map[string]interface{}{"id": "2"},
-				map[string]interface{}{"id": "3"},
-			},
-			"has_more": false,
-		},
-	})
-	if got := errOut.String(); got != "" {
-		t.Fatalf("stderr bytes = %q, want empty", got)
-	}
-}
-
-func TestAPIPaginate_StreamingFormatsEmitExactMultiPageBytes(t *testing.T) {
-	tests := []struct {
-		name   string
-		format output.Format
-		want   string
-	}{
-		{
-			name:   "ndjson",
-			format: output.FormatNDJSON,
-			want:   "{\"id\":\"1\",\"name\":\"Alice\"}\n{\"id\":\"2\",\"name\":\"Carol\",\"page_only\":\"ignored\"}\n",
-		},
-		{
-			name:   "table",
-			format: output.FormatTable,
-			want:   "id  name \n──  ─────\n1   Alice\n2   Carol\n",
-		},
-		{
-			name:   "csv",
-			format: output.FormatCSV,
-			want:   "id,name\n1,Alice\n2,Carol\n",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			ac, out, errOut, reg := newAPIPaginateTestHarness(t)
-			reg.Register(&httpmock.Stub{
-				URL: "/open-apis/test/v1/items",
-				Body: map[string]interface{}{
-					"code": 0,
-					"msg":  "ok",
-					"data": map[string]interface{}{
-						"items": []interface{}{
-							map[string]interface{}{"id": "1", "name": "Alice"},
-						},
-						"has_more":   true,
-						"page_token": "next-1",
-					},
-				},
-			})
-			reg.Register(&httpmock.Stub{
-				URL: "/open-apis/test/v1/items",
-				Body: map[string]interface{}{
-					"code": 0,
-					"msg":  "ok",
-					"data": map[string]interface{}{
-						"items": []interface{}{
-							map[string]interface{}{"id": "2", "name": "Carol", "page_only": "ignored"},
-						},
-						"has_more": false,
-					},
-				},
-			})
-
-			err := apiPaginate(context.Background(), ac, apiPaginateRequest(),
-				tt.format, "", out, errOut, "lark-cli api GET", client.PaginationOptions{
-					PageLimit: 10,
-					PageDelay: -1,
-				})
-
-			if err != nil {
-				t.Fatalf("apiPaginate() error = %v, want nil", err)
-			}
-			if got := out.String(); got != tt.want {
-				t.Fatalf("stdout byte mismatch\ngot (%d bytes):\n%q\nwant (%d bytes):\n%q", len(got), got, len(tt.want), tt.want)
-			}
-			if got := errOut.String(); got != "" {
-				t.Fatalf("stderr bytes = %q, want empty", got)
-			}
-		})
-	}
-}
-
-func TestAPIPaginate_StreamingWriteFailureStopsFurtherPages(t *testing.T) {
-	ac, _, errOut, reg := newAPIPaginateTestHarness(t)
-	sentinel := errors.New("page write failed")
-	out := &apiFailOnWriteWriter{failAt: 2, err: sentinel}
-	calls := 0
-	for page := 1; page <= 2; page++ {
-		hasMore := true
-		data := map[string]interface{}{
-			"items":    []interface{}{map[string]interface{}{"id": page}},
-			"has_more": hasMore,
-		}
-		if hasMore {
-			data["page_token"] = fmt.Sprintf("next-%d", page)
-		}
-		reg.Register(&httpmock.Stub{
-			URL: "/open-apis/test/v1/items",
-			OnMatch: func(*http.Request) {
-				calls++
-			},
-			Body: map[string]interface{}{
-				"code": 0,
-				"msg":  "ok",
-				"data": data,
-			},
-		})
-	}
-
-	err := apiPaginate(context.Background(), ac, apiPaginateRequest(),
-		output.FormatNDJSON, "", out, errOut, "lark-cli api GET",
-		client.PaginationOptions{PageLimit: 10, PageDelay: -1})
-
-	if !errors.Is(err, sentinel) {
-		t.Fatalf("apiPaginate() error = %v, want preserved writer cause", err)
-	}
-	problem, ok := errs.ProblemOf(err)
-	if !ok || problem.Category != errs.CategoryInternal {
-		t.Fatalf("apiPaginate() problem = %#v, %v; want internal typed error", problem, ok)
-	}
-	if calls != 2 {
-		t.Fatalf("pagination requests = %d, want 2", calls)
-	}
-	if got, want := out.buf.String(), "{\"id\":1}\n"; got != want {
-		t.Fatalf("stdout bytes = %q, want %q", got, want)
-	}
-}
-
-func TestAPIPaginate_StreamingFormatFallsBackToJSONWithoutList(t *testing.T) {
-	ac, out, errOut, reg := newAPIPaginateTestHarness(t)
-	reg.Register(&httpmock.Stub{
-		URL: "/open-apis/test/v1/items",
-		Body: map[string]interface{}{
-			"code": 0,
-			"msg":  "ok",
-			"data": map[string]interface{}{
-				"name":    "Test User",
-				"user_id": "u123",
-			},
-		},
-	})
-
-	err := apiPaginate(context.Background(), ac, apiPaginateRequest(),
-		output.FormatNDJSON, "", out, errOut, "lark-cli api GET", client.PaginationOptions{PageDelay: -1})
-
-	if err != nil {
-		t.Fatalf("apiPaginate() error = %v, want nil", err)
-	}
-	assertAPIPaginateJSONBytes(t, out.Bytes(), output.Envelope{
-		OK:       true,
-		Identity: "bot",
-		Data: map[string]interface{}{
-			"name":    "Test User",
-			"user_id": "u123",
-		},
-	})
-	wantWarning := "warning: this API does not return a list, format \"ndjson\" is not supported, falling back to json\n"
-	if got := errOut.String(); got != wantWarning {
-		t.Fatalf("stderr bytes = %q, want %q", got, wantWarning)
-	}
-}
-
-func TestAPIPaginate_BusinessErrorsWriteRawAndAreMarkedRaw(t *testing.T) {
-	businessResponse := map[string]interface{}{
-		"code": 123456,
-		"msg":  "fixture business error",
-		"data": map[string]interface{}{"detail": "business failed"},
-	}
-	tests := []struct {
-		name   string
-		format output.Format
-		jqExpr string
-	}{
-		{name: "jq", format: output.FormatJSON, jqExpr: ".data.items"},
-		{name: "default_json", format: output.FormatJSON},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			ac, out, errOut, reg := newAPIPaginateTestHarness(t)
-			reg.Register(&httpmock.Stub{
-				URL:  "/open-apis/test/v1/items",
-				Body: businessResponse,
-			})
-
-			err := apiPaginate(context.Background(), ac, apiPaginateRequest(),
-				tt.format, tt.jqExpr, out, errOut, "lark-cli api GET", client.PaginationOptions{PageDelay: -1})
-
-			if err == nil {
-				t.Fatal("apiPaginate() error = nil, want business error")
-			}
-			if !errs.IsRaw(err) {
-				t.Fatalf("errs.IsRaw(error) = false, want true; error = %T: %v", err, err)
-			}
-			assertAPIPaginateJSONBytes(t, out.Bytes(), businessResponse)
-			if bytes.Contains(out.Bytes(), []byte(`"ok": true`)) {
-				t.Fatalf("business-error stdout contains a success envelope:\n%s", out.Bytes())
-			}
-			if got := errOut.String(); got != "" {
-				t.Fatalf("stderr bytes = %q, want empty", got)
-			}
-		})
-	}
-}
-
-func TestAPIPaginate_TransportErrorsAreMarkedRaw(t *testing.T) {
-	tests := []struct {
-		name   string
-		format output.Format
-		jqExpr string
-	}{
-		{name: "jq_paginate_all", format: output.FormatJSON, jqExpr: ".data.items"},
-		{name: "stream_pages", format: output.FormatNDJSON},
-		{name: "default_paginate_all", format: output.FormatJSON},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			ac, out, errOut, _ := newAPIPaginateTestHarness(t)
-
-			err := apiPaginate(context.Background(), ac, apiPaginateRequest(),
-				tt.format, tt.jqExpr, out, errOut, "lark-cli api GET", client.PaginationOptions{PageDelay: -1})
-
-			if err == nil {
-				t.Fatal("apiPaginate() error = nil, want transport error")
-			}
-			if !errs.IsRaw(err) {
-				t.Fatalf("errs.IsRaw(error) = false, want true; error = %T: %v", err, err)
-			}
-			if got := out.String(); got != "" {
-				t.Fatalf("stdout bytes = %q, want empty", got)
-			}
-			if got := errOut.String(); got != "" {
-				t.Fatalf("stderr bytes = %q, want empty", got)
-			}
-		})
-	}
-}
-
-func TestAPIPaginate_StreamBusinessErrorIsMarkedRaw(t *testing.T) {
-	ac, out, errOut, reg := newAPIPaginateTestHarness(t)
-	reg.Register(&httpmock.Stub{
-		URL: "/open-apis/test/v1/items",
-		Body: map[string]interface{}{
-			"code": 123456,
-			"msg":  "fixture business error",
-			"data": map[string]interface{}{},
-		},
-	})
-
-	err := apiPaginate(context.Background(), ac, apiPaginateRequest(),
-		output.FormatNDJSON, "", out, errOut, "lark-cli api GET", client.PaginationOptions{PageDelay: -1})
-
-	if err == nil {
-		t.Fatal("apiPaginate() error = nil, want business error")
-	}
-	if !errs.IsRaw(err) {
-		t.Fatalf("errs.IsRaw(error) = false, want true; error = %T: %v", err, err)
-	}
-	if got := out.String(); got != "" {
-		t.Fatalf("stdout bytes = %q, want empty", got)
-	}
-	if got := errOut.String(); got != "" {
-		t.Fatalf("stderr bytes = %q, want empty", got)
-	}
-}

cmd/api/api_test.go

@@ -4,14 +4,10 @@
 package api
 
 import (
-	"bytes"
 	"context"
 	"encoding/json"
 	"errors"
-	"mime"
-	"mime/multipart"
 	"os"
-	"path/filepath"
 	"sort"
 	"strings"
 	"testing"
@@ -24,28 +20,13 @@ import (
 	"github.com/spf13/cobra"
 )
 
-func newTestApiCmd(f *cmdutil.Factory, runF func(*APIOptions) error) *cobra.Command {
-	cmd := NewCmdApi(f, runF)
-	cmd.SilenceErrors = true
-	cmd.SilenceUsage = true
-	return cmd
-}
-
-func newTestRootCmd() *cobra.Command {
-	return &cobra.Command{
-		Use:           "lark-cli",
-		SilenceErrors: true,
-		SilenceUsage:  true,
-	}
-}
-
 func TestApiCmd_FlagParsing(t *testing.T) {
 	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
 		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
 	})
 
 	var gotOpts *APIOptions
-	cmd := newTestApiCmd(f, func(opts *APIOptions) error {
+	cmd := NewCmdApi(f, func(opts *APIOptions) error {
 		gotOpts = opts
 		return nil
 	})
@@ -69,52 +50,22 @@ func TestApiCmd_FlagParsing(t *testing.T) {
 }
 
 func TestApiCmd_DryRun(t *testing.T) {
-	f, stdout, stderr, _ := cmdutil.TestFactory(t, &core.CliConfig{
+	f, stdout, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
 		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
 	})
 
-	cmd := newTestApiCmd(f, nil)
+	cmd := NewCmdApi(f, nil)
 	cmd.SetArgs([]string{"GET", "/open-apis/test", "--as", "bot", "--dry-run"})
 	err := cmd.Execute()
 	if err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
-	var got map[string]interface{}
-	if err := json.Unmarshal(stdout.Bytes(), &got); err != nil {
-		t.Fatalf("dry-run stdout is not JSON: %v\nstdout:\n%s\nstderr:\n%s", err, stdout.String(), stderr.String())
+	output := stdout.String()
+	if !strings.Contains(output, "Dry Run") {
+		t.Error("expected dry run output")
 	}
-	if got["ok"] != true || got["identity"] != "bot" || got["dry_run"] != true {
-		t.Fatalf("unexpected dry-run envelope: %#v", got)
-	}
-	data, ok := got["data"].(map[string]interface{})
-	if !ok {
-		t.Fatalf("data = %#v, want object", got["data"])
-	}
-	api, ok := data["api"].([]interface{})
-	if !ok || len(api) != 1 {
-		t.Fatalf("api = %#v, want one call", data["api"])
-	}
-	call, ok := api[0].(map[string]interface{})
-	if !ok || call["url"] != "/open-apis/test" {
-		t.Fatalf("api[0] = %#v", api[0])
-	}
-	if strings.Contains(stdout.String(), "=== Dry Run ===") {
-		t.Fatalf("stdout should not contain dry-run banner: %s", stdout.String())
-	}
-}
-
-func TestApiCmd_DryRunWithJq(t *testing.T) {
-	f, stdout, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
-	})
-
-	cmd := newTestApiCmd(f, nil)
-	cmd.SetArgs([]string{"GET", "/open-apis/test", "--as", "bot", "--dry-run", "--jq", ".data.api[0].url"})
-	if err := cmd.Execute(); err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if got := strings.TrimSpace(stdout.String()); got != "/open-apis/test" {
-		t.Fatalf("jq output = %q, want /open-apis/test", got)
+	if !strings.Contains(output, "/open-apis/test") {
+		t.Error("expected path in dry run output")
 	}
 }
 
@@ -126,7 +77,7 @@ func TestApiCmd_NullParamsWithPageSize(t *testing.T) {
 		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
 	})
 
-	cmd := newTestApiCmd(f, nil)
+	cmd := NewCmdApi(f, nil)
 	cmd.SetArgs([]string{"GET", "/open-apis/test", "--params", "null", "--page-size", "50", "--as", "bot", "--dry-run"})
 	if err := cmd.Execute(); err != nil {
 		t.Fatalf("--params null with --page-size should not error, got: %v", err)
@@ -147,7 +98,7 @@ func TestApiCmd_BotMode(t *testing.T) {
 		Body: map[string]interface{}{"code": 0, "msg": "ok", "data": map[string]interface{}{"result": "success"}},
 	})
 
-	cmd := newTestApiCmd(f, nil)
+	cmd := NewCmdApi(f, nil)
 	cmd.SetArgs([]string{"GET", "/open-apis/test", "--as", "bot"})
 	err := cmd.Execute()
 	if err != nil {
@@ -174,7 +125,7 @@ func TestApiCmd_MissingArgs(t *testing.T) {
 		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
 	})
 
-	cmd := newTestApiCmd(f, nil)
+	cmd := NewCmdApi(f, nil)
 	cmd.SetArgs([]string{"GET"}) // missing path
 	err := cmd.Execute()
 	if err == nil {
@@ -182,28 +133,12 @@ func TestApiCmd_MissingArgs(t *testing.T) {
 	}
 }
 
-func TestApiCmd_EmptyMethodRejected(t *testing.T) {
-	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
-	})
-
-	cmd := newTestApiCmd(f, nil)
-	cmd.SetArgs([]string{"", "/open-apis/test", "--as", "bot", "--dry-run"})
-	err := cmd.Execute()
-	if err == nil {
-		t.Fatal("expected validation error for empty HTTP method")
-	}
-	if !strings.Contains(err.Error(), "method") {
-		t.Fatalf("error should name the method argument, got: %v", err)
-	}
-}
-
 func TestApiCmd_InvalidParamsJSON(t *testing.T) {
 	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
 		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
 	})
 
-	cmd := newTestApiCmd(f, nil)
+	cmd := NewCmdApi(f, nil)
 	cmd.SetArgs([]string{"GET", "/open-apis/test", "--as", "bot", "--params", "{bad"})
 	err := cmd.Execute()
 	if err == nil {
@@ -216,7 +151,7 @@ func TestApiValidArgsFunction(t *testing.T) {
 		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
 	})
 
-	cmd := newTestApiCmd(f, nil)
+	cmd := NewCmdApi(f, nil)
 	fn := cmd.ValidArgsFunction
 
 	tests := []struct {
@@ -282,7 +217,7 @@ func TestNewCmdApi_StrictModeHidesAsFlag(t *testing.T) {
 		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu, SupportedIdentities: 2,
 	})
 
-	cmd := newTestApiCmd(f, nil)
+	cmd := NewCmdApi(f, nil)
 	flag := cmd.Flags().Lookup("as")
 	if flag == nil {
 		t.Fatal("expected --as flag to be registered")
@@ -301,7 +236,7 @@ func TestApiCmd_PageLimitDefault(t *testing.T) {
 	})
 
 	var gotOpts *APIOptions
-	cmd := newTestApiCmd(f, func(opts *APIOptions) error {
+	cmd := NewCmdApi(f, func(opts *APIOptions) error {
 		gotOpts = opts
 		return nil
 	})
@@ -320,7 +255,7 @@ func TestApiCmd_ParamsAndDataBothStdinConflict(t *testing.T) {
 		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
 	})
 
-	cmd := newTestApiCmd(f, nil)
+	cmd := NewCmdApi(f, nil)
 	cmd.SetArgs([]string{"POST", "/open-apis/test", "--as", "bot", "--params", "-", "--data", "-"})
 	err := cmd.Execute()
 	if err == nil {
@@ -337,7 +272,7 @@ func TestApiCmd_OutputAndPageAllConflict(t *testing.T) {
 	})
 
 	var gotOpts *APIOptions
-	cmd := newTestApiCmd(f, func(opts *APIOptions) error {
+	cmd := NewCmdApi(f, func(opts *APIOptions) error {
 		gotOpts = opts
 		return apiRun(opts)
 	})
@@ -352,9 +287,6 @@ func TestApiCmd_OutputAndPageAllConflict(t *testing.T) {
 }
 
 func TestApiCmd_BinaryResponse_AutoSave(t *testing.T) {
-	dir := t.TempDir()
-	cmdutil.TestChdir(t, dir)
-
 	f, stdout, stderr, reg := cmdutil.TestFactory(t, &core.CliConfig{
 		AppID: "test-app-bin", AppSecret: "test-secret-bin", Brand: core.BrandFeishu,
 	})
@@ -365,7 +297,7 @@ func TestApiCmd_BinaryResponse_AutoSave(t *testing.T) {
 		ContentType: "application/octet-stream",
 	})
 
-	cmd := newTestApiCmd(f, nil)
+	cmd := NewCmdApi(f, nil)
 	cmd.SetArgs([]string{"GET", "/open-apis/drive/v1/files/xxx/download", "--as", "bot"})
 	err := cmd.Execute()
 	if err != nil {
@@ -374,33 +306,8 @@ func TestApiCmd_BinaryResponse_AutoSave(t *testing.T) {
 	if !strings.Contains(stderr.String(), "binary response detected") {
 		t.Error("expected binary response hint in stderr")
 	}
-	var got map[string]interface{}
-	if err := json.Unmarshal(stdout.Bytes(), &got); err != nil {
-		t.Fatalf("stdout is not JSON: %v\nstdout:\n%s", err, stdout.String())
-	}
-	savedPath, _ := got["saved_path"].(string)
-	if savedPath == "" {
-		t.Fatalf("saved_path missing from output: %#v", got)
-	}
-	// The file must land inside the temporary cwd — this pins the isolation
-	// contract: rolling back TestChdir would leave download.bin in the repo.
-	wantDir, err := filepath.EvalSymlinks(dir)
-	if err != nil {
-		t.Fatal(err)
-	}
-	gotDir, err := filepath.EvalSymlinks(filepath.Dir(savedPath))
-	if err != nil {
-		t.Fatalf("saved_path %q dir not resolvable: %v", savedPath, err)
-	}
-	if gotDir != wantDir {
-		t.Errorf("saved_path %q is outside temp cwd %q", savedPath, wantDir)
-	}
-	content, err := os.ReadFile(savedPath)
-	if err != nil {
-		t.Fatalf("read saved file: %v", err)
-	}
-	if string(content) != "fake-binary-content" {
-		t.Errorf("saved file content = %q, want %q", content, "fake-binary-content")
+	if !strings.Contains(stdout.String(), "saved_path") {
+		t.Error("expected saved_path in output")
 	}
 }
 
@@ -421,7 +328,7 @@ func TestApiCmd_PageAll_NonBatchAPI_FallbackToJSON(t *testing.T) {
 		},
 	})
 
-	cmd := newTestApiCmd(f, nil)
+	cmd := NewCmdApi(f, nil)
 	cmd.SetArgs([]string{"GET", "/open-apis/contact/v3/users/u123", "--as", "bot", "--page-all", "--format", "ndjson"})
 	err := cmd.Execute()
 	if err != nil {
@@ -461,7 +368,7 @@ func TestApiCmd_PageAll_NonBatchAPI_ErrorStillOutputsJSON(t *testing.T) {
 		},
 	})
 
-	cmd := newTestApiCmd(f, nil)
+	cmd := NewCmdApi(f, nil)
 	cmd.SetArgs([]string{"GET", "/open-apis/im/v1/chats/oc_xxx/announcement", "--as", "bot", "--page-all"})
 	err := cmd.Execute()
 	// Should return an error
@@ -502,7 +409,7 @@ func TestApiCmd_PageAll_BatchAPI_StreamsItems(t *testing.T) {
 		},
 	})
 
-	cmd := newTestApiCmd(f, nil)
+	cmd := NewCmdApi(f, nil)
 	cmd.SetArgs([]string{"GET", "/open-apis/contact/v3/users", "--as", "bot", "--page-all", "--format", "ndjson"})
 	err := cmd.Execute()
 	if err != nil {
@@ -541,7 +448,7 @@ func TestApiCmd_PageAll_StreamBusinessErrorDoesNotDumpJSON(t *testing.T) {
 		},
 	})
 
-	cmd := newTestApiCmd(f, nil)
+	cmd := NewCmdApi(f, nil)
 	cmd.SetArgs([]string{"GET", "/open-apis/contact/v3/users", "--as", "bot", "--page-all", "--format", "ndjson"})
 	err := cmd.Execute()
 	if err == nil {
@@ -576,7 +483,7 @@ func TestApiCmd_PageAll_BatchAPI_DefaultJSONEnvelope(t *testing.T) {
 		},
 	})
 
-	cmd := newTestApiCmd(f, nil)
+	cmd := NewCmdApi(f, nil)
 	cmd.SetArgs([]string{"GET", "/open-apis/contact/v3/users", "--as", "bot", "--page-all"})
 	if err := cmd.Execute(); err != nil {
 		t.Fatalf("unexpected error: %v", err)
@@ -642,8 +549,8 @@ func TestApiCmd_PageAll_DefaultJSONRunsContentSafety(t *testing.T) {
 		},
 	})
 
-	root := newTestRootCmd()
-	root.AddCommand(newTestApiCmd(f, nil))
+	root := &cobra.Command{Use: "lark-cli"}
+	root.AddCommand(NewCmdApi(f, nil))
 	root.SetArgs([]string{"api", "GET", "/open-apis/contact/v3/users", "--as", "bot", "--page-all"})
 	if err := root.Execute(); err != nil {
 		t.Fatalf("unexpected error: %v", err)
@@ -693,8 +600,8 @@ func TestApiCmd_PageAll_StreamFormatRunsContentSafety(t *testing.T) {
 		},
 	})
 
-	root := newTestRootCmd()
-	root.AddCommand(newTestApiCmd(f, nil))
+	root := &cobra.Command{Use: "lark-cli"}
+	root.AddCommand(NewCmdApi(f, nil))
 	root.SetArgs([]string{"api", "GET", "/open-apis/contact/v3/users", "--as", "bot", "--page-all", "--format", "ndjson"})
 	if err := root.Execute(); err != nil {
 		t.Fatalf("unexpected error: %v", err)
@@ -749,8 +656,8 @@ func TestApiCmd_PageAll_StreamFormatBlockSkipsBlockedPage(t *testing.T) {
 		},
 	})
 
-	root := newTestRootCmd()
-	root.AddCommand(newTestApiCmd(f, nil))
+	root := &cobra.Command{Use: "lark-cli"}
+	root.AddCommand(NewCmdApi(f, nil))
 	root.SetArgs([]string{"api", "GET", "/open-apis/contact/v3/users", "--as", "bot", "--page-all", "--format", "ndjson"})
 	err := root.Execute()
 	if err == nil {
@@ -814,7 +721,7 @@ func TestApiCmd_JqFlag_Parsing(t *testing.T) {
 	})
 
 	var gotOpts *APIOptions
-	cmd := newTestApiCmd(f, func(opts *APIOptions) error {
+	cmd := NewCmdApi(f, func(opts *APIOptions) error {
 		gotOpts = opts
 		return nil
 	})
@@ -834,7 +741,7 @@ func TestApiCmd_JqFlag_ShortForm(t *testing.T) {
 	})
 
 	var gotOpts *APIOptions
-	cmd := newTestApiCmd(f, func(opts *APIOptions) error {
+	cmd := NewCmdApi(f, func(opts *APIOptions) error {
 		gotOpts = opts
 		return nil
 	})
@@ -853,7 +760,7 @@ func TestApiCmd_JqAndOutputConflict(t *testing.T) {
 		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
 	})
 
-	cmd := newTestApiCmd(f, func(opts *APIOptions) error {
+	cmd := NewCmdApi(f, func(opts *APIOptions) error {
 		return apiRun(opts)
 	})
 	cmd.SetArgs([]string{"GET", "/open-apis/test", "--as", "bot", "--jq", ".data", "--output", "file.bin"})
@@ -884,7 +791,7 @@ func TestApiCmd_JqFilter_AppliesExpression(t *testing.T) {
 		},
 	})
 
-	cmd := newTestApiCmd(f, nil)
+	cmd := NewCmdApi(f, nil)
 	cmd.SetArgs([]string{"GET", "/open-apis/test/jq", "--as", "bot", "--jq", ".data.items[].name"})
 	err := cmd.Execute()
 	if err != nil {
@@ -905,7 +812,7 @@ func TestApiCmd_JqAndFormatConflict(t *testing.T) {
 		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
 	})
 
-	cmd := newTestApiCmd(f, func(opts *APIOptions) error {
+	cmd := NewCmdApi(f, func(opts *APIOptions) error {
 		return apiRun(opts)
 	})
 	cmd.SetArgs([]string{"GET", "/open-apis/test", "--as", "bot", "--jq", ".data", "--format", "ndjson"})
@@ -923,7 +830,7 @@ func TestApiCmd_JqInvalidExpression(t *testing.T) {
 		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
 	})
 
-	cmd := newTestApiCmd(f, func(opts *APIOptions) error {
+	cmd := NewCmdApi(f, func(opts *APIOptions) error {
 		return apiRun(opts)
 	})
 	cmd.SetArgs([]string{"GET", "/open-apis/test", "--as", "bot", "--jq", "invalid["})
@@ -952,7 +859,7 @@ func TestApiCmd_PageAll_WithJq(t *testing.T) {
 		},
 	})
 
-	cmd := newTestApiCmd(f, nil)
+	cmd := NewCmdApi(f, nil)
 	cmd.SetArgs([]string{"GET", "/open-apis/contact/v3/users", "--as", "bot", "--page-all", "--jq", ".data.items[].id"})
 	err := cmd.Execute()
 	if err != nil {
@@ -973,7 +880,7 @@ func TestApiCmd_MethodUppercase(t *testing.T) {
 	})
 
 	var gotOpts *APIOptions
-	cmd := newTestApiCmd(f, func(opts *APIOptions) error {
+	cmd := NewCmdApi(f, func(opts *APIOptions) error {
 		gotOpts = opts
 		return nil
 	})
@@ -992,7 +899,7 @@ func TestApiCmd_FileFlagParsing(t *testing.T) {
 		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
 	})
 	var gotOpts *APIOptions
-	cmd := newTestApiCmd(f, func(opts *APIOptions) error {
+	cmd := NewCmdApi(f, func(opts *APIOptions) error {
 		gotOpts = opts
 		return nil
 	})
@@ -1010,7 +917,7 @@ func TestApiCmd_FileAndOutputConflict(t *testing.T) {
 	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
 		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
 	})
-	cmd := newTestApiCmd(f, func(opts *APIOptions) error {
+	cmd := NewCmdApi(f, func(opts *APIOptions) error {
 		return apiRun(opts)
 	})
 	cmd.SetArgs([]string{"POST", "/open-apis/test", "--as", "bot", "--file", "photo.jpg", "--output", "out.json"})
@@ -1027,7 +934,7 @@ func TestApiCmd_FileWithGET(t *testing.T) {
 	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
 		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
 	})
-	cmd := newTestApiCmd(f, func(opts *APIOptions) error {
+	cmd := NewCmdApi(f, func(opts *APIOptions) error {
 		return apiRun(opts)
 	})
 	cmd.SetArgs([]string{"GET", "/open-apis/test", "--as", "bot", "--file", "photo.jpg"})
@@ -1044,7 +951,7 @@ func TestApiCmd_FileStdinConflictWithData(t *testing.T) {
 	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
 		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
 	})
-	cmd := newTestApiCmd(f, func(opts *APIOptions) error {
+	cmd := NewCmdApi(f, func(opts *APIOptions) error {
 		return apiRun(opts)
 	})
 	cmd.SetArgs([]string{"POST", "/open-apis/test", "--as", "bot", "--file", "-", "--data", "-"})
@@ -1067,30 +974,18 @@ func TestApiCmd_DryRunWithFile(t *testing.T) {
 	f, stdout, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
 		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
 	})
-	cmd := newTestApiCmd(f, nil)
+	cmd := NewCmdApi(f, nil)
 	cmd.SetArgs([]string{"POST", "/open-apis/im/v1/images", "--file", "image=" + tmpFile, "--data", `{"image_type":"message"}`, "--dry-run", "--as", "bot"})
 	err := cmd.Execute()
 	if err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
 	out := stdout.String()
-	var env map[string]interface{}
-	if err := json.Unmarshal(stdout.Bytes(), &env); err != nil {
-		t.Fatalf("dry-run stdout is not JSON: %v\n%s", err, out)
+	if !strings.Contains(out, "image") {
+		t.Errorf("expected dry-run output to mention file field, got: %s", out)
 	}
-	if env["dry_run"] != true {
-		t.Fatalf("dry_run = %#v, want true", env["dry_run"])
-	}
-	data := env["data"].(map[string]interface{})
-	api := data["api"].([]interface{})
-	call := api[0].(map[string]interface{})
-	body := call["body"].(map[string]interface{})
-	file := body["file"].(map[string]interface{})
-	if file["field"] != "image" || file["path"] != tmpFile {
-		t.Fatalf("unexpected file dry-run body: %#v", body)
-	}
-	if strings.Contains(out, "=== Dry Run ===") {
-		t.Fatalf("stdout should not contain dry-run banner: %s", out)
+	if !strings.Contains(out, "Dry Run") {
+		t.Errorf("expected dry-run header, got: %s", out)
 	}
 }
 
@@ -1120,7 +1015,7 @@ func TestApiCmd_PermissionError_DerivesFirstClassFields(t *testing.T) {
 		},
 	})
 
-	cmd := newTestApiCmd(f, nil)
+	cmd := NewCmdApi(f, nil)
 	cmd.SetArgs([]string{"GET", "/open-apis/docx/v1/documents/test", "--as", "bot"})
 	err := cmd.Execute()
 	if err == nil {
@@ -1146,7 +1041,7 @@ func TestApiCmd_JsonFlag_Accepted(t *testing.T) {
 	})
 
 	var gotOpts *APIOptions
-	cmd := newTestApiCmd(f, func(opts *APIOptions) error {
+	cmd := NewCmdApi(f, func(opts *APIOptions) error {
 		gotOpts = opts
 		return nil
 	})
@@ -1159,157 +1054,3 @@ func TestApiCmd_JsonFlag_Accepted(t *testing.T) {
 		t.Errorf("expected method GET, got %s", gotOpts.Method)
 	}
 }
-
-// parseMultipartFilenames drives one api --file upload through the mock
-// transport and returns a map of field name -> part filename parsed from the
-// captured multipart body, plus the map of text form fields. It fails the test
-// if the captured request is not multipart/form-data.
-func parseMultipartFilenames(t *testing.T, stub *httpmock.Stub) (map[string]string, map[string]string) {
-	t.Helper()
-	ct := stub.CapturedHeaders.Get("Content-Type")
-	mediaType, params, err := mime.ParseMediaType(ct)
-	if err != nil {
-		t.Fatalf("parse Content-Type %q: %v", ct, err)
-	}
-	if !strings.HasPrefix(mediaType, "multipart/") {
-		t.Fatalf("Content-Type = %q, want multipart/*", mediaType)
-	}
-	filenames := map[string]string{}
-	fields := map[string]string{}
-	mr := multipart.NewReader(bytes.NewReader(stub.CapturedBody), params["boundary"])
-	for {
-		part, err := mr.NextPart()
-		if err != nil {
-			break
-		}
-		if fn := part.FileName(); fn != "" {
-			filenames[part.FormName()] = fn
-		} else {
-			buf := &bytes.Buffer{}
-			_, _ = buf.ReadFrom(part)
-			fields[part.FormName()] = buf.String()
-		}
-	}
-	return filenames, fields
-}
-
-func TestApiCmd_FileUpload_PreservesFilename(t *testing.T) {
-	f, _, _, reg := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
-	})
-
-	dir := t.TempDir()
-	cmdutil.TestChdir(t, dir)
-	if err := os.WriteFile(filepath.Join(dir, "invoice.pdf"), []byte("%PDF-1.4 fake"), 0600); err != nil {
-		t.Fatalf("write test file: %v", err)
-	}
-
-	stub := &httpmock.Stub{
-		URL:  "/open-apis/approval/v4/files/upload",
-		Body: map[string]interface{}{"code": 0, "msg": "success", "data": map[string]interface{}{"code": "file_xxx"}},
-	}
-	reg.Register(stub)
-
-	cmd := NewCmdApi(f, nil)
-	cmd.SetArgs([]string{"POST", "/open-apis/approval/v4/files/upload", "--as", "bot", "--file", "invoice.pdf"})
-	if err := cmd.Execute(); err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-
-	filenames, _ := parseMultipartFilenames(t, stub)
-	if got := filenames["file"]; got != "invoice.pdf" {
-		t.Fatalf("part filename for field %q = %q, want %q", "file", got, "invoice.pdf")
-	}
-}
-
-func TestApiCmd_FileUpload_FieldPrefixKeepsBasename(t *testing.T) {
-	f, _, _, reg := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
-	})
-
-	dir := t.TempDir()
-	cmdutil.TestChdir(t, dir)
-	if err := os.MkdirAll(filepath.Join(dir, "sub"), 0700); err != nil {
-		t.Fatalf("mkdir: %v", err)
-	}
-	if err := os.WriteFile(filepath.Join(dir, "sub", "invoice.pdf"), []byte("%PDF-1.4 fake"), 0600); err != nil {
-		t.Fatalf("write test file: %v", err)
-	}
-
-	stub := &httpmock.Stub{
-		URL:  "/open-apis/approval/v4/files/upload",
-		Body: map[string]interface{}{"code": 0, "msg": "success", "data": map[string]interface{}{"code": "file_xxx"}},
-	}
-	reg.Register(stub)
-
-	cmd := NewCmdApi(f, nil)
-	cmd.SetArgs([]string{"POST", "/open-apis/approval/v4/files/upload", "--as", "bot", "--file", "upload=sub/invoice.pdf"})
-	if err := cmd.Execute(); err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-
-	filenames, _ := parseMultipartFilenames(t, stub)
-	if _, ok := filenames["upload"]; !ok {
-		t.Fatalf("expected field name %q from field=path form, got fields %v", "upload", filenames)
-	}
-	if got := filenames["upload"]; got != "invoice.pdf" {
-		t.Fatalf("part filename for field %q = %q, want %q (basename only)", "upload", got, "invoice.pdf")
-	}
-}
-
-func TestApiCmd_FileUpload_WithDataFields(t *testing.T) {
-	f, _, _, reg := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
-	})
-
-	dir := t.TempDir()
-	cmdutil.TestChdir(t, dir)
-	if err := os.WriteFile(filepath.Join(dir, "invoice.pdf"), []byte("%PDF-1.4 fake"), 0600); err != nil {
-		t.Fatalf("write test file: %v", err)
-	}
-
-	stub := &httpmock.Stub{
-		URL:  "/open-apis/approval/v4/files/upload",
-		Body: map[string]interface{}{"code": 0, "msg": "success", "data": map[string]interface{}{"code": "file_xxx"}},
-	}
-	reg.Register(stub)
-
-	cmd := NewCmdApi(f, nil)
-	cmd.SetArgs([]string{"POST", "/open-apis/approval/v4/files/upload", "--as", "bot",
-		"--file", "invoice.pdf", "--data", `{"type":"attachment"}`})
-	if err := cmd.Execute(); err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-
-	filenames, fields := parseMultipartFilenames(t, stub)
-	if got := filenames["file"]; got != "invoice.pdf" {
-		t.Fatalf("part filename = %q, want %q", got, "invoice.pdf")
-	}
-	if got := fields["type"]; got != "attachment" {
-		t.Fatalf("text field type = %q, want %q", got, "attachment")
-	}
-}
-
-func TestApiCmd_FileUpload_StdinFallsBackToUnknown(t *testing.T) {
-	f, _, _, reg := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
-	})
-	f.IOStreams.In = bytes.NewReader([]byte("stdin-bytes"))
-
-	stub := &httpmock.Stub{
-		URL:  "/open-apis/approval/v4/files/upload",
-		Body: map[string]interface{}{"code": 0, "msg": "success", "data": map[string]interface{}{"code": "file_xxx"}},
-	}
-	reg.Register(stub)
-
-	cmd := NewCmdApi(f, nil)
-	cmd.SetArgs([]string{"POST", "/open-apis/approval/v4/files/upload", "--as", "bot", "--file", "-"})
-	if err := cmd.Execute(); err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-
-	filenames, _ := parseMultipartFilenames(t, stub)
-	if got := filenames["file"]; got != "unknown-file" {
-		t.Fatalf("stdin part filename = %q, want %q (no stable local name, fallback)", got, "unknown-file")
-	}
-}

cmd/auth/login_messages.go

@@ -128,5 +128,5 @@ func getLoginMsg(lang i18n.Lang) *loginMsg {
 // (not backed by from_meta service specs). Descriptions are now centralized in
 // service_descriptions.json.
 func getShortcutOnlyDomainNames() []string {
-	return []string{"application", "base", "contact", "docs", "markdown", "apps", "note"}
+	return []string{"base", "contact", "docs", "markdown", "apps", "note"}
 }

cmd/auth/testmain_test.go

@@ -1,46 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package auth
-
-import (
-	"os"
-	"path/filepath"
-	"testing"
-
-	"github.com/larksuite/cli/internal/registry/registrytest"
-)
-
-// TestMain isolates auth command tests from the host machine: config, logs
-// and the registry cache are redirected to a temp dir, then the registry is
-// seeded from the tracked fixture and initialized eagerly. Domain-completion
-// tests read the registry, so without seeding a clean checkout would either
-// fail or trigger a remote metadata fetch.
-//
-// Note: os.Exit skips deferred functions, so cleanup runs explicitly after
-// m.Run before exiting.
-func TestMain(m *testing.M) {
-	root, err := os.MkdirTemp("", "lark-cli-cmd-auth-test-*")
-	if err != nil {
-		println("cmd/auth test setup: MkdirTemp failed:", err.Error())
-		os.Exit(2)
-	}
-	if err := os.Setenv("LARKSUITE_CLI_CONFIG_DIR", filepath.Join(root, "config")); err != nil {
-		println("cmd/auth test setup: Setenv failed:", err.Error())
-		os.RemoveAll(root)
-		os.Exit(2)
-	}
-	if err := os.Setenv("LARKSUITE_CLI_LOG_DIR", filepath.Join(root, "logs")); err != nil {
-		println("cmd/auth test setup: Setenv failed:", err.Error())
-		os.RemoveAll(root)
-		os.Exit(2)
-	}
-	if err := registrytest.Seed(root); err != nil {
-		println("cmd/auth test setup: registrytest.Seed failed:", err.Error())
-		os.RemoveAll(root)
-		os.Exit(2)
-	}
-	code := m.Run()
-	_ = os.RemoveAll(root)
-	os.Exit(code)
-}

cmd/build.go

@@ -25,10 +25,8 @@ import (
 	"github.com/larksuite/cli/internal/build"
 	"github.com/larksuite/cli/internal/cmdpolicy"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/hook"
 	"github.com/larksuite/cli/internal/keychain"
-	"github.com/larksuite/cli/internal/registry"
 	"github.com/larksuite/cli/shortcuts"
 	"github.com/spf13/cobra"
 )
@@ -44,18 +42,6 @@ type buildConfig struct {
 	skipStrictMode bool
 	skipService    bool
 	serviceCatalog *apicatalog.Catalog
-	startupBrand   core.LarkBrand
-}
-
-// WithStartupBrand initializes the API registry with the given brand before
-// any command registration touches the runtime catalog. Without it the
-// registry's sync.Once locks onto the Feishu default at first catalog access,
-// long before the lazily-resolved config brand is known — see
-// ResolveStartupBrand for the caller-side resolution.
-func WithStartupBrand(brand core.LarkBrand) BuildOption {
-	return func(c *buildConfig) {
-		c.startupBrand = brand
-	}
 }
 
 // WithIO sets the IO streams for the CLI by wrapping raw reader/writers.
@@ -168,12 +154,6 @@ func buildInternal(ctx context.Context, inv cmdutil.InvocationContext, opts ...B
 		cfg.streams = cmdutil.SystemIO()
 	}
 
-	// Initialize the registry brand before anything touches the runtime
-	// catalog (its sync.Once would otherwise lock onto the Feishu default).
-	if cfg.startupBrand != "" {
-		registry.InitWithBrand(cfg.startupBrand)
-	}
-
 	f := cmdutil.NewDefault(cfg.streams, inv)
 	if cfg.keychain != nil {
 		f.Keychain = cfg.keychain

cmd/config/bind_test.go

@@ -916,6 +916,25 @@ func TestReadDotenv_ValueWithEquals(t *testing.T) {
 	}
 }
 
+func TestNormalizeBrand(t *testing.T) {
+	tests := []struct {
+		input string
+		want  string
+	}{
+		{"", "feishu"},
+		{"feishu", "feishu"},
+		{"lark", "lark"},
+		{"LARK", "lark"},
+		{" lark ", "lark"},
+		{"Lark", "lark"},
+	}
+	for _, tt := range tests {
+		if got := normalizeBrand(tt.input); got != tt.want {
+			t.Errorf("normalizeBrand(%q) = %q, want %q", tt.input, got, tt.want)
+		}
+	}
+}
+
 func TestResolveOpenClawConfigPath_Overrides(t *testing.T) {
 	t.Run("OPENCLAW_CONFIG_PATH wins", func(t *testing.T) {
 		custom := filepath.Join(t.TempDir(), "custom.json")

cmd/config/binder.go

@@ -205,7 +205,7 @@ func (b *openclawBinder) Build(appID string) (*core.AppConfig, error) {
 	return &core.AppConfig{
 		AppId:     selected.AppID,
 		AppSecret: stored,
-		Brand:     core.ParseBrand(selected.Brand),
+		Brand:     core.LarkBrand(normalizeBrand(selected.Brand)),
 	}, nil
 }
 
@@ -261,7 +261,7 @@ func (b *hermesBinder) Build(appID string) (*core.AppConfig, error) {
 	return &core.AppConfig{
 		AppId:     appID,
 		AppSecret: stored,
-		Brand:     core.ParseBrand(b.envMap["FEISHU_DOMAIN"]),
+		Brand:     core.LarkBrand(normalizeBrand(b.envMap["FEISHU_DOMAIN"])),
 	}, nil
 }
 
@@ -326,7 +326,7 @@ func (b *larkChannelBinder) Build(appID string) (*core.AppConfig, error) {
 	return &core.AppConfig{
 		AppId:     appID,
 		AppSecret: stored,
-		Brand:     core.ParseBrand(b.cfg.Accounts.App.Tenant),
+		Brand:     core.LarkBrand(normalizeBrand(b.cfg.Accounts.App.Tenant)),
 	}, nil
 }
 
@@ -350,6 +350,16 @@ func sourceDisplayName(source string) string {
 	}
 }
 
+// normalizeBrand applies .strip().lower() and defaults to "feishu".
+// Aligns with Hermes gateway/platforms/feishu.py:1119 behavior.
+func normalizeBrand(raw string) string {
+	s := strings.TrimSpace(strings.ToLower(raw))
+	if s == "" {
+		return "feishu"
+	}
+	return s
+}
+
 // resolveHermesEnvPath returns the path to Hermes's .env file.
 // Respects HERMES_HOME override; defaults to ~/.hermes/.env.
 //

cmd/config/config.go

@@ -31,7 +31,6 @@ func NewCmdConfig(f *cmdutil.Factory) *cobra.Command {
 	cmd.AddCommand(NewCmdConfigShow(f, nil))
 	cmd.AddCommand(NewCmdConfigDefaultAs(f))
 	cmd.AddCommand(NewCmdConfigStrictMode(f))
-	cmd.AddCommand(NewCmdConfigRiskControl(f))
 	cmd.AddCommand(NewCmdConfigPolicy(f))
 	cmd.AddCommand(NewCmdConfigPlugins(f))
 	cmd.AddCommand(NewCmdConfigKeychainDowngrade(f))

cmd/config/init_interactive.go

@@ -5,9 +5,7 @@ package config
 
 import (
 	"context"
-	"errors"
 	"fmt"
-	"net"
 
 	"github.com/charmbracelet/huh"
 	"github.com/larksuite/cli/internal/build"
@@ -179,12 +177,12 @@ func runCreateAppFlow(ctx context.Context, f *cmdutil.Factory, brandOverride cor
 	}
 
 	// Step 1: Request app registration (begin)
-	// Registration is platform traffic, so it must use the provider-aware
-	// transport as well as the shared proxy configuration.
+	// Use the shared proxy-plugin-aware transport so registration traffic is not
+	// a bypass of proxy plugin mode.
 	httpClient := transport.NewHTTPClient(0)
-	authResp, err := larkauth.RequestAppRegistration(ctx, httpClient, larkBrand, f.IOStreams.ErrOut)
+	authResp, err := larkauth.RequestAppRegistration(httpClient, larkBrand, f.IOStreams.ErrOut)
 	if err != nil {
-		return nil, classifyRegistrationBeginError(err)
+		return nil, errs.NewConfigError(errs.SubtypeInvalidClient, "app registration failed: %v", err).WithCause(err)
 	}
 
 	// Step 2: Build and display verification URL + QR code
@@ -210,17 +208,33 @@ func runCreateAppFlow(ctx context.Context, f *cmdutil.Factory, brandOverride cor
 		fmt.Fprintf(f.IOStreams.ErrOut, "  %s\n\n", verificationURL)
 		fmt.Fprintf(f.IOStreams.ErrOut, "%s\n", msg.WaitingForScanNonTTY)
 	}
-	// Step 4: Poll for credentials (brand discovery lives in internal/auth);
-	// this layer only classifies the terminal error and saves the result.
-	result, finalBrand, err := larkauth.RegisterAppWithDiscovery(ctx, httpClient, authResp, f.IOStreams.ErrOut)
+	result, err := larkauth.PollAppRegistration(ctx, httpClient, core.BrandFeishu, authResp.DeviceCode, authResp.Interval, authResp.ExpiresIn, f.IOStreams.ErrOut)
 	if err != nil {
-		return nil, classifyRegistrationError(err)
+		return nil, errs.NewAuthenticationError(errs.SubtypeUnknown, "%v", err).WithCause(err)
+	}
+
+	// Step 4: Handle Lark brand special case
+	// If tenant_brand=lark and no client_secret, retry with lark brand endpoint
+	if result.ClientSecret == "" && result.UserInfo != nil && result.UserInfo.TenantBrand == "lark" {
+		// fmt.Fprintf(f.IOStreams.ErrOut, "%s\n", msg.DetectedLarkTenant)
+		result, err = larkauth.PollAppRegistration(ctx, httpClient, core.BrandLark, authResp.DeviceCode, authResp.Interval, authResp.ExpiresIn, f.IOStreams.ErrOut)
+		if err != nil {
+			return nil, errs.NewNetworkError(errs.SubtypeNetworkTransport, "lark endpoint retry failed: %v", err).WithCause(err)
+		}
 	}
 
 	if result.ClientID == "" || result.ClientSecret == "" {
 		return nil, errs.NewConfigError(errs.SubtypeInvalidClient, "app registration succeeded but missing client_id or client_secret")
 	}
 
+	// Determine final brand from response
+	finalBrand := larkBrand
+	if result.UserInfo != nil && result.UserInfo.TenantBrand == "lark" {
+		finalBrand = core.BrandLark
+	} else if result.UserInfo != nil && result.UserInfo.TenantBrand == "feishu" {
+		finalBrand = core.BrandFeishu
+	}
+
 	fmt.Fprintln(f.IOStreams.ErrOut)
 	output.PrintSuccess(f.IOStreams.ErrOut, fmt.Sprintf(msg.AppCreated, result.ClientID))
 
@@ -231,40 +245,3 @@ func runCreateAppFlow(ctx context.Context, f *cmdutil.Factory, brandOverride cor
 		AppSecret: result.ClientSecret,
 	}, nil
 }
-
-// classifyRegistrationBeginError keeps transport/cancellation failures out of
-// the invalid-client category: the begin request sends no app credentials.
-func classifyRegistrationBeginError(err error) error {
-	switch {
-	case errors.Is(err, context.Canceled):
-		return errs.NewAuthenticationError(errs.SubtypeUnknown, "app registration cancelled").WithCause(err)
-	case errors.Is(err, context.DeadlineExceeded):
-		return errs.NewNetworkError(errs.SubtypeNetworkTimeout, "app registration begin timed out: %v", err).WithCause(err)
-	}
-	var netErr net.Error
-	if errors.As(err, &netErr) {
-		subtype := errs.SubtypeNetworkTransport
-		if netErr.Timeout() {
-			subtype = errs.SubtypeNetworkTimeout
-		}
-		return errs.NewNetworkError(subtype, "app registration begin failed: %v", err).WithCause(err)
-	}
-	return errs.NewAPIError(errs.SubtypeUnknown, "app registration begin failed: %v", err).WithCause(err)
-}
-
-// classifyRegistrationError maps registration terminal outcomes to typed
-// errors, preserving causes.
-func classifyRegistrationError(err error) error {
-	switch {
-	case errors.Is(err, larkauth.ErrRegistrationDenied):
-		return errs.NewAuthenticationError(errs.SubtypeUnknown, "%v", err).
-			WithHint("re-run `lark-cli config init --new` and approve the authorization request").
-			WithCause(err)
-	case errors.Is(err, larkauth.ErrRegistrationExpired), errors.Is(err, larkauth.ErrRegistrationTimedOut):
-		return errs.NewAuthenticationError(errs.SubtypeTokenExpired, "%v", err).
-			WithHint("re-run `lark-cli config init --new` and complete the scan before the code expires").
-			WithCause(err)
-	default:
-		return errs.NewAuthenticationError(errs.SubtypeUnknown, "app registration failed: %v", err).WithCause(err)
-	}
-}

cmd/config/init_interactive_test.go

@@ -1,70 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package config
-
-import (
-	"context"
-	"errors"
-	"net"
-	"testing"
-
-	"github.com/larksuite/cli/errs"
-	larkauth "github.com/larksuite/cli/internal/auth"
-)
-
-func assertRegistrationProblem(t *testing.T, got, cause error, category errs.Category, subtype errs.Subtype) *errs.Problem {
-	t.Helper()
-	p, ok := errs.ProblemOf(got)
-	if !ok {
-		t.Fatalf("error %T is not typed: %v", got, got)
-	}
-	if p.Category != category || p.Subtype != subtype {
-		t.Errorf("problem = (%q, %q), want (%q, %q)", p.Category, p.Subtype, category, subtype)
-	}
-	if !errors.Is(got, cause) {
-		t.Errorf("error %v does not preserve cause %v", got, cause)
-	}
-	return p
-}
-
-func TestClassifyRegistrationBeginError(t *testing.T) {
-	tests := []struct {
-		name     string
-		err      error
-		category errs.Category
-		subtype  errs.Subtype
-	}{
-		{"cancelled", context.Canceled, errs.CategoryAuthentication, errs.SubtypeUnknown},
-		{"deadline", context.DeadlineExceeded, errs.CategoryNetwork, errs.SubtypeNetworkTimeout},
-		{"transport", &net.DNSError{Err: "lookup failed", Name: "accounts.example"}, errs.CategoryNetwork, errs.SubtypeNetworkTransport},
-		{"response", errors.New("response not JSON"), errs.CategoryAPI, errs.SubtypeUnknown},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			assertRegistrationProblem(t, classifyRegistrationBeginError(tt.err), tt.err, tt.category, tt.subtype)
-		})
-	}
-}
-
-func TestClassifyRegistrationError(t *testing.T) {
-	tests := []struct {
-		name    string
-		err     error
-		subtype errs.Subtype
-		hint    bool
-	}{
-		{"denied", larkauth.ErrRegistrationDenied, errs.SubtypeUnknown, true},
-		{"expired", larkauth.ErrRegistrationExpired, errs.SubtypeTokenExpired, true},
-		{"timed-out", larkauth.ErrRegistrationTimedOut, errs.SubtypeTokenExpired, true},
-		{"cancelled", context.Canceled, errs.SubtypeUnknown, false},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			p := assertRegistrationProblem(t, classifyRegistrationError(tt.err), tt.err, errs.CategoryAuthentication, tt.subtype)
-			if (p.Hint != "") != tt.hint {
-				t.Errorf("hint = %q, want non-empty=%v", p.Hint, tt.hint)
-			}
-		})
-	}
-}

cmd/config/risk_control.go

@@ -1,80 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package config
-
-import (
-	"fmt"
-
-	"github.com/spf13/cobra"
-
-	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
-)
-
-// NewCmdConfigRiskControl creates the workspace risk-control policy command.
-func NewCmdConfigRiskControl(f *cmdutil.Factory) *cobra.Command {
-	cmd := &cobra.Command{
-		Use:   "risk-control [on|off|default]",
-		Short: "Manage workspace account-protection policy",
-		Long: `View or set the account-protection risk-control policy for this workspace.
-
-Account protection is on by default. Use off to opt this workspace out, on to
-opt it back in explicitly, or default to remove the explicit preference.`,
-		Args: cobra.MaximumNArgs(1),
-		// This is persistent workspace policy, not credential management.
-		PersistentPreRunE: func(cmd *cobra.Command, _ []string) error {
-			cmd.SilenceUsage = true
-			return nil
-		},
-		RunE: func(cmd *cobra.Command, args []string) error {
-			config, err := core.LoadOrNotConfigured()
-			if err != nil {
-				return err
-			}
-			if len(args) == 0 {
-				printRiskControl(f, config)
-				return nil
-			}
-
-			switch args[0] {
-			case "on":
-				enabled := true
-				config.RiskControl = &enabled
-			case "off":
-				enabled := false
-				config.RiskControl = &enabled
-			case "default":
-				config.RiskControl = nil
-			default:
-				return errs.NewValidationError(errs.SubtypeInvalidArgument,
-					"invalid risk-control value %q, valid values: on | off | default", args[0])
-			}
-
-			if err := core.SaveMultiAppConfig(config); err != nil {
-				return errs.NewInternalError(errs.SubtypeStorage,
-					"failed to save risk-control policy: %v", err).WithCause(err)
-			}
-			fmt.Fprintf(f.IOStreams.ErrOut, "Risk control set to %s (workspace)\n", args[0])
-			return nil
-		},
-	}
-	cmdutil.SetRisk(cmd, cmdutil.RiskWrite)
-	return cmd
-}
-
-func printRiskControl(f *cmdutil.Factory, config *core.MultiAppConfig) {
-	source := "default"
-	if config.RiskControl != nil {
-		source = "workspace"
-	}
-	fmt.Fprintf(f.IOStreams.Out, "risk-control: %s (source: %s)\n", riskControlState(config.RiskControlEnabled()), source)
-}
-
-func riskControlState(enabled bool) string {
-	if enabled {
-		return "on"
-	}
-	return "off"
-}

cmd/config/risk_control_test.go

@@ -1,130 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package config
-
-import (
-	"errors"
-	"strings"
-	"testing"
-
-	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
-)
-
-func TestRiskControlWorkspacePolicy(t *testing.T) {
-	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
-	config := &core.MultiAppConfig{Apps: []core.AppConfig{{
-		AppId: "cli_test", AppSecret: core.PlainSecret("secret"), Brand: core.BrandFeishu,
-	}}}
-	if err := core.SaveMultiAppConfig(config); err != nil {
-		t.Fatal(err)
-	}
-
-	f, stdout, stderr, _ := cmdutil.TestFactory(t, nil)
-	cmd := NewCmdConfigRiskControl(f)
-	cmd.SetArgs([]string{"off"})
-	if err := cmd.Execute(); err != nil {
-		t.Fatalf("set off: %v", err)
-	}
-	loaded, err := core.LoadMultiAppConfig()
-	if err != nil {
-		t.Fatal(err)
-	}
-	if loaded.RiskControl == nil || *loaded.RiskControl {
-		t.Fatalf("RiskControl = %v, want explicit false", loaded.RiskControl)
-	}
-	if !strings.Contains(stderr.String(), "set to off") {
-		t.Fatalf("stderr = %q", stderr.String())
-	}
-
-	stdout.Reset()
-	cmd = NewCmdConfigRiskControl(f)
-	if err := cmd.Execute(); err != nil {
-		t.Fatalf("show: %v", err)
-	}
-	if got := stdout.String(); got != "risk-control: off (source: workspace)\n" {
-		t.Fatalf("stdout = %q", got)
-	}
-
-	cmd = NewCmdConfigRiskControl(f)
-	cmd.SetArgs([]string{"on"})
-	if err := cmd.Execute(); err != nil {
-		t.Fatalf("set on: %v", err)
-	}
-	loaded, err = core.LoadMultiAppConfig()
-	if err != nil {
-		t.Fatal(err)
-	}
-	if loaded.RiskControl == nil || !*loaded.RiskControl {
-		t.Fatalf("RiskControl = %v, want explicit true", loaded.RiskControl)
-	}
-
-	cmd = NewCmdConfigRiskControl(f)
-	cmd.SetArgs([]string{"default"})
-	if err := cmd.Execute(); err != nil {
-		t.Fatalf("reset default: %v", err)
-	}
-	loaded, err = core.LoadMultiAppConfig()
-	if err != nil {
-		t.Fatal(err)
-	}
-	if loaded.RiskControl != nil {
-		t.Fatalf("RiskControl = %v, want nil", loaded.RiskControl)
-	}
-
-	stdout.Reset()
-	cmd = NewCmdConfigRiskControl(f)
-	if err := cmd.Execute(); err != nil {
-		t.Fatalf("show default: %v", err)
-	}
-	if got := stdout.String(); got != "risk-control: on (source: default)\n" {
-		t.Fatalf("stdout = %q", got)
-	}
-}
-
-func TestRiskControlWorkspacePolicyRejectsInvalidValue(t *testing.T) {
-	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
-	if err := core.SaveMultiAppConfig(&core.MultiAppConfig{Apps: []core.AppConfig{{
-		AppId: "cli_test", AppSecret: core.PlainSecret("secret"), Brand: core.BrandFeishu,
-	}}}); err != nil {
-		t.Fatal(err)
-	}
-
-	f, _, _, _ := cmdutil.TestFactory(t, nil)
-	cmd := NewCmdConfigRiskControl(f)
-	cmd.SetArgs([]string{"invalid"})
-	err := cmd.Execute()
-	var validationErr *errs.ValidationError
-	if !errors.As(err, &validationErr) {
-		t.Fatalf("error = %T %v, want *errs.ValidationError", err, err)
-	}
-	if validationErr.Subtype != errs.SubtypeInvalidArgument {
-		t.Fatalf("subtype = %q, want %q", validationErr.Subtype, errs.SubtypeInvalidArgument)
-	}
-}
-
-func TestRiskControlWorkspacePolicyAllowedWithExternalCredentials(t *testing.T) {
-	f := newConfigFactoryWithExternalProvider(t)
-	config := &core.MultiAppConfig{Apps: []core.AppConfig{{
-		AppId: "cli_test", AppSecret: core.PlainSecret("secret"), Brand: core.BrandFeishu,
-	}}}
-	if err := core.SaveMultiAppConfig(config); err != nil {
-		t.Fatal(err)
-	}
-
-	cmd := NewCmdConfig(f)
-	cmd.SetArgs([]string{"risk-control", "off"})
-	if err := cmd.Execute(); err != nil {
-		t.Fatalf("set off with external credentials: %v", err)
-	}
-
-	loaded, err := core.LoadMultiAppConfig()
-	if err != nil {
-		t.Fatal(err)
-	}
-	if loaded.RiskControl == nil || *loaded.RiskControl {
-		t.Fatalf("RiskControl = %v, want explicit false", loaded.RiskControl)
-	}
-}

cmd/doctor/doctor.go

@@ -157,8 +157,8 @@ func networkChecks(ctx context.Context, opts *DoctorOptions, ep core.Endpoints)
 		}
 	}
 
-	// Connectivity checks are platform traffic and must exercise the same
-	// provider-aware route as real platform requests.
+	// Use the shared proxy-plugin-aware transport so connectivity checks reflect
+	// the real egress path (and are blocked when proxy plugin fails closed).
 	httpClient := transport.NewHTTPClient(0)
 	mcpURL := ep.MCP + "/mcp"
 

cmd/event/list_test.go

@@ -17,8 +17,6 @@ import (
 
 func TestEventLookup_VCMeetingLifecycleKeys(t *testing.T) {
 	for _, key := range []string{
-		"approval.instance.status_changed_v4",
-		"approval.task.status_changed_v4",
 		"vc.meeting.participant_meeting_started_v1",
 		"vc.meeting.participant_meeting_joined_v1",
 	} {
@@ -38,8 +36,6 @@ func TestRunList_TextOutput(t *testing.T) {
 	out := stdout.String()
 	for _, want := range []string{
 		"KEY", "AUTH", "PARAMS", "DESCRIPTION",
-		"approval.instance.status_changed_v4",
-		"approval.task.status_changed_v4",
 		"im.message.receive_v1",
 		"im.message.message_read_v1",
 		"task.task.update_user_access_v2",
@@ -94,8 +90,6 @@ func TestRunList_JSONOutput(t *testing.T) {
 		t.Fatal("event list JSON missing task.task.update_user_access_v2")
 	}
 	for _, want := range []string{
-		"approval.instance.status_changed_v4",
-		"approval.task.status_changed_v4",
 		"vc.meeting.participant_meeting_started_v1",
 		"vc.meeting.participant_meeting_joined_v1",
 	} {

cmd/event/schema_test.go

@@ -19,29 +19,6 @@ import (
 	_ "github.com/larksuite/cli/events"
 )
 
-type approvalSchemaJSONPayload struct {
-	JQRootPath           string                           `json:"jq_root_path"`
-	AuthTypes            []string                         `json:"auth_types"`
-	Scopes               []string                         `json:"scopes"`
-	Params               []approvalSchemaJSONParam        `json:"params"`
-	ResolvedOutputSchema approvalSchemaJSONResolvedSchema `json:"resolved_output_schema"`
-}
-
-type approvalSchemaJSONParam struct {
-	Name            string `json:"name"`
-	Type            string `json:"type"`
-	Required        bool   `json:"required"`
-	SubscriptionKey bool   `json:"subscription_key"`
-}
-
-type approvalSchemaJSONResolvedSchema struct {
-	Properties map[string]approvalSchemaJSONProperty `json:"properties"`
-}
-
-type approvalSchemaJSONProperty struct {
-	Format string `json:"format"`
-}
-
 func TestRunSchema_ProcessedKey_Text(t *testing.T) {
 	f, stdout, _, _ := cmdutil.TestFactory(t, &core.CliConfig{AppID: "test"})
 
@@ -119,40 +96,6 @@ func TestRunSchema_JSONOutput(t *testing.T) {
 	}
 }
 
-func TestRunSchema_ReceiveMessageAgentFieldsJSON(t *testing.T) {
-	f, stdout, _, _ := cmdutil.TestFactory(t, &core.CliConfig{AppID: "test"})
-
-	if err := runSchema(f, "im.message.receive_v1", true); err != nil {
-		t.Fatalf("runSchema json: %v", err)
-	}
-
-	var payload map[string]interface{}
-	if err := json.Unmarshal(stdout.Bytes(), &payload); err != nil {
-		t.Fatalf("output is not valid JSON: %v\n%s", err, stdout.String())
-	}
-	resolved := payload["resolved_output_schema"].(map[string]interface{})
-	props := resolved["properties"].(map[string]interface{})
-	for _, field := range []string{
-		"root_id",
-		"thread_id",
-		"reply_to",
-		"sender_type",
-		"mentions",
-	} {
-		if _, ok := props[field]; !ok {
-			t.Errorf("receive schema missing field %q", field)
-		}
-	}
-	msgDesc := props["message_id"].(map[string]interface{})["description"].(string)
-	if !strings.Contains(msgDesc, "Recommended idempotency key") {
-		t.Errorf("message_id description should guide deduplication, got %q", msgDesc)
-	}
-	eventDesc := props["event_id"].(map[string]interface{})["description"].(string)
-	if strings.Contains(eventDesc, "safe for deduplication") {
-		t.Errorf("event_id description should not recommend deduplication, got %q", eventDesc)
-	}
-}
-
 func TestRunSchema_TaskUpdateUserAccessJSON(t *testing.T) {
 	f, stdout, _, _ := cmdutil.TestFactory(t, &core.CliConfig{AppID: "test"})
 
@@ -181,60 +124,6 @@ func TestRunSchema_TaskUpdateUserAccessJSON(t *testing.T) {
 	}
 }
 
-func TestRunSchema_ApprovalStatusChangedJSON(t *testing.T) {
-	tests := []struct {
-		key   string
-		scope string
-	}{
-		{"approval.instance.status_changed_v4", "approval:instance:read"},
-		{"approval.task.status_changed_v4", "approval:task:read"},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.key, func(t *testing.T) {
-			t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
-			f, stdout, _, _ := cmdutil.TestFactory(t, &core.CliConfig{AppID: "test"})
-
-			if err := runSchema(f, tc.key, true); err != nil {
-				t.Fatalf("runSchema json: %v", err)
-			}
-
-			var payload approvalSchemaJSONPayload
-			if err := json.Unmarshal(stdout.Bytes(), &payload); err != nil {
-				t.Fatalf("output is not valid JSON: %v\n%s", err, stdout.String())
-			}
-			if payload.JQRootPath != "." {
-				t.Errorf("jq_root_path = %v, want .", payload.JQRootPath)
-			}
-			if got := payload.AuthTypes; !reflect.DeepEqual(got, []string{"user"}) {
-				t.Errorf("auth_types = %#v, want user", got)
-			}
-			if got := payload.Scopes; !reflect.DeepEqual(got, []string{tc.scope}) {
-				t.Errorf("scopes = %#v, want %s", got, tc.scope)
-			}
-			if len(payload.Params) != 1 {
-				t.Fatalf("params = %#v, want one subscription_type param", payload.Params)
-			}
-			param := payload.Params[0]
-			if param.Name != "subscription_type" || param.Type != "multi" || param.Required || param.SubscriptionKey {
-				t.Fatalf("subscription_type param = %#v, want optional multi non-subscription-key param", param)
-			}
-			props := payload.ResolvedOutputSchema.Properties
-			for _, field := range []string{"type", "event_id", "timestamp", "approval_code", "instance_code", "status", "operate_time"} {
-				if _, ok := props[field]; !ok {
-					t.Errorf("approval schema missing flat field %q: %+v", field, props)
-				}
-			}
-			if _, ok := props["event"]; ok {
-				t.Errorf("approval Custom schema should be flat, got envelope field event: %+v", props)
-			}
-			if got := props["operate_time"].Format; got != "timestamp_ms" {
-				t.Errorf("operate_time format = %v, want timestamp_ms", got)
-			}
-		})
-	}
-}
-
 func TestRunSchema_JSONOutput_VCMeetingLifecycleKeys(t *testing.T) {
 	for _, key := range []string{
 		"vc.meeting.participant_meeting_started_v1",

cmd/root.go

@@ -107,7 +107,6 @@ func Execute() int {
 		ctx, inv,
 		WithIO(os.Stdin, os.Stdout, os.Stderr),
 		HideProfile(isSingleAppMode()),
-		WithStartupBrand(ResolveStartupBrand(inv.Profile)),
 	)
 
 	// --- Notices (non-blocking) ---
@@ -680,11 +679,7 @@ func installTipsHelpFunc(root *cobra.Command) {
 			defaultHelp(cmd, args)
 			return
 		}
-		if service.PrepareMethodHelp(cmd, embeddedSkillContent) {
-			defaultHelp(cmd, args)
-			return
-		}
-		if service.PrepareShortcutHelp(cmd, embeddedSkillContent) {
+		if service.PrepareMethodHelp(cmd) {
 			defaultHelp(cmd, args)
 			return
 		}

cmd/root_integration_test.go

@@ -14,13 +14,11 @@ import (
 	"github.com/larksuite/cli/cmd/api"
 	"github.com/larksuite/cli/cmd/auth"
 	"github.com/larksuite/cli/cmd/service"
-	"github.com/larksuite/cli/internal/apicatalog"
 	"github.com/larksuite/cli/internal/build"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/envvars"
 	"github.com/larksuite/cli/internal/httpmock"
-	"github.com/larksuite/cli/internal/meta"
 	"github.com/larksuite/cli/internal/output"
 	"github.com/larksuite/cli/internal/skillscheck"
 	"github.com/larksuite/cli/internal/update"
@@ -105,11 +103,6 @@ func parseTypedEnvelope(t *testing.T, stderr *bytes.Buffer) typedErrorEnvelope {
 }
 
 func buildStrictModeIntegrationRootCmd(t *testing.T, f *cmdutil.Factory) *cobra.Command {
-	t.Helper()
-	return buildStrictModeIntegrationRootCmdWithCatalog(t, f, nil)
-}
-
-func buildStrictModeIntegrationRootCmdWithCatalog(t *testing.T, f *cmdutil.Factory, catalog *apicatalog.Catalog) *cobra.Command {
 	t.Helper()
 	rootCmd := &cobra.Command{Use: "lark-cli"}
 	rootCmd.SilenceErrors = true
@@ -120,11 +113,7 @@ func buildStrictModeIntegrationRootCmdWithCatalog(t *testing.T, f *cmdutil.Facto
 	}
 	rootCmd.AddCommand(auth.NewCmdAuth(f))
 	rootCmd.AddCommand(api.NewCmdApi(f, nil))
-	if catalog != nil {
-		service.RegisterServiceCommandsFromCatalog(context.Background(), rootCmd, f, *catalog)
-	} else {
-		service.RegisterServiceCommands(rootCmd, f)
-	}
+	service.RegisterServiceCommands(rootCmd, f)
 	shortcuts.RegisterShortcuts(rootCmd, f)
 	if mode := f.ResolveStrictMode(context.Background()); mode.IsActive() {
 		pruneForStrictMode(rootCmd, mode)
@@ -132,29 +121,6 @@ func buildStrictModeIntegrationRootCmdWithCatalog(t *testing.T, f *cmdutil.Facto
 	return rootCmd
 }
 
-func strictModeFixtureCatalog() apicatalog.Catalog {
-	return apicatalog.New(apicatalog.SourceEmbedded, []meta.Service{
-		{
-			Name:        "fixture",
-			ServicePath: "/open-apis/fixture/v1",
-			Resources: map[string]meta.Resource{
-				"things": {
-					Methods: map[string]meta.Method{
-						"create": {
-							Path:         "things",
-							HTTPMethod:   "POST",
-							AccessTokens: []meta.Token{meta.TokenTenant},
-							RequestBody: map[string]meta.Field{
-								"name": {Type: "string"},
-							},
-						},
-					},
-				},
-			},
-		},
-	})
-}
-
 func newStrictModeDefaultFactory(t *testing.T, profile string, mode core.StrictMode) (*cmdutil.Factory, *bytes.Buffer, *bytes.Buffer) {
 	t.Helper()
 	t.Setenv(envvars.CliAppID, "")
@@ -371,11 +337,10 @@ func TestIntegration_StrictModeUser_ProfileOverride_ShortcutExplicitBotReturnsEn
 
 func TestIntegration_StrictModeBot_ProfileOverride_ServiceExplicitUserReturnsEnvelope(t *testing.T) {
 	f, stdout, stderr := newStrictModeDefaultFactory(t, "target", core.StrictModeBot)
-	catalog := strictModeFixtureCatalog()
-	rootCmd := buildStrictModeIntegrationRootCmdWithCatalog(t, f, &catalog)
+	rootCmd := buildStrictModeIntegrationRootCmd(t, f)
 
 	code := executeRootIntegration(t, f, rootCmd, []string{
-		"fixture", "things", "create", "--data", `{"name":"probe"}`, "--as", "user", "--dry-run",
+		"im", "chats", "get", "--params", `{"chat_id":"oc_test"}`, "--as", "user", "--dry-run",
 	})
 
 	if code != output.ExitValidation {
@@ -390,11 +355,10 @@ func TestIntegration_StrictModeBot_ProfileOverride_ServiceExplicitUserReturnsEnv
 
 func TestIntegration_StrictModeUser_ProfileOverride_ServiceBotOnlyMethodReturnsEnvelope(t *testing.T) {
 	f, stdout, stderr := newStrictModeDefaultFactory(t, "target", core.StrictModeUser)
-	catalog := strictModeFixtureCatalog()
-	rootCmd := buildStrictModeIntegrationRootCmdWithCatalog(t, f, &catalog)
+	rootCmd := buildStrictModeIntegrationRootCmd(t, f)
 
 	code := executeRootIntegration(t, f, rootCmd, []string{
-		"fixture", "things", "create", "--data", `{"name":"probe"}`, "--dry-run",
+		"im", "images", "create", "--data", `{"image_type":"message","image":"x"}`, "--dry-run",
 	})
 
 	if code != output.ExitValidation {

cmd/root_upgrade.go

@@ -65,17 +65,7 @@ func offerRootUpgrade(f *cmdutil.Factory, cmd *cobra.Command) {
 	if info == nil {
 		return
 	}
-	// Deliberately no target version here: info.Latest comes from the on-disk
-	// cache, which has no expiry (the 24h TTL only throttles refreshes, and a
-	// failed refresh leaves the old value in place), so it can name a version
-	// that is no longer the one npm would install. The version actually
-	// installed is resolved live by the update subcommand, which prints
-	// "Updating lark-cli <cur> -> <latest> via <pm> ..." before installing —
-	// that is where the user sees the real target. Keep going through the
-	// update subcommand rather than calling RunNpmInstall directly, otherwise
-	// that line disappears and the user approves a global install without ever
-	// being told what gets installed.
-	fmt.Fprintf(ios.ErrOut, "A newer lark-cli is available (current %s). Upgrade now? [y/N]: ", info.Current)
+	fmt.Fprintf(ios.ErrOut, "lark-cli %s available (current %s). Upgrade now? [y/N]: ", info.Latest, info.Current)
 	if !readYes(ios.In) {
 		return
 	}

cmd/root_upgrade_test.go

@@ -128,17 +128,6 @@ func TestOfferRootUpgrade(t *testing.T) {
 			if gotPrompt != tc.wantPrompt {
 				t.Errorf("prompt: got %v want %v (stderr=%q)", gotPrompt, tc.wantPrompt, errBuf.String())
 			}
-			// The prompt must not name a target version: info.Latest comes from
-			// the on-disk cache and can be stale, while the version actually
-			// installed is resolved live by the update subcommand.
-			if tc.wantPrompt {
-				if strings.Contains(errBuf.String(), tc.latest) {
-					t.Errorf("prompt must not name the cached target version %q (stderr=%q)", tc.latest, errBuf.String())
-				}
-				if !strings.Contains(errBuf.String(), build.Version) {
-					t.Errorf("prompt must name the current version %q (stderr=%q)", build.Version, errBuf.String())
-				}
-			}
 			if called != tc.wantRun {
 				t.Errorf("runRootUpgrade called: got %v want %v", called, tc.wantRun)
 			}

cmd/schema/schema.go

@@ -65,13 +65,13 @@ func NewCmdSchema(f *cmdutil.Factory, runF func(*SchemaOptions) error) *cobra.Co
 	return cmd
 }
 
-// completeSchemaPath is a thin adapter over the schema catalog's Complete.
-// It uses the same source as schema execution so completion candidates match
-// what `schema` can resolve.
+// completeSchemaPath is a thin adapter over the embedded catalog's Complete.
+// It uses the embedded source so completion candidates match what `schema`
+// execution can resolve (both overlay-free).
 func completeSchemaPath(f *cmdutil.Factory) func(*cobra.Command, []string, string) ([]string, cobra.ShellCompDirective) {
 	return func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
 		mode := f.ResolveStrictMode(cmd.Context())
-		completions, noSpace := registry.SchemaCatalog().Complete(args, toComplete, registry.FilterForStrictMode(mode))
+		completions, noSpace := registry.EmbeddedCatalog().Complete(args, toComplete, registry.FilterForStrictMode(mode))
 		directive := cobra.ShellCompDirectiveNoFileComp
 		if noSpace {
 			directive |= cobra.ShellCompDirectiveNoSpace
@@ -86,19 +86,13 @@ func schemaRun(opts *SchemaOptions) error {
 	return runSchema(out, apicatalog.ParsePath(opts.Args), mode)
 }
 
-// runSchema resolves the path through the schema catalog and renders the
+// runSchema resolves the path through the embedded catalog and renders the
 // matching envelope(s). The catalog owns navigation (Resolve + MethodRefs) and
 // schema owns rendering (Envelope/Envelopes); this adapter only chooses the
 // output shape — a single resolved method renders as one envelope object,
 // anything broader as an array — and maps resolve failures to hints.
 func runSchema(out io.Writer, parts []string, mode core.StrictMode) error {
-	catalog := registry.SchemaCatalog()
-	if len(catalog.Services()) == 0 {
-		// No embedded metadata and the runtime fallback is empty too: offline
-		// with a cold cache, remote meta off, or an unwritable cache dir.
-		return errs.NewValidationError(errs.SubtypeFailedPrecondition, "No API metadata available").
-			WithHint("this binary has no embedded API metadata; run any command with network access to the open platform once so metadata can be fetched and cached")
-	}
+	catalog := registry.EmbeddedCatalog()
 	target, err := catalog.Resolve(parts)
 	if err != nil {
 		return resolveError(err)

cmd/service/affordance.go

@@ -71,18 +71,11 @@ func PrepareDomainHelp(cmd *cobra.Command, skillFS fs.FS) bool {
 }
 
 // domainHelpBase returns the description to seed domain help with — the
-// hand-authored Long when present, else the Short.
+// hand-authored Long when present, else the Short — captured once into an
+// annotation so re-rendering reuses the pristine text instead of the
+// already-augmented Long.
 func domainHelpBase(cmd *cobra.Command) string {
-	return captureHelpBase(cmd, domainBaseAnnotation)
-}
-
-// captureHelpBase records a command's pristine lead text once — its
-// hand-authored Long, or Short when Long is empty — into the given annotation,
-// so lazy re-renders compose onto the original text instead of onto an
-// already-augmented Long. This is what lets a shortcut's PostMount-authored
-// Long survive: it becomes the base the affordance block is appended below.
-func captureHelpBase(cmd *cobra.Command, key string) string {
-	if base, ok := cmd.Annotations[key]; ok {
+	if base, ok := cmd.Annotations[domainBaseAnnotation]; ok {
 		return base
 	}
 	base := cmd.Long
@@ -92,7 +85,7 @@ func captureHelpBase(cmd *cobra.Command, key string) string {
 	if cmd.Annotations == nil {
 		cmd.Annotations = map[string]string{}
 	}
-	cmd.Annotations[key] = base
+	cmd.Annotations[domainBaseAnnotation] = base
 	return base
 }
 
@@ -108,12 +101,12 @@ func methodLong(description, schemaPath, paramsOnly string) string {
 }
 
 // Annotation keys PrepareMethodHelp reads to rebuild a method command's Long.
-// The affordance overlay coordinates live in cmdmeta (shared with shortcuts).
 const (
-	schemaPathAnnotation   = "method-schema-path"
-	paramsOnlyAnnotation   = "method-params-only"
-	domainBaseAnnotation   = "affordance-domain-base"
-	shortcutBaseAnnotation = "affordance-shortcut-base"
+	affordanceServiceAnnotation = "affordance-service"
+	affordanceMethodAnnotation  = "affordance-method"
+	schemaPathAnnotation        = "method-schema-path"
+	paramsOnlyAnnotation        = "method-params-only"
+	domainBaseAnnotation        = "affordance-domain-base"
 )
 
 // setMethodHelpData records the coordinates PrepareMethodHelp needs (storing a
@@ -122,7 +115,10 @@ func setMethodHelpData(cmd *cobra.Command, service, methodID, schemaPath, params
 	if cmd.Annotations == nil {
 		cmd.Annotations = map[string]string{}
 	}
-	cmdmeta.SetAffordanceRef(cmd, service, methodID)
+	if service != "" && methodID != "" {
+		cmd.Annotations[affordanceServiceAnnotation] = service
+		cmd.Annotations[affordanceMethodAnnotation] = methodID
+	}
 	cmd.Annotations[schemaPathAnnotation] = schemaPath
 	if paramsOnly != "" {
 		cmd.Annotations[paramsOnlyAnnotation] = paramsOnly
@@ -132,11 +128,8 @@ func setMethodHelpData(cmd *cobra.Command, service, methodID, schemaPath, params
 // PrepareMethodHelp rebuilds a generated method command's Long with the agent
 // guidance at the TOP (Risk, then the affordance block, then the schema
 // pointer), returning false for non-method commands. The overlay is parsed
-// here — only when help is rendered. skillFS (nil-safe) gates the related-skill
-// pointers: each is emitted only when it resolves in the skill tree (see
-// affordance.SkillStatPath), so a typo or a build without embedded skills never
-// prints a `skills read` that cannot be opened.
-func PrepareMethodHelp(cmd *cobra.Command, skillFS fs.FS) bool {
+// here — only when help is rendered.
+func PrepareMethodHelp(cmd *cobra.Command) bool {
 	ann := cmd.Annotations
 	if ann == nil {
 		return false
@@ -148,15 +141,22 @@ func PrepareMethodHelp(cmd *cobra.Command, skillFS fs.FS) bool {
 
 	var b strings.Builder
 	b.WriteString(cmd.Short)
-	writeRisk(&b, cmd)
+	if level, ok := cmdutil.GetRisk(cmd); ok {
+		// --yes asserts the USER confirmed; the agent must not self-approve.
+		if level == cmdutil.RiskHighRiskWrite {
+			fmt.Fprintf(&b, "\n\nRisk: %s (requires explicit user confirmation to execute; the agent must NOT add --yes on its own — only pass --yes after the user has confirmed)", level)
+		} else {
+			fmt.Fprintf(&b, "\n\nRisk: %s", level)
+		}
+	}
 
 	var skills []string
 	if raw, ok := affordanceRaw(cmd); ok {
+		if block := renderAffordance(meta.Method{Affordance: raw}); block != "" {
+			b.WriteString("\n\n")
+			b.WriteString(block)
+		}
 		if a, ok := (meta.Method{Affordance: raw}).ParsedAffordance(); ok {
-			if block := renderAffordanceValue(a); block != "" {
-				b.WriteString("\n\n")
-				b.WriteString(block)
-			}
 			skills = a.Skills
 		}
 	}
@@ -164,93 +164,15 @@ func PrepareMethodHelp(cmd *cobra.Command, skillFS fs.FS) bool {
 	fmt.Fprintf(&b, "\n\nFull parameter schema:\n  lark-cli schema %s", schemaPath)
 	b.WriteString(ann[paramsOnlyAnnotation])
 
-	writeRelatedSkills(&b, skills, skillFS)
-
-	cmd.Long = b.String()
-	return true
-}
-
-// PrepareShortcutHelp composes a +-prefixed shortcut's Long from its affordance
-// overlay — the same top layout as method help (description, Risk, guidance
-// block, related skills) minus the schema pointer, which shortcuts have none
-// of. Returns false when the command is not a shortcut or carries no overlay
-// entry, so shortcuts without guidance keep the default help plus the bottom
-// risk/tips append.
-//
-// The lead is the command's pristine base (captureHelpBase): a shortcut that
-// set a hand-authored Long in PostMount (e.g. the docs shortcuts' "agents MUST
-// read the skill" directive) keeps it — the affordance block is appended below,
-// never clobbering it.
-//
-// Tips precedence (intentional, not a bug): the overlay's ### Tips win. The
-// shortcut's declarative Tips (the Go Tips field) are only a fallback used when
-// the overlay declares none; when the overlay has tips, the Go tips are dropped
-// (replaced, not merged) so tips never render twice. Authoring a ### Tips block
-// therefore silently retires that shortcut's Go Tips — consolidate into one.
-func PrepareShortcutHelp(cmd *cobra.Command, skillFS fs.FS) bool {
-	if src, _ := cmdmeta.SourceOf(cmd); src != cmdmeta.SourceShortcut {
-		return false
-	}
-	raw, ok := affordanceRaw(cmd)
-	if !ok {
-		return false
-	}
-	a, ok := (meta.Method{Affordance: raw}).ParsedAffordance()
-	if !ok {
-		return false
-	}
-	if len(a.Tips) == 0 {
-		a.Tips = cmdutil.GetTips(cmd)
-	}
-
-	var b strings.Builder
-	b.WriteString(captureHelpBase(cmd, shortcutBaseAnnotation))
-	writeRisk(&b, cmd)
-	if block := renderAffordanceValue(a); block != "" {
-		b.WriteString("\n\n")
-		b.WriteString(block)
-	}
-	writeRelatedSkills(&b, a.Skills, skillFS)
-
-	cmd.Long = b.String()
-	return true
-}
-
-// writeRisk appends the "Risk: <level>" line, warning agents not to self-approve
-// high-risk-write commands. A no-op when the command has no risk annotation.
-func writeRisk(b *strings.Builder, cmd *cobra.Command) {
-	level, ok := cmdutil.GetRisk(cmd)
-	if !ok {
-		return
-	}
-	// --yes asserts the USER confirmed; the agent must not self-approve.
-	if level == cmdutil.RiskHighRiskWrite {
-		fmt.Fprintf(b, "\n\nRisk: %s (requires explicit user confirmation to execute; the agent must NOT add --yes on its own — only pass --yes after the user has confirmed)", level)
-	} else {
-		fmt.Fprintf(b, "\n\nRisk: %s", level)
-	}
-}
-
-// writeRelatedSkills appends the "Related skills" block for the entries that
-// exist in skillFS. Nothing is written when skillFS is nil or no entry resolves,
-// so help never prints a `skills read` pointer that cannot be opened.
-func writeRelatedSkills(b *strings.Builder, skills []string, skillFS fs.FS) {
-	if skillFS == nil || len(skills) == 0 {
-		return
-	}
-	var avail []string
-	for _, s := range skills {
-		if _, err := fs.Stat(skillFS, affordance.SkillStatPath(s)); err == nil {
-			avail = append(avail, s)
+	if len(skills) > 0 {
+		b.WriteString("\n\nWorkflow skill (end-to-end usage):")
+		for _, s := range skills {
+			fmt.Fprintf(&b, "\n  lark-cli skills read %s", s)
 		}
 	}
-	if len(avail) == 0 {
-		return
-	}
-	b.WriteString("\n\nRelated skills (read for end-to-end usage):")
-	for _, s := range avail {
-		fmt.Fprintf(b, "\n  lark-cli skills read %s", s)
-	}
+
+	cmd.Long = b.String()
+	return true
 }
 
 // affordanceLookup is the overlay source; a package var so tests can inject.
@@ -267,8 +189,12 @@ func RenderAffordanceForCmd(cmd *cobra.Command) string {
 }
 
 func affordanceRaw(cmd *cobra.Command) (json.RawMessage, bool) {
-	service, methodID, ok := cmdmeta.AffordanceRef(cmd)
-	if !ok {
+	if cmd.Annotations == nil {
+		return nil, false
+	}
+	service := cmd.Annotations[affordanceServiceAnnotation]
+	methodID := cmd.Annotations[affordanceMethodAnnotation]
+	if service == "" || methodID == "" {
 		return nil, false
 	}
 	return affordanceLookup(service, methodID)
@@ -281,13 +207,7 @@ func renderAffordance(m meta.Method) string {
 	if !ok {
 		return ""
 	}
-	return renderAffordanceValue(a)
-}
 
-// renderAffordanceValue renders an already-parsed affordance. Split from
-// renderAffordance so callers can render a value they have adjusted first (e.g.
-// a shortcut folding its declarative tips into an overlay that has none).
-func renderAffordanceValue(a meta.Affordance) string {
 	var sections []string
 	bullets := func(title string, items []string) {
 		var nonEmpty []string

cmd/service/affordance_test.go

@@ -7,7 +7,6 @@ import (
 	"encoding/json"
 	"strings"
 	"testing"
-	"testing/fstest"
 
 	"github.com/larksuite/cli/internal/cmdmeta"
 	"github.com/larksuite/cli/internal/cmdutil"
@@ -71,8 +70,8 @@ func TestServiceMethod_AffordanceNotInLong(t *testing.T) {
 		t.Errorf("affordance must not be baked into Long (lazy):\n%s", cmd.Long)
 	}
 	// The lookup ref is recorded so the help path can resolve it later.
-	if svc, method, ok := cmdmeta.AffordanceRef(cmd); !ok || svc != "im" || method != "messages.create" {
-		t.Errorf("affordance ref = %q/%q (ok=%v), want im/messages.create", svc, method, ok)
+	if cmd.Annotations[affordanceServiceAnnotation] != "im" || cmd.Annotations[affordanceMethodAnnotation] != "messages.create" {
+		t.Errorf("affordance ref annotations = %v, want im/messages.create", cmd.Annotations)
 	}
 }
 
@@ -120,7 +119,7 @@ func TestPrepareMethodHelp(t *testing.T) {
 	m := map[string]interface{}{"id": "messages.create", "path": "messages", "httpMethod": "POST", "description": "发送消息"}
 	cmd := NewCmdServiceMethod(f, imSpec(), meta.FromMap(m), "create", "messages", nil)
 
-	if !PrepareMethodHelp(cmd, nil) {
+	if !PrepareMethodHelp(cmd) {
 		t.Fatal("PrepareMethodHelp returned false for a service-method command")
 	}
 	long := cmd.Long
@@ -137,133 +136,11 @@ func TestPrepareMethodHelp(t *testing.T) {
 	}
 
 	// A non-service command (no schema-path annotation) is left untouched.
-	if PrepareMethodHelp(&cobra.Command{Use: "plain"}, nil) {
+	if PrepareMethodHelp(&cobra.Command{Use: "plain"}) {
 		t.Error("PrepareMethodHelp should return false for a non-service command")
 	}
 }
 
-// PrepareShortcutHelp composes a shortcut's Long from its overlay with the same
-// top layout as method help (no schema pointer), folding declarative tips when
-// the overlay declares none, and leaves shortcuts without an overlay entry (and
-// non-shortcut commands) for the default help path.
-func TestPrepareShortcutHelp(t *testing.T) {
-	orig := affordanceLookup
-	t.Cleanup(func() { affordanceLookup = orig })
-	affordanceLookup = func(service, methodID string) (json.RawMessage, bool) {
-		if service == "calendar" && methodID == "+create" {
-			return json.RawMessage(`{"use_when":["高层创建日程"],"skills":["lark-calendar"]}`), true
-		}
-		return nil, false
-	}
-
-	sc := &cobra.Command{Use: "+create", Short: "Create an event"}
-	cmdmeta.SetSource(sc, cmdmeta.SourceShortcut, false)
-	cmdmeta.SetAffordanceRef(sc, "calendar", "+create")
-	cmdutil.SetRisk(sc, "write")
-	cmdutil.SetTips(sc, []string{"start/end 收 ISO 8601"})
-
-	if !PrepareShortcutHelp(sc, nil) {
-		t.Fatal("PrepareShortcutHelp returned false for a shortcut with an overlay")
-	}
-	for _, want := range []string{"Create an event", "Risk: write", "When to use:", "高层创建日程", "Tips:", "start/end 收 ISO 8601"} {
-		if !strings.Contains(sc.Long, want) {
-			t.Errorf("shortcut Long missing %q:\n%s", want, sc.Long)
-		}
-	}
-	if strings.Contains(sc.Long, "Full parameter schema:") {
-		t.Errorf("shortcut Long must not carry a schema pointer:\n%s", sc.Long)
-	}
-
-	// No overlay entry -> leave it for the default help path.
-	bare := &cobra.Command{Use: "+bare", Short: "x"}
-	cmdmeta.SetSource(bare, cmdmeta.SourceShortcut, false)
-	cmdmeta.SetAffordanceRef(bare, "calendar", "+bare")
-	if PrepareShortcutHelp(bare, nil) {
-		t.Error("PrepareShortcutHelp should return false when the shortcut has no overlay")
-	}
-
-	// Non-shortcut source is ignored even with a ref.
-	notSc := &cobra.Command{Use: "create", Short: "x"}
-	cmdmeta.SetAffordanceRef(notSc, "calendar", "+create")
-	if PrepareShortcutHelp(notSc, nil) {
-		t.Error("PrepareShortcutHelp should return false for a non-shortcut command")
-	}
-}
-
-// Related-skill pointers are gated on existence: a skill that resolves in the
-// skill FS renders, a typo is dropped (never print an unopenable `skills read`),
-// and a nil skill FS suppresses the whole block.
-func TestRelatedSkillsStatGating(t *testing.T) {
-	orig := affordanceLookup
-	t.Cleanup(func() { affordanceLookup = orig })
-	affordanceLookup = func(_, _ string) (json.RawMessage, bool) {
-		return json.RawMessage(`{"use_when":["x"],"skills":["lark-real","lark-typo","lark-real/references/deep.md","lark-real/references/missing.md"]}`), true
-	}
-	skillFS := fstest.MapFS{
-		"lark-real/SKILL.md":           {Data: []byte("# real")},
-		"lark-real/references/deep.md": {Data: []byte("# deep")},
-	}
-
-	f, _, _, _ := cmdutil.TestFactory(t, testConfig)
-	m := map[string]interface{}{"id": "messages.create", "path": "messages", "httpMethod": "POST", "description": "d"}
-
-	cmd := NewCmdServiceMethod(f, imSpec(), meta.FromMap(m), "create", "messages", nil)
-	if !PrepareMethodHelp(cmd, skillFS) {
-		t.Fatal("PrepareMethodHelp returned false")
-	}
-	if !strings.Contains(cmd.Long, "skills read lark-real\n") {
-		t.Errorf("existing bare-name skill should render on its own line; got:\n%s", cmd.Long)
-	}
-	if strings.Contains(cmd.Long, "lark-typo") {
-		t.Errorf("nonexistent skill must be dropped, not printed as an unopenable pointer; got:\n%s", cmd.Long)
-	}
-	// A name/relpath reference to an existing file renders; a missing one drops.
-	if !strings.Contains(cmd.Long, "skills read lark-real/references/deep.md") {
-		t.Errorf("existing reference entry should render; got:\n%s", cmd.Long)
-	}
-	if strings.Contains(cmd.Long, "references/missing.md") {
-		t.Errorf("nonexistent reference must be dropped; got:\n%s", cmd.Long)
-	}
-
-	// nil skill FS: the whole Related-skills block is suppressed.
-	bare := NewCmdServiceMethod(f, imSpec(), meta.FromMap(m), "create", "messages", nil)
-	PrepareMethodHelp(bare, nil)
-	if strings.Contains(bare.Long, "Related skills") {
-		t.Errorf("nil skillFS should suppress the skills block; got:\n%s", bare.Long)
-	}
-}
-
-// A shortcut that set a hand-authored Long (as the docs shortcuts do in
-// PostMount) keeps it as the lead: the affordance block is appended below, not
-// clobbered, and re-rendering does not double-append.
-func TestPrepareShortcutHelp_PreservesPostMountLong(t *testing.T) {
-	orig := affordanceLookup
-	t.Cleanup(func() { affordanceLookup = orig })
-	affordanceLookup = func(_, _ string) (json.RawMessage, bool) {
-		return json.RawMessage(`{"use_when":["高层创建日程"]}`), true
-	}
-
-	const authored = "Custom docs help. AI agents MUST read the skill first."
-	sc := &cobra.Command{Use: "+create", Short: "Create", Long: authored}
-	cmdmeta.SetSource(sc, cmdmeta.SourceShortcut, false)
-	cmdmeta.SetAffordanceRef(sc, "calendar", "+create")
-
-	if !PrepareShortcutHelp(sc, nil) {
-		t.Fatal("PrepareShortcutHelp returned false for a shortcut with an overlay")
-	}
-	if !strings.HasPrefix(sc.Long, authored) {
-		t.Errorf("hand-authored Long must lead, not be clobbered; got:\n%s", sc.Long)
-	}
-	if !strings.Contains(sc.Long, "When to use:") {
-		t.Errorf("affordance block should be appended below the base; got:\n%s", sc.Long)
-	}
-	// Re-render must reuse the captured base, not append the block twice.
-	PrepareShortcutHelp(sc, nil)
-	if n := strings.Count(sc.Long, "When to use:"); n != 1 {
-		t.Errorf("affordance appended %d times across re-renders, want 1:\n%s", n, sc.Long)
-	}
-}
-
 // domainCmd wires a domain-tagged command with a subcommand under a root, the
 // shape PrepareDomainHelp expects.
 func domainCmd(short, long string) *cobra.Command {

cmd/service/service.go

@@ -403,9 +403,9 @@ func serviceMethodRun(opts *ServiceMethodOptions) error {
 
 	if opts.DryRun {
 		if fileMeta != nil {
-			return cmdutil.PrintDryRunWithFile(request, config, serviceDryRunOutputOptions(f, opts), *fileMeta)
+			return cmdutil.PrintDryRunWithFile(f.IOStreams.Out, request, config, opts.Format, fileMeta.FieldName, fileMeta.FilePath, fileMeta.FormFields)
 		}
-		return serviceDryRun(f, request, config, opts)
+		return serviceDryRun(f, request, config, opts.Format)
 	}
 
 	if opts.Method.Risk == cmdutil.RiskHighRiskWrite {
@@ -667,19 +667,8 @@ func buildServiceRequest(opts *ServiceMethodOptions) (client.RawApiRequest, *cmd
 	return request, nil, nil
 }
 
-func serviceDryRun(f *cmdutil.Factory, request client.RawApiRequest, config *core.CliConfig, opts *ServiceMethodOptions) error {
-	return cmdutil.PrintDryRun(request, config, serviceDryRunOutputOptions(f, opts))
-}
-
-func serviceDryRunOutputOptions(f *cmdutil.Factory, opts *ServiceMethodOptions) cmdutil.DryRunOutputOptions {
-	return cmdutil.DryRunOutputOptions{
-		Format:      opts.Format,
-		JqExpr:      opts.JqExpr,
-		CommandPath: opts.Cmd.CommandPath(),
-		Identity:    opts.As,
-		Out:         f.IOStreams.Out,
-		ErrOut:      f.IOStreams.ErrOut,
-	}
+func serviceDryRun(f *cmdutil.Factory, request client.RawApiRequest, config *core.CliConfig, format string) error {
+	return cmdutil.PrintDryRun(f.IOStreams.Out, request, config, format)
 }
 
 func servicePaginate(ctx context.Context, ac *client.APIClient, request client.RawApiRequest, format output.Format, jqExpr string, out, errOut io.Writer, commandPath string, pagOpts client.PaginationOptions, checkErr func(interface{}, core.Identity) error) error {
@@ -707,18 +696,20 @@ func servicePaginate(ctx context.Context, ac *client.APIClient, request client.R
 
 	switch format {
 	case output.FormatNDJSON, output.FormatTable, output.FormatCSV:
-		emitter := output.NewEmitter(output.EmitterConfig{
-			Out:            out,
-			ErrOut:         errOut,
-			CommandPath:    commandPath,
-			Identity:       string(pagOpts.Identity),
-			NoticeProvider: output.GetNotice,
-		})
+		pf := output.NewPaginatedFormatter(out, format)
 		result, hasItems, err := ac.StreamPages(ctx, request, func(items []interface{}) error {
 			// Streaming formats intentionally emit each page after that page has
 			// passed safety scanning. A later page may still fail, so callers
 			// must use the exit code to distinguish complete vs partial output.
-			return emitter.StreamPage(items, output.StreamOptions{Format: format.String()})
+			scanResult := output.ScanForSafety(commandPath, items, errOut)
+			if scanResult.Blocked {
+				return scanResult.BlockErr
+			}
+			if scanResult.Alert != nil {
+				output.WriteAlertWarning(errOut, scanResult.Alert)
+			}
+			pf.FormatPage(items)
+			return nil
 		}, pagOpts)
 		if err != nil {
 			return err

cmd/service/service_paginate_test.go

@@ -1,400 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package service
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"io"
-	"net/http"
-	"testing"
-
-	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/client"
-	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
-	"github.com/larksuite/cli/internal/httpmock"
-	"github.com/larksuite/cli/internal/output"
-)
-
-type serviceFailOnWriteWriter struct {
-	buf    bytes.Buffer
-	writes int
-	failAt int
-	err    error
-}
-
-func (w *serviceFailOnWriteWriter) Write(p []byte) (int, error) {
-	w.writes++
-	if w.writes == w.failAt {
-		return 0, w.err
-	}
-	return w.buf.Write(p)
-}
-
-func newServicePaginateTestHarness(t *testing.T) (*client.APIClient, *bytes.Buffer, *bytes.Buffer, *httpmock.Registry) {
-	t.Helper()
-	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
-	t.Setenv("LARKSUITE_CLI_CONTENT_SAFETY_MODE", "off")
-	previousNotice := output.PendingNotice
-	output.PendingNotice = nil
-	t.Cleanup(func() { output.PendingNotice = previousNotice })
-
-	config := &core.CliConfig{
-		AppID:     "test-app",
-		AppSecret: "test-secret",
-		Brand:     core.BrandFeishu,
-	}
-	f, out, errOut, reg := cmdutil.TestFactory(t, config)
-	ac, err := f.NewAPIClientWithConfig(config)
-	if err != nil {
-		t.Fatalf("NewAPIClientWithConfig() error = %v", err)
-	}
-	ac.ErrOut = io.Discard
-	return ac, out, errOut, reg
-}
-
-func servicePaginateRequest() client.RawApiRequest {
-	return client.RawApiRequest{
-		Method: "GET",
-		URL:    "/open-apis/test/v1/items",
-		As:     core.AsBot,
-	}
-}
-
-func assertServicePaginateJSONBytes(t *testing.T, got []byte, want interface{}) {
-	t.Helper()
-	wantBytes, err := json.MarshalIndent(want, "", "  ")
-	if err != nil {
-		t.Fatalf("marshal expected JSON: %v", err)
-	}
-	wantBytes = append(wantBytes, '\n')
-	if !bytes.Equal(got, wantBytes) {
-		t.Fatalf("stdout bytes mismatch\ngot:\n%s\nwant:\n%s", got, wantBytes)
-	}
-}
-
-func TestServicePaginate_DefaultAggregatesAllPages(t *testing.T) {
-	ac, out, errOut, reg := newServicePaginateTestHarness(t)
-	calls := 0
-	wantTokens := []string{"", "next-1", "next-2"}
-	for i, wantToken := range wantTokens {
-		page := i + 1
-		hasMore := page < len(wantTokens)
-		data := map[string]interface{}{
-			"items":    []interface{}{map[string]interface{}{"id": string(rune('0' + page))}},
-			"has_more": hasMore,
-		}
-		if hasMore {
-			data["page_token"] = wantTokens[page]
-		}
-		reg.Register(&httpmock.Stub{
-			URL: "/open-apis/test/v1/items",
-			OnMatch: func(req *http.Request) {
-				calls++
-				if got := req.URL.Query().Get("page_token"); got != wantToken {
-					t.Errorf("request %d page_token = %q, want %q", page, got, wantToken)
-				}
-			},
-			Body: map[string]interface{}{
-				"code": 0,
-				"msg":  "ok",
-				"data": data,
-			},
-		})
-	}
-
-	err := servicePaginate(context.Background(), ac, servicePaginateRequest(),
-		output.FormatJSON, "", out, errOut, "lark-cli test items list", client.PaginationOptions{
-			PageLimit: 10,
-			PageDelay: -1,
-		}, ac.CheckResponse)
-
-	if err != nil {
-		t.Fatalf("servicePaginate() error = %v, want nil", err)
-	}
-	if calls != 3 {
-		t.Fatalf("pagination requests = %d, want 3", calls)
-	}
-	assertServicePaginateJSONBytes(t, out.Bytes(), output.Envelope{
-		OK:       true,
-		Identity: "bot",
-		Data: map[string]interface{}{
-			"items": []interface{}{
-				map[string]interface{}{"id": "1"},
-				map[string]interface{}{"id": "2"},
-				map[string]interface{}{"id": "3"},
-			},
-			"has_more": false,
-		},
-	})
-	if got := errOut.String(); got != "" {
-		t.Fatalf("stderr bytes = %q, want empty", got)
-	}
-}
-
-func TestServicePaginate_StreamingFormatsEmitExactMultiPageBytes(t *testing.T) {
-	tests := []struct {
-		name   string
-		format output.Format
-		want   string
-	}{
-		{
-			name:   "ndjson",
-			format: output.FormatNDJSON,
-			want:   "{\"id\":\"1\",\"name\":\"Alice\"}\n{\"id\":\"2\",\"name\":\"Carol\",\"page_only\":\"ignored\"}\n",
-		},
-		{
-			name:   "table",
-			format: output.FormatTable,
-			want:   "id  name \n──  ─────\n1   Alice\n2   Carol\n",
-		},
-		{
-			name:   "csv",
-			format: output.FormatCSV,
-			want:   "id,name\n1,Alice\n2,Carol\n",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			ac, out, errOut, reg := newServicePaginateTestHarness(t)
-			reg.Register(&httpmock.Stub{
-				URL: "/open-apis/test/v1/items",
-				Body: map[string]interface{}{
-					"code": 0,
-					"msg":  "ok",
-					"data": map[string]interface{}{
-						"items": []interface{}{
-							map[string]interface{}{"id": "1", "name": "Alice"},
-						},
-						"has_more":   true,
-						"page_token": "next-1",
-					},
-				},
-			})
-			reg.Register(&httpmock.Stub{
-				URL: "/open-apis/test/v1/items",
-				Body: map[string]interface{}{
-					"code": 0,
-					"msg":  "ok",
-					"data": map[string]interface{}{
-						"items": []interface{}{
-							map[string]interface{}{"id": "2", "name": "Carol", "page_only": "ignored"},
-						},
-						"has_more": false,
-					},
-				},
-			})
-
-			err := servicePaginate(context.Background(), ac, servicePaginateRequest(),
-				tt.format, "", out, errOut, "lark-cli test items list", client.PaginationOptions{
-					PageLimit: 10,
-					PageDelay: -1,
-				}, ac.CheckResponse)
-
-			if err != nil {
-				t.Fatalf("servicePaginate() error = %v, want nil", err)
-			}
-			if got := out.String(); got != tt.want {
-				t.Fatalf("stdout byte mismatch\ngot (%d bytes):\n%q\nwant (%d bytes):\n%q", len(got), got, len(tt.want), tt.want)
-			}
-			if got := errOut.String(); got != "" {
-				t.Fatalf("stderr bytes = %q, want empty", got)
-			}
-		})
-	}
-}
-
-func TestServicePaginate_StreamingWriteFailureStopsFurtherPages(t *testing.T) {
-	ac, _, errOut, reg := newServicePaginateTestHarness(t)
-	sentinel := errors.New("page write failed")
-	out := &serviceFailOnWriteWriter{failAt: 2, err: sentinel}
-	calls := 0
-	for page := 1; page <= 2; page++ {
-		hasMore := true
-		data := map[string]interface{}{
-			"items":    []interface{}{map[string]interface{}{"id": page}},
-			"has_more": hasMore,
-		}
-		if hasMore {
-			data["page_token"] = fmt.Sprintf("next-%d", page)
-		}
-		reg.Register(&httpmock.Stub{
-			URL: "/open-apis/test/v1/items",
-			OnMatch: func(*http.Request) {
-				calls++
-			},
-			Body: map[string]interface{}{
-				"code": 0,
-				"msg":  "ok",
-				"data": data,
-			},
-		})
-	}
-
-	err := servicePaginate(context.Background(), ac, servicePaginateRequest(),
-		output.FormatNDJSON, "", out, errOut, "lark-cli test items list",
-		client.PaginationOptions{PageLimit: 10, PageDelay: -1}, ac.CheckResponse)
-
-	if !errors.Is(err, sentinel) {
-		t.Fatalf("servicePaginate() error = %v, want preserved writer cause", err)
-	}
-	problem, ok := errs.ProblemOf(err)
-	if !ok || problem.Category != errs.CategoryInternal {
-		t.Fatalf("servicePaginate() problem = %#v, %v; want internal typed error", problem, ok)
-	}
-	if calls != 2 {
-		t.Fatalf("pagination requests = %d, want 2", calls)
-	}
-	if got, want := out.buf.String(), "{\"id\":1}\n"; got != want {
-		t.Fatalf("stdout bytes = %q, want %q", got, want)
-	}
-}
-
-func TestServicePaginate_StreamingFormatFallsBackToJSONWithoutList(t *testing.T) {
-	ac, out, errOut, reg := newServicePaginateTestHarness(t)
-	reg.Register(&httpmock.Stub{
-		URL: "/open-apis/test/v1/items",
-		Body: map[string]interface{}{
-			"code": 0,
-			"msg":  "ok",
-			"data": map[string]interface{}{
-				"name":    "Test User",
-				"user_id": "u123",
-			},
-		},
-	})
-
-	err := servicePaginate(context.Background(), ac, servicePaginateRequest(),
-		output.FormatNDJSON, "", out, errOut, "lark-cli test items get",
-		client.PaginationOptions{PageDelay: -1}, ac.CheckResponse)
-
-	if err != nil {
-		t.Fatalf("servicePaginate() error = %v, want nil", err)
-	}
-	assertServicePaginateJSONBytes(t, out.Bytes(), output.Envelope{
-		OK:       true,
-		Identity: "bot",
-		Data: map[string]interface{}{
-			"name":    "Test User",
-			"user_id": "u123",
-		},
-	})
-	wantWarning := "warning: this API does not return a list, format \"ndjson\" is not supported, falling back to json\n"
-	if got := errOut.String(); got != wantWarning {
-		t.Fatalf("stderr bytes = %q, want %q", got, wantWarning)
-	}
-}
-
-func TestServicePaginate_BusinessErrorsWriteRawAndRemainUnmarked(t *testing.T) {
-	businessResponse := map[string]interface{}{
-		"code": 123456,
-		"msg":  "fixture business error",
-		"data": map[string]interface{}{"detail": "business failed"},
-	}
-	tests := []struct {
-		name   string
-		format output.Format
-		jqExpr string
-	}{
-		{name: "jq", format: output.FormatJSON, jqExpr: ".data.items"},
-		{name: "default_json", format: output.FormatJSON},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			ac, out, errOut, reg := newServicePaginateTestHarness(t)
-			reg.Register(&httpmock.Stub{
-				URL:  "/open-apis/test/v1/items",
-				Body: businessResponse,
-			})
-
-			err := servicePaginate(context.Background(), ac, servicePaginateRequest(),
-				tt.format, tt.jqExpr, out, errOut, "lark-cli test items list",
-				client.PaginationOptions{PageDelay: -1}, ac.CheckResponse)
-
-			if err == nil {
-				t.Fatal("servicePaginate() error = nil, want business error")
-			}
-			if errs.IsRaw(err) {
-				t.Fatalf("errs.IsRaw(error) = true, want current servicePaginate pass-through behavior")
-			}
-			assertServicePaginateJSONBytes(t, out.Bytes(), businessResponse)
-			if bytes.Contains(out.Bytes(), []byte(`"ok": true`)) {
-				t.Fatalf("business-error stdout contains a success envelope:\n%s", out.Bytes())
-			}
-			if got := errOut.String(); got != "" {
-				t.Fatalf("stderr bytes = %q, want empty", got)
-			}
-		})
-	}
-}
-
-func TestServicePaginate_TransportErrorsRemainUnmarked(t *testing.T) {
-	tests := []struct {
-		name   string
-		format output.Format
-		jqExpr string
-	}{
-		{name: "jq_paginate_all", format: output.FormatJSON, jqExpr: ".data.items"},
-		{name: "stream_pages", format: output.FormatNDJSON},
-		{name: "default_paginate_all", format: output.FormatJSON},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			ac, out, errOut, _ := newServicePaginateTestHarness(t)
-
-			err := servicePaginate(context.Background(), ac, servicePaginateRequest(),
-				tt.format, tt.jqExpr, out, errOut, "lark-cli test items list",
-				client.PaginationOptions{PageDelay: -1}, ac.CheckResponse)
-
-			if err == nil {
-				t.Fatal("servicePaginate() error = nil, want transport error")
-			}
-			if errs.IsRaw(err) {
-				t.Fatalf("errs.IsRaw(error) = true, want current servicePaginate pass-through behavior")
-			}
-			if got := out.String(); got != "" {
-				t.Fatalf("stdout bytes = %q, want empty", got)
-			}
-			if got := errOut.String(); got != "" {
-				t.Fatalf("stderr bytes = %q, want empty", got)
-			}
-		})
-	}
-}
-
-func TestServicePaginate_StreamBusinessErrorRemainsUnmarked(t *testing.T) {
-	ac, out, errOut, reg := newServicePaginateTestHarness(t)
-	reg.Register(&httpmock.Stub{
-		URL: "/open-apis/test/v1/items",
-		Body: map[string]interface{}{
-			"code": 123456,
-			"msg":  "fixture business error",
-			"data": map[string]interface{}{},
-		},
-	})
-
-	err := servicePaginate(context.Background(), ac, servicePaginateRequest(),
-		output.FormatNDJSON, "", out, errOut, "lark-cli test items list",
-		client.PaginationOptions{PageDelay: -1}, ac.CheckResponse)
-
-	if err == nil {
-		t.Fatal("servicePaginate() error = nil, want business error")
-	}
-	if errs.IsRaw(err) {
-		t.Fatalf("errs.IsRaw(error) = true, want current servicePaginate pass-through behavior")
-	}
-	if got := out.String(); got != "" {
-		t.Fatalf("stdout bytes = %q, want empty", got)
-	}
-	if got := errOut.String(); got != "" {
-		t.Fatalf("stderr bytes = %q, want empty", got)
-	}
-}

cmd/service/service_test.go

@@ -4,14 +4,10 @@
 package service
 
 import (
-	"bytes"
 	"context"
 	"encoding/json"
 	"errors"
-	"mime"
-	"mime/multipart"
 	"os"
-	"path/filepath"
 	"strings"
 	"testing"
 
@@ -224,39 +220,13 @@ func TestServiceMethod_DryRun_PathParam(t *testing.T) {
 			if err := cmd.Execute(); err != nil {
 				t.Fatalf("unexpected error: %v", err)
 			}
-			var got map[string]interface{}
-			if err := json.Unmarshal(stdout.Bytes(), &got); err != nil {
-				t.Fatalf("dry-run stdout is not JSON: %v\n%s", err, stdout.String())
-			}
-			if got["ok"] != true || got["dry_run"] != true {
-				t.Fatalf("unexpected dry-run envelope: %#v", got)
-			}
-			data := got["data"].(map[string]interface{})
-			api := data["api"].([]interface{})
-			call := api[0].(map[string]interface{})
-			if call["url"] != tt.wantInURL {
-				t.Errorf("url = %q, want %q\nstdout:\n%s", call["url"], tt.wantInURL, stdout.String())
+			if !strings.Contains(stdout.String(), tt.wantInURL) {
+				t.Errorf("expected URL containing %q, got:\n%s", tt.wantInURL, stdout.String())
 			}
 		})
 	}
 }
 
-func TestServiceMethod_DryRunWithJq(t *testing.T) {
-	f, stdout, _, _ := cmdutil.TestFactory(t, testConfig)
-	cmd := NewCmdServiceMethod(f, driveSpec(), driveMethod("GET", nil), "get", "files", nil)
-	cmd.SetArgs([]string{
-		"--params", `{"file_token":"boxcn123abc"}`,
-		"--dry-run",
-		"--jq", ".data.api[0].url",
-	})
-	if err := cmd.Execute(); err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if got, want := strings.TrimSpace(stdout.String()), "/open-apis/drive/v1/files/boxcn123abc/copy"; got != want {
-		t.Fatalf("jq output = %q, want %q", got, want)
-	}
-}
-
 func TestServiceMethod_PathParamRejectsTraversal(t *testing.T) {
 	tests := []struct {
 		name      string
@@ -344,12 +314,8 @@ func TestServiceMethod_PaginationParamSkippedWithPageAll(t *testing.T) {
 	if err != nil {
 		t.Fatalf("expected no error with --page-all skipping page_size, got: %v", err)
 	}
-	var got map[string]interface{}
-	if err := json.Unmarshal(stdout.Bytes(), &got); err != nil {
-		t.Fatalf("dry-run stdout is not JSON: %v\n%s", err, stdout.String())
-	}
-	if got["dry_run"] != true {
-		t.Fatalf("dry_run = %#v, want true", got["dry_run"])
+	if !strings.Contains(stdout.String(), "Dry Run") {
+		t.Error("expected dry-run output")
 	}
 }
 
@@ -1111,23 +1077,11 @@ func TestServiceMethod_FileUpload_DryRun(t *testing.T) {
 		t.Fatalf("unexpected error: %v", err)
 	}
 	out := stdout.String()
-	var env map[string]interface{}
-	if err := json.Unmarshal(stdout.Bytes(), &env); err != nil {
-		t.Fatalf("dry-run stdout is not JSON: %v\n%s", err, out)
+	if !strings.Contains(out, "image") {
+		t.Errorf("expected dry-run output to mention file field, got: %s", out)
 	}
-	if env["dry_run"] != true {
-		t.Fatalf("dry_run = %#v, want true", env["dry_run"])
-	}
-	data := env["data"].(map[string]interface{})
-	api := data["api"].([]interface{})
-	call := api[0].(map[string]interface{})
-	body := call["body"].(map[string]interface{})
-	file := body["file"].(map[string]interface{})
-	if file["field"] != "image" || file["path"] != tmpFile {
-		t.Fatalf("unexpected file dry-run body: %#v", body)
-	}
-	if strings.Contains(out, "=== Dry Run ===") {
-		t.Fatalf("stdout should not contain dry-run banner: %s", out)
+	if !strings.Contains(out, "Dry Run") {
+		t.Errorf("expected dry-run header, got: %s", out)
 	}
 }
 
@@ -1178,63 +1132,6 @@ func TestDetectFileFields(t *testing.T) {
 	}
 }
 
-// parseMultipartFilenames drives one service-method --file upload through the
-// mock transport and returns a map of field name -> part filename parsed from
-// the captured multipart body. Mirrors cmd/api's helper of the same name
-// (inlined here rather than shared, since the two live in different packages)
-// to give BuildFormdata's shared local-file fix a second real entry-point
-// covering it.
-func parseMultipartFilenames(t *testing.T, stub *httpmock.Stub) map[string]string {
-	t.Helper()
-	ct := stub.CapturedHeaders.Get("Content-Type")
-	mediaType, params, err := mime.ParseMediaType(ct)
-	if err != nil {
-		t.Fatalf("parse Content-Type %q: %v", ct, err)
-	}
-	if !strings.HasPrefix(mediaType, "multipart/") {
-		t.Fatalf("Content-Type = %q, want multipart/*", mediaType)
-	}
-	filenames := map[string]string{}
-	mr := multipart.NewReader(bytes.NewReader(stub.CapturedBody), params["boundary"])
-	for {
-		part, err := mr.NextPart()
-		if err != nil {
-			break
-		}
-		if fn := part.FileName(); fn != "" {
-			filenames[part.FormName()] = fn
-		}
-	}
-	return filenames
-}
-
-func TestServiceMethod_FileUpload_PreservesFilename(t *testing.T) {
-	f, _, _, reg := cmdutil.TestFactory(t, testConfig)
-
-	dir := t.TempDir()
-	cmdutil.TestChdir(t, dir)
-	if err := os.WriteFile(filepath.Join(dir, "photo.jpg"), []byte("fake-image"), 0600); err != nil {
-		t.Fatalf("write test file: %v", err)
-	}
-
-	stub := &httpmock.Stub{
-		URL:  "/open-apis/im/v1/images",
-		Body: map[string]interface{}{"code": 0, "msg": "ok", "data": map[string]interface{}{"image_key": "img_xxx"}},
-	}
-	reg.Register(stub)
-
-	cmd := NewCmdServiceMethod(f, imSpec(), imImageMethod(), "create", "images", nil)
-	cmd.SetArgs([]string{"--file", "photo.jpg", "--data", `{"image_type":"message"}`, "--as", "bot"})
-	if err := cmd.Execute(); err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-
-	filenames := parseMultipartFilenames(t, stub)
-	if got := filenames["image"]; got != "photo.jpg" {
-		t.Fatalf("part filename for field %q = %q, want %q", "image", got, "photo.jpg")
-	}
-}
-
 func TestServiceMethod_JsonFlag_Accepted(t *testing.T) {
 	f, _, _, _ := cmdutil.TestFactory(t, testConfig)
 

cmd/service/testmain_test.go

@@ -1,39 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package service
-
-import (
-	"os"
-	"testing"
-
-	"github.com/larksuite/cli/internal/registry/registrytest"
-)
-
-// TestMain isolates service command tests from the host machine: config (and
-// the registry cache under it) is redirected to a temp dir, then the registry
-// is seeded from the tracked fixture and initialized eagerly. Tests pass on a
-// clean checkout with no network, no `make fetch_meta`, and no user cache.
-//
-// Note: os.Exit skips deferred functions, so cleanup runs explicitly after
-// m.Run before exiting.
-func TestMain(m *testing.M) {
-	root, err := os.MkdirTemp("", "lark-cli-cmd-service-test-*")
-	if err != nil {
-		println("cmd/service test setup: MkdirTemp failed:", err.Error())
-		os.Exit(2)
-	}
-	if err := os.Setenv("LARKSUITE_CLI_CONFIG_DIR", root); err != nil {
-		println("cmd/service test setup: Setenv failed:", err.Error())
-		os.RemoveAll(root)
-		os.Exit(2)
-	}
-	if err := registrytest.Seed(root); err != nil {
-		println("cmd/service test setup: registrytest.Seed failed:", err.Error())
-		os.RemoveAll(root)
-		os.Exit(2)
-	}
-	code := m.Run()
-	os.RemoveAll(root)
-	os.Exit(code)
-}

cmd/startup_brand.go

@@ -1,28 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package cmd
-
-import (
-	"os"
-
-	"github.com/larksuite/cli/internal/core"
-	"github.com/larksuite/cli/internal/envvars"
-)
-
-// ResolveStartupBrand resolves the brand before the command tree is built, so
-// the registry's remote metadata overlay uses the configured brand from the
-// first catalog access. It mirrors the credential chain's brand precedence —
-// environment, then the active profile's raw config entry — without touching
-// the keychain (no secrets are needed to know the brand).
-func ResolveStartupBrand(profile string) core.LarkBrand {
-	if raw := os.Getenv(envvars.CliBrand); raw != "" {
-		return core.ParseBrand(raw)
-	}
-	if cfg, err := core.LoadMultiAppConfig(); err == nil {
-		if app := cfg.CurrentAppConfig(profile); app != nil {
-			return core.ParseBrand(string(app.Brand))
-		}
-	}
-	return core.BrandFeishu
-}

cmd/startup_brand_test.go

@@ -1,143 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package cmd
-
-import (
-	"context"
-	"flag"
-	"fmt"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"strings"
-	"testing"
-
-	"github.com/google/uuid"
-	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
-	"github.com/larksuite/cli/internal/registry"
-)
-
-const startupBrandHelperEnv = "GO_TEST_STARTUP_BRAND_HELPER"
-
-var _ = flag.String("startup-brand-helper", "", "internal startup brand test helper nonce")
-
-func isStartupBrandHelper() bool {
-	return startupBrandHelperEnabled(os.Getenv(startupBrandHelperEnv), startupBrandHelperNonce(os.Args))
-}
-
-func startupBrandHelperEnabled(envNonce, argNonce string) bool {
-	return envNonce != "" && envNonce == argNonce
-}
-
-func startupBrandHelperNonce(args []string) string {
-	const prefix = "-startup-brand-helper="
-	for _, arg := range args {
-		if strings.HasPrefix(arg, prefix) {
-			return strings.TrimPrefix(arg, prefix)
-		}
-	}
-	return ""
-}
-
-func TestResolveStartupBrand_Precedence(t *testing.T) {
-	tmp := t.TempDir()
-	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", tmp)
-	t.Setenv("LARKSUITE_CLI_BRAND", "")
-	os.Unsetenv("LARKSUITE_CLI_BRAND")
-
-	// No config at all → default brand.
-	if got := ResolveStartupBrand(""); got != core.BrandFeishu {
-		t.Errorf("empty state brand = %q, want feishu", got)
-	}
-
-	// Raw config supplies the active profile's brand — no keychain involved.
-	raw := `{"currentApp":"feishu-app","apps":[` +
-		`{"name":"feishu-app","appId":"cli_f","appSecret":"test-secret","brand":"feishu","users":[]},` +
-		`{"name":"lark-prof","appId":"cli_l","appSecret":"test-secret","brand":"LARK","users":[]}]}`
-	if err := os.WriteFile(filepath.Join(tmp, "config.json"), []byte(raw), 0600); err != nil {
-		t.Fatal(err)
-	}
-	if got := ResolveStartupBrand(""); got != core.BrandFeishu {
-		t.Errorf("default profile brand = %q, want feishu", got)
-	}
-	if got := ResolveStartupBrand("lark-prof"); got != core.BrandLark {
-		t.Errorf("lark profile brand = %q, want lark (normalized)", got)
-	}
-
-	// Environment wins over the config file.
-	t.Setenv("LARKSUITE_CLI_BRAND", "lark")
-	if got := ResolveStartupBrand(""); got != core.BrandLark {
-		t.Errorf("env brand = %q, want lark", got)
-	}
-}
-
-// TestStartupBrandReachesRegistry_RealStartupOrder proves the fix for the
-// production startup sequence: building the command tree locks the registry's
-// sync.Once, so the brand must be injected before the first catalog access.
-// It runs in a subprocess because the registry is process-global.
-func TestStartupBrandReachesRegistry_RealStartupOrder(t *testing.T) {
-	if isStartupBrandHelper() {
-		// Helper: replicate Execute()'s build wiring with a lark config.
-		buildInternal(
-			context.Background(), cmdutil.InvocationContext{},
-			WithIO(strings.NewReader(""), os.Stdout, os.Stderr),
-			WithStartupBrand(ResolveStartupBrand("")),
-		)
-		fmt.Printf("CONFIGURED_BRAND=%s\n", registry.ConfiguredBrand())
-		os.Exit(0)
-	}
-
-	tmp := t.TempDir()
-	raw := `{"apps":[{"appId":"cli_l","appSecret":"test-secret","brand":"lark","users":[]}]}`
-	if err := os.WriteFile(filepath.Join(tmp, "config.json"), []byte(raw), 0600); err != nil {
-		t.Fatal(err)
-	}
-
-	nonce := uuid.NewString()
-	t.Setenv(startupBrandHelperEnv, nonce)
-	cmd := exec.Command(os.Args[0], "-test.run", "TestStartupBrandReachesRegistry_RealStartupOrder")
-	cmd.Args = append(cmd.Args, "-startup-brand-helper="+nonce)
-	cmd.Env = append(os.Environ(),
-		"LARKSUITE_CLI_CONFIG_DIR="+tmp,
-		"LARKSUITE_CLI_REMOTE_META=off", // no network during the subprocess build
-	)
-	out, err := cmd.CombinedOutput()
-	if err != nil {
-		t.Fatalf("subprocess failed: %v\n%s", err, out)
-	}
-	if !strings.Contains(string(out), "CONFIGURED_BRAND=lark") {
-		t.Errorf("registry brand after real startup order = %s, want lark", out)
-	}
-}
-
-func TestStartupBrandHelperRequiresMatchingCommandNonce(t *testing.T) {
-	for _, tt := range []struct {
-		name     string
-		envNonce string
-		argNonce string
-		want     bool
-	}{
-		{name: "neither set"},
-		{name: "ambient environment only", envNonce: "ambient"},
-		{name: "command argument only", argNonce: "command"},
-		{name: "mismatch", envNonce: "ambient", argNonce: "command"},
-		{name: "matching", envNonce: "nonce", argNonce: "nonce", want: true},
-	} {
-		t.Run(tt.name, func(t *testing.T) {
-			if got := startupBrandHelperEnabled(tt.envNonce, tt.argNonce); got != tt.want {
-				t.Fatalf("startupBrandHelperEnabled() = %v, want %v", got, tt.want)
-			}
-		})
-	}
-}
-
-func TestStartupBrandHelperNonce(t *testing.T) {
-	if got := startupBrandHelperNonce([]string{"test", "-test.run", "brand"}); got != "" {
-		t.Fatalf("startupBrandHelperNonce() = %q, want empty", got)
-	}
-	if got := startupBrandHelperNonce([]string{"test", "-startup-brand-helper=nonce"}); got != "nonce" {
-		t.Fatalf("startupBrandHelperNonce() = %q, want nonce", got)
-	}
-}

cmd/testmain_test.go

@@ -1,46 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package cmd
-
-import (
-	"os"
-	"testing"
-
-	"github.com/larksuite/cli/internal/registry/registrytest"
-)
-
-// TestMain isolates command-tree tests from the host machine: config (and the
-// registry cache under it) is redirected to a temp dir, then the registry is
-// seeded from the tracked fixture and initialized eagerly. Tests pass on a
-// clean checkout with no network, no `make fetch_meta`, and no user cache.
-//
-// Note: os.Exit skips deferred functions, so cleanup runs explicitly after
-// m.Run before exiting.
-func TestMain(m *testing.M) {
-	if isStartupBrandHelper() {
-		// Re-exec helper subprocess (startup_brand_test.go): the parent test
-		// already provides an isolated config dir and disables remote metadata,
-		// and the helper must own the first registry Init to prove the startup
-		// order — do not seed or eagerly initialize here.
-		os.Exit(m.Run())
-	}
-	root, err := os.MkdirTemp("", "lark-cli-cmd-test-*")
-	if err != nil {
-		println("cmd test setup: MkdirTemp failed:", err.Error())
-		os.Exit(2)
-	}
-	if err := os.Setenv("LARKSUITE_CLI_CONFIG_DIR", root); err != nil {
-		println("cmd test setup: Setenv failed:", err.Error())
-		os.RemoveAll(root)
-		os.Exit(2)
-	}
-	if err := registrytest.Seed(root); err != nil {
-		println("cmd test setup: registrytest.Seed failed:", err.Error())
-		os.RemoveAll(root)
-		os.Exit(2)
-	}
-	code := m.Run()
-	os.RemoveAll(root)
-	os.Exit(code)
-}

cmd/update/testmain_test.go

@@ -1,23 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package cmdupdate
-
-import (
-	"os"
-	"path/filepath"
-	"testing"
-)
-
-func TestMain(m *testing.M) {
-	root, err := os.MkdirTemp("", "lark-cli-update-test-*")
-	if err != nil {
-		panic(err)
-	}
-	if err := os.Setenv("LARKSUITE_CLI_CONFIG_DIR", filepath.Join(root, "config")); err != nil {
-		panic(err)
-	}
-	code := m.Run()
-	_ = os.RemoveAll(root)
-	os.Exit(code)
-}

cmd/update/update.go

@@ -5,7 +5,6 @@ package cmdupdate
 
 import (
 	"fmt"
-	stdio "io"
 	"runtime"
 	"strings"
 
@@ -14,7 +13,6 @@ import (
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/build"
 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/output"
 	"github.com/larksuite/cli/internal/selfupdate"
 	"github.com/larksuite/cli/internal/skillscheck"
@@ -104,8 +102,7 @@ func NewCmdUpdate(f *cmdutil.Factory) *cobra.Command {
 		Long: `Update lark-cli to the latest version.
 
 Detects the installation method automatically:
-  - npm install:  runs npm install -g @larksuite/cli@<version>
-  - pnpm install: runs pnpm add -g @larksuite/cli@<version>
+  - npm install: runs npm install -g @larksuite/cli@<version>
   - manual/other: shows GitHub Releases download URL
 
 Use --json for structured output (for AI agents and scripts).
@@ -127,15 +124,13 @@ func updateRun(opts *UpdateOptions) error {
 	io := opts.Factory.IOStreams
 	cur := currentVersion()
 	updater := newUpdater()
-	// Brand only steers skills sync. updateRun skips that resolution in --check,
-	// where the Updater's zero-value brand retains the Feishu default.
+
 	if !opts.Check {
-		updater.Brand = resolveSkillsBrand(opts.Factory, io.ErrOut)
 		updater.CleanupStaleFiles()
 	}
 	output.PendingNotice = nil
 
-	// 1. Fetch latest version.
+	// 1. Fetch latest version
 	latest, err := fetchLatest()
 	if err != nil {
 		return reportError(opts, io, "network",
@@ -157,7 +152,7 @@ func updateRun(opts *UpdateOptions) error {
 		return reportAlreadyUpToDate(opts, io, cur, latest, skillsResult, opts.Check)
 	}
 
-	// 4. Detect installation method.
+	// 4. Detect installation method
 	detect := updater.DetectInstallMethod()
 
 	// 5. --check
@@ -169,23 +164,7 @@ func updateRun(opts *UpdateOptions) error {
 	if !detect.CanAutoUpdate() {
 		return doManualUpdate(opts, io, cur, latest, detect, updater)
 	}
-	return doAutoUpdate(opts, io, cur, latest, detect, updater)
-}
-
-// resolveSkillsBrand returns the skills-source brand: resolved config first,
-// then the active profile's raw config entry (the brand is not a secret; a
-// locked keychain must not flip the source), then the default with a notice.
-func resolveSkillsBrand(f *cmdutil.Factory, errOut stdio.Writer) core.LarkBrand {
-	if cfg, err := f.Config(); err == nil && cfg != nil {
-		return core.ParseBrand(string(cfg.Brand))
-	}
-	if raw, err := core.LoadMultiAppConfig(); err == nil {
-		if app := raw.CurrentAppConfig(f.Invocation.Profile); app != nil {
-			return core.ParseBrand(string(app.Brand))
-		}
-	}
-	fmt.Fprintf(errOut, "note: could not resolve the configured brand; syncing skills from the default source\n")
-	return core.BrandFeishu
+	return doNpmUpdate(opts, io, cur, latest, updater)
 }
 
 // --- Output helpers ---
@@ -247,23 +226,12 @@ func doManualUpdate(opts *UpdateOptions, io *cmdutil.IOStreams, cur, latest stri
 	fmt.Fprintf(io.ErrOut, "To update manually, download the latest release:\n")
 	fmt.Fprintf(io.ErrOut, "  Release:   %s\n", releaseURL(latest))
 	fmt.Fprintf(io.ErrOut, "  Changelog: %s\n", changelogURL())
-	if detect.Method == selfupdate.InstallPnpm {
-		fmt.Fprintf(io.ErrOut, "\nOr install via pnpm (note: skills will not be synced):\n  pnpm add -g %s@%s\n  pnpm dlx skills add larksuite/cli -y -g   # sync skills separately\n", selfupdate.NpmPackage, latest)
-	} else {
-		fmt.Fprintf(io.ErrOut, "\nOr install via npm (note: skills will not be synced):\n  npm install -g %s@%s\n  npx skills add larksuite/cli -y -g   # sync skills separately\n", selfupdate.NpmPackage, latest)
-	}
+	fmt.Fprintf(io.ErrOut, "\nOr install via npm (note: skills will not be synced):\n  npm install -g %s@%s\n  npx skills add larksuite/cli -y -g   # sync skills separately\n", selfupdate.NpmPackage, latest)
 	emitSkillsTextHints(io, skillsResult)
 	return nil
 }
 
-func doAutoUpdate(opts *UpdateOptions, io *cmdutil.IOStreams, cur, latest string, detect selfupdate.DetectResult, updater *selfupdate.Updater) error {
-	pm := "npm"
-	install := updater.RunNpmInstall
-	if detect.Method == selfupdate.InstallPnpm {
-		pm = "pnpm"
-		install = updater.RunPnpmInstall
-	}
-
+func doNpmUpdate(opts *UpdateOptions, io *cmdutil.IOStreams, cur, latest string, updater *selfupdate.Updater) error {
 	restore, err := updater.PrepareSelfReplace()
 	if err != nil {
 		return reportError(opts, io, "update_error",
@@ -271,19 +239,19 @@ func doAutoUpdate(opts *UpdateOptions, io *cmdutil.IOStreams, cur, latest string
 	}
 
 	if !opts.JSON {
-		fmt.Fprintf(io.ErrOut, "Updating lark-cli %s %s %s via %s ...\n", cur, symArrow(), latest, pm)
+		fmt.Fprintf(io.ErrOut, "Updating lark-cli %s %s %s via npm ...\n", cur, symArrow(), latest)
 	}
 
-	npmResult := install(latest)
+	npmResult := updater.RunNpmInstall(latest)
 	if npmResult.Err != nil {
 		restore()
 		combined := npmResult.CombinedOutput()
 		if opts.JSON {
 			output.PrintJson(io.Out, map[string]interface{}{
 				"ok": false, "error": map[string]interface{}{
-					"type": "update_error", "message": fmt.Sprintf("%s install failed: %s", pm, npmResult.Err),
+					"type": "update_error", "message": fmt.Sprintf("npm install failed: %s", npmResult.Err),
 					"detail": selfupdate.Truncate(combined, maxNpmOutput),
-					"hint":   permissionHint(combined, pm),
+					"hint":   permissionHint(combined),
 				},
 			})
 			return output.ErrBare(output.ExitAPI)
@@ -295,7 +263,7 @@ func doAutoUpdate(opts *UpdateOptions, io *cmdutil.IOStreams, cur, latest string
 			fmt.Fprint(io.ErrOut, npmResult.Stderr.String())
 		}
 		fmt.Fprintf(io.ErrOut, "\n%s Update failed: %s\n", symFail(), npmResult.Err)
-		if hint := permissionHint(combined, pm); hint != "" {
+		if hint := permissionHint(combined); hint != "" {
 			fmt.Fprintf(io.ErrOut, "  %s\n", hint)
 		}
 		return output.ErrBare(output.ExitAPI)
@@ -306,7 +274,7 @@ func doAutoUpdate(opts *UpdateOptions, io *cmdutil.IOStreams, cur, latest string
 	if err := updater.VerifyBinary(latest); err != nil {
 		restore()
 		msg := fmt.Sprintf("new binary verification failed: %s", err)
-		hint := verificationFailureHint(updater, latest, pm)
+		hint := verificationFailureHint(updater, latest)
 		if opts.JSON {
 			output.PrintJson(io.Out, map[string]interface{}{
 				"ok":    false,
@@ -336,33 +304,23 @@ func doAutoUpdate(opts *UpdateOptions, io *cmdutil.IOStreams, cur, latest string
 	fmt.Fprintf(io.ErrOut, "\n%s Successfully updated lark-cli from %s to %s\n", symOK(), cur, latest)
 	fmt.Fprintf(io.ErrOut, "  Changelog: %s\n", changelogURL())
 	if skillsResult != nil {
-		skillsPM := "npx"
-		if detect.Method == selfupdate.InstallPnpm && detect.PnpmAvailable {
-			skillsPM = "pnpm dlx"
-		}
-		fmt.Fprintf(io.ErrOut, "\nUpdating skills via %s ...\n", skillsPM)
+		fmt.Fprintf(io.ErrOut, "\nUpdating skills ...\n")
 	}
 	emitSkillsTextHints(io, skillsResult)
 	return nil
 }
 
-func permissionHint(pmOutput, pm string) string {
-	if !strings.Contains(pmOutput, "EACCES") || isWindows() {
-		return ""
+func permissionHint(npmOutput string) string {
+	if strings.Contains(npmOutput, "EACCES") && !isWindows() {
+		return "Permission denied. Try: sudo lark-cli update, or adjust your npm global prefix: https://docs.npmjs.com/resolving-eacces-permissions-errors"
 	}
-	if pm == "pnpm" {
-		return "Permission denied. Ensure your pnpm global directory is writable — re-run `pnpm setup`, or see https://pnpm.io/pnpm-cli"
-	}
-	return "Permission denied. Try: sudo lark-cli update, or adjust your npm global prefix: https://docs.npmjs.com/resolving-eacces-permissions-errors"
+	return ""
 }
 
-func verificationFailureHint(updater *selfupdate.Updater, latest, pm string) string {
+func verificationFailureHint(updater *selfupdate.Updater, latest string) string {
 	if updater.CanRestorePreviousVersion() {
 		return "the previous version has been restored"
 	}
-	if pm == "pnpm" {
-		return fmt.Sprintf("automatic rollback is unavailable on this platform; reinstall manually (skills will not be synced): pnpm add -g %s@%s && pnpm dlx skills add larksuite/cli -y -g, or download %s", selfupdate.NpmPackage, latest, releaseURL(latest))
-	}
 	return fmt.Sprintf("automatic rollback is unavailable on this platform; reinstall manually (skills will not be synced): npm install -g %s@%s && npx skills add larksuite/cli -y -g, or download %s", selfupdate.NpmPackage, latest, releaseURL(latest))
 }
 

cmd/update/update_test.go

@@ -9,9 +9,7 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
-	"os"
 	"os/exec"
-	"path/filepath"
 	"strings"
 	"testing"
 	"time"
@@ -24,8 +22,6 @@ import (
 	"github.com/larksuite/cli/internal/skillscheck"
 )
 
-const runLiveSkillsTestsEnv = "LARKSUITE_CLI_RUN_LIVE_SKILLS_TESTS"
-
 // newTestFactory creates a test factory with minimal config.
 func newTestFactory(t *testing.T) (*cmdutil.Factory, *bytes.Buffer, *bytes.Buffer) {
 	t.Helper()
@@ -33,17 +29,13 @@ func newTestFactory(t *testing.T) (*cmdutil.Factory, *bytes.Buffer, *bytes.Buffe
 	return f, stdout, stderr
 }
 
-// mockDetect sets up newUpdater to return an Updater with the given DetectResult
-// and fully mocked skills operations. Tests that only care about install-method
-// detection must never fall through to the real npx skills CLI.
+// mockDetect sets up newUpdater to return an Updater with the given DetectResult.
 func mockDetect(t *testing.T, result selfupdate.DetectResult) {
 	t.Helper()
 	origNew := newUpdater
 	newUpdater = func() *selfupdate.Updater {
 		u := selfupdate.New()
 		u.DetectOverride = func() selfupdate.DetectResult { return result }
-		u.SkillsIndexFetchOverride = successfulSkillsIndexFetch()
-		u.SkillsCommandOverride = successfulSkillsCommand()
 		return u
 	}
 	t.Cleanup(func() { newUpdater = origNew })
@@ -65,27 +57,6 @@ func mockDetectAndNpm(t *testing.T, result selfupdate.DetectResult, npmFn func(s
 	t.Cleanup(func() { newUpdater = origNew })
 }
 
-// mockDetectAndPnpm mirrors mockDetectAndNpm but wires the pnpm install path
-// and fails the test if the npm install path is invoked.
-func mockDetectAndPnpm(t *testing.T, result selfupdate.DetectResult, pnpmFn func(string) *selfupdate.NpmResult) {
-	t.Helper()
-	origNew := newUpdater
-	newUpdater = func() *selfupdate.Updater {
-		u := selfupdate.New()
-		u.DetectOverride = func() selfupdate.DetectResult { return result }
-		u.PnpmInstallOverride = pnpmFn
-		u.NpmInstallOverride = func(string) *selfupdate.NpmResult {
-			t.Errorf("npm install must not be called for a pnpm install")
-			return &selfupdate.NpmResult{}
-		}
-		u.VerifyOverride = func(string) error { return nil }
-		u.SkillsIndexFetchOverride = successfulSkillsIndexFetch()
-		u.SkillsCommandOverride = successfulSkillsCommand()
-		return u
-	}
-	t.Cleanup(func() { newUpdater = origNew })
-}
-
 func successfulSkillsIndexFetch() func() *selfupdate.NpmResult {
 	return func() *selfupdate.NpmResult {
 		r := &selfupdate.NpmResult{}
@@ -110,122 +81,6 @@ func successfulSkillsCommand() func(args ...string) *selfupdate.NpmResult {
 	}
 }
 
-func mockSkillsSync(t *testing.T) {
-	t.Helper()
-	origNew := newUpdater
-	newUpdater = func() *selfupdate.Updater {
-		u := selfupdate.New()
-		u.SkillsIndexFetchOverride = successfulSkillsIndexFetch()
-		u.SkillsCommandOverride = successfulSkillsCommand()
-		return u
-	}
-	t.Cleanup(func() { newUpdater = origNew })
-}
-
-func TestUpdatePnpm_JSON(t *testing.T) {
-	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
-	f, stdout, _ := newTestFactory(t)
-	cmd := NewCmdUpdate(f)
-	cmd.SetArgs([]string{"--json"})
-	origFetch := fetchLatest
-	fetchLatest = func() (string, error) { return "2.0.0", nil }
-	defer func() { fetchLatest = origFetch }()
-	origVersion := currentVersion
-	currentVersion = func() string { return "1.0.0" }
-	defer func() { currentVersion = origVersion }()
-	mockDetectAndPnpm(t,
-		selfupdate.DetectResult{Method: selfupdate.InstallPnpm, ResolvedPath: "/x/node_modules/.pnpm/@larksuite+cli@1.0.0/node_modules/@larksuite/cli/bin/lark-cli", PnpmAvailable: true},
-		func(string) *selfupdate.NpmResult { return &selfupdate.NpmResult{} },
-	)
-	if err := cmd.Execute(); err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if out := stdout.String(); !strings.Contains(out, `"action": "updated"`) {
-		t.Errorf("expected updated in output, got: %s", out)
-	}
-}
-
-func TestUpdatePnpm_Human(t *testing.T) {
-	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
-	f, _, stderr := newTestFactory(t)
-	cmd := NewCmdUpdate(f)
-	cmd.SetArgs([]string{})
-	origFetch := fetchLatest
-	fetchLatest = func() (string, error) { return "2.0.0", nil }
-	defer func() { fetchLatest = origFetch }()
-	origVersion := currentVersion
-	currentVersion = func() string { return "1.0.0" }
-	defer func() { currentVersion = origVersion }()
-	mockDetectAndPnpm(t,
-		selfupdate.DetectResult{Method: selfupdate.InstallPnpm, ResolvedPath: "/x/node_modules/.pnpm/@larksuite+cli@1.0.0/node_modules/@larksuite/cli/bin/lark-cli", PnpmAvailable: true},
-		func(string) *selfupdate.NpmResult { return &selfupdate.NpmResult{} },
-	)
-	if err := cmd.Execute(); err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	out := stderr.String()
-	if !strings.Contains(out, "via pnpm") {
-		t.Errorf("expected 'via pnpm' in stderr, got: %s", out)
-	}
-	if !strings.Contains(out, "Updating skills via pnpm dlx ...") {
-		t.Errorf("expected skills sync to report pnpm dlx launcher, got: %s", out)
-	}
-	if !strings.Contains(out, "Successfully updated") {
-		t.Errorf("expected success message, got: %s", out)
-	}
-}
-
-func TestUpdatePnpm_InstallError_JSON(t *testing.T) {
-	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
-	f, stdout, _ := newTestFactory(t)
-	cmd := NewCmdUpdate(f)
-	cmd.SetArgs([]string{"--json"})
-	origFetch := fetchLatest
-	fetchLatest = func() (string, error) { return "2.0.0", nil }
-	defer func() { fetchLatest = origFetch }()
-	origVersion := currentVersion
-	currentVersion = func() string { return "1.0.0" }
-	defer func() { currentVersion = origVersion }()
-	mockDetectAndPnpm(t,
-		selfupdate.DetectResult{Method: selfupdate.InstallPnpm, ResolvedPath: "/x/node_modules/.pnpm/@larksuite+cli@1.0.0/node_modules/@larksuite/cli/bin/lark-cli", PnpmAvailable: true},
-		func(string) *selfupdate.NpmResult { return &selfupdate.NpmResult{Err: errors.New("pnpm boom")} },
-	)
-	err := cmd.Execute()
-	if err == nil {
-		t.Fatal("expected error exit")
-	}
-	if out := stdout.String(); !strings.Contains(out, `"ok": false`) || !strings.Contains(out, "update_error") {
-		t.Errorf("expected failure envelope, got: %s", out)
-	}
-	if out := stdout.String(); !strings.Contains(out, "pnpm install failed") {
-		t.Errorf("expected message to report pnpm as the package manager, got: %s", out)
-	}
-}
-
-func TestUpdatePnpm_Unavailable_ManualFallback(t *testing.T) {
-	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
-	f, _, stderr := newTestFactory(t)
-	cmd := NewCmdUpdate(f)
-	cmd.SetArgs([]string{})
-	origFetch := fetchLatest
-	fetchLatest = func() (string, error) { return "2.0.0", nil }
-	defer func() { fetchLatest = origFetch }()
-	origVersion := currentVersion
-	currentVersion = func() string { return "1.0.0" }
-	defer func() { currentVersion = origVersion }()
-	mockDetect(t, selfupdate.DetectResult{Method: selfupdate.InstallPnpm, ResolvedPath: "/x/node_modules/.pnpm/@larksuite+cli@1.0.0/node_modules/@larksuite/cli/bin/lark-cli", PnpmAvailable: false})
-	if err := cmd.Execute(); err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	out := stderr.String()
-	if !strings.Contains(out, "installed via pnpm, but pnpm is not available in PATH") {
-		t.Errorf("expected pnpm manual reason, got: %s", out)
-	}
-	if !strings.Contains(out, "pnpm add -g") {
-		t.Errorf("expected pnpm add -g hint, got: %s", out)
-	}
-}
-
 func TestNormalizeVersion(t *testing.T) {
 	tests := []struct {
 		input string
@@ -246,9 +101,6 @@ func TestNormalizeVersion(t *testing.T) {
 }
 
 func TestUpdateAlreadyUpToDate_JSON(t *testing.T) {
-	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
-	mockSkillsSync(t)
-
 	f, stdout, _ := newTestFactory(t)
 
 	cmd := NewCmdUpdate(f)
@@ -277,9 +129,6 @@ func TestUpdateAlreadyUpToDate_JSON(t *testing.T) {
 }
 
 func TestUpdateAlreadyUpToDate_Human(t *testing.T) {
-	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
-	mockSkillsSync(t)
-
 	f, _, stderr := newTestFactory(t)
 
 	cmd := NewCmdUpdate(f)
@@ -305,7 +154,6 @@ func TestUpdateAlreadyUpToDate_Human(t *testing.T) {
 }
 
 func TestUpdateManual_JSON(t *testing.T) {
-	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
 	f, stdout, _ := newTestFactory(t)
 	cmd := NewCmdUpdate(f)
 	cmd.SetArgs([]string{"--json"})
@@ -337,7 +185,6 @@ func TestUpdateManual_JSON(t *testing.T) {
 }
 
 func TestUpdateManual_Human(t *testing.T) {
-	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
 	f, _, stderr := newTestFactory(t)
 	cmd := NewCmdUpdate(f)
 	cmd.SetArgs([]string{})
@@ -419,9 +266,6 @@ func TestUpdateNpm_Human(t *testing.T) {
 	if !strings.Contains(out, "Successfully updated") {
 		t.Errorf("expected success message in stderr, got: %s", out)
 	}
-	if !strings.Contains(out, "Updating skills via npx ...") {
-		t.Errorf("expected skills sync to report npx launcher for npm install, got: %s", out)
-	}
 }
 
 func TestUpdateForce_JSON(t *testing.T) {
@@ -895,9 +739,9 @@ func TestPermissionHint(t *testing.T) {
 	origOS := currentOS
 	defer func() { currentOS = origOS }()
 
-	// Linux + npm: EACCES should produce a hint with npm prefix guidance.
+	// Linux: EACCES should produce a hint with npm prefix guidance.
 	currentOS = "linux"
-	hint := permissionHint("EACCES: permission denied, access '/usr/local/lib'", "npm")
+	hint := permissionHint("EACCES: permission denied, access '/usr/local/lib'")
 	if !strings.Contains(hint, "npm global prefix") {
 		t.Errorf("expected npm prefix hint on linux, got: %s", hint)
 	}
@@ -905,25 +749,16 @@ func TestPermissionHint(t *testing.T) {
 		t.Errorf("should not suggest raw sudo npm install, got: %s", hint)
 	}
 
-	// Linux + pnpm: EACCES should point at pnpm setup, not npm prefix/sudo.
-	pnpmHint := permissionHint("EACCES: permission denied, access '/Users/x/Library/pnpm'", "pnpm")
-	if !strings.Contains(pnpmHint, "pnpm setup") {
-		t.Errorf("expected pnpm setup hint, got: %s", pnpmHint)
-	}
-	if strings.Contains(pnpmHint, "npm global prefix") || strings.Contains(pnpmHint, "sudo") {
-		t.Errorf("pnpm hint must not reference npm prefix or sudo, got: %s", pnpmHint)
-	}
-
 	// Windows: EACCES hint is suppressed (no EACCES on Windows).
 	currentOS = "windows"
-	hint = permissionHint("EACCES: permission denied", "npm")
+	hint = permissionHint("EACCES: permission denied")
 	if hint != "" {
 		t.Errorf("expected empty hint on Windows, got: %s", hint)
 	}
 
 	// Non-EACCES error: always empty.
 	currentOS = "linux"
-	if got := permissionHint("some other error", "npm"); got != "" {
+	if got := permissionHint("some other error"); got != "" {
 		t.Errorf("expected empty hint for non-EACCES, got: %s", got)
 	}
 }
@@ -1187,7 +1022,6 @@ func TestRunSkillsAndState_DedupForceBypass(t *testing.T) {
 	}
 	called := false
 	updater := &selfupdate.Updater{
-		SkillsIndexFetchOverride: successfulSkillsIndexFetch(),
 		SkillsCommandOverride: func(args ...string) *selfupdate.NpmResult {
 			called = true
 			return successfulSkillsCommand()(args...)
@@ -1204,10 +1038,7 @@ func TestRunSkillsAndState_DedupForceBypass(t *testing.T) {
 
 func TestRunSkillsAndState_SuccessWritesState(t *testing.T) {
 	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
-	updater := &selfupdate.Updater{
-		SkillsIndexFetchOverride: successfulSkillsIndexFetch(),
-		SkillsCommandOverride:    successfulSkillsCommand(),
-	}
+	updater := &selfupdate.Updater{SkillsCommandOverride: successfulSkillsCommand()}
 	got := runSkillsAndState(updater, newTestIO(), "1.0.21", false)
 	if got == nil || got.Err != nil {
 		t.Fatalf("runSkillsAndState() = %+v, want non-nil with nil Err", got)
@@ -1227,7 +1058,6 @@ func TestRunSkillsAndState_FailureKeepsOldState(t *testing.T) {
 		t.Fatal(err)
 	}
 	updater := &selfupdate.Updater{
-		SkillsIndexFetchOverride: successfulSkillsIndexFetch(),
 		SkillsCommandOverride: func(args ...string) *selfupdate.NpmResult {
 			r := &selfupdate.NpmResult{}
 			r.Err = fmt.Errorf("npx failed")
@@ -1544,133 +1374,28 @@ func TestEmitSkillsTextHints_Success(t *testing.T) {
 	}
 }
 
-// liveSkillsIsolationEnv is the single source of truth for the user-state
-// directories a live skills test must redirect under the temporary home. It
-// covers the CLI's own config, the agent homes the skills CLI installs into,
-// the XDG dirs it derives paths from (XDG_STATE_HOME holds its global
-// .skill-lock.json), and the npm/npx overrides that take precedence over
-// HOME-derived defaults (both cases: npm reads npm_config_* case-insensitively).
-func liveSkillsIsolationEnv(home string) map[string]string {
-	return map[string]string{
-		"HOME":                     home,
-		"USERPROFILE":              home,
-		"APPDATA":                  filepath.Join(home, "AppData", "Roaming"),
-		"LOCALAPPDATA":             filepath.Join(home, "AppData", "Local"),
-		"XDG_CONFIG_HOME":          filepath.Join(home, ".config"),
-		"XDG_DATA_HOME":            filepath.Join(home, ".local", "share"),
-		"XDG_STATE_HOME":           filepath.Join(home, ".local", "state"),
-		"CODEX_HOME":               filepath.Join(home, ".codex"),
-		"CLAUDE_CONFIG_DIR":        filepath.Join(home, ".claude"),
-		"LARKSUITE_CLI_CONFIG_DIR": filepath.Join(home, ".lark-cli"),
-		"npm_config_cache":         filepath.Join(home, ".npm-cache"),
-		"NPM_CONFIG_CACHE":         filepath.Join(home, ".npm-cache"),
-		"npm_config_prefix":        filepath.Join(home, ".npm-global"),
-		"NPM_CONFIG_PREFIX":        filepath.Join(home, ".npm-global"),
-		"npm_config_userconfig":    filepath.Join(home, ".npmrc"),
-		"NPM_CONFIG_USERCONFIG":    filepath.Join(home, ".npmrc"),
-	}
-}
-
-func prepareLiveSkillsIntegration(t *testing.T) string {
-	t.Helper()
-	if os.Getenv(runLiveSkillsTestsEnv) != "1" {
-		t.Skipf("live skills integration test disabled; set %s=1 to run", runLiveSkillsTestsEnv)
-	}
-
-	home := t.TempDir()
-	for key, value := range liveSkillsIsolationEnv(home) {
-		t.Setenv(key, value)
-	}
-	return home
-}
-
-func TestPrepareLiveSkillsIntegration(t *testing.T) {
-	reachedAfterGate := false
-	t.Run("requires explicit opt-in", func(t *testing.T) {
-		t.Setenv(runLiveSkillsTestsEnv, "")
-		prepareLiveSkillsIntegration(t)
-		reachedAfterGate = true
-	})
-	if reachedAfterGate {
-		t.Fatal("prepareLiveSkillsIntegration continued without explicit opt-in")
-	}
-
-	t.Run("isolates user directories", func(t *testing.T) {
-		t.Setenv(runLiveSkillsTestsEnv, "1")
-		home := prepareLiveSkillsIntegration(t)
-		// Pin the isolation contract by key: removing a variable from
-		// liveSkillsIsolationEnv must fail this list, and every redirected
-		// value must live under the temporary home.
-		required := []string{
-			"HOME", "USERPROFILE", "APPDATA", "LOCALAPPDATA",
-			"XDG_CONFIG_HOME", "XDG_DATA_HOME", "XDG_STATE_HOME",
-			"CODEX_HOME", "CLAUDE_CONFIG_DIR", "LARKSUITE_CLI_CONFIG_DIR",
-			"npm_config_cache", "NPM_CONFIG_CACHE",
-			"npm_config_prefix", "NPM_CONFIG_PREFIX",
-			"npm_config_userconfig", "NPM_CONFIG_USERCONFIG",
-		}
-		env := liveSkillsIsolationEnv(home)
-		for _, key := range required {
-			expected, ok := env[key]
-			if !ok {
-				t.Errorf("liveSkillsIsolationEnv dropped required key %s", key)
-				continue
-			}
-			if !strings.HasPrefix(expected, home) {
-				t.Errorf("%s = %q escapes temporary home %q", key, expected, home)
-			}
-			if got := os.Getenv(key); got != expected {
-				t.Errorf("%s = %q, want %q", key, got, expected)
-			}
-		}
-	})
-}
-
-// seedLiveSkillsGlobal verifies the real npx skills CLI is reachable, installs
-// lark-calendar into the isolated global skills dir, and returns the parsed
-// global skills list. The caller opted in explicitly, so every missing
-// precondition is a hard failure — skipping would report "nothing verified"
-// as a green run.
-func seedLiveSkillsGlobal(t *testing.T) []string {
-	t.Helper()
+// TestUpdateCommand_RealSkillsSyncRewritesState is a live integration test that
+// verifies "lark-cli update" correctly triggers skills sync and rewrites the
+// state file. It calls the real npx skills CLI, so the test is skipped when
+// npx or the skills registry is unavailable (e.g. no network or fork PRs).
+func TestUpdateCommand_RealSkillsSyncRewritesState(t *testing.T) {
+	// Phase 1: Verify the real npx skills CLI is available; skip otherwise.
 	if _, err := exec.LookPath("npx"); err != nil {
-		t.Fatalf("live skills tests opted in but npx not found in PATH: %v", err)
+		t.Skipf("npx not found in PATH: %v", err)
 	}
-	// Three sequential npx runs against a cold cache (the isolated home starts
-	// empty) can be slow; with Fatal-on-timeout semantics the budget errs on
-	// the generous side.
-	ctx, cancel := context.WithTimeout(context.Background(), 180*time.Second)
+	ctx, cancel := context.WithTimeout(context.Background(), 45*time.Second)
 	defer cancel()
 	if err := exec.CommandContext(ctx, "npx", "-y", "skills", "add", "https://open.feishu.cn", "--list").Run(); err != nil {
-		t.Fatalf("live skills tests opted in but real skills CLI unavailable: %v", err)
-	}
-	if err := exec.CommandContext(ctx, "npx", "-y", "skills", "add", "https://open.feishu.cn", "-s", "lark-calendar", "-g", "-y").Run(); err != nil {
-		t.Fatalf("failed to seed isolated global skills: %v", err)
+		t.Skipf("real skills CLI unavailable: %v", err)
 	}
 	globalOut, err := exec.CommandContext(ctx, "npx", "-y", "skills", "ls", "-g").Output()
 	if err != nil {
-		t.Fatalf("real global skills CLI unavailable: %v", err)
+		t.Skipf("real global skills CLI unavailable: %v", err)
 	}
 	localSkills := skillscheck.ParseSkillsList(string(globalOut))
-	if len(localSkills) == 0 {
-		t.Fatal("seeded lark-calendar but global skills list is empty")
-	}
 	if err := ctx.Err(); err != nil {
-		t.Fatalf("real skills CLI availability check timed out: %v", err)
+		t.Skipf("real skills CLI availability check timed out: %v", err)
 	}
-	return localSkills
-}
-
-// TestUpdateCommand_RealSkillsSyncRewritesState is a live integration test that
-// verifies "lark-cli update" correctly triggers skills sync and rewrites the
-// state file. It calls the real npx skills CLI and only runs with explicit
-// opt-in. All user directories are redirected to a temporary home.
-func TestUpdateCommand_RealSkillsSyncRewritesState(t *testing.T) {
-	prepareLiveSkillsIntegration(t)
-
-	// Phase 1: Verify the real npx skills CLI is available and seed the
-	// isolated global skills install.
-	localSkills := seedLiveSkillsGlobal(t)
 
 	// Phase 2: Seed a previous sync state simulating an upgrade from v1.0.19.
 	// lark-doc and lark-mail are recorded as skipped/deleted, meaning the user
@@ -1766,17 +1491,26 @@ func TestUpdateCommand_RealSkillsSyncRewritesState(t *testing.T) {
 // not exist (cold start), the update command installs all official skills and
 // writes a fresh state file. No skill should appear in SkippedDeletedSkills
 // because there is no previous state to preserve user deletions from.
-// This is a live integration test that calls the real npx skills CLI and only
-// runs with explicit opt-in. All user directories are redirected to a temporary
-// home.
+// This is a live integration test that calls the real npx skills CLI; it is
+// skipped when npx or the skills registry is unavailable.
 func TestUpdateCommand_SkillsSyncColdStart(t *testing.T) {
-	prepareLiveSkillsIntegration(t)
-
-	// Phase 1: Verify the real npx skills CLI is available and seed one known
-	// official skill into the isolated global install. Cold start means no
-	// skills-state.json — locally installed skills may still exist, and seeding
-	// one keeps the Phase 4 per-skill assertions from running zero times.
-	localSkills := seedLiveSkillsGlobal(t)
+	// Phase 1: Verify the real npx skills CLI is available; skip otherwise.
+	if _, err := exec.LookPath("npx"); err != nil {
+		t.Skipf("npx not found in PATH: %v", err)
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), 45*time.Second)
+	defer cancel()
+	if err := exec.CommandContext(ctx, "npx", "-y", "skills", "add", "https://open.feishu.cn", "--list").Run(); err != nil {
+		t.Skipf("real skills CLI unavailable: %v", err)
+	}
+	globalOut, err := exec.CommandContext(ctx, "npx", "-y", "skills", "ls", "-g").Output()
+	if err != nil {
+		t.Skipf("real global skills CLI unavailable: %v", err)
+	}
+	localSkills := skillscheck.ParseSkillsList(string(globalOut))
+	if err := ctx.Err(); err != nil {
+		t.Skipf("real skills CLI availability check timed out: %v", err)
+	}
 
 	// Phase 2: Use an isolated config dir with no pre-existing skills-state.json.
 	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
@@ -1860,64 +1594,3 @@ func containsString(values []string, target string) bool {
 	}
 	return false
 }
-
-func TestResolveSkillsBrand_LayeredFallback(t *testing.T) {
-	// Layer 1: resolved config wins.
-	var errBuf bytes.Buffer
-	f := &cmdutil.Factory{Config: func() (*core.CliConfig, error) {
-		return &core.CliConfig{Brand: core.LarkBrand(" LARK ")}, nil
-	}}
-	if got := resolveSkillsBrand(f, &errBuf); got != core.BrandLark {
-		t.Errorf("resolved-config brand = %q, want lark", got)
-	}
-
-	// Layer 2: credential resolution fails, raw config file still supplies the
-	// brand (a locked keychain must not flip a Lark profile to Feishu).
-	tmp := t.TempDir()
-	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", tmp)
-	raw := `{"apps":[{"appId":"cli_x","appSecret":"test-secret","brand":"lark","users":[]}]}`
-	if err := os.WriteFile(filepath.Join(tmp, "config.json"), []byte(raw), 0600); err != nil {
-		t.Fatal(err)
-	}
-	f = &cmdutil.Factory{Config: func() (*core.CliConfig, error) { return nil, errors.New("keychain locked") }}
-	errBuf.Reset()
-	if got := resolveSkillsBrand(f, &errBuf); got != core.BrandLark {
-		t.Errorf("raw-config brand = %q, want lark", got)
-	}
-	if errBuf.Len() != 0 {
-		t.Errorf("unexpected notice when raw config supplied the brand: %q", errBuf.String())
-	}
-
-	// Layer 3: nothing readable → default brand with a notice.
-	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
-	errBuf.Reset()
-	if got := resolveSkillsBrand(f, &errBuf); got != core.BrandFeishu {
-		t.Errorf("fallback brand = %q, want feishu", got)
-	}
-	if !strings.Contains(errBuf.String(), "could not resolve the configured brand") {
-		t.Errorf("expected fallback notice, got %q", errBuf.String())
-	}
-}
-
-// The raw-config fallback must read the active profile, not the default one.
-func TestResolveSkillsBrand_RespectsActiveProfile(t *testing.T) {
-	tmp := t.TempDir()
-	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", tmp)
-	raw := `{"currentApp":"feishu-app","apps":[` +
-		`{"name":"feishu-app","appId":"cli_f","appSecret":"test-secret","brand":"feishu","users":[]},` +
-		`{"name":"lark-prof","appId":"cli_l","appSecret":"test-secret","brand":"lark","users":[]}]}`
-	if err := os.WriteFile(filepath.Join(tmp, "config.json"), []byte(raw), 0600); err != nil {
-		t.Fatal(err)
-	}
-	f := &cmdutil.Factory{
-		Invocation: cmdutil.InvocationContext{Profile: "lark-prof"},
-		Config:     func() (*core.CliConfig, error) { return nil, errors.New("keychain locked") },
-	}
-	var errBuf bytes.Buffer
-	if got := resolveSkillsBrand(f, &errBuf); got != core.BrandLark {
-		t.Errorf("brand = %q, want lark (the active profile's brand)", got)
-	}
-	if errBuf.Len() != 0 {
-		t.Errorf("unexpected notice: %q", errBuf.String())
-	}
-}

errs/ERROR_CONTRACT.md

@@ -72,28 +72,6 @@ other category. `error.type` is `"policy"`, `error.subtype` is one of
 `challenge_required` / `access_denied`, and process exit is `6` via
 `CategoryPolicy`.
 
-### Success envelope (stdout)
-
-For contrast: success responses render to **stdout** as an
-`output.Envelope` (`internal/output/envelope.go`), exit code `0`:
-
-```json
-{
-  "ok": true,
-  "identity": "user",
-  "data": { "guid": "e297d3d0-..." },
-  "meta": { "count": 1 }
-}
-```
-
-Consumers must branch on `ok` (or the process exit code). The success
-envelope has **no top-level `code` or `msg` field** — `code` exists only
-inside `error`, where it is the upstream numeric code (invariant 4).
-Wrappers that follow the raw OpenAPI convention and test `code == 0`
-will misclassify every successful call as a failure, which is
-especially dangerous around write commands (e.g. retrying a create that
-already succeeded).
-
 ## Categories
 
 | Category | When | Exit | Typed struct |

events/application/menu.go

@@ -1,107 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package application
-
-import (
-	"context"
-	"encoding/json"
-	"strings"
-
-	"github.com/larksuite/cli/internal/event"
-)
-
-// BotMenuOutput is the flattened shape for application.bot.menu_v6.
-type BotMenuOutput struct {
-	Type            string `json:"type"                         desc:"Event type; always application.bot.menu_v6"`
-	EventID         string `json:"event_id,omitempty"           desc:"Globally unique event ID; safe for deduplication"`
-	Timestamp       string `json:"timestamp,omitempty"          desc:"Event delivery time (ms timestamp string); prefers header.create_time" kind:"timestamp_ms"`
-	AppID           string `json:"app_id,omitempty"             desc:"Application ID from the event header"`
-	TenantKey       string `json:"tenant_key,omitempty"         desc:"Tenant key from the event header"`
-	EventKey        string `json:"event_key,omitempty"          desc:"Developer-defined bot menu event key"`
-	MenuTimestamp   string `json:"menu_timestamp,omitempty"     desc:"Menu click timestamp from the event body"                           kind:"timestamp_ms"`
-	OperatorID      string `json:"operator_id,omitempty"        desc:"Operator open_id; kept as a short alias of operator_open_id"        kind:"open_id"`
-	OperatorOpenID  string `json:"operator_open_id,omitempty"   desc:"Operator open_id"                                                   kind:"open_id"`
-	OperatorUnionID string `json:"operator_union_id,omitempty"  desc:"Operator union_id"                                                  kind:"union_id"`
-	OperatorUserID  string `json:"operator_user_id,omitempty"   desc:"Operator user_id"                                                   kind:"user_id"`
-	OperatorName    string `json:"operator_name,omitempty"      desc:"Operator display name"`
-}
-
-func processBotMenu(_ context.Context, _ event.APIClient, raw *event.RawEvent, _ map[string]string) (json.RawMessage, error) {
-	var envelope struct {
-		Header struct {
-			EventID    string `json:"event_id"`
-			EventType  string `json:"event_type"`
-			CreateTime string `json:"create_time"`
-			AppID      string `json:"app_id"`
-			TenantKey  string `json:"tenant_key"`
-		} `json:"header"`
-		Event struct {
-			EventKey  string          `json:"event_key"`
-			Timestamp json.RawMessage `json:"timestamp"`
-			Operator  struct {
-				OperatorID struct {
-					OpenID  string `json:"open_id"`
-					UnionID string `json:"union_id"`
-					UserID  string `json:"user_id"`
-				} `json:"operator_id"`
-				OperatorName string `json:"operator_name"`
-			} `json:"operator"`
-		} `json:"event"`
-	}
-	if err := json.Unmarshal(raw.Payload, &envelope); err != nil {
-		return raw.Payload, nil //nolint:nilerr // passthrough on malformed payload so consumers still see the event
-	}
-
-	menuTimestamp := timestampMillisString(envelope.Event.Timestamp)
-	timestamp := envelope.Header.CreateTime
-	if timestamp == "" {
-		timestamp = menuTimestamp
-	}
-	operatorID := envelope.Event.Operator.OperatorID.OpenID
-
-	out := &BotMenuOutput{
-		Type:            eventTypeBotMenuV6,
-		EventID:         envelope.Header.EventID,
-		Timestamp:       timestamp,
-		AppID:           envelope.Header.AppID,
-		TenantKey:       envelope.Header.TenantKey,
-		EventKey:        envelope.Event.EventKey,
-		MenuTimestamp:   menuTimestamp,
-		OperatorID:      operatorID,
-		OperatorOpenID:  operatorID,
-		OperatorUnionID: envelope.Event.Operator.OperatorID.UnionID,
-		OperatorUserID:  envelope.Event.Operator.OperatorID.UserID,
-		OperatorName:    envelope.Event.Operator.OperatorName,
-	}
-	return json.Marshal(out)
-}
-
-func rawScalarString(raw json.RawMessage) string {
-	s := strings.TrimSpace(string(raw))
-	if s == "" || s == "null" {
-		return ""
-	}
-	var text string
-	if err := json.Unmarshal(raw, &text); err == nil {
-		return text
-	}
-	return s
-}
-
-func timestampMillisString(raw json.RawMessage) string {
-	s := rawScalarString(raw)
-	if len(s) == 10 && allDigits(s) {
-		return s + "000"
-	}
-	return s
-}
-
-func allDigits(s string) bool {
-	for _, r := range s {
-		if r < '0' || r > '9' {
-			return false
-		}
-	}
-	return s != ""
-}

events/application/menu_test.go

@@ -1,227 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package application
-
-import (
-	"context"
-	"encoding/json"
-	"reflect"
-	"testing"
-	"time"
-
-	"github.com/larksuite/cli/internal/event"
-)
-
-func TestKeysBotMenuMetadata(t *testing.T) {
-	keys := Keys()
-	if len(keys) != 1 {
-		t.Fatalf("len(Keys()) = %d, want 1", len(keys))
-	}
-
-	def := keys[0]
-	if def.Key != eventTypeBotMenuV6 {
-		t.Errorf("Key = %q, want %q", def.Key, eventTypeBotMenuV6)
-	}
-	if def.EventType != eventTypeBotMenuV6 {
-		t.Errorf("EventType = %q, want %q", def.EventType, eventTypeBotMenuV6)
-	}
-	if def.SubscriptionType != "" {
-		t.Errorf("SubscriptionType = %q, want default event subscription", def.SubscriptionType)
-	}
-	if def.Schema.Custom == nil {
-		t.Fatal("Schema.Custom is nil")
-	}
-	if def.Schema.Custom.Type != reflect.TypeOf(BotMenuOutput{}) {
-		t.Errorf("custom type = %v, want BotMenuOutput", def.Schema.Custom.Type)
-	}
-	if def.Schema.Native != nil {
-		t.Fatal("Schema.Native must be nil for processed output")
-	}
-	if def.Process == nil {
-		t.Fatal("Process is nil")
-	}
-	if !reflect.DeepEqual(def.AuthTypes, []string{"bot"}) {
-		t.Errorf("AuthTypes = %#v", def.AuthTypes)
-	}
-	if !reflect.DeepEqual(def.RequiredConsoleEvents, []string{eventTypeBotMenuV6}) {
-		t.Errorf("RequiredConsoleEvents = %#v", def.RequiredConsoleEvents)
-	}
-}
-
-func TestBotMenuRegistersCleanly(t *testing.T) {
-	const key = eventTypeBotMenuV6
-	event.UnregisterKeyForTest(key)
-	t.Cleanup(func() { event.UnregisterKeyForTest(key) })
-
-	for _, def := range Keys() {
-		event.RegisterKey(def)
-	}
-	if _, ok := event.Lookup(key); !ok {
-		t.Fatalf("event.Lookup(%q) not registered", key)
-	}
-}
-
-func TestProcessBotMenu(t *testing.T) {
-	payload := `{
-		"schema": "2.0",
-		"header": {
-			"event_id": "ev_menu_001",
-			"event_type": "application.bot.menu_v6",
-			"create_time": "1776409469273",
-			"app_id": "cli_test",
-			"tenant_key": "tenant_test"
-		},
-		"event": {
-			"event_key": "start_eval",
-			"timestamp": 1776409469000,
-			"operator": {
-				"operator_id": {
-					"open_id": "ou_operator",
-					"union_id": "on_operator",
-					"user_id": "user_operator"
-				},
-				"operator_name": "Test User"
-			}
-		}
-	}`
-	out := runBotMenu(t, payload)
-
-	if out.Type != eventTypeBotMenuV6 {
-		t.Errorf("Type = %q, want %q", out.Type, eventTypeBotMenuV6)
-	}
-	if out.EventID != "ev_menu_001" {
-		t.Errorf("EventID = %q", out.EventID)
-	}
-	if out.Timestamp != "1776409469273" {
-		t.Errorf("Timestamp = %q", out.Timestamp)
-	}
-	if out.EventKey != "start_eval" {
-		t.Errorf("EventKey = %q", out.EventKey)
-	}
-	if out.MenuTimestamp != "1776409469000" {
-		t.Errorf("MenuTimestamp = %q", out.MenuTimestamp)
-	}
-	if out.OperatorID != "ou_operator" || out.OperatorOpenID != "ou_operator" {
-		t.Errorf("OperatorID/OperatorOpenID = %q/%q", out.OperatorID, out.OperatorOpenID)
-	}
-	if out.OperatorUnionID != "on_operator" {
-		t.Errorf("OperatorUnionID = %q", out.OperatorUnionID)
-	}
-	if out.OperatorUserID != "user_operator" {
-		t.Errorf("OperatorUserID = %q", out.OperatorUserID)
-	}
-	if out.OperatorName != "Test User" {
-		t.Errorf("OperatorName = %q", out.OperatorName)
-	}
-	if out.AppID != "cli_test" || out.TenantKey != "tenant_test" {
-		t.Errorf("AppID/TenantKey = %q/%q", out.AppID, out.TenantKey)
-	}
-}
-
-func TestProcessBotMenuStringTimestampFallback(t *testing.T) {
-	payload := `{
-		"schema": "2.0",
-		"header": {
-			"event_id": "ev_menu_002",
-			"event_type": "application.bot.menu_v6"
-		},
-		"event": {
-			"event_key": "start_eval",
-			"timestamp": "1776409469001",
-			"operator": {
-				"operator_id": {"open_id": "ou_operator"}
-			}
-		}
-	}`
-	out := runBotMenu(t, payload)
-
-	if out.Timestamp != "1776409469001" {
-		t.Errorf("Timestamp fallback = %q", out.Timestamp)
-	}
-	if out.MenuTimestamp != "1776409469001" {
-		t.Errorf("MenuTimestamp = %q", out.MenuTimestamp)
-	}
-}
-
-func TestProcessBotMenuSecondsTimestampFallback(t *testing.T) {
-	payload := `{
-		"schema": "2.0",
-		"header": {
-			"event_id": "ev_menu_seconds",
-			"event_type": "application.bot.menu_v6"
-		},
-		"event": {
-			"event_key": "start_eval",
-			"timestamp": 1694592375,
-			"operator": {
-				"operator_id": {"open_id": "ou_operator"}
-			}
-		}
-	}`
-	out := runBotMenu(t, payload)
-
-	if out.Timestamp != "1694592375000" {
-		t.Errorf("Timestamp fallback = %q, want seconds normalized to milliseconds", out.Timestamp)
-	}
-	if out.MenuTimestamp != "1694592375000" {
-		t.Errorf("MenuTimestamp = %q, want seconds normalized to milliseconds", out.MenuTimestamp)
-	}
-}
-
-func TestProcessBotMenuTypeUsesLocalConstant(t *testing.T) {
-	payload := `{
-		"schema": "2.0",
-		"header": {
-			"event_id": "ev_menu_003",
-			"event_type": "unexpected.event_type",
-			"create_time": "1776409469275"
-		},
-		"event": {
-			"event_key": "start_eval",
-			"operator": {
-				"operator_id": {"open_id": "ou_operator"}
-			}
-		}
-	}`
-	out := runBotMenu(t, payload)
-
-	if out.Type != eventTypeBotMenuV6 {
-		t.Errorf("Type = %q, want %q", out.Type, eventTypeBotMenuV6)
-	}
-}
-
-func TestProcessBotMenuMalformedPayload(t *testing.T) {
-	raw := &event.RawEvent{
-		EventID:   "ev_bad",
-		EventType: eventTypeBotMenuV6,
-		Payload:   json.RawMessage(`not json`),
-		Timestamp: time.Now(),
-	}
-	got, err := processBotMenu(context.Background(), nil, raw, nil)
-	if err != nil {
-		t.Fatalf("Process should swallow parse errors, got %v", err)
-	}
-	if string(got) != "not json" {
-		t.Errorf("malformed fallback output = %q, want original bytes", string(got))
-	}
-}
-
-func runBotMenu(t *testing.T, payload string) BotMenuOutput {
-	t.Helper()
-	raw := &event.RawEvent{
-		EventID:   "ev_test",
-		EventType: eventTypeBotMenuV6,
-		Payload:   json.RawMessage(payload),
-		Timestamp: time.Now(),
-	}
-	got, err := processBotMenu(context.Background(), nil, raw, nil)
-	if err != nil {
-		t.Fatalf("processBotMenu: %v", err)
-	}
-	var out BotMenuOutput
-	if err := json.Unmarshal(got, &out); err != nil {
-		t.Fatalf("unmarshal output: %v\n%s", err, got)
-	}
-	return out
-}

events/application/register.go

@@ -1,31 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-// Package application registers Application-domain EventKeys.
-package application
-
-import (
-	"reflect"
-
-	"github.com/larksuite/cli/internal/event"
-)
-
-const eventTypeBotMenuV6 = "application.bot.menu_v6"
-
-// Keys returns all Application-domain EventKey definitions.
-func Keys() []event.KeyDefinition {
-	return []event.KeyDefinition{
-		{
-			Key:         eventTypeBotMenuV6,
-			DisplayName: "Bot menu",
-			Description: "Triggered when a user clicks a custom bot menu item whose action is configured as a push event.",
-			EventType:   eventTypeBotMenuV6,
-			Schema: event.SchemaDef{
-				Custom: &event.SchemaSpec{Type: reflect.TypeOf(BotMenuOutput{})},
-			},
-			Process:               processBotMenu,
-			AuthTypes:             []string{"bot"},
-			RequiredConsoleEvents: []string{eventTypeBotMenuV6},
-		},
-	}
-}

events/approval/preconsume.go

@@ -1,155 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package approval
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"strings"
-
-	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/event"
-)
-
-type approvalEventType string
-type approvalSubscriptionPath string
-
-type approvalSubscriptionConfig struct {
-	eventType     approvalEventType
-	subscribePath approvalSubscriptionPath
-}
-
-func approvalSubscriptionPreConsume(cfg approvalSubscriptionConfig) func(context.Context, event.APIClient, map[string]string) (func() error, error) {
-	return func(ctx context.Context, rt event.APIClient, params map[string]string) (func() error, error) {
-		if rt == nil {
-			return nil, errs.NewInternalError(errs.SubtypeUnknown,
-				"runtime API client is required for pre-consume subscription")
-		}
-
-		eventType := string(cfg.eventType)
-		subscribePath := string(cfg.subscribePath)
-		subscriptionTypes, err := approvalSubscriptionTypes(eventType, params)
-		if err != nil {
-			return nil, err
-		}
-
-		registered := make([]string, 0, len(subscriptionTypes))
-		for _, subscriptionType := range subscriptionTypes {
-			body := map[string]string{"subscription_type": subscriptionType}
-			if _, err := rt.CallAPI(ctx, "POST", subscribePath, body); err != nil {
-				return nil, approvalSubscriptionRegistrationError(eventType, registered, subscriptionType, err)
-			}
-			registered = append(registered, subscriptionType)
-		}
-
-		// Approval subscriptions are durable user-auth relations. Consuming events
-		// should not cancel that relation when this local process exits.
-		return nil, nil
-	}
-}
-
-func approvalSubscriptionTypes(eventType string, params map[string]string) ([]string, error) {
-	raw := strings.TrimSpace(params["subscription_type"])
-	if raw == "" {
-		return append([]string(nil), approvalAllSubscriptionTypes...), nil
-	}
-
-	values, err := parseApprovalSubscriptionTypeValues(raw)
-	if err != nil {
-		return nil, invalidApprovalSubscriptionTypeError(eventType, raw)
-	}
-
-	selected := make(map[string]bool, len(values))
-	for _, value := range values {
-		value = strings.TrimSpace(value)
-		switch value {
-		case approvalSubscriptionTypeInvolved, approvalSubscriptionTypeManaged:
-			selected[value] = true
-		default:
-			return nil, invalidApprovalSubscriptionTypeError(eventType, value)
-		}
-	}
-
-	result := make([]string, 0, len(selected))
-	for _, value := range approvalAllSubscriptionTypes {
-		if selected[value] {
-			result = append(result, value)
-		}
-	}
-	if len(result) == 0 {
-		return nil, invalidApprovalSubscriptionTypeError(eventType, raw)
-	}
-	return result, nil
-}
-
-func parseApprovalSubscriptionTypeValues(raw string) ([]string, error) {
-	if strings.HasPrefix(raw, "[") {
-		var values []string
-		if err := json.Unmarshal([]byte(raw), &values); err != nil {
-			return nil, err
-		}
-		return values, nil
-	}
-	return strings.Split(raw, ","), nil
-}
-
-func approvalSubscriptionRegistrationError(eventType string, registered []string, failed string, err error) error {
-	if err == nil {
-		return nil
-	}
-
-	msg := fmt.Sprintf(
-		"approval subscription pre-consume failed for EventKey %s: failed subscription_type %s",
-		eventType,
-		failed,
-	)
-	hint := fmt.Sprintf(
-		"no approval subscription relation was registered for EventKey %s; fix the cause and retry",
-		eventType,
-	)
-	if len(registered) > 0 {
-		msg = fmt.Sprintf(
-			"approval subscription pre-consume partially completed for EventKey %s: registered subscription_type(s) [%s], failed subscription_type %s",
-			eventType,
-			strings.Join(registered, ", "),
-			failed,
-		)
-		hint = fmt.Sprintf(
-			"server-side approval subscription relation(s) already registered for EventKey %s: %s; after fixing the cause, retry with --param subscription_type=%s to register the failed relation",
-			eventType,
-			strings.Join(registered, ", "),
-			failed,
-		)
-	}
-
-	if p, ok := errs.ProblemOf(err); ok {
-		if upstream := strings.TrimSpace(p.Message); upstream != "" {
-			p.Message = msg + ": " + upstream
-		} else {
-			p.Message = msg
-		}
-		if upstreamHint := strings.TrimSpace(p.Hint); upstreamHint != "" {
-			p.Hint = upstreamHint + "\n" + hint
-		} else {
-			p.Hint = hint
-		}
-		return err
-	}
-	return errs.NewInternalError(errs.SubtypeSDKError, "%s: %v", msg, err).
-		WithHint("%s", hint).
-		WithCause(err)
-}
-
-func invalidApprovalSubscriptionTypeError(eventType, value string) error {
-	return errs.NewValidationError(errs.SubtypeInvalidArgument,
-		"invalid subscription_type for EventKey %s: %q", eventType, value).
-		WithParam("--param").
-		WithHint("omit subscription_type to register both approval subscription relations, or pass --param subscription_type=%s, --param subscription_type=%s, or --param subscription_type=%s,%s; run `lark-cli event schema %s` for details",
-			approvalSubscriptionTypeInvolved,
-			approvalSubscriptionTypeManaged,
-			approvalSubscriptionTypeInvolved,
-			approvalSubscriptionTypeManaged,
-			eventType)
-}

events/approval/register.go

@@ -1,179 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-// Package approval registers Approval-domain EventKeys.
-package approval
-
-import (
-	"context"
-	"encoding/json"
-	"reflect"
-
-	"github.com/larksuite/cli/internal/event"
-)
-
-const (
-	eventTypeApprovalInstanceStatusChangedV4 = "approval.instance.status_changed_v4"
-	eventTypeApprovalTaskStatusChangedV4     = "approval.task.status_changed_v4"
-
-	pathApprovalInstancesSubscription = "/open-apis/approval/v4/instances/subscription"
-	pathApprovalTasksSubscription     = "/open-apis/approval/v4/tasks/subscription"
-
-	approvalSubscriptionTypeInvolved = "INVOLVED_APPROVAL"
-	approvalSubscriptionTypeManaged  = "MANAGED_APPROVAL"
-)
-
-var approvalAllSubscriptionTypes = []string{
-	approvalSubscriptionTypeInvolved,
-	approvalSubscriptionTypeManaged,
-}
-
-// Keys returns all Approval-domain EventKey definitions.
-func Keys() []event.KeyDefinition {
-	return []event.KeyDefinition{
-		{
-			Key:         eventTypeApprovalInstanceStatusChangedV4,
-			DisplayName: "Approval instance status changed",
-			Description: "Triggered after an approval instance status becomes visible to the requester or approval participants",
-			EventType:   eventTypeApprovalInstanceStatusChangedV4,
-			Params:      approvalSubscriptionParams(),
-			Schema: event.SchemaDef{
-				Custom: &event.SchemaSpec{Type: reflect.TypeOf(ApprovalInstanceStatusChangedV4Output{})},
-			},
-			Process: processApprovalInstanceStatusChanged,
-			PreConsume: approvalSubscriptionPreConsume(approvalSubscriptionConfig{
-				eventType:     eventTypeApprovalInstanceStatusChangedV4,
-				subscribePath: pathApprovalInstancesSubscription,
-			}),
-			Scopes: []string{"approval:instance:read"},
-			AuthTypes: []string{
-				"user",
-			},
-			RequiredConsoleEvents: []string{eventTypeApprovalInstanceStatusChangedV4},
-		},
-		{
-			Key:         eventTypeApprovalTaskStatusChangedV4,
-			DisplayName: "Approval task status changed",
-			Description: "Triggered after an approval task status becomes visible to the requester or task approver",
-			EventType:   eventTypeApprovalTaskStatusChangedV4,
-			Params:      approvalSubscriptionParams(),
-			Schema: event.SchemaDef{
-				Custom: &event.SchemaSpec{Type: reflect.TypeOf(ApprovalTaskStatusChangedV4Output{})},
-			},
-			Process: processApprovalTaskStatusChanged,
-			PreConsume: approvalSubscriptionPreConsume(approvalSubscriptionConfig{
-				eventType:     eventTypeApprovalTaskStatusChangedV4,
-				subscribePath: pathApprovalTasksSubscription,
-			}),
-			Scopes: []string{"approval:task:read"},
-			AuthTypes: []string{
-				"user",
-			},
-			RequiredConsoleEvents: []string{eventTypeApprovalTaskStatusChangedV4},
-		},
-	}
-}
-
-func approvalSubscriptionParams() []event.ParamDef {
-	return []event.ParamDef{
-		{
-			Name:        "subscription_type",
-			Type:        event.ParamMulti,
-			Description: "Approval subscription relation type(s) to register for the current authorized user. Omit to register both involved and managed approval relations.",
-			Values: []event.ParamValue{
-				{
-					Value: approvalSubscriptionTypeInvolved,
-					Desc:  "Receive events where the current user is the approval requester or approver.",
-				},
-				{
-					Value: approvalSubscriptionTypeManaged,
-					Desc:  "Receive events under approval definitions managed by the current user.",
-				},
-			},
-		},
-	}
-}
-
-func processApprovalInstanceStatusChanged(_ context.Context, _ event.APIClient, raw *event.RawEvent, _ map[string]string) (json.RawMessage, error) {
-	if raw == nil {
-		return nil, nil
-	}
-	var envelope struct {
-		Header struct {
-			EventID    string `json:"event_id"`
-			EventType  string `json:"event_type"`
-			CreateTime string `json:"create_time"`
-		} `json:"header"`
-		Event struct {
-			ApprovalCode string          `json:"approval_code"`
-			InstanceCode string          `json:"instance_code"`
-			ExternalID   string          `json:"external_id"`
-			Status       string          `json:"status"`
-			OperateTime  string          `json:"operate_time"`
-			StartUser    *ApprovalUserID `json:"start_user"`
-		} `json:"event"`
-	}
-	if err := json.Unmarshal(raw.Payload, &envelope); err != nil {
-		return raw.Payload, nil //nolint:nilerr // passthrough on malformed payload so consumers still see the event
-	}
-
-	out := &ApprovalInstanceStatusChangedV4Output{
-		Type:         envelope.Header.EventType,
-		EventID:      envelope.Header.EventID,
-		Timestamp:    envelope.Header.CreateTime,
-		ApprovalCode: envelope.Event.ApprovalCode,
-		InstanceCode: envelope.Event.InstanceCode,
-		ExternalID:   envelope.Event.ExternalID,
-		Status:       envelope.Event.Status,
-		OperateTime:  envelope.Event.OperateTime,
-		StartUser:    envelope.Event.StartUser,
-	}
-	if out.Type == "" {
-		out.Type = raw.EventType
-	}
-	return json.Marshal(out)
-}
-
-func processApprovalTaskStatusChanged(_ context.Context, _ event.APIClient, raw *event.RawEvent, _ map[string]string) (json.RawMessage, error) {
-	if raw == nil {
-		return nil, nil
-	}
-	var envelope struct {
-		Header struct {
-			EventID    string `json:"event_id"`
-			EventType  string `json:"event_type"`
-			CreateTime string `json:"create_time"`
-		} `json:"header"`
-		Event struct {
-			ApprovalCode   string          `json:"approval_code"`
-			InstanceCode   string          `json:"instance_code"`
-			TaskID         string          `json:"task_id"`
-			ExternalID     string          `json:"external_id"`
-			TaskExternalID string          `json:"task_external_id"`
-			AssignedUser   *ApprovalUserID `json:"assigned_user"`
-			Status         string          `json:"status"`
-			OperateTime    string          `json:"operate_time"`
-		} `json:"event"`
-	}
-	if err := json.Unmarshal(raw.Payload, &envelope); err != nil {
-		return raw.Payload, nil //nolint:nilerr // passthrough on malformed payload so consumers still see the event
-	}
-
-	out := &ApprovalTaskStatusChangedV4Output{
-		Type:           envelope.Header.EventType,
-		EventID:        envelope.Header.EventID,
-		Timestamp:      envelope.Header.CreateTime,
-		ApprovalCode:   envelope.Event.ApprovalCode,
-		InstanceCode:   envelope.Event.InstanceCode,
-		TaskID:         envelope.Event.TaskID,
-		ExternalID:     envelope.Event.ExternalID,
-		TaskExternalID: envelope.Event.TaskExternalID,
-		AssignedUser:   envelope.Event.AssignedUser,
-		Status:         envelope.Event.Status,
-		OperateTime:    envelope.Event.OperateTime,
-	}
-	if out.Type == "" {
-		out.Type = raw.EventType
-	}
-	return json.Marshal(out)
-}

events/approval/register_test.go

@@ -1,654 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package approval
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"reflect"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/event"
-	"github.com/larksuite/cli/internal/event/schemas"
-)
-
-type recordedCall struct {
-	method string
-	path   string
-	body   interface{}
-}
-
-type fakeAPIClient struct {
-	calls     []recordedCall
-	err       error
-	errOnCall int
-}
-
-func (f *fakeAPIClient) CallAPI(_ context.Context, method, path string, body interface{}) (json.RawMessage, error) {
-	f.calls = append(f.calls, recordedCall{method: method, path: path, body: body})
-	if f.err != nil && (f.errOnCall == 0 || f.errOnCall == len(f.calls)) {
-		return nil, f.err
-	}
-	return json.RawMessage(`{}`), nil
-}
-
-func TestKeysApprovalMetadata(t *testing.T) {
-	keys := Keys()
-	if len(keys) != 2 {
-		t.Fatalf("len(Keys()) = %d, want 2", len(keys))
-	}
-
-	tests := []struct {
-		key        string
-		scope      string
-		schemaType reflect.Type
-		subscribe  string
-	}{
-		{
-			key:        eventTypeApprovalInstanceStatusChangedV4,
-			scope:      "approval:instance:read",
-			schemaType: reflect.TypeOf(ApprovalInstanceStatusChangedV4Output{}),
-			subscribe:  pathApprovalInstancesSubscription,
-		},
-		{
-			key:        eventTypeApprovalTaskStatusChangedV4,
-			scope:      "approval:task:read",
-			schemaType: reflect.TypeOf(ApprovalTaskStatusChangedV4Output{}),
-			subscribe:  pathApprovalTasksSubscription,
-		},
-	}
-
-	byKey := make(map[string]event.KeyDefinition, len(keys))
-	for _, def := range keys {
-		byKey[def.Key] = def
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.key, func(t *testing.T) {
-			def, ok := byKey[tc.key]
-			if !ok {
-				t.Fatalf("missing key %s", tc.key)
-			}
-			if def.EventType != tc.key {
-				t.Errorf("EventType = %q, want %q", def.EventType, tc.key)
-			}
-			if def.Schema.Custom == nil || def.Schema.Custom.Type != tc.schemaType {
-				t.Fatalf("Custom schema Type = %v, want %v", def.Schema.Custom, tc.schemaType)
-			}
-			if def.Schema.Native != nil {
-				t.Fatal("approval events must use Custom schema while SDK event types are not exported")
-			}
-			if def.Process == nil {
-				t.Fatal("Process must flatten raw V2 envelopes")
-			}
-			if def.PreConsume == nil {
-				t.Fatal("PreConsume must subscribe approval user-auth events")
-			}
-			if !reflect.DeepEqual(def.Scopes, []string{tc.scope}) {
-				t.Errorf("Scopes = %#v, want %q", def.Scopes, tc.scope)
-			}
-			if !reflect.DeepEqual(def.AuthTypes, []string{"user"}) {
-				t.Errorf("AuthTypes = %#v, want user", def.AuthTypes)
-			}
-			if !reflect.DeepEqual(def.RequiredConsoleEvents, []string{tc.key}) {
-				t.Errorf("RequiredConsoleEvents = %#v, want %q", def.RequiredConsoleEvents, tc.key)
-			}
-			assertSubscriptionParam(t, def.Params)
-		})
-	}
-}
-
-func assertSubscriptionParam(t *testing.T, params []event.ParamDef) {
-	t.Helper()
-	if len(params) != 1 {
-		t.Fatalf("len(params) = %d, want 1", len(params))
-	}
-	p := params[0]
-	if p.Name != "subscription_type" || p.Type != event.ParamMulti || p.Required || p.SubscriptionKey {
-		t.Fatalf("subscription_type param = %+v, want optional multi non-subscription-key param", p)
-	}
-	got := map[string]string{}
-	for _, v := range p.Values {
-		got[v.Value] = v.Desc
-	}
-	for _, want := range []string{approvalSubscriptionTypeInvolved, approvalSubscriptionTypeManaged} {
-		if got[want] == "" {
-			t.Errorf("subscription_type value %q missing or empty desc; values=%+v", want, p.Values)
-		}
-	}
-}
-
-type reflectedApprovalSchema struct {
-	Properties map[string]reflectedApprovalSchemaProperty `json:"properties"`
-}
-
-type reflectedApprovalSchemaProperty struct {
-	Format     string                                     `json:"format"`
-	Enum       []string                                   `json:"enum"`
-	Properties map[string]reflectedApprovalSchemaProperty `json:"properties"`
-}
-
-func TestApprovalSchemasAnnotations(t *testing.T) {
-	tests := []struct {
-		name         string
-		schemaType   reflect.Type
-		eventType    string
-		statusValues []string
-		userField    string
-	}{
-		{
-			name:         "instance",
-			schemaType:   reflect.TypeOf(ApprovalInstanceStatusChangedV4Output{}),
-			eventType:    eventTypeApprovalInstanceStatusChangedV4,
-			statusValues: []string{"PENDING", "APPROVED", "REJECTED", "CANCELED", "DELETED", "REVERTED", "OVERTIME_CLOSE", "OVERTIME_RECOVER"},
-			userField:    "start_user",
-		},
-		{
-			name:         "task",
-			schemaType:   reflect.TypeOf(ApprovalTaskStatusChangedV4Output{}),
-			eventType:    eventTypeApprovalTaskStatusChangedV4,
-			statusValues: []string{"REVERTED", "PENDING", "APPROVED", "REJECTED", "TRANSFERRED", "ROLLBACK", "DONE", "OVERTIME_CLOSE", "OVERTIME_RECOVER"},
-			userField:    "assigned_user",
-		},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			var schema reflectedApprovalSchema
-			if err := json.Unmarshal(schemas.FromType(tc.schemaType), &schema); err != nil {
-				t.Fatalf("unmarshal schema: %v", err)
-			}
-			props := schema.Properties
-			eventTypeEnum := props["type"].Enum
-			if len(eventTypeEnum) != 1 || eventTypeEnum[0] != tc.eventType {
-				t.Fatalf("type enum = %v, want %s", eventTypeEnum, tc.eventType)
-			}
-			if got := props["timestamp"].Format; got != "timestamp_ms" {
-				t.Errorf("timestamp format = %v, want timestamp_ms", got)
-			}
-			assertEnumContains(t, props["status"].Enum, tc.statusValues)
-			if got := props["operate_time"].Format; got != "timestamp_ms" {
-				t.Errorf("event.operate_time format = %v, want timestamp_ms", got)
-			}
-
-			userProps := props[tc.userField].Properties
-			if got := userProps["open_id"].Format; got != "open_id" {
-				t.Errorf("%s.open_id format = %v, want open_id", tc.userField, got)
-			}
-			if got := userProps["union_id"].Format; got != "union_id" {
-				t.Errorf("%s.union_id format = %v, want union_id", tc.userField, got)
-			}
-			if got := userProps["user_id"].Format; got != "user_id" {
-				t.Errorf("%s.user_id format = %v, want user_id", tc.userField, got)
-			}
-		})
-	}
-}
-
-func assertEnumContains(t *testing.T, raw []string, wants []string) {
-	t.Helper()
-	got := make(map[string]bool, len(raw))
-	for _, v := range raw {
-		got[v] = true
-	}
-	for _, want := range wants {
-		if !got[want] {
-			t.Errorf("enum missing %q; enum=%v", want, raw)
-		}
-	}
-}
-
-func TestApprovalPreConsumeRegistersSubscriptionTypesWithoutCleanup(t *testing.T) {
-	tests := []struct {
-		name          string
-		eventType     string
-		subscribePath string
-		params        map[string]string
-		wantTypes     []string
-	}{
-		{
-			name:          "instance omitted subscription_type registers both",
-			eventType:     eventTypeApprovalInstanceStatusChangedV4,
-			subscribePath: pathApprovalInstancesSubscription,
-			wantTypes: []string{
-				approvalSubscriptionTypeInvolved,
-				approvalSubscriptionTypeManaged,
-			},
-		},
-		{
-			name:          "task explicit single managed",
-			eventType:     eventTypeApprovalTaskStatusChangedV4,
-			subscribePath: pathApprovalTasksSubscription,
-			params:        map[string]string{"subscription_type": approvalSubscriptionTypeManaged},
-			wantTypes:     []string{approvalSubscriptionTypeManaged},
-		},
-		{
-			name:          "task comma separated multi canonicalizes and deduplicates",
-			eventType:     eventTypeApprovalTaskStatusChangedV4,
-			subscribePath: pathApprovalTasksSubscription,
-			params: map[string]string{
-				"subscription_type": approvalSubscriptionTypeManaged + "," + approvalSubscriptionTypeInvolved + "," + approvalSubscriptionTypeManaged,
-			},
-			wantTypes: []string{
-				approvalSubscriptionTypeInvolved,
-				approvalSubscriptionTypeManaged,
-			},
-		},
-		{
-			name:          "instance json array multi",
-			eventType:     eventTypeApprovalInstanceStatusChangedV4,
-			subscribePath: pathApprovalInstancesSubscription,
-			params: map[string]string{
-				"subscription_type": `["MANAGED_APPROVAL","INVOLVED_APPROVAL"]`,
-			},
-			wantTypes: []string{
-				approvalSubscriptionTypeInvolved,
-				approvalSubscriptionTypeManaged,
-			},
-		},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			pc := approvalSubscriptionPreConsume(approvalSubscriptionConfig{
-				eventType:     approvalEventType(tc.eventType),
-				subscribePath: approvalSubscriptionPath(tc.subscribePath),
-			})
-			rt := &fakeAPIClient{}
-			cleanup, err := pc(context.Background(), rt, tc.params)
-			if err != nil {
-				t.Fatalf("PreConsume returned error: %v", err)
-			}
-			if cleanup != nil {
-				t.Fatal("cleanup must be nil; approval consume must not unsubscribe on exit")
-			}
-			assertSubscriptionCalls(t, rt.calls, tc.subscribePath, tc.wantTypes)
-		})
-	}
-}
-
-func assertSubscriptionCalls(t *testing.T, got []recordedCall, wantPath string, wantTypes []string) {
-	t.Helper()
-	if len(got) != len(wantTypes) {
-		t.Fatalf("calls after pre-consume = %d, want %d; calls=%+v", len(got), len(wantTypes), got)
-	}
-	for i, wantType := range wantTypes {
-		assertCall(t, got[i], "POST", wantPath, map[string]string{"subscription_type": wantType})
-	}
-}
-
-func assertCall(t *testing.T, got recordedCall, wantMethod, wantPath string, wantBody interface{}) {
-	t.Helper()
-	if got.method != wantMethod {
-		t.Errorf("method = %q, want %q", got.method, wantMethod)
-	}
-	if got.path != wantPath {
-		t.Errorf("path = %q, want %q", got.path, wantPath)
-	}
-	if !reflect.DeepEqual(got.body, wantBody) {
-		t.Errorf("body = %#v, want %#v", got.body, wantBody)
-	}
-}
-
-func TestApprovalPreConsumeValidationErrors(t *testing.T) {
-	t.Run("nil runtime", func(t *testing.T) {
-		pc := approvalSubscriptionPreConsume(approvalSubscriptionConfig{
-			eventType: eventTypeApprovalInstanceStatusChangedV4,
-		})
-		_, err := pc(context.Background(), nil, map[string]string{"subscription_type": approvalSubscriptionTypeInvolved})
-		if err == nil {
-			t.Fatal("expected nil runtime error")
-		}
-		p, ok := errs.ProblemOf(err)
-		if !ok || p.Category != errs.CategoryInternal {
-			t.Fatalf("err = %T/%v, want typed internal error", err, err)
-		}
-	})
-
-	for _, raw := range []string{"BAD", "[]", `["INVOLVED_APPROVAL",3]`} {
-		t.Run("invalid subscription type "+raw, func(t *testing.T) {
-			pc := approvalSubscriptionPreConsume(approvalSubscriptionConfig{
-				eventType: eventTypeApprovalInstanceStatusChangedV4,
-			})
-			cleanup, err := pc(context.Background(), &fakeAPIClient{}, map[string]string{"subscription_type": raw})
-			if err == nil {
-				t.Fatal("expected invalid subscription_type error")
-			}
-			if cleanup != nil {
-				t.Fatal("cleanup must be nil on validation error")
-			}
-			var ve *errs.ValidationError
-			if !errors.As(err, &ve) {
-				t.Fatalf("err = %T/%v, want *errs.ValidationError", err, err)
-			}
-			if ve.Subtype != errs.SubtypeInvalidArgument || ve.Param != "--param" {
-				t.Errorf("subtype/param = %s/%q, want invalid_argument/--param", ve.Subtype, ve.Param)
-			}
-			if ve.Hint == "" {
-				t.Error("invalid subscription_type should carry a hint")
-			}
-		})
-	}
-
-	t.Run("partial registration failure reports registered and failed relation types", func(t *testing.T) {
-		upstream := errs.NewAPIError(errs.SubtypeServerError, "approval subscription API failed")
-		rt := &fakeAPIClient{err: upstream, errOnCall: 2}
-		pc := approvalSubscriptionPreConsume(approvalSubscriptionConfig{
-			eventType:     eventTypeApprovalTaskStatusChangedV4,
-			subscribePath: pathApprovalTasksSubscription,
-		})
-
-		cleanup, err := pc(context.Background(), rt, map[string]string{})
-		if err == nil {
-			t.Fatal("expected partial registration error")
-		}
-		if cleanup != nil {
-			t.Fatal("cleanup must be nil on registration error")
-		}
-		assertSubscriptionCalls(t, rt.calls, pathApprovalTasksSubscription, []string{
-			approvalSubscriptionTypeInvolved,
-			approvalSubscriptionTypeManaged,
-		})
-		p, ok := errs.ProblemOf(err)
-		if !ok {
-			t.Fatalf("err = %T/%v, want typed error", err, err)
-		}
-		if p.Category != errs.CategoryAPI || p.Subtype != errs.SubtypeServerError {
-			t.Fatalf("category/subtype = %s/%s, want api/server_error", p.Category, p.Subtype)
-		}
-		for _, want := range []string{
-			"registered subscription_type(s) [INVOLVED_APPROVAL]",
-			"failed subscription_type MANAGED_APPROVAL",
-		} {
-			if !strings.Contains(p.Message, want) {
-				t.Errorf("partial error message missing %q: %q", want, p.Message)
-			}
-		}
-		for _, want := range []string{
-			"already registered",
-			"--param subscription_type=MANAGED_APPROVAL",
-		} {
-			if !strings.Contains(p.Hint, want) {
-				t.Errorf("partial error hint missing %q: %q", want, p.Hint)
-			}
-		}
-	})
-}
-
-func TestApprovalSubscriptionRegistrationErrorVariants(t *testing.T) {
-	t.Run("nil error", func(t *testing.T) {
-		if err := approvalSubscriptionRegistrationError(eventTypeApprovalTaskStatusChangedV4, nil, approvalSubscriptionTypeInvolved, nil); err != nil {
-			t.Fatalf("nil cause returned error: %v", err)
-		}
-	})
-
-	t.Run("typed error with existing hint and empty message", func(t *testing.T) {
-		upstream := errs.NewAPIError(errs.SubtypeServerError, "").WithHint("retry later")
-		err := approvalSubscriptionRegistrationError(
-			eventTypeApprovalTaskStatusChangedV4,
-			nil,
-			approvalSubscriptionTypeInvolved,
-			upstream,
-		)
-		if err != upstream {
-			t.Fatalf("typed error should be annotated in place; got %T/%v", err, err)
-		}
-		p, ok := errs.ProblemOf(err)
-		if !ok {
-			t.Fatalf("err = %T/%v, want typed error", err, err)
-		}
-		if !strings.Contains(p.Message, "failed subscription_type INVOLVED_APPROVAL") {
-			t.Errorf("message missing failed relation: %q", p.Message)
-		}
-		for _, want := range []string{"retry later", "no approval subscription relation was registered"} {
-			if !strings.Contains(p.Hint, want) {
-				t.Errorf("hint missing %q: %q", want, p.Hint)
-			}
-		}
-	})
-
-	t.Run("untyped error is wrapped with retry context", func(t *testing.T) {
-		cause := errors.New("transport closed")
-		err := approvalSubscriptionRegistrationError(
-			eventTypeApprovalTaskStatusChangedV4,
-			nil,
-			approvalSubscriptionTypeInvolved,
-			cause,
-		)
-		if !errors.Is(err, cause) {
-			t.Fatalf("wrapped error should preserve cause; got %T/%v", err, err)
-		}
-		p, ok := errs.ProblemOf(err)
-		if !ok {
-			t.Fatalf("err = %T/%v, want typed error", err, err)
-		}
-		if p.Category != errs.CategoryInternal || p.Subtype != errs.SubtypeSDKError {
-			t.Fatalf("category/subtype = %s/%s, want internal/sdk_error", p.Category, p.Subtype)
-		}
-		if !strings.Contains(p.Hint, "no approval subscription relation was registered") {
-			t.Errorf("hint missing no-registration context: %q", p.Hint)
-		}
-	})
-}
-
-func TestProcessApprovalInstanceStatusChanged(t *testing.T) {
-	out := runApprovalInstanceStatusChanged(t, `{
-		"schema": "2.0",
-		"header": {
-			"event_id": "evt_approval_instance_001",
-			"event_type": "approval.instance.status_changed_v4",
-			"create_time": "1710000000000"
-		},
-		"event": {
-			"approval_code": "approval_code_001",
-			"instance_code": "instance_code_001",
-			"external_id": "external_001",
-			"status": "PENDING",
-			"operate_time": "1666079207003",
-			"start_user": {
-				"open_id": "ou_start",
-				"union_id": "on_start",
-				"user_id": "user_start"
-			}
-		}
-	}`)
-
-	if out.Type != eventTypeApprovalInstanceStatusChangedV4 {
-		t.Errorf("Type = %q, want %q", out.Type, eventTypeApprovalInstanceStatusChangedV4)
-	}
-	if out.EventID != "evt_approval_instance_001" || out.Timestamp != "1710000000000" {
-		t.Errorf("EventID/Timestamp = %q/%q", out.EventID, out.Timestamp)
-	}
-	if out.ApprovalCode != "approval_code_001" || out.InstanceCode != "instance_code_001" {
-		t.Errorf("approval/instance code = %q/%q", out.ApprovalCode, out.InstanceCode)
-	}
-	if out.ExternalID != "external_001" || out.Status != "PENDING" || out.OperateTime != "1666079207003" {
-		t.Errorf("external/status/operate_time = %q/%q/%q", out.ExternalID, out.Status, out.OperateTime)
-	}
-	if out.StartUser == nil || out.StartUser.OpenID != "ou_start" || out.StartUser.UnionID != "on_start" || out.StartUser.UserID != "user_start" {
-		t.Fatalf("StartUser = %+v, want full user ids", out.StartUser)
-	}
-}
-
-func TestProcessApprovalTaskStatusChanged(t *testing.T) {
-	out := runApprovalTaskStatusChanged(t, `{
-		"schema": "2.0",
-		"header": {
-			"event_id": "evt_approval_task_001",
-			"event_type": "approval.task.status_changed_v4",
-			"create_time": "1710000000001"
-		},
-		"event": {
-			"approval_code": "approval_code_002",
-			"instance_code": "instance_code_002",
-			"task_id": "task_001",
-			"external_id": "external_002",
-			"task_external_id": "task_external_001",
-			"status": "APPROVED",
-			"operate_time": "1666079207004",
-			"assigned_user": {
-				"open_id": "ou_assignee",
-				"union_id": "on_assignee",
-				"user_id": "user_assignee"
-			}
-		}
-	}`)
-
-	if out.Type != eventTypeApprovalTaskStatusChangedV4 {
-		t.Errorf("Type = %q, want %q", out.Type, eventTypeApprovalTaskStatusChangedV4)
-	}
-	if out.EventID != "evt_approval_task_001" || out.Timestamp != "1710000000001" {
-		t.Errorf("EventID/Timestamp = %q/%q", out.EventID, out.Timestamp)
-	}
-	if out.ApprovalCode != "approval_code_002" || out.InstanceCode != "instance_code_002" || out.TaskID != "task_001" {
-		t.Errorf("approval/instance/task = %q/%q/%q", out.ApprovalCode, out.InstanceCode, out.TaskID)
-	}
-	if out.ExternalID != "external_002" || out.TaskExternalID != "task_external_001" || out.Status != "APPROVED" || out.OperateTime != "1666079207004" {
-		t.Errorf("external/task_external/status/operate_time = %q/%q/%q/%q", out.ExternalID, out.TaskExternalID, out.Status, out.OperateTime)
-	}
-	if out.AssignedUser == nil || out.AssignedUser.OpenID != "ou_assignee" || out.AssignedUser.UnionID != "on_assignee" || out.AssignedUser.UserID != "user_assignee" {
-		t.Fatalf("AssignedUser = %+v, want full user ids", out.AssignedUser)
-	}
-}
-
-func TestProcessApprovalStatusChangedUsesRawEventTypeFallback(t *testing.T) {
-	instance := runApprovalInstanceStatusChanged(t, `{
-		"schema": "2.0",
-		"header": {
-			"event_id": "evt_approval_instance_fallback",
-			"create_time": "1710000000002"
-		},
-		"event": {
-			"approval_code": "approval_code_fallback",
-			"instance_code": "instance_code_fallback",
-			"status": "APPROVED",
-			"operate_time": "1666079207005"
-		}
-	}`)
-	if instance.Type != eventTypeApprovalInstanceStatusChangedV4 {
-		t.Errorf("instance Type fallback = %q, want %q", instance.Type, eventTypeApprovalInstanceStatusChangedV4)
-	}
-
-	task := runApprovalTaskStatusChanged(t, `{
-		"schema": "2.0",
-		"header": {
-			"event_id": "evt_approval_task_fallback",
-			"create_time": "1710000000003"
-		},
-		"event": {
-			"approval_code": "approval_code_fallback",
-			"instance_code": "instance_code_fallback",
-			"task_id": "task_fallback",
-			"status": "DONE",
-			"operate_time": "1666079207006"
-		}
-	}`)
-	if task.Type != eventTypeApprovalTaskStatusChangedV4 {
-		t.Errorf("task Type fallback = %q, want %q", task.Type, eventTypeApprovalTaskStatusChangedV4)
-	}
-}
-
-func TestProcessApprovalStatusChangedMalformedPayloadPassthrough(t *testing.T) {
-	for _, tc := range []struct {
-		name      string
-		eventType string
-		process   event.ProcessFunc
-	}{
-		{"instance", eventTypeApprovalInstanceStatusChangedV4, processApprovalInstanceStatusChanged},
-		{"task", eventTypeApprovalTaskStatusChangedV4, processApprovalTaskStatusChanged},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			raw := &event.RawEvent{
-				EventType: tc.eventType,
-				Payload:   json.RawMessage(`not json`),
-				Timestamp: time.Now(),
-			}
-			got, err := tc.process(context.Background(), nil, raw, nil)
-			if err != nil {
-				t.Fatalf("Process should swallow parse errors, got %v", err)
-			}
-			if string(got) != "not json" {
-				t.Errorf("malformed fallback output = %q, want original bytes", string(got))
-			}
-		})
-	}
-}
-
-func TestProcessApprovalStatusChangedNilRaw(t *testing.T) {
-	for _, tc := range []struct {
-		name    string
-		process event.ProcessFunc
-	}{
-		{"instance", processApprovalInstanceStatusChanged},
-		{"task", processApprovalTaskStatusChanged},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			got, err := tc.process(context.Background(), nil, nil, nil)
-			if err != nil {
-				t.Fatalf("Process nil raw returned error: %v", err)
-			}
-			if got != nil {
-				t.Fatalf("Process nil raw output = %s, want nil", string(got))
-			}
-		})
-	}
-}
-
-func runApprovalInstanceStatusChanged(t *testing.T, payload string) ApprovalInstanceStatusChangedV4Output {
-	t.Helper()
-	raw := &event.RawEvent{
-		EventType: eventTypeApprovalInstanceStatusChangedV4,
-		Payload:   json.RawMessage(payload),
-		Timestamp: time.Now(),
-	}
-	got, err := processApprovalInstanceStatusChanged(context.Background(), nil, raw, nil)
-	if err != nil {
-		t.Fatalf("Process returned error: %v", err)
-	}
-	var out ApprovalInstanceStatusChangedV4Output
-	if err := json.Unmarshal(got, &out); err != nil {
-		t.Fatalf("Process output is not valid instance JSON: %v\nraw=%s", err, string(got))
-	}
-	return out
-}
-
-func runApprovalTaskStatusChanged(t *testing.T, payload string) ApprovalTaskStatusChangedV4Output {
-	t.Helper()
-	raw := &event.RawEvent{
-		EventType: eventTypeApprovalTaskStatusChangedV4,
-		Payload:   json.RawMessage(payload),
-		Timestamp: time.Now(),
-	}
-	got, err := processApprovalTaskStatusChanged(context.Background(), nil, raw, nil)
-	if err != nil {
-		t.Fatalf("Process returned error: %v", err)
-	}
-	var out ApprovalTaskStatusChangedV4Output
-	if err := json.Unmarshal(got, &out); err != nil {
-		t.Fatalf("Process output is not valid task JSON: %v\nraw=%s", err, string(got))
-	}
-	return out
-}
-
-func TestApprovalKeysRegisterCleanly(t *testing.T) {
-	for _, key := range []string{eventTypeApprovalInstanceStatusChangedV4, eventTypeApprovalTaskStatusChangedV4} {
-		event.UnregisterKeyForTest(key)
-		t.Cleanup(func() { event.UnregisterKeyForTest(key) })
-	}
-
-	for _, def := range Keys() {
-		event.RegisterKey(def)
-	}
-	for _, key := range []string{eventTypeApprovalInstanceStatusChangedV4, eventTypeApprovalTaskStatusChangedV4} {
-		if _, ok := event.Lookup(key); !ok {
-			t.Fatalf("event.Lookup(%q) not registered", key)
-		}
-	}
-}
-
-var _ event.APIClient = (*fakeAPIClient)(nil)

events/approval/types.go

@@ -1,42 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package approval
-
-// ApprovalUserID identifies a user in the three Lark ID formats included by
-// approval status-change events.
-type ApprovalUserID struct {
-	OpenID  string `json:"open_id,omitempty"  desc:"User open_id; prefixed with ou_" kind:"open_id"`
-	UnionID string `json:"union_id,omitempty" desc:"User union_id"                  kind:"union_id"`
-	UserID  string `json:"user_id,omitempty"  desc:"User id within the tenant"       kind:"user_id"`
-}
-
-// ApprovalInstanceStatusChangedV4Output is the flattened shape for
-// approval.instance.status_changed_v4.
-type ApprovalInstanceStatusChangedV4Output struct {
-	Type         string          `json:"type"                    desc:"Event type; always approval.instance.status_changed_v4" enum:"approval.instance.status_changed_v4"`
-	EventID      string          `json:"event_id,omitempty"      desc:"Globally unique event ID; safe for deduplication"`
-	Timestamp    string          `json:"timestamp,omitempty"     desc:"Event delivery time (ms timestamp string); taken from header.create_time when present" kind:"timestamp_ms"`
-	ApprovalCode string          `json:"approval_code,omitempty" desc:"Approval definition code; not a subscription dimension"`
-	InstanceCode string          `json:"instance_code,omitempty" desc:"Approval instance code"`
-	ExternalID   string          `json:"external_id,omitempty"   desc:"Third-party approval instance id; present only for third-party approvals"`
-	Status       string          `json:"status,omitempty"        desc:"Approval instance status" enum:"PENDING,APPROVED,REJECTED,CANCELED,DELETED,REVERTED,OVERTIME_CLOSE,OVERTIME_RECOVER"`
-	OperateTime  string          `json:"operate_time,omitempty"  desc:"Status change time in milliseconds" kind:"timestamp_ms"`
-	StartUser    *ApprovalUserID `json:"start_user,omitempty"    desc:"Approval instance starter; omitted when unavailable"`
-}
-
-// ApprovalTaskStatusChangedV4Output is the flattened shape for
-// approval.task.status_changed_v4.
-type ApprovalTaskStatusChangedV4Output struct {
-	Type           string          `json:"type"                      desc:"Event type; always approval.task.status_changed_v4" enum:"approval.task.status_changed_v4"`
-	EventID        string          `json:"event_id,omitempty"        desc:"Globally unique event ID; safe for deduplication"`
-	Timestamp      string          `json:"timestamp,omitempty"       desc:"Event delivery time (ms timestamp string); taken from header.create_time when present" kind:"timestamp_ms"`
-	ApprovalCode   string          `json:"approval_code,omitempty"     desc:"Approval definition code; not a subscription dimension"`
-	InstanceCode   string          `json:"instance_code,omitempty"     desc:"Approval instance code"`
-	TaskID         string          `json:"task_id,omitempty"           desc:"Approval task id"`
-	ExternalID     string          `json:"external_id,omitempty"       desc:"Third-party approval external id; present only for third-party approvals"`
-	TaskExternalID string          `json:"task_external_id,omitempty"  desc:"Third-party approval task external id; present only when emitted by the upstream service"`
-	AssignedUser   *ApprovalUserID `json:"assigned_user,omitempty"     desc:"Task assignee or operator user ids; omitted for automatic flows without an operator"`
-	Status         string          `json:"status,omitempty"            desc:"Approval task status" enum:"REVERTED,PENDING,APPROVED,REJECTED,TRANSFERRED,ROLLBACK,DONE,OVERTIME_CLOSE,OVERTIME_RECOVER"`
-	OperateTime    string          `json:"operate_time,omitempty"      desc:"Status change time in milliseconds" kind:"timestamp_ms"`
-}

events/im/message_receive.go

@@ -13,29 +13,17 @@ import (
 
 // ImMessageReceiveOutput is the flattened shape for im.message.receive_v1; `desc` tags drive the reflected schema.
 type ImMessageReceiveOutput struct {
-	Type        string          `json:"type"                   desc:"Event type; always im.message.receive_v1"`
-	EventID     string          `json:"event_id,omitempty"     desc:"Event delivery ID. Do not use as the message deduplication key; use message_id instead."`
-	Timestamp   string          `json:"timestamp,omitempty"    desc:"Event delivery time (ms timestamp string); prefers header.create_time"                                                                                                              kind:"timestamp_ms"`
-	ID          string          `json:"id,omitempty"           desc:"Message ID (legacy alias of message_id, kept for compatibility)"                                                                                                                     kind:"message_id"`
-	MessageID   string          `json:"message_id,omitempty"   desc:"Message ID; prefixed with om_. Recommended idempotency key for im.message.receive_v1 consumers."                                                                                     kind:"message_id"`
-	CreateTime  string          `json:"create_time,omitempty"  desc:"Message creation time (ms timestamp string)"                                                                                                                                         kind:"timestamp_ms"`
-	UpdateTime  string          `json:"update_time,omitempty"  desc:"Message update time (ms timestamp string); emitted only when different from create_time"                                                                                              kind:"timestamp_ms"`
-	ChatID      string          `json:"chat_id,omitempty"      desc:"Chat/conversation ID; prefixed with oc_"                                                                                                                                             kind:"chat_id"`
-	ChatType    string          `json:"chat_type,omitempty"    desc:"Conversation type"                                                                                                                                                                   enum:"p2p,group"`
-	MessageType string          `json:"message_type,omitempty" desc:"Message type"`
-	SenderID    string          `json:"sender_id,omitempty"    desc:"Sender open_id; prefixed with ou_"                                                                                                                                                   kind:"open_id"`
-	SenderType  string          `json:"sender_type,omitempty"  desc:"Sender type"                                                                                                                                                                         enum:"user,bot"`
-	RootID      string          `json:"root_id,omitempty"      desc:"Root message ID of the reply/thread context, when present"                                                                                                                           kind:"message_id"`
-	ThreadID    string          `json:"thread_id,omitempty"    desc:"Thread ID, when present"`
-	ReplyTo     string          `json:"reply_to,omitempty"     desc:"Parent message ID of the direct reply context, when present"                                                                                                                         kind:"message_id"`
-	Content     string          `json:"content,omitempty"      desc:"Message content. For most types (text/post/image/file/audio, etc.) this is pre-rendered human-readable text."`
-	Mentions    []MentionOutput `json:"mentions,omitempty" desc:"Compact mentions aligned with im +messages-mget"`
-}
-
-type MentionOutput struct {
-	Key  string `json:"key,omitempty"  desc:"Mention placeholder key, for example @_user_1"`
-	ID   string `json:"id,omitempty"   desc:"Mentioned user open_id; prefixed with ou_"        kind:"open_id"`
-	Name string `json:"name,omitempty" desc:"Mentioned display name"`
+	Type        string `json:"type"                   desc:"Event type; always im.message.receive_v1"`
+	EventID     string `json:"event_id,omitempty"     desc:"Globally unique event ID; safe for deduplication"`
+	Timestamp   string `json:"timestamp,omitempty"    desc:"Event delivery time (ms timestamp string); prefers header.create_time"                                                                                                              kind:"timestamp_ms"`
+	ID          string `json:"id,omitempty"           desc:"Message ID (legacy alias of message_id, kept for compatibility)"                                                                                                                     kind:"message_id"`
+	MessageID   string `json:"message_id,omitempty"   desc:"Message ID; prefixed with om_"                                                                                                                                                       kind:"message_id"`
+	CreateTime  string `json:"create_time,omitempty"  desc:"Message creation time (ms timestamp string)"                                                                                                                                         kind:"timestamp_ms"`
+	ChatID      string `json:"chat_id,omitempty"      desc:"Chat/conversation ID; prefixed with oc_"                                                                                                                                             kind:"chat_id"`
+	ChatType    string `json:"chat_type,omitempty"    desc:"Conversation type"                                                                                                                                                                   enum:"p2p,group"`
+	MessageType string `json:"message_type,omitempty" desc:"Message type"`
+	SenderID    string `json:"sender_id,omitempty"    desc:"Sender open_id; prefixed with ou_"                                                                                                                                                   kind:"open_id"`
+	Content     string `json:"content,omitempty"      desc:"Message content. For most types (text/post/image/file/audio, etc.) this is pre-rendered human-readable text."`
 }
 
 func processImMessageReceive(_ context.Context, _ event.APIClient, raw *event.RawEvent, _ map[string]string) (json.RawMessage, error) {
@@ -48,20 +36,15 @@ func processImMessageReceive(_ context.Context, _ event.APIClient, raw *event.Ra
 		Event struct {
 			Message struct {
 				MessageID   string        `json:"message_id"`
-				RootID      string        `json:"root_id"`
-				ParentID    string        `json:"parent_id"`
-				ThreadID    string        `json:"thread_id"`
 				ChatID      string        `json:"chat_id"`
 				ChatType    string        `json:"chat_type"`
 				MessageType string        `json:"message_type"`
 				Content     string        `json:"content"`
 				CreateTime  string        `json:"create_time"`
-				UpdateTime  string        `json:"update_time"`
 				Mentions    []interface{} `json:"mentions"`
 			} `json:"message"`
 			Sender struct {
-				SenderType string `json:"sender_type"`
-				SenderID   struct {
+				SenderID struct {
 					OpenID string `json:"open_id"`
 				} `json:"sender_id"`
 			} `json:"sender"`
@@ -98,54 +81,7 @@ func processImMessageReceive(_ context.Context, _ event.APIClient, raw *event.Ra
 		ChatType:    msg.ChatType,
 		MessageType: msg.MessageType,
 		SenderID:    envelope.Event.Sender.SenderID.OpenID,
-		SenderType:  envelope.Event.Sender.SenderType,
-		RootID:      msg.RootID,
-		ThreadID:    msg.ThreadID,
-		ReplyTo:     msg.ParentID,
 		Content:     content,
-		Mentions:    compactMentions(msg.Mentions),
-	}
-	if msg.UpdateTime != "" && msg.UpdateTime != msg.CreateTime {
-		out.UpdateTime = msg.UpdateTime
 	}
 	return json.Marshal(out)
 }
-
-func compactMentions(mentions []interface{}) []MentionOutput {
-	if len(mentions) == 0 {
-		return nil
-	}
-	out := make([]MentionOutput, 0, len(mentions))
-	for _, raw := range mentions {
-		item, _ := raw.(map[string]interface{})
-		mention := MentionOutput{
-			Key:  stringField(item, "key"),
-			ID:   mentionOpenID(item["id"]),
-			Name: stringField(item, "name"),
-		}
-		if mention.Key != "" || mention.ID != "" || mention.Name != "" {
-			out = append(out, mention)
-		}
-	}
-	if len(out) == 0 {
-		return nil
-	}
-	return out
-}
-
-func stringField(m map[string]interface{}, key string) string {
-	v, _ := m[key].(string)
-	return v
-}
-
-func mentionOpenID(raw interface{}) string {
-	switch v := raw.(type) {
-	case map[string]interface{}:
-		openID, _ := v["open_id"].(string)
-		return openID
-	case string:
-		return v
-	default:
-		return ""
-	}
-}

events/im/message_receive_test.go

@@ -84,32 +84,19 @@ func TestProcessImMessageReceive_Text(t *testing.T) {
 		},
 		"event": {
 			"sender": {
-				"sender_type": "user",
 				"sender_id": {"open_id": "ou_sender"}
 			},
 			"message": {
 				"message_id":   "om_text_001",
-				"root_id":      "om_root_001",
-				"parent_id":    "om_parent_001",
-				"thread_id":    "omt_thread_001",
 				"chat_id":      "oc_chat",
 				"chat_type":    "p2p",
 				"message_type": "text",
 				"create_time":  "1776409468987",
-				"update_time":  "1776409469999",
-				"content":      "{\"text\":\"hello @_user_1\"}",
-				"mentions": [
-					{
-						"key": "@_user_1",
-						"id": {"open_id": "ou_mentioned"},
-						"name": "Alice"
-					}
-				]
+				"content":      "{\"text\":\"hello there\"}"
 			}
 		}
 	}`
 	out := runReceive(t, payload)
-	outMap := runReceiveMap(t, payload)
 
 	if out.Type != "im.message.receive_v1" {
 		t.Errorf("Type = %q", out.Type)
@@ -123,69 +110,12 @@ func TestProcessImMessageReceive_Text(t *testing.T) {
 	if out.SenderID != "ou_sender" {
 		t.Errorf("SenderID = %q", out.SenderID)
 	}
-	if out.Content != "hello @Alice" {
-		t.Errorf("Content = %q, want \"hello @Alice\"", out.Content)
+	if out.Content != "hello there" {
+		t.Errorf("Content = %q, want \"hello there\"", out.Content)
 	}
 	if out.Timestamp != "1776409469273" {
 		t.Errorf("Timestamp = %q", out.Timestamp)
 	}
-	for field, want := range map[string]string{
-		"sender_type": "user",
-		"root_id":     "om_root_001",
-		"thread_id":   "omt_thread_001",
-		"reply_to":    "om_parent_001",
-		"update_time": "1776409469999",
-	} {
-		if got, _ := outMap[field].(string); got != want {
-			t.Errorf("%s = %q, want %q", field, got, want)
-		}
-	}
-	mentions, _ := outMap["mentions"].([]interface{})
-	if len(mentions) != 1 {
-		t.Fatalf("mentions length = %d, want 1: %#v", len(mentions), outMap["mentions"])
-	}
-	mention, _ := mentions[0].(map[string]interface{})
-	for field, want := range map[string]string{
-		"key":  "@_user_1",
-		"id":   "ou_mentioned",
-		"name": "Alice",
-	} {
-		if got, _ := mention[field].(string); got != want {
-			t.Errorf("mentions[0].%s = %q, want %q", field, got, want)
-		}
-	}
-}
-
-func TestProcessImMessageReceive_OmitsUnchangedUpdateTime(t *testing.T) {
-	payload := `{
-		"schema": "2.0",
-		"header": {
-			"event_id": "ev_test_text",
-			"event_type": "im.message.receive_v1",
-			"create_time": "1776409469273",
-			"app_id": "cli_test"
-		},
-		"event": {
-			"sender": {
-				"sender_type": "user",
-				"sender_id": {"open_id": "ou_sender"}
-			},
-			"message": {
-				"message_id":   "om_text_001",
-				"chat_id":      "oc_chat",
-				"chat_type":    "p2p",
-				"message_type": "text",
-				"create_time":  "1776409468987",
-				"update_time":  "1776409468987",
-				"content":      "{\"text\":\"hello there\"}"
-			}
-		}
-	}`
-	outMap := runReceiveMap(t, payload)
-
-	if _, ok := outMap["update_time"]; ok {
-		t.Errorf("update_time should be omitted when it equals create_time: %#v", outMap)
-	}
 }
 
 func TestProcessImMessageReceive_Interactive(t *testing.T) {
@@ -258,22 +188,3 @@ func runReceive(t *testing.T, payload string) ImMessageReceiveOutput {
 	}
 	return out
 }
-
-func runReceiveMap(t *testing.T, payload string) map[string]interface{} {
-	t.Helper()
-	raw := &event.RawEvent{
-		EventID:   "ev_test",
-		EventType: "im.message.receive_v1",
-		Payload:   json.RawMessage(payload),
-		Timestamp: time.Now(),
-	}
-	got, err := processImMessageReceive(context.Background(), nil, raw, nil)
-	if err != nil {
-		t.Fatalf("Process error: %v", err)
-	}
-	var out map[string]interface{}
-	if err := json.Unmarshal(got, &out); err != nil {
-		t.Fatalf("Process output is not valid JSON: %v\nraw=%s", err, string(got))
-	}
-	return out
-}

events/register.go

@@ -5,8 +5,6 @@
 package events
 
 import (
-	"github.com/larksuite/cli/events/application"
-	"github.com/larksuite/cli/events/approval"
 	"github.com/larksuite/cli/events/im"
 	"github.com/larksuite/cli/events/minutes"
 	"github.com/larksuite/cli/events/task"
@@ -18,8 +16,6 @@ import (
 // Mail is intentionally omitted in this phase.
 func init() {
 	all := [][]event.KeyDefinition{
-		application.Keys(),
-		approval.Keys(),
 		im.Keys(),
 		minutes.Keys(),
 		task.Keys(),

extension/credential/env/env.go

@@ -9,7 +9,6 @@ import (
 	"os"
 
 	"github.com/larksuite/cli/extension/credential"
-	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/envvars"
 )
 
@@ -42,7 +41,10 @@ func (p *Provider) ResolveAccount(ctx context.Context) (*credential.Account, err
 			Reason:   envvars.CliAppID + " is set but no app secret or access token is available",
 		}
 	}
-	brand := credential.Brand(core.ParseBrand(os.Getenv(envvars.CliBrand)))
+	brand := credential.Brand(os.Getenv(envvars.CliBrand))
+	if brand == "" {
+		brand = credential.BrandFeishu
+	}
 	acct := &credential.Account{AppID: appID, AppSecret: appSecret, Brand: brand}
 
 	switch id := credential.Identity(os.Getenv(envvars.CliDefaultAs)); id {

extension/credential/env/env_test.go

@@ -22,13 +22,13 @@ func TestProvider_Name(t *testing.T) {
 func TestResolveAccount_BothSet(t *testing.T) {
 	t.Setenv(envvars.CliAppID, "cli_test")
 	t.Setenv(envvars.CliAppSecret, "secret_test")
-	t.Setenv(envvars.CliBrand, " LARK ")
+	t.Setenv(envvars.CliBrand, "feishu")
 
 	acct, err := (&Provider{}).ResolveAccount(context.Background())
 	if err != nil {
 		t.Fatal(err)
 	}
-	if acct.AppID != "cli_test" || acct.AppSecret != "secret_test" || acct.Brand != "lark" {
+	if acct.AppID != "cli_test" || acct.AppSecret != "secret_test" || acct.Brand != "feishu" {
 		t.Errorf("unexpected: %+v", acct)
 	}
 }

extension/credential/sidecar/provider.go

@@ -16,7 +16,6 @@ import (
 	"os"
 
 	"github.com/larksuite/cli/extension/credential"
-	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/envvars"
 	"github.com/larksuite/cli/sidecar"
 )
@@ -59,7 +58,10 @@ func (p *Provider) ResolveAccount(ctx context.Context) (*credential.Account, err
 		}
 	}
 
-	brand := credential.Brand(core.ParseBrand(os.Getenv(envvars.CliBrand)))
+	brand := credential.Brand(os.Getenv(envvars.CliBrand))
+	if brand == "" {
+		brand = credential.BrandFeishu
+	}
 
 	acct := &credential.Account{
 		AppID:     appID,

extension/credential/sidecar/provider_test.go

@@ -56,7 +56,7 @@ func TestResolveAccount_Active(t *testing.T) {
 	setEnv(t, envvars.CliAuthProxy, "http://127.0.0.1:16384")
 	setEnv(t, envvars.CliProxyKey, "test-key")
 	setEnv(t, envvars.CliAppID, "cli_test123")
-	setEnv(t, envvars.CliBrand, " LARK ")
+	setEnv(t, envvars.CliBrand, "lark")
 	unsetEnv(t, envvars.CliDefaultAs)
 	unsetEnv(t, envvars.CliStrictMode)
 

extension/transport/sidecar/interceptor_test.go

@@ -12,18 +12,9 @@ import (
 	"net/http"
 	"testing"
 
-	exttransport "github.com/larksuite/cli/extension/transport"
-	"github.com/larksuite/cli/internal/envvars"
-	internaltransport "github.com/larksuite/cli/internal/transport"
 	"github.com/larksuite/cli/sidecar"
 )
 
-type roundTripFunc func(*http.Request) (*http.Response, error)
-
-func (f roundTripFunc) RoundTrip(req *http.Request) (*http.Response, error) {
-	return f(req)
-}
-
 // failingBody is a ReadCloser that errors on Read and tracks Close calls.
 type failingBody struct {
 	err      error
@@ -272,55 +263,3 @@ func TestInterceptor_EmptyBody(t *testing.T) {
 		t.Errorf("body SHA256 = %q, want empty-string SHA256 %q", sha, expectedEmpty)
 	}
 }
-
-func TestLegacySidecarProviderStillHandlesForcedExternalRequests(t *testing.T) {
-	t.Setenv(envvars.CliAuthProxy, "http://127.0.0.1:16384")
-	t.Setenv(envvars.CliProxyKey, "test-key")
-	previousProvider := exttransport.GetProvider()
-	exttransport.Register(&Provider{})
-	t.Cleanup(func() { exttransport.Register(previousProvider) })
-
-	seen := make(chan *http.Request, 2)
-	base := roundTripFunc(func(req *http.Request) (*http.Response, error) {
-		seen <- req.Clone(req.Context())
-		return &http.Response{StatusCode: http.StatusNoContent, Body: http.NoBody, Request: req}, nil
-	})
-	client := internaltransport.ClientForRequestClass(
-		&http.Client{Transport: internaltransport.NewHTTPPolicyRouter(base, base)},
-		exttransport.RequestClassExternal,
-	)
-
-	withSentinel, err := http.NewRequest(http.MethodGet, "https://external.example/protected", nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-	withSentinel.Header.Set("Authorization", "Bearer "+sidecar.SentinelUAT)
-	resp, err := client.Do(withSentinel)
-	if err != nil {
-		t.Fatal(err)
-	}
-	resp.Body.Close()
-
-	withoutSentinel, err := http.NewRequest(http.MethodGet, "https://external.example/public", nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-	resp, err = client.Do(withoutSentinel)
-	if err != nil {
-		t.Fatal(err)
-	}
-	resp.Body.Close()
-
-	proxied := <-seen
-	if proxied.URL.Scheme != "http" || proxied.URL.Host != "127.0.0.1:16384" {
-		t.Fatalf("sentinel request URL = %s, want sidecar route", proxied.URL)
-	}
-	if got := proxied.Header.Get(sidecar.HeaderProxyTarget); got != "https://external.example" {
-		t.Fatalf("sentinel request proxy target = %q", got)
-	}
-
-	passthrough := <-seen
-	if got := passthrough.URL.String(); got != "https://external.example/public" {
-		t.Fatalf("non-sentinel request URL = %q, want unchanged", got)
-	}
-}

extension/transport/types.go

@@ -15,27 +15,6 @@ type Provider interface {
 	ResolveInterceptor(ctx context.Context) Interceptor
 }
 
-// RequestClass describes the trust boundary of an outbound HTTP request.
-// Platform requests target endpoints owned by the CLI's endpoint resolver;
-// external requests target user-provided, pre-signed, CDN, registry, or other
-// non-platform URLs. Redirect targets are classified again from each hop's
-// logical URL; rewriting a host in an interceptor does not add that host to
-// the platform endpoint catalog.
-type RequestClass string
-
-const (
-	RequestClassPlatform RequestClass = "platform"
-	RequestClassExternal RequestClass = "external"
-)
-
-// ScopedProvider optionally limits a Provider to selected request classes.
-// Providers that do not implement this interface retain the original
-// behavior and apply to every request class.
-type ScopedProvider interface {
-	Provider
-	SupportsRequestClass(RequestClass) bool
-}
-
 // Interceptor defines network-layer customization via a pre/post hook pair.
 // The built-in transport chain always executes between PreRoundTrip and the
 // returned post function, and cannot be skipped or overridden by the extension.

go.mod

@@ -10,7 +10,7 @@ require (
 	github.com/gofrs/flock v0.8.1
 	github.com/google/uuid v1.6.0
 	github.com/itchyny/gojq v0.12.17
-	github.com/larksuite/oapi-sdk-go/v3 v3.7.2
+	github.com/larksuite/oapi-sdk-go/v3 v3.5.4
 	github.com/sergi/go-diff v1.4.0
 	github.com/skip2/go-qrcode v0.0.0-20200617195104-da1b6568686e
 	github.com/smartystreets/goconvey v1.8.1

go.sum

@@ -79,8 +79,8 @@ github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORN
 github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
 github.com/kr/text v0.1.0 h1:45sCR5RtlFHMR4UwH9sdQ5TC8v0qDQCHnXt+kaKSTVE=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
-github.com/larksuite/oapi-sdk-go/v3 v3.7.2 h1:SCIcXHRmtpQbiaZgDTDi1NYNCzrusi7ePJBR9uKoduE=
-github.com/larksuite/oapi-sdk-go/v3 v3.7.2/go.mod h1:ZEplY+kwuIrj/nqw5uSCINNATcH3KdxSN7y+UxYY5fI=
+github.com/larksuite/oapi-sdk-go/v3 v3.5.4 h1:U2S9x9LrfH++ZqJ+YAiUlqzCWJmVXhFdS8Z7rIBH8H0=
+github.com/larksuite/oapi-sdk-go/v3 v3.5.4/go.mod h1:ZEplY+kwuIrj/nqw5uSCINNATcH3KdxSN7y+UxYY5fI=
 github.com/lucasb-eyer/go-colorful v1.2.0 h1:1nnpGOrhyZZuNyfu1QjKiUICQ74+3FNCN69Aj6K7nkY=
 github.com/lucasb-eyer/go-colorful v1.2.0/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0=
 github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=

internal/affordance/affordance.go

@@ -77,15 +77,20 @@ func loadService(service string) map[string]json.RawMessage {
 // space→dot fallback covers domains where the two already coincide.
 func commandFormResolver(service string) func(string) string {
 	byForm := map[string]string{}
-	if svc, ok := registry.SchemaCatalog().Service(service); ok {
+	for _, svc := range registry.EmbeddedServicesTyped() {
+		if svc.Name != service {
+			continue
+		}
 		for _, ref := range apicatalog.ServiceMethods(svc, nil) {
 			byForm[strings.Join(ref.CommandPath()[1:], " ")] = ref.Method.ID
 		}
+		break
 	}
 	return func(h string) string {
-		if id, ok := byForm[strings.TrimSpace(h)]; ok {
+		h = strings.TrimSpace(h)
+		if id, ok := byForm[h]; ok {
 			return id
 		}
-		return headingToKey(h) // one home for the shortcut/method key convention
+		return strings.ReplaceAll(h, " ", ".")
 	}
 }

internal/affordance/affordance_test.go

@@ -7,8 +7,6 @@ import (
 	"encoding/json"
 	"testing"
 	"testing/fstest"
-
-	"github.com/larksuite/cli/internal/meta"
 )
 
 // fixtureMD is a minimal affordance source: two methods, each with a lead
@@ -86,38 +84,3 @@ func TestParseDomainMD_ParagraphNotDropped(t *testing.T) {
 		t.Errorf("custom-section paragraph not flowed through: %+v", a.Extensions)
 	}
 }
-
-// The ### Skills section merges with the domain `> skill:` default: domain
-// first, then per-command entries, de-duplicated. A command with no ### Skills
-// still inherits the domain default.
-func TestParseDomainMD_SkillsMerge(t *testing.T) {
-	md := "# d\n> skill: lark-d\n\n" +
-		"## foo\ndoes foo.\n\n### Skills\n- lark-workflow\n- lark-d\n\n" + // lark-d duplicates the domain default
-		"## bar\ndoes bar.\n"
-	got := parseDomainMD([]byte(md), nil)
-
-	if a := got["foo"]; len(a.Skills) != 2 || a.Skills[0] != "lark-d" || a.Skills[1] != "lark-workflow" {
-		t.Errorf("foo skills = %v, want [lark-d lark-workflow] (domain first, deduped)", a.Skills)
-	}
-	if a := got["bar"]; len(a.Skills) != 1 || a.Skills[0] != "lark-d" {
-		t.Errorf("bar skills = %v, want [lark-d] (domain default inherited)", a.Skills)
-	}
-}
-
-// A +-prefixed shortcut heading keys verbatim (no space->dot folding), so it
-// matches the shortcut command as mounted.
-func TestParseDomainMD_ShortcutHeadingVerbatim(t *testing.T) {
-	md := "# d\n\n## +create\ncreate via shortcut.\n"
-	got := parseDomainMD([]byte(md), nil)
-	if _, ok := got["+create"]; !ok {
-		t.Errorf("shortcut heading should key as %q; got keys %v", "+create", keysOf(got))
-	}
-}
-
-func keysOf(m map[string]meta.Affordance) []string {
-	out := make([]string, 0, len(m))
-	for k := range m {
-		out = append(out, k)
-	}
-	return out
-}

internal/affordance/mdparse.go

@@ -19,7 +19,6 @@ import (
 //	### Prerequisites   -> prerequisites   (a "…来自 [[x]]" link is a sequence edge)
 //	### Tips            -> tips
 //	### Examples        -> examples: **description** + a ```fenced``` command
-//	### Skills          -> skills: bullet skill names, added to the domain default
 //	### <other>         -> extensions[] (custom section, flows through verbatim)
 //	[[cmd]]             -> a command reference, rendered as `cmd`
 //
@@ -35,56 +34,16 @@ var standardSection = map[string]string{
 	"Prerequisites": "prerequisites",
 	"Tips":          "tips",
 	"Examples":      "examples",
-	"Skills":        "skills",
-}
-
-// mergeSkills returns the domain-default skill followed by a command's own skill
-// entries, de-duplicated in author order and empties dropped. Backticks (left by
-// the shared bullet parse) are stripped so each entry is a bare skill name.
-func mergeSkills(domain string, extra []string) []string {
-	var out []string
-	seen := map[string]bool{}
-	add := func(s string) {
-		s = strings.Trim(strings.TrimSpace(s), "`")
-		if s == "" || seen[s] {
-			return
-		}
-		seen[s] = true
-		out = append(out, s)
-	}
-	add(domain)
-	for _, s := range extra {
-		add(s)
-	}
-	return out
 }
 
 func linkToBacktick(s string) string { return mdLink.ReplaceAllString(s, "`$1`") }
 
-// SkillStatPath maps a `### Skills` entry to the path (relative to the skill
-// tree) whose existence gates it: a bare skill name resolves to its SKILL.md,
-// while an entry containing a slash is a name/relative-path reference (e.g.
-// "lark-contact/references/lark-contact-search-user.md") and resolves to that
-// path directly. Both render as `lark-cli skills read <entry>` — the slash form
-// skills read already accepts — so a per-command entry can point at that
-// command's own reference file, not just re-point the domain skill.
-func SkillStatPath(entry string) string {
-	if strings.Contains(entry, "/") {
-		return entry
-	}
-	return entry + "/SKILL.md"
-}
-
 // headingToKey maps a command heading ("instances get") to its affordance key
 // ("instances.get"). The space→dot rule holds where the command form matches
 // the method id; domains whose resource names differ (e.g. plural "messages"
 // vs id segment "message") need the registry's authoritative resource↔id table.
 func headingToKey(h string) string {
-	h = strings.TrimSpace(h)
-	if strings.HasPrefix(h, "+") { // shortcut command: key is the command verbatim
-		return h
-	}
-	return strings.ReplaceAll(h, " ", ".")
+	return strings.ReplaceAll(strings.TrimSpace(h), " ", ".")
 }
 
 type mdSection struct {
@@ -123,7 +82,6 @@ func parseDomainMD(src []byte, resolve func(string) string) map[string]meta.Affo
 		if len(useWhen) > 0 {
 			a.UseWhen = useWhen
 		}
-		var perCmdSkills []string
 		for _, s := range secs {
 			switch standardSection[s.label] {
 			case "avoid_when":
@@ -134,14 +92,12 @@ func parseDomainMD(src []byte, resolve func(string) string) map[string]meta.Affo
 				a.Tips = s.items
 			case "examples":
 				a.Examples = s.cases
-			case "skills":
-				perCmdSkills = s.items
 			default:
 				a.Extensions = append(a.Extensions, meta.AffordanceSection{Label: s.label, Items: s.items})
 			}
 		}
-		if s := mergeSkills(skill, perCmdSkills); len(s) > 0 {
-			a.Skills = s
+		if skill != "" {
+			a.Skills = []string{skill}
 		}
 		out[curKey] = a
 	}
@@ -201,7 +157,7 @@ func parseDomainMD(src []byte, resolve func(string) string) map[string]meta.Affo
 				inFence, fence = true, nil
 			} else {
 				inFence = false
-				sec.cases = append(sec.cases, meta.AffordanceCase{Description: linkToBacktick(pending), Command: strings.Join(fence, "\n")})
+				sec.cases = append(sec.cases, meta.AffordanceCase{Description: pending, Command: strings.Join(fence, "\n")})
 				pending = ""
 			}
 			continue

internal/auth/app_registration.go

@@ -6,7 +6,6 @@ package auth
 import (
 	"context"
 	"encoding/json"
-	"errors"
 	"fmt"
 	"io"
 	"net/http"
@@ -17,46 +16,6 @@ import (
 	"github.com/larksuite/cli/internal/core"
 )
 
-// Terminal registration outcomes, exposed for typed classification by callers.
-var (
-	ErrRegistrationDenied   = errors.New("app registration denied by user")
-	ErrRegistrationExpired  = errors.New("device code expired, please try again")
-	ErrRegistrationTimedOut = errors.New("app registration timed out, please try again")
-)
-
-// Protocol defaults, mirroring the official SDK registration flow.
-const (
-	registrationBootstrapBrand = core.BrandFeishu
-	defaultPollIntervalSeconds = 5
-	defaultExpireInSeconds     = 600
-	beginRequestTimeout        = 30 * time.Second
-	maxPollIntervalSeconds     = 60
-)
-
-// normalizedInterval clamps a non-positive poll interval to the protocol default.
-func normalizedInterval(v int) int {
-	if v <= 0 {
-		return defaultPollIntervalSeconds
-	}
-	return v
-}
-
-// normalizedExpireIn clamps a non-positive expiry budget to the protocol default.
-func normalizedExpireIn(v int) int {
-	if v <= 0 {
-		return defaultExpireInSeconds
-	}
-	return v
-}
-
-// registrationContextError maps a done context to its terminal reason, keeping the cause.
-func registrationContextError(ctx context.Context) error {
-	if errors.Is(ctx.Err(), context.DeadlineExceeded) {
-		return fmt.Errorf("%w: %w", ErrRegistrationTimedOut, ctx.Err())
-	}
-	return fmt.Errorf("app registration cancelled: %w", ctx.Err())
-}
-
 // AppRegistrationResponse is the response from the app registration begin endpoint.
 type AppRegistrationResponse struct {
 	DeviceCode              string
@@ -80,24 +39,15 @@ type AppRegUserInfo struct {
 	TenantBrand string // "feishu" or "lark"
 }
 
-// appRegistrationEndpoint returns the brand's accounts registration endpoint.
-func appRegistrationEndpoint(brand core.LarkBrand) string {
-	return core.ResolveEndpoints(brand).Accounts + PathAppRegistration
-}
-
-// RequestAppRegistration initiates the device flow. The registration protocol
-// always bootstraps on Feishu; brand selects the user-facing verification host.
-// The request is bounded by ctx and a begin timeout.
-func RequestAppRegistration(ctx context.Context, httpClient *http.Client, brand core.LarkBrand, errOut io.Writer) (*AppRegistrationResponse, error) {
+// RequestAppRegistration initiates the app registration device flow.
+func RequestAppRegistration(httpClient *http.Client, brand core.LarkBrand, errOut io.Writer) (*AppRegistrationResponse, error) {
 	if errOut == nil {
 		errOut = io.Discard
 	}
 
-	ctx, cancel := context.WithTimeout(ctx, beginRequestTimeout)
-	defer cancel()
-
 	ep := core.ResolveEndpoints(brand)
-	endpoint := appRegistrationEndpoint(registrationBootstrapBrand)
+	regEp := core.ResolveEndpoints(core.BrandFeishu) // registration begin always uses feishu
+	endpoint := regEp.Accounts + PathAppRegistration
 
 	form := url.Values{}
 	form.Set("action", "begin")
@@ -105,7 +55,7 @@ func RequestAppRegistration(ctx context.Context, httpClient *http.Client, brand
 	form.Set("auth_method", "client_secret")
 	form.Set("request_user_info", "open_id tenant_brand")
 
-	req, err := http.NewRequestWithContext(ctx, "POST", endpoint, strings.NewReader(form.Encode()))
+	req, err := http.NewRequest("POST", endpoint, strings.NewReader(form.Encode()))
 	if err != nil {
 		return nil, err
 	}
@@ -120,7 +70,7 @@ func RequestAppRegistration(ctx context.Context, httpClient *http.Client, brand
 
 	body, err := io.ReadAll(resp.Body)
 	if err != nil {
-		return nil, fmt.Errorf("app registration failed: read body: %w", err)
+		return nil, fmt.Errorf("app registration failed: read body: %v", err)
 	}
 
 	var data map[string]interface{}
@@ -140,26 +90,15 @@ func RequestAppRegistration(ctx context.Context, httpClient *http.Client, brand
 		return nil, fmt.Errorf("app registration failed: %s", msg)
 	}
 
-	// The protocol field is expire_in; accept the legacy expires_in spelling,
-	// then normalize to protocol defaults.
-	expiresIn := getInt(data, "expire_in", 0)
-	if expiresIn <= 0 {
-		expiresIn = getInt(data, "expires_in", 0)
-	}
-	expiresIn = normalizedExpireIn(expiresIn)
-	interval := normalizedInterval(getInt(data, "interval", 0))
-
-	deviceCode := getStr(data, "device_code")
-	if deviceCode == "" {
-		return nil, fmt.Errorf("app registration failed: response missing device_code")
-	}
+	expiresIn := getInt(data, "expires_in", 300)
+	interval := getInt(data, "interval", 5)
 
 	userCode := getStr(data, "user_code")
 	verificationUri := getStr(data, "verification_uri")
 	verificationUriComplete := fmt.Sprintf("%s/page/cli?user_code=%s", ep.Open, userCode)
 
 	return &AppRegistrationResponse{
-		DeviceCode:              deviceCode,
+		DeviceCode:              getStr(data, "device_code"),
 		UserCode:                getStr(data, "user_code"),
 		VerificationUri:         verificationUri,
 		VerificationUriComplete: verificationUriComplete,
@@ -179,97 +118,72 @@ func BuildVerificationURL(baseURL, cliVersion string) string {
 		"&from=cli"
 }
 
-// pollOnce performs one ctx-bound poll request and decodes the payload.
-func pollOnce(ctx context.Context, httpClient *http.Client, brand core.LarkBrand, deviceCode string) (map[string]interface{}, error) {
-	form := url.Values{}
-	form.Set("action", "poll")
-	form.Set("device_code", deviceCode)
-
-	req, err := http.NewRequestWithContext(ctx, "POST", appRegistrationEndpoint(brand), strings.NewReader(form.Encode()))
-	if err != nil {
-		return nil, fmt.Errorf("poll request: %w", err)
-	}
-	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
-
-	resp, err := httpClient.Do(req)
-	if err != nil {
-		return nil, fmt.Errorf("poll network error: %w", err)
-	}
-	defer resp.Body.Close()
-	logHTTPResponse(resp)
-
-	body, err := io.ReadAll(resp.Body)
-	if err != nil {
-		return nil, fmt.Errorf("poll read error: %w", err)
-	}
-	var data map[string]interface{}
-	if err := json.Unmarshal(body, &data); err != nil {
-		return nil, fmt.Errorf("poll parse error: %w", err)
-	}
-	return data, nil
-}
-
-// RegisterAppWithDiscovery polls for credentials, mirroring the official SDK
-// flow: the first poll and the (at most one) cross-brand switch are immediate,
-// non-error responses without complete credentials keep polling, and one
-// deadline from the begin expiry bounds all waits and in-flight requests.
-// The returned brand is the one the credentials were issued on.
-func RegisterAppWithDiscovery(ctx context.Context, httpClient *http.Client, resp *AppRegistrationResponse, errOut io.Writer) (*AppRegistrationResult, core.LarkBrand, error) {
+// PollAppRegistration polls the app registration endpoint until the app is created or the flow times out.
+// If the result has ClientSecret == "" and UserInfo.TenantBrand == "lark", the caller should
+// retry with BrandLark to get the secret from accounts.larksuite.com.
+func PollAppRegistration(ctx context.Context, httpClient *http.Client, brand core.LarkBrand, deviceCode string, interval, expiresIn int, errOut io.Writer) (*AppRegistrationResult, error) {
 	if errOut == nil {
 		errOut = io.Discard
 	}
 
-	// Interval and expiry arrive normalized from begin-response parsing
-	// (normalizedInterval floors them there); the loop trusts them as-is.
-	interval := resp.Interval
-	ctx, cancel := context.WithDeadline(ctx,
-		time.Now().Add(time.Duration(resp.ExpiresIn)*time.Second))
-	defer cancel()
+	const maxPollInterval = 60
+	const maxPollAttempts = 200
 
-	currentBrand := registrationBootstrapBrand
-	effectiveBrand := currentBrand
-	switched := false
-	waitBeforePoll := false
+	ep := core.ResolveEndpoints(brand)
+	endpoint := ep.Accounts + PathAppRegistration
+	deadline := time.Now().Add(time.Duration(expiresIn) * time.Second)
+	currentInterval := interval
+	attempts := 0
 
-	for {
-		if waitBeforePoll {
-			select {
-			case <-time.After(time.Duration(interval) * time.Second):
-			case <-ctx.Done():
-				return nil, effectiveBrand, registrationContextError(ctx)
-			}
-		}
-		waitBeforePoll = true
+	for time.Now().Before(deadline) && attempts < maxPollAttempts {
+		attempts++
 		if ctx.Err() != nil {
-			return nil, effectiveBrand, registrationContextError(ctx)
+			return nil, fmt.Errorf("polling was cancelled")
 		}
 
-		data, err := pollOnce(ctx, httpClient, currentBrand, resp.DeviceCode)
+		select {
+		case <-time.After(time.Duration(currentInterval) * time.Second):
+		case <-ctx.Done():
+			return nil, fmt.Errorf("polling was cancelled")
+		}
+
+		form := url.Values{}
+		form.Set("action", "poll")
+		form.Set("device_code", deviceCode)
+
+		req, err := http.NewRequest("POST", endpoint, strings.NewReader(form.Encode()))
 		if err != nil {
-			fmt.Fprintf(errOut, "[lark-cli] [WARN] app-registration: %v\n", err)
-			interval = minInt(interval+1, maxPollIntervalSeconds)
+			continue
+		}
+		req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+
+		resp, err := httpClient.Do(req)
+		if err != nil {
+			fmt.Fprintf(errOut, "[lark-cli] [WARN] app-registration: poll network error: %v\n", err)
+			currentInterval = minInt(currentInterval+1, maxPollInterval)
+			continue
+		}
+		logHTTPResponse(resp)
+
+		body, err := io.ReadAll(resp.Body)
+		resp.Body.Close()
+		if err != nil {
+			fmt.Fprintf(errOut, "[lark-cli] [WARN] app-registration: poll read error: %v\n", err)
+			currentInterval = minInt(currentInterval+1, maxPollInterval)
 			continue
 		}
 
-		// A cross-brand tenant report switches the polled domain (once,
-		// immediately) regardless of the accompanying status — the signal can
-		// arrive alongside authorization_pending, mirroring the official SDK.
-		if !switched {
-			if userInfoRaw, ok := data["user_info"].(map[string]interface{}); ok {
-				if tb := getStr(userInfoRaw, "tenant_brand"); tb != "" {
-					if actual := core.ParseBrand(tb); actual != currentBrand {
-						currentBrand = actual
-						effectiveBrand = actual
-						switched = true
-						waitBeforePoll = false
-						continue
-					}
-				}
-			}
+		var data map[string]interface{}
+		if err := json.Unmarshal(body, &data); err != nil {
+			fmt.Fprintf(errOut, "[lark-cli] [WARN] app-registration: poll parse error: %v\n", err)
+			currentInterval = minInt(currentInterval+1, maxPollInterval)
+			continue
 		}
 
 		errStr := getStr(data, "error")
-		if errStr == "" {
+
+		// Success: client_id present
+		if errStr == "" && getStr(data, "client_id") != "" {
 			result := &AppRegistrationResult{
 				ClientID:     getStr(data, "client_id"),
 				ClientSecret: getStr(data, "client_secret"),
@@ -280,37 +194,34 @@ func RegisterAppWithDiscovery(ctx context.Context, httpClient *http.Client, resp
 					TenantBrand: getStr(userInfoRaw, "tenant_brand"),
 				}
 			}
-
-			if result.ClientID != "" && result.ClientSecret != "" {
-				// The issuing domain is authoritative; a contradictory final
-				// tenant report is a protocol violation, not a brand override.
-				if result.UserInfo != nil && result.UserInfo.TenantBrand != "" &&
-					core.ParseBrand(result.UserInfo.TenantBrand) != effectiveBrand {
-					return nil, effectiveBrand, fmt.Errorf("app registration returned credentials with a contradictory tenant brand %q", result.UserInfo.TenantBrand)
-				}
-				return result, effectiveBrand, nil
-			}
-			// Incomplete credentials without an error: keep polling.
-			continue
+			return result, nil
 		}
 
 		switch errStr {
 		case "authorization_pending":
 			continue
 		case "slow_down":
-			interval = minInt(interval+5, maxPollIntervalSeconds)
-			fmt.Fprintf(errOut, "[lark-cli] app-registration: slow_down, interval increased to %ds\n", interval)
+			currentInterval = minInt(currentInterval+5, maxPollInterval)
+			fmt.Fprintf(errOut, "[lark-cli] app-registration: slow_down, interval increased to %ds\n", currentInterval)
 			continue
 		case "access_denied":
-			return nil, effectiveBrand, ErrRegistrationDenied
+			return nil, fmt.Errorf("app registration denied by user")
 		case "expired_token", "invalid_grant":
-			return nil, effectiveBrand, ErrRegistrationExpired
+			return nil, fmt.Errorf("device code expired, please try again")
 		}
 
 		desc := getStr(data, "error_description")
 		if desc == "" {
 			desc = errStr
 		}
-		return nil, effectiveBrand, fmt.Errorf("app registration failed: %s", desc)
+		if desc == "" {
+			desc = "Unknown error"
+		}
+		return nil, fmt.Errorf("app registration failed: %s", desc)
 	}
+
+	if attempts >= maxPollAttempts {
+		fmt.Fprintf(errOut, "[lark-cli] [WARN] app-registration: max poll attempts (%d) reached\n", maxPollAttempts)
+	}
+	return nil, fmt.Errorf("app registration timed out, please try again")
 }

internal/auth/app_registration_test.go

@@ -4,28 +4,11 @@
 package auth
 
 import (
-	"context"
-	"errors"
-	"io"
-	"net/http"
-	"strings"
 	"testing"
-	"time"
 
-	"github.com/larksuite/cli/internal/core"
 	"github.com/smartystreets/goconvey/convey"
 )
 
-// jsonResponse builds a canned registration response (transport fakes reuse
-// roundTripFunc from device_flow_test.go).
-func jsonResponse(body string) *http.Response {
-	return &http.Response{
-		StatusCode: http.StatusOK,
-		Body:       io.NopCloser(strings.NewReader(body)),
-		Header:     make(http.Header),
-	}
-}
-
 // Test_BuildVerificationURL verifies that tracking parameters are correctly appended.
 func Test_BuildVerificationURL(t *testing.T) {
 	t.Run("URL不含问号则添加?分隔符", func(t *testing.T) {
@@ -48,358 +31,3 @@ func Test_BuildVerificationURL(t *testing.T) {
 		})
 	})
 }
-
-func TestAppRegistrationEndpoint(t *testing.T) {
-	cases := []struct {
-		brand core.LarkBrand
-		want  string
-	}{
-		{core.BrandFeishu, "https://accounts.feishu.cn" + PathAppRegistration},
-		{core.BrandLark, "https://accounts.larksuite.com" + PathAppRegistration},
-	}
-	for _, c := range cases {
-		if got := appRegistrationEndpoint(c.brand); got != c.want {
-			t.Errorf("brand %q: endpoint = %q, want %q", c.brand, got, c.want)
-		}
-	}
-}
-
-func TestRequestAppRegistration_UsesFeishuBootstrapAndConfiguredVerificationBrand(t *testing.T) {
-	cases := []struct {
-		brand            core.LarkBrand
-		verificationHost string
-	}{
-		{core.BrandFeishu, "open.feishu.cn"},
-		{core.BrandLark, "open.larksuite.com"},
-	}
-	for _, c := range cases {
-		t.Run(string(c.brand), func(t *testing.T) {
-			client := &http.Client{Transport: roundTripFunc(func(r *http.Request) (*http.Response, error) {
-				if got, want := r.URL.Host, "accounts.feishu.cn"; got != want {
-					t.Errorf("begin host = %q, want bootstrap host %q", got, want)
-				}
-				return jsonResponse(`{"device_code":"d","user_code":"TEST-CODE","expire_in":60,"interval":5}`), nil
-			})}
-			resp, err := RequestAppRegistration(context.Background(), client, c.brand, io.Discard)
-			if err != nil {
-				t.Fatalf("RequestAppRegistration(%q) error = %v", c.brand, err)
-			}
-			if !strings.HasPrefix(resp.VerificationUriComplete, "https://"+c.verificationHost+"/page/cli?") {
-				t.Errorf("verification URL = %q, want host %q", resp.VerificationUriComplete, c.verificationHost)
-			}
-		})
-	}
-}
-
-// Full Lark routing contract: Lark selects the Lark verification page, while
-// registration bootstraps on Feishu and switches only after the tenant signal.
-// The Lark credential response omits user_info, so the effective domain must
-// still determine the saved brand.
-func TestRegisterAppWithDiscovery_LarkFlowUsesProtocolBootstrap(t *testing.T) {
-	var calls []string
-	client := &http.Client{Transport: roundTripFunc(func(r *http.Request) (*http.Response, error) {
-		if err := r.ParseForm(); err != nil {
-			t.Fatalf("parse form: %v", err)
-		}
-		action := r.Form.Get("action")
-		calls = append(calls, action+"@"+r.URL.Host)
-		if action == "begin" {
-			return jsonResponse(`{"device_code":"device","user_code":"TEST-CODE","expire_in":60,"interval":0}`), nil
-		}
-		switch r.URL.Host {
-		case "accounts.feishu.cn":
-			return jsonResponse(`{"user_info":{"open_id":"ou_x","tenant_brand":"lark"}}`), nil
-		case "accounts.larksuite.com":
-			return jsonResponse(`{"client_id":"cli_x","client_secret":"test-secret"}`), nil
-		}
-		t.Errorf("unexpected host polled: %s", r.URL.Host)
-		return jsonResponse(`{}`), nil
-	})}
-	resp, err := RequestAppRegistration(context.Background(), client, core.BrandLark, io.Discard)
-	if err != nil {
-		t.Fatalf("RequestAppRegistration error = %v", err)
-	}
-	if got, want := resp.VerificationUriComplete, "https://open.larksuite.com/page/cli?user_code=TEST-CODE"; got != want {
-		t.Errorf("verification URL = %q, want %q", got, want)
-	}
-
-	result, finalBrand, err := RegisterAppWithDiscovery(context.Background(), client, resp, io.Discard)
-	if err != nil {
-		t.Fatalf("RegisterAppWithDiscovery error = %v, want nil", err)
-	}
-	if finalBrand != core.BrandLark {
-		t.Errorf("finalBrand = %q, want %q (credentials were issued on the lark domain)", finalBrand, core.BrandLark)
-	}
-	if result.ClientID != "cli_x" || result.ClientSecret != "test-secret" {
-		t.Errorf("credentials = (%q, %q), want (cli_x, test-secret)", result.ClientID, result.ClientSecret)
-	}
-	want := []string{"begin@accounts.feishu.cn", "poll@accounts.feishu.cn", "poll@accounts.larksuite.com"}
-	if len(calls) != len(want) {
-		t.Fatalf("calls = %v, want %v", calls, want)
-	}
-	for i := range want {
-		if calls[i] != want[i] {
-			t.Errorf("calls = %v, want %v", calls, want)
-			break
-		}
-	}
-}
-
-// Plain path: the bootstrap domain can return complete Feishu credentials in
-// one poll, even when user_info is absent.
-func TestRegisterAppWithDiscovery_BootstrapBrandSinglePoll(t *testing.T) {
-	polls := 0
-	client := &http.Client{Transport: roundTripFunc(func(r *http.Request) (*http.Response, error) {
-		polls++
-		if got, want := r.URL.Host, "accounts.feishu.cn"; got != want {
-			t.Errorf("poll host = %q, want %q", got, want)
-		}
-		return jsonResponse(`{"client_id":"cli_x","client_secret":"test-secret"}`), nil
-	})}
-	resp := &AppRegistrationResponse{DeviceCode: "device", Interval: 0, ExpiresIn: 5}
-
-	_, finalBrand, err := RegisterAppWithDiscovery(context.Background(), client, resp, io.Discard)
-	if err != nil {
-		t.Fatalf("RegisterAppWithDiscovery error = %v, want nil", err)
-	}
-	if finalBrand != core.BrandFeishu {
-		t.Errorf("finalBrand = %q, want %q", finalBrand, core.BrandFeishu)
-	}
-	if polls != 1 {
-		t.Errorf("polls = %d, want 1", polls)
-	}
-}
-
-// The discovery deadline must cancel in-flight requests: the fake transport
-// hangs until the request context is done.
-func TestRegisterAppWithDiscovery_DeadlineBoundsInFlightRequests(t *testing.T) {
-	client := &http.Client{Transport: roundTripFunc(func(r *http.Request) (*http.Response, error) {
-		<-r.Context().Done()
-		return nil, r.Context().Err()
-	})}
-	resp := &AppRegistrationResponse{DeviceCode: "device", Interval: 0, ExpiresIn: 1}
-
-	start := time.Now()
-	_, _, err := RegisterAppWithDiscovery(context.Background(), client, resp, io.Discard)
-	if err == nil {
-		t.Fatal("expected timeout error, got nil")
-	}
-	if !strings.Contains(err.Error(), "timed out") {
-		t.Errorf("error = %v, want a timed-out terminal reason", err)
-	}
-	if elapsed := time.Since(start); elapsed > 3*time.Second {
-		t.Errorf("discovery not bounded by its deadline: took %v", elapsed)
-	}
-}
-
-// Empty payloads and incomplete same-brand responses are not terminal.
-func TestRegisterAppWithDiscovery_PollsUntilCredentials(t *testing.T) {
-	responses := []string{
-		`{}`,
-		`{"client_id":"cli_x","user_info":{"open_id":"ou_x","tenant_brand":"feishu"}}`,
-		`{"client_id":"cli_x","client_secret":"test-secret","user_info":{"open_id":"ou_x","tenant_brand":"feishu"}}`,
-	}
-	polls := 0
-	client := &http.Client{Transport: roundTripFunc(func(r *http.Request) (*http.Response, error) {
-		body := responses[polls]
-		polls++
-		return jsonResponse(body), nil
-	})}
-	resp := &AppRegistrationResponse{DeviceCode: "device", Interval: 0, ExpiresIn: 5}
-
-	result, finalBrand, err := RegisterAppWithDiscovery(context.Background(), client, resp, io.Discard)
-	if err != nil {
-		t.Fatalf("RegisterAppWithDiscovery error = %v, want nil", err)
-	}
-	if polls != 3 {
-		t.Errorf("polls = %d, want 3", polls)
-	}
-	if result.ClientSecret != "test-secret" || finalBrand != core.BrandFeishu {
-		t.Errorf("result = (%q, %q), want (test-secret, feishu)", result.ClientSecret, finalBrand)
-	}
-}
-
-// Neither the first poll nor the cross-brand switch waits out the interval
-// (a 5s interval would blow the elapsed bound).
-func TestRegisterAppWithDiscovery_ImmediateFirstPollAndSwitch(t *testing.T) {
-	var polledHosts []string
-	client := &http.Client{Transport: roundTripFunc(func(r *http.Request) (*http.Response, error) {
-		polledHosts = append(polledHosts, r.URL.Host)
-		if r.URL.Host == "accounts.feishu.cn" {
-			return jsonResponse(`{"user_info":{"open_id":"ou_x","tenant_brand":"lark"}}`), nil
-		}
-		return jsonResponse(`{"client_id":"cli_x","client_secret":"test-secret"}`), nil
-	})}
-	resp := &AppRegistrationResponse{DeviceCode: "device", Interval: 5, ExpiresIn: 60}
-
-	start := time.Now()
-	result, finalBrand, err := RegisterAppWithDiscovery(context.Background(), client, resp, io.Discard)
-	if err != nil {
-		t.Fatalf("RegisterAppWithDiscovery error = %v, want nil", err)
-	}
-	if elapsed := time.Since(start); elapsed > 2*time.Second {
-		t.Errorf("discovery waited an interval somewhere: took %v", elapsed)
-	}
-	if finalBrand != core.BrandLark || result.ClientSecret != "test-secret" {
-		t.Errorf("result = (%q, %q), want (test-secret, lark)", result.ClientSecret, finalBrand)
-	}
-	want := []string{"accounts.feishu.cn", "accounts.larksuite.com"}
-	if len(polledHosts) != 2 || polledHosts[0] != want[0] || polledHosts[1] != want[1] {
-		t.Errorf("polled hosts = %v, want %v", polledHosts, want)
-	}
-}
-
-// Denial and expiry map to sentinels; cancellation preserves its cause.
-func TestRegisterAppWithDiscovery_TerminalSentinels(t *testing.T) {
-	deny := &http.Client{Transport: roundTripFunc(func(r *http.Request) (*http.Response, error) {
-		return jsonResponse(`{"error":"access_denied"}`), nil
-	})}
-	resp := &AppRegistrationResponse{DeviceCode: "device", Interval: 0, ExpiresIn: 5}
-	_, _, err := RegisterAppWithDiscovery(context.Background(), deny, resp, io.Discard)
-	if !errors.Is(err, ErrRegistrationDenied) {
-		t.Errorf("denied err = %v, want ErrRegistrationDenied", err)
-	}
-
-	expired := &http.Client{Transport: roundTripFunc(func(r *http.Request) (*http.Response, error) {
-		return jsonResponse(`{"error":"expired_token"}`), nil
-	})}
-	_, _, err = RegisterAppWithDiscovery(context.Background(), expired, resp, io.Discard)
-	if !errors.Is(err, ErrRegistrationExpired) {
-		t.Errorf("expired err = %v, want ErrRegistrationExpired", err)
-	}
-
-	cancelledCtx, cancel := context.WithCancel(context.Background())
-	cancel()
-	_, _, err = RegisterAppWithDiscovery(cancelledCtx, deny, resp, io.Discard)
-	if !errors.Is(err, context.Canceled) {
-		t.Errorf("cancelled err = %v, want a context.Canceled cause", err)
-	}
-}
-
-// Begin parsing: expire_in (legacy expires_in fallback), normalization, and
-// required device_code.
-func TestRequestAppRegistration_ProtocolFields(t *testing.T) {
-	serve := func(body string) *http.Client {
-		return &http.Client{Transport: roundTripFunc(func(r *http.Request) (*http.Response, error) {
-			return jsonResponse(body), nil
-		})}
-	}
-
-	resp, err := RequestAppRegistration(context.Background(),
-		serve(`{"device_code":"d","expire_in":60,"interval":3}`), core.BrandFeishu, io.Discard)
-	if err != nil {
-		t.Fatalf("begin error = %v", err)
-	}
-	if resp.ExpiresIn != 60 || resp.Interval != 3 {
-		t.Errorf("parsed (expire=%d, interval=%d), want (60, 3)", resp.ExpiresIn, resp.Interval)
-	}
-
-	resp, err = RequestAppRegistration(context.Background(),
-		serve(`{"device_code":"d","expires_in":45}`), core.BrandFeishu, io.Discard)
-	if err != nil {
-		t.Fatalf("legacy begin error = %v", err)
-	}
-	if resp.ExpiresIn != 45 || resp.Interval != 5 {
-		t.Errorf("legacy parsed (expire=%d, interval=%d), want (45, 5 — normalized default)", resp.ExpiresIn, resp.Interval)
-	}
-
-	resp, err = RequestAppRegistration(context.Background(),
-		serve(`{"device_code":"d","interval":0}`), core.BrandFeishu, io.Discard)
-	if err != nil {
-		t.Fatalf("defaults begin error = %v", err)
-	}
-	if resp.ExpiresIn != 600 || resp.Interval != 5 {
-		t.Errorf("defaults parsed (expire=%d, interval=%d), want (600, 5)", resp.ExpiresIn, resp.Interval)
-	}
-
-	if _, err := RequestAppRegistration(context.Background(),
-		serve(`{"interval":5}`), core.BrandFeishu, io.Discard); err == nil {
-		t.Error("missing device_code: expected error, got nil")
-	}
-}
-
-// A tenant signal arriving alongside authorization_pending must still switch
-// the polled domain (the official SDK checks the signal before the error).
-func TestRegisterAppWithDiscovery_PendingWithTenantSignalSwitches(t *testing.T) {
-	var polledHosts []string
-	client := &http.Client{Transport: roundTripFunc(func(r *http.Request) (*http.Response, error) {
-		polledHosts = append(polledHosts, r.URL.Host)
-		if r.URL.Host == "accounts.feishu.cn" {
-			return jsonResponse(`{"error":"authorization_pending","user_info":{"tenant_brand":"lark"}}`), nil
-		}
-		return jsonResponse(`{"client_id":"cli_x","client_secret":"test-secret"}`), nil
-	})}
-	resp := &AppRegistrationResponse{DeviceCode: "device", Interval: 0, ExpiresIn: 5}
-
-	result, finalBrand, err := RegisterAppWithDiscovery(context.Background(), client, resp, io.Discard)
-	if err != nil {
-		t.Fatalf("RegisterAppWithDiscovery error = %v, want nil", err)
-	}
-	if finalBrand != core.BrandLark || result.ClientSecret != "test-secret" {
-		t.Errorf("result = (%q, %q), want (test-secret, lark)", result.ClientSecret, finalBrand)
-	}
-	want := []string{"accounts.feishu.cn", "accounts.larksuite.com"}
-	if len(polledHosts) != 2 || polledHosts[0] != want[0] || polledHosts[1] != want[1] {
-		t.Errorf("polled hosts = %v, want %v", polledHosts, want)
-	}
-}
-
-// Polling has no attempt cap: only the expiry budget terminates the loop.
-func TestRegisterAppWithDiscovery_NoAttemptCap(t *testing.T) {
-	polls := 0
-	client := &http.Client{Transport: roundTripFunc(func(r *http.Request) (*http.Response, error) {
-		polls++
-		if polls <= 250 {
-			return jsonResponse(`{"error":"authorization_pending"}`), nil
-		}
-		return jsonResponse(`{"client_id":"cli_x","client_secret":"test-secret"}`), nil
-	})}
-	resp := &AppRegistrationResponse{DeviceCode: "device", Interval: 0, ExpiresIn: 30}
-
-	result, _, err := RegisterAppWithDiscovery(context.Background(), client, resp, io.Discard)
-	if err != nil {
-		t.Fatalf("RegisterAppWithDiscovery error = %v, want nil (no attempts cap)", err)
-	}
-	if polls != 251 || result.ClientSecret != "test-secret" {
-		t.Errorf("polls = %d (want 251), secret = %q", polls, result.ClientSecret)
-	}
-}
-
-// A final tenant report contradicting the issuing domain is a protocol
-// violation, not a brand override: the saved brand must never diverge from
-// the domain that issued the credentials.
-func TestRegisterAppWithDiscovery_ContradictoryFinalBrandFails(t *testing.T) {
-	client := &http.Client{Transport: roundTripFunc(func(r *http.Request) (*http.Response, error) {
-		if r.URL.Host == "accounts.feishu.cn" {
-			return jsonResponse(`{"error":"authorization_pending","user_info":{"tenant_brand":"lark"}}`), nil
-		}
-		// The lark domain issues credentials but reports a feishu tenant.
-		return jsonResponse(`{"client_id":"cli_x","client_secret":"test-secret","user_info":{"tenant_brand":"feishu"}}`), nil
-	})}
-	resp := &AppRegistrationResponse{DeviceCode: "device", Interval: 0, ExpiresIn: 5}
-
-	_, _, err := RegisterAppWithDiscovery(context.Background(), client, resp, io.Discard)
-	if err == nil || !strings.Contains(err.Error(), "contradictory tenant brand") {
-		t.Errorf("err = %v, want contradictory-tenant-brand protocol error", err)
-	}
-}
-
-// A cancelled body read during begin must keep its context cause so the
-// command layer classifies it as a cancellation, not an API failure.
-func TestRequestAppRegistration_BodyReadCancelKeepsCause(t *testing.T) {
-	client := &http.Client{Transport: roundTripFunc(func(r *http.Request) (*http.Response, error) {
-		return &http.Response{
-			StatusCode: http.StatusOK,
-			Body:       io.NopCloser(&errReader{err: context.Canceled}),
-			Header:     make(http.Header),
-		}, nil
-	})}
-	_, err := RequestAppRegistration(context.Background(), client, core.BrandFeishu, io.Discard)
-	if !errors.Is(err, context.Canceled) {
-		t.Errorf("err = %v, want a context.Canceled cause", err)
-	}
-}
-
-type errReader struct{ err error }
-
-func (r *errReader) Read([]byte) (int, error) { return 0, r.err }

internal/auth/testmain_test.go

@@ -1,23 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package auth
-
-import (
-	"os"
-	"path/filepath"
-	"testing"
-)
-
-func TestMain(m *testing.M) {
-	root, err := os.MkdirTemp("", "lark-cli-internal-auth-test-*")
-	if err != nil {
-		panic(err)
-	}
-	if err := os.Setenv("LARKSUITE_CLI_LOG_DIR", filepath.Join(root, "logs")); err != nil {
-		panic(err)
-	}
-	code := m.Run()
-	_ = os.RemoveAll(root)
-	os.Exit(code)
-}

internal/auth/transport.go

@@ -17,8 +17,6 @@ import (
 	"github.com/larksuite/cli/internal/transport"
 )
 
-var _ transport.RoundTripperDecorator = (*SecurityPolicyTransport)(nil)
-
 // SecurityPolicyTransport is an http.RoundTripper that intercepts all responses
 // and checks for security policy errors.
 type SecurityPolicyTransport struct {
@@ -33,16 +31,6 @@ func (t *SecurityPolicyTransport) base() http.RoundTripper {
 	return transport.Fallback()
 }
 
-func (t *SecurityPolicyTransport) BaseRoundTripper() http.RoundTripper {
-	return t.base()
-}
-
-func (t *SecurityPolicyTransport) WithBaseRoundTripper(base http.RoundTripper) http.RoundTripper {
-	cloned := *t
-	cloned.Base = base
-	return &cloned
-}
-
 // RoundTrip implements http.RoundTripper.
 func (t *SecurityPolicyTransport) RoundTrip(req *http.Request) (*http.Response, error) {
 	resp, err := t.base().RoundTrip(req)

internal/client/client.go

@@ -212,9 +212,6 @@ func (c *APIClient) DoStream(ctx context.Context, req *larkcore.ApiReq, as core.
 	resp, err := httpClient.Do(httpReq)
 	if err != nil {
 		cancel()
-		if _, ok := errs.ProblemOf(err); ok {
-			return nil, err
-		}
 		return nil, errs.NewNetworkError(classifyNetworkSubtype(err), "stream request failed: %s", err).WithCause(err)
 	}
 	resp.Body = &cancelOnCloseBody{ReadCloser: resp.Body, cancel: cancel}

internal/client/client_test.go

@@ -518,29 +518,6 @@ func TestDoStream_TransportFailureSplitsSubtype(t *testing.T) {
 	}
 }
 
-func TestDoStream_PreservesTypedTransportError(t *testing.T) {
-	policyErr := errs.NewSecurityPolicyError(errs.SubtypeAccessDenied, "blocked redirect")
-	ac := &APIClient{
-		HTTP: &http.Client{Transport: roundTripFunc(func(*http.Request) (*http.Response, error) {
-			return nil, policyErr
-		})},
-		Credential: credential.NewCredentialProvider(nil, nil, &staticTokenResolver{}, nil),
-		Config:     &core.CliConfig{AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu},
-	}
-
-	_, err := ac.DoStream(context.Background(), &larkcore.ApiReq{
-		HttpMethod: http.MethodGet,
-		ApiPath:    "/open-apis/drive/v1/files/file_token/download",
-	}, core.AsBot)
-	problem, ok := errs.ProblemOf(err)
-	if !ok || problem.Category != errs.CategoryPolicy || problem.Subtype != errs.SubtypeAccessDenied {
-		t.Fatalf("DoStream() problem = %#v, %v; want policy/access_denied", problem, ok)
-	}
-	if !errors.Is(err, policyErr) {
-		t.Fatal("DoStream() did not preserve the typed transport error")
-	}
-}
-
 // failingTokenResolver always returns TokenUnavailableError, exercising the
 // auth/credential failure path through resolveAccessToken.
 type failingTokenResolver struct{}

internal/client/response.go

@@ -132,14 +132,16 @@ func HandleResponse(resp *larkcore.ApiResp, opts ResponseOptions) error {
 			})
 		}
 
-		emitter := output.NewEmitter(output.EmitterConfig{
-			Out:            opts.Out,
-			ErrOut:         opts.ErrOut,
-			CommandPath:    opts.CommandPath,
-			Identity:       string(identity),
-			NoticeProvider: output.GetNotice,
-		})
-		return emitter.Success(result, output.EmitOptions{Format: opts.Format.String()})
+		// Content safety scanning for non-JSON presentation formats.
+		scanResult := output.ScanForSafety(opts.CommandPath, result, opts.ErrOut)
+		if scanResult.Blocked {
+			return scanResult.BlockErr
+		}
+		if scanResult.Alert != nil {
+			output.WriteAlertWarning(opts.ErrOut, scanResult.Alert)
+		}
+		output.FormatValue(opts.Out, result, opts.Format)
+		return nil
 	}
 
 	// Non-JSON (binary) responses.

internal/client/response_test.go

@@ -18,7 +18,6 @@ import (
 
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/core"
-	"github.com/larksuite/cli/internal/httpmock"
 	"github.com/larksuite/cli/internal/output"
 	"github.com/larksuite/cli/internal/vfs/localfileio"
 )
@@ -240,87 +239,6 @@ func TestHandleResponse_JSON(t *testing.T) {
 	}
 }
 
-func TestHandleResponse_NonJSONFormatsEmitExactStructuredResponseBytes(t *testing.T) {
-	tests := []struct {
-		name   string
-		format output.Format
-		want   string
-	}{
-		{
-			name:   "ndjson",
-			format: output.FormatNDJSON,
-			want:   "{\"id\":\"1\",\"name\":\"Alice\"}\n{\"id\":\"2\",\"name\":\"Bob\"}\n",
-		},
-		{
-			name:   "table",
-			format: output.FormatTable,
-			want:   "id  name \n──  ─────\n1   Alice\n2   Bob  \n",
-		},
-		{
-			name:   "csv",
-			format: output.FormatCSV,
-			want:   "id,name\n1,Alice\n2,Bob\n",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			t.Setenv("LARKSUITE_CLI_CONTENT_SAFETY_MODE", "off")
-			reg := &httpmock.Registry{}
-			reg.Register(&httpmock.Stub{
-				Method: http.MethodGet,
-				URL:    "/open-apis/test/v1/items",
-				Body: map[string]interface{}{
-					"code": 0,
-					"msg":  "ok",
-					"data": map[string]interface{}{
-						"items": []interface{}{
-							map[string]interface{}{"id": "1", "name": "Alice"},
-							map[string]interface{}{"id": "2", "name": "Bob"},
-						},
-						"has_more": false,
-					},
-				},
-			})
-
-			httpResp, err := httpmock.NewClient(reg).Get("https://open.feishu.cn/open-apis/test/v1/items")
-			if err != nil {
-				t.Fatalf("fixture request failed: %v", err)
-			}
-			body, err := io.ReadAll(httpResp.Body)
-			_ = httpResp.Body.Close()
-			if err != nil {
-				t.Fatalf("read fixture response: %v", err)
-			}
-			resp := &larkcore.ApiResp{
-				StatusCode: httpResp.StatusCode,
-				Header:     httpResp.Header.Clone(),
-				RawBody:    body,
-			}
-
-			var out bytes.Buffer
-			var errOut bytes.Buffer
-			err = HandleResponse(resp, ResponseOptions{
-				Format:      tt.format,
-				Identity:    core.AsBot,
-				Out:         &out,
-				ErrOut:      &errOut,
-				CommandPath: "lark-cli api GET",
-			})
-			if err != nil {
-				t.Fatalf("HandleResponse() error = %v, want nil", err)
-			}
-			if got := out.String(); got != tt.want {
-				t.Fatalf("stdout byte mismatch\ngot (%d bytes):\n%q\nwant (%d bytes):\n%q", len(got), got, len(tt.want), tt.want)
-			}
-			if got := errOut.String(); got != "" {
-				t.Fatalf("stderr bytes = %q, want empty", got)
-			}
-			reg.Verify(t)
-		})
-	}
-}
-
 func TestHandleResponse_JSONWithJqUsesSuccessEnvelope(t *testing.T) {
 	body := []byte(`{"code":0,"msg":"ok","data":{"id":"1"}}`)
 	resp := newApiResp(body, map[string]string{"Content-Type": "application/json"})

internal/cmdmeta/meta.go

@@ -2,11 +2,9 @@
 // SPDX-License-Identifier: MIT
 
 // Package cmdmeta is the single source of truth for command metadata that the
-// policy engine, the hook selector, and help rendering consume. It wraps the
-// existing cmdutil annotations (risk_level, supportedIdentities) and adds the
-// "domain" axis that the hook selector and Rule path globs need, plus the
-// affordance ref (service, method id) that lets service-method and shortcut
-// help share one usage-guidance lookup path.
+// policy engine and the hook selector both consume. It wraps the existing
+// cmdutil annotations (risk_level, supportedIdentities) and adds the
+// "domain" axis that the hook selector and Rule path globs need.
 //
 // Three axes:
 //
@@ -53,12 +51,6 @@ const (
 
 	sourceAnnotationKey    = "cmdmeta.source"
 	generatedAnnotationKey = "cmdmeta.generated"
-
-	// affordance{Service,Method}Key locate the command's usage-guidance overlay
-	// entry (see internal/affordance). Both service-method commands and
-	// +-prefixed shortcuts set these so help rendering shares one lookup path.
-	affordanceServiceKey = "cmdmeta.affordance.service"
-	affordanceMethodKey  = "cmdmeta.affordance.method"
 )
 
 // Meta groups the three command-level metadata axes consumed by the policy
@@ -133,35 +125,6 @@ func SetSource(cmd *cobra.Command, source Source, generated bool) {
 	}
 }
 
-// SetAffordanceRef records which affordance overlay entry (service, method id)
-// a command maps to, so help rendering can look up its usage guidance. Stored
-// on the command itself (no inheritance): each method / shortcut owns its ref.
-// A no-op if either coordinate is empty.
-func SetAffordanceRef(cmd *cobra.Command, service, method string) {
-	if service == "" || method == "" {
-		return
-	}
-	if cmd.Annotations == nil {
-		cmd.Annotations = map[string]string{}
-	}
-	cmd.Annotations[affordanceServiceKey] = service
-	cmd.Annotations[affordanceMethodKey] = method
-}
-
-// AffordanceRef returns the command's own affordance overlay coordinates.
-// ok is false when the command carries no ref.
-func AffordanceRef(cmd *cobra.Command) (service, method string, ok bool) {
-	if cmd.Annotations == nil {
-		return "", "", false
-	}
-	service = cmd.Annotations[affordanceServiceKey]
-	method = cmd.Annotations[affordanceMethodKey]
-	if service == "" || method == "" {
-		return "", "", false
-	}
-	return service, method, true
-}
-
 // Domain returns the nearest-ancestor domain for the command. Empty string
 // when no ancestor has the annotation -- this is the "unknown" state the
 // policy engine must treat as ALLOW.

internal/cmdutil/dryrun.go

@@ -8,29 +8,15 @@ import (
 	"fmt"
 	"io"
 	"net/url"
-	"regexp"
 	"sort"
 	"strings"
 
-	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/client"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/output"
 	"github.com/larksuite/cli/internal/util"
 )
 
-var dryRunURLPlaceholderRE = regexp.MustCompile(`:([A-Za-z_][A-Za-z0-9_]*)`)
-
-// DryRunOutputOptions controls dry-run stdout/stderr rendering.
-type DryRunOutputOptions struct {
-	Format      string
-	JqExpr      string
-	CommandPath string
-	Identity    core.Identity
-	Out         io.Writer
-	ErrOut      io.Writer
-}
-
 // DryRunAPICall describes a single API call in dry-run output.
 type DryRunAPICall struct {
 	Desc   string                 `json:"desc,omitempty"`
@@ -40,21 +26,12 @@ type DryRunAPICall struct {
 	Body   interface{}            `json:"body,omitempty"`
 }
 
-// DryRunContext is the execution context shared by every dry-run preview:
-// which app would make the call and, when known, as which user. The identity
-// itself lives at the envelope top level, not here.
-type DryRunContext struct {
-	AppID      string `json:"app_id,omitempty"`
-	UserOpenID string `json:"user_open_id,omitempty"`
-}
-
 // DryRunAPI is the builder and result type for dry-run output.
 // URL templates use :param placeholders; Set stores actual values; MarshalJSON and Format resolve them.
 type DryRunAPI struct {
-	desc    string
-	calls   []DryRunAPICall
-	context *DryRunContext
-	extra   map[string]interface{}
+	desc  string
+	calls []DryRunAPICall
+	extra map[string]interface{}
 }
 
 func NewDryRunAPI() *DryRunAPI {
@@ -63,22 +40,30 @@ func NewDryRunAPI() *DryRunAPI {
 
 // --- HTTP method builders (add a call, return self for chaining) ---
 
-// call appends a request with the method transcribed verbatim, so previews
-// never misreport what the real client would send.
-func (d *DryRunAPI) call(method, url string) *DryRunAPI {
-	d.calls = append(d.calls, DryRunAPICall{Method: method, URL: url})
+func (d *DryRunAPI) GET(url string) *DryRunAPI {
+	d.calls = append(d.calls, DryRunAPICall{Method: "GET", URL: url})
 	return d
 }
 
-func (d *DryRunAPI) GET(url string) *DryRunAPI { return d.call("GET", url) }
+func (d *DryRunAPI) POST(url string) *DryRunAPI {
+	d.calls = append(d.calls, DryRunAPICall{Method: "POST", URL: url})
+	return d
+}
 
-func (d *DryRunAPI) POST(url string) *DryRunAPI { return d.call("POST", url) }
+func (d *DryRunAPI) PUT(url string) *DryRunAPI {
+	d.calls = append(d.calls, DryRunAPICall{Method: "PUT", URL: url})
+	return d
+}
 
-func (d *DryRunAPI) PUT(url string) *DryRunAPI { return d.call("PUT", url) }
+func (d *DryRunAPI) DELETE(url string) *DryRunAPI {
+	d.calls = append(d.calls, DryRunAPICall{Method: "DELETE", URL: url})
+	return d
+}
 
-func (d *DryRunAPI) DELETE(url string) *DryRunAPI { return d.call("DELETE", url) }
-
-func (d *DryRunAPI) PATCH(url string) *DryRunAPI { return d.call("PATCH", url) }
+func (d *DryRunAPI) PATCH(url string) *DryRunAPI {
+	d.calls = append(d.calls, DryRunAPICall{Method: "PATCH", URL: url})
+	return d
+}
 
 // Body sets the request body on the last added call.
 func (d *DryRunAPI) Body(body interface{}) *DryRunAPI {
@@ -113,26 +98,12 @@ func (d *DryRunAPI) Set(key string, value interface{}) *DryRunAPI {
 	return d
 }
 
-// Context records the calling app/user under data.context; empty values are
-// omitted, and a fully empty context is not emitted at all.
-func (d *DryRunAPI) Context(appID, userOpenID string) *DryRunAPI {
-	if appID == "" && userOpenID == "" {
-		return d
-	}
-	d.context = &DryRunContext{AppID: appID, UserOpenID: userOpenID}
-	return d
-}
-
 // resolveURL replaces :key placeholders in url with path-escaped values from extra.
 func (d *DryRunAPI) resolveURL(rawURL string) string {
-	return dryRunURLPlaceholderRE.ReplaceAllStringFunc(rawURL, func(token string) string {
-		name := token[1:]
-		value, ok := d.extra[name]
-		if !ok {
-			return token
-		}
-		return url.PathEscape(fmt.Sprintf("%v", value))
-	})
+	for k, v := range d.extra {
+		rawURL = strings.ReplaceAll(rawURL, ":"+k, url.PathEscape(fmt.Sprintf("%v", v)))
+	}
+	return rawURL
 }
 
 // MarshalJSON serializes as {"description": "...", "api": [...calls with resolved URLs], ...extra}.
@@ -147,17 +118,13 @@ func (d *DryRunAPI) MarshalJSON() ([]byte, error) {
 			Body:   c.Body,
 		}
 	}
-	m := make(map[string]interface{}, len(d.extra)+3)
-	for k, v := range d.extra {
-		m[k] = v
-	}
-	// Typed fields win over same-named extra keys.
+	m := make(map[string]interface{}, len(d.extra)+2)
 	if d.desc != "" {
 		m["description"] = d.desc
 	}
 	m["api"] = resolved
-	if d.context != nil {
-		m["context"] = d.context
+	for k, v := range d.extra {
+		m[k] = v
 	}
 	return json.Marshal(m)
 }
@@ -187,7 +154,11 @@ func (d *DryRunAPI) Format() string {
 			u += "?" + encodeParams(c.Params)
 		}
 
-		b.WriteString(c.Method)
+		method := c.Method
+		if method == "" {
+			method = "GET"
+		}
+		b.WriteString(method)
 		b.WriteByte(' ')
 		b.WriteString(u)
 		b.WriteByte('\n')
@@ -244,74 +215,83 @@ func encodeParams(params map[string]interface{}) string {
 	return vals.Encode()
 }
 
-// buildDryRunPreview assembles the shared preview skeleton: HTTP method, URL,
-// query params, and the app/user context common to every dry-run.
-func buildDryRunPreview(request client.RawApiRequest, config *core.CliConfig) *DryRunAPI {
-	dr := NewDryRunAPI().call(request.Method, request.URL)
+// PrintDryRunWithFile outputs a dry-run summary for file upload requests.
+// Instead of serializing the Formdata body, it shows file metadata.
+func PrintDryRunWithFile(w io.Writer, request client.RawApiRequest, config *core.CliConfig, format, fileField, filePath string, formFields any) error {
+	dr := NewDryRunAPI()
+	switch request.Method {
+	case "POST":
+		dr.POST(request.URL)
+	case "PUT":
+		dr.PUT(request.URL)
+	case "PATCH":
+		dr.PATCH(request.URL)
+	case "DELETE":
+		dr.DELETE(request.URL)
+	default:
+		dr.GET(request.URL)
+	}
 	if len(request.Params) > 0 {
 		dr.Params(request.Params)
 	}
-	// Identity is reported at the envelope top level, not duplicated here.
-	dr.Context(config.AppID, config.UserOpenId)
-	return dr
-}
-
-// PrintDryRunWithFile outputs a dry-run summary for file upload requests.
-// Instead of serializing the Formdata body, it shows file metadata.
-func PrintDryRunWithFile(request client.RawApiRequest, config *core.CliConfig, opts DryRunOutputOptions, file FileUploadMeta) error {
-	dr := buildDryRunPreview(request, config)
-	filePathDisplay := file.FilePath
+	filePathDisplay := filePath
 	if filePathDisplay == "" {
 		filePathDisplay = "<stdin>"
 	}
 	fileInfo := map[string]any{
-		"file": map[string]string{"field": file.FieldName, "path": filePathDisplay},
+		"file": map[string]string{"field": fileField, "path": filePathDisplay},
 	}
-	if file.FormFields != nil {
-		fileInfo["form_fields"] = file.FormFields
+	if formFields != nil {
+		fileInfo["form_fields"] = formFields
 	}
 	fileInfo["options"] = []string{"WithFileUpload"}
 	dr.Body(fileInfo)
-	return WriteDryRun(dr, opts)
+	dr.Set("as", string(request.As))
+	dr.Set("appId", config.AppID)
+	if config.UserOpenId != "" {
+		dr.Set("userOpenId", config.UserOpenId)
+	}
+	fmt.Fprintln(w, "=== Dry Run ===")
+	if format == "pretty" {
+		fmt.Fprint(w, dr.Format())
+	} else {
+		output.PrintJson(w, dr)
+	}
+	return nil
 }
 
 // PrintDryRun outputs a standardised dry-run summary using DryRunAPI.
 // When format is "pretty", outputs human-readable text; otherwise JSON.
-func PrintDryRun(request client.RawApiRequest, config *core.CliConfig, opts DryRunOutputOptions) error {
-	dr := buildDryRunPreview(request, config)
+func PrintDryRun(w io.Writer, request client.RawApiRequest, config *core.CliConfig, format string) error {
+	dr := NewDryRunAPI()
+	switch request.Method {
+	case "POST":
+		dr.POST(request.URL)
+	case "PUT":
+		dr.PUT(request.URL)
+	case "PATCH":
+		dr.PATCH(request.URL)
+	case "DELETE":
+		dr.DELETE(request.URL)
+	default:
+		dr.GET(request.URL)
+	}
+	if len(request.Params) > 0 {
+		dr.Params(request.Params)
+	}
 	if !util.IsNil(request.Data) {
 		dr.Body(request.Data)
 	}
-	return WriteDryRun(dr, opts)
-}
-
-// WriteDryRun emits a DryRunAPI using the shared dry-run output contract.
-// Identity may be empty; the envelope omits it rather than guessing.
-func WriteDryRun(dr *DryRunAPI, opts DryRunOutputOptions) error {
-	if dr == nil {
-		return errs.NewInternalError(errs.SubtypeUnknown, "dry-run produced no request preview")
+	dr.Set("as", string(request.As))
+	dr.Set("appId", config.AppID)
+	if config.UserOpenId != "" {
+		dr.Set("userOpenId", config.UserOpenId)
 	}
-	// The JqExpr guard is defensive: every entry point already rejects --jq
-	// combined with --format pretty via output.ValidateJqFlags.
-	if opts.Format == "pretty" && opts.JqExpr == "" {
-		// A nil ErrOut only skips the banner decoration (mirroring
-		// WriteSuccessEnvelope's warning path); the payload write to Out
-		// must fail loudly rather than be silently discarded.
-		if opts.ErrOut != nil {
-			fmt.Fprintln(opts.ErrOut, "=== Dry Run ===")
-		}
-		// stdout carries its own marker so logs that drop stderr still show
-		// this was a preview, not an executed request.
-		fmt.Fprintln(opts.Out, "# dry-run: request not sent")
-		fmt.Fprint(opts.Out, dr.Format())
-		return nil
+	fmt.Fprintln(w, "=== Dry Run ===")
+	if format == "pretty" {
+		fmt.Fprint(w, dr.Format())
+	} else {
+		output.PrintJson(w, dr)
 	}
-	return output.WriteSuccessEnvelope(dr, output.SuccessEnvelopeOptions{
-		CommandPath: opts.CommandPath,
-		Identity:    string(opts.Identity),
-		DryRun:      true,
-		JqExpr:      opts.JqExpr,
-		Out:         opts.Out,
-		ErrOut:      opts.ErrOut,
-	})
+	return nil
 }

internal/cmdutil/dryrun_test.go

@@ -6,12 +6,9 @@ package cmdutil
 import (
 	"bytes"
 	"encoding/json"
-	"errors"
-	"io"
 	"strings"
 	"testing"
 
-	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/client"
 	"github.com/larksuite/cli/internal/core"
 )
@@ -69,31 +66,11 @@ func TestDryRunAPI_ResolveURL(t *testing.T) {
 	}
 }
 
-func TestDryRunAPI_ResolveURLMatchesFullPlaceholderOnly(t *testing.T) {
-	dr := NewDryRunAPI().
-		GET("/open-apis/task/v2/tasks/:assignee_id").
-		Set("assignee", "ou_bot")
-
-	text := dr.Format()
-	if strings.Contains(text, "ou_bot_id") {
-		t.Fatalf("prefix placeholder key corrupted longer token: %s", text)
-	}
-	if !strings.Contains(text, ":assignee_id") {
-		t.Fatalf("missing unresolved placeholder, got: %s", text)
-	}
-
-	dr.Set("assignee_id", "ou_abc/123")
-	text = dr.Format()
-	if !strings.Contains(text, "/open-apis/task/v2/tasks/ou_abc%2F123") {
-		t.Fatalf("expected full placeholder replacement with path escaping, got: %s", text)
-	}
-}
-
 func TestDryRunAPI_MarshalJSON(t *testing.T) {
 	dr := NewDryRunAPI().
 		Desc("test api").
 		GET("/open-apis/test").
-		Set("note", "audit")
+		Set("as", "user")
 
 	data, err := json.Marshal(dr)
 	if err != nil {
@@ -106,8 +83,8 @@ func TestDryRunAPI_MarshalJSON(t *testing.T) {
 	if m["description"] != "test api" {
 		t.Errorf("expected description, got: %v", m["description"])
 	}
-	if m["note"] != "audit" {
-		t.Errorf("expected note=audit, got: %v", m["note"])
+	if m["as"] != "user" {
+		t.Errorf("expected as=user, got: %v", m["as"])
 	}
 	api, ok := m["api"].([]interface{})
 	if !ok || len(api) != 1 {
@@ -146,67 +123,31 @@ func TestDryRunAPI_ExtraFieldsOnly(t *testing.T) {
 
 func TestPrintDryRun_JSON(t *testing.T) {
 	var buf bytes.Buffer
-	var errBuf bytes.Buffer
-	err := PrintDryRun(client.RawApiRequest{
+	err := PrintDryRun(&buf, client.RawApiRequest{
 		Method: "GET",
 		URL:    "/open-apis/test",
 		As:     "user",
-	}, &core.CliConfig{AppID: "app123"}, DryRunOutputOptions{
-		Format:      "json",
-		CommandPath: "lark-cli api",
-		Identity:    core.AsUser,
-		Out:         &buf,
-		ErrOut:      &errBuf,
-	})
+	}, &core.CliConfig{AppID: "app123"}, "json")
 	if err != nil {
 		t.Fatalf("PrintDryRun failed: %v", err)
 	}
 	out := buf.String()
-	if strings.Contains(out, "=== Dry Run ===") {
-		t.Fatalf("JSON stdout must not contain banner, got: %s", out)
+	if !strings.Contains(out, "=== Dry Run ===") {
+		t.Errorf("expected header, got: %s", out)
 	}
-	var env map[string]interface{}
-	if err := json.Unmarshal(buf.Bytes(), &env); err != nil {
-		t.Fatalf("dry-run stdout is not JSON: %v\n%s", err, out)
-	}
-	if env["ok"] != true || env["identity"] != "user" || env["dry_run"] != true {
-		t.Fatalf("unexpected envelope: %#v", env)
-	}
-	data, ok := env["data"].(map[string]interface{})
-	if !ok {
-		t.Fatalf("unexpected data: %#v", env["data"])
-	}
-	dctx, ok := data["context"].(map[string]interface{})
-	if !ok || dctx["app_id"] != "app123" {
-		t.Fatalf("unexpected data.context: %#v", data["context"])
-	}
-	if _, exists := data["as"]; exists {
-		t.Fatalf("data.as must not appear; identity lives at the envelope top level: %#v", data)
-	}
-	api, ok := data["api"].([]interface{})
-	if !ok || len(api) != 1 {
-		t.Fatalf("api = %#v, want one call", data["api"])
-	}
-	call, ok := api[0].(map[string]interface{})
-	if !ok || call["url"] != "/open-apis/test" {
-		t.Fatalf("api[0] = %#v", api[0])
+	if !strings.Contains(out, "app123") {
+		t.Errorf("expected appId in output, got: %s", out)
 	}
 }
 
 func TestPrintDryRun_Pretty(t *testing.T) {
 	var buf bytes.Buffer
-	var errBuf bytes.Buffer
-	err := PrintDryRun(client.RawApiRequest{
+	err := PrintDryRun(&buf, client.RawApiRequest{
 		Method: "POST",
 		URL:    "/open-apis/test",
 		Data:   map[string]interface{}{"key": "val"},
 		As:     "bot",
-	}, &core.CliConfig{AppID: "app456"}, DryRunOutputOptions{
-		Format:   "pretty",
-		Identity: core.AsBot,
-		Out:      &buf,
-		ErrOut:   &errBuf,
-	})
+	}, &core.CliConfig{AppID: "app456"}, "pretty")
 	if err != nil {
 		t.Fatalf("PrintDryRun failed: %v", err)
 	}
@@ -214,136 +155,6 @@ func TestPrintDryRun_Pretty(t *testing.T) {
 	if !strings.Contains(out, "POST /open-apis/test") {
 		t.Errorf("expected POST line in pretty output, got: %s", out)
 	}
-	if !strings.HasPrefix(out, "# dry-run: request not sent\n") {
-		t.Fatalf("pretty stdout should start with the dry-run marker, got: %s", out)
-	}
-	if strings.Contains(out, "=== Dry Run ===") {
-		t.Fatalf("pretty stdout must not contain banner, got: %s", out)
-	}
-	if !strings.Contains(errBuf.String(), "=== Dry Run ===") {
-		t.Fatalf("pretty stderr should contain banner, got: %s", errBuf.String())
-	}
-}
-
-func TestPrintDryRun_WithJqUsesEnvelope(t *testing.T) {
-	var buf bytes.Buffer
-	err := PrintDryRun(client.RawApiRequest{
-		Method: "GET",
-		URL:    "/open-apis/test",
-		As:     "bot",
-	}, &core.CliConfig{AppID: "app123"}, DryRunOutputOptions{
-		Format:   "json",
-		JqExpr:   ".data.api[0].url",
-		Identity: core.AsBot,
-		Out:      &buf,
-		ErrOut:   io.Discard,
-	})
-	if err != nil {
-		t.Fatalf("PrintDryRun failed: %v", err)
-	}
-	if got := strings.TrimSpace(buf.String()); got != "/open-apis/test" {
-		t.Fatalf("jq output = %q, want /open-apis/test", got)
-	}
-}
-
-func TestPrintDryRunWithFile_JSONEnvelope(t *testing.T) {
-	var buf bytes.Buffer
-	err := PrintDryRunWithFile(client.RawApiRequest{
-		Method: "POST",
-		URL:    "/open-apis/drive/v1/files/upload_all",
-		As:     "bot",
-	}, &core.CliConfig{AppID: "app123", UserOpenId: "ou_tester"}, DryRunOutputOptions{
-		Format:   "json",
-		Identity: core.AsBot,
-		Out:      &buf,
-		ErrOut:   io.Discard,
-	}, FileUploadMeta{FieldName: "file", FilePath: "report.txt", FormFields: map[string]any{"parent": "fld"}})
-	if err != nil {
-		t.Fatalf("PrintDryRunWithFile failed: %v", err)
-	}
-	var env map[string]interface{}
-	if err := json.Unmarshal(buf.Bytes(), &env); err != nil {
-		t.Fatalf("dry-run stdout is not JSON: %v\n%s", err, buf.String())
-	}
-	if env["dry_run"] != true {
-		t.Fatalf("dry_run = %#v, want true", env["dry_run"])
-	}
-	data := env["data"].(map[string]interface{})
-	api := data["api"].([]interface{})
-	call := api[0].(map[string]interface{})
-	body := call["body"].(map[string]interface{})
-	file := body["file"].(map[string]interface{})
-	if file["path"] != "report.txt" {
-		t.Fatalf("file body = %#v", body)
-	}
-	dctx, ok := data["context"].(map[string]interface{})
-	if !ok || dctx["app_id"] != "app123" || dctx["user_open_id"] != "ou_tester" {
-		t.Fatalf("unexpected data.context: %#v", data["context"])
-	}
-	for _, legacy := range []string{"as", "appId", "userOpenId"} {
-		if _, exists := data[legacy]; exists {
-			t.Fatalf("legacy key %q must not appear in data: %#v", legacy, data)
-		}
-	}
-}
-
-func TestPrintDryRun_MethodTranscribedVerbatim(t *testing.T) {
-	var buf bytes.Buffer
-	err := PrintDryRun(client.RawApiRequest{
-		Method: "OPTIONS",
-		URL:    "/open-apis/test",
-		As:     "bot",
-	}, &core.CliConfig{AppID: "app123"}, DryRunOutputOptions{
-		Format:   "json",
-		Identity: core.AsBot,
-		Out:      &buf,
-		ErrOut:   io.Discard,
-	})
-	if err != nil {
-		t.Fatalf("PrintDryRun failed: %v", err)
-	}
-	var env map[string]interface{}
-	if err := json.Unmarshal(buf.Bytes(), &env); err != nil {
-		t.Fatalf("dry-run stdout is not JSON: %v\n%s", err, buf.String())
-	}
-	call := env["data"].(map[string]interface{})["api"].([]interface{})[0].(map[string]interface{})
-	if call["method"] != "OPTIONS" {
-		t.Fatalf("method = %#v, want OPTIONS transcribed verbatim (not coerced to GET)", call["method"])
-	}
-}
-
-func TestPrintDryRun_EmptyConfigOmitsContext(t *testing.T) {
-	var buf bytes.Buffer
-	err := PrintDryRun(client.RawApiRequest{
-		Method: "GET",
-		URL:    "/open-apis/test",
-	}, &core.CliConfig{}, DryRunOutputOptions{
-		Format: "json",
-		Out:    &buf,
-		ErrOut: io.Discard,
-	})
-	if err != nil {
-		t.Fatalf("PrintDryRun failed: %v", err)
-	}
-	var env map[string]interface{}
-	if err := json.Unmarshal(buf.Bytes(), &env); err != nil {
-		t.Fatalf("dry-run stdout is not JSON: %v\n%s", err, buf.String())
-	}
-	data := env["data"].(map[string]interface{})
-	if _, exists := data["context"]; exists {
-		t.Fatalf("empty app/user context must be omitted entirely, got: %#v", data["context"])
-	}
-}
-
-func TestWriteDryRun_NilPreviewIsInternalError(t *testing.T) {
-	err := WriteDryRun(nil, DryRunOutputOptions{Format: "json", Out: io.Discard})
-	if err == nil {
-		t.Fatal("WriteDryRun(nil) should fail instead of emitting an empty preview")
-	}
-	var internal *errs.InternalError
-	if !errors.As(err, &internal) {
-		t.Fatalf("expected *errs.InternalError, got %T: %v", err, err)
-	}
 }
 
 func TestDryRunFormatValue(t *testing.T) {

internal/cmdutil/factory.go

@@ -16,12 +16,10 @@ import (
 	"github.com/larksuite/cli/errs"
 	extcred "github.com/larksuite/cli/extension/credential"
 	"github.com/larksuite/cli/extension/fileio"
-	exttransport "github.com/larksuite/cli/extension/transport"
 	"github.com/larksuite/cli/internal/client"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/credential"
 	"github.com/larksuite/cli/internal/keychain"
-	"github.com/larksuite/cli/internal/transport"
 )
 
 // Factory holds shared dependencies injected into every command.
@@ -33,7 +31,7 @@ type InvocationContext struct {
 
 type Factory struct {
 	Config     func() (*core.CliConfig, error) // lazily loads app config from Credential
-	HttpClient func() (*http.Client, error)    // policy-routed HTTP client for direct requests
+	HttpClient func() (*http.Client, error)    // HTTP client for non-Lark API calls (with retry and security headers)
 	LarkClient func() (*lark.Client, error)    // Lark SDK client for all Open API calls
 	IOStreams  *IOStreams                      // stdin/stdout/stderr streams
 
@@ -50,18 +48,6 @@ type Factory struct {
 	SkillContent fs.FS // embedded skill tree (rooted at the skill list); nil when the build embeds no skills
 }
 
-// ExternalHTTPClient returns a clone of the existing Factory client whose
-// requests are explicitly classified as external. The underlying client,
-// redirect policy, timeout, proxy configuration, and legacy transport provider
-// behavior are preserved.
-func (f *Factory) ExternalHTTPClient() (*http.Client, error) {
-	client, err := f.HttpClient()
-	if err != nil {
-		return nil, err
-	}
-	return transport.ClientForRequestClass(client, exttransport.RequestClassExternal), nil
-}
-
 // ResolveFileIO resolves a FileIO instance using the current execution context.
 // The provider controls whether the returned instance is fresh or cached.
 func (f *Factory) ResolveFileIO(ctx context.Context) fileio.FileIO {

internal/cmdutil/factory_default.go

@@ -5,18 +5,16 @@ package cmdutil
 
 import (
 	"context"
+	"fmt"
 	"io"
 	"net/http"
-	"net/url"
 	"os"
-	"strings"
 	"sync"
 	"time"
 
 	lark "github.com/larksuite/oapi-sdk-go/v3"
 	larkcore "github.com/larksuite/oapi-sdk-go/v3/core"
 
-	"github.com/larksuite/cli/errs"
 	extcred "github.com/larksuite/cli/extension/credential"
 	"github.com/larksuite/cli/extension/fileio"
 	"github.com/larksuite/cli/internal/auth"
@@ -24,7 +22,6 @@ import (
 	"github.com/larksuite/cli/internal/credential"
 	"github.com/larksuite/cli/internal/keychain"
 	"github.com/larksuite/cli/internal/registry"
-	"github.com/larksuite/cli/internal/riskcontrol"
 	_ "github.com/larksuite/cli/internal/security/contentsafety" // register content safety provider
 	"github.com/larksuite/cli/internal/transport"
 	_ "github.com/larksuite/cli/internal/vfs/localfileio" // register default FileIO provider
@@ -36,7 +33,7 @@ import (
 //	Phase 1: HttpClient (no credential dependency)
 //	Phase 2: Credential (sole data source for account info)
 //	Phase 3: Config derived from Credential
-//	Phase 4: LarkClient derived from Credential and workspace policy
+//	Phase 4: LarkClient derived from Credential
 func NewDefault(streams *IOStreams, inv InvocationContext) *Factory {
 	streams = normalizeStreams(streams)
 	f := &Factory{
@@ -50,19 +47,6 @@ func NewDefault(streams *IOStreams, inv InvocationContext) *Factory {
 	// workspace-scoped. Default is WorkspaceLocal — existing behavior unchanged.
 	ws := core.DetectWorkspaceFromEnv(os.Getenv)
 	core.SetCurrentWorkspace(ws)
-	workspaceConfig := core.NewConfigSnapshot()
-	bootstrapHostSignalSource := sync.OnceValue(func() riskcontrol.Source {
-		return resolveSDKHostSignalSource(workspaceConfig)
-	})
-	// Install after workspace selection so the dependency bootstrap bridge uses
-	// the correct shared proxy configuration. NewDefault is also used by cmd.Build
-	// consumers, so this keeps their request routing identical to cmd.Execute.
-	transport.InstallSDKTransportBridge(func(base http.RoundTripper) http.RoundTripper {
-		return buildSDKPlatformTransportWithBase(
-			base,
-			bootstrapHostSignalSource(),
-		)
-	})
 
 	// Inject workspace-aware dir into keychain's log system.
 	// This breaks the core↔keychain import cycle by using a function variable.
@@ -72,7 +56,7 @@ func NewDefault(streams *IOStreams, inv InvocationContext) *Factory {
 	f.FileIOProvider = fileio.GetProvider()
 
 	// Phase 1: HttpClient (no credential dependency)
-	f.HttpClient = cachedHttpClientFunc(f, workspaceConfig)
+	f.HttpClient = cachedHttpClientFunc(f)
 
 	// Phase 2: Credential (sole data source)
 	// Keychain is read via closure so callers can replace f.Keychain after construction.
@@ -83,7 +67,7 @@ func NewDefault(streams *IOStreams, inv InvocationContext) *Factory {
 		ErrOut:     f.IOStreams.ErrOut,
 	})
 
-	// Phase 3: Runtime config contains resolved account data only.
+	// Phase 3: Config derived from Credential via an explicit conversion boundary.
 	f.Config = sync.OnceValues(func() (*core.CliConfig, error) {
 		acct, err := f.Credential.ResolveAccount(context.Background())
 		if err != nil {
@@ -94,52 +78,21 @@ func NewDefault(streams *IOStreams, inv InvocationContext) *Factory {
 		return cfg, nil
 	})
 
-	// Phase 4: LarkClient composes account data and workspace policy at the SDK
-	// transport boundary.
-	f.LarkClient = cachedLarkClientFunc(f, workspaceConfig)
+	// Phase 4: LarkClient from Credential (placeholder AppSecret)
+	f.LarkClient = cachedLarkClientFunc(f)
 
 	return f
 }
 
-// safeRedirectPolicy permits cross-origin redirects only for bodyless GET and
-// HEAD requests. This allows API download redirects while preventing OAuth or
-// other credential-bearing request bodies from being replayed to another
-// origin. HTTPS requests can never be downgraded to HTTP.
+// safeRedirectPolicy prevents credential headers from being forwarded
+// when a response redirects to a different host (e.g. Lark API 302 → CDN).
+// Strips Authorization, X-Lark-MCP-UAT, and X-Lark-MCP-TAT on cross-host
+// redirects; other headers like X-Cli-* pass through.
 func safeRedirectPolicy(req *http.Request, via []*http.Request) error {
 	if len(via) >= 10 {
-		return errs.NewNetworkError(errs.SubtypeNetworkTransport, "too many redirects")
+		return fmt.Errorf("too many redirects")
 	}
-	if len(via) == 0 {
-		return nil
-	}
-	original := via[0]
-	previous := via[len(via)-1]
-	if previous.URL != nil && req.URL != nil && strings.EqualFold(previous.URL.Scheme, "https") && !strings.EqualFold(req.URL.Scheme, "https") {
-		return errs.NewSecurityPolicyError(
-			errs.SubtypeAccessDenied,
-			"redirect from HTTPS to %s is not allowed",
-			req.URL.Scheme,
-		)
-	}
-	if !sameRedirectOrigin(previous.URL, req.URL) {
-		if req.Method != http.MethodGet && req.Method != http.MethodHead {
-			return errs.NewSecurityPolicyError(
-				errs.SubtypeAccessDenied,
-				"cross-origin redirect for HTTP method %s is not allowed",
-				req.Method,
-			)
-		}
-		if req.Body != nil || req.GetBody != nil {
-			return errs.NewSecurityPolicyError(
-				errs.SubtypeAccessDenied,
-				"cross-origin redirect with a request body is not allowed",
-			)
-		}
-	}
-	// net/http copies initial headers onto every redirect request. Continue
-	// stripping credentials for every hop outside the initial origin, even when
-	// two consecutive redirect targets share an origin.
-	if !sameRedirectOrigin(original.URL, req.URL) {
+	if len(via) > 0 && req.URL.Host != via[0].URL.Host {
 		req.Header.Del("Authorization")
 		req.Header.Del("X-Lark-MCP-UAT")
 		req.Header.Del("X-Lark-MCP-TAT")
@@ -147,29 +100,6 @@ func safeRedirectPolicy(req *http.Request, via []*http.Request) error {
 	return nil
 }
 
-func sameRedirectOrigin(left, right *url.URL) bool {
-	if left == nil || right == nil {
-		return false
-	}
-	return strings.EqualFold(left.Scheme, right.Scheme) &&
-		strings.EqualFold(left.Hostname(), right.Hostname()) &&
-		effectivePort(left) == effectivePort(right)
-}
-
-func effectivePort(candidate *url.URL) string {
-	if port := candidate.Port(); port != "" {
-		return port
-	}
-	switch strings.ToLower(candidate.Scheme) {
-	case "http":
-		return "80"
-	case "https":
-		return "443"
-	default:
-		return ""
-	}
-}
-
 // warnIfProxied is a test seam for the proxy-warning gate. Production wires it
 // to transport.WarnIfProxied; tests swap in a spy to count invocations. It is
 // needed because the real function is guarded by an internal sync.Once, so
@@ -178,19 +108,19 @@ func effectivePort(candidate *url.URL) string {
 // .StderrIsTerminal field, which tests set directly.
 var warnIfProxied = transport.WarnIfProxied
 
-func cachedHttpClientFunc(f *Factory, workspaceConfig workspaceConfigSource) func() (*http.Client, error) {
+func cachedHttpClientFunc(f *Factory) func() (*http.Client, error) {
 	return sync.OnceValues(func() (*http.Client, error) {
 		if f.IOStreams.StderrIsTerminal {
 			warnIfProxied(f.IOStreams.ErrOut)
 		}
 
-		hostSignalSource := resolveSDKHostSignalSource(workspaceConfig)
-		shared := transport.Shared()
-		outbound := riskcontrol.NewTransport(shared, hostSignalSource)
-		platform := buildDirectHTTPTransport(outbound, true)
-		external := buildDirectHTTPTransport(outbound, false)
+		var rt http.RoundTripper = transport.Shared()
+		rt = &RetryTransport{Base: rt}
+		rt = &SecurityHeaderTransport{Base: rt}
+		rt = &auth.SecurityPolicyTransport{Base: rt} // Add our global response interceptor
+		rt = wrapWithExtension(rt)
 		client := &http.Client{
-			Transport:     transport.NewHTTPPolicyRouter(platform, external),
+			Transport:     rt,
 			Timeout:       30 * time.Second,
 			CheckRedirect: safeRedirectPolicy,
 		}
@@ -198,16 +128,7 @@ func cachedHttpClientFunc(f *Factory, workspaceConfig workspaceConfigSource) fun
 	})
 }
 
-func buildDirectHTTPTransport(base http.RoundTripper, platform bool) http.RoundTripper {
-	var builtIn http.RoundTripper = &RetryTransport{Base: base}
-	builtIn = &SecurityHeaderTransport{Base: builtIn}
-	if platform {
-		builtIn = &auth.SecurityPolicyTransport{Base: builtIn}
-	}
-	return builtIn
-}
-
-func cachedLarkClientFunc(f *Factory, workspaceConfig workspaceConfigSource) func() (*lark.Client, error) {
+func cachedLarkClientFunc(f *Factory) func() (*lark.Client, error) {
 	return sync.OnceValues(func() (*lark.Client, error) {
 		acct, err := f.Credential.ResolveAccount(context.Background())
 		if err != nil {
@@ -221,9 +142,8 @@ func cachedLarkClientFunc(f *Factory, workspaceConfig workspaceConfigSource) fun
 		if f.IOStreams.StderrIsTerminal {
 			warnIfProxied(f.IOStreams.ErrOut)
 		}
-		hostSignalSource := resolveSDKHostSignalSource(workspaceConfig)
 		opts = append(opts, lark.WithHttpClient(&http.Client{
-			Transport:     buildSDKTransport(hostSignalSource),
+			Transport:     buildSDKTransport(),
 			CheckRedirect: safeRedirectPolicy,
 		}))
 		ep := core.ResolveEndpoints(acct.Brand)
@@ -232,41 +152,13 @@ func cachedLarkClientFunc(f *Factory, workspaceConfig workspaceConfigSource) fun
 	})
 }
 
-func buildSDKTransport(hostSignalSource riskcontrol.Source) http.RoundTripper {
-	return buildSDKTransportWithBase(transport.Shared(), hostSignalSource)
-}
-
-func buildSDKPlatformTransportWithBase(
-	base http.RoundTripper,
-	hostSignalSource riskcontrol.Source,
-) http.RoundTripper {
-	outbound := riskcontrol.NewTransport(base, hostSignalSource)
-	return buildSDKHTTPTransport(outbound, true)
-}
-
-func buildSDKTransportWithBase(
-	base http.RoundTripper,
-	hostSignalSource riskcontrol.Source,
-) http.RoundTripper {
-	// Risk control is the innermost trusted boundary for both request classes.
-	// It therefore observes the final URL and strips extension-supplied reserved
-	// headers immediately before the network transport.
-	outbound := riskcontrol.NewTransport(base, hostSignalSource)
-	return transport.NewHTTPPolicyRouter(
-		buildSDKHTTPTransport(outbound, true),
-		buildSDKHTTPTransport(outbound, false),
-	)
-}
-
-func buildSDKHTTPTransport(base http.RoundTripper, platform bool) http.RoundTripper {
-	var builtIn http.RoundTripper = &RetryTransport{Base: base}
-	builtIn = &UserAgentTransport{Base: builtIn}
-	builtIn = &BuildHeaderTransport{Base: builtIn}
-	builtIn = &SecurityHeaderTransport{Base: builtIn}
-	if platform {
-		builtIn = &auth.SecurityPolicyTransport{Base: builtIn}
-	}
-	return builtIn
+func buildSDKTransport() http.RoundTripper {
+	var sdkTransport http.RoundTripper = transport.Shared()
+	sdkTransport = &RetryTransport{Base: sdkTransport}
+	sdkTransport = &UserAgentTransport{Base: sdkTransport}
+	sdkTransport = &BuildHeaderTransport{Base: sdkTransport}
+	sdkTransport = &auth.SecurityPolicyTransport{Base: sdkTransport}
+	return wrapWithExtension(sdkTransport)
 }
 
 type credentialDeps struct {

internal/cmdutil/factory_http_test.go

@@ -4,24 +4,12 @@
 package cmdutil
 
 import (
-	"errors"
 	"io"
-	"net/http"
-	"net/http/httptest"
-	"strings"
 	"testing"
-
-	"github.com/larksuite/cli/errs"
-	exttransport "github.com/larksuite/cli/extension/transport"
-	"github.com/larksuite/cli/internal/core"
-	internaltransport "github.com/larksuite/cli/internal/transport"
 )
 
-func TestCachedHTTPClientFunc_ReturnsSameInstance(t *testing.T) {
-	isEnabled := false
-	f, _, _, _ := TestFactory(t, &core.CliConfig{AppID: "test-app"})
-	f.IOStreams.ErrOut = io.Discard
-	fn := cachedHttpClientFunc(f, staticWorkspaceConfig{config: &core.MultiAppConfig{RiskControl: &isEnabled}})
+func TestCachedHttpClientFunc_ReturnsSameInstance(t *testing.T) {
+	fn := cachedHttpClientFunc(&Factory{IOStreams: &IOStreams{ErrOut: io.Discard}})
 
 	c1, err := fn()
 	if err != nil {
@@ -40,304 +28,18 @@ func TestCachedHTTPClientFunc_ReturnsSameInstance(t *testing.T) {
 	}
 }
 
-func TestCachedHTTPClientFunc_HasTimeout(t *testing.T) {
-	isEnabled := false
-	f, _, _, _ := TestFactory(t, &core.CliConfig{AppID: "test-app"})
-	f.IOStreams.ErrOut = io.Discard
-	fn := cachedHttpClientFunc(f, staticWorkspaceConfig{config: &core.MultiAppConfig{RiskControl: &isEnabled}})
+func TestCachedHttpClientFunc_HasTimeout(t *testing.T) {
+	fn := cachedHttpClientFunc(&Factory{IOStreams: &IOStreams{ErrOut: io.Discard}})
 	c, _ := fn()
 	if c.Timeout == 0 {
 		t.Error("expected non-zero timeout")
 	}
 }
 
-func TestCachedHTTPClientFunc_HasRedirectPolicy(t *testing.T) {
-	isEnabled := false
-	f, _, _, _ := TestFactory(t, &core.CliConfig{AppID: "test-app"})
-	f.IOStreams.ErrOut = io.Discard
-	fn := cachedHttpClientFunc(f, staticWorkspaceConfig{config: &core.MultiAppConfig{RiskControl: &isEnabled}})
+func TestCachedHttpClientFunc_HasRedirectPolicy(t *testing.T) {
+	fn := cachedHttpClientFunc(&Factory{IOStreams: &IOStreams{ErrOut: io.Discard}})
 	c, _ := fn()
 	if c.CheckRedirect == nil {
 		t.Error("expected CheckRedirect to be set (safeRedirectPolicy)")
 	}
 }
-
-func TestFactoryExternalHTTPClientClonesExistingClient(t *testing.T) {
-	base := &http.Client{Timeout: 17, CheckRedirect: safeRedirectPolicy}
-	factory := &Factory{HttpClient: func() (*http.Client, error) { return base, nil }}
-
-	external, err := factory.ExternalHTTPClient()
-	if err != nil {
-		t.Fatal(err)
-	}
-	if external == base {
-		t.Fatal("ExternalHTTPClient returned the cached client instead of a clone")
-	}
-	if external.Timeout != base.Timeout || external.CheckRedirect == nil {
-		t.Fatal("ExternalHTTPClient did not preserve client policy")
-	}
-	if base.Transport != nil {
-		t.Fatal("ExternalHTTPClient mutated the cached client's transport")
-	}
-}
-
-type platformOnlyStubProvider struct {
-	*stubTransportProvider
-}
-
-func (*platformOnlyStubProvider) SupportsRequestClass(class exttransport.RequestClass) bool {
-	return class == exttransport.RequestClassPlatform
-}
-
-func TestFactoryHTTPClientRoutesPoliciesByRequestClass(t *testing.T) {
-	t.Setenv("LARKSUITE_CLI_NO_PROXY", "1")
-
-	interceptor := &headerCapturingInterceptor{}
-	exttransport.Register(&platformOnlyStubProvider{stubTransportProvider: &stubTransportProvider{interceptor: interceptor}})
-	t.Cleanup(func() { exttransport.Register(nil) })
-
-	received := make(chan http.Header, 2)
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
-		received <- req.Header.Clone()
-		w.WriteHeader(http.StatusNoContent)
-	}))
-	t.Cleanup(server.Close)
-
-	factory := &Factory{IOStreams: &IOStreams{ErrOut: io.Discard}}
-	client, err := cachedHttpClientFunc(factory, nil)()
-	if err != nil {
-		t.Fatal(err)
-	}
-	factory.HttpClient = func() (*http.Client, error) { return client, nil }
-	platformClient := internaltransport.ClientForRequestClass(client, exttransport.RequestClassPlatform)
-	externalClient, err := factory.ExternalHTTPClient()
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	for _, client := range []*http.Client{platformClient, externalClient} {
-		resp, err := client.Get(server.URL)
-		if err != nil {
-			t.Fatal(err)
-		}
-		resp.Body.Close()
-	}
-
-	platformHeaders := <-received
-	if got := platformHeaders.Get("X-Custom-Trace"); got != "ext-trace-123" {
-		t.Fatalf("platform extension header = %q, want ext-trace-123", got)
-	}
-	if got := platformHeaders.Get(HeaderSource); got != SourceValue {
-		t.Fatalf("platform security header = %q, want %q", got, SourceValue)
-	}
-
-	externalHeaders := <-received
-	if got := externalHeaders.Get("X-Custom-Trace"); got != "" {
-		t.Fatalf("external request leaked extension header %q", got)
-	}
-	for header, values := range BaseSecurityHeaders() {
-		if len(values) == 0 {
-			continue
-		}
-		want := values[len(values)-1]
-		if got := externalHeaders.Get(header); got != want {
-			t.Fatalf("external security header %s = %q, want preserved value %q", header, got, want)
-		}
-	}
-}
-
-func TestFactoryExternalHTTPClientDoesNotParsePlatformErrorProtocol(t *testing.T) {
-	t.Setenv("LARKSUITE_CLI_NO_PROXY", "1")
-	exttransport.Register(nil)
-
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
-		w.Header().Set("Content-Type", "application/json")
-		_, _ = io.WriteString(w, `{"code":21000,"msg":"application-defined external response","data":{"cli_hint":"external-defined"}}`)
-	}))
-	t.Cleanup(server.Close)
-
-	factory := &Factory{IOStreams: &IOStreams{ErrOut: io.Discard}}
-	client, err := cachedHttpClientFunc(factory, nil)()
-	if err != nil {
-		t.Fatal(err)
-	}
-	factory.HttpClient = func() (*http.Client, error) { return client, nil }
-
-	platform := internaltransport.ClientForRequestClass(client, exttransport.RequestClassPlatform)
-	if _, err := platform.Get(server.URL); err == nil {
-		t.Fatal("platform request error = nil, want security policy classification")
-	} else {
-		var policyErr *errs.SecurityPolicyError
-		if !errors.As(err, &policyErr) {
-			t.Fatalf("platform request error type = %T, want *errs.SecurityPolicyError", err)
-		}
-	}
-
-	external, err := factory.ExternalHTTPClient()
-	if err != nil {
-		t.Fatal(err)
-	}
-	resp, err := external.Get(server.URL)
-	if err != nil {
-		t.Fatalf("external request parsed platform error protocol: %v", err)
-	}
-	resp.Body.Close()
-}
-
-func TestSafeRedirectPolicyAllowsBodylessCrossOriginGetAndStripsCredentials(t *testing.T) {
-	original, err := http.NewRequest(http.MethodGet, "https://open.feishu.cn/start", nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-	redirect, err := http.NewRequest(http.MethodGet, "https://cdn.example.com/file", nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-	for _, header := range []string{"Authorization", "X-Lark-MCP-UAT", "X-Lark-MCP-TAT"} {
-		redirect.Header.Set(header, "secret")
-	}
-
-	if err := safeRedirectPolicy(redirect, []*http.Request{original}); err != nil {
-		t.Fatalf("safeRedirectPolicy() error = %v, want allowed GET redirect", err)
-	}
-	for _, header := range []string{"Authorization", "X-Lark-MCP-UAT", "X-Lark-MCP-TAT"} {
-		if got := redirect.Header.Get(header); got != "" {
-			t.Fatalf("redirect retained %s=%q", header, got)
-		}
-	}
-}
-
-func TestSafeRedirectPolicyRejectsHTTPSDowngrade(t *testing.T) {
-	original, err := http.NewRequest(http.MethodGet, "https://open.feishu.cn/start", nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-	redirect, err := http.NewRequest(http.MethodGet, "http://open.feishu.cn/next", nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	err = safeRedirectPolicy(redirect, []*http.Request{original})
-	if err == nil || !strings.Contains(err.Error(), "HTTPS") {
-		t.Fatalf("safeRedirectPolicy() error = %v, want HTTPS downgrade rejection", err)
-	}
-	requireRedirectProblem(t, err, errs.CategoryPolicy, errs.SubtypeAccessDenied)
-}
-
-func TestSafeRedirectPolicyRejectsCrossOriginMethod(t *testing.T) {
-	original, err := http.NewRequest(http.MethodPost, "https://accounts.feishu.cn/token", nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-	redirect, err := http.NewRequest(http.MethodPost, "https://external.example/token", nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	err = safeRedirectPolicy(redirect, []*http.Request{original})
-	if err == nil || !strings.Contains(err.Error(), "HTTP method POST") {
-		t.Fatalf("safeRedirectPolicy() error = %v, want cross-origin method rejection", err)
-	}
-	requireRedirectProblem(t, err, errs.CategoryPolicy, errs.SubtypeAccessDenied)
-}
-
-func TestSafeRedirectPolicyRejectsCrossOriginRequestBody(t *testing.T) {
-	original, err := http.NewRequest(http.MethodGet, "https://accounts.feishu.cn/token", nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-	redirect, err := http.NewRequest(http.MethodGet, "https://external.example/token", strings.NewReader("client_secret=secret"))
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	err = safeRedirectPolicy(redirect, []*http.Request{original})
-	if err == nil || !strings.Contains(err.Error(), "request body") {
-		t.Fatalf("safeRedirectPolicy() error = %v, want cross-origin body rejection", err)
-	}
-	requireRedirectProblem(t, err, errs.CategoryPolicy, errs.SubtypeAccessDenied)
-}
-
-func TestSafeRedirectPolicyRejectsTooManyRedirects(t *testing.T) {
-	err := safeRedirectPolicy(&http.Request{}, make([]*http.Request, 10))
-	if err == nil || err.Error() != "too many redirects" {
-		t.Fatalf("safeRedirectPolicy() error = %v, want redirect limit rejection", err)
-	}
-	requireRedirectProblem(t, err, errs.CategoryNetwork, errs.SubtypeNetworkTransport)
-}
-
-func TestSafeRedirectPolicyTreatsDefaultHTTPSPortAsSameOrigin(t *testing.T) {
-	original, err := http.NewRequest(http.MethodPost, "https://accounts.feishu.cn/token", strings.NewReader("secret"))
-	if err != nil {
-		t.Fatal(err)
-	}
-	redirect, err := http.NewRequest(http.MethodPost, "https://accounts.feishu.cn:443/token-next", strings.NewReader("secret"))
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	if err := safeRedirectPolicy(redirect, []*http.Request{original}); err != nil {
-		t.Fatalf("safeRedirectPolicy() error = %v, want same-origin redirect", err)
-	}
-}
-
-func TestSafeRedirectPolicyKeepsCredentialsStrippedAcrossExternalHops(t *testing.T) {
-	original, err := http.NewRequest(http.MethodGet, "https://open.feishu.cn/start", nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-	previous, err := http.NewRequest(http.MethodGet, "https://cdn.example.com/first", nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-	redirect, err := http.NewRequest(http.MethodGet, "https://cdn.example.com/second", nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-	redirect.Header.Set("Authorization", "Bearer copied-from-initial-request")
-
-	if err := safeRedirectPolicy(redirect, []*http.Request{original, previous}); err != nil {
-		t.Fatalf("safeRedirectPolicy() error = %v, want same-CDN redirect", err)
-	}
-	if got := redirect.Header.Get("Authorization"); got != "" {
-		t.Fatalf("redirect retained Authorization=%q outside the initial origin", got)
-	}
-}
-
-func TestSafeRedirectPolicyRejectsDowngradeOnLaterHop(t *testing.T) {
-	original, err := http.NewRequest(http.MethodGet, "http://source.example/start", nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-	previous, err := http.NewRequest(http.MethodGet, "https://cdn.example.com/secure", nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-	redirect, err := http.NewRequest(http.MethodGet, "http://cdn.example.com/plain", nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	err = safeRedirectPolicy(redirect, []*http.Request{original, previous})
-	if err == nil || !strings.Contains(err.Error(), "HTTPS") {
-		t.Fatalf("safeRedirectPolicy() error = %v, want later-hop HTTPS downgrade rejection", err)
-	}
-	requireRedirectProblem(t, err, errs.CategoryPolicy, errs.SubtypeAccessDenied)
-}
-
-func requireRedirectProblem(t *testing.T, err error, category errs.Category, subtype errs.Subtype) {
-	t.Helper()
-	problem, ok := errs.ProblemOf(err)
-	if !ok {
-		t.Fatalf("error type = %T, want typed error", err)
-	}
-	if problem.Category != category || problem.Subtype != subtype {
-		t.Fatalf(
-			"error category/subtype = %s/%s, want %s/%s",
-			problem.Category,
-			problem.Subtype,
-			category,
-			subtype,
-		)
-	}
-}

internal/cmdutil/factory_proxy_warn_test.go

@@ -8,7 +8,6 @@ import (
 	"testing"
 
 	_ "github.com/larksuite/cli/extension/credential/env" // registers the env-backed account provider
-	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/envvars"
 )
 
@@ -34,18 +33,16 @@ var proxyWarnGateCases = []struct {
 	{"non-terminal stderr stays silent", false, 0},
 }
 
-// TestCachedHTTPClientFunc_ProxyWarnGate verifies the HTTP client init path
+// TestCachedHttpClientFunc_ProxyWarnGate verifies the http-client init path
 // invokes WarnIfProxied only when stderr is an interactive terminal.
-func TestCachedHTTPClientFunc_ProxyWarnGate(t *testing.T) {
-	isEnabled := false
+func TestCachedHttpClientFunc_ProxyWarnGate(t *testing.T) {
 	for _, tc := range proxyWarnGateCases {
 		t.Run(tc.name, func(t *testing.T) {
 			calls := installProxyWarnSpy(t)
 
-			f, _, _, _ := TestFactory(t, &core.CliConfig{AppID: "test-app"})
-			f.IOStreams.ErrOut = io.Discard
-			f.IOStreams.StderrIsTerminal = tc.terminal
-			fn := cachedHttpClientFunc(f, staticWorkspaceConfig{config: &core.MultiAppConfig{RiskControl: &isEnabled}})
+			fn := cachedHttpClientFunc(&Factory{IOStreams: &IOStreams{
+				ErrOut: io.Discard, StderrIsTerminal: tc.terminal,
+			}})
 			if _, err := fn(); err != nil {
 				t.Fatalf("http client init: %v", err)
 			}
@@ -76,7 +73,7 @@ func TestCachedLarkClientFunc_ProxyWarnGate(t *testing.T) {
 			// normalizeStreams copies the struct (out := *s), so the
 			// StderrIsTerminal field survives into f.IOStreams.
 			f := NewDefault(&IOStreams{ErrOut: io.Discard, StderrIsTerminal: tc.terminal}, InvocationContext{})
-			if _, err := cachedLarkClientFunc(f, nil)(); err != nil {
+			if _, err := cachedLarkClientFunc(f)(); err != nil {
 				t.Fatalf("lark client init: %v", err)
 			}
 

internal/cmdutil/fileupload.go

@@ -7,7 +7,6 @@ import (
 	"bytes"
 	"fmt"
 	"io"
-	"path/filepath"
 	"strconv"
 	"strings"
 
@@ -129,7 +128,7 @@ func BuildFormdata(fileIO fileio.FileIO, fieldName, filePath string, isStdin boo
 				WithParam("--file").
 				WithCause(err)
 		}
-		fd.AddFileWithName(fieldName, filepath.Base(filePath), bytes.NewReader(data))
+		fd.AddFile(fieldName, bytes.NewReader(data))
 	}
 
 	// Add top-level JSON keys as text form fields.

internal/cmdutil/localfile.go

@@ -1,36 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package cmdutil
-
-import (
-	"io/fs"
-
-	"github.com/larksuite/cli/extension/fileio"
-	"github.com/larksuite/cli/internal/validate"
-	"github.com/larksuite/cli/internal/vfs"
-)
-
-// StatLocalFile returns metadata for a path in the process filesystem namespace.
-// It is intended for advisory validation; callers must validate the opened file
-// again before using its contents.
-func StatLocalFile(path string) (fs.FileInfo, error) {
-	localPath, err := validate.LocalInputPath(path)
-	if err != nil {
-		return nil, &fileio.PathValidationError{Err: err}
-	}
-	return vfs.Stat(localPath)
-}
-
-// OpenLocalFile opens a path in the process filesystem namespace.
-// Absolute and relative paths are accepted. It is the shared replacement for
-// direct os.Open/os.ReadFile use in commands that intentionally read local
-// paths outside the workspace sandbox. Callers inspect the returned descriptor
-// before reading so validation and use apply to the same opened file.
-func OpenLocalFile(path string) (fs.File, error) {
-	localPath, err := validate.LocalInputPath(path)
-	if err != nil {
-		return nil, &fileio.PathValidationError{Err: err}
-	}
-	return vfs.Open(localPath)
-}

internal/cmdutil/localfile_test.go

@@ -1,96 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package cmdutil
-
-import (
-	"errors"
-	"io"
-	"io/fs"
-	"os"
-	"path/filepath"
-	"testing"
-
-	"github.com/larksuite/cli/extension/fileio"
-	"github.com/larksuite/cli/internal/vfs"
-)
-
-func TestOpenLocalFile_AcceptsAbsoluteAndParentRelativePaths(t *testing.T) {
-	root := t.TempDir()
-	workDir := filepath.Join(root, "work")
-	if err := os.Mkdir(workDir, 0o755); err != nil {
-		t.Fatal(err)
-	}
-	path := filepath.Join(root, "input.txt")
-	if err := os.WriteFile(path, []byte("content"), 0o600); err != nil {
-		t.Fatal(err)
-	}
-	TestChdir(t, workDir)
-
-	for _, input := range []string{path, filepath.Join("..", "input.txt")} {
-		f, err := OpenLocalFile(input)
-		if err != nil {
-			t.Fatalf("OpenLocalFile(%q) error = %v", input, err)
-		}
-		got, readErr := io.ReadAll(f)
-		closeErr := f.Close()
-		if readErr != nil || closeErr != nil || string(got) != "content" {
-			t.Fatalf("OpenLocalFile(%q) content=%q read=%v close=%v", input, got, readErr, closeErr)
-		}
-	}
-}
-
-func TestOpenLocalFile_RejectsInvalidInput(t *testing.T) {
-	if _, err := OpenLocalFile("input\n.txt"); !errors.Is(err, fileio.ErrPathValidation) {
-		t.Fatalf("OpenLocalFile() error = %v, want ErrPathValidation", err)
-	}
-}
-
-func TestStatLocalFile_ReturnsMetadata(t *testing.T) {
-	info, err := StatLocalFile(t.TempDir())
-	if err != nil {
-		t.Fatalf("StatLocalFile() error = %v", err)
-	}
-	if !info.IsDir() {
-		t.Fatalf("StatLocalFile() mode = %v, want directory", info.Mode())
-	}
-}
-
-func TestOpenLocalFile_DoesNotStatBeforeOpen(t *testing.T) {
-	path := filepath.Join(t.TempDir(), "input.txt")
-	if err := os.WriteFile(path, []byte("content"), 0o600); err != nil {
-		t.Fatal(err)
-	}
-
-	previous := vfs.DefaultFS
-	counting := &countingLocalFileFS{FS: previous}
-	vfs.DefaultFS = counting
-	t.Cleanup(func() { vfs.DefaultFS = previous })
-
-	f, err := OpenLocalFile(path)
-	if err != nil {
-		t.Fatalf("OpenLocalFile() error = %v", err)
-	}
-	if err := f.Close(); err != nil {
-		t.Fatal(err)
-	}
-	if counting.openCalls != 1 || counting.statCalls != 0 {
-		t.Fatalf("OpenLocalFile() calls: Open=%d Stat=%d, want Open=1 Stat=0", counting.openCalls, counting.statCalls)
-	}
-}
-
-type countingLocalFileFS struct {
-	vfs.FS
-	openCalls int
-	statCalls int
-}
-
-func (f *countingLocalFileFS) Open(name string) (*os.File, error) {
-	f.openCalls++
-	return f.FS.Open(name)
-}
-
-func (f *countingLocalFileFS) Stat(name string) (fs.FileInfo, error) {
-	f.statCalls++
-	return f.FS.Stat(name)
-}

internal/cmdutil/risk_control.go

@@ -1,28 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package cmdutil
-
-import (
-	"github.com/larksuite/cli/internal/core"
-	"github.com/larksuite/cli/internal/riskcontrol"
-)
-
-type workspaceConfigSource interface {
-	MultiAppConfig() (*core.MultiAppConfig, error)
-}
-
-// resolveSDKHostSignalSource applies workspace policy at the SDK transport
-// boundary.
-func resolveSDKHostSignalSource(config workspaceConfigSource) riskcontrol.Source {
-	if config == nil {
-		return nil
-	}
-	workspace, configErr := config.MultiAppConfig()
-	// Default-on means an existing config with no explicit preference. Absent
-	// or unreadable config cannot authorize host-signal collection.
-	if configErr != nil || !workspace.RiskControlEnabled() {
-		return nil
-	}
-	return riskcontrol.NewHostSource()
-}

internal/cmdutil/risk_control_test.go

@@ -1,45 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package cmdutil
-
-import (
-	"errors"
-	"testing"
-
-	"github.com/larksuite/cli/internal/core"
-)
-
-type staticWorkspaceConfig struct {
-	config *core.MultiAppConfig
-	err    error
-}
-
-func (s staticWorkspaceConfig) MultiAppConfig() (*core.MultiAppConfig, error) {
-	return s.config, s.err
-}
-
-func TestResolveSDKHostSignalSource(t *testing.T) {
-	disabled := false
-	tests := []struct {
-		name       string
-		config     workspaceConfigSource
-		wantSource bool
-	}{
-		{name: "workspace default on", config: staticWorkspaceConfig{config: &core.MultiAppConfig{}}, wantSource: true},
-		{name: "workspace opt-out", config: staticWorkspaceConfig{config: &core.MultiAppConfig{RiskControl: &disabled}}},
-		{name: "missing config", config: staticWorkspaceConfig{err: errors.New("file does not exist")}},
-		{name: "unreadable config", config: staticWorkspaceConfig{err: errors.New("permission denied")}},
-		{name: "nil config value", config: staticWorkspaceConfig{}},
-		{name: "nil config source"},
-	}
-
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			got := resolveSDKHostSignalSource(test.config)
-			if (got != nil) != test.wantSource {
-				t.Fatalf("resolveSDKHostSignalSource() = %T, wantSource %t", got, test.wantSource)
-			}
-		})
-	}
-}

internal/cmdutil/secheader.go

@@ -6,10 +6,12 @@ package cmdutil
 import (
 	"context"
 	"net/http"
+	"os"
 	"reflect"
 	"runtime/debug"
 	"strings"
 	"sync"
+	"unicode"
 
 	"github.com/larksuite/cli/extension/credential"
 	"github.com/larksuite/cli/extension/fileio"
@@ -26,7 +28,6 @@ const (
 	HeaderShortcut    = "X-Cli-Shortcut"
 	HeaderExecutionId = "X-Cli-Execution-Id"
 	HeaderAgentTrace  = "X-Agent-Trace"
-	HeaderAgentName   = "X-Agent-Name"
 
 	SourceValue = "lark-cli"
 
@@ -39,6 +40,8 @@ const (
 	BuildKindUnknown  = "unknown"
 
 	officialModulePath = "github.com/larksuite/cli"
+
+	agentTraceMaxLen = 1024
 )
 
 // UserAgentValue returns the User-Agent value: "lark-cli/{version}".
@@ -46,6 +49,25 @@ func UserAgentValue() string {
 	return SourceValue + "/" + build.Version
 }
 
+// AgentTraceValue returns a header-safe value from the
+// LARKSUITE_CLI_AGENT_TRACE environment variable. It trims
+// surrounding whitespace, rejects values containing any Unicode
+// control character or exceeding agentTraceMaxLen, and returns ""
+// for any invalid or empty value. Callers can use the result
+// directly in HTTP headers without further sanitisation.
+func AgentTraceValue() string {
+	v := strings.TrimSpace(os.Getenv(envvars.CliAgentTrace))
+	if v == "" || len(v) > agentTraceMaxLen {
+		return ""
+	}
+	for _, r := range v {
+		if unicode.IsControl(r) {
+			return ""
+		}
+	}
+	return v
+}
+
 // BaseSecurityHeaders returns headers that every request must carry.
 func BaseSecurityHeaders() http.Header {
 	h := make(http.Header)
@@ -53,12 +75,11 @@ func BaseSecurityHeaders() http.Header {
 	h.Set(HeaderVersion, build.Version)
 	h.Set(HeaderBuild, DetectBuildKind())
 	h.Set(HeaderUserAgent, UserAgentValue())
-	if v := envvars.AgentTrace(); v != "" {
+	h.Set("x-tt-env", "ppe_sheet_cli_zzj_dev")
+	h.Set("x-use-ppe", "1")
+	if v := AgentTraceValue(); v != "" {
 		h.Set(HeaderAgentTrace, v)
 	}
-	if v := envvars.AgentName(); v != "" {
-		h.Set(HeaderAgentName, v)
-	}
 	return h
 }
 

internal/cmdutil/secheader_test.go

@@ -6,6 +6,7 @@ package cmdutil
 import (
 	"context"
 	"net/http"
+	"strings"
 	"testing"
 
 	"github.com/larksuite/cli/extension/credential"
@@ -263,31 +264,85 @@ func TestBaseSecurityHeaders_AllRequiredHeaders(t *testing.T) {
 }
 
 // ---------------------------------------------------------------------------
-// Agent headers injected via BaseSecurityHeaders
+// AgentTraceValue / HeaderAgentTrace
 // ---------------------------------------------------------------------------
 
-func TestBaseSecurityHeaders_NoAgentNameHeaderWhenEnvUnset(t *testing.T) {
-	t.Setenv(envvars.CliAgentName, "")
-	h := BaseSecurityHeaders()
-	if v := h.Get(HeaderAgentName); v != "" {
-		t.Fatalf("BaseSecurityHeaders() included %s = %q, want absent when env unset", HeaderAgentName, v)
+func TestAgentTraceValue_EmptyWhenEnvUnset(t *testing.T) {
+	t.Setenv(envvars.CliAgentTrace, "")
+	if got := AgentTraceValue(); got != "" {
+		t.Fatalf("AgentTraceValue() = %q, want empty when env unset", got)
 	}
 }
 
-func TestBaseSecurityHeaders_IncludesAgentNameHeaderWhenEnvSet(t *testing.T) {
-	const agentName = "sample-agent"
-	t.Setenv(envvars.CliAgentName, agentName)
-	h := BaseSecurityHeaders()
-	if v := h.Get(HeaderAgentName); v != agentName {
-		t.Fatalf("BaseSecurityHeaders()[%s] = %q, want %q", HeaderAgentName, v, agentName)
+func TestAgentTraceValue_ReturnsCleanValue(t *testing.T) {
+	t.Setenv(envvars.CliAgentTrace, "trace-abc-123")
+	if got := AgentTraceValue(); got != "trace-abc-123" {
+		t.Fatalf("AgentTraceValue() = %q, want %q", got, "trace-abc-123")
 	}
 }
 
-func TestBaseSecurityHeaders_NoAgentNameHeaderWhenEnvInvalid(t *testing.T) {
-	t.Setenv(envvars.CliAgentName, "agent\r\nX-Evil: attack")
-	h := BaseSecurityHeaders()
-	if v := h.Get(HeaderAgentName); v != "" {
-		t.Fatalf("BaseSecurityHeaders() included %s = %q, want absent for invalid input", HeaderAgentName, v)
+func TestAgentTraceValue_TrimsWhitespace(t *testing.T) {
+	t.Setenv(envvars.CliAgentTrace, "  trace-trim  ")
+	if got := AgentTraceValue(); got != "trace-trim" {
+		t.Fatalf("AgentTraceValue() = %q, want %q (whitespace trimmed)", got, "trace-trim")
+	}
+}
+
+func TestAgentTraceValue_OnlyWhitespace_ReturnsEmpty(t *testing.T) {
+	t.Setenv(envvars.CliAgentTrace, "   ")
+	if got := AgentTraceValue(); got != "" {
+		t.Fatalf("AgentTraceValue() = %q, want empty for whitespace-only value", got)
+	}
+}
+
+func TestAgentTraceValue_RejectsCRLF(t *testing.T) {
+	t.Setenv(envvars.CliAgentTrace, "val\r\nX-Evil: attack")
+	if got := AgentTraceValue(); got != "" {
+		t.Fatalf("AgentTraceValue() = %q, want empty for CR/LF value", got)
+	}
+}
+
+func TestAgentTraceValue_RejectsLF(t *testing.T) {
+	t.Setenv(envvars.CliAgentTrace, "val\nX-Evil: attack")
+	if got := AgentTraceValue(); got != "" {
+		t.Fatalf("AgentTraceValue() = %q, want empty for LF value", got)
+	}
+}
+
+func TestAgentTraceValue_RejectsTab(t *testing.T) {
+	t.Setenv(envvars.CliAgentTrace, "val\tinjected")
+	if got := AgentTraceValue(); got != "" {
+		t.Fatalf("AgentTraceValue() = %q, want empty for tab value", got)
+	}
+}
+
+func TestAgentTraceValue_RejectsControlChar(t *testing.T) {
+	t.Setenv(envvars.CliAgentTrace, "val\x01injected")
+	if got := AgentTraceValue(); got != "" {
+		t.Fatalf("AgentTraceValue() = %q, want empty for control char value", got)
+	}
+}
+
+func TestAgentTraceValue_RejectsDEL(t *testing.T) {
+	t.Setenv(envvars.CliAgentTrace, "val\x7finjected")
+	if got := AgentTraceValue(); got != "" {
+		t.Fatalf("AgentTraceValue() = %q, want empty for DEL value", got)
+	}
+}
+
+func TestAgentTraceValue_RejectsOverlongValue(t *testing.T) {
+	longVal := strings.Repeat("a", agentTraceMaxLen+1)
+	t.Setenv(envvars.CliAgentTrace, longVal)
+	if got := AgentTraceValue(); got != "" {
+		t.Fatalf("AgentTraceValue() returned non-empty for %d-byte value (max %d)", len(longVal), agentTraceMaxLen)
+	}
+}
+
+func TestAgentTraceValue_AcceptsMaxLengthValue(t *testing.T) {
+	val := strings.Repeat("a", agentTraceMaxLen)
+	t.Setenv(envvars.CliAgentTrace, val)
+	if got := AgentTraceValue(); got != val {
+		t.Fatalf("AgentTraceValue() = %q, want %d-byte value accepted", got, agentTraceMaxLen)
 	}
 }
 

internal/cmdutil/testing_test.go

@@ -46,7 +46,7 @@ func TestTestFactory_ReplacesGlobals(t *testing.T) {
 		URL:  "/test",
 		Body: "ok",
 	})
-	// Use the stub via Factory HttpClient.
+	// Use the stub via Factory HttpClient
 	httpClient, err := f.HttpClient()
 	if err != nil {
 		t.Fatalf("HttpClient() error: %v", err)

internal/cmdutil/testmain_test.go

@@ -1,30 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package cmdutil
-
-import (
-	"os"
-	"path/filepath"
-	"testing"
-)
-
-func TestMain(m *testing.M) {
-	// Default-factory tests initialize the registry and resolve config. Keep
-	// them deterministic: never read the developer's real ~/.lark-cli and
-	// prevent background remote-metadata refreshes from touching user state.
-	root, err := os.MkdirTemp("", "lark-cli-cmdutil-test-*")
-	if err != nil {
-		println("internal/cmdutil test setup: MkdirTemp failed:", err.Error())
-		os.Exit(2)
-	}
-	if err := os.Setenv("LARKSUITE_CLI_CONFIG_DIR", filepath.Join(root, "config")); err != nil {
-		panic(err)
-	}
-	if err := os.Setenv("LARKSUITE_CLI_REMOTE_META", "off"); err != nil {
-		panic(err)
-	}
-	code := m.Run()
-	_ = os.RemoveAll(root)
-	os.Exit(code)
-}

internal/cmdutil/transport.go

@@ -4,19 +4,14 @@
 package cmdutil
 
 import (
+	"context"
 	"net/http"
 	"time"
 
+	exttransport "github.com/larksuite/cli/extension/transport"
 	"github.com/larksuite/cli/internal/transport"
 )
 
-var (
-	_ transport.RoundTripperDecorator = (*RetryTransport)(nil)
-	_ transport.RoundTripperDecorator = (*UserAgentTransport)(nil)
-	_ transport.RoundTripperDecorator = (*BuildHeaderTransport)(nil)
-	_ transport.RoundTripperDecorator = (*SecurityHeaderTransport)(nil)
-)
-
 // RetryTransport is an http.RoundTripper that retries on 5xx responses
 // and network errors. MaxRetries defaults to 0 (no retries).
 type RetryTransport struct {
@@ -32,16 +27,6 @@ func (t *RetryTransport) base() http.RoundTripper {
 	return transport.Fallback()
 }
 
-func (t *RetryTransport) BaseRoundTripper() http.RoundTripper {
-	return t.base()
-}
-
-func (t *RetryTransport) WithBaseRoundTripper(base http.RoundTripper) http.RoundTripper {
-	cloned := *t
-	cloned.Base = base
-	return &cloned
-}
-
 func (t *RetryTransport) delay() time.Duration {
 	if t.Delay > 0 {
 		return t.Delay
@@ -78,19 +63,6 @@ type UserAgentTransport struct {
 	Base http.RoundTripper
 }
 
-func (t *UserAgentTransport) BaseRoundTripper() http.RoundTripper {
-	if t.Base != nil {
-		return t.Base
-	}
-	return transport.Fallback()
-}
-
-func (t *UserAgentTransport) WithBaseRoundTripper(base http.RoundTripper) http.RoundTripper {
-	cloned := *t
-	cloned.Base = base
-	return &cloned
-}
-
 func (t *UserAgentTransport) RoundTrip(req *http.Request) (*http.Response, error) {
 	req = req.Clone(req.Context())
 	req.Header.Set(HeaderUserAgent, UserAgentValue())
@@ -101,25 +73,14 @@ func (t *UserAgentTransport) RoundTrip(req *http.Request) (*http.Response, error
 }
 
 // BuildHeaderTransport is an http.RoundTripper that force-writes the
-// X-Cli-Build header before every request. It remains in the SDK transport
-// chain as a narrow defense-in-depth layer alongside SecurityHeaderTransport.
+// X-Cli-Build header before every request. Used in the SDK transport chain,
+// where SecurityHeaderTransport is not installed, to prevent extensions from
+// tampering with the build classification. The direct HTTP chain is already
+// covered by SecurityHeaderTransport iterating BaseSecurityHeaders.
 type BuildHeaderTransport struct {
 	Base http.RoundTripper
 }
 
-func (t *BuildHeaderTransport) BaseRoundTripper() http.RoundTripper {
-	if t.Base != nil {
-		return t.Base
-	}
-	return transport.Fallback()
-}
-
-func (t *BuildHeaderTransport) WithBaseRoundTripper(base http.RoundTripper) http.RoundTripper {
-	cloned := *t
-	cloned.Base = base
-	return &cloned
-}
-
 func (t *BuildHeaderTransport) RoundTrip(req *http.Request) (*http.Response, error) {
 	req = req.Clone(req.Context())
 	req.Header.Set(HeaderBuild, DetectBuildKind())
@@ -142,16 +103,6 @@ func (t *SecurityHeaderTransport) base() http.RoundTripper {
 	return transport.Fallback()
 }
 
-func (t *SecurityHeaderTransport) BaseRoundTripper() http.RoundTripper {
-	return t.base()
-}
-
-func (t *SecurityHeaderTransport) WithBaseRoundTripper(base http.RoundTripper) http.RoundTripper {
-	cloned := *t
-	cloned.Base = base
-	return &cloned
-}
-
 // RoundTrip implements http.RoundTripper.
 func (t *SecurityHeaderTransport) RoundTrip(req *http.Request) (*http.Response, error) {
 	req = req.Clone(req.Context())
@@ -169,3 +120,67 @@ func (t *SecurityHeaderTransport) RoundTrip(req *http.Request) (*http.Response,
 	}
 	return t.base().RoundTrip(req)
 }
+
+// extensionMiddleware wraps the built-in transport chain with pre/post hooks.
+// The built-in chain always executes unless the extension is an
+// exttransport.AbortableInterceptor and its PreRoundTripE returns a non-nil
+// error; it cannot otherwise be skipped or overridden.
+//
+// The original request context is restored after the pre hook to prevent
+// extensions from tampering with cancellation, deadlines, or built-in values.
+// Cloning the request isolates header/URL/etc. mutations from the caller's
+// request object; req.Body is intentionally shared — extensions that consume
+// it are responsible for rewinding (see Interceptor doc).
+type extensionMiddleware struct {
+	Base    http.RoundTripper
+	Ext     exttransport.Interceptor
+	ExtName string // Provider.Name(), captured at wrap time for *AbortError.Extension
+}
+
+// RoundTrip invokes the interceptor pre hook, restores the original context,
+// executes the built-in chain (unless aborted), then calls the post hook if
+// non-nil. When the extension implements AbortableInterceptor and returns a
+// non-nil error from PreRoundTripE, the built-in chain is skipped and an
+// *exttransport.AbortError is returned; the post hook is still invoked with
+// (nil, reason) so extensions can unwind resources.
+func (m *extensionMiddleware) RoundTrip(req *http.Request) (*http.Response, error) {
+	origCtx := req.Context()
+	req = req.Clone(origCtx)
+
+	var (
+		post    func(*http.Response, error)
+		abortEr error
+	)
+	if a, ok := m.Ext.(exttransport.AbortableInterceptor); ok {
+		post, abortEr = a.PreRoundTripE(req)
+	} else {
+		post = m.Ext.PreRoundTrip(req)
+	}
+	if abortEr != nil {
+		if post != nil {
+			post(nil, abortEr)
+		}
+		return nil, &exttransport.AbortError{Extension: m.ExtName, Reason: abortEr}
+	}
+
+	req = req.WithContext(origCtx) // restore original context
+	resp, err := m.Base.RoundTrip(req)
+	if post != nil {
+		post(resp, err)
+	}
+	return resp, err
+}
+
+// wrapWithExtension wraps transport with the registered extension middleware.
+// If no extension is registered, returns transport unchanged.
+func wrapWithExtension(transport http.RoundTripper) http.RoundTripper {
+	p := exttransport.GetProvider()
+	if p == nil {
+		return transport
+	}
+	tr := p.ResolveInterceptor(context.Background())
+	if tr == nil {
+		return transport
+	}
+	return &extensionMiddleware{Base: transport, Ext: tr, ExtName: p.Name()}
+}

internal/cmdutil/transport_test.go

@@ -14,8 +14,7 @@ import (
 	"time"
 
 	exttransport "github.com/larksuite/cli/extension/transport"
-	"github.com/larksuite/cli/internal/riskcontrol"
-	internaltransport "github.com/larksuite/cli/internal/transport"
+	internalauth "github.com/larksuite/cli/internal/auth"
 )
 
 type roundTripFunc func(*http.Request) (*http.Response, error)
@@ -91,107 +90,79 @@ func TestRetryTransport_DefaultNoRetry(t *testing.T) {
 	}
 }
 
-// buildSDKTransport policy behavior
+// ---------------------------------------------------------------------------
+// buildSDKTransport chain composition
 // ---------------------------------------------------------------------------
 
-func TestBuildSDKTransportAppliesSecurityHeadersToEveryRequestClass(t *testing.T) {
-	exttransport.Register(nil)
-	received := make(chan http.Header, 2)
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
-		received <- req.Header.Clone()
-		w.WriteHeader(http.StatusNoContent)
-	}))
-	t.Cleanup(server.Close)
+func TestBuildSDKTransport_IncludesRetryTransport(t *testing.T) {
+	transport := buildSDKTransport()
 
-	for _, class := range []exttransport.RequestClass{
-		exttransport.RequestClassPlatform,
-		exttransport.RequestClassExternal,
-	} {
-		client := internaltransport.ClientForRequestClass(
-			&http.Client{Transport: buildSDKTransport(nil)},
-			class,
-		)
-		resp, err := client.Get(server.URL)
-		if err != nil {
-			t.Fatal(err)
-		}
-		resp.Body.Close()
-
-		headers := <-received
-		for header, values := range BaseSecurityHeaders() {
-			if len(values) == 0 {
-				continue
-			}
-			want := values[len(values)-1]
-			if got := headers.Get(header); got != want {
-				t.Fatalf("SDK %s header %s = %q, want %q", class, header, got, want)
-			}
-		}
+	// Chain: SecurityPolicy → BuildHeader → UserAgent → Retry → Base
+	sec, ok := transport.(*internalauth.SecurityPolicyTransport)
+	if !ok {
+		t.Fatalf("outer transport type = %T, want *auth.SecurityPolicyTransport", transport)
+	}
+	bh, ok := sec.Base.(*BuildHeaderTransport)
+	if !ok {
+		t.Fatalf("layer after SecurityPolicy = %T, want *BuildHeaderTransport", sec.Base)
+	}
+	ua, ok := bh.Base.(*UserAgentTransport)
+	if !ok {
+		t.Fatalf("layer after BuildHeader = %T, want *UserAgentTransport", bh.Base)
+	}
+	if _, ok := ua.Base.(*RetryTransport); !ok {
+		t.Fatalf("inner transport type = %T, want *RetryTransport", ua.Base)
 	}
 }
 
 func TestBuildSDKTransport_WithExtension(t *testing.T) {
-	previous := exttransport.GetProvider()
-	interceptor := &headerCapturingInterceptor{}
-	exttransport.Register(&platformOnlyStubProvider{
-		stubTransportProvider: &stubTransportProvider{interceptor: interceptor},
-	})
-	t.Cleanup(func() { exttransport.Register(previous) })
+	exttransport.Register(&stubTransportProvider{})
+	t.Cleanup(func() { exttransport.Register(nil) })
 
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
-		w.WriteHeader(http.StatusNoContent)
-	}))
-	t.Cleanup(server.Close)
+	transport := buildSDKTransport()
 
-	client := internaltransport.ClientForRequestClass(
-		&http.Client{Transport: buildSDKTransport(nil)},
-		exttransport.RequestClassPlatform,
-	)
-	resp, err := client.Get(server.URL)
-	if err != nil {
-		t.Fatal(err)
+	// Chain: extensionMiddleware → SecurityPolicy → BuildHeader → UserAgent → Retry → Base
+	mid, ok := transport.(*extensionMiddleware)
+	if !ok {
+		t.Fatalf("outer transport type = %T, want *extensionMiddleware", transport)
 	}
-	resp.Body.Close()
-	if !interceptor.preCalled || !interceptor.postCalled {
-		t.Fatal("SDK platform request did not execute extension pre/post hooks")
+	sec, ok := mid.Base.(*internalauth.SecurityPolicyTransport)
+	if !ok {
+		t.Fatalf("transport type = %T, want *auth.SecurityPolicyTransport", mid.Base)
+	}
+	bh, ok := sec.Base.(*BuildHeaderTransport)
+	if !ok {
+		t.Fatalf("layer after SecurityPolicy = %T, want *BuildHeaderTransport", sec.Base)
+	}
+	ua, ok := bh.Base.(*UserAgentTransport)
+	if !ok {
+		t.Fatalf("layer after BuildHeader = %T, want *UserAgentTransport", bh.Base)
+	}
+	if _, ok := ua.Base.(*RetryTransport); !ok {
+		t.Fatalf("innermost transport type = %T, want *RetryTransport", ua.Base)
 	}
 }
 
 func TestBuildSDKTransport_WithoutExtension(t *testing.T) {
-	previous := exttransport.GetProvider()
 	exttransport.Register(nil)
-	t.Cleanup(func() { exttransport.Register(previous) })
 
-	if _, ok := buildSDKTransport(nil).(*internaltransport.HTTPPolicyRouter); !ok {
-		t.Fatalf(
-			"buildSDKTransport() type = %T, want *transport.HTTPPolicyRouter",
-			buildSDKTransport(nil),
-		)
-	}
-}
+	transport := buildSDKTransport()
 
-func TestBuildSDKTransportSupportsPolicyLeafCloning(t *testing.T) {
-	previous := exttransport.GetProvider()
-	exttransport.Register(nil)
-	t.Cleanup(func() { exttransport.Register(previous) })
-
-	base := &http.Transport{}
-	client := internaltransport.ClientForRequestClass(
-		&http.Client{Transport: buildSDKTransportWithBase(base, nil)},
-		exttransport.RequestClassExternal,
-	)
-	source, ok := client.Transport.(interface {
-		CloneHTTPTransport() (http.RoundTripper, *http.Transport, bool)
-	})
+	// Chain: SecurityPolicy → BuildHeader → UserAgent → Retry → Base
+	sec, ok := transport.(*internalauth.SecurityPolicyTransport)
 	if !ok {
-		t.Fatalf("SDK request-class transport type = %T, want clone capability", client.Transport)
+		t.Fatalf("outer transport type = %T, want *auth.SecurityPolicyTransport", transport)
 	}
-	rebuilt, concrete, ok := source.CloneHTTPTransport()
-	if !ok || rebuilt == nil || concrete == nil {
-		t.Fatal("SDK policy graph could not clone its HTTP transport leaf")
+	bh, ok := sec.Base.(*BuildHeaderTransport)
+	if !ok {
+		t.Fatalf("layer after SecurityPolicy = %T, want *BuildHeaderTransport", sec.Base)
 	}
-	if concrete == base {
-		t.Fatal("SDK policy graph reused the original HTTP transport")
+	ua, ok := bh.Base.(*UserAgentTransport)
+	if !ok {
+		t.Fatalf("layer after BuildHeader = %T, want *UserAgentTransport", bh.Base)
+	}
+	if _, ok := ua.Base.(*RetryTransport); !ok {
+		t.Fatalf("inner transport type = %T, want *RetryTransport", ua.Base)
 	}
 }
 
@@ -251,7 +222,7 @@ func TestExtensionInterceptor_ExecutionOrder(t *testing.T) {
 	var base http.RoundTripper = http.DefaultTransport
 	base = &RetryTransport{Base: base}
 	base = &SecurityHeaderTransport{Base: base}
-	transport := internaltransport.WrapWithExtension(base)
+	transport := wrapWithExtension(base)
 	client := &http.Client{Transport: transport}
 
 	req, _ := http.NewRequest("GET", srv.URL, nil)
@@ -279,132 +250,26 @@ func TestExtensionInterceptor_ExecutionOrder(t *testing.T) {
 	}
 }
 
-// buildTamperingInterceptor tries to delete and spoof security headers via
-// PreRoundTrip. The SDK built-in chain must restore the real values before the
-// request leaves the process.
+// buildTamperingInterceptor tries to delete and spoof X-Cli-Build via
+// PreRoundTrip. The SDK chain's BuildHeaderTransport must restore the real
+// value before the request leaves the process.
 type buildTamperingInterceptor struct{}
 
 func (buildTamperingInterceptor) PreRoundTrip(req *http.Request) func(*http.Response, error) {
 	req.Header.Del(HeaderBuild)
 	req.Header.Set(HeaderBuild, "ext-tampered-build")
-	req.Header.Del(HeaderSource)
-	req.Header.Set(HeaderSource, "ext-tampered-source")
 	return nil
 }
 
-type riskHeaderTamperingInterceptor struct{}
-
-func (riskHeaderTamperingInterceptor) PreRoundTrip(req *http.Request) func(*http.Response, error) {
-	req.Header.Set(riskcontrol.HeaderOSType, "extension-value")
-	req.Header.Set(riskcontrol.HeaderProductModel, "extension-value")
-	return nil
-}
-
-type bootstrapPolicyTamperingInterceptor struct{}
-
-func (bootstrapPolicyTamperingInterceptor) PreRoundTrip(req *http.Request) func(*http.Response, error) {
-	req.Header.Set(HeaderSource, "extension-value")
-	req.Header.Set(riskcontrol.HeaderOSType, "extension-value")
-	return nil
-}
-
-func TestNewDefaultInstallsSDKBootstrapSecurityPolicy(t *testing.T) {
-	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
-	oldTransport := http.DefaultClient.Transport
-	oldCheckRedirect := http.DefaultClient.CheckRedirect
-	t.Cleanup(func() {
-		http.DefaultClient.Transport = oldTransport
-		http.DefaultClient.CheckRedirect = oldCheckRedirect
-	})
-
-	previous := exttransport.GetProvider()
-	exttransport.Register(&platformOnlyStubProvider{
-		stubTransportProvider: &stubTransportProvider{
-			interceptor: bootstrapPolicyTamperingInterceptor{},
-		},
-	})
-	t.Cleanup(func() { exttransport.Register(previous) })
-
-	var received http.Header
-	network := roundTripFunc(func(req *http.Request) (*http.Response, error) {
-		received = req.Header.Clone()
-		return &http.Response{
-			StatusCode: http.StatusNoContent,
-			Body:       http.NoBody,
-			Request:    req,
-		}, nil
-	})
-	http.DefaultClient.Transport = network
-	http.DefaultClient.CheckRedirect = nil
-	_ = NewDefault(nil, InvocationContext{})
-
-	req, err := http.NewRequest(
-		http.MethodPost,
-		"https://open.feishu.cn/callback/ws/endpoint",
-		strings.NewReader(`{"app_secret":"secret"}`),
-	)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	resp, err := http.DefaultClient.Do(req)
-	if err != nil {
-		t.Fatal(err)
-	}
-	resp.Body.Close()
-
-	if got := received.Get(HeaderSource); got != SourceValue {
-		t.Fatalf("%s = %q, want trusted value %q", HeaderSource, got, SourceValue)
-	}
-	if got := received.Get(riskcontrol.HeaderOSType); got != "" {
-		t.Fatalf("%s = %q, want extension value stripped", riskcontrol.HeaderOSType, got)
-	}
-	if got := received.Get(HeaderBuild); got != DetectBuildKind() {
-		t.Fatalf("%s = %q, want %q", HeaderBuild, got, DetectBuildKind())
-	}
-	if got := received.Get(HeaderUserAgent); got != UserAgentValue() {
-		t.Fatalf("%s = %q, want %q", HeaderUserAgent, got, UserAgentValue())
-	}
-}
-
-func TestBuildSDKTransport_StripsExtensionRiskHeaders(t *testing.T) {
-	previous := exttransport.GetProvider()
-	exttransport.Register(&stubTransportProvider{interceptor: riskHeaderTamperingInterceptor{}})
-	t.Cleanup(func() { exttransport.Register(previous) })
-
-	var received http.Header
-	network := roundTripFunc(func(req *http.Request) (*http.Response, error) {
-		received = req.Header.Clone()
-		return &http.Response{StatusCode: http.StatusOK, Body: http.NoBody}, nil
-	})
-	req, err := http.NewRequest(http.MethodGet, "https://open.feishu.cn/open-apis/test", nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-	req.Header.Set("Authorization", "Bearer token")
-
-	client := internaltransport.ClientForRequestClass(
-		&http.Client{Transport: buildSDKTransportWithBase(network, nil)},
-		exttransport.RequestClassPlatform,
-	)
-	resp, err := client.Do(req)
-	if err != nil {
-		t.Fatal(err)
-	}
-	resp.Body.Close()
-	if received.Get(riskcontrol.HeaderOSType) != "" || received.Get(riskcontrol.HeaderProductModel) != "" {
-		t.Fatalf("extension risk headers reached network: %v", received)
-	}
-}
-
 // TestBuildHeaderTransport_SDKChain_OverridesTamperedHeader verifies that the
-// SDK chain restores both the build classification and the full security
-// header set after an extension runs.
+// X-Cli-Build header is force-written by BuildHeaderTransport in the SDK
+// transport chain, even when an extension tries to delete or spoof it. This
+// closes the gap where the SDK chain had no equivalent of
+// SecurityHeaderTransport (see design doc §3.3.3).
 func TestBuildHeaderTransport_SDKChain_OverridesTamperedHeader(t *testing.T) {
-	var receivedBuild, receivedSource string
+	var receivedBuild string
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		receivedBuild = r.Header.Get(HeaderBuild)
-		receivedSource = r.Header.Get(HeaderSource)
 		w.WriteHeader(http.StatusOK)
 	}))
 	defer srv.Close()
@@ -412,13 +277,12 @@ func TestBuildHeaderTransport_SDKChain_OverridesTamperedHeader(t *testing.T) {
 	exttransport.Register(&stubTransportProvider{interceptor: buildTamperingInterceptor{}})
 	t.Cleanup(func() { exttransport.Register(nil) })
 
-	// Replicate the SDK built-in chain inside buildSDKTransport.
+	// Replicate the SDK chain layering used by buildSDKTransport.
 	var base http.RoundTripper = http.DefaultTransport
 	base = &RetryTransport{Base: base}
 	base = &UserAgentTransport{Base: base}
 	base = &BuildHeaderTransport{Base: base}
-	base = &SecurityHeaderTransport{Base: base}
-	transport := internaltransport.WrapWithExtension(base)
+	transport := wrapWithExtension(base)
 	client := &http.Client{Transport: transport}
 
 	req, _ := http.NewRequest("GET", srv.URL, nil)
@@ -435,9 +299,6 @@ func TestBuildHeaderTransport_SDKChain_OverridesTamperedHeader(t *testing.T) {
 	if receivedBuild != want {
 		t.Fatalf("%s = %q, want %q", HeaderBuild, receivedBuild, want)
 	}
-	if receivedSource != SourceValue {
-		t.Fatalf("%s = %q, want %q", HeaderSource, receivedSource, SourceValue)
-	}
 }
 
 // TestBuildHeaderTransport_OverridesEvenWithoutTamper verifies that even if
@@ -527,7 +388,7 @@ func TestExtensionInterceptor_ContextTamperPrevented(t *testing.T) {
 		return nil
 	})
 
-	mid := &internaltransport.ExtensionMiddleware{Base: capturer, Ext: tamperIC}
+	mid := &extensionMiddleware{Base: capturer, Ext: tamperIC}
 
 	origCtx := context.WithValue(context.Background(), testKey, "original")
 	req, _ := http.NewRequestWithContext(origCtx, "GET", srv.URL, nil)
@@ -589,7 +450,7 @@ func TestExtensionMiddleware_PreRoundTripEAbort(t *testing.T) {
 			return &http.Response{StatusCode: http.StatusOK, Body: http.NoBody}, nil
 		})
 
-		mid := &internaltransport.ExtensionMiddleware{Base: base, Ext: ic, ExtName: "stub"}
+		mid := &extensionMiddleware{Base: base, Ext: ic, ExtName: "stub"}
 		req, _ := http.NewRequest("GET", "http://example.invalid/", nil)
 		resp, err := mid.RoundTrip(req)
 
@@ -630,7 +491,7 @@ func TestExtensionMiddleware_PreRoundTripEAbort(t *testing.T) {
 			return nil, nil
 		})
 
-		mid := &internaltransport.ExtensionMiddleware{Base: base, Ext: ic, ExtName: "stub"}
+		mid := &extensionMiddleware{Base: base, Ext: ic, ExtName: "stub"}
 		req, _ := http.NewRequest("GET", "http://example.invalid/", nil)
 		_, err := mid.RoundTrip(req)
 
@@ -649,7 +510,7 @@ func TestExtensionMiddleware_PreRoundTripEHappyPath(t *testing.T) {
 		return &http.Response{StatusCode: http.StatusOK, Body: http.NoBody}, nil
 	})
 
-	mid := &internaltransport.ExtensionMiddleware{Base: base, Ext: ic, ExtName: "stub"}
+	mid := &extensionMiddleware{Base: base, Ext: ic, ExtName: "stub"}
 	req, _ := http.NewRequest("GET", "http://example.invalid/", nil)
 	resp, err := mid.RoundTrip(req)
 	if err != nil {

internal/core/config.go

@@ -60,18 +60,11 @@ func (a *AppConfig) ProfileName() string {
 // MultiAppConfig is the multi-app config file format.
 type MultiAppConfig struct {
 	StrictMode  StrictMode  `json:"strictMode,omitempty"`
-	RiskControl *bool       `json:"riskControl,omitempty"`
 	CurrentApp  string      `json:"currentApp,omitempty"`
 	PreviousApp string      `json:"previousApp,omitempty"`
 	Apps        []AppConfig `json:"apps"`
 }
 
-// RiskControlEnabled resolves the workspace policy. An omitted preference
-// keeps the default-on account-protection behavior.
-func (m *MultiAppConfig) RiskControlEnabled() bool {
-	return m != nil && (m.RiskControl == nil || *m.RiskControl)
-}
-
 // CurrentAppConfig returns the currently active app config.
 // Resolution priority: profileOverride > CurrentApp field > Apps[0].
 func (m *MultiAppConfig) CurrentAppConfig(profileOverride string) *AppConfig {
@@ -275,7 +268,7 @@ func ResolveConfigFromMulti(raw *MultiAppConfig, kc keychain.KeychainAccess, pro
 		ProfileName: app.ProfileName(),
 		AppID:       app.AppId,
 		AppSecret:   secret,
-		Brand:       ParseBrand(string(app.Brand)),
+		Brand:       app.Brand,
 		Lang:        app.Lang,
 		DefaultAs:   app.DefaultAs,
 	}

internal/core/config_snapshot.go

@@ -1,37 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package core
-
-import (
-	"io/fs"
-	"sync"
-)
-
-// ConfigSnapshot lazily captures one stable view of config.json for a CLI
-// invocation. All runtime consumers share the same load result so account and
-// workspace policy resolution cannot observe different file revisions. Callers
-// must treat the returned config as read-only.
-type ConfigSnapshot struct {
-	load func() (*MultiAppConfig, error)
-}
-
-// NewConfigSnapshot creates a lazily loaded invocation-scoped config snapshot.
-func NewConfigSnapshot() *ConfigSnapshot {
-	return newConfigSnapshot(LoadMultiAppConfig)
-}
-
-func newConfigSnapshot(load func() (*MultiAppConfig, error)) *ConfigSnapshot {
-	if load == nil {
-		return &ConfigSnapshot{}
-	}
-	return &ConfigSnapshot{load: sync.OnceValues(load)}
-}
-
-// MultiAppConfig returns the captured persistent config and load error.
-func (s *ConfigSnapshot) MultiAppConfig() (*MultiAppConfig, error) {
-	if s == nil || s.load == nil {
-		return nil, fs.ErrNotExist
-	}
-	return s.load()
-}

internal/core/config_snapshot_test.go

@@ -1,58 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package core
-
-import (
-	"errors"
-	"io/fs"
-	"testing"
-)
-
-func TestConfigSnapshotLoadsOnce(t *testing.T) {
-	calls := 0
-	want := &MultiAppConfig{}
-	snapshot := newConfigSnapshot(func() (*MultiAppConfig, error) {
-		calls++
-		return want, nil
-	})
-
-	for range 2 {
-		config, err := snapshot.MultiAppConfig()
-		if err != nil {
-			t.Fatal(err)
-		}
-		if config != want {
-			t.Fatal("snapshot returned a different config instance")
-		}
-	}
-	if calls != 1 {
-		t.Fatalf("config loads = %d, want 1", calls)
-	}
-}
-
-func TestConfigSnapshotZeroValueIsMissing(t *testing.T) {
-	config, err := (&ConfigSnapshot{}).MultiAppConfig()
-	if config != nil || !errors.Is(err, fs.ErrNotExist) {
-		t.Fatalf("MultiAppConfig() = (%v, %v), want (nil, fs.ErrNotExist)", config, err)
-	}
-}
-
-func TestConfigSnapshotCachesError(t *testing.T) {
-	calls := 0
-	want := errors.New("load failed")
-	snapshot := newConfigSnapshot(func() (*MultiAppConfig, error) {
-		calls++
-		return nil, want
-	})
-
-	for range 2 {
-		config, err := snapshot.MultiAppConfig()
-		if config != nil || !errors.Is(err, want) {
-			t.Fatalf("MultiAppConfig() = (%v, %v), want (nil, %v)", config, err, want)
-		}
-	}
-	if calls != 1 {
-		t.Fatalf("config loads = %d, want 1", calls)
-	}
-}

internal/core/config_test.go

@@ -60,9 +60,7 @@ func TestAppConfig_LangOmitEmpty(t *testing.T) {
 }
 
 func TestMultiAppConfig_RoundTrip(t *testing.T) {
-	disabled := false
 	config := &MultiAppConfig{
-		RiskControl: &disabled,
 		Apps: []AppConfig{{
 			AppId: "cli_test", AppSecret: PlainSecret("s"),
 			Brand: BrandLark, Lang: "zh", Users: []AppUser{},
@@ -86,9 +84,6 @@ func TestMultiAppConfig_RoundTrip(t *testing.T) {
 	if got.Apps[0].Brand != BrandLark {
 		t.Errorf("Brand = %q, want %q", got.Apps[0].Brand, BrandLark)
 	}
-	if got.RiskControl == nil || *got.RiskControl {
-		t.Errorf("RiskControl = %v, want explicit false", got.RiskControl)
-	}
 }
 
 func TestResolveConfigFromMulti_RejectsSecretKeyMismatch(t *testing.T) {
@@ -235,20 +230,3 @@ func TestCliConfig_CanBot(t *testing.T) {
 		})
 	}
 }
-
-// Runtime configs must never carry raw brand casing: the config ingress
-// normalizes it, so downstream equality checks see canonical values.
-func TestResolveConfigFromMulti_NormalizesBrand(t *testing.T) {
-	multi := &MultiAppConfig{Apps: []AppConfig{{
-		AppId:     "cli_x",
-		AppSecret: PlainSecret("test-secret"),
-		Brand:     LarkBrand(" LARK "),
-	}}}
-	cfg, err := ResolveConfigFromMulti(multi, nil, "")
-	if err != nil {
-		t.Fatalf("ResolveConfigFromMulti error = %v", err)
-	}
-	if cfg.Brand != BrandLark {
-		t.Errorf("Brand = %q, want %q (normalized at ingress)", cfg.Brand, BrandLark)
-	}
-}

internal/core/types.go

@@ -3,14 +3,9 @@
 
 package core
 
-import (
-	"net/url"
-	"strings"
-)
-
 // LarkBrand represents the Lark platform brand.
 // "feishu" targets China-mainland, "lark" targets international.
-// ParseBrand and ResolveEndpoints map unrecognized values to BrandFeishu.
+// Any other string is treated as a custom base URL.
 type LarkBrand string
 
 const (
@@ -18,10 +13,10 @@ const (
 	BrandLark   LarkBrand = "lark"
 )
 
-// ParseBrand normalizes a brand string (case-insensitive, whitespace-tolerant);
-// anything other than "lark" normalizes to BrandFeishu.
+// ParseBrand normalizes a brand string to a LarkBrand constant.
+// Unrecognized values default to BrandFeishu.
 func ParseBrand(value string) LarkBrand {
-	if strings.ToLower(strings.TrimSpace(value)) == "lark" {
+	if value == "lark" {
 		return BrandLark
 	}
 	return BrandFeishu
@@ -41,10 +36,9 @@ type Endpoints struct {
 	AppLink  string // e.g. "https://applink.feishu.cn"
 }
 
-// ResolveEndpoints resolves endpoint URLs for the brand, normalizing its
-// input so stored values with unusual casing still resolve correctly.
+// ResolveEndpoints resolves endpoint URLs based on brand.
 func ResolveEndpoints(brand LarkBrand) Endpoints {
-	switch ParseBrand(string(brand)) {
+	switch brand {
 	case BrandLark:
 		return Endpoints{
 			Open:     "https://open.larksuite.com",
@@ -66,39 +60,3 @@ func ResolveEndpoints(brand LarkBrand) Endpoints {
 func ResolveOpenBaseURL(brand LarkBrand) string {
 	return ResolveEndpoints(brand).Open
 }
-
-var platformEndpointHosts = func() map[string]struct{} {
-	hosts := make(map[string]struct{})
-	for _, brand := range []LarkBrand{BrandFeishu, BrandLark} {
-		endpoints := ResolveEndpoints(brand)
-		for _, rawURL := range []string{endpoints.Open, endpoints.Accounts, endpoints.MCP, endpoints.AppLink} {
-			parsed, err := url.Parse(rawURL)
-			if err == nil && parsed.Hostname() != "" {
-				hosts[strings.ToLower(parsed.Hostname())] = struct{}{}
-			}
-		}
-	}
-	return hosts
-}()
-
-// IsPlatformEndpointHost reports whether hostname exactly matches one of the
-// endpoint hosts produced by ResolveEndpoints. It intentionally does not use a
-// suffix match: lookalike external domains must never enter the platform
-// transport extension.
-func IsPlatformEndpointHost(hostname string) bool {
-	_, ok := platformEndpointHosts[strings.ToLower(hostname)]
-	return ok
-}
-
-// IsPlatformEndpointURL reports whether candidate uses a secure origin for a
-// configured platform endpoint. Non-TLS and non-standard-port lookalikes are
-// excluded even when their hostname matches.
-func IsPlatformEndpointURL(candidate *url.URL) bool {
-	if candidate == nil || !strings.EqualFold(candidate.Scheme, "https") {
-		return false
-	}
-	if port := candidate.Port(); port != "" && port != "443" {
-		return false
-	}
-	return IsPlatformEndpointHost(candidate.Hostname())
-}

internal/core/types_test.go

@@ -3,11 +3,7 @@
 
 package core
 
-import (
-	"net/url"
-	"reflect"
-	"testing"
-)
+import "testing"
 
 func TestResolveEndpoints_Feishu(t *testing.T) {
 	ep := ResolveEndpoints(BrandFeishu)
@@ -61,119 +57,3 @@ func TestResolveOpenBaseURL(t *testing.T) {
 		t.Errorf("ResolveOpenBaseURL(lark) = %q", got)
 	}
 }
-
-func TestParseBrand(t *testing.T) {
-	cases := []struct {
-		in   string
-		want LarkBrand
-	}{
-		{"", BrandFeishu},
-		{"feishu", BrandFeishu},
-		{"lark", BrandLark},
-		{"LARK", BrandLark},
-		{" lark ", BrandLark},
-		{"Lark", BrandLark},
-		{"xyz", BrandFeishu},
-	}
-	for _, c := range cases {
-		if got := ParseBrand(c.in); got != c.want {
-			t.Errorf("ParseBrand(%q) = %q, want %q", c.in, got, c.want)
-		}
-	}
-}
-
-// TestResolveEndpoints_NormalizesBrand locks the boundary invariant: the
-// resolver normalizes its brand input, so historical config values with
-// unusual casing or whitespace still resolve to their intended endpoints.
-func TestResolveEndpoints_NormalizesBrand(t *testing.T) {
-	for _, raw := range []string{"LARK", " lark ", "Lark"} {
-		if got := ResolveEndpoints(LarkBrand(raw)).Open; got != "https://open.larksuite.com" {
-			t.Errorf("ResolveEndpoints(%q).Open = %q, want the lark endpoint", raw, got)
-		}
-	}
-	if got := ResolveEndpoints(LarkBrand("unexpected")).Open; got != "https://open.feishu.cn" {
-		t.Errorf("ResolveEndpoints(unexpected).Open = %q, want the feishu default", got)
-	}
-}
-
-func TestIsPlatformEndpointHost_ExactMatchOnly(t *testing.T) {
-	for _, host := range []string{
-		"open.feishu.cn",
-		"accounts.feishu.cn",
-		"mcp.feishu.cn",
-		"applink.feishu.cn",
-		"open.larksuite.com",
-		"accounts.larksuite.com",
-		"mcp.larksuite.com",
-		"applink.larksuite.com",
-	} {
-		if !IsPlatformEndpointHost(host) {
-			t.Errorf("IsPlatformEndpointHost(%q) = false, want true", host)
-		}
-	}
-
-	for _, host := range []string{
-		"example.com",
-		"open.feishu.cn.example.com",
-		"notopen.feishu.cn",
-		"",
-	} {
-		if IsPlatformEndpointHost(host) {
-			t.Errorf("IsPlatformEndpointHost(%q) = true, want false", host)
-		}
-	}
-}
-
-func TestIsPlatformEndpointHost_CoversEveryResolvedEndpoint(t *testing.T) {
-	for _, brand := range []LarkBrand{BrandFeishu, BrandLark} {
-		endpoints := reflect.ValueOf(ResolveEndpoints(brand))
-		for i := 0; i < endpoints.NumField(); i++ {
-			rawURL := endpoints.Field(i).String()
-			parsed, err := url.Parse(rawURL)
-			if err != nil {
-				t.Fatalf("ResolveEndpoints(%q) field %d URL %q: %v", brand, i, rawURL, err)
-			}
-			if !IsPlatformEndpointHost(parsed.Hostname()) {
-				t.Errorf("ResolveEndpoints(%q) field %d host %q is missing from the platform transport boundary", brand, i, parsed.Hostname())
-			}
-		}
-	}
-}
-
-func TestIsPlatformEndpointURL_RequiresSecureStandardOrigin(t *testing.T) {
-	if IsPlatformEndpointURL(nil) {
-		t.Error("IsPlatformEndpointURL(nil) = true, want false")
-	}
-	uppercaseScheme := &url.URL{Scheme: "HTTPS", Host: "open.feishu.cn", Path: "/path"}
-	if !IsPlatformEndpointURL(uppercaseScheme) {
-		t.Error("IsPlatformEndpointURL() rejected uppercase HTTPS scheme")
-	}
-
-	for _, rawURL := range []string{
-		"http://open.feishu.cn/path",
-		"https://open.feishu.cn:8443/path",
-		"https://open.feishu.cn.example.com/path",
-	} {
-		candidate, err := url.Parse(rawURL)
-		if err != nil {
-			t.Fatal(err)
-		}
-		if IsPlatformEndpointURL(candidate) {
-			t.Errorf("IsPlatformEndpointURL(%q) = true, want false", rawURL)
-		}
-	}
-
-	for _, rawURL := range []string{
-		"https://open.feishu.cn/path",
-		"https://open.feishu.cn:443/path",
-		"https://OPEN.FEISHU.CN/path",
-	} {
-		candidate, err := url.Parse(rawURL)
-		if err != nil {
-			t.Fatal(err)
-		}
-		if !IsPlatformEndpointURL(candidate) {
-			t.Errorf("IsPlatformEndpointURL(%q) = false, want true", rawURL)
-		}
-	}
-}

internal/credential/types.go

@@ -72,8 +72,7 @@ func AccountFromCliConfig(cfg *core.CliConfig) *Account {
 	}
 }
 
-// ToCliConfig copies the credential-layer account into the downstream config
-// shape, normalizing the brand so runtime consumers never see raw casing.
+// ToCliConfig copies the credential-layer account into the downstream config shape.
 func (a *Account) ToCliConfig() *core.CliConfig {
 	if a == nil {
 		return nil
@@ -82,7 +81,7 @@ func (a *Account) ToCliConfig() *core.CliConfig {
 		ProfileName:         a.ProfileName,
 		AppID:               a.AppID,
 		AppSecret:           normalizeAccountAppSecret(a.AppSecret),
-		Brand:               core.ParseBrand(string(a.Brand)),
+		Brand:               a.Brand,
 		DefaultAs:           a.DefaultAs,
 		UserOpenId:          a.UserOpenId,
 		UserName:            a.UserName,