feat(enhancement): centralize HTTP transport policies (#2021)

* docs(base): clarify form and file operation routing

* docs: clarify complete base role table rules

* docs: clarify base advanced permission status

* docs: clarify base form field lifecycle

* docs: guide base form question creation

* fix(base): address form dry-run review findings

* docs(base): add complete editable role example

* fix(base): validate form question create inputs

.github/CODEOWNERS

@@ -1,4 +1,7 @@
+/go.mod @liangshuo-1
+/go.sum @liangshuo-1
 /internal/ @liangshuo-1
+/shortcuts/common/ @liangshuo-1
 
 # Last match wins: existing domains below are exempt, only new skills/ entries need review.
 /skills/ @liangshuo-1

.github/workflows/release.yml

@@ -9,7 +9,40 @@ permissions:
   contents: read
 
 jobs:
-  goreleaser:
+  preflight:
+    runs-on: ubuntu-22.04
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          fetch-depth: 0
+
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+        with:
+          node-version: '22.14.0'
+
+      - name: Validate tag and commit
+        env:
+          TAG: ${{ github.ref_name }}
+        run: |
+          set -euo pipefail
+          node scripts/release-preflight.js --tag "$TAG"
+          git fetch origin main
+          HEAD_SHA="$(git rev-parse --verify 'HEAD^{commit}')"
+          MAIN_SHA="$(git rev-parse --verify 'FETCH_HEAD^{commit}')"
+          TAG_SHA="$(git rev-parse --verify "refs/tags/${TAG}^{commit}")"
+          if [[ "$TAG_SHA" != "$HEAD_SHA" ]]; then
+            echo "Tag ${TAG} does not resolve to the checked-out HEAD commit." >&2
+            exit 1
+          fi
+          if ! git merge-base --is-ancestor "$HEAD_SHA" "$MAIN_SHA"; then
+            echo "Tag ${TAG} does not point to a commit contained in origin/main." >&2
+            exit 1
+          fi
+
+  build-release:
+    needs: preflight
     runs-on: ubuntu-22.04
     permissions:
       contents: write
@@ -26,35 +59,79 @@ jobs:
         with:
           python-version: '3.x'
 
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+        with:
+          node-version: '22.14.0'
+          registry-url: 'https://registry.npmjs.org'
+          package-manager-cache: false
+
+      - name: Install pinned npm
+        run: npm install --global npm@11.16.0
+
       - name: Run GoReleaser
         uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6
         with:
           version: '~> v2'
           args: release --clean
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ github.token }}
+
+      - name: Include release checksums
+        run: |
+          set -euo pipefail
+          test -s dist/checksums.txt
+          (cd dist && sha256sum --check checksums.txt)
+          cp dist/checksums.txt checksums.txt
+
+      - name: Collect release asset
+        run: |
+          set -euo pipefail
+          mkdir npm-publish-asset
+          cp dist/*.tar.gz dist/*.zip dist/checksums.txt npm-publish-asset/
+
+      - name: Upload release asset
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: npm-publish-asset-${{ github.run_id }}
+          path: npm-publish-asset/
+          if-no-files-found: error
+          overwrite: true
 
   publish-npm:
-    needs: goreleaser
+    needs: build-release
     runs-on: ubuntu-22.04
+    environment: npm-production
+    permissions:
+      contents: read
+      id-token: write
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
         with:
-          node-version: '20'
+          node-version: '22.14.0'
           registry-url: 'https://registry.npmjs.org'
+          package-manager-cache: false
 
-      - name: Download checksums from release
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - name: Install pinned npm
+        run: npm install --global npm@11.16.0
+
+      - name: Download release asset
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        with:
+          name: npm-publish-asset-${{ github.run_id }}
+          path: npm-publish-asset
+
+      - name: Verify npm publish asset
         run: |
           set -euo pipefail
-          TAG="${GITHUB_REF_NAME}"
-          gh release download "${TAG}" --pattern checksums.txt --dir .
-          test -s checksums.txt || { echo "checksums.txt missing or empty for ${TAG}"; exit 1; }
+          (cd npm-publish-asset && sha256sum --check checksums.txt)
+          cp npm-publish-asset/checksums.txt checksums.txt
+          PACK_JSON="$(npm pack --ignore-scripts --json)"
+          PACK_FILE="$(node -e 'const p=JSON.parse(process.argv[1]); if(p.length!==1 || !p[0].filename) process.exit(1); process.stdout.write(p[0].filename)' "$PACK_JSON")"
+          test -s "$PACK_FILE"
+          tar -tzf "$PACK_FILE" | grep -qx 'package/checksums.txt'
+          rm "$PACK_FILE"
 
       - name: Publish to npm
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
         run: npm publish --access public

.github/workflows/semantic-review.yml

@@ -25,19 +25,16 @@ jobs:
         with:
           script: |
             const run = context.payload.workflow_run;
-            if (run.name !== "CI") throw new Error(`unexpected workflow name: ${run.name}`);
-            let workflowPath = run.path || "";
-            if (!workflowPath) {
-              const workflowId = Number(run.workflow_id || 0);
-              if (!Number.isInteger(workflowId) || workflowId <= 0) throw new Error("missing workflow id");
-              const { data: workflow } = await github.rest.actions.getWorkflow({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                workflow_id: workflowId,
-              });
-              workflowPath = workflow.path || "";
-            }
-            if (workflowPath !== ".github/workflows/ci.yml") throw new Error(`unexpected workflow path: ${workflowPath}`);
+            const workflowId = Number(run.workflow_id || 0);
+            if (!Number.isInteger(workflowId) || workflowId <= 0) throw new Error("missing workflow id");
+            const { data: workflow } = await github.rest.actions.getWorkflow({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              workflow_id: workflowId,
+            });
+            if (workflow.name !== "CI") throw new Error(`unexpected workflow name: ${workflow.name}`);
+            if (workflow.path !== ".github/workflows/ci.yml") throw new Error(`unexpected workflow path: ${workflow.path}`);
+            if (run.path && run.path !== workflow.path) throw new Error(`workflow path mismatch: ${run.path}`);
             if (run.event !== "pull_request") throw new Error(`unexpected event: ${run.event}`);
             if (run.repository.id !== context.payload.repository.id) throw new Error("repository id mismatch");
             if (run.repository.full_name !== context.payload.repository.full_name) throw new Error("repository name mismatch");
@@ -253,19 +250,16 @@ jobs:
         with:
           script: |
             const run = context.payload.workflow_run;
-            if (run.name !== "CI") throw new Error(`unexpected workflow name: ${run.name}`);
-            let workflowPath = run.path || "";
-            if (!workflowPath) {
-              const workflowId = Number(run.workflow_id || 0);
-              if (!Number.isInteger(workflowId) || workflowId <= 0) throw new Error("missing workflow id");
-              const { data: workflow } = await github.rest.actions.getWorkflow({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                workflow_id: workflowId,
-              });
-              workflowPath = workflow.path || "";
-            }
-            if (workflowPath !== ".github/workflows/ci.yml") throw new Error(`unexpected workflow path: ${workflowPath}`);
+            const workflowId = Number(run.workflow_id || 0);
+            if (!Number.isInteger(workflowId) || workflowId <= 0) throw new Error("missing workflow id");
+            const { data: workflow } = await github.rest.actions.getWorkflow({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              workflow_id: workflowId,
+            });
+            if (workflow.name !== "CI") throw new Error(`unexpected workflow name: ${workflow.name}`);
+            if (workflow.path !== ".github/workflows/ci.yml") throw new Error(`unexpected workflow path: ${workflow.path}`);
+            if (run.path && run.path !== workflow.path) throw new Error(`workflow path mismatch: ${run.path}`);
             if (run.event !== "pull_request") throw new Error(`unexpected event: ${run.event}`);
             if (run.conclusion !== "success") throw new Error(`unexpected conclusion: ${run.conclusion}`);
             if (run.repository.id !== context.payload.repository.id) throw new Error("repository id mismatch");

CHANGELOG.md

@@ -2,6 +2,149 @@
 
 All notable changes to this project will be documented in this file.
 
+## [v1.0.81] - 2026-07-31
+
+### Features
+
+- support visible_rule for form questions (#1891)
+- **contact**: add bot search shortcut (#2083)
+- add SXSD schema validation to Slides lint (#2103)
+- **drive**: add comment-operation shortcuts (#1898)
+- **drive**: extend permission shortcuts for Miaoda (#2070)
+- **apps**: add cache debug commands (+cache-get/-delete/-clear) (#1896)
+- support source file preview artifacts (#2085)
+
+### Bug Fixes
+
+- **contact**: stop bot match segments carrying tags or empty entries (#2115)
+- **base**: resolve Base URL block types accurately (#2099)
+- **drive**: use title for default download filename (#2089)
+- drop stale target version from root upgrade prompt (#2100)
+
+### Documentation
+
+- **calendar**: warn against container-default timezone in time conversion (#2104)
+- **calendar**: confirm scope before editing recurring events (#2119)
+- **base**: clarify form and file operation routing (#2110)
+
+### Misc
+
+- add protected public domain allowlists (#2111)
+
+## [v1.0.80] - 2026-07-29
+
+### Features
+
+- **drive**: add +member-list shortcut (#1795)
+- **drive**: add +permission-get-setting shortcut (#1738)
+- propagate invocation metadata (#2097)
+
+### Documentation
+
+- **slides**: 补齐 shortcut 参数说明，修正 +xml-get --output 必填标注 (#2088)
+- **slides**: +create 的参数下沉到 create.md，主 skill 只留路由 (#2096)
+
+### Tests
+
+- **e2e**: wait for base role update visibility (#2087)
+
+### Misc
+
+- Feat/detect line text overlap (#2069)
+
+## [v1.0.79] - 2026-07-28
+
+### Features
+
+- **slides**: update xsd (#2067)
+
+### Bug Fixes
+
+- **ci**: validate static workflow identity (#2015)
+- **sheets**: recognize OFL0X local office tokens (#2063)
+
+### Documentation
+
+- **calendar**: clarify identity selection by event ownership (#2071)
+- **slides**: add formula inline element syntax to quick-ref (#2077)
+
+## [v1.0.78] - 2026-07-27
+
+### Features
+
+- event description support rich text (#1975)
+
+### Bug Fixes
+
+- **slides**: restrict canvas overflow checks
+- **slides**: upgrade text overflow to error above 10px threshold
+- **slides**: detect letterSpacing-driven text overflow
+- **slides**: downgrade background-decoration text overflow to info
+- **slides**: allow chartParsedValues roundtrip tag
+- refine character width estimation for lark-slides text lint
+- **slides**: preserve info lint severity
+- **slides**: text may over flow shape
+- exempt ghost text from slides lint
+
+## [v1.0.77] - 2026-07-24
+
+### Features
+
+- introducing official card icon (#1973)
+- **apps**: validate +file-list --page-size against server (0, 200] range (#2007)
+- **apps**: support absolute and relative upload paths (#2005)
+- **slides**: fill xml-schema-quick-ref gaps that forced XSD fallback (#2026)
+- **slides**: add layout density lint for sparse/empty containers (#2022)
+- add risk-control protection (#1910)
+
+### Bug Fixes
+
+- **slides**: normalize presentation flag aliases (#2032)
+- **base**: classify +form-submit as high-risk-write (#1969)
+- **slides**: declare screenshot scope
+- **slides**: support CSV multi-value for --slide-id in screenshot (#2047)
+
+### Documentation
+
+- **skill**: clarify scope handling for query expansion (#2030)
+- **base**: clarify complete and partial updates (#1993)
+- **skills**: clarify callout child rules (#2048)
+
+### Misc
+
+- fix/task id handling (#2023)
+- fix/task search pagination (#2041)
+
+## [v1.0.75] - 2026-07-22
+
+### Features
+
+- add okr single create shortcut & skill text opti (#1941)
+- **calendar**: auto-add bot self as attendee and note user-only search (#1991)
+
+### Bug Fixes
+
+- **base**: improve table shortcut behavior & guidance (#1803)
+- issue#1935 & whiteboard shortcut reformat (#1980)
+- remove legacy shortcut (#1997)
+- **e2e**: inject shared credentials by identity (#1995)
+
+### Documentation
+
+- **skill**: describe html5 block xml usage (#1380)
+- clarify fetch metadata and user cites (#1981)
+- add topic move collector workflow (#1473)
+- update lark doc HTML size limit (#2001)
+- **base**: align record write schema guidance (#2000)
+
+### Tests
+
+- **e2e**: declare request identities explicitly (#2004)
+
+### Misc
+
+- harden npm release publishing (#1918)
+
 ## [v1.0.74] - 2026-07-21
 
 ### Features
@@ -1608,6 +1751,12 @@ Bundled AI agent skills for intelligent assistance:
 - Bilingual documentation (English & Chinese).
 - CI/CD pipelines: linting, testing, coverage reporting, and automated releases.
 
+[v1.0.81]: https://github.com/larksuite/cli/releases/tag/v1.0.81
+[v1.0.80]: https://github.com/larksuite/cli/releases/tag/v1.0.80
+[v1.0.79]: https://github.com/larksuite/cli/releases/tag/v1.0.79
+[v1.0.78]: https://github.com/larksuite/cli/releases/tag/v1.0.78
+[v1.0.77]: https://github.com/larksuite/cli/releases/tag/v1.0.77
+[v1.0.75]: https://github.com/larksuite/cli/releases/tag/v1.0.75
 [v1.0.74]: https://github.com/larksuite/cli/releases/tag/v1.0.74
 [v1.0.73]: https://github.com/larksuite/cli/releases/tag/v1.0.73
 [v1.0.72]: https://github.com/larksuite/cli/releases/tag/v1.0.72

Makefile

@@ -51,7 +51,7 @@ script-test:
 	bash scripts/resolve-changed-from.test.sh
 	bash scripts/ci-workflow.test.sh
 	bash scripts/semantic-review-workflow.test.sh
-	$(NODE) --test scripts/e2e_domains.test.js scripts/fetch_e2e_tat.test.js scripts/semantic-review-verify-artifact.test.js scripts/pr-quality-summary.test.js scripts/semantic-review-publish.test.js scripts/ci-quality-summary-publish.test.js
+	$(NODE) --test scripts/e2e_domains.test.js scripts/fetch_e2e_tat.test.js scripts/install.test.js scripts/release-preflight.test.js scripts/semantic-review-verify-artifact.test.js scripts/pr-quality-summary.test.js scripts/semantic-review-publish.test.js scripts/ci-quality-summary-publish.test.js
 
 # ./extension/... keeps the public plugin SDK in the default test matrix.
 unit-test: fetch_meta

README.md

@@ -285,12 +285,31 @@ To reduce these risks, the tool enables default security protections at multiple
 
 We recommend using the Lark/Feishu bot integrated with this tool as a private conversational assistant. Do not add it to group chats or allow other users to interact with it, to avoid abuse of permissions or data leakage.
 
+To reduce the security risks associated with access token theft, the CLI sends a minimal set of risk-control signals with OpenAPI requests made to exact official Feishu/Lark HTTPS domains. These signals are used to help identify anomalous API activity. This protection is enabled by default. The information sent is limited to:
+
+- Operating system type: macOS, Windows, or Linux
+- Device hardware model: for example, Mac17,9
+
+To disable this protection for the current workspace, run:
+
+```bash
+lark-cli config risk-control off
+```
+
+To enable this protection for the current workspace, run:
+
+```bash
+lark-cli config risk-control on
+```
+
+To restore the default policy for the current workspace, run:
+
+```bash
+lark-cli config risk-control default
+```
+
 Please fully understand all usage risks. By using this tool, you are deemed to voluntarily assume all related responsibilities.
 
-## Star History
-
-[![Star History Chart](https://api.star-history.com/svg?repos=larksuite/cli&type=Date)](https://star-history.com/#larksuite/cli&Date)
-
 ## Contributing
 
 Community contributions are welcome! If you find a bug or have feature suggestions, please submit an [Issue](https://github.com/larksuite/cli/issues) or [Pull Request](https://github.com/larksuite/cli/pulls).

README.zh.md

@@ -286,12 +286,31 @@ lark-cli schema im.messages.delete
 
 我们建议您将对接本工具的飞书机器人作为私人对话助手使用，请勿将其拉入群聊或允许其他用户与其交互，以避免权限被滥用或数据泄露。
 
+为降低访问令牌被盗用后的安全风险，CLI 在向飞书/Lark 官方 HTTPS 精确域名发起 OpenAPI 请求时，会随请求发送一组最小化的风控信号，用于辅助识别异常调用行为。该保护默认开启，发送的信息仅包括：
+
+- 操作系统类型：macOS、Windows 或 Linux
+- 设备的硬件产品型号：例如 Mac17,9
+
+如需让当前 workspace 退出该保护，可执行以下命令：
+
+```bash
+lark-cli config risk-control off
+```
+
+如需开启当前 workspace 的保护，可执行以下命令：
+
+```bash
+lark-cli config risk-control on
+```
+
+恢复当前 workspace 默认策略可执行：
+
+```bash
+lark-cli config risk-control default
+```
+
 请您充分知悉全部使用风险，使用本工具即视为您自愿承担相关所有责任。
 
-## Star History
-
-[![Star History Chart](https://api.star-history.com/svg?repos=larksuite/cli&type=Date)](https://star-history.com/#larksuite/cli&Date)
-
 ## 贡献
 
 欢迎社区贡献！如果你发现 bug 或有功能建议，请提交 [Issue](https://github.com/larksuite/cli/issues) 或 [Pull Request](https://github.com/larksuite/cli/pulls)。

affordance/contact.md

@@ -23,6 +23,41 @@ lark-cli contact +search-user --query "alice" --as user
 lark-cli contact +search-user --user-ids "ou_3a8b****6a7b,me" --as user
 ```
 
+## +search-bot
+Search bots (apps) by keyword. Pass `--query` or `--queries`; use `--chat-ids` to search within specific chats.
+
+### Skills
+- lark-contact/references/lark-contact-search-bot.md
+
+### Avoid when
+- Looking for a person rather than a bot → use [[+search-user]]
+- Running as a bot — this shortcut is user-only
+
+### Tips
+- `has_more=true` means the search is incomplete; refine the keyword or search scope instead of paginating
+
+### Examples
+
+**Find bots by keyword**
+```bash
+lark-cli contact +search-bot --query "会议助手" --as user
+```
+
+**Search inside one chat**
+```bash
+lark-cli contact +search-bot --query "助手" --chat-ids "oc_3a8b****6a7b" --as user
+```
+
+**Find bots you've chatted with**
+```bash
+lark-cli contact +search-bot --query "助手" --has-chatted --as user
+```
+
+**Search several bot keywords in one call**
+```bash
+lark-cli contact +search-bot --queries "会议助手,日报助手,审批助手" --as user
+```
+
 ## +get-user
 Fetch one user's profile by id, or your own with --user-id omitted. Use it under bot identity — `+search-user` is user-only.
 

cmd/api/api.go

@@ -5,6 +5,8 @@ package api
 
 import (
 	"context"
+	"fmt"
+	"io"
 	"regexp"
 	"strings"
 
@@ -232,15 +234,6 @@ func apiRun(opts *APIOptions) error {
 				errs.InvalidParam{Name: "--page-all", Reason: "conflicts with --output"},
 			)
 	}
-	// Parse before the dry-run branch so both dry-run and emit reject unknown
-	// values. Raw API responses accept four formats; pretty remains available
-	// only for the dry-run request preview handled below.
-	format, ok := output.ParseFormat(opts.Format)
-	if !ok {
-		return errs.NewValidationError(errs.SubtypeInvalidArgument,
-			"unknown output format %q (want json, ndjson, table, or csv)", opts.Format).
-			WithParam("--format")
-	}
 	if err := output.ValidateJqFlags(opts.JqExpr, opts.Output, opts.Format); err != nil {
 		return err
 	}
@@ -257,17 +250,9 @@ func apiRun(opts *APIOptions) error {
 
 	if opts.DryRun {
 		if fileMeta != nil {
-			return cmdutil.PrintDryRunWithFile(request, config, dryRunOutputOptions(f, opts, format), *fileMeta)
+			return cmdutil.PrintDryRunWithFile(request, config, dryRunOutputOptions(f, opts), *fileMeta)
 		}
-		return apiDryRun(f, request, config, opts, format)
-	}
-	// pretty is a shortcut-only presentation format; the raw api command has no
-	// pretty renderer for responses, so reject it before client init rather than
-	// fall back. (Dry-run keeps its own plain-text pretty preview, handled above.)
-	if format == output.FormatPretty {
-		return errs.NewValidationError(errs.SubtypeInvalidArgument,
-			"--format pretty is not supported here (use json, ndjson, table, or csv)").
-			WithParam("--format")
+		return apiDryRun(f, request, config, opts)
 	}
 	// Identity info is now included in the JSON envelope; skip stderr printing.
 	// cmdutil.PrintIdentity(f.IOStreams.ErrOut, opts.As, config, f.IdentityAutoDetected)
@@ -278,20 +263,14 @@ func apiRun(opts *APIOptions) error {
 	}
 
 	out := f.IOStreams.Out
+	format, formatOK := output.ParseFormat(opts.Format)
+	if !formatOK {
+		fmt.Fprintf(f.IOStreams.ErrOut, "warning: unknown format %q, falling back to json\n", opts.Format)
+	}
 
 	if opts.PageAll {
-		return client.PaginateToOutput(opts.Ctx, client.PaginateOutputOptions{
-			Client:      ac,
-			Request:     request,
-			Format:      format,
-			JqExpr:      opts.JqExpr,
-			Out:         out,
-			ErrOut:      f.IOStreams.ErrOut,
-			CommandPath: opts.Cmd.CommandPath(),
-			Pagination:  client.PaginationOptions{PageLimit: opts.PageLimit, PageDelay: opts.PageDelay},
-			CheckErr:    ac.CheckResponse,
-			MarkErr:     errs.MarkRaw,
-		})
+		return apiPaginate(opts.Ctx, ac, request, format, opts.JqExpr, out, f.IOStreams.ErrOut, opts.Cmd.CommandPath(),
+			client.PaginationOptions{PageLimit: opts.PageLimit, PageDelay: opts.PageDelay})
 	}
 
 	resp, err := ac.DoAPI(opts.Ctx, request)
@@ -325,13 +304,13 @@ func apiRun(opts *APIOptions) error {
 	return nil
 }
 
-func apiDryRun(f *cmdutil.Factory, request client.RawApiRequest, config *core.CliConfig, opts *APIOptions, format output.Format) error {
-	return cmdutil.PrintDryRun(request, config, dryRunOutputOptions(f, opts, format))
+func apiDryRun(f *cmdutil.Factory, request client.RawApiRequest, config *core.CliConfig, opts *APIOptions) error {
+	return cmdutil.PrintDryRun(request, config, dryRunOutputOptions(f, opts))
 }
 
-func dryRunOutputOptions(f *cmdutil.Factory, opts *APIOptions, format output.Format) cmdutil.DryRunOutputOptions {
+func dryRunOutputOptions(f *cmdutil.Factory, opts *APIOptions) cmdutil.DryRunOutputOptions {
 	return cmdutil.DryRunOutputOptions{
-		Format:      format.String(),
+		Format:      opts.Format,
 		JqExpr:      opts.JqExpr,
 		CommandPath: opts.Cmd.CommandPath(),
 		Identity:    opts.As,
@@ -339,3 +318,75 @@ func dryRunOutputOptions(f *cmdutil.Factory, opts *APIOptions, format output.For
 		ErrOut:      f.IOStreams.ErrOut,
 	}
 }
+
+func apiPaginate(ctx context.Context, ac *client.APIClient, request client.RawApiRequest, format output.Format, jqExpr string, out, errOut io.Writer, commandPath string, pagOpts client.PaginationOptions) error {
+	if pagOpts.Identity == "" {
+		pagOpts.Identity = request.As
+	}
+	// When jq is set, always aggregate all pages then filter.
+	if jqExpr != "" {
+		result, err := ac.PaginateAll(ctx, request, pagOpts)
+		if err != nil {
+			return errs.MarkRaw(err)
+		}
+		if apiErr := ac.CheckResponse(result, pagOpts.Identity); apiErr != nil {
+			output.FormatValue(out, result, output.FormatJSON)
+			return errs.MarkRaw(apiErr)
+		}
+		return output.WriteSuccessEnvelope(output.SuccessEnvelopeData(result), output.SuccessEnvelopeOptions{
+			CommandPath: commandPath,
+			Identity:    string(pagOpts.Identity),
+			JqExpr:      jqExpr,
+			Out:         out,
+			ErrOut:      errOut,
+		})
+	}
+
+	switch format {
+	case output.FormatNDJSON, output.FormatTable, output.FormatCSV:
+		emitter := output.NewEmitter(output.EmitterConfig{
+			Out:            out,
+			ErrOut:         errOut,
+			CommandPath:    commandPath,
+			Identity:       string(pagOpts.Identity),
+			NoticeProvider: output.GetNotice,
+		})
+		result, hasItems, err := ac.StreamPages(ctx, request, func(items []interface{}) error {
+			// Streaming formats intentionally emit each page after that page has
+			// passed safety scanning. A later page may still fail, so callers
+			// must use the exit code to distinguish complete vs partial output.
+			return emitter.StreamPage(items, output.StreamOptions{Format: format.String()})
+		}, pagOpts)
+		if err != nil {
+			return errs.MarkRaw(err)
+		}
+		if apiErr := ac.CheckResponse(result, pagOpts.Identity); apiErr != nil {
+			return errs.MarkRaw(apiErr)
+		}
+		if !hasItems {
+			fmt.Fprintf(errOut, "warning: this API does not return a list, format %q is not supported, falling back to json\n", format)
+			return output.WriteSuccessEnvelope(output.SuccessEnvelopeData(result), output.SuccessEnvelopeOptions{
+				CommandPath: commandPath,
+				Identity:    string(pagOpts.Identity),
+				Out:         out,
+				ErrOut:      errOut,
+			})
+		}
+		return nil
+	default:
+		result, err := ac.PaginateAll(ctx, request, pagOpts)
+		if err != nil {
+			return errs.MarkRaw(err)
+		}
+		if apiErr := ac.CheckResponse(result, pagOpts.Identity); apiErr != nil {
+			output.FormatValue(out, result, output.FormatJSON)
+			return errs.MarkRaw(apiErr)
+		}
+		return output.WriteSuccessEnvelope(output.SuccessEnvelopeData(result), output.SuccessEnvelopeOptions{
+			CommandPath: commandPath,
+			Identity:    string(pagOpts.Identity),
+			Out:         out,
+			ErrOut:      errOut,
+		})
+	}
+}

cmd/api/api_paginate_test.go

@@ -66,23 +66,6 @@ func apiPaginateRequest() client.RawApiRequest {
 	}
 }
 
-// apiPaginate adapts the positional test calls to PaginateToOutput's options
-// struct so each test case stays a single readable statement.
-func apiPaginate(ctx context.Context, ac *client.APIClient, request client.RawApiRequest, format output.Format, jqExpr string, out, errOut io.Writer, commandPath string, pag client.PaginationOptions, checkErr func(interface{}, core.Identity) error, markErr func(error) error) error {
-	return client.PaginateToOutput(ctx, client.PaginateOutputOptions{
-		Client:      ac,
-		Request:     request,
-		Format:      format,
-		JqExpr:      jqExpr,
-		Out:         out,
-		ErrOut:      errOut,
-		CommandPath: commandPath,
-		Pagination:  pag,
-		CheckErr:    checkErr,
-		MarkErr:     markErr,
-	})
-}
-
 func assertAPIPaginateJSONBytes(t *testing.T, got []byte, want interface{}) {
 	t.Helper()
 	wantBytes, err := json.MarshalIndent(want, "", "  ")
@@ -129,10 +112,10 @@ func TestAPIPaginate_DefaultAggregatesAllPages(t *testing.T) {
 		output.FormatJSON, "", out, errOut, "lark-cli api GET", client.PaginationOptions{
 			PageLimit: 10,
 			PageDelay: -1,
-		}, ac.CheckResponse, errs.MarkRaw)
+		})
 
 	if err != nil {
-		t.Fatalf("PaginateToOutput() error = %v, want nil", err)
+		t.Fatalf("apiPaginate() error = %v, want nil", err)
 	}
 	if calls != 3 {
 		t.Fatalf("pagination requests = %d, want 3", calls)
@@ -212,10 +195,10 @@ func TestAPIPaginate_StreamingFormatsEmitExactMultiPageBytes(t *testing.T) {
 				tt.format, "", out, errOut, "lark-cli api GET", client.PaginationOptions{
 					PageLimit: 10,
 					PageDelay: -1,
-				}, ac.CheckResponse, errs.MarkRaw)
+				})
 
 			if err != nil {
-				t.Fatalf("PaginateToOutput() error = %v, want nil", err)
+				t.Fatalf("apiPaginate() error = %v, want nil", err)
 			}
 			if got := out.String(); got != tt.want {
 				t.Fatalf("stdout byte mismatch\ngot (%d bytes):\n%q\nwant (%d bytes):\n%q", len(got), got, len(tt.want), tt.want)
@@ -256,14 +239,14 @@ func TestAPIPaginate_StreamingWriteFailureStopsFurtherPages(t *testing.T) {
 
 	err := apiPaginate(context.Background(), ac, apiPaginateRequest(),
 		output.FormatNDJSON, "", out, errOut, "lark-cli api GET",
-		client.PaginationOptions{PageLimit: 10, PageDelay: -1}, ac.CheckResponse, errs.MarkRaw)
+		client.PaginationOptions{PageLimit: 10, PageDelay: -1})
 
 	if !errors.Is(err, sentinel) {
-		t.Fatalf("PaginateToOutput() error = %v, want preserved writer cause", err)
+		t.Fatalf("apiPaginate() error = %v, want preserved writer cause", err)
 	}
 	problem, ok := errs.ProblemOf(err)
 	if !ok || problem.Category != errs.CategoryInternal {
-		t.Fatalf("PaginateToOutput() problem = %#v, %v; want internal typed error", problem, ok)
+		t.Fatalf("apiPaginate() problem = %#v, %v; want internal typed error", problem, ok)
 	}
 	if calls != 2 {
 		t.Fatalf("pagination requests = %d, want 2", calls)
@@ -273,7 +256,7 @@ func TestAPIPaginate_StreamingWriteFailureStopsFurtherPages(t *testing.T) {
 	}
 }
 
-func TestAPIPaginate_StreamingFormatHonorsNDJSONWithoutList(t *testing.T) {
+func TestAPIPaginate_StreamingFormatFallsBackToJSONWithoutList(t *testing.T) {
 	ac, out, errOut, reg := newAPIPaginateTestHarness(t)
 	reg.Register(&httpmock.Stub{
 		URL: "/open-apis/test/v1/items",
@@ -288,17 +271,22 @@ func TestAPIPaginate_StreamingFormatHonorsNDJSONWithoutList(t *testing.T) {
 	})
 
 	err := apiPaginate(context.Background(), ac, apiPaginateRequest(),
-		output.FormatNDJSON, "", out, errOut, "lark-cli api GET", client.PaginationOptions{PageDelay: -1}, ac.CheckResponse, errs.MarkRaw)
+		output.FormatNDJSON, "", out, errOut, "lark-cli api GET", client.PaginationOptions{PageDelay: -1})
 
 	if err != nil {
-		t.Fatalf("PaginateToOutput() error = %v, want nil", err)
+		t.Fatalf("apiPaginate() error = %v, want nil", err)
 	}
-	const want = "{\"name\":\"Test User\",\"user_id\":\"u123\"}\n"
-	if got := out.String(); got != want {
-		t.Fatalf("stdout bytes = %q, want %q", got, want)
-	}
-	if errOut.Len() != 0 {
-		t.Fatalf("stderr bytes = %q, want empty", errOut.String())
+	assertAPIPaginateJSONBytes(t, out.Bytes(), output.Envelope{
+		OK:       true,
+		Identity: "bot",
+		Data: map[string]interface{}{
+			"name":    "Test User",
+			"user_id": "u123",
+		},
+	})
+	wantWarning := "warning: this API does not return a list, format \"ndjson\" is not supported, falling back to json\n"
+	if got := errOut.String(); got != wantWarning {
+		t.Fatalf("stderr bytes = %q, want %q", got, wantWarning)
 	}
 }
 
@@ -326,10 +314,10 @@ func TestAPIPaginate_BusinessErrorsWriteRawAndAreMarkedRaw(t *testing.T) {
 			})
 
 			err := apiPaginate(context.Background(), ac, apiPaginateRequest(),
-				tt.format, tt.jqExpr, out, errOut, "lark-cli api GET", client.PaginationOptions{PageDelay: -1}, ac.CheckResponse, errs.MarkRaw)
+				tt.format, tt.jqExpr, out, errOut, "lark-cli api GET", client.PaginationOptions{PageDelay: -1})
 
 			if err == nil {
-				t.Fatal("PaginateToOutput() error = nil, want business error")
+				t.Fatal("apiPaginate() error = nil, want business error")
 			}
 			if !errs.IsRaw(err) {
 				t.Fatalf("errs.IsRaw(error) = false, want true; error = %T: %v", err, err)
@@ -361,10 +349,10 @@ func TestAPIPaginate_TransportErrorsAreMarkedRaw(t *testing.T) {
 			ac, out, errOut, _ := newAPIPaginateTestHarness(t)
 
 			err := apiPaginate(context.Background(), ac, apiPaginateRequest(),
-				tt.format, tt.jqExpr, out, errOut, "lark-cli api GET", client.PaginationOptions{PageDelay: -1}, ac.CheckResponse, errs.MarkRaw)
+				tt.format, tt.jqExpr, out, errOut, "lark-cli api GET", client.PaginationOptions{PageDelay: -1})
 
 			if err == nil {
-				t.Fatal("PaginateToOutput() error = nil, want transport error")
+				t.Fatal("apiPaginate() error = nil, want transport error")
 			}
 			if !errs.IsRaw(err) {
 				t.Fatalf("errs.IsRaw(error) = false, want true; error = %T: %v", err, err)
@@ -391,10 +379,10 @@ func TestAPIPaginate_StreamBusinessErrorIsMarkedRaw(t *testing.T) {
 	})
 
 	err := apiPaginate(context.Background(), ac, apiPaginateRequest(),
-		output.FormatNDJSON, "", out, errOut, "lark-cli api GET", client.PaginationOptions{PageDelay: -1}, ac.CheckResponse, errs.MarkRaw)
+		output.FormatNDJSON, "", out, errOut, "lark-cli api GET", client.PaginationOptions{PageDelay: -1})
 
 	if err == nil {
-		t.Fatal("PaginateToOutput() error = nil, want business error")
+		t.Fatal("apiPaginate() error = nil, want business error")
 	}
 	if !errs.IsRaw(err) {
 		t.Fatalf("errs.IsRaw(error) = false, want true; error = %T: %v", err, err)

cmd/api/api_test.go

@@ -118,101 +118,6 @@ func TestApiCmd_DryRunWithJq(t *testing.T) {
 	}
 }
 
-// An unknown --format is a typed validation error, not a silent JSON fallback —
-// on both the emit path and (parsed before the dry-run branch) the dry-run path.
-// No stub is registered because the command must fail before any API call.
-func TestApiCmd_UnknownFormat_Rejected(t *testing.T) {
-	for _, extra := range [][]string{nil, {"--dry-run"}} {
-		name := "emit"
-		if len(extra) > 0 {
-			name = "dry-run"
-		}
-		t.Run(name, func(t *testing.T) {
-			t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
-			f, stdout, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
-				AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
-			})
-			cmd := newTestApiCmd(f, nil)
-			cmd.SetArgs(append([]string{"GET", "/open-apis/test", "--as", "bot", "--format", "bogus"}, extra...))
-			err := cmd.Execute()
-			if err == nil {
-				t.Fatal("expected a validation error for unknown --format")
-			}
-			requireValidationParam(t, err, "--format")
-			if !strings.Contains(err.Error(), "unknown output format") {
-				t.Errorf("error = %v, want unknown-format message", err)
-			}
-			if strings.Contains(strings.ToLower(err.Error()), "pretty") {
-				t.Errorf("error = %v, raw api format choices must exclude pretty", err)
-			}
-			if stdout.String() != "" {
-				t.Errorf("unknown --format must not write stdout, got:\n%s", stdout.String())
-			}
-		})
-	}
-}
-
-func TestApiCmd_UnknownFormatPrecedesJqConflict(t *testing.T) {
-	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
-	f, stdout, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
-	})
-	cmd := newTestApiCmd(f, nil)
-	cmd.SetArgs([]string{
-		"GET", "/open-apis/test", "--as", "bot",
-		"--format", "tabel", "--jq", ".",
-	})
-
-	err := cmd.Execute()
-	requireValidationParam(t, err, "--format")
-	if !strings.Contains(err.Error(), "unknown output format") {
-		t.Fatalf("error = %v, want unknown-format message", err)
-	}
-	if strings.Contains(err.Error(), "mutually exclusive") {
-		t.Fatalf("error = %v, unknown format should be reported before jq conflict", err)
-	}
-	if stdout.Len() != 0 {
-		t.Fatalf("unknown --format wrote stdout:\n%s", stdout.String())
-	}
-}
-
-// pretty is shortcut-only: the raw api command rejects it on the emit path
-// (before client init) but keeps the dry-run plain-text preview.
-func TestApiCmd_Pretty_RejectedOnEmit(t *testing.T) {
-	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
-	f, stdout, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
-	})
-	cmd := newTestApiCmd(f, nil)
-	cmd.SetArgs([]string{"GET", "/open-apis/test", "--as", "bot", "--format", "pretty"})
-	err := cmd.Execute()
-	if err == nil {
-		t.Fatal("expected a validation error for --format pretty on the emit path")
-	}
-	requireValidationParam(t, err, "--format")
-	if !strings.Contains(err.Error(), "pretty") {
-		t.Errorf("error = %v, want pretty-not-supported message", err)
-	}
-	if stdout.String() != "" {
-		t.Errorf("rejected --format pretty must not write stdout, got:\n%s", stdout.String())
-	}
-}
-
-func TestApiCmd_MixedCasePretty_PreservedOnDryRun(t *testing.T) {
-	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
-	f, stdout, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
-	})
-	cmd := newTestApiCmd(f, nil)
-	cmd.SetArgs([]string{"GET", "/open-apis/test", "--as", "bot", "--format", "Pretty", "--dry-run"})
-	if err := cmd.Execute(); err != nil {
-		t.Fatalf("dry-run --format pretty must be accepted, got: %v", err)
-	}
-	if !strings.Contains(stdout.String(), "# dry-run: request not sent") {
-		t.Fatalf("dry-run --format pretty lost its plain-text preview, stdout:\n%s", stdout.String())
-	}
-}
-
 // Regression: --params null parses to a nil map; writing page_size onto it must
 // not panic. Symmetric to the typed-flag overlay path in cmd/service — both
 // write into the map ParseJSONMap returns.
@@ -499,7 +404,7 @@ func TestApiCmd_BinaryResponse_AutoSave(t *testing.T) {
 	}
 }
 
-func TestApiCmd_PageAll_NonBatchAPI_HonorsNDJSON(t *testing.T) {
+func TestApiCmd_PageAll_NonBatchAPI_FallbackToJSON(t *testing.T) {
 	f, stdout, stderr, reg := cmdutil.TestFactory(t, &core.CliConfig{
 		AppID: "test-app-pageall1", AppSecret: "test-secret-pageall1", Brand: core.BrandFeishu,
 	})
@@ -522,15 +427,24 @@ func TestApiCmd_PageAll_NonBatchAPI_HonorsNDJSON(t *testing.T) {
 	if err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
-	if strings.Contains(stderr.String(), "falling back") {
-		t.Fatalf("stderr contains format fallback warning: %q", stderr.String())
+	// Should print fallback warning to stderr
+	if !strings.Contains(stderr.String(), "warning: this API does not return a list") {
+		t.Error("expected fallback warning in stderr")
 	}
+	if !strings.Contains(stderr.String(), "falling back to json") {
+		t.Error("expected 'falling back to json' in stderr")
+	}
+	// Should output JSON result to stdout
 	var got map[string]interface{}
 	if err := json.Unmarshal(stdout.Bytes(), &got); err != nil {
-		t.Fatalf("invalid NDJSON object: %v\n%s", err, stdout.String())
+		t.Fatalf("invalid JSON output: %v\n%s", err, stdout.String())
 	}
-	if got["user_id"] != "u123" || got["name"] != "Test User" {
-		t.Fatalf("unexpected NDJSON object: %#v", got)
+	data, ok := got["data"].(map[string]interface{})
+	if got["ok"] != true || got["identity"] != "bot" || !ok || data["user_id"] != "u123" {
+		t.Fatalf("unexpected fallback envelope: %#v", got)
+	}
+	if _, hasCode := got["code"]; hasCode {
+		t.Fatalf("fallback success envelope leaked outer code: %s", stdout.String())
 	}
 }
 
@@ -707,10 +621,6 @@ func (p *apiContentSafetyProvider) Scan(_ context.Context, req extcs.ScanRequest
 	return &extcs.Alert{Provider: "api-test", MatchedRules: []string{"pagination"}}, nil
 }
 
-func (p *apiContentSafetyProvider) ScanFullText(ctx context.Context, req extcs.ScanRequest) (*extcs.Alert, error) {
-	return p.Scan(ctx, req)
-}
-
 func TestApiCmd_PageAll_DefaultJSONRunsContentSafety(t *testing.T) {
 	t.Setenv("LARKSUITE_CLI_CONTENT_SAFETY_MODE", "warn")
 	provider := &apiContentSafetyProvider{}
@@ -744,12 +654,12 @@ func TestApiCmd_PageAll_DefaultJSONRunsContentSafety(t *testing.T) {
 	if provider.path != "api" {
 		t.Fatalf("scan path = %q, want api", provider.path)
 	}
-	data, ok := provider.data.(string)
+	data, ok := provider.data.(map[string]interface{})
 	if !ok {
-		t.Fatalf("scanned data type = %T, want rendered JSON string", provider.data)
+		t.Fatalf("scanned data type = %T, want map", provider.data)
 	}
-	if strings.Contains(data, `"code"`) || !strings.Contains(data, `"data"`) {
-		t.Fatalf("scanned JSON should be the success envelope without an API code, got %q", data)
+	if _, hasCode := data["code"]; hasCode {
+		t.Fatalf("scanned data should be business data only, got %#v", data)
 	}
 
 	var got map[string]interface{}
@@ -795,11 +705,9 @@ func TestApiCmd_PageAll_StreamFormatRunsContentSafety(t *testing.T) {
 	if provider.path != "api" {
 		t.Fatalf("scan path = %q, want api", provider.path)
 	}
-	// Streaming now scans the exact rendered page bytes (not the structured
-	// item) so a rule match formed only in the rendered output cannot slip past.
-	scanned, ok := provider.data.(string)
-	if !ok || !strings.Contains(scanned, `"id":"1"`) {
-		t.Fatalf("scanned data = %#v, want rendered ndjson page text", provider.data)
+	items, ok := provider.data.([]interface{})
+	if !ok || len(items) != 1 {
+		t.Fatalf("scanned data = %#v, want one streamed item", provider.data)
 	}
 	if !strings.Contains(stderr.String(), "warning: content safety alert from api-test") {
 		t.Fatalf("expected content safety warning on stderr, got: %s", stderr.String())
@@ -859,8 +767,11 @@ func TestApiCmd_PageAll_StreamFormatBlockSkipsBlockedPage(t *testing.T) {
 		t.Fatalf("rules = %v, want [pagination]", safetyErr.Rules)
 	}
 	out := stdout.String()
-	if out != "" {
-		t.Fatalf("blocked complete stream was written before safety block: %s", out)
+	if !strings.Contains(out, "safe-page") {
+		t.Fatalf("expected earlier safe page to remain streamed, got: %s", out)
+	}
+	if strings.Contains(out, "blocked-page") {
+		t.Fatalf("blocked page was written before safety block: %s", out)
 	}
 }
 
@@ -875,18 +786,6 @@ func requireProblem(t *testing.T, err error, category errs.Category, subtype err
 	}
 }
 
-func requireValidationParam(t *testing.T, err error, param string) {
-	t.Helper()
-	requireProblem(t, err, errs.CategoryValidation, errs.SubtypeInvalidArgument, 0)
-	var validationErr *errs.ValidationError
-	if !errors.As(err, &validationErr) {
-		t.Fatalf("expected *errs.ValidationError, got %T: %v", err, err)
-	}
-	if validationErr.Param != param {
-		t.Fatalf("Param = %q, want %q", validationErr.Param, param)
-	}
-}
-
 func TestNormalisePath_StripsQueryAndFragment(t *testing.T) {
 	for _, tt := range []struct {
 		name string

cmd/auth/auth_test.go

@@ -381,34 +381,6 @@ func TestAuthScopesCmd_JSONFlagForcesJSONFormat(t *testing.T) {
 	}
 }
 
-func TestAuthScopesCmd_RejectsUnknownFormat(t *testing.T) {
-	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
-	})
-
-	runCalled := false
-	cmd := NewCmdAuthScopes(f, func(*ScopesOptions) error {
-		runCalled = true
-		return nil
-	})
-	cmd.SetArgs([]string{"--format", "tabel"})
-
-	err := cmd.Execute()
-	if err == nil {
-		t.Fatal("expected invalid format error")
-	}
-	var validationErr *errs.ValidationError
-	if !errors.As(err, &validationErr) {
-		t.Fatalf("error = %T, want *errs.ValidationError", err)
-	}
-	if validationErr.Category != errs.CategoryValidation || validationErr.Subtype != errs.SubtypeInvalidArgument || validationErr.Param != "--format" {
-		t.Fatalf("validation error = %#v; want validation/invalid_argument with --format", validationErr)
-	}
-	if runCalled {
-		t.Fatal("auth scopes runner was called for an invalid format")
-	}
-}
-
 func TestAuthScopesRun_UsesTenantAccessTokenFromCredentialProvider(t *testing.T) {
 	f, _, _, reg := cmdutil.TestFactory(t, &core.CliConfig{
 		AppID: "test-app", AppSecret: "", Brand: core.BrandFeishu,

cmd/auth/scopes.go

@@ -6,8 +6,6 @@ package auth
 import (
 	"context"
 	"fmt"
-	"io"
-	"strings"
 
 	"github.com/spf13/cobra"
 
@@ -35,13 +33,6 @@ func NewCmdAuthScopes(f *cmdutil.Factory, runF func(*ScopesOptions) error) *cobr
 			opts.Ctx = cmd.Context()
 			if opts.JSON {
 				opts.Format = "json"
-			} else {
-				opts.Format = strings.ToLower(strings.TrimSpace(opts.Format))
-				if opts.Format != "json" && opts.Format != "pretty" {
-					return errs.NewValidationError(errs.SubtypeInvalidArgument,
-						"unknown output format %q (want json or pretty)", opts.Format).
-						WithParam("--format")
-				}
 			}
 			if runF != nil {
 				return runF(opts)
@@ -83,36 +74,20 @@ func authScopesRun(opts *ScopesOptions) error {
 		return errs.NewInternalError(errs.SubtypeSDKError,
 			"failed to get app scope info: %v", err).WithCause(err)
 	}
-	data := map[string]interface{}{
-		"appId":      config.AppID,
-		"brand":      config.Brand,
-		"tokenType":  "user",
-		"userScopes": appInfo.UserScopes,
-		"count":      len(appInfo.UserScopes),
-	}
-	emitter := output.NewEmitter(output.EmitterConfig{
-		Out:         f.IOStreams.Out,
-		ErrOut:      f.IOStreams.ErrOut,
-		CommandPath: "lark-cli auth scopes",
-	})
 	if opts.Format == "pretty" {
-		return emitter.Value(data, output.StreamOptions{
-			Format: output.FormatPretty,
-			Pretty: func(w io.Writer, _ bool) error {
-				if _, err := fmt.Fprintf(w, "App ID: %s\n", config.AppID); err != nil {
-					return err
-				}
-				if _, err := fmt.Fprintf(w, "Enabled scopes (%d):\n\n", len(appInfo.UserScopes)); err != nil {
-					return err
-				}
-				for _, scope := range appInfo.UserScopes {
-					if _, err := fmt.Fprintf(w, "  • %s\n", scope); err != nil {
-						return err
-					}
-				}
-				return nil
-			},
+		fmt.Fprintf(f.IOStreams.ErrOut, "App ID: %s\n", config.AppID)
+		fmt.Fprintf(f.IOStreams.ErrOut, "Enabled scopes (%d):\n\n", len(appInfo.UserScopes))
+		for _, s := range appInfo.UserScopes {
+			fmt.Fprintf(f.IOStreams.ErrOut, "  • %s\n", s)
+		}
+	} else {
+		output.PrintJson(f.IOStreams.Out, map[string]interface{}{
+			"appId":      config.AppID,
+			"brand":      config.Brand,
+			"tokenType":  "user",
+			"userScopes": appInfo.UserScopes,
+			"count":      len(appInfo.UserScopes),
 		})
 	}
-	return emitter.Value(data, output.StreamOptions{Format: output.FormatJSON})
+	return nil
 }

cmd/auth/scopes_test.go

@@ -7,7 +7,6 @@ import (
 	"context"
 	"errors"
 	"fmt"
-	"strings"
 	"testing"
 
 	"github.com/larksuite/cli/errs"
@@ -44,36 +43,6 @@ func scopesTestFactory(t *testing.T) *ScopesOptions {
 	}
 }
 
-func TestAuthScopesRunPrettyWritesBusinessDataToStdout(t *testing.T) {
-	previous := getAppInfoFn
-	getAppInfoFn = func(context.Context, *cmdutil.Factory, string) (*appInfo, error) {
-		return &appInfo{UserScopes: []string{"im:message"}}, nil
-	}
-	t.Cleanup(func() { getAppInfoFn = previous })
-
-	f, stdout, stderr, _ := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID:     "test-app",
-		AppSecret: "test-secret",
-		Brand:     core.BrandFeishu,
-	})
-	err := authScopesRun(&ScopesOptions{
-		Factory: f,
-		Ctx:     context.Background(),
-		Format:  "pretty",
-	})
-	if err != nil {
-		t.Fatalf("authScopesRun() error = %v", err)
-	}
-	for _, want := range []string{"App ID: test-app", "Enabled scopes (1)", "im:message"} {
-		if !strings.Contains(stdout.String(), want) {
-			t.Fatalf("stdout missing %q: %s", want, stdout.String())
-		}
-		if strings.Contains(stderr.String(), want) {
-			t.Fatalf("stderr contains business data %q: %s", want, stderr.String())
-		}
-	}
-}
-
 // TestAuthScopesRun_NetworkErrorPassedThrough pins that a typed NetworkError
 // surfaced by the dependency is not re-classified as PermissionError —
 // re-auth does not fix DNS / transport failures and blanket-wrapping them

cmd/config/config.go

@@ -31,6 +31,7 @@ func NewCmdConfig(f *cmdutil.Factory) *cobra.Command {
 	cmd.AddCommand(NewCmdConfigShow(f, nil))
 	cmd.AddCommand(NewCmdConfigDefaultAs(f))
 	cmd.AddCommand(NewCmdConfigStrictMode(f))
+	cmd.AddCommand(NewCmdConfigRiskControl(f))
 	cmd.AddCommand(NewCmdConfigPolicy(f))
 	cmd.AddCommand(NewCmdConfigPlugins(f))
 	cmd.AddCommand(NewCmdConfigKeychainDowngrade(f))

cmd/config/init_interactive.go

@@ -179,8 +179,8 @@ func runCreateAppFlow(ctx context.Context, f *cmdutil.Factory, brandOverride cor
 	}
 
 	// Step 1: Request app registration (begin)
-	// Use the shared proxy-plugin-aware transport so registration traffic is not
-	// a bypass of proxy plugin mode.
+	// Registration is platform traffic, so it must use the provider-aware
+	// transport as well as the shared proxy configuration.
 	httpClient := transport.NewHTTPClient(0)
 	authResp, err := larkauth.RequestAppRegistration(ctx, httpClient, larkBrand, f.IOStreams.ErrOut)
 	if err != nil {

cmd/config/risk_control.go

@@ -0,0 +1,80 @@
+// Copyright (c) 2026 Lark Technologies Pte. Ltd.
+// SPDX-License-Identifier: MIT
+
+package config
+
+import (
+	"fmt"
+
+	"github.com/spf13/cobra"
+
+	"github.com/larksuite/cli/errs"
+	"github.com/larksuite/cli/internal/cmdutil"
+	"github.com/larksuite/cli/internal/core"
+)
+
+// NewCmdConfigRiskControl creates the workspace risk-control policy command.
+func NewCmdConfigRiskControl(f *cmdutil.Factory) *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "risk-control [on|off|default]",
+		Short: "Manage workspace account-protection policy",
+		Long: `View or set the account-protection risk-control policy for this workspace.
+
+Account protection is on by default. Use off to opt this workspace out, on to
+opt it back in explicitly, or default to remove the explicit preference.`,
+		Args: cobra.MaximumNArgs(1),
+		// This is persistent workspace policy, not credential management.
+		PersistentPreRunE: func(cmd *cobra.Command, _ []string) error {
+			cmd.SilenceUsage = true
+			return nil
+		},
+		RunE: func(cmd *cobra.Command, args []string) error {
+			config, err := core.LoadOrNotConfigured()
+			if err != nil {
+				return err
+			}
+			if len(args) == 0 {
+				printRiskControl(f, config)
+				return nil
+			}
+
+			switch args[0] {
+			case "on":
+				enabled := true
+				config.RiskControl = &enabled
+			case "off":
+				enabled := false
+				config.RiskControl = &enabled
+			case "default":
+				config.RiskControl = nil
+			default:
+				return errs.NewValidationError(errs.SubtypeInvalidArgument,
+					"invalid risk-control value %q, valid values: on | off | default", args[0])
+			}
+
+			if err := core.SaveMultiAppConfig(config); err != nil {
+				return errs.NewInternalError(errs.SubtypeStorage,
+					"failed to save risk-control policy: %v", err).WithCause(err)
+			}
+			fmt.Fprintf(f.IOStreams.ErrOut, "Risk control set to %s (workspace)\n", args[0])
+			return nil
+		},
+	}
+	cmdutil.SetRisk(cmd, cmdutil.RiskWrite)
+	return cmd
+}
+
+func printRiskControl(f *cmdutil.Factory, config *core.MultiAppConfig) {
+	source := "default"
+	if config.RiskControl != nil {
+		source = "workspace"
+	}
+	fmt.Fprintf(f.IOStreams.Out, "risk-control: %s (source: %s)\n", riskControlState(config.RiskControlEnabled()), source)
+}
+
+func riskControlState(enabled bool) string {
+	if enabled {
+		return "on"
+	}
+	return "off"
+}

cmd/config/risk_control_test.go

@@ -0,0 +1,130 @@
+// Copyright (c) 2026 Lark Technologies Pte. Ltd.
+// SPDX-License-Identifier: MIT
+
+package config
+
+import (
+	"errors"
+	"strings"
+	"testing"
+
+	"github.com/larksuite/cli/errs"
+	"github.com/larksuite/cli/internal/cmdutil"
+	"github.com/larksuite/cli/internal/core"
+)
+
+func TestRiskControlWorkspacePolicy(t *testing.T) {
+	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
+	config := &core.MultiAppConfig{Apps: []core.AppConfig{{
+		AppId: "cli_test", AppSecret: core.PlainSecret("secret"), Brand: core.BrandFeishu,
+	}}}
+	if err := core.SaveMultiAppConfig(config); err != nil {
+		t.Fatal(err)
+	}
+
+	f, stdout, stderr, _ := cmdutil.TestFactory(t, nil)
+	cmd := NewCmdConfigRiskControl(f)
+	cmd.SetArgs([]string{"off"})
+	if err := cmd.Execute(); err != nil {
+		t.Fatalf("set off: %v", err)
+	}
+	loaded, err := core.LoadMultiAppConfig()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if loaded.RiskControl == nil || *loaded.RiskControl {
+		t.Fatalf("RiskControl = %v, want explicit false", loaded.RiskControl)
+	}
+	if !strings.Contains(stderr.String(), "set to off") {
+		t.Fatalf("stderr = %q", stderr.String())
+	}
+
+	stdout.Reset()
+	cmd = NewCmdConfigRiskControl(f)
+	if err := cmd.Execute(); err != nil {
+		t.Fatalf("show: %v", err)
+	}
+	if got := stdout.String(); got != "risk-control: off (source: workspace)\n" {
+		t.Fatalf("stdout = %q", got)
+	}
+
+	cmd = NewCmdConfigRiskControl(f)
+	cmd.SetArgs([]string{"on"})
+	if err := cmd.Execute(); err != nil {
+		t.Fatalf("set on: %v", err)
+	}
+	loaded, err = core.LoadMultiAppConfig()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if loaded.RiskControl == nil || !*loaded.RiskControl {
+		t.Fatalf("RiskControl = %v, want explicit true", loaded.RiskControl)
+	}
+
+	cmd = NewCmdConfigRiskControl(f)
+	cmd.SetArgs([]string{"default"})
+	if err := cmd.Execute(); err != nil {
+		t.Fatalf("reset default: %v", err)
+	}
+	loaded, err = core.LoadMultiAppConfig()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if loaded.RiskControl != nil {
+		t.Fatalf("RiskControl = %v, want nil", loaded.RiskControl)
+	}
+
+	stdout.Reset()
+	cmd = NewCmdConfigRiskControl(f)
+	if err := cmd.Execute(); err != nil {
+		t.Fatalf("show default: %v", err)
+	}
+	if got := stdout.String(); got != "risk-control: on (source: default)\n" {
+		t.Fatalf("stdout = %q", got)
+	}
+}
+
+func TestRiskControlWorkspacePolicyRejectsInvalidValue(t *testing.T) {
+	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
+	if err := core.SaveMultiAppConfig(&core.MultiAppConfig{Apps: []core.AppConfig{{
+		AppId: "cli_test", AppSecret: core.PlainSecret("secret"), Brand: core.BrandFeishu,
+	}}}); err != nil {
+		t.Fatal(err)
+	}
+
+	f, _, _, _ := cmdutil.TestFactory(t, nil)
+	cmd := NewCmdConfigRiskControl(f)
+	cmd.SetArgs([]string{"invalid"})
+	err := cmd.Execute()
+	var validationErr *errs.ValidationError
+	if !errors.As(err, &validationErr) {
+		t.Fatalf("error = %T %v, want *errs.ValidationError", err, err)
+	}
+	if validationErr.Subtype != errs.SubtypeInvalidArgument {
+		t.Fatalf("subtype = %q, want %q", validationErr.Subtype, errs.SubtypeInvalidArgument)
+	}
+}
+
+func TestRiskControlWorkspacePolicyAllowedWithExternalCredentials(t *testing.T) {
+	f := newConfigFactoryWithExternalProvider(t)
+	config := &core.MultiAppConfig{Apps: []core.AppConfig{{
+		AppId: "cli_test", AppSecret: core.PlainSecret("secret"), Brand: core.BrandFeishu,
+	}}}
+	if err := core.SaveMultiAppConfig(config); err != nil {
+		t.Fatal(err)
+	}
+
+	cmd := NewCmdConfig(f)
+	cmd.SetArgs([]string{"risk-control", "off"})
+	if err := cmd.Execute(); err != nil {
+		t.Fatalf("set off with external credentials: %v", err)
+	}
+
+	loaded, err := core.LoadMultiAppConfig()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if loaded.RiskControl == nil || *loaded.RiskControl {
+		t.Fatalf("RiskControl = %v, want explicit false", loaded.RiskControl)
+	}
+}

cmd/doctor/doctor.go

@@ -157,8 +157,8 @@ func networkChecks(ctx context.Context, opts *DoctorOptions, ep core.Endpoints)
 		}
 	}
 
-	// Use the shared proxy-plugin-aware transport so connectivity checks reflect
-	// the real egress path (and are blocked when proxy plugin fails closed).
+	// Connectivity checks are platform traffic and must exercise the same
+	// provider-aware route as real platform requests.
 	httpClient := transport.NewHTTPClient(0)
 	mcpURL := ep.MCP + "/mcp"
 

cmd/root_upgrade.go

@@ -65,7 +65,17 @@ func offerRootUpgrade(f *cmdutil.Factory, cmd *cobra.Command) {
 	if info == nil {
 		return
 	}
-	fmt.Fprintf(ios.ErrOut, "lark-cli %s available (current %s). Upgrade now? [y/N]: ", info.Latest, info.Current)
+	// Deliberately no target version here: info.Latest comes from the on-disk
+	// cache, which has no expiry (the 24h TTL only throttles refreshes, and a
+	// failed refresh leaves the old value in place), so it can name a version
+	// that is no longer the one npm would install. The version actually
+	// installed is resolved live by the update subcommand, which prints
+	// "Updating lark-cli <cur> -> <latest> via <pm> ..." before installing —
+	// that is where the user sees the real target. Keep going through the
+	// update subcommand rather than calling RunNpmInstall directly, otherwise
+	// that line disappears and the user approves a global install without ever
+	// being told what gets installed.
+	fmt.Fprintf(ios.ErrOut, "A newer lark-cli is available (current %s). Upgrade now? [y/N]: ", info.Current)
 	if !readYes(ios.In) {
 		return
 	}

cmd/root_upgrade_test.go

@@ -128,6 +128,17 @@ func TestOfferRootUpgrade(t *testing.T) {
 			if gotPrompt != tc.wantPrompt {
 				t.Errorf("prompt: got %v want %v (stderr=%q)", gotPrompt, tc.wantPrompt, errBuf.String())
 			}
+			// The prompt must not name a target version: info.Latest comes from
+			// the on-disk cache and can be stale, while the version actually
+			// installed is resolved live by the update subcommand.
+			if tc.wantPrompt {
+				if strings.Contains(errBuf.String(), tc.latest) {
+					t.Errorf("prompt must not name the cached target version %q (stderr=%q)", tc.latest, errBuf.String())
+				}
+				if !strings.Contains(errBuf.String(), build.Version) {
+					t.Errorf("prompt must name the current version %q (stderr=%q)", build.Version, errBuf.String())
+				}
+			}
 			if called != tc.wantRun {
 				t.Errorf("runRootUpgrade called: got %v want %v", called, tc.wantRun)
 			}

cmd/service/service.go

@@ -6,6 +6,7 @@ package service
 import (
 	"context"
 	"fmt"
+	"io"
 	"sort"
 	"strings"
 
@@ -379,15 +380,6 @@ func serviceMethodRun(opts *ServiceMethodOptions) error {
 	if opts.PageAll && opts.Output != "" {
 		return errs.NewValidationError(errs.SubtypeInvalidArgument, "--output and --page-all are mutually exclusive").WithParam("--output")
 	}
-	// Parse before the dry-run branch so both dry-run and emit reject unknown
-	// values. Raw service responses accept four formats; pretty remains available
-	// only for the dry-run request preview handled below.
-	format, ok := output.ParseFormat(opts.Format)
-	if !ok {
-		return errs.NewValidationError(errs.SubtypeInvalidArgument,
-			"unknown output format %q (want json, ndjson, table, or csv)", opts.Format).
-			WithParam("--format")
-	}
 	if err := output.ValidateJqFlags(opts.JqExpr, opts.Output, opts.Format); err != nil {
 		return err
 	}
@@ -411,18 +403,9 @@ func serviceMethodRun(opts *ServiceMethodOptions) error {
 
 	if opts.DryRun {
 		if fileMeta != nil {
-			return cmdutil.PrintDryRunWithFile(request, config, serviceDryRunOutputOptions(f, opts, format), *fileMeta)
+			return cmdutil.PrintDryRunWithFile(request, config, serviceDryRunOutputOptions(f, opts), *fileMeta)
 		}
-		return serviceDryRun(f, request, config, opts, format)
-	}
-	// pretty is a shortcut-only presentation format; the raw service command has
-	// no pretty renderer for responses, so reject it before the confirmation and
-	// client init rather than fall back. (Dry-run keeps its own plain-text pretty
-	// preview, handled above.)
-	if format == output.FormatPretty {
-		return errs.NewValidationError(errs.SubtypeInvalidArgument,
-			"--format pretty is not supported here (use json, ndjson, table, or csv)").
-			WithParam("--format")
+		return serviceDryRun(f, request, config, opts)
 	}
 
 	if opts.Method.Risk == cmdutil.RiskHighRiskWrite {
@@ -437,6 +420,10 @@ func serviceMethodRun(opts *ServiceMethodOptions) error {
 	}
 
 	out := f.IOStreams.Out
+	format, formatOK := output.ParseFormat(opts.Format)
+	if !formatOK {
+		fmt.Fprintf(f.IOStreams.ErrOut, "warning: unknown format %q, falling back to json\n", opts.Format)
+	}
 
 	// Scope-insufficient (99991679) and all other Lark API codes route through
 	// errclass.BuildAPIError via ac.CheckResponse, producing *errs.PermissionError
@@ -444,18 +431,8 @@ func serviceMethodRun(opts *ServiceMethodOptions) error {
 	checkErr := ac.CheckResponse
 
 	if opts.PageAll {
-		return client.PaginateToOutput(opts.Ctx, client.PaginateOutputOptions{
-			Client:      ac,
-			Request:     request,
-			Format:      format,
-			JqExpr:      opts.JqExpr,
-			Out:         out,
-			ErrOut:      f.IOStreams.ErrOut,
-			CommandPath: opts.Cmd.CommandPath(),
-			Pagination:  client.PaginationOptions{PageLimit: opts.PageLimit, PageDelay: opts.PageDelay},
-			CheckErr:    checkErr,
-			MarkErr:     nil,
-		})
+		return servicePaginate(opts.Ctx, ac, request, format, opts.JqExpr, out, f.IOStreams.ErrOut, opts.Cmd.CommandPath(),
+			client.PaginationOptions{PageLimit: opts.PageLimit, PageDelay: opts.PageDelay}, checkErr)
 	}
 
 	resp, err := ac.DoAPI(opts.Ctx, request)
@@ -690,13 +667,13 @@ func buildServiceRequest(opts *ServiceMethodOptions) (client.RawApiRequest, *cmd
 	return request, nil, nil
 }
 
-func serviceDryRun(f *cmdutil.Factory, request client.RawApiRequest, config *core.CliConfig, opts *ServiceMethodOptions, format output.Format) error {
-	return cmdutil.PrintDryRun(request, config, serviceDryRunOutputOptions(f, opts, format))
+func serviceDryRun(f *cmdutil.Factory, request client.RawApiRequest, config *core.CliConfig, opts *ServiceMethodOptions) error {
+	return cmdutil.PrintDryRun(request, config, serviceDryRunOutputOptions(f, opts))
 }
 
-func serviceDryRunOutputOptions(f *cmdutil.Factory, opts *ServiceMethodOptions, format output.Format) cmdutil.DryRunOutputOptions {
+func serviceDryRunOutputOptions(f *cmdutil.Factory, opts *ServiceMethodOptions) cmdutil.DryRunOutputOptions {
 	return cmdutil.DryRunOutputOptions{
-		Format:      format.String(),
+		Format:      opts.Format,
 		JqExpr:      opts.JqExpr,
 		CommandPath: opts.Cmd.CommandPath(),
 		Identity:    opts.As,
@@ -704,3 +681,75 @@ func serviceDryRunOutputOptions(f *cmdutil.Factory, opts *ServiceMethodOptions,
 		ErrOut:      f.IOStreams.ErrOut,
 	}
 }
+
+func servicePaginate(ctx context.Context, ac *client.APIClient, request client.RawApiRequest, format output.Format, jqExpr string, out, errOut io.Writer, commandPath string, pagOpts client.PaginationOptions, checkErr func(interface{}, core.Identity) error) error {
+	if pagOpts.Identity == "" {
+		pagOpts.Identity = request.As
+	}
+	// When jq is set, always aggregate all pages then filter.
+	if jqExpr != "" {
+		result, err := ac.PaginateAll(ctx, request, pagOpts)
+		if err != nil {
+			return err
+		}
+		if apiErr := checkErr(result, pagOpts.Identity); apiErr != nil {
+			output.FormatValue(out, result, output.FormatJSON)
+			return apiErr
+		}
+		return output.WriteSuccessEnvelope(output.SuccessEnvelopeData(result), output.SuccessEnvelopeOptions{
+			CommandPath: commandPath,
+			Identity:    string(pagOpts.Identity),
+			JqExpr:      jqExpr,
+			Out:         out,
+			ErrOut:      errOut,
+		})
+	}
+
+	switch format {
+	case output.FormatNDJSON, output.FormatTable, output.FormatCSV:
+		emitter := output.NewEmitter(output.EmitterConfig{
+			Out:            out,
+			ErrOut:         errOut,
+			CommandPath:    commandPath,
+			Identity:       string(pagOpts.Identity),
+			NoticeProvider: output.GetNotice,
+		})
+		result, hasItems, err := ac.StreamPages(ctx, request, func(items []interface{}) error {
+			// Streaming formats intentionally emit each page after that page has
+			// passed safety scanning. A later page may still fail, so callers
+			// must use the exit code to distinguish complete vs partial output.
+			return emitter.StreamPage(items, output.StreamOptions{Format: format.String()})
+		}, pagOpts)
+		if err != nil {
+			return err
+		}
+		if apiErr := checkErr(result, pagOpts.Identity); apiErr != nil {
+			return apiErr
+		}
+		if !hasItems {
+			fmt.Fprintf(errOut, "warning: this API does not return a list, format %q is not supported, falling back to json\n", format)
+			return output.WriteSuccessEnvelope(output.SuccessEnvelopeData(result), output.SuccessEnvelopeOptions{
+				CommandPath: commandPath,
+				Identity:    string(pagOpts.Identity),
+				Out:         out,
+				ErrOut:      errOut,
+			})
+		}
+		return nil
+	default:
+		result, err := ac.PaginateAll(ctx, request, pagOpts)
+		if err != nil {
+			return err
+		}
+		if apiErr := checkErr(result, pagOpts.Identity); apiErr != nil {
+			output.FormatValue(out, result, output.FormatJSON)
+			return apiErr
+		}
+		return output.WriteSuccessEnvelope(output.SuccessEnvelopeData(result), output.SuccessEnvelopeOptions{
+			CommandPath: commandPath,
+			Identity:    string(pagOpts.Identity),
+			Out:         out,
+			ErrOut:      errOut,
+		})
+	}
+}

cmd/service/service_paginate_test.go

@@ -66,23 +66,6 @@ func servicePaginateRequest() client.RawApiRequest {
 	}
 }
 
-// servicePaginate adapts the positional test calls to PaginateToOutput's options
-// struct so each test case stays a single readable statement.
-func servicePaginate(ctx context.Context, ac *client.APIClient, request client.RawApiRequest, format output.Format, jqExpr string, out, errOut io.Writer, commandPath string, pag client.PaginationOptions, checkErr func(interface{}, core.Identity) error, markErr func(error) error) error {
-	return client.PaginateToOutput(ctx, client.PaginateOutputOptions{
-		Client:      ac,
-		Request:     request,
-		Format:      format,
-		JqExpr:      jqExpr,
-		Out:         out,
-		ErrOut:      errOut,
-		CommandPath: commandPath,
-		Pagination:  pag,
-		CheckErr:    checkErr,
-		MarkErr:     markErr,
-	})
-}
-
 func assertServicePaginateJSONBytes(t *testing.T, got []byte, want interface{}) {
 	t.Helper()
 	wantBytes, err := json.MarshalIndent(want, "", "  ")
@@ -129,10 +112,10 @@ func TestServicePaginate_DefaultAggregatesAllPages(t *testing.T) {
 		output.FormatJSON, "", out, errOut, "lark-cli test items list", client.PaginationOptions{
 			PageLimit: 10,
 			PageDelay: -1,
-		}, ac.CheckResponse, nil)
+		}, ac.CheckResponse)
 
 	if err != nil {
-		t.Fatalf("PaginateToOutput() error = %v, want nil", err)
+		t.Fatalf("servicePaginate() error = %v, want nil", err)
 	}
 	if calls != 3 {
 		t.Fatalf("pagination requests = %d, want 3", calls)
@@ -212,10 +195,10 @@ func TestServicePaginate_StreamingFormatsEmitExactMultiPageBytes(t *testing.T) {
 				tt.format, "", out, errOut, "lark-cli test items list", client.PaginationOptions{
 					PageLimit: 10,
 					PageDelay: -1,
-				}, ac.CheckResponse, nil)
+				}, ac.CheckResponse)
 
 			if err != nil {
-				t.Fatalf("PaginateToOutput() error = %v, want nil", err)
+				t.Fatalf("servicePaginate() error = %v, want nil", err)
 			}
 			if got := out.String(); got != tt.want {
 				t.Fatalf("stdout byte mismatch\ngot (%d bytes):\n%q\nwant (%d bytes):\n%q", len(got), got, len(tt.want), tt.want)
@@ -256,14 +239,14 @@ func TestServicePaginate_StreamingWriteFailureStopsFurtherPages(t *testing.T) {
 
 	err := servicePaginate(context.Background(), ac, servicePaginateRequest(),
 		output.FormatNDJSON, "", out, errOut, "lark-cli test items list",
-		client.PaginationOptions{PageLimit: 10, PageDelay: -1}, ac.CheckResponse, nil)
+		client.PaginationOptions{PageLimit: 10, PageDelay: -1}, ac.CheckResponse)
 
 	if !errors.Is(err, sentinel) {
-		t.Fatalf("PaginateToOutput() error = %v, want preserved writer cause", err)
+		t.Fatalf("servicePaginate() error = %v, want preserved writer cause", err)
 	}
 	problem, ok := errs.ProblemOf(err)
 	if !ok || problem.Category != errs.CategoryInternal {
-		t.Fatalf("PaginateToOutput() problem = %#v, %v; want internal typed error", problem, ok)
+		t.Fatalf("servicePaginate() problem = %#v, %v; want internal typed error", problem, ok)
 	}
 	if calls != 2 {
 		t.Fatalf("pagination requests = %d, want 2", calls)
@@ -273,7 +256,7 @@ func TestServicePaginate_StreamingWriteFailureStopsFurtherPages(t *testing.T) {
 	}
 }
 
-func TestServicePaginate_StreamingFormatHonorsNDJSONWithoutList(t *testing.T) {
+func TestServicePaginate_StreamingFormatFallsBackToJSONWithoutList(t *testing.T) {
 	ac, out, errOut, reg := newServicePaginateTestHarness(t)
 	reg.Register(&httpmock.Stub{
 		URL: "/open-apis/test/v1/items",
@@ -289,17 +272,22 @@ func TestServicePaginate_StreamingFormatHonorsNDJSONWithoutList(t *testing.T) {
 
 	err := servicePaginate(context.Background(), ac, servicePaginateRequest(),
 		output.FormatNDJSON, "", out, errOut, "lark-cli test items get",
-		client.PaginationOptions{PageDelay: -1}, ac.CheckResponse, nil)
+		client.PaginationOptions{PageDelay: -1}, ac.CheckResponse)
 
 	if err != nil {
-		t.Fatalf("PaginateToOutput() error = %v, want nil", err)
+		t.Fatalf("servicePaginate() error = %v, want nil", err)
 	}
-	const want = "{\"name\":\"Test User\",\"user_id\":\"u123\"}\n"
-	if got := out.String(); got != want {
-		t.Fatalf("stdout bytes = %q, want %q", got, want)
-	}
-	if errOut.Len() != 0 {
-		t.Fatalf("stderr bytes = %q, want empty", errOut.String())
+	assertServicePaginateJSONBytes(t, out.Bytes(), output.Envelope{
+		OK:       true,
+		Identity: "bot",
+		Data: map[string]interface{}{
+			"name":    "Test User",
+			"user_id": "u123",
+		},
+	})
+	wantWarning := "warning: this API does not return a list, format \"ndjson\" is not supported, falling back to json\n"
+	if got := errOut.String(); got != wantWarning {
+		t.Fatalf("stderr bytes = %q, want %q", got, wantWarning)
 	}
 }
 
@@ -328,10 +316,10 @@ func TestServicePaginate_BusinessErrorsWriteRawAndRemainUnmarked(t *testing.T) {
 
 			err := servicePaginate(context.Background(), ac, servicePaginateRequest(),
 				tt.format, tt.jqExpr, out, errOut, "lark-cli test items list",
-				client.PaginationOptions{PageDelay: -1}, ac.CheckResponse, nil)
+				client.PaginationOptions{PageDelay: -1}, ac.CheckResponse)
 
 			if err == nil {
-				t.Fatal("PaginateToOutput() error = nil, want business error")
+				t.Fatal("servicePaginate() error = nil, want business error")
 			}
 			if errs.IsRaw(err) {
 				t.Fatalf("errs.IsRaw(error) = true, want current servicePaginate pass-through behavior")
@@ -364,10 +352,10 @@ func TestServicePaginate_TransportErrorsRemainUnmarked(t *testing.T) {
 
 			err := servicePaginate(context.Background(), ac, servicePaginateRequest(),
 				tt.format, tt.jqExpr, out, errOut, "lark-cli test items list",
-				client.PaginationOptions{PageDelay: -1}, ac.CheckResponse, nil)
+				client.PaginationOptions{PageDelay: -1}, ac.CheckResponse)
 
 			if err == nil {
-				t.Fatal("PaginateToOutput() error = nil, want transport error")
+				t.Fatal("servicePaginate() error = nil, want transport error")
 			}
 			if errs.IsRaw(err) {
 				t.Fatalf("errs.IsRaw(error) = true, want current servicePaginate pass-through behavior")
@@ -395,10 +383,10 @@ func TestServicePaginate_StreamBusinessErrorRemainsUnmarked(t *testing.T) {
 
 	err := servicePaginate(context.Background(), ac, servicePaginateRequest(),
 		output.FormatNDJSON, "", out, errOut, "lark-cli test items list",
-		client.PaginationOptions{PageDelay: -1}, ac.CheckResponse, nil)
+		client.PaginationOptions{PageDelay: -1}, ac.CheckResponse)
 
 	if err == nil {
-		t.Fatal("PaginateToOutput() error = nil, want business error")
+		t.Fatal("servicePaginate() error = nil, want business error")
 	}
 	if errs.IsRaw(err) {
 		t.Fatalf("errs.IsRaw(error) = true, want current servicePaginate pass-through behavior")

cmd/service/service_test.go

@@ -257,21 +257,6 @@ func TestServiceMethod_DryRunWithJq(t *testing.T) {
 	}
 }
 
-func TestServiceMethod_DryRunMixedCasePrettyUsesPlainTextPreview(t *testing.T) {
-	f, stdout, _, _ := cmdutil.TestFactory(t, testConfig)
-	spec := meta.ServiceFromMap(map[string]interface{}{"name": "svc", "servicePath": "/open-apis/svc/v1"})
-	method := meta.FromMap(map[string]interface{}{"path": "items", "httpMethod": "GET", "parameters": map[string]interface{}{}})
-	cmd := NewCmdServiceMethod(f, spec, method, "list", "items", nil)
-	cmd.SetArgs([]string{"--as", "bot", "--dry-run", "--format", "Pretty"})
-
-	if err := cmd.Execute(); err != nil {
-		t.Fatalf("dry-run --format Pretty must be accepted, got: %v", err)
-	}
-	if !strings.Contains(stdout.String(), "# dry-run: request not sent") {
-		t.Fatalf("dry-run --format Pretty lost its plain-text preview, stdout:\n%s", stdout.String())
-	}
-}
-
 func TestServiceMethod_PathParamRejectsTraversal(t *testing.T) {
 	tests := []struct {
 		name      string
@@ -540,10 +525,6 @@ func (p *serviceContentSafetyProvider) Scan(_ context.Context, req extcs.ScanReq
 	return &extcs.Alert{Provider: "service-test", MatchedRules: []string{"pagination"}}, nil
 }
 
-func (p *serviceContentSafetyProvider) ScanFullText(ctx context.Context, req extcs.ScanRequest) (*extcs.Alert, error) {
-	return p.Scan(ctx, req)
-}
-
 func TestServiceMethod_PageAll_DefaultJSONRunsContentSafety(t *testing.T) {
 	t.Setenv("LARKSUITE_CLI_CONTENT_SAFETY_MODE", "warn")
 	provider := &serviceContentSafetyProvider{}
@@ -580,12 +561,12 @@ func TestServiceMethod_PageAll_DefaultJSONRunsContentSafety(t *testing.T) {
 	if provider.path != "list" {
 		t.Fatalf("scan path = %q, want list", provider.path)
 	}
-	data, ok := provider.data.(string)
+	data, ok := provider.data.(map[string]interface{})
 	if !ok {
-		t.Fatalf("scanned data type = %T, want rendered JSON string", provider.data)
+		t.Fatalf("scanned data type = %T, want map", provider.data)
 	}
-	if strings.Contains(data, `"code"`) || !strings.Contains(data, `"data"`) {
-		t.Fatalf("scanned JSON should be the success envelope without an API code, got %q", data)
+	if _, hasCode := data["code"]; hasCode {
+		t.Fatalf("scanned data should be business data only, got %#v", data)
 	}
 
 	var got map[string]interface{}
@@ -634,11 +615,9 @@ func TestServiceMethod_PageAll_StreamFormatRunsContentSafety(t *testing.T) {
 	if provider.path != "list" {
 		t.Fatalf("scan path = %q, want list", provider.path)
 	}
-	// Streaming now scans the exact rendered page bytes (not the structured
-	// item) so a rule match formed only in the rendered output cannot slip past.
-	scanned, ok := provider.data.(string)
-	if !ok || !strings.Contains(scanned, `"id":"1"`) {
-		t.Fatalf("scanned data = %#v, want rendered ndjson page text", provider.data)
+	items, ok := provider.data.([]interface{})
+	if !ok || len(items) != 1 {
+		t.Fatalf("scanned data = %#v, want one streamed item", provider.data)
 	}
 	if !strings.Contains(stderr.String(), "warning: content safety alert from service-test") {
 		t.Fatalf("expected content safety warning on stderr, got: %s", stderr.String())
@@ -701,8 +680,11 @@ func TestServiceMethod_PageAll_StreamFormatBlockSkipsBlockedPage(t *testing.T) {
 		t.Fatalf("rules = %v, want [pagination]", safetyErr.Rules)
 	}
 	out := stdout.String()
-	if out != "" {
-		t.Fatalf("blocked complete stream was written before safety block: %s", out)
+	if !strings.Contains(out, "safe-page") {
+		t.Fatalf("expected earlier safe page to remain streamed, got: %s", out)
+	}
+	if strings.Contains(out, "blocked-page") {
+		t.Fatalf("blocked page was written before safety block: %s", out)
 	}
 }
 
@@ -813,81 +795,26 @@ func TestServiceMethod_PageAll_StreamBusinessErrorDoesNotDumpJSON(t *testing.T)
 	}
 }
 
-func TestServiceMethod_UnknownFormat_Rejected(t *testing.T) {
-	// No stub is registered: the unknown --format must be rejected before any
-	// API call is made.
-	f, stdout, stderr, _ := cmdutil.TestFactory(t, &core.CliConfig{
+func TestServiceMethod_UnknownFormat_Warning(t *testing.T) {
+	f, _, stderr, reg := cmdutil.TestFactory(t, &core.CliConfig{
 		AppID: "test-app-fmt", AppSecret: "test-secret-fmt", Brand: core.BrandFeishu,
 	})
 
+	reg.Register(&httpmock.Stub{
+		URL:  "/open-apis/svc/v1/items",
+		Body: map[string]interface{}{"code": 0, "msg": "ok", "data": map[string]interface{}{}},
+	})
+
 	spec := meta.ServiceFromMap(map[string]interface{}{"name": "svc", "servicePath": "/open-apis/svc/v1"})
 	method := meta.FromMap(map[string]interface{}{"path": "items", "httpMethod": "GET", "parameters": map[string]interface{}{}})
 	cmd := NewCmdServiceMethod(f, spec, method, "list", "items", nil)
 	cmd.SetArgs([]string{"--as", "bot", "--format", "unknown"})
 
-	// An unknown --format is a typed validation error, not a silent JSON fallback.
-	err := cmd.Execute()
-	if err == nil {
-		t.Fatal("expected a validation error for unknown --format")
+	if err := cmd.Execute(); err != nil {
+		t.Fatalf("unexpected error: %v", err)
 	}
-	requireValidationParam(t, err, "--format")
-	if !strings.Contains(err.Error(), "unknown output format") {
-		t.Errorf("error = %v, want unknown-format message", err)
-	}
-	if strings.Contains(strings.ToLower(err.Error()), "pretty") {
-		t.Errorf("error = %v, raw service format choices must exclude pretty", err)
-	}
-	if stdout.String() != "" {
-		t.Errorf("unknown --format must not write stdout, got:\n%s", stdout.String())
-	}
-	// The old degrade-to-JSON warning must be gone, not merely accompanied by an error.
-	if strings.Contains(stderr.String(), "falling back to json") {
-		t.Errorf("unknown --format must not emit the legacy fallback warning, got stderr:\n%s", stderr.String())
-	}
-}
-
-func TestServiceMethod_UnknownFormatPrecedesJqConflict(t *testing.T) {
-	f, stdout, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "test-app-fmt", AppSecret: "test-secret-fmt", Brand: core.BrandFeishu,
-	})
-	spec := meta.ServiceFromMap(map[string]interface{}{"name": "svc", "servicePath": "/open-apis/svc/v1"})
-	method := meta.FromMap(map[string]interface{}{
-		"path": "items", "httpMethod": "GET", "parameters": map[string]interface{}{},
-	})
-	cmd := NewCmdServiceMethod(f, spec, method, "list", "items", nil)
-	cmd.SetArgs([]string{"--as", "bot", "--format", "tabel", "--jq", "."})
-
-	err := cmd.Execute()
-	requireValidationParam(t, err, "--format")
-	if !strings.Contains(err.Error(), "unknown output format") {
-		t.Fatalf("error = %v, want unknown-format message", err)
-	}
-	if strings.Contains(err.Error(), "mutually exclusive") {
-		t.Fatalf("error = %v, unknown format should be reported before jq conflict", err)
-	}
-	if stdout.Len() != 0 {
-		t.Fatalf("unknown --format wrote stdout:\n%s", stdout.String())
-	}
-}
-
-func TestServiceMethod_PrettyRejectedOnEmit(t *testing.T) {
-	f, stdout, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "test-app-fmt", AppSecret: "test-secret-fmt", Brand: core.BrandFeishu,
-	})
-	spec := meta.ServiceFromMap(map[string]interface{}{"name": "svc", "servicePath": "/open-apis/svc/v1"})
-	method := meta.FromMap(map[string]interface{}{
-		"path": "items", "httpMethod": "GET", "parameters": map[string]interface{}{},
-	})
-	cmd := NewCmdServiceMethod(f, spec, method, "list", "items", nil)
-	cmd.SetArgs([]string{"--as", "bot", "--format", "pretty"})
-
-	err := cmd.Execute()
-	requireValidationParam(t, err, "--format")
-	if !strings.Contains(err.Error(), "pretty") {
-		t.Fatalf("error = %v, want pretty-not-supported message", err)
-	}
-	if stdout.Len() != 0 {
-		t.Fatalf("rejected --format pretty wrote stdout:\n%s", stdout.String())
+	if !strings.Contains(stderr.String(), "warning: unknown format") {
+		t.Errorf("expected format warning in stderr, got:\n%s", stderr.String())
 	}
 }
 
@@ -1101,18 +1028,6 @@ func requireProblem(t *testing.T, err error, category errs.Category, subtype err
 	}
 }
 
-func requireValidationParam(t *testing.T, err error, param string) {
-	t.Helper()
-	requireProblem(t, err, errs.CategoryValidation, errs.SubtypeInvalidArgument, 0)
-	var validationErr *errs.ValidationError
-	if !errors.As(err, &validationErr) {
-		t.Fatalf("expected *errs.ValidationError, got %T: %v", err, err)
-	}
-	if validationErr.Param != param {
-		t.Fatalf("Param = %q, want %q", validationErr.Param, param)
-	}
-}
-
 // ── file upload ──
 
 func imImageMethod() meta.Method {

extension/contentsafety/types.go

@@ -9,30 +9,17 @@ import (
 )
 
 // Provider scans parsed response data for content-safety issues.
-// Implementations must be safe for concurrent use. Scan may be a best-effort
-// scan with bounded string length or nesting depth.
+// Implementations must be safe for concurrent use.
 type Provider interface {
 	Name() string
 	Scan(ctx context.Context, req ScanRequest) (*Alert, error)
 }
 
-// FullTextProvider is a Provider that guarantees a complete scan of Data with
-// NO per-string or depth truncation. Block mode requires this capability so a
-// match anywhere in the output cannot slip past a truncation boundary.
-type FullTextProvider interface {
-	Provider
-	ScanFullText(ctx context.Context, req ScanRequest) (*Alert, error)
-}
-
 // ScanRequest carries the data to scan.
 type ScanRequest struct {
 	Path   string    // normalized command path (e.g. "im.messages_search")
 	Data   any       // parsed response data (generic JSON shape)
 	ErrOut io.Writer // stderr for provider-level notices (e.g. lazy-config creation)
-	// FullText marks Data as one complete rendered-output string. It remains a
-	// compatibility hint for Provider.Scan; block mode calls
-	// FullTextProvider.ScanFullText to enforce complete scanning.
-	FullText bool
 }
 
 // Alert holds the result of a content-safety scan that detected issues.

extension/contentsafety/types_test.go

@@ -29,14 +29,6 @@ func (s *stubProvider) Scan(_ context.Context, _ ScanRequest) (*Alert, error) {
 	return &Alert{Provider: "stub", MatchedRules: []string{"test"}}, nil
 }
 
-type fullTextStubProvider struct {
-	stubProvider
-}
-
-func (s *fullTextStubProvider) ScanFullText(ctx context.Context, req ScanRequest) (*Alert, error) {
-	return s.Scan(ctx, req)
-}
-
 func TestProviderInterface(t *testing.T) {
 	var p Provider = &stubProvider{}
 	if p.Name() != "stub" {
@@ -51,17 +43,6 @@ func TestProviderInterface(t *testing.T) {
 	}
 }
 
-func TestFullTextProviderInterface(t *testing.T) {
-	var p FullTextProvider = &fullTextStubProvider{}
-	alert, err := p.ScanFullText(context.Background(), ScanRequest{Path: "test", Data: "full", ErrOut: io.Discard})
-	if err != nil {
-		t.Fatalf("ScanFullText() error = %v", err)
-	}
-	if alert.Provider != "stub" {
-		t.Errorf("alert.Provider = %q, want %q", alert.Provider, "stub")
-	}
-}
-
 func TestRegistryLastWriteWins(t *testing.T) {
 	mu.Lock()
 	old := provider

extension/transport/sidecar/interceptor_test.go

@@ -12,9 +12,18 @@ import (
 	"net/http"
 	"testing"
 
+	exttransport "github.com/larksuite/cli/extension/transport"
+	"github.com/larksuite/cli/internal/envvars"
+	internaltransport "github.com/larksuite/cli/internal/transport"
 	"github.com/larksuite/cli/sidecar"
 )
 
+type roundTripFunc func(*http.Request) (*http.Response, error)
+
+func (f roundTripFunc) RoundTrip(req *http.Request) (*http.Response, error) {
+	return f(req)
+}
+
 // failingBody is a ReadCloser that errors on Read and tracks Close calls.
 type failingBody struct {
 	err      error
@@ -263,3 +272,55 @@ func TestInterceptor_EmptyBody(t *testing.T) {
 		t.Errorf("body SHA256 = %q, want empty-string SHA256 %q", sha, expectedEmpty)
 	}
 }
+
+func TestLegacySidecarProviderStillHandlesForcedExternalRequests(t *testing.T) {
+	t.Setenv(envvars.CliAuthProxy, "http://127.0.0.1:16384")
+	t.Setenv(envvars.CliProxyKey, "test-key")
+	previousProvider := exttransport.GetProvider()
+	exttransport.Register(&Provider{})
+	t.Cleanup(func() { exttransport.Register(previousProvider) })
+
+	seen := make(chan *http.Request, 2)
+	base := roundTripFunc(func(req *http.Request) (*http.Response, error) {
+		seen <- req.Clone(req.Context())
+		return &http.Response{StatusCode: http.StatusNoContent, Body: http.NoBody, Request: req}, nil
+	})
+	client := internaltransport.ClientForRequestClass(
+		&http.Client{Transport: internaltransport.NewHTTPPolicyRouter(base, base)},
+		exttransport.RequestClassExternal,
+	)
+
+	withSentinel, err := http.NewRequest(http.MethodGet, "https://external.example/protected", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	withSentinel.Header.Set("Authorization", "Bearer "+sidecar.SentinelUAT)
+	resp, err := client.Do(withSentinel)
+	if err != nil {
+		t.Fatal(err)
+	}
+	resp.Body.Close()
+
+	withoutSentinel, err := http.NewRequest(http.MethodGet, "https://external.example/public", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	resp, err = client.Do(withoutSentinel)
+	if err != nil {
+		t.Fatal(err)
+	}
+	resp.Body.Close()
+
+	proxied := <-seen
+	if proxied.URL.Scheme != "http" || proxied.URL.Host != "127.0.0.1:16384" {
+		t.Fatalf("sentinel request URL = %s, want sidecar route", proxied.URL)
+	}
+	if got := proxied.Header.Get(sidecar.HeaderProxyTarget); got != "https://external.example" {
+		t.Fatalf("sentinel request proxy target = %q", got)
+	}
+
+	passthrough := <-seen
+	if got := passthrough.URL.String(); got != "https://external.example/public" {
+		t.Fatalf("non-sentinel request URL = %q, want unchanged", got)
+	}
+}

extension/transport/types.go

@@ -15,6 +15,27 @@ type Provider interface {
 	ResolveInterceptor(ctx context.Context) Interceptor
 }
 
+// RequestClass describes the trust boundary of an outbound HTTP request.
+// Platform requests target endpoints owned by the CLI's endpoint resolver;
+// external requests target user-provided, pre-signed, CDN, registry, or other
+// non-platform URLs. Redirect targets are classified again from each hop's
+// logical URL; rewriting a host in an interceptor does not add that host to
+// the platform endpoint catalog.
+type RequestClass string
+
+const (
+	RequestClassPlatform RequestClass = "platform"
+	RequestClassExternal RequestClass = "external"
+)
+
+// ScopedProvider optionally limits a Provider to selected request classes.
+// Providers that do not implement this interface retain the original
+// behavior and apply to every request class.
+type ScopedProvider interface {
+	Provider
+	SupportsRequestClass(RequestClass) bool
+}
+
 // Interceptor defines network-layer customization via a pre/post hook pair.
 // The built-in transport chain always executes between PreRoundTrip and the
 // returned post function, and cannot be skipped or overridden by the extension.

internal/auth/transport.go

@@ -17,6 +17,8 @@ import (
 	"github.com/larksuite/cli/internal/transport"
 )
 
+var _ transport.RoundTripperDecorator = (*SecurityPolicyTransport)(nil)
+
 // SecurityPolicyTransport is an http.RoundTripper that intercepts all responses
 // and checks for security policy errors.
 type SecurityPolicyTransport struct {
@@ -31,6 +33,16 @@ func (t *SecurityPolicyTransport) base() http.RoundTripper {
 	return transport.Fallback()
 }
 
+func (t *SecurityPolicyTransport) BaseRoundTripper() http.RoundTripper {
+	return t.base()
+}
+
+func (t *SecurityPolicyTransport) WithBaseRoundTripper(base http.RoundTripper) http.RoundTripper {
+	cloned := *t
+	cloned.Base = base
+	return &cloned
+}
+
 // RoundTrip implements http.RoundTripper.
 func (t *SecurityPolicyTransport) RoundTrip(req *http.Request) (*http.Response, error) {
 	resp, err := t.base().RoundTrip(req)

internal/client/client.go

@@ -212,6 +212,9 @@ func (c *APIClient) DoStream(ctx context.Context, req *larkcore.ApiReq, as core.
 	resp, err := httpClient.Do(httpReq)
 	if err != nil {
 		cancel()
+		if _, ok := errs.ProblemOf(err); ok {
+			return nil, err
+		}
 		return nil, errs.NewNetworkError(classifyNetworkSubtype(err), "stream request failed: %s", err).WithCause(err)
 	}
 	resp.Body = &cancelOnCloseBody{ReadCloser: resp.Body, cancel: cancel}

internal/client/client_test.go

@@ -518,6 +518,29 @@ func TestDoStream_TransportFailureSplitsSubtype(t *testing.T) {
 	}
 }
 
+func TestDoStream_PreservesTypedTransportError(t *testing.T) {
+	policyErr := errs.NewSecurityPolicyError(errs.SubtypeAccessDenied, "blocked redirect")
+	ac := &APIClient{
+		HTTP: &http.Client{Transport: roundTripFunc(func(*http.Request) (*http.Response, error) {
+			return nil, policyErr
+		})},
+		Credential: credential.NewCredentialProvider(nil, nil, &staticTokenResolver{}, nil),
+		Config:     &core.CliConfig{AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu},
+	}
+
+	_, err := ac.DoStream(context.Background(), &larkcore.ApiReq{
+		HttpMethod: http.MethodGet,
+		ApiPath:    "/open-apis/drive/v1/files/file_token/download",
+	}, core.AsBot)
+	problem, ok := errs.ProblemOf(err)
+	if !ok || problem.Category != errs.CategoryPolicy || problem.Subtype != errs.SubtypeAccessDenied {
+		t.Fatalf("DoStream() problem = %#v, %v; want policy/access_denied", problem, ok)
+	}
+	if !errors.Is(err, policyErr) {
+		t.Fatal("DoStream() did not preserve the typed transport error")
+	}
+}
+
 // failingTokenResolver always returns TokenUnavailableError, exercising the
 // auth/credential failure path through resolveAccessToken.
 type failingTokenResolver struct{}
@@ -711,19 +734,3 @@ func TestCallAPI_ParseJSONFailureWrapsAsAPI(t *testing.T) {
 		t.Errorf("ExitCodeOf = %d, want %d (internal)", output.ExitCodeOf(err), output.ExitInternal)
 	}
 }
-
-func TestPaginateToOutputRejectsUnsupportedInternalFormat(t *testing.T) {
-	for _, format := range []output.Format{output.FormatPretty, output.Format(99)} {
-		err := PaginateToOutput(context.Background(), PaginateOutputOptions{
-			Request:     RawApiRequest{},
-			Format:      format,
-			Out:         io.Discard,
-			ErrOut:      io.Discard,
-			CommandPath: "lark-cli fixture",
-		})
-		var internalErr *errs.InternalError
-		if !errors.As(err, &internalErr) {
-			t.Fatalf("format %q error = %T, want *errs.InternalError", format, err)
-		}
-	}
-}

internal/client/paginate_emit.go

@@ -1,129 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package client
-
-import (
-	"context"
-	"io"
-
-	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/core"
-	"github.com/larksuite/cli/internal/output"
-)
-
-// PaginateOutputOptions bundles the inputs for PaginateToOutput. Grouping the
-// writers, callbacks, and pagination knobs into one struct keeps the call sites
-// readable and avoids positional-argument mistakes across the many parameters.
-type PaginateOutputOptions struct {
-	Client      *APIClient
-	Request     RawApiRequest
-	Format      output.Format
-	JqExpr      string
-	Out         io.Writer
-	ErrOut      io.Writer
-	CommandPath string
-	Pagination  PaginationOptions
-	CheckErr    func(interface{}, core.Identity) error
-	MarkErr     func(error) error
-}
-
-// PaginateToOutput fetches all requested pages and emits them in the selected format.
-func PaginateToOutput(ctx context.Context, opts PaginateOutputOptions) error {
-	ac := opts.Client
-	request := opts.Request
-	format := opts.Format
-	jqExpr := opts.JqExpr
-	out := opts.Out
-	errOut := opts.ErrOut
-	commandPath := opts.CommandPath
-	pagOpts := opts.Pagination
-	checkErr := opts.CheckErr
-	markErr := opts.MarkErr
-	if !format.Valid() || format == output.FormatPretty {
-		return errs.NewInternalError(errs.SubtypeUnknown,
-			"internal: unsupported pagination output format %q", format)
-	}
-	if markErr == nil {
-		markErr = func(err error) error { return err }
-	}
-	if pagOpts.Identity == "" {
-		pagOpts.Identity = request.As
-	}
-	emitValue := func(data interface{}, valueFormat output.Format) error {
-		emitter := output.NewEmitter(output.EmitterConfig{
-			Out:         out,
-			ErrOut:      errOut,
-			CommandPath: commandPath,
-			Identity:    string(pagOpts.Identity),
-		})
-		return emitter.Value(data, output.StreamOptions{Format: valueFormat})
-	}
-	// When jq is set, always aggregate all pages then filter.
-	if jqExpr != "" {
-		result, err := ac.PaginateAll(ctx, request, pagOpts)
-		if err != nil {
-			return markErr(err)
-		}
-		if apiErr := checkErr(result, pagOpts.Identity); apiErr != nil {
-			if emitErr := emitValue(result, output.FormatJSON); emitErr != nil {
-				return markErr(emitErr)
-			}
-			return markErr(apiErr)
-		}
-		return output.WriteSuccessEnvelope(output.SuccessEnvelopeData(result), output.SuccessEnvelopeOptions{
-			CommandPath: commandPath,
-			Identity:    string(pagOpts.Identity),
-			JqExpr:      jqExpr,
-			Out:         out,
-			ErrOut:      errOut,
-		})
-	}
-
-	switch format {
-	case output.FormatNDJSON, output.FormatTable, output.FormatCSV:
-		emitter := output.NewEmitter(output.EmitterConfig{
-			Out:            out,
-			ErrOut:         errOut,
-			CommandPath:    commandPath,
-			Identity:       string(pagOpts.Identity),
-			NoticeProvider: output.GetNotice,
-		})
-		result, hasItems, err := ac.StreamPages(ctx, request, func(items []interface{}) error {
-			return emitter.StreamPage(items, output.StreamOptions{Format: format})
-		}, pagOpts)
-		if err != nil && errs.IsContentSafety(err) {
-			return markErr(err)
-		}
-		if finishErr := emitter.FinishStream(); finishErr != nil {
-			return markErr(finishErr)
-		}
-		if err != nil {
-			return markErr(err)
-		}
-		if apiErr := checkErr(result, pagOpts.Identity); apiErr != nil {
-			return markErr(apiErr)
-		}
-		if !hasItems {
-			return emitter.Value(output.SuccessEnvelopeData(result), output.StreamOptions{Format: format})
-		}
-		return nil
-	default:
-		result, err := ac.PaginateAll(ctx, request, pagOpts)
-		if err != nil {
-			return markErr(err)
-		}
-		if apiErr := checkErr(result, pagOpts.Identity); apiErr != nil {
-			if emitErr := emitValue(result, output.FormatJSON); emitErr != nil {
-				return markErr(emitErr)
-			}
-			return markErr(apiErr)
-		}
-		return output.WriteSuccessEnvelope(output.SuccessEnvelopeData(result), output.SuccessEnvelopeOptions{
-			CommandPath: commandPath,
-			Identity:    string(pagOpts.Identity),
-			Out:         out,
-			ErrOut:      errOut,
-		})
-	}
-}

internal/client/response.go

@@ -139,7 +139,7 @@ func HandleResponse(resp *larkcore.ApiResp, opts ResponseOptions) error {
 			Identity:       string(identity),
 			NoticeProvider: output.GetNotice,
 		})
-		return emitter.Success(result, output.EmitOptions{Format: opts.Format})
+		return emitter.Success(result, output.EmitOptions{Format: opts.Format.String()})
 	}
 
 	// Non-JSON (binary) responses.

internal/cmdutil/factory.go

@@ -16,10 +16,12 @@ import (
 	"github.com/larksuite/cli/errs"
 	extcred "github.com/larksuite/cli/extension/credential"
 	"github.com/larksuite/cli/extension/fileio"
+	exttransport "github.com/larksuite/cli/extension/transport"
 	"github.com/larksuite/cli/internal/client"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/credential"
 	"github.com/larksuite/cli/internal/keychain"
+	"github.com/larksuite/cli/internal/transport"
 )
 
 // Factory holds shared dependencies injected into every command.
@@ -31,7 +33,7 @@ type InvocationContext struct {
 
 type Factory struct {
 	Config     func() (*core.CliConfig, error) // lazily loads app config from Credential
-	HttpClient func() (*http.Client, error)    // HTTP client for non-Lark API calls (with retry and security headers)
+	HttpClient func() (*http.Client, error)    // policy-routed HTTP client for direct requests
 	LarkClient func() (*lark.Client, error)    // Lark SDK client for all Open API calls
 	IOStreams  *IOStreams                      // stdin/stdout/stderr streams
 
@@ -48,6 +50,18 @@ type Factory struct {
 	SkillContent fs.FS // embedded skill tree (rooted at the skill list); nil when the build embeds no skills
 }
 
+// ExternalHTTPClient returns a clone of the existing Factory client whose
+// requests are explicitly classified as external. The underlying client,
+// redirect policy, timeout, proxy configuration, and legacy transport provider
+// behavior are preserved.
+func (f *Factory) ExternalHTTPClient() (*http.Client, error) {
+	client, err := f.HttpClient()
+	if err != nil {
+		return nil, err
+	}
+	return transport.ClientForRequestClass(client, exttransport.RequestClassExternal), nil
+}
+
 // ResolveFileIO resolves a FileIO instance using the current execution context.
 // The provider controls whether the returned instance is fresh or cached.
 func (f *Factory) ResolveFileIO(ctx context.Context) fileio.FileIO {

internal/cmdutil/factory_default.go

@@ -5,16 +5,18 @@ package cmdutil
 
 import (
 	"context"
-	"fmt"
 	"io"
 	"net/http"
+	"net/url"
 	"os"
+	"strings"
 	"sync"
 	"time"
 
 	lark "github.com/larksuite/oapi-sdk-go/v3"
 	larkcore "github.com/larksuite/oapi-sdk-go/v3/core"
 
+	"github.com/larksuite/cli/errs"
 	extcred "github.com/larksuite/cli/extension/credential"
 	"github.com/larksuite/cli/extension/fileio"
 	"github.com/larksuite/cli/internal/auth"
@@ -22,6 +24,7 @@ import (
 	"github.com/larksuite/cli/internal/credential"
 	"github.com/larksuite/cli/internal/keychain"
 	"github.com/larksuite/cli/internal/registry"
+	"github.com/larksuite/cli/internal/riskcontrol"
 	_ "github.com/larksuite/cli/internal/security/contentsafety" // register content safety provider
 	"github.com/larksuite/cli/internal/transport"
 	_ "github.com/larksuite/cli/internal/vfs/localfileio" // register default FileIO provider
@@ -33,7 +36,7 @@ import (
 //	Phase 1: HttpClient (no credential dependency)
 //	Phase 2: Credential (sole data source for account info)
 //	Phase 3: Config derived from Credential
-//	Phase 4: LarkClient derived from Credential
+//	Phase 4: LarkClient derived from Credential and workspace policy
 func NewDefault(streams *IOStreams, inv InvocationContext) *Factory {
 	streams = normalizeStreams(streams)
 	f := &Factory{
@@ -47,6 +50,19 @@ func NewDefault(streams *IOStreams, inv InvocationContext) *Factory {
 	// workspace-scoped. Default is WorkspaceLocal — existing behavior unchanged.
 	ws := core.DetectWorkspaceFromEnv(os.Getenv)
 	core.SetCurrentWorkspace(ws)
+	workspaceConfig := core.NewConfigSnapshot()
+	bootstrapHostSignalSource := sync.OnceValue(func() riskcontrol.Source {
+		return resolveSDKHostSignalSource(workspaceConfig)
+	})
+	// Install after workspace selection so the dependency bootstrap bridge uses
+	// the correct shared proxy configuration. NewDefault is also used by cmd.Build
+	// consumers, so this keeps their request routing identical to cmd.Execute.
+	transport.InstallSDKTransportBridge(func(base http.RoundTripper) http.RoundTripper {
+		return buildSDKPlatformTransportWithBase(
+			base,
+			bootstrapHostSignalSource(),
+		)
+	})
 
 	// Inject workspace-aware dir into keychain's log system.
 	// This breaks the core↔keychain import cycle by using a function variable.
@@ -56,7 +72,7 @@ func NewDefault(streams *IOStreams, inv InvocationContext) *Factory {
 	f.FileIOProvider = fileio.GetProvider()
 
 	// Phase 1: HttpClient (no credential dependency)
-	f.HttpClient = cachedHttpClientFunc(f)
+	f.HttpClient = cachedHttpClientFunc(f, workspaceConfig)
 
 	// Phase 2: Credential (sole data source)
 	// Keychain is read via closure so callers can replace f.Keychain after construction.
@@ -67,7 +83,7 @@ func NewDefault(streams *IOStreams, inv InvocationContext) *Factory {
 		ErrOut:     f.IOStreams.ErrOut,
 	})
 
-	// Phase 3: Config derived from Credential via an explicit conversion boundary.
+	// Phase 3: Runtime config contains resolved account data only.
 	f.Config = sync.OnceValues(func() (*core.CliConfig, error) {
 		acct, err := f.Credential.ResolveAccount(context.Background())
 		if err != nil {
@@ -78,21 +94,52 @@ func NewDefault(streams *IOStreams, inv InvocationContext) *Factory {
 		return cfg, nil
 	})
 
-	// Phase 4: LarkClient from Credential (placeholder AppSecret)
-	f.LarkClient = cachedLarkClientFunc(f)
+	// Phase 4: LarkClient composes account data and workspace policy at the SDK
+	// transport boundary.
+	f.LarkClient = cachedLarkClientFunc(f, workspaceConfig)
 
 	return f
 }
 
-// safeRedirectPolicy prevents credential headers from being forwarded
-// when a response redirects to a different host (e.g. Lark API 302 → CDN).
-// Strips Authorization, X-Lark-MCP-UAT, and X-Lark-MCP-TAT on cross-host
-// redirects; other headers like X-Cli-* pass through.
+// safeRedirectPolicy permits cross-origin redirects only for bodyless GET and
+// HEAD requests. This allows API download redirects while preventing OAuth or
+// other credential-bearing request bodies from being replayed to another
+// origin. HTTPS requests can never be downgraded to HTTP.
 func safeRedirectPolicy(req *http.Request, via []*http.Request) error {
 	if len(via) >= 10 {
-		return fmt.Errorf("too many redirects")
+		return errs.NewNetworkError(errs.SubtypeNetworkTransport, "too many redirects")
 	}
-	if len(via) > 0 && req.URL.Host != via[0].URL.Host {
+	if len(via) == 0 {
+		return nil
+	}
+	original := via[0]
+	previous := via[len(via)-1]
+	if previous.URL != nil && req.URL != nil && strings.EqualFold(previous.URL.Scheme, "https") && !strings.EqualFold(req.URL.Scheme, "https") {
+		return errs.NewSecurityPolicyError(
+			errs.SubtypeAccessDenied,
+			"redirect from HTTPS to %s is not allowed",
+			req.URL.Scheme,
+		)
+	}
+	if !sameRedirectOrigin(previous.URL, req.URL) {
+		if req.Method != http.MethodGet && req.Method != http.MethodHead {
+			return errs.NewSecurityPolicyError(
+				errs.SubtypeAccessDenied,
+				"cross-origin redirect for HTTP method %s is not allowed",
+				req.Method,
+			)
+		}
+		if req.Body != nil || req.GetBody != nil {
+			return errs.NewSecurityPolicyError(
+				errs.SubtypeAccessDenied,
+				"cross-origin redirect with a request body is not allowed",
+			)
+		}
+	}
+	// net/http copies initial headers onto every redirect request. Continue
+	// stripping credentials for every hop outside the initial origin, even when
+	// two consecutive redirect targets share an origin.
+	if !sameRedirectOrigin(original.URL, req.URL) {
 		req.Header.Del("Authorization")
 		req.Header.Del("X-Lark-MCP-UAT")
 		req.Header.Del("X-Lark-MCP-TAT")
@@ -100,6 +147,29 @@ func safeRedirectPolicy(req *http.Request, via []*http.Request) error {
 	return nil
 }
 
+func sameRedirectOrigin(left, right *url.URL) bool {
+	if left == nil || right == nil {
+		return false
+	}
+	return strings.EqualFold(left.Scheme, right.Scheme) &&
+		strings.EqualFold(left.Hostname(), right.Hostname()) &&
+		effectivePort(left) == effectivePort(right)
+}
+
+func effectivePort(candidate *url.URL) string {
+	if port := candidate.Port(); port != "" {
+		return port
+	}
+	switch strings.ToLower(candidate.Scheme) {
+	case "http":
+		return "80"
+	case "https":
+		return "443"
+	default:
+		return ""
+	}
+}
+
 // warnIfProxied is a test seam for the proxy-warning gate. Production wires it
 // to transport.WarnIfProxied; tests swap in a spy to count invocations. It is
 // needed because the real function is guarded by an internal sync.Once, so
@@ -108,19 +178,19 @@ func safeRedirectPolicy(req *http.Request, via []*http.Request) error {
 // .StderrIsTerminal field, which tests set directly.
 var warnIfProxied = transport.WarnIfProxied
 
-func cachedHttpClientFunc(f *Factory) func() (*http.Client, error) {
+func cachedHttpClientFunc(f *Factory, workspaceConfig workspaceConfigSource) func() (*http.Client, error) {
 	return sync.OnceValues(func() (*http.Client, error) {
 		if f.IOStreams.StderrIsTerminal {
 			warnIfProxied(f.IOStreams.ErrOut)
 		}
 
-		var rt http.RoundTripper = transport.Shared()
-		rt = &RetryTransport{Base: rt}
-		rt = &SecurityHeaderTransport{Base: rt}
-		rt = &auth.SecurityPolicyTransport{Base: rt} // Add our global response interceptor
-		rt = wrapWithExtension(rt)
+		hostSignalSource := resolveSDKHostSignalSource(workspaceConfig)
+		shared := transport.Shared()
+		outbound := riskcontrol.NewTransport(shared, hostSignalSource)
+		platform := buildDirectHTTPTransport(outbound, true)
+		external := buildDirectHTTPTransport(outbound, false)
 		client := &http.Client{
-			Transport:     rt,
+			Transport:     transport.NewHTTPPolicyRouter(platform, external),
 			Timeout:       30 * time.Second,
 			CheckRedirect: safeRedirectPolicy,
 		}
@@ -128,7 +198,16 @@ func cachedHttpClientFunc(f *Factory) func() (*http.Client, error) {
 	})
 }
 
-func cachedLarkClientFunc(f *Factory) func() (*lark.Client, error) {
+func buildDirectHTTPTransport(base http.RoundTripper, platform bool) http.RoundTripper {
+	var builtIn http.RoundTripper = &RetryTransport{Base: base}
+	builtIn = &SecurityHeaderTransport{Base: builtIn}
+	if platform {
+		builtIn = &auth.SecurityPolicyTransport{Base: builtIn}
+	}
+	return builtIn
+}
+
+func cachedLarkClientFunc(f *Factory, workspaceConfig workspaceConfigSource) func() (*lark.Client, error) {
 	return sync.OnceValues(func() (*lark.Client, error) {
 		acct, err := f.Credential.ResolveAccount(context.Background())
 		if err != nil {
@@ -142,8 +221,9 @@ func cachedLarkClientFunc(f *Factory) func() (*lark.Client, error) {
 		if f.IOStreams.StderrIsTerminal {
 			warnIfProxied(f.IOStreams.ErrOut)
 		}
+		hostSignalSource := resolveSDKHostSignalSource(workspaceConfig)
 		opts = append(opts, lark.WithHttpClient(&http.Client{
-			Transport:     buildSDKTransport(),
+			Transport:     buildSDKTransport(hostSignalSource),
 			CheckRedirect: safeRedirectPolicy,
 		}))
 		ep := core.ResolveEndpoints(acct.Brand)
@@ -152,13 +232,41 @@ func cachedLarkClientFunc(f *Factory) func() (*lark.Client, error) {
 	})
 }
 
-func buildSDKTransport() http.RoundTripper {
-	var sdkTransport http.RoundTripper = transport.Shared()
-	sdkTransport = &RetryTransport{Base: sdkTransport}
-	sdkTransport = &UserAgentTransport{Base: sdkTransport}
-	sdkTransport = &BuildHeaderTransport{Base: sdkTransport}
-	sdkTransport = &auth.SecurityPolicyTransport{Base: sdkTransport}
-	return wrapWithExtension(sdkTransport)
+func buildSDKTransport(hostSignalSource riskcontrol.Source) http.RoundTripper {
+	return buildSDKTransportWithBase(transport.Shared(), hostSignalSource)
+}
+
+func buildSDKPlatformTransportWithBase(
+	base http.RoundTripper,
+	hostSignalSource riskcontrol.Source,
+) http.RoundTripper {
+	outbound := riskcontrol.NewTransport(base, hostSignalSource)
+	return buildSDKHTTPTransport(outbound, true)
+}
+
+func buildSDKTransportWithBase(
+	base http.RoundTripper,
+	hostSignalSource riskcontrol.Source,
+) http.RoundTripper {
+	// Risk control is the innermost trusted boundary for both request classes.
+	// It therefore observes the final URL and strips extension-supplied reserved
+	// headers immediately before the network transport.
+	outbound := riskcontrol.NewTransport(base, hostSignalSource)
+	return transport.NewHTTPPolicyRouter(
+		buildSDKHTTPTransport(outbound, true),
+		buildSDKHTTPTransport(outbound, false),
+	)
+}
+
+func buildSDKHTTPTransport(base http.RoundTripper, platform bool) http.RoundTripper {
+	var builtIn http.RoundTripper = &RetryTransport{Base: base}
+	builtIn = &UserAgentTransport{Base: builtIn}
+	builtIn = &BuildHeaderTransport{Base: builtIn}
+	builtIn = &SecurityHeaderTransport{Base: builtIn}
+	if platform {
+		builtIn = &auth.SecurityPolicyTransport{Base: builtIn}
+	}
+	return builtIn
 }
 
 type credentialDeps struct {

internal/cmdutil/factory_http_test.go

@@ -4,12 +4,24 @@
 package cmdutil
 
 import (
+	"errors"
 	"io"
+	"net/http"
+	"net/http/httptest"
+	"strings"
 	"testing"
+
+	"github.com/larksuite/cli/errs"
+	exttransport "github.com/larksuite/cli/extension/transport"
+	"github.com/larksuite/cli/internal/core"
+	internaltransport "github.com/larksuite/cli/internal/transport"
 )
 
-func TestCachedHttpClientFunc_ReturnsSameInstance(t *testing.T) {
-	fn := cachedHttpClientFunc(&Factory{IOStreams: &IOStreams{ErrOut: io.Discard}})
+func TestCachedHTTPClientFunc_ReturnsSameInstance(t *testing.T) {
+	isEnabled := false
+	f, _, _, _ := TestFactory(t, &core.CliConfig{AppID: "test-app"})
+	f.IOStreams.ErrOut = io.Discard
+	fn := cachedHttpClientFunc(f, staticWorkspaceConfig{config: &core.MultiAppConfig{RiskControl: &isEnabled}})
 
 	c1, err := fn()
 	if err != nil {
@@ -28,18 +40,304 @@ func TestCachedHttpClientFunc_ReturnsSameInstance(t *testing.T) {
 	}
 }
 
-func TestCachedHttpClientFunc_HasTimeout(t *testing.T) {
-	fn := cachedHttpClientFunc(&Factory{IOStreams: &IOStreams{ErrOut: io.Discard}})
+func TestCachedHTTPClientFunc_HasTimeout(t *testing.T) {
+	isEnabled := false
+	f, _, _, _ := TestFactory(t, &core.CliConfig{AppID: "test-app"})
+	f.IOStreams.ErrOut = io.Discard
+	fn := cachedHttpClientFunc(f, staticWorkspaceConfig{config: &core.MultiAppConfig{RiskControl: &isEnabled}})
 	c, _ := fn()
 	if c.Timeout == 0 {
 		t.Error("expected non-zero timeout")
 	}
 }
 
-func TestCachedHttpClientFunc_HasRedirectPolicy(t *testing.T) {
-	fn := cachedHttpClientFunc(&Factory{IOStreams: &IOStreams{ErrOut: io.Discard}})
+func TestCachedHTTPClientFunc_HasRedirectPolicy(t *testing.T) {
+	isEnabled := false
+	f, _, _, _ := TestFactory(t, &core.CliConfig{AppID: "test-app"})
+	f.IOStreams.ErrOut = io.Discard
+	fn := cachedHttpClientFunc(f, staticWorkspaceConfig{config: &core.MultiAppConfig{RiskControl: &isEnabled}})
 	c, _ := fn()
 	if c.CheckRedirect == nil {
 		t.Error("expected CheckRedirect to be set (safeRedirectPolicy)")
 	}
 }
+
+func TestFactoryExternalHTTPClientClonesExistingClient(t *testing.T) {
+	base := &http.Client{Timeout: 17, CheckRedirect: safeRedirectPolicy}
+	factory := &Factory{HttpClient: func() (*http.Client, error) { return base, nil }}
+
+	external, err := factory.ExternalHTTPClient()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if external == base {
+		t.Fatal("ExternalHTTPClient returned the cached client instead of a clone")
+	}
+	if external.Timeout != base.Timeout || external.CheckRedirect == nil {
+		t.Fatal("ExternalHTTPClient did not preserve client policy")
+	}
+	if base.Transport != nil {
+		t.Fatal("ExternalHTTPClient mutated the cached client's transport")
+	}
+}
+
+type platformOnlyStubProvider struct {
+	*stubTransportProvider
+}
+
+func (*platformOnlyStubProvider) SupportsRequestClass(class exttransport.RequestClass) bool {
+	return class == exttransport.RequestClassPlatform
+}
+
+func TestFactoryHTTPClientRoutesPoliciesByRequestClass(t *testing.T) {
+	t.Setenv("LARKSUITE_CLI_NO_PROXY", "1")
+
+	interceptor := &headerCapturingInterceptor{}
+	exttransport.Register(&platformOnlyStubProvider{stubTransportProvider: &stubTransportProvider{interceptor: interceptor}})
+	t.Cleanup(func() { exttransport.Register(nil) })
+
+	received := make(chan http.Header, 2)
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
+		received <- req.Header.Clone()
+		w.WriteHeader(http.StatusNoContent)
+	}))
+	t.Cleanup(server.Close)
+
+	factory := &Factory{IOStreams: &IOStreams{ErrOut: io.Discard}}
+	client, err := cachedHttpClientFunc(factory, nil)()
+	if err != nil {
+		t.Fatal(err)
+	}
+	factory.HttpClient = func() (*http.Client, error) { return client, nil }
+	platformClient := internaltransport.ClientForRequestClass(client, exttransport.RequestClassPlatform)
+	externalClient, err := factory.ExternalHTTPClient()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	for _, client := range []*http.Client{platformClient, externalClient} {
+		resp, err := client.Get(server.URL)
+		if err != nil {
+			t.Fatal(err)
+		}
+		resp.Body.Close()
+	}
+
+	platformHeaders := <-received
+	if got := platformHeaders.Get("X-Custom-Trace"); got != "ext-trace-123" {
+		t.Fatalf("platform extension header = %q, want ext-trace-123", got)
+	}
+	if got := platformHeaders.Get(HeaderSource); got != SourceValue {
+		t.Fatalf("platform security header = %q, want %q", got, SourceValue)
+	}
+
+	externalHeaders := <-received
+	if got := externalHeaders.Get("X-Custom-Trace"); got != "" {
+		t.Fatalf("external request leaked extension header %q", got)
+	}
+	for header, values := range BaseSecurityHeaders() {
+		if len(values) == 0 {
+			continue
+		}
+		want := values[len(values)-1]
+		if got := externalHeaders.Get(header); got != want {
+			t.Fatalf("external security header %s = %q, want preserved value %q", header, got, want)
+		}
+	}
+}
+
+func TestFactoryExternalHTTPClientDoesNotParsePlatformErrorProtocol(t *testing.T) {
+	t.Setenv("LARKSUITE_CLI_NO_PROXY", "1")
+	exttransport.Register(nil)
+
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = io.WriteString(w, `{"code":21000,"msg":"application-defined external response","data":{"cli_hint":"external-defined"}}`)
+	}))
+	t.Cleanup(server.Close)
+
+	factory := &Factory{IOStreams: &IOStreams{ErrOut: io.Discard}}
+	client, err := cachedHttpClientFunc(factory, nil)()
+	if err != nil {
+		t.Fatal(err)
+	}
+	factory.HttpClient = func() (*http.Client, error) { return client, nil }
+
+	platform := internaltransport.ClientForRequestClass(client, exttransport.RequestClassPlatform)
+	if _, err := platform.Get(server.URL); err == nil {
+		t.Fatal("platform request error = nil, want security policy classification")
+	} else {
+		var policyErr *errs.SecurityPolicyError
+		if !errors.As(err, &policyErr) {
+			t.Fatalf("platform request error type = %T, want *errs.SecurityPolicyError", err)
+		}
+	}
+
+	external, err := factory.ExternalHTTPClient()
+	if err != nil {
+		t.Fatal(err)
+	}
+	resp, err := external.Get(server.URL)
+	if err != nil {
+		t.Fatalf("external request parsed platform error protocol: %v", err)
+	}
+	resp.Body.Close()
+}
+
+func TestSafeRedirectPolicyAllowsBodylessCrossOriginGetAndStripsCredentials(t *testing.T) {
+	original, err := http.NewRequest(http.MethodGet, "https://open.feishu.cn/start", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	redirect, err := http.NewRequest(http.MethodGet, "https://cdn.example.com/file", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, header := range []string{"Authorization", "X-Lark-MCP-UAT", "X-Lark-MCP-TAT"} {
+		redirect.Header.Set(header, "secret")
+	}
+
+	if err := safeRedirectPolicy(redirect, []*http.Request{original}); err != nil {
+		t.Fatalf("safeRedirectPolicy() error = %v, want allowed GET redirect", err)
+	}
+	for _, header := range []string{"Authorization", "X-Lark-MCP-UAT", "X-Lark-MCP-TAT"} {
+		if got := redirect.Header.Get(header); got != "" {
+			t.Fatalf("redirect retained %s=%q", header, got)
+		}
+	}
+}
+
+func TestSafeRedirectPolicyRejectsHTTPSDowngrade(t *testing.T) {
+	original, err := http.NewRequest(http.MethodGet, "https://open.feishu.cn/start", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	redirect, err := http.NewRequest(http.MethodGet, "http://open.feishu.cn/next", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	err = safeRedirectPolicy(redirect, []*http.Request{original})
+	if err == nil || !strings.Contains(err.Error(), "HTTPS") {
+		t.Fatalf("safeRedirectPolicy() error = %v, want HTTPS downgrade rejection", err)
+	}
+	requireRedirectProblem(t, err, errs.CategoryPolicy, errs.SubtypeAccessDenied)
+}
+
+func TestSafeRedirectPolicyRejectsCrossOriginMethod(t *testing.T) {
+	original, err := http.NewRequest(http.MethodPost, "https://accounts.feishu.cn/token", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	redirect, err := http.NewRequest(http.MethodPost, "https://external.example/token", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	err = safeRedirectPolicy(redirect, []*http.Request{original})
+	if err == nil || !strings.Contains(err.Error(), "HTTP method POST") {
+		t.Fatalf("safeRedirectPolicy() error = %v, want cross-origin method rejection", err)
+	}
+	requireRedirectProblem(t, err, errs.CategoryPolicy, errs.SubtypeAccessDenied)
+}
+
+func TestSafeRedirectPolicyRejectsCrossOriginRequestBody(t *testing.T) {
+	original, err := http.NewRequest(http.MethodGet, "https://accounts.feishu.cn/token", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	redirect, err := http.NewRequest(http.MethodGet, "https://external.example/token", strings.NewReader("client_secret=secret"))
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	err = safeRedirectPolicy(redirect, []*http.Request{original})
+	if err == nil || !strings.Contains(err.Error(), "request body") {
+		t.Fatalf("safeRedirectPolicy() error = %v, want cross-origin body rejection", err)
+	}
+	requireRedirectProblem(t, err, errs.CategoryPolicy, errs.SubtypeAccessDenied)
+}
+
+func TestSafeRedirectPolicyRejectsTooManyRedirects(t *testing.T) {
+	err := safeRedirectPolicy(&http.Request{}, make([]*http.Request, 10))
+	if err == nil || err.Error() != "too many redirects" {
+		t.Fatalf("safeRedirectPolicy() error = %v, want redirect limit rejection", err)
+	}
+	requireRedirectProblem(t, err, errs.CategoryNetwork, errs.SubtypeNetworkTransport)
+}
+
+func TestSafeRedirectPolicyTreatsDefaultHTTPSPortAsSameOrigin(t *testing.T) {
+	original, err := http.NewRequest(http.MethodPost, "https://accounts.feishu.cn/token", strings.NewReader("secret"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	redirect, err := http.NewRequest(http.MethodPost, "https://accounts.feishu.cn:443/token-next", strings.NewReader("secret"))
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if err := safeRedirectPolicy(redirect, []*http.Request{original}); err != nil {
+		t.Fatalf("safeRedirectPolicy() error = %v, want same-origin redirect", err)
+	}
+}
+
+func TestSafeRedirectPolicyKeepsCredentialsStrippedAcrossExternalHops(t *testing.T) {
+	original, err := http.NewRequest(http.MethodGet, "https://open.feishu.cn/start", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	previous, err := http.NewRequest(http.MethodGet, "https://cdn.example.com/first", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	redirect, err := http.NewRequest(http.MethodGet, "https://cdn.example.com/second", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	redirect.Header.Set("Authorization", "Bearer copied-from-initial-request")
+
+	if err := safeRedirectPolicy(redirect, []*http.Request{original, previous}); err != nil {
+		t.Fatalf("safeRedirectPolicy() error = %v, want same-CDN redirect", err)
+	}
+	if got := redirect.Header.Get("Authorization"); got != "" {
+		t.Fatalf("redirect retained Authorization=%q outside the initial origin", got)
+	}
+}
+
+func TestSafeRedirectPolicyRejectsDowngradeOnLaterHop(t *testing.T) {
+	original, err := http.NewRequest(http.MethodGet, "http://source.example/start", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	previous, err := http.NewRequest(http.MethodGet, "https://cdn.example.com/secure", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	redirect, err := http.NewRequest(http.MethodGet, "http://cdn.example.com/plain", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	err = safeRedirectPolicy(redirect, []*http.Request{original, previous})
+	if err == nil || !strings.Contains(err.Error(), "HTTPS") {
+		t.Fatalf("safeRedirectPolicy() error = %v, want later-hop HTTPS downgrade rejection", err)
+	}
+	requireRedirectProblem(t, err, errs.CategoryPolicy, errs.SubtypeAccessDenied)
+}
+
+func requireRedirectProblem(t *testing.T, err error, category errs.Category, subtype errs.Subtype) {
+	t.Helper()
+	problem, ok := errs.ProblemOf(err)
+	if !ok {
+		t.Fatalf("error type = %T, want typed error", err)
+	}
+	if problem.Category != category || problem.Subtype != subtype {
+		t.Fatalf(
+			"error category/subtype = %s/%s, want %s/%s",
+			problem.Category,
+			problem.Subtype,
+			category,
+			subtype,
+		)
+	}
+}

internal/cmdutil/factory_proxy_warn_test.go

@@ -8,6 +8,7 @@ import (
 	"testing"
 
 	_ "github.com/larksuite/cli/extension/credential/env" // registers the env-backed account provider
+	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/envvars"
 )
 
@@ -33,16 +34,18 @@ var proxyWarnGateCases = []struct {
 	{"non-terminal stderr stays silent", false, 0},
 }
 
-// TestCachedHttpClientFunc_ProxyWarnGate verifies the http-client init path
+// TestCachedHTTPClientFunc_ProxyWarnGate verifies the HTTP client init path
 // invokes WarnIfProxied only when stderr is an interactive terminal.
-func TestCachedHttpClientFunc_ProxyWarnGate(t *testing.T) {
+func TestCachedHTTPClientFunc_ProxyWarnGate(t *testing.T) {
+	isEnabled := false
 	for _, tc := range proxyWarnGateCases {
 		t.Run(tc.name, func(t *testing.T) {
 			calls := installProxyWarnSpy(t)
 
-			fn := cachedHttpClientFunc(&Factory{IOStreams: &IOStreams{
-				ErrOut: io.Discard, StderrIsTerminal: tc.terminal,
-			}})
+			f, _, _, _ := TestFactory(t, &core.CliConfig{AppID: "test-app"})
+			f.IOStreams.ErrOut = io.Discard
+			f.IOStreams.StderrIsTerminal = tc.terminal
+			fn := cachedHttpClientFunc(f, staticWorkspaceConfig{config: &core.MultiAppConfig{RiskControl: &isEnabled}})
 			if _, err := fn(); err != nil {
 				t.Fatalf("http client init: %v", err)
 			}
@@ -73,7 +76,7 @@ func TestCachedLarkClientFunc_ProxyWarnGate(t *testing.T) {
 			// normalizeStreams copies the struct (out := *s), so the
 			// StderrIsTerminal field survives into f.IOStreams.
 			f := NewDefault(&IOStreams{ErrOut: io.Discard, StderrIsTerminal: tc.terminal}, InvocationContext{})
-			if _, err := cachedLarkClientFunc(f)(); err != nil {
+			if _, err := cachedLarkClientFunc(f, nil)(); err != nil {
 				t.Fatalf("lark client init: %v", err)
 			}
 

internal/cmdutil/localfile.go

@@ -0,0 +1,36 @@
+// Copyright (c) 2026 Lark Technologies Pte. Ltd.
+// SPDX-License-Identifier: MIT
+
+package cmdutil
+
+import (
+	"io/fs"
+
+	"github.com/larksuite/cli/extension/fileio"
+	"github.com/larksuite/cli/internal/validate"
+	"github.com/larksuite/cli/internal/vfs"
+)
+
+// StatLocalFile returns metadata for a path in the process filesystem namespace.
+// It is intended for advisory validation; callers must validate the opened file
+// again before using its contents.
+func StatLocalFile(path string) (fs.FileInfo, error) {
+	localPath, err := validate.LocalInputPath(path)
+	if err != nil {
+		return nil, &fileio.PathValidationError{Err: err}
+	}
+	return vfs.Stat(localPath)
+}
+
+// OpenLocalFile opens a path in the process filesystem namespace.
+// Absolute and relative paths are accepted. It is the shared replacement for
+// direct os.Open/os.ReadFile use in commands that intentionally read local
+// paths outside the workspace sandbox. Callers inspect the returned descriptor
+// before reading so validation and use apply to the same opened file.
+func OpenLocalFile(path string) (fs.File, error) {
+	localPath, err := validate.LocalInputPath(path)
+	if err != nil {
+		return nil, &fileio.PathValidationError{Err: err}
+	}
+	return vfs.Open(localPath)
+}

internal/cmdutil/localfile_test.go

@@ -0,0 +1,96 @@
+// Copyright (c) 2026 Lark Technologies Pte. Ltd.
+// SPDX-License-Identifier: MIT
+
+package cmdutil
+
+import (
+	"errors"
+	"io"
+	"io/fs"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/larksuite/cli/extension/fileio"
+	"github.com/larksuite/cli/internal/vfs"
+)
+
+func TestOpenLocalFile_AcceptsAbsoluteAndParentRelativePaths(t *testing.T) {
+	root := t.TempDir()
+	workDir := filepath.Join(root, "work")
+	if err := os.Mkdir(workDir, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	path := filepath.Join(root, "input.txt")
+	if err := os.WriteFile(path, []byte("content"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	TestChdir(t, workDir)
+
+	for _, input := range []string{path, filepath.Join("..", "input.txt")} {
+		f, err := OpenLocalFile(input)
+		if err != nil {
+			t.Fatalf("OpenLocalFile(%q) error = %v", input, err)
+		}
+		got, readErr := io.ReadAll(f)
+		closeErr := f.Close()
+		if readErr != nil || closeErr != nil || string(got) != "content" {
+			t.Fatalf("OpenLocalFile(%q) content=%q read=%v close=%v", input, got, readErr, closeErr)
+		}
+	}
+}
+
+func TestOpenLocalFile_RejectsInvalidInput(t *testing.T) {
+	if _, err := OpenLocalFile("input\n.txt"); !errors.Is(err, fileio.ErrPathValidation) {
+		t.Fatalf("OpenLocalFile() error = %v, want ErrPathValidation", err)
+	}
+}
+
+func TestStatLocalFile_ReturnsMetadata(t *testing.T) {
+	info, err := StatLocalFile(t.TempDir())
+	if err != nil {
+		t.Fatalf("StatLocalFile() error = %v", err)
+	}
+	if !info.IsDir() {
+		t.Fatalf("StatLocalFile() mode = %v, want directory", info.Mode())
+	}
+}
+
+func TestOpenLocalFile_DoesNotStatBeforeOpen(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "input.txt")
+	if err := os.WriteFile(path, []byte("content"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+
+	previous := vfs.DefaultFS
+	counting := &countingLocalFileFS{FS: previous}
+	vfs.DefaultFS = counting
+	t.Cleanup(func() { vfs.DefaultFS = previous })
+
+	f, err := OpenLocalFile(path)
+	if err != nil {
+		t.Fatalf("OpenLocalFile() error = %v", err)
+	}
+	if err := f.Close(); err != nil {
+		t.Fatal(err)
+	}
+	if counting.openCalls != 1 || counting.statCalls != 0 {
+		t.Fatalf("OpenLocalFile() calls: Open=%d Stat=%d, want Open=1 Stat=0", counting.openCalls, counting.statCalls)
+	}
+}
+
+type countingLocalFileFS struct {
+	vfs.FS
+	openCalls int
+	statCalls int
+}
+
+func (f *countingLocalFileFS) Open(name string) (*os.File, error) {
+	f.openCalls++
+	return f.FS.Open(name)
+}
+
+func (f *countingLocalFileFS) Stat(name string) (fs.FileInfo, error) {
+	f.statCalls++
+	return f.FS.Stat(name)
+}

internal/cmdutil/risk_control.go

@@ -0,0 +1,28 @@
+// Copyright (c) 2026 Lark Technologies Pte. Ltd.
+// SPDX-License-Identifier: MIT
+
+package cmdutil
+
+import (
+	"github.com/larksuite/cli/internal/core"
+	"github.com/larksuite/cli/internal/riskcontrol"
+)
+
+type workspaceConfigSource interface {
+	MultiAppConfig() (*core.MultiAppConfig, error)
+}
+
+// resolveSDKHostSignalSource applies workspace policy at the SDK transport
+// boundary.
+func resolveSDKHostSignalSource(config workspaceConfigSource) riskcontrol.Source {
+	if config == nil {
+		return nil
+	}
+	workspace, configErr := config.MultiAppConfig()
+	// Default-on means an existing config with no explicit preference. Absent
+	// or unreadable config cannot authorize host-signal collection.
+	if configErr != nil || !workspace.RiskControlEnabled() {
+		return nil
+	}
+	return riskcontrol.NewHostSource()
+}

internal/cmdutil/risk_control_test.go

@@ -0,0 +1,45 @@
+// Copyright (c) 2026 Lark Technologies Pte. Ltd.
+// SPDX-License-Identifier: MIT
+
+package cmdutil
+
+import (
+	"errors"
+	"testing"
+
+	"github.com/larksuite/cli/internal/core"
+)
+
+type staticWorkspaceConfig struct {
+	config *core.MultiAppConfig
+	err    error
+}
+
+func (s staticWorkspaceConfig) MultiAppConfig() (*core.MultiAppConfig, error) {
+	return s.config, s.err
+}
+
+func TestResolveSDKHostSignalSource(t *testing.T) {
+	disabled := false
+	tests := []struct {
+		name       string
+		config     workspaceConfigSource
+		wantSource bool
+	}{
+		{name: "workspace default on", config: staticWorkspaceConfig{config: &core.MultiAppConfig{}}, wantSource: true},
+		{name: "workspace opt-out", config: staticWorkspaceConfig{config: &core.MultiAppConfig{RiskControl: &disabled}}},
+		{name: "missing config", config: staticWorkspaceConfig{err: errors.New("file does not exist")}},
+		{name: "unreadable config", config: staticWorkspaceConfig{err: errors.New("permission denied")}},
+		{name: "nil config value", config: staticWorkspaceConfig{}},
+		{name: "nil config source"},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			got := resolveSDKHostSignalSource(test.config)
+			if (got != nil) != test.wantSource {
+				t.Fatalf("resolveSDKHostSignalSource() = %T, wantSource %t", got, test.wantSource)
+			}
+		})
+	}
+}

internal/cmdutil/secheader.go

@@ -26,6 +26,7 @@ const (
 	HeaderShortcut    = "X-Cli-Shortcut"
 	HeaderExecutionId = "X-Cli-Execution-Id"
 	HeaderAgentTrace  = "X-Agent-Trace"
+	HeaderAgentName   = "X-Agent-Name"
 
 	SourceValue = "lark-cli"
 
@@ -55,6 +56,9 @@ func BaseSecurityHeaders() http.Header {
 	if v := envvars.AgentTrace(); v != "" {
 		h.Set(HeaderAgentTrace, v)
 	}
+	if v := envvars.AgentName(); v != "" {
+		h.Set(HeaderAgentName, v)
+	}
 	return h
 }
 

internal/cmdutil/secheader_test.go

@@ -263,9 +263,34 @@ func TestBaseSecurityHeaders_AllRequiredHeaders(t *testing.T) {
 }
 
 // ---------------------------------------------------------------------------
-// HeaderAgentTrace injection (via BaseSecurityHeaders)
+// Agent headers injected via BaseSecurityHeaders
 // ---------------------------------------------------------------------------
 
+func TestBaseSecurityHeaders_NoAgentNameHeaderWhenEnvUnset(t *testing.T) {
+	t.Setenv(envvars.CliAgentName, "")
+	h := BaseSecurityHeaders()
+	if v := h.Get(HeaderAgentName); v != "" {
+		t.Fatalf("BaseSecurityHeaders() included %s = %q, want absent when env unset", HeaderAgentName, v)
+	}
+}
+
+func TestBaseSecurityHeaders_IncludesAgentNameHeaderWhenEnvSet(t *testing.T) {
+	const agentName = "sample-agent"
+	t.Setenv(envvars.CliAgentName, agentName)
+	h := BaseSecurityHeaders()
+	if v := h.Get(HeaderAgentName); v != agentName {
+		t.Fatalf("BaseSecurityHeaders()[%s] = %q, want %q", HeaderAgentName, v, agentName)
+	}
+}
+
+func TestBaseSecurityHeaders_NoAgentNameHeaderWhenEnvInvalid(t *testing.T) {
+	t.Setenv(envvars.CliAgentName, "agent\r\nX-Evil: attack")
+	h := BaseSecurityHeaders()
+	if v := h.Get(HeaderAgentName); v != "" {
+		t.Fatalf("BaseSecurityHeaders() included %s = %q, want absent for invalid input", HeaderAgentName, v)
+	}
+}
+
 func TestBaseSecurityHeaders_NoAgentTraceHeaderWhenEnvUnset(t *testing.T) {
 	t.Setenv(envvars.CliAgentTrace, "")
 	h := BaseSecurityHeaders()

internal/cmdutil/testing_test.go

@@ -46,7 +46,7 @@ func TestTestFactory_ReplacesGlobals(t *testing.T) {
 		URL:  "/test",
 		Body: "ok",
 	})
-	// Use the stub via Factory HttpClient
+	// Use the stub via Factory HttpClient.
 	httpClient, err := f.HttpClient()
 	if err != nil {
 		t.Fatalf("HttpClient() error: %v", err)

internal/cmdutil/transport.go

@@ -4,14 +4,19 @@
 package cmdutil
 
 import (
-	"context"
 	"net/http"
 	"time"
 
-	exttransport "github.com/larksuite/cli/extension/transport"
 	"github.com/larksuite/cli/internal/transport"
 )
 
+var (
+	_ transport.RoundTripperDecorator = (*RetryTransport)(nil)
+	_ transport.RoundTripperDecorator = (*UserAgentTransport)(nil)
+	_ transport.RoundTripperDecorator = (*BuildHeaderTransport)(nil)
+	_ transport.RoundTripperDecorator = (*SecurityHeaderTransport)(nil)
+)
+
 // RetryTransport is an http.RoundTripper that retries on 5xx responses
 // and network errors. MaxRetries defaults to 0 (no retries).
 type RetryTransport struct {
@@ -27,6 +32,16 @@ func (t *RetryTransport) base() http.RoundTripper {
 	return transport.Fallback()
 }
 
+func (t *RetryTransport) BaseRoundTripper() http.RoundTripper {
+	return t.base()
+}
+
+func (t *RetryTransport) WithBaseRoundTripper(base http.RoundTripper) http.RoundTripper {
+	cloned := *t
+	cloned.Base = base
+	return &cloned
+}
+
 func (t *RetryTransport) delay() time.Duration {
 	if t.Delay > 0 {
 		return t.Delay
@@ -63,6 +78,19 @@ type UserAgentTransport struct {
 	Base http.RoundTripper
 }
 
+func (t *UserAgentTransport) BaseRoundTripper() http.RoundTripper {
+	if t.Base != nil {
+		return t.Base
+	}
+	return transport.Fallback()
+}
+
+func (t *UserAgentTransport) WithBaseRoundTripper(base http.RoundTripper) http.RoundTripper {
+	cloned := *t
+	cloned.Base = base
+	return &cloned
+}
+
 func (t *UserAgentTransport) RoundTrip(req *http.Request) (*http.Response, error) {
 	req = req.Clone(req.Context())
 	req.Header.Set(HeaderUserAgent, UserAgentValue())
@@ -73,14 +101,25 @@ func (t *UserAgentTransport) RoundTrip(req *http.Request) (*http.Response, error
 }
 
 // BuildHeaderTransport is an http.RoundTripper that force-writes the
-// X-Cli-Build header before every request. Used in the SDK transport chain,
-// where SecurityHeaderTransport is not installed, to prevent extensions from
-// tampering with the build classification. The direct HTTP chain is already
-// covered by SecurityHeaderTransport iterating BaseSecurityHeaders.
+// X-Cli-Build header before every request. It remains in the SDK transport
+// chain as a narrow defense-in-depth layer alongside SecurityHeaderTransport.
 type BuildHeaderTransport struct {
 	Base http.RoundTripper
 }
 
+func (t *BuildHeaderTransport) BaseRoundTripper() http.RoundTripper {
+	if t.Base != nil {
+		return t.Base
+	}
+	return transport.Fallback()
+}
+
+func (t *BuildHeaderTransport) WithBaseRoundTripper(base http.RoundTripper) http.RoundTripper {
+	cloned := *t
+	cloned.Base = base
+	return &cloned
+}
+
 func (t *BuildHeaderTransport) RoundTrip(req *http.Request) (*http.Response, error) {
 	req = req.Clone(req.Context())
 	req.Header.Set(HeaderBuild, DetectBuildKind())
@@ -103,6 +142,16 @@ func (t *SecurityHeaderTransport) base() http.RoundTripper {
 	return transport.Fallback()
 }
 
+func (t *SecurityHeaderTransport) BaseRoundTripper() http.RoundTripper {
+	return t.base()
+}
+
+func (t *SecurityHeaderTransport) WithBaseRoundTripper(base http.RoundTripper) http.RoundTripper {
+	cloned := *t
+	cloned.Base = base
+	return &cloned
+}
+
 // RoundTrip implements http.RoundTripper.
 func (t *SecurityHeaderTransport) RoundTrip(req *http.Request) (*http.Response, error) {
 	req = req.Clone(req.Context())
@@ -120,67 +169,3 @@ func (t *SecurityHeaderTransport) RoundTrip(req *http.Request) (*http.Response,
 	}
 	return t.base().RoundTrip(req)
 }
-
-// extensionMiddleware wraps the built-in transport chain with pre/post hooks.
-// The built-in chain always executes unless the extension is an
-// exttransport.AbortableInterceptor and its PreRoundTripE returns a non-nil
-// error; it cannot otherwise be skipped or overridden.
-//
-// The original request context is restored after the pre hook to prevent
-// extensions from tampering with cancellation, deadlines, or built-in values.
-// Cloning the request isolates header/URL/etc. mutations from the caller's
-// request object; req.Body is intentionally shared — extensions that consume
-// it are responsible for rewinding (see Interceptor doc).
-type extensionMiddleware struct {
-	Base    http.RoundTripper
-	Ext     exttransport.Interceptor
-	ExtName string // Provider.Name(), captured at wrap time for *AbortError.Extension
-}
-
-// RoundTrip invokes the interceptor pre hook, restores the original context,
-// executes the built-in chain (unless aborted), then calls the post hook if
-// non-nil. When the extension implements AbortableInterceptor and returns a
-// non-nil error from PreRoundTripE, the built-in chain is skipped and an
-// *exttransport.AbortError is returned; the post hook is still invoked with
-// (nil, reason) so extensions can unwind resources.
-func (m *extensionMiddleware) RoundTrip(req *http.Request) (*http.Response, error) {
-	origCtx := req.Context()
-	req = req.Clone(origCtx)
-
-	var (
-		post    func(*http.Response, error)
-		abortEr error
-	)
-	if a, ok := m.Ext.(exttransport.AbortableInterceptor); ok {
-		post, abortEr = a.PreRoundTripE(req)
-	} else {
-		post = m.Ext.PreRoundTrip(req)
-	}
-	if abortEr != nil {
-		if post != nil {
-			post(nil, abortEr)
-		}
-		return nil, &exttransport.AbortError{Extension: m.ExtName, Reason: abortEr}
-	}
-
-	req = req.WithContext(origCtx) // restore original context
-	resp, err := m.Base.RoundTrip(req)
-	if post != nil {
-		post(resp, err)
-	}
-	return resp, err
-}
-
-// wrapWithExtension wraps transport with the registered extension middleware.
-// If no extension is registered, returns transport unchanged.
-func wrapWithExtension(transport http.RoundTripper) http.RoundTripper {
-	p := exttransport.GetProvider()
-	if p == nil {
-		return transport
-	}
-	tr := p.ResolveInterceptor(context.Background())
-	if tr == nil {
-		return transport
-	}
-	return &extensionMiddleware{Base: transport, Ext: tr, ExtName: p.Name()}
-}

internal/cmdutil/transport_test.go

@@ -14,7 +14,8 @@ import (
 	"time"
 
 	exttransport "github.com/larksuite/cli/extension/transport"
-	internalauth "github.com/larksuite/cli/internal/auth"
+	"github.com/larksuite/cli/internal/riskcontrol"
+	internaltransport "github.com/larksuite/cli/internal/transport"
 )
 
 type roundTripFunc func(*http.Request) (*http.Response, error)
@@ -90,79 +91,107 @@ func TestRetryTransport_DefaultNoRetry(t *testing.T) {
 	}
 }
 
-// ---------------------------------------------------------------------------
-// buildSDKTransport chain composition
+// buildSDKTransport policy behavior
 // ---------------------------------------------------------------------------
 
-func TestBuildSDKTransport_IncludesRetryTransport(t *testing.T) {
-	transport := buildSDKTransport()
+func TestBuildSDKTransportAppliesSecurityHeadersToEveryRequestClass(t *testing.T) {
+	exttransport.Register(nil)
+	received := make(chan http.Header, 2)
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
+		received <- req.Header.Clone()
+		w.WriteHeader(http.StatusNoContent)
+	}))
+	t.Cleanup(server.Close)
 
-	// Chain: SecurityPolicy → BuildHeader → UserAgent → Retry → Base
-	sec, ok := transport.(*internalauth.SecurityPolicyTransport)
-	if !ok {
-		t.Fatalf("outer transport type = %T, want *auth.SecurityPolicyTransport", transport)
-	}
-	bh, ok := sec.Base.(*BuildHeaderTransport)
-	if !ok {
-		t.Fatalf("layer after SecurityPolicy = %T, want *BuildHeaderTransport", sec.Base)
-	}
-	ua, ok := bh.Base.(*UserAgentTransport)
-	if !ok {
-		t.Fatalf("layer after BuildHeader = %T, want *UserAgentTransport", bh.Base)
-	}
-	if _, ok := ua.Base.(*RetryTransport); !ok {
-		t.Fatalf("inner transport type = %T, want *RetryTransport", ua.Base)
+	for _, class := range []exttransport.RequestClass{
+		exttransport.RequestClassPlatform,
+		exttransport.RequestClassExternal,
+	} {
+		client := internaltransport.ClientForRequestClass(
+			&http.Client{Transport: buildSDKTransport(nil)},
+			class,
+		)
+		resp, err := client.Get(server.URL)
+		if err != nil {
+			t.Fatal(err)
+		}
+		resp.Body.Close()
+
+		headers := <-received
+		for header, values := range BaseSecurityHeaders() {
+			if len(values) == 0 {
+				continue
+			}
+			want := values[len(values)-1]
+			if got := headers.Get(header); got != want {
+				t.Fatalf("SDK %s header %s = %q, want %q", class, header, got, want)
+			}
+		}
 	}
 }
 
 func TestBuildSDKTransport_WithExtension(t *testing.T) {
-	exttransport.Register(&stubTransportProvider{})
-	t.Cleanup(func() { exttransport.Register(nil) })
+	previous := exttransport.GetProvider()
+	interceptor := &headerCapturingInterceptor{}
+	exttransport.Register(&platformOnlyStubProvider{
+		stubTransportProvider: &stubTransportProvider{interceptor: interceptor},
+	})
+	t.Cleanup(func() { exttransport.Register(previous) })
 
-	transport := buildSDKTransport()
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
+		w.WriteHeader(http.StatusNoContent)
+	}))
+	t.Cleanup(server.Close)
 
-	// Chain: extensionMiddleware → SecurityPolicy → BuildHeader → UserAgent → Retry → Base
-	mid, ok := transport.(*extensionMiddleware)
-	if !ok {
-		t.Fatalf("outer transport type = %T, want *extensionMiddleware", transport)
+	client := internaltransport.ClientForRequestClass(
+		&http.Client{Transport: buildSDKTransport(nil)},
+		exttransport.RequestClassPlatform,
+	)
+	resp, err := client.Get(server.URL)
+	if err != nil {
+		t.Fatal(err)
 	}
-	sec, ok := mid.Base.(*internalauth.SecurityPolicyTransport)
-	if !ok {
-		t.Fatalf("transport type = %T, want *auth.SecurityPolicyTransport", mid.Base)
-	}
-	bh, ok := sec.Base.(*BuildHeaderTransport)
-	if !ok {
-		t.Fatalf("layer after SecurityPolicy = %T, want *BuildHeaderTransport", sec.Base)
-	}
-	ua, ok := bh.Base.(*UserAgentTransport)
-	if !ok {
-		t.Fatalf("layer after BuildHeader = %T, want *UserAgentTransport", bh.Base)
-	}
-	if _, ok := ua.Base.(*RetryTransport); !ok {
-		t.Fatalf("innermost transport type = %T, want *RetryTransport", ua.Base)
+	resp.Body.Close()
+	if !interceptor.preCalled || !interceptor.postCalled {
+		t.Fatal("SDK platform request did not execute extension pre/post hooks")
 	}
 }
 
 func TestBuildSDKTransport_WithoutExtension(t *testing.T) {
+	previous := exttransport.GetProvider()
 	exttransport.Register(nil)
+	t.Cleanup(func() { exttransport.Register(previous) })
 
-	transport := buildSDKTransport()
+	if _, ok := buildSDKTransport(nil).(*internaltransport.HTTPPolicyRouter); !ok {
+		t.Fatalf(
+			"buildSDKTransport() type = %T, want *transport.HTTPPolicyRouter",
+			buildSDKTransport(nil),
+		)
+	}
+}
 
-	// Chain: SecurityPolicy → BuildHeader → UserAgent → Retry → Base
-	sec, ok := transport.(*internalauth.SecurityPolicyTransport)
+func TestBuildSDKTransportSupportsPolicyLeafCloning(t *testing.T) {
+	previous := exttransport.GetProvider()
+	exttransport.Register(nil)
+	t.Cleanup(func() { exttransport.Register(previous) })
+
+	base := &http.Transport{}
+	client := internaltransport.ClientForRequestClass(
+		&http.Client{Transport: buildSDKTransportWithBase(base, nil)},
+		exttransport.RequestClassExternal,
+	)
+	source, ok := client.Transport.(interface {
+		CloneHTTPTransport() (http.RoundTripper, *http.Transport, bool)
+	})
 	if !ok {
-		t.Fatalf("outer transport type = %T, want *auth.SecurityPolicyTransport", transport)
+		t.Fatalf("SDK request-class transport type = %T, want clone capability", client.Transport)
 	}
-	bh, ok := sec.Base.(*BuildHeaderTransport)
-	if !ok {
-		t.Fatalf("layer after SecurityPolicy = %T, want *BuildHeaderTransport", sec.Base)
+	rebuilt, concrete, ok := source.CloneHTTPTransport()
+	if !ok || rebuilt == nil || concrete == nil {
+		t.Fatal("SDK policy graph could not clone its HTTP transport leaf")
 	}
-	ua, ok := bh.Base.(*UserAgentTransport)
-	if !ok {
-		t.Fatalf("layer after BuildHeader = %T, want *UserAgentTransport", bh.Base)
-	}
-	if _, ok := ua.Base.(*RetryTransport); !ok {
-		t.Fatalf("inner transport type = %T, want *RetryTransport", ua.Base)
+	if concrete == base {
+		t.Fatal("SDK policy graph reused the original HTTP transport")
 	}
 }
 
@@ -222,7 +251,7 @@ func TestExtensionInterceptor_ExecutionOrder(t *testing.T) {
 	var base http.RoundTripper = http.DefaultTransport
 	base = &RetryTransport{Base: base}
 	base = &SecurityHeaderTransport{Base: base}
-	transport := wrapWithExtension(base)
+	transport := internaltransport.WrapWithExtension(base)
 	client := &http.Client{Transport: transport}
 
 	req, _ := http.NewRequest("GET", srv.URL, nil)
@@ -250,26 +279,132 @@ func TestExtensionInterceptor_ExecutionOrder(t *testing.T) {
 	}
 }
 
-// buildTamperingInterceptor tries to delete and spoof X-Cli-Build via
-// PreRoundTrip. The SDK chain's BuildHeaderTransport must restore the real
-// value before the request leaves the process.
+// buildTamperingInterceptor tries to delete and spoof security headers via
+// PreRoundTrip. The SDK built-in chain must restore the real values before the
+// request leaves the process.
 type buildTamperingInterceptor struct{}
 
 func (buildTamperingInterceptor) PreRoundTrip(req *http.Request) func(*http.Response, error) {
 	req.Header.Del(HeaderBuild)
 	req.Header.Set(HeaderBuild, "ext-tampered-build")
+	req.Header.Del(HeaderSource)
+	req.Header.Set(HeaderSource, "ext-tampered-source")
 	return nil
 }
 
+type riskHeaderTamperingInterceptor struct{}
+
+func (riskHeaderTamperingInterceptor) PreRoundTrip(req *http.Request) func(*http.Response, error) {
+	req.Header.Set(riskcontrol.HeaderOSType, "extension-value")
+	req.Header.Set(riskcontrol.HeaderProductModel, "extension-value")
+	return nil
+}
+
+type bootstrapPolicyTamperingInterceptor struct{}
+
+func (bootstrapPolicyTamperingInterceptor) PreRoundTrip(req *http.Request) func(*http.Response, error) {
+	req.Header.Set(HeaderSource, "extension-value")
+	req.Header.Set(riskcontrol.HeaderOSType, "extension-value")
+	return nil
+}
+
+func TestNewDefaultInstallsSDKBootstrapSecurityPolicy(t *testing.T) {
+	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
+	oldTransport := http.DefaultClient.Transport
+	oldCheckRedirect := http.DefaultClient.CheckRedirect
+	t.Cleanup(func() {
+		http.DefaultClient.Transport = oldTransport
+		http.DefaultClient.CheckRedirect = oldCheckRedirect
+	})
+
+	previous := exttransport.GetProvider()
+	exttransport.Register(&platformOnlyStubProvider{
+		stubTransportProvider: &stubTransportProvider{
+			interceptor: bootstrapPolicyTamperingInterceptor{},
+		},
+	})
+	t.Cleanup(func() { exttransport.Register(previous) })
+
+	var received http.Header
+	network := roundTripFunc(func(req *http.Request) (*http.Response, error) {
+		received = req.Header.Clone()
+		return &http.Response{
+			StatusCode: http.StatusNoContent,
+			Body:       http.NoBody,
+			Request:    req,
+		}, nil
+	})
+	http.DefaultClient.Transport = network
+	http.DefaultClient.CheckRedirect = nil
+	_ = NewDefault(nil, InvocationContext{})
+
+	req, err := http.NewRequest(
+		http.MethodPost,
+		"https://open.feishu.cn/callback/ws/endpoint",
+		strings.NewReader(`{"app_secret":"secret"}`),
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		t.Fatal(err)
+	}
+	resp.Body.Close()
+
+	if got := received.Get(HeaderSource); got != SourceValue {
+		t.Fatalf("%s = %q, want trusted value %q", HeaderSource, got, SourceValue)
+	}
+	if got := received.Get(riskcontrol.HeaderOSType); got != "" {
+		t.Fatalf("%s = %q, want extension value stripped", riskcontrol.HeaderOSType, got)
+	}
+	if got := received.Get(HeaderBuild); got != DetectBuildKind() {
+		t.Fatalf("%s = %q, want %q", HeaderBuild, got, DetectBuildKind())
+	}
+	if got := received.Get(HeaderUserAgent); got != UserAgentValue() {
+		t.Fatalf("%s = %q, want %q", HeaderUserAgent, got, UserAgentValue())
+	}
+}
+
+func TestBuildSDKTransport_StripsExtensionRiskHeaders(t *testing.T) {
+	previous := exttransport.GetProvider()
+	exttransport.Register(&stubTransportProvider{interceptor: riskHeaderTamperingInterceptor{}})
+	t.Cleanup(func() { exttransport.Register(previous) })
+
+	var received http.Header
+	network := roundTripFunc(func(req *http.Request) (*http.Response, error) {
+		received = req.Header.Clone()
+		return &http.Response{StatusCode: http.StatusOK, Body: http.NoBody}, nil
+	})
+	req, err := http.NewRequest(http.MethodGet, "https://open.feishu.cn/open-apis/test", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	req.Header.Set("Authorization", "Bearer token")
+
+	client := internaltransport.ClientForRequestClass(
+		&http.Client{Transport: buildSDKTransportWithBase(network, nil)},
+		exttransport.RequestClassPlatform,
+	)
+	resp, err := client.Do(req)
+	if err != nil {
+		t.Fatal(err)
+	}
+	resp.Body.Close()
+	if received.Get(riskcontrol.HeaderOSType) != "" || received.Get(riskcontrol.HeaderProductModel) != "" {
+		t.Fatalf("extension risk headers reached network: %v", received)
+	}
+}
+
 // TestBuildHeaderTransport_SDKChain_OverridesTamperedHeader verifies that the
-// X-Cli-Build header is force-written by BuildHeaderTransport in the SDK
-// transport chain, even when an extension tries to delete or spoof it. This
-// closes the gap where the SDK chain had no equivalent of
-// SecurityHeaderTransport (see design doc §3.3.3).
+// SDK chain restores both the build classification and the full security
+// header set after an extension runs.
 func TestBuildHeaderTransport_SDKChain_OverridesTamperedHeader(t *testing.T) {
-	var receivedBuild string
+	var receivedBuild, receivedSource string
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		receivedBuild = r.Header.Get(HeaderBuild)
+		receivedSource = r.Header.Get(HeaderSource)
 		w.WriteHeader(http.StatusOK)
 	}))
 	defer srv.Close()
@@ -277,12 +412,13 @@ func TestBuildHeaderTransport_SDKChain_OverridesTamperedHeader(t *testing.T) {
 	exttransport.Register(&stubTransportProvider{interceptor: buildTamperingInterceptor{}})
 	t.Cleanup(func() { exttransport.Register(nil) })
 
-	// Replicate the SDK chain layering used by buildSDKTransport.
+	// Replicate the SDK built-in chain inside buildSDKTransport.
 	var base http.RoundTripper = http.DefaultTransport
 	base = &RetryTransport{Base: base}
 	base = &UserAgentTransport{Base: base}
 	base = &BuildHeaderTransport{Base: base}
-	transport := wrapWithExtension(base)
+	base = &SecurityHeaderTransport{Base: base}
+	transport := internaltransport.WrapWithExtension(base)
 	client := &http.Client{Transport: transport}
 
 	req, _ := http.NewRequest("GET", srv.URL, nil)
@@ -299,6 +435,9 @@ func TestBuildHeaderTransport_SDKChain_OverridesTamperedHeader(t *testing.T) {
 	if receivedBuild != want {
 		t.Fatalf("%s = %q, want %q", HeaderBuild, receivedBuild, want)
 	}
+	if receivedSource != SourceValue {
+		t.Fatalf("%s = %q, want %q", HeaderSource, receivedSource, SourceValue)
+	}
 }
 
 // TestBuildHeaderTransport_OverridesEvenWithoutTamper verifies that even if
@@ -388,7 +527,7 @@ func TestExtensionInterceptor_ContextTamperPrevented(t *testing.T) {
 		return nil
 	})
 
-	mid := &extensionMiddleware{Base: capturer, Ext: tamperIC}
+	mid := &internaltransport.ExtensionMiddleware{Base: capturer, Ext: tamperIC}
 
 	origCtx := context.WithValue(context.Background(), testKey, "original")
 	req, _ := http.NewRequestWithContext(origCtx, "GET", srv.URL, nil)
@@ -450,7 +589,7 @@ func TestExtensionMiddleware_PreRoundTripEAbort(t *testing.T) {
 			return &http.Response{StatusCode: http.StatusOK, Body: http.NoBody}, nil
 		})
 
-		mid := &extensionMiddleware{Base: base, Ext: ic, ExtName: "stub"}
+		mid := &internaltransport.ExtensionMiddleware{Base: base, Ext: ic, ExtName: "stub"}
 		req, _ := http.NewRequest("GET", "http://example.invalid/", nil)
 		resp, err := mid.RoundTrip(req)
 
@@ -491,7 +630,7 @@ func TestExtensionMiddleware_PreRoundTripEAbort(t *testing.T) {
 			return nil, nil
 		})
 
-		mid := &extensionMiddleware{Base: base, Ext: ic, ExtName: "stub"}
+		mid := &internaltransport.ExtensionMiddleware{Base: base, Ext: ic, ExtName: "stub"}
 		req, _ := http.NewRequest("GET", "http://example.invalid/", nil)
 		_, err := mid.RoundTrip(req)
 
@@ -510,7 +649,7 @@ func TestExtensionMiddleware_PreRoundTripEHappyPath(t *testing.T) {
 		return &http.Response{StatusCode: http.StatusOK, Body: http.NoBody}, nil
 	})
 
-	mid := &extensionMiddleware{Base: base, Ext: ic, ExtName: "stub"}
+	mid := &internaltransport.ExtensionMiddleware{Base: base, Ext: ic, ExtName: "stub"}
 	req, _ := http.NewRequest("GET", "http://example.invalid/", nil)
 	resp, err := mid.RoundTrip(req)
 	if err != nil {

internal/core/config.go

@@ -60,11 +60,18 @@ func (a *AppConfig) ProfileName() string {
 // MultiAppConfig is the multi-app config file format.
 type MultiAppConfig struct {
 	StrictMode  StrictMode  `json:"strictMode,omitempty"`
+	RiskControl *bool       `json:"riskControl,omitempty"`
 	CurrentApp  string      `json:"currentApp,omitempty"`
 	PreviousApp string      `json:"previousApp,omitempty"`
 	Apps        []AppConfig `json:"apps"`
 }
 
+// RiskControlEnabled resolves the workspace policy. An omitted preference
+// keeps the default-on account-protection behavior.
+func (m *MultiAppConfig) RiskControlEnabled() bool {
+	return m != nil && (m.RiskControl == nil || *m.RiskControl)
+}
+
 // CurrentAppConfig returns the currently active app config.
 // Resolution priority: profileOverride > CurrentApp field > Apps[0].
 func (m *MultiAppConfig) CurrentAppConfig(profileOverride string) *AppConfig {

internal/core/config_snapshot.go

@@ -0,0 +1,37 @@
+// Copyright (c) 2026 Lark Technologies Pte. Ltd.
+// SPDX-License-Identifier: MIT
+
+package core
+
+import (
+	"io/fs"
+	"sync"
+)
+
+// ConfigSnapshot lazily captures one stable view of config.json for a CLI
+// invocation. All runtime consumers share the same load result so account and
+// workspace policy resolution cannot observe different file revisions. Callers
+// must treat the returned config as read-only.
+type ConfigSnapshot struct {
+	load func() (*MultiAppConfig, error)
+}
+
+// NewConfigSnapshot creates a lazily loaded invocation-scoped config snapshot.
+func NewConfigSnapshot() *ConfigSnapshot {
+	return newConfigSnapshot(LoadMultiAppConfig)
+}
+
+func newConfigSnapshot(load func() (*MultiAppConfig, error)) *ConfigSnapshot {
+	if load == nil {
+		return &ConfigSnapshot{}
+	}
+	return &ConfigSnapshot{load: sync.OnceValues(load)}
+}
+
+// MultiAppConfig returns the captured persistent config and load error.
+func (s *ConfigSnapshot) MultiAppConfig() (*MultiAppConfig, error) {
+	if s == nil || s.load == nil {
+		return nil, fs.ErrNotExist
+	}
+	return s.load()
+}

internal/core/config_snapshot_test.go

@@ -0,0 +1,58 @@
+// Copyright (c) 2026 Lark Technologies Pte. Ltd.
+// SPDX-License-Identifier: MIT
+
+package core
+
+import (
+	"errors"
+	"io/fs"
+	"testing"
+)
+
+func TestConfigSnapshotLoadsOnce(t *testing.T) {
+	calls := 0
+	want := &MultiAppConfig{}
+	snapshot := newConfigSnapshot(func() (*MultiAppConfig, error) {
+		calls++
+		return want, nil
+	})
+
+	for range 2 {
+		config, err := snapshot.MultiAppConfig()
+		if err != nil {
+			t.Fatal(err)
+		}
+		if config != want {
+			t.Fatal("snapshot returned a different config instance")
+		}
+	}
+	if calls != 1 {
+		t.Fatalf("config loads = %d, want 1", calls)
+	}
+}
+
+func TestConfigSnapshotZeroValueIsMissing(t *testing.T) {
+	config, err := (&ConfigSnapshot{}).MultiAppConfig()
+	if config != nil || !errors.Is(err, fs.ErrNotExist) {
+		t.Fatalf("MultiAppConfig() = (%v, %v), want (nil, fs.ErrNotExist)", config, err)
+	}
+}
+
+func TestConfigSnapshotCachesError(t *testing.T) {
+	calls := 0
+	want := errors.New("load failed")
+	snapshot := newConfigSnapshot(func() (*MultiAppConfig, error) {
+		calls++
+		return nil, want
+	})
+
+	for range 2 {
+		config, err := snapshot.MultiAppConfig()
+		if config != nil || !errors.Is(err, want) {
+			t.Fatalf("MultiAppConfig() = (%v, %v), want (nil, %v)", config, err, want)
+		}
+	}
+	if calls != 1 {
+		t.Fatalf("config loads = %d, want 1", calls)
+	}
+}

internal/core/config_test.go

@@ -60,7 +60,9 @@ func TestAppConfig_LangOmitEmpty(t *testing.T) {
 }
 
 func TestMultiAppConfig_RoundTrip(t *testing.T) {
+	disabled := false
 	config := &MultiAppConfig{
+		RiskControl: &disabled,
 		Apps: []AppConfig{{
 			AppId: "cli_test", AppSecret: PlainSecret("s"),
 			Brand: BrandLark, Lang: "zh", Users: []AppUser{},
@@ -84,6 +86,9 @@ func TestMultiAppConfig_RoundTrip(t *testing.T) {
 	if got.Apps[0].Brand != BrandLark {
 		t.Errorf("Brand = %q, want %q", got.Apps[0].Brand, BrandLark)
 	}
+	if got.RiskControl == nil || *got.RiskControl {
+		t.Errorf("RiskControl = %v, want explicit false", got.RiskControl)
+	}
 }
 
 func TestResolveConfigFromMulti_RejectsSecretKeyMismatch(t *testing.T) {

internal/core/types.go

@@ -3,7 +3,10 @@
 
 package core
 
-import "strings"
+import (
+	"net/url"
+	"strings"
+)
 
 // LarkBrand represents the Lark platform brand.
 // "feishu" targets China-mainland, "lark" targets international.
@@ -63,3 +66,39 @@ func ResolveEndpoints(brand LarkBrand) Endpoints {
 func ResolveOpenBaseURL(brand LarkBrand) string {
 	return ResolveEndpoints(brand).Open
 }
+
+var platformEndpointHosts = func() map[string]struct{} {
+	hosts := make(map[string]struct{})
+	for _, brand := range []LarkBrand{BrandFeishu, BrandLark} {
+		endpoints := ResolveEndpoints(brand)
+		for _, rawURL := range []string{endpoints.Open, endpoints.Accounts, endpoints.MCP, endpoints.AppLink} {
+			parsed, err := url.Parse(rawURL)
+			if err == nil && parsed.Hostname() != "" {
+				hosts[strings.ToLower(parsed.Hostname())] = struct{}{}
+			}
+		}
+	}
+	return hosts
+}()
+
+// IsPlatformEndpointHost reports whether hostname exactly matches one of the
+// endpoint hosts produced by ResolveEndpoints. It intentionally does not use a
+// suffix match: lookalike external domains must never enter the platform
+// transport extension.
+func IsPlatformEndpointHost(hostname string) bool {
+	_, ok := platformEndpointHosts[strings.ToLower(hostname)]
+	return ok
+}
+
+// IsPlatformEndpointURL reports whether candidate uses a secure origin for a
+// configured platform endpoint. Non-TLS and non-standard-port lookalikes are
+// excluded even when their hostname matches.
+func IsPlatformEndpointURL(candidate *url.URL) bool {
+	if candidate == nil || !strings.EqualFold(candidate.Scheme, "https") {
+		return false
+	}
+	if port := candidate.Port(); port != "" && port != "443" {
+		return false
+	}
+	return IsPlatformEndpointHost(candidate.Hostname())
+}

internal/core/types_test.go

@@ -3,7 +3,11 @@
 
 package core
 
-import "testing"
+import (
+	"net/url"
+	"reflect"
+	"testing"
+)
 
 func TestResolveEndpoints_Feishu(t *testing.T) {
 	ep := ResolveEndpoints(BrandFeishu)
@@ -91,3 +95,85 @@ func TestResolveEndpoints_NormalizesBrand(t *testing.T) {
 		t.Errorf("ResolveEndpoints(unexpected).Open = %q, want the feishu default", got)
 	}
 }
+
+func TestIsPlatformEndpointHost_ExactMatchOnly(t *testing.T) {
+	for _, host := range []string{
+		"open.feishu.cn",
+		"accounts.feishu.cn",
+		"mcp.feishu.cn",
+		"applink.feishu.cn",
+		"open.larksuite.com",
+		"accounts.larksuite.com",
+		"mcp.larksuite.com",
+		"applink.larksuite.com",
+	} {
+		if !IsPlatformEndpointHost(host) {
+			t.Errorf("IsPlatformEndpointHost(%q) = false, want true", host)
+		}
+	}
+
+	for _, host := range []string{
+		"example.com",
+		"open.feishu.cn.example.com",
+		"notopen.feishu.cn",
+		"",
+	} {
+		if IsPlatformEndpointHost(host) {
+			t.Errorf("IsPlatformEndpointHost(%q) = true, want false", host)
+		}
+	}
+}
+
+func TestIsPlatformEndpointHost_CoversEveryResolvedEndpoint(t *testing.T) {
+	for _, brand := range []LarkBrand{BrandFeishu, BrandLark} {
+		endpoints := reflect.ValueOf(ResolveEndpoints(brand))
+		for i := 0; i < endpoints.NumField(); i++ {
+			rawURL := endpoints.Field(i).String()
+			parsed, err := url.Parse(rawURL)
+			if err != nil {
+				t.Fatalf("ResolveEndpoints(%q) field %d URL %q: %v", brand, i, rawURL, err)
+			}
+			if !IsPlatformEndpointHost(parsed.Hostname()) {
+				t.Errorf("ResolveEndpoints(%q) field %d host %q is missing from the platform transport boundary", brand, i, parsed.Hostname())
+			}
+		}
+	}
+}
+
+func TestIsPlatformEndpointURL_RequiresSecureStandardOrigin(t *testing.T) {
+	if IsPlatformEndpointURL(nil) {
+		t.Error("IsPlatformEndpointURL(nil) = true, want false")
+	}
+	uppercaseScheme := &url.URL{Scheme: "HTTPS", Host: "open.feishu.cn", Path: "/path"}
+	if !IsPlatformEndpointURL(uppercaseScheme) {
+		t.Error("IsPlatformEndpointURL() rejected uppercase HTTPS scheme")
+	}
+
+	for _, rawURL := range []string{
+		"http://open.feishu.cn/path",
+		"https://open.feishu.cn:8443/path",
+		"https://open.feishu.cn.example.com/path",
+	} {
+		candidate, err := url.Parse(rawURL)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if IsPlatformEndpointURL(candidate) {
+			t.Errorf("IsPlatformEndpointURL(%q) = true, want false", rawURL)
+		}
+	}
+
+	for _, rawURL := range []string{
+		"https://open.feishu.cn/path",
+		"https://open.feishu.cn:443/path",
+		"https://OPEN.FEISHU.CN/path",
+	} {
+		candidate, err := url.Parse(rawURL)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if !IsPlatformEndpointURL(candidate) {
+			t.Errorf("IsPlatformEndpointURL(%q) = false, want true", rawURL)
+		}
+	}
+}

internal/envvars/read_test.go

@@ -16,16 +16,18 @@ func TestAgentName_EmptyWhenEnvUnset(t *testing.T) {
 }
 
 func TestAgentName_ReturnsCleanValue(t *testing.T) {
-	t.Setenv(CliAgentName, "claude-code")
-	if got := AgentName(); got != "claude-code" {
-		t.Fatalf("AgentName() = %q, want %q", got, "claude-code")
+	const agentName = "sample-agent"
+	t.Setenv(CliAgentName, agentName)
+	if got := AgentName(); got != agentName {
+		t.Fatalf("AgentName() = %q, want %q", got, agentName)
 	}
 }
 
 func TestAgentName_TrimsWhitespace(t *testing.T) {
-	t.Setenv(CliAgentName, "  cursor  ")
-	if got := AgentName(); got != "cursor" {
-		t.Fatalf("AgentName() = %q, want %q (whitespace trimmed)", got, "cursor")
+	const agentName = "sample-agent"
+	t.Setenv(CliAgentName, "  "+agentName+"  ")
+	if got := AgentName(); got != agentName {
+		t.Fatalf("AgentName() = %q, want %q (whitespace trimmed)", got, agentName)
 	}
 }
 

internal/httpmock/registry.go

@@ -38,6 +38,10 @@ type Stub struct {
 	// matches after the first hit. Each match appends to CapturedBodies.
 	Reusable bool
 
+	// Optional (optional): when true, Verify does not require this stub to be
+	// matched. Useful for negative assertions via OnMatch.
+	Optional bool
+
 	// CapturedHeaders records the request headers of the matched request.
 	// Populated after RoundTrip matches this stub.
 	CapturedHeaders http.Header
@@ -137,6 +141,9 @@ func (r *Registry) Verify(t testing.TB) {
 		if s.matched {
 			continue
 		}
+		if s.Optional {
+			continue
+		}
 		// Reusable stubs never set s.matched; treat any captured hit as a match.
 		if s.Reusable && len(s.CapturedBodies) > 0 {
 			continue

internal/output/emit.go

@@ -4,7 +4,6 @@
 package output
 
 import (
-	"context"
 	"errors"
 	"fmt"
 	"io"
@@ -16,19 +15,17 @@ import (
 
 // ScanResult holds the output of ScanForSafety.
 type ScanResult struct {
-	Alert      *extcs.Alert
-	Blocked    bool
-	BlockErr   error
-	scanFailed bool
+	Alert    *extcs.Alert
+	Blocked  bool
+	BlockErr error
 }
 
-// ScanForSafety scans structured response data.
+// ScanForSafety runs content-safety scanning on the given data.
+// cmdPath is the raw cobra CommandPath().
+// When MODE=off, no provider registered, or the command is not allowlisted,
+// returns a zero ScanResult.
 func ScanForSafety(cmdPath string, data any, errOut io.Writer) ScanResult {
-	return scanForSafetyMode(cmdPath, data, errOut, false, modeFromEnv(errOut), defaultContentSafetyContext)
-}
-
-func scanForSafetyMode(cmdPath string, data any, errOut io.Writer, fullText bool, m mode, newScanContext scanContextFactory) ScanResult {
-	alert, csErr := runContentSafety(cmdPath, data, errOut, fullText, m, newScanContext)
+	alert, csErr := runContentSafety(cmdPath, data, errOut)
 	if errors.Is(csErr, errBlocked) {
 		return ScanResult{
 			Alert:    alert,
@@ -36,18 +33,10 @@ func scanForSafetyMode(cmdPath string, data any, errOut io.Writer, fullText bool
 			BlockErr: wrapBlockError(alert),
 		}
 	}
-	if errors.Is(csErr, errScanIncomplete) {
-		return ScanResult{
-			Blocked:  true,
-			BlockErr: wrapScanIncompleteError(csErr),
-		}
-	}
-	if errors.Is(csErr, errScanFailed) {
-		return ScanResult{scanFailed: true}
-	}
 	return ScanResult{Alert: alert}
 }
 
+// wrapBlockError creates a typed error for content-safety block.
 func wrapBlockError(alert *extcs.Alert) error {
 	var matchedRules []string
 	if alert != nil {
@@ -59,16 +48,8 @@ func wrapBlockError(alert *extcs.Alert) error {
 		WithCause(errBlocked)
 }
 
-func wrapScanIncompleteError(cause error) error {
-	message := "content-safety scan did not complete; blocked (block mode)"
-	if errors.Is(cause, context.DeadlineExceeded) {
-		message = "content-safety scan did not complete in time; blocked (block mode)"
-	}
-	return errs.NewContentSafetyError(errs.SubtypeContentSafety, "%s", message).
-		WithCause(cause)
-}
-
-// WriteAlertWarning writes a content-safety warning.
+// WriteAlertWarning writes a human-readable content-safety warning to w.
+// Used by non-JSON output paths (pretty, table, csv) in warn mode.
 func WriteAlertWarning(w io.Writer, alert *extcs.Alert) error {
 	if alert == nil {
 		return nil

internal/output/emit_core.go

@@ -6,7 +6,6 @@ package output
 import (
 	"bytes"
 	"context"
-	"errors"
 	"fmt"
 	"io"
 	"os"
@@ -25,15 +24,11 @@ const (
 	modeBlock
 )
 
-// scanTimeout also bounds untruncated rendered-text scans.
+// scanTimeout caps the content-safety scan so it cannot dominate CLI latency.
+// 100 ms is generous for a regex walk of a typical API response (KB-scale JSON);
+// larger responses hit maxDepth/maxStringBytes well before this fires.
 const scanTimeout = 100 * time.Millisecond
 
-type scanContextFactory func() (context.Context, context.CancelFunc)
-
-func defaultContentSafetyContext() (context.Context, context.CancelFunc) {
-	return context.WithTimeout(context.Background(), scanTimeout)
-}
-
 // modeFromEnv reads LARKSUITE_CLI_CONTENT_SAFETY_MODE.
 func modeFromEnv(errOut io.Writer) mode {
 	raw := strings.TrimSpace(os.Getenv(envvars.CliContentSafetyMode))
@@ -71,13 +66,11 @@ func normalizeCommandPath(cobraPath string) string {
 	return strings.Join(segs, ".")
 }
 
-var (
-	errBlocked        = errors.New("content safety blocked")
-	errScanFailed     = errors.New("content safety scan failed")
-	errScanIncomplete = errors.New("content safety scan incomplete")
-)
+var errBlocked = fmt.Errorf("content safety blocked")
 
-func runContentSafety(cobraPath string, data any, errOut io.Writer, fullText bool, m mode, newScanContext scanContextFactory) (*extcs.Alert, error) {
+// runContentSafety orchestrates the scan: mode check -> provider -> scan with timeout + panic recovery.
+func runContentSafety(cobraPath string, data any, errOut io.Writer) (*extcs.Alert, error) {
+	m := modeFromEnv(errOut)
 	if m == modeOff {
 		return nil, nil
 	}
@@ -92,28 +85,17 @@ func runContentSafety(cobraPath string, data any, errOut io.Writer, fullText boo
 		return nil, nil
 	}
 
-	scan := p.Scan
-	if m == modeBlock {
-		fullTextProvider, ok := p.(extcs.FullTextProvider)
-		if !ok {
-			return nil, fmt.Errorf("%w: provider %q does not support complete scans",
-				errScanIncomplete, p.Name())
-		}
-		scan = fullTextProvider.ScanFullText
-	}
-
 	type result struct {
 		alert *extcs.Alert
 		err   error
 	}
 	ch := make(chan result, 1)
-	if newScanContext == nil {
-		newScanContext = defaultContentSafetyContext
-	}
-	ctx, cancel := newScanContext()
+	ctx, cancel := context.WithTimeout(context.Background(), scanTimeout)
 	defer cancel()
 
-	// A timed-out provider may outlive this call, so it cannot share errOut.
+	// Give the goroutine its own writer so it cannot race on errOut after timeout.
+	// On success, we copy any provider notices to the real errOut.
+	// On timeout, the buffer is owned by the goroutine until it finishes; no shared access.
 	scanErrBuf := &bytes.Buffer{}
 	go func() {
 		defer func() {
@@ -121,12 +103,7 @@ func runContentSafety(cobraPath string, data any, errOut io.Writer, fullText boo
 				ch <- result{nil, fmt.Errorf("content safety panic: %v", r)}
 			}
 		}()
-		a, e := scan(ctx, extcs.ScanRequest{
-			Path:     cmdPath,
-			Data:     data,
-			ErrOut:   scanErrBuf,
-			FullText: fullText,
-		})
+		a, e := p.Scan(ctx, extcs.ScanRequest{Path: cmdPath, Data: data, ErrOut: scanErrBuf})
 		ch <- result{a, e}
 	}()
 
@@ -136,22 +113,13 @@ func runContentSafety(cobraPath string, data any, errOut io.Writer, fullText boo
 		if scanErrBuf.Len() > 0 {
 			_, _ = io.Copy(errOut, scanErrBuf)
 		}
-		if ctx.Err() != nil && m == modeBlock {
-			return nil, fmt.Errorf("%w: %w", errScanIncomplete, ctx.Err())
-		}
 	case <-ctx.Done():
-		if m == modeBlock {
-			return nil, fmt.Errorf("%w: %w", errScanIncomplete, ctx.Err())
-		}
-		return nil, fmt.Errorf("%w: %w", errScanFailed, ctx.Err())
+		return nil, nil // timeout, fail-open; scanErrBuf stays with the goroutine
 	}
 
 	if res.err != nil {
 		fmt.Fprintf(errOut, "warning: content safety scan error: %v\n", res.err)
-		if m == modeBlock {
-			return nil, fmt.Errorf("%w: %w", errScanIncomplete, res.err)
-		}
-		return nil, fmt.Errorf("%w: %w", errScanFailed, res.err)
+		return nil, nil // fail-open
 	}
 	if res.alert == nil {
 		return nil, nil

internal/output/emit_test.go

@@ -8,7 +8,6 @@ import (
 	"context"
 	"errors"
 	"strings"
-	"sync/atomic"
 	"testing"
 	"time"
 
@@ -23,70 +22,11 @@ type mockProvider struct {
 	err   error
 }
 
-type resultFirstCanceledContext struct {
-	selectDone      chan struct{}
-	providerDone    chan struct{}
-	selectWaiting   chan struct{}
-	doneCallCounter atomic.Int32
-}
-
-func newResultFirstCanceledContext() *resultFirstCanceledContext {
-	providerDone := make(chan struct{})
-	close(providerDone)
-	return &resultFirstCanceledContext{
-		selectDone:    make(chan struct{}),
-		providerDone:  providerDone,
-		selectWaiting: make(chan struct{}),
-	}
-}
-
-func (c *resultFirstCanceledContext) Deadline() (time.Time, bool) {
-	return time.Time{}, false
-}
-
-func (c *resultFirstCanceledContext) Done() <-chan struct{} {
-	if c.doneCallCounter.Add(1) == 1 {
-		close(c.selectWaiting)
-		return c.selectDone
-	}
-	return c.providerDone
-}
-
-func (c *resultFirstCanceledContext) Err() error {
-	return context.DeadlineExceeded
-}
-
-func (c *resultFirstCanceledContext) Value(any) any {
-	return nil
-}
-
-type abortedCleanProvider struct {
-	selectWaiting <-chan struct{}
-}
-
-func (p *abortedCleanProvider) Name() string {
-	return "aborted-clean"
-}
-
-func (p *abortedCleanProvider) Scan(ctx context.Context, _ extcs.ScanRequest) (*extcs.Alert, error) {
-	<-p.selectWaiting
-	<-ctx.Done()
-	return nil, nil
-}
-
-func (p *abortedCleanProvider) ScanFullText(ctx context.Context, req extcs.ScanRequest) (*extcs.Alert, error) {
-	return p.Scan(ctx, req)
-}
-
 func (m *mockProvider) Name() string { return m.name }
 func (m *mockProvider) Scan(_ context.Context, _ extcs.ScanRequest) (*extcs.Alert, error) {
 	return m.alert, m.err
 }
 
-func (m *mockProvider) ScanFullText(ctx context.Context, req extcs.ScanRequest) (*extcs.Alert, error) {
-	return m.Scan(ctx, req)
-}
-
 func TestScanForSafety_ModeOff(t *testing.T) {
 	t.Setenv("LARKSUITE_CLI_CONTENT_SAFETY_MODE", "off")
 	var buf bytes.Buffer
@@ -162,131 +102,36 @@ func TestScanForSafety_NoProvider(t *testing.T) {
 	}
 }
 
-func TestScanForSafety_ScanError_ModeBehavior(t *testing.T) {
-	for _, tt := range []struct {
-		name        string
-		mode        string
-		wantBlocked bool
-		wantWarning bool
-	}{
-		{name: "block fails closed", mode: "block", wantBlocked: true, wantWarning: true},
-		{name: "warn fails open", mode: "warn", wantWarning: true},
-		{name: "off skips scan", mode: "off"},
-	} {
-		t.Run(tt.name, func(t *testing.T) {
-			t.Setenv("LARKSUITE_CLI_CONTENT_SAFETY_MODE", tt.mode)
-			mp := &mockProvider{name: "mock", err: errors.New("scan broke")}
-			extcs.Register(mp)
-			t.Cleanup(func() { extcs.Register(nil) })
+func TestScanForSafety_ScanError_FailOpen(t *testing.T) {
+	t.Setenv("LARKSUITE_CLI_CONTENT_SAFETY_MODE", "block")
+	mp := &mockProvider{name: "mock", err: errors.New("scan broke")}
+	extcs.Register(mp)
+	defer extcs.Register(nil)
 
-			var buf bytes.Buffer
-			result := ScanForSafety("lark-cli im +test", map[string]any{}, &buf)
-			if result.Blocked != tt.wantBlocked {
-				t.Fatalf("Blocked = %v, want %v", result.Blocked, tt.wantBlocked)
-			}
-			if tt.wantBlocked {
-				var safetyErr *errs.ContentSafetyError
-				if !errors.As(result.BlockErr, &safetyErr) {
-					t.Fatalf("BlockErr = %T, want *errs.ContentSafetyError", result.BlockErr)
-				}
-				if !strings.Contains(safetyErr.Message, "scan did not complete") {
-					t.Fatalf("BlockErr message = %q, want scan-incomplete message", safetyErr.Message)
-				}
-				if !errors.Is(result.BlockErr, errScanIncomplete) {
-					t.Fatal("BlockErr should preserve errScanIncomplete cause")
-				}
-			}
-			if got := strings.Contains(buf.String(), "scan error"); got != tt.wantWarning {
-				t.Fatalf("scan warning present = %v, want %v; stderr=%q", got, tt.wantWarning, buf.String())
-			}
-		})
+	var buf bytes.Buffer
+	result := ScanForSafety("lark-cli im +test", map[string]any{}, &buf)
+	if result.Blocked {
+		t.Error("scan error should fail-open, not block")
+	}
+	if !strings.Contains(buf.String(), "scan error") {
+		t.Errorf("expected warning on stderr, got: %s", buf.String())
 	}
 }
 
-func TestScanForSafety_SlowProvider_TimeoutModeBehavior(t *testing.T) {
-	for _, tt := range []struct {
-		name        string
-		mode        string
-		wantBlocked bool
-	}{
-		{name: "block fails closed", mode: "block", wantBlocked: true},
-		{name: "warn fails open", mode: "warn"},
-	} {
-		t.Run(tt.name, func(t *testing.T) {
-			t.Setenv("LARKSUITE_CLI_CONTENT_SAFETY_MODE", tt.mode)
-			extcs.Register(&slowProvider{})
-			t.Cleanup(func() { extcs.Register(nil) })
+func TestScanForSafety_SlowProvider_Timeout_FailOpen(t *testing.T) {
+	t.Setenv("LARKSUITE_CLI_CONTENT_SAFETY_MODE", "block")
 
-			var buf bytes.Buffer
-			result := ScanForSafety("lark-cli im +test", map[string]any{}, &buf)
-			if result.Blocked != tt.wantBlocked {
-				t.Fatalf("Blocked = %v, want %v", result.Blocked, tt.wantBlocked)
-			}
-			if result.Alert != nil {
-				t.Error("slow provider should return nil alert on timeout")
-			}
-			if tt.wantBlocked {
-				var safetyErr *errs.ContentSafetyError
-				if !errors.As(result.BlockErr, &safetyErr) {
-					t.Fatalf("BlockErr = %T, want *errs.ContentSafetyError", result.BlockErr)
-				}
-				if !strings.Contains(safetyErr.Message, "did not complete in time") {
-					t.Fatalf("BlockErr message = %q, want timeout message", safetyErr.Message)
-				}
-			}
-		})
+	slow := &slowProvider{}
+	extcs.Register(slow)
+	defer extcs.Register(nil)
+
+	var buf bytes.Buffer
+	result := ScanForSafety("lark-cli im +test", map[string]any{}, &buf)
+	if result.Blocked {
+		t.Error("slow provider should fail-open on timeout, not block")
 	}
-}
-
-func TestEmitterAbortedCleanLookingScanModeBehavior(t *testing.T) {
-	tests := []struct {
-		name        string
-		mode        string
-		wantBlocked bool
-	}{
-		{name: "block fails closed", mode: "block", wantBlocked: true},
-		{name: "warn fails open", mode: "warn"},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			t.Setenv("LARKSUITE_CLI_CONTENT_SAFETY_MODE", tt.mode)
-			scanCtx := newResultFirstCanceledContext()
-			extcs.Register(&abortedCleanProvider{selectWaiting: scanCtx.selectWaiting})
-			t.Cleanup(func() { extcs.Register(nil) })
-
-			stdout := &bytes.Buffer{}
-			emitter := NewEmitter(EmitterConfig{
-				Out:         stdout,
-				ErrOut:      &bytes.Buffer{},
-				CommandPath: "lark-cli fixture +emit",
-				Identity:    "bot",
-			})
-			emitter.scanCtx = func() (context.Context, context.CancelFunc) {
-				return scanCtx, func() {}
-			}
-			err := emitter.Success(map[string]any{"id": "1"}, EmitOptions{Format: FormatJSON})
-
-			if tt.wantBlocked {
-				var safetyErr *errs.ContentSafetyError
-				if !errors.As(err, &safetyErr) {
-					t.Fatalf("Emitter.Success() error = %T, want *errs.ContentSafetyError", err)
-				}
-				if !strings.Contains(safetyErr.Message, "scan did not complete") {
-					t.Fatalf("Emitter.Success() error = %v, want scan-incomplete message", err)
-				}
-				if stdout.Len() != 0 {
-					t.Fatalf("Emitter.Success() stdout = %q, want empty", stdout.String())
-				}
-				return
-			}
-			if err != nil {
-				t.Fatalf("Emitter.Success() error = %v, want nil", err)
-			}
-			if stdout.Len() == 0 {
-				t.Fatal("Emitter.Success() stdout is empty, want emitted output")
-			}
-		})
+	if result.Alert != nil {
+		t.Error("slow provider should return nil alert on timeout")
 	}
 }
 
@@ -303,10 +148,6 @@ func (s *slowProvider) Scan(ctx context.Context, _ extcs.ScanRequest) (*extcs.Al
 	}
 }
 
-func (s *slowProvider) ScanFullText(ctx context.Context, req extcs.ScanRequest) (*extcs.Alert, error) {
-	return s.Scan(ctx, req)
-}
-
 func TestWriteAlertWarning(t *testing.T) {
 	alert := &extcs.Alert{Provider: "regex", MatchedRules: []string{"r1", "r2"}}
 	var buf bytes.Buffer

internal/output/emitter.go

@@ -6,11 +6,11 @@ package output
 import (
 	"bytes"
 	"encoding/json"
+	"fmt"
 	"io"
-	"sort"
+	"maps"
 
 	"github.com/larksuite/cli/errs"
-	extcs "github.com/larksuite/cli/extension/contentsafety"
 )
 
 // NoticeProvider supplies the notice attached to a structured envelope.
@@ -25,30 +25,31 @@ type PrettyRenderer func(w io.Writer, colorEnabled bool) error
 // EmitterConfig contains command-scoped dependencies. A command constructs one
 // Emitter and reuses it for its success result or streamed pages.
 type EmitterConfig struct {
-	Out                    io.Writer
-	ErrOut                 io.Writer
-	CommandPath            string
-	Identity               string
-	ColorEnabled           bool
-	NoticeProvider         NoticeProvider
-	MaxBufferedStreamBytes int
+	Out            io.Writer
+	ErrOut         io.Writer
+	CommandPath    string
+	Identity       string
+	ColorEnabled   bool
+	NoticeProvider NoticeProvider
 }
 
 // EmitOptions describes one result's wire representation.
 //
-// The format contract is explicit: FormatJSON (the zero value) uses an
+// The format contract is explicit: JSON (including the empty default) uses an
 // Envelope; pretty, table, csv, and ndjson render naked business data. JQ takes
 // precedence over Format and filters the JSON Envelope. Raw affects only JSON
-// envelope encoding and jq's complex-value encoding. Format is a canonical
-// typed value — boundaries reject unknown formats via ParseFormatStrict, so the
-// Emitter never sees one and never falls back.
+// envelope encoding and jq's complex-value encoding.
+//
+// JQSafetyWarning preserves the legacy difference between RuntimeContext.emit
+// (false) and WriteSuccessEnvelope (true) until their callers are migrated.
 type EmitOptions struct {
-	Raw    bool
-	Meta   *Meta
-	Format Format
-	JQ     string
-	DryRun bool
-	Pretty PrettyRenderer
+	Raw             bool
+	Meta            *Meta
+	Format          string
+	JQ              string
+	DryRun          bool
+	Pretty          PrettyRenderer
+	JQSafetyWarning bool
 }
 
 // StreamOptions describes one streamed page's wire representation. Streaming
@@ -58,7 +59,7 @@ type EmitOptions struct {
 // the aggregated result, which the caller's pagination layer owns before it
 // streams pages.
 type StreamOptions struct {
-	Format Format
+	Format string
 	Pretty PrettyRenderer
 }
 
@@ -71,33 +72,17 @@ type Emitter struct {
 	identity       string
 	colorEnabled   bool
 	noticeProvider NoticeProvider
-	scanCtx        scanContextFactory
 
-	streamFormat    Format
-	streamFormatSet bool
-	streamPrettySet bool
-	streamHasPretty bool
+	streamFormat    string
 	streamFormatter *PaginatedFormatter
-	streamMode      mode
-	streamModeSet   bool
-	streamBuffer    bytes.Buffer
-	maxStreamBytes  int
-	streamFinished  bool
-	streamFinishErr error
 }
 
-const defaultMaxBufferedStreamBytes = 64 << 20
-
 // NewEmitter constructs a command-scoped output emitter.
 func NewEmitter(config EmitterConfig) *Emitter {
 	errOut := config.ErrOut
 	if errOut == nil {
 		errOut = io.Discard
 	}
-	maxStreamBytes := config.MaxBufferedStreamBytes
-	if maxStreamBytes <= 0 {
-		maxStreamBytes = defaultMaxBufferedStreamBytes
-	}
 	return &Emitter{
 		out:            config.Out,
 		errOut:         errOut,
@@ -105,8 +90,6 @@ func NewEmitter(config EmitterConfig) *Emitter {
 		identity:       config.Identity,
 		colorEnabled:   config.ColorEnabled,
 		noticeProvider: config.NoticeProvider,
-		scanCtx:        defaultContentSafetyContext,
-		maxStreamBytes: maxStreamBytes,
 	}
 }
 
@@ -114,10 +97,6 @@ func NewEmitter(config EmitterConfig) *Emitter {
 // primitives. JSON and jq use the standard envelope; pretty, table, csv, and
 // ndjson render the business value directly.
 func (e *Emitter) Success(data interface{}, opts EmitOptions) error {
-	if !opts.Format.Valid() {
-		return errs.NewInternalError(errs.SubtypeUnknown,
-			"internal: unknown output format %d", int(opts.Format))
-	}
 	if err := e.requireOutput(); err != nil {
 		return err
 	}
@@ -127,49 +106,26 @@ func (e *Emitter) Success(data interface{}, opts EmitOptions) error {
 	}
 
 	switch opts.Format {
-	case FormatJSON:
+	case "", "json":
 		return e.emitEnvelope(data, true, opts)
-	case FormatPretty:
+	case "pretty":
 		return e.emitPretty(data, opts)
 	default:
 		return e.emitFormatted(data, opts.Format)
 	}
 }
 
-// Value scans and emits one naked business value. It is intended for
-// long-running streams and custom-format shortcuts whose public contract does
-// not use the standard success envelope.
-func (e *Emitter) Value(data interface{}, opts StreamOptions) error {
-	if !opts.Format.Valid() {
-		return errs.NewInternalError(errs.SubtypeUnknown,
-			"internal: unknown output format %d", int(opts.Format))
-	}
-	if err := e.requireOutput(); err != nil {
-		return err
-	}
-	if opts.Format == FormatPretty && opts.Pretty != nil {
-		return e.emitPrettyRenderer(data, opts.Pretty)
-	}
-	return e.emitValue(data, opts.Format)
-}
-
 // PartialFailure emits a multi-status result whose envelope honestly reports
 // ok:false. It is the typed counterpart to Success for batch operations where
 // some items failed but the per-item outcomes are the primary stdout output.
-// JSON and jq retain the failure envelope. Other formats emit the selected
-// naked representation while the caller supplies the non-zero exit signal.
+// Like the legacy OutPartialFailure it produces only the JSON/jq envelope; the
+// caller owns the non-zero exit signal, keeping the Emitter free of exit
+// semantics.
 func (e *Emitter) PartialFailure(data interface{}, opts EmitOptions) error {
-	if !opts.Format.Valid() {
-		return errs.NewInternalError(errs.SubtypeUnknown,
-			"internal: unknown output format %d", int(opts.Format))
-	}
 	if err := e.requireOutput(); err != nil {
 		return err
 	}
-	if opts.JQ != "" || opts.Format == FormatJSON {
-		return e.emitEnvelope(data, false, opts)
-	}
-	return e.Value(data, StreamOptions{Format: opts.Format, Pretty: opts.Pretty})
+	return e.emitEnvelope(data, false, opts)
 }
 
 // StreamPage scans and emits one page while retaining table/csv columns from
@@ -180,80 +136,54 @@ func (e *Emitter) PartialFailure(data interface{}, opts EmitOptions) error {
 // jq from the type makes "jq requires aggregated output" a compile-time fact
 // instead of a runtime rejection.
 func (e *Emitter) StreamPage(data interface{}, opts StreamOptions) error {
-	if !opts.Format.Valid() {
-		return errs.NewInternalError(errs.SubtypeUnknown,
-			"internal: unknown output format %d", int(opts.Format))
-	}
 	if err := e.requireOutput(); err != nil {
 		return err
 	}
-	if e.streamFinished {
-		return errs.NewInternalError(errs.SubtypeUnknown,
-			"stream output is already finished")
+
+	scanResult := ScanForSafety(e.commandPath, data, e.errOut)
+	if scanResult.Blocked {
+		return scanResult.BlockErr
 	}
-	if !e.streamFormatSet {
+	if scanResult.Alert != nil {
+		if err := WriteAlertWarning(e.errOut, scanResult.Alert); err != nil {
+			return wrapOutputError("write", err)
+		}
+	}
+
+	if opts.Format == "pretty" {
+		if opts.Pretty == nil {
+			return errs.NewInternalError(errs.SubtypeUnknown,
+				"pretty output requires a renderer")
+		}
+		return e.emit(func(w io.Writer) error {
+			return opts.Pretty(w, e.colorEnabled)
+		})
+	}
+
+	format, known := ParseFormat(opts.Format)
+	if !known && e.streamFormatter == nil && e.errOut != nil {
+		fmt.Fprintf(e.errOut, "warning: unknown format %q, falling back to json\n", opts.Format)
+	}
+	if e.streamFormatter == nil {
 		e.streamFormat = opts.Format
-		e.streamFormatSet = true
+		e.streamFormatter = NewPaginatedFormatter(nil, format)
 	} else if opts.Format != e.streamFormat {
 		return errs.NewInternalError(errs.SubtypeUnknown,
 			"stream output format changed from %q to %q", e.streamFormat, opts.Format)
 	}
 
-	if opts.Format == FormatPretty {
-		hasPretty := opts.Pretty != nil
-		if !e.streamPrettySet {
-			e.streamHasPretty = hasPretty
-			e.streamPrettySet = true
-		} else if hasPretty != e.streamHasPretty {
-			return errs.NewInternalError(errs.SubtypeUnknown,
-				"stream pretty renderer availability changed between pages")
-		}
-		if opts.Pretty != nil {
-			var buf bytes.Buffer
-			if err := opts.Pretty(&buf, e.colorEnabled); err != nil {
-				return wrapOutputError("render", err)
-			}
-			return e.emitStreamBuffer(data, &buf)
-		}
-		// Commands without a curated pretty renderer use the generic table
-		// representation. This keeps --format pretty truthful without requiring
-		// every shortcut to duplicate a renderer.
-		opts.Format = FormatTable
-	}
-
-	if e.streamFormatter == nil {
-		e.streamFormatter = NewPaginatedFormatter(nil, opts.Format)
-	}
-
-	// Render this page, then scan the exact bytes before writing: a rule match
-	// can form in the rendered page (joined table cells, adjacent objects) even
-	// when no single value matches.
-	var buf bytes.Buffer
-	e.streamFormatter.W = &buf
-	if err := e.streamFormatter.WritePage(data); err != nil {
-		return wrapOutputError("render", err)
-	}
-	return e.emitStreamBuffer(data, &buf)
-}
-
-// FinishStream commits output buffered by StreamPage in block mode. Warn mode
-// remains incremental: each page is scanned and written by StreamPage. Callers
-// must invoke FinishStream after the final page, including when pagination ends
-// with an API error and partial block-mode output should remain visible.
-func (e *Emitter) FinishStream() error {
-	if e.streamFinished {
-		return e.streamFinishErr
-	}
-	e.streamFinished = true
-	if !e.streamModeSet || e.streamMode != modeBlock || e.streamBuffer.Len() == 0 {
-		return nil
-	}
-	e.streamFinishErr = e.emitScannedBufferMode(&e.streamBuffer, e.streamMode)
-	return e.streamFinishErr
+	return e.emit(func(w io.Writer) error {
+		e.streamFormatter.W = w
+		return e.streamFormatter.WritePage(data)
+	})
 }
 
 func (e *Emitter) emitEnvelope(data interface{}, ok bool, opts EmitOptions) error {
-	m := modeFromEnv(e.errOut)
+	scanResult := ScanForSafety(e.commandPath, data, e.errOut)
+	if scanResult.Blocked {
+		return scanResult.BlockErr
+	}
+
 	env := Envelope{
 		OK:       ok,
 		Identity: e.identity,
@@ -262,14 +192,15 @@ func (e *Emitter) emitEnvelope(data interface{}, ok bool, opts EmitOptions) erro
 		Meta:     opts.Meta,
 		Notice:   e.notice(),
 	}
+	if scanResult.Alert != nil {
+		env.ContentSafetyAlert = scanResult.Alert
+	}
 
 	if opts.JQ != "" {
-		sourceScan := e.scanForSafetyMode(data, false, m)
-		if sourceScan.Blocked {
-			return sourceScan.BlockErr
-		}
-		if sourceScan.Alert != nil {
-			env.ContentSafetyAlert = sourceScan.Alert
+		if scanResult.Alert != nil && opts.JQSafetyWarning {
+			if err := WriteAlertWarning(e.errOut, scanResult.Alert); err != nil {
+				return wrapOutputError("write", err)
+			}
 		}
 		// Buffer the jq output manually so jq's own typed error (a validation
 		// error for a bad expression, an api error for a runtime failure) is
@@ -285,121 +216,25 @@ func (e *Emitter) emitEnvelope(data interface{}, ok bool, opts EmitOptions) erro
 		if jqErr != nil {
 			return jqErr
 		}
-		var renderedScan ScanResult
-		if !sourceScan.scanFailed {
-			renderedScan = e.scanRenderedBufferMode(&buf, m)
-		}
-		if renderedScan.Blocked {
-			return renderedScan.BlockErr
-		}
-		alert := mergeSafetyAlerts(sourceScan.Alert, renderedScan.Alert)
-		if alert != nil {
-			if err := WriteAlertWarning(e.errOut, alert); err != nil {
-				return wrapOutputError("write", err)
-			}
-		}
 		if _, err := io.Copy(e.out, &buf); err != nil {
 			return wrapOutputError("write", err)
 		}
 		return nil
 	}
 
-	// Scan both representations. The structured scan detects content changed by
-	// JSON escaping, while the rendered scan detects matches formed across
-	// serialized fields.
-	sourceScan := e.scanForSafetyMode(data, false, m)
-	if sourceScan.Blocked {
-		return sourceScan.BlockErr
-	}
-
-	var buf bytes.Buffer
-	if err := renderEnvelope(&buf, env, opts.Raw); err != nil {
-		return wrapOutputError("render", err)
-	}
-	var renderedScan ScanResult
-	if !sourceScan.scanFailed {
-		renderedScan = e.scanRenderedBufferMode(&buf, m)
-	}
-	if renderedScan.Blocked {
-		return renderedScan.BlockErr
-	}
-	if alert := mergeSafetyAlerts(sourceScan.Alert, renderedScan.Alert); alert != nil {
-		env.ContentSafetyAlert = alert
-		buf.Reset()
-		if err := renderEnvelope(&buf, env, opts.Raw); err != nil {
-			return wrapOutputError("render", err)
+	return e.emit(func(w io.Writer) error {
+		if opts.Raw {
+			enc := json.NewEncoder(w)
+			enc.SetEscapeHTML(false)
+			enc.SetIndent("", "  ")
+			return enc.Encode(env)
 		}
-	}
-	if _, err := io.Copy(e.out, &buf); err != nil {
-		return wrapOutputError("write", err)
-	}
-	return nil
+		return WriteJSON(w, env)
+	})
 }
 
 func (e *Emitter) emitPretty(data interface{}, opts EmitOptions) error {
-	if opts.Pretty != nil {
-		return e.emitPrettyRenderer(data, opts.Pretty)
-	}
-
-	return e.emitFormatted(data, FormatPretty)
-}
-
-func (e *Emitter) emitPrettyRenderer(data interface{}, renderer PrettyRenderer) error {
-	// Buffer pretty output so the safety scan sees the exact text that will be
-	// written to stdout, including anything captured by the opaque renderer.
-	var buf bytes.Buffer
-	if err := renderer(&buf, e.colorEnabled); err != nil {
-		return wrapOutputError("render", err)
-	}
-	return e.emitSourceAndRenderedBufferMode(data, &buf, modeFromEnv(e.errOut))
-}
-
-// emitFormatted renders naked business data for ndjson, table, csv, and the
-// generic pretty representation. Success routes FormatJSON to the envelope and
-// curated pretty output to its renderer.
-func (e *Emitter) emitFormatted(data interface{}, format Format) error {
-	var buf bytes.Buffer
-	if err := WriteFormatted(&buf, data, format); err != nil {
-		return wrapOutputError("render", err)
-	}
-	return e.emitSourceAndRenderedBufferMode(data, &buf, modeFromEnv(e.errOut))
-}
-
-func (e *Emitter) emitValue(data interface{}, format Format) error {
-	var buf bytes.Buffer
-	var err error
-	switch format {
-	case FormatJSON:
-		err = WriteJSON(&buf, data)
-	case FormatNDJSON:
-		err = WriteNDJSON(&buf, data)
-	case FormatTable:
-		err = WriteTable(&buf, data)
-	case FormatCSV:
-		err = WriteCSV(&buf, data)
-	case FormatPretty:
-		err = WriteFormatted(&buf, data, format)
-	default:
-		return errs.NewInternalError(errs.SubtypeUnknown,
-			"internal: unknown output format %d", int(format))
-	}
-	if err != nil {
-		return wrapOutputError("render", err)
-	}
-	return e.emitSourceAndRenderedBufferMode(data, &buf, modeFromEnv(e.errOut))
-}
-
-func (e *Emitter) emitScannedBufferMode(buf *bytes.Buffer, m mode) error {
-	scanResult := e.scanRenderedBufferMode(buf, m)
-	return e.emitBufferAfterScan(buf, scanResult)
-}
-
-func (e *Emitter) emitSourceAndRenderedBufferMode(data interface{}, buf *bytes.Buffer, m mode) error {
-	scanResult := e.scanSourceAndRenderedBufferMode(data, buf, m)
-	return e.emitBufferAfterScan(buf, scanResult)
-}
-
-func (e *Emitter) emitBufferAfterScan(buf *bytes.Buffer, scanResult ScanResult) error {
+	scanResult := ScanForSafety(e.commandPath, data, e.errOut)
 	if scanResult.Blocked {
 		return scanResult.BlockErr
 	}
@@ -408,97 +243,79 @@ func (e *Emitter) emitBufferAfterScan(buf *bytes.Buffer, scanResult ScanResult)
 			return wrapOutputError("write", err)
 		}
 	}
-	if _, err := io.Copy(e.out, buf); err != nil {
+	if opts.Pretty != nil {
+		return e.emit(func(w io.Writer) error {
+			return opts.Pretty(w, e.colorEnabled)
+		})
+	}
+
+	// RuntimeContext.outFormat falls back through Out/OutRaw when no pretty
+	// renderer is supplied. Keep that second scan visible in the leaf contract
+	// until production callers are migrated and the legacy behavior is removed.
+	return e.emitEnvelope(data, true, opts)
+}
+
+func (e *Emitter) emitFormatted(data interface{}, rawFormat string) error {
+	scanResult := ScanForSafety(e.commandPath, data, e.errOut)
+	if scanResult.Blocked {
+		return scanResult.BlockErr
+	}
+	if scanResult.Alert != nil {
+		if err := WriteAlertWarning(e.errOut, scanResult.Alert); err != nil {
+			return wrapOutputError("write", err)
+		}
+	}
+
+	format, known := ParseFormat(rawFormat)
+	if !known && e.errOut != nil {
+		fmt.Fprintf(e.errOut, "warning: unknown format %q, falling back to json\n", rawFormat)
+	}
+	if format == FormatJSON {
+		return e.printLegacyDataJSON(data)
+	}
+	return e.emit(func(w io.Writer) error {
+		return WriteFormatted(w, data, format)
+	})
+}
+
+type emitterDataMap map[string]interface{}
+
+// printLegacyDataJSON matches FormatValue's JSON branch while sourcing notice
+// data from this Emitter instead of PrintJson's global PendingNotice hook.
+func (e *Emitter) printLegacyDataJSON(data interface{}) error {
+	// Normalise structs / named maps to plain generic types first, exactly as
+	// FormatValue does, so a struct or named-map payload still matches the map
+	// case below and keeps its injected _notice on the unknown-format fallback.
+	data = toGeneric(data)
+	if m, ok := data.(map[string]interface{}); ok {
+		if _, isEnvelope := m["ok"]; isEnvelope {
+			if notice := e.notice(); notice != nil {
+				m = maps.Clone(m)
+				m["_notice"] = notice
+			}
+		}
+		// The named map retains identical JSON bytes while preventing PrintJson
+		// from consulting its legacy global notice hook a second time.
+		return e.emit(func(w io.Writer) error {
+			return WriteJSON(w, emitterDataMap(m))
+		})
+	}
+	return e.emit(func(w io.Writer) error {
+		return WriteJSON(w, data)
+	})
+}
+
+func (e *Emitter) emit(render func(io.Writer) error) error {
+	var buf bytes.Buffer
+	if err := render(&buf); err != nil {
+		return wrapOutputError("render", err)
+	}
+	if _, err := io.Copy(e.out, &buf); err != nil {
 		return wrapOutputError("write", err)
 	}
 	return nil
 }
 
-func (e *Emitter) emitStreamBuffer(data interface{}, buf *bytes.Buffer) error {
-	if !e.streamModeSet {
-		e.streamMode = modeFromEnv(e.errOut)
-		e.streamModeSet = true
-	}
-	switch e.streamMode {
-	case modeWarn:
-		return e.emitSourceAndRenderedBufferMode(data, buf, e.streamMode)
-	case modeBlock:
-		sourceScan := e.scanForSafetyMode(data, false, e.streamMode)
-		if sourceScan.Blocked {
-			return sourceScan.BlockErr
-		}
-		if buf.Len() > e.maxStreamBytes-e.streamBuffer.Len() {
-			return errs.NewContentSafetyError(errs.SubtypeContentSafety,
-				"content-safety scan input exceeds the %d-byte stream limit; blocked",
-				e.maxStreamBytes).
-				WithHint("reduce --page-limit or request fewer records")
-		}
-		_, _ = e.streamBuffer.Write(buf.Bytes())
-		return nil
-	}
-	if _, err := io.Copy(e.out, buf); err != nil {
-		return wrapOutputError("write", err)
-	}
-	return nil
-}
-
-func (e *Emitter) scanSourceAndRenderedBufferMode(data interface{}, buf *bytes.Buffer, m mode) ScanResult {
-	sourceScan := e.scanForSafetyMode(data, false, m)
-	if sourceScan.Blocked || sourceScan.scanFailed {
-		return sourceScan
-	}
-	renderedScan := e.scanRenderedBufferMode(buf, m)
-	if renderedScan.Blocked {
-		return renderedScan
-	}
-	renderedScan.Alert = mergeSafetyAlerts(sourceScan.Alert, renderedScan.Alert)
-	return renderedScan
-}
-
-func (e *Emitter) scanRenderedBufferMode(buf *bytes.Buffer, m mode) ScanResult {
-	return e.scanForSafetyMode(buf.String(), true, m)
-}
-
-func renderEnvelope(w io.Writer, env Envelope, raw bool) error {
-	if raw {
-		enc := json.NewEncoder(w)
-		enc.SetEscapeHTML(false)
-		enc.SetIndent("", "  ")
-		return enc.Encode(env)
-	}
-	return WriteJSON(w, env)
-}
-
-func mergeSafetyAlerts(first, second *extcs.Alert) *extcs.Alert {
-	if first == nil {
-		return second
-	}
-	if second == nil {
-		return first
-	}
-	rules := make(map[string]struct{}, len(first.MatchedRules)+len(second.MatchedRules))
-	for _, rule := range first.MatchedRules {
-		rules[rule] = struct{}{}
-	}
-	for _, rule := range second.MatchedRules {
-		rules[rule] = struct{}{}
-	}
-	mergedRules := make([]string, 0, len(rules))
-	for rule := range rules {
-		mergedRules = append(mergedRules, rule)
-	}
-	sort.Strings(mergedRules)
-	provider := first.Provider
-	if provider == "" {
-		provider = second.Provider
-	}
-	return &extcs.Alert{Provider: provider, MatchedRules: mergedRules}
-}
-
-func (e *Emitter) scanForSafetyMode(data interface{}, fullText bool, m mode) ScanResult {
-	return scanForSafetyMode(e.commandPath, data, e.errOut, fullText, m, e.scanCtx)
-}
-
 func wrapOutputError(op string, err error) error {
 	return errs.NewInternalError(errs.SubtypeUnknown, "failed to %s command output", op).WithCause(err)
 }

internal/output/emitter_legacy_compat_test.go

@@ -45,10 +45,6 @@ func (p *emitterSafetyProvider) Scan(context.Context, extcs.ScanRequest) (*extcs
 	return p.alert, p.err
 }
 
-func (p *emitterSafetyProvider) ScanFullText(ctx context.Context, req extcs.ScanRequest) (*extcs.Alert, error) {
-	return p.Scan(ctx, req)
-}
-
 const (
 	runtimeContextLegacyGoldenPath       = "testdata/runtime_context_legacy.golden.json"
 	writeSuccessEnvelopeLegacyGoldenPath = "testdata/write_success_envelope_legacy.golden.json"
@@ -64,7 +60,6 @@ type runtimeContextOracleCase struct {
 	format      string
 	useFormat   bool
 	pretty      bool
-	keepError   bool
 	notice      map[string]interface{}
 	safetyMode  string
 	safetyAlert *extcs.Alert
@@ -193,6 +188,15 @@ func TestEmitterMatchesRuntimeContextLegacyOracle(t *testing.T) {
 			useFormat: true,
 			pretty:    true,
 		},
+		{
+			name: "pretty_without_renderer",
+			data: func() interface{} {
+				return map[string]interface{}{"name": "Alice"}
+			},
+			ok:        true,
+			format:    "pretty",
+			useFormat: true,
+		},
 		{
 			name: "ndjson",
 			data: func() interface{} {
@@ -232,7 +236,7 @@ func TestEmitterMatchesRuntimeContextLegacyOracle(t *testing.T) {
 			useFormat: true,
 		},
 		{
-			name: "jq_safety_alert_writes_stderr_warning",
+			name: "jq_safety_alert_without_stderr_warning",
 			data: func() interface{} {
 				return map[string]interface{}{"id": "1"}
 			},
@@ -245,7 +249,7 @@ func TestEmitterMatchesRuntimeContextLegacyOracle(t *testing.T) {
 			},
 		},
 		{
-			name: "scanner_error_warn_mode_fails_open",
+			name: "scanner_error_fails_open",
 			data: func() interface{} {
 				return map[string]interface{}{"id": "1"}
 			},
@@ -253,16 +257,6 @@ func TestEmitterMatchesRuntimeContextLegacyOracle(t *testing.T) {
 			safetyMode: "warn",
 			safetyErr:  errors.New("scanner unavailable"),
 		},
-		// Block mode intentionally fails closed when scanning errors.
-		{
-			name: "scanner_error_block_mode_fails_closed",
-			data: func() interface{} {
-				return map[string]interface{}{"id": "1"}
-			},
-			ok:         false,
-			safetyMode: "block",
-			safetyErr:  errors.New("scanner unavailable"),
-		},
 		{
 			name: "scanner_block",
 			data: func() interface{} {
@@ -275,6 +269,16 @@ func TestEmitterMatchesRuntimeContextLegacyOracle(t *testing.T) {
 				MatchedRules: []string{"fixture-rule"},
 			},
 		},
+		{
+			name: "unknown_format_data_envelope_notice",
+			data: func() interface{} {
+				return map[string]interface{}{"ok": true, "value": "fixture"}
+			},
+			ok:        true,
+			format:    "yaml",
+			useFormat: true,
+			notice:    map[string]interface{}{"skills": map[string]interface{}{"current": "1.0.0"}},
+		},
 	}
 
 	golden := loadRuntimeContextLegacyGolden(t)
@@ -305,11 +309,7 @@ func TestEmitterMatchesRuntimeContextLegacyOracle(t *testing.T) {
 				format:    tc.format,
 				useFormat: tc.useFormat,
 				pretty:    tc.pretty,
-				keepError: tc.keepError,
 			}
-			// tc.format is the string a shortcut's --format flag would carry; the
-			// boundary parses it to a canonical Format before the Emitter sees it.
-			format, _ := output.ParseFormat(tc.format)
 			current := runEmitterWithRuntimeContextContract(tc.data(), output.EmitterConfig{
 				CommandPath:    "lark-cli fixture +emit",
 				Identity:       "bot",
@@ -317,10 +317,10 @@ func TestEmitterMatchesRuntimeContextLegacyOracle(t *testing.T) {
 			}, tc.ok, output.EmitOptions{
 				Raw:    tc.raw,
 				Meta:   tc.meta,
-				Format: format,
+				Format: tc.format,
 				JQ:     tc.jq,
 				Pretty: emitterPrettyRenderer(tc.pretty),
-			}, tc.keepError)
+			})
 
 			assertEmitterGolden(t, want, current)
 
@@ -388,15 +388,10 @@ type runtimeOracleOptions struct {
 	format    string
 	useFormat bool
 	pretty    bool
-	keepError bool
 }
 
 func runRuntimeContextOracle(t *testing.T, data interface{}, opts runtimeOracleOptions) emitterCapture {
 	t.Helper()
-	if opts.keepError {
-		return runRuntimeContextShortcutOracle(t, data, opts)
-	}
-
 	stdout := &bytes.Buffer{}
 	stderr := &bytes.Buffer{}
 	parent := &cobra.Command{Use: "lark-cli"}
@@ -436,42 +431,6 @@ func runRuntimeContextOracle(t *testing.T, data interface{}, opts runtimeOracleO
 	return emitterCapture{stdout: stdout.String(), stderr: stderr.String(), err: err}
 }
 
-func runRuntimeContextShortcutOracle(t *testing.T, data interface{}, opts runtimeOracleOptions) emitterCapture {
-	t.Helper()
-	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
-	factory, stdout, stderr, _ := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "test", AppSecret: "test", Brand: core.BrandFeishu,
-	})
-	root := &cobra.Command{Use: "lark-cli", SilenceErrors: true, SilenceUsage: true}
-	fixture := &cobra.Command{Use: "fixture"}
-	root.AddCommand(fixture)
-
-	shortcut := common.Shortcut{
-		Service:   "fixture",
-		Command:   "+emit",
-		AuthTypes: []string{"bot"},
-		Execute: func(_ context.Context, runtime *common.RuntimeContext) error {
-			pretty := func(w io.Writer) {
-				fmt.Fprintln(w, "pretty:fixture")
-			}
-			if !opts.pretty {
-				pretty = nil
-			}
-			if opts.raw {
-				runtime.OutFormatRaw(data, opts.meta, pretty)
-			} else {
-				runtime.OutFormat(data, opts.meta, pretty)
-			}
-			return nil
-		},
-	}
-	shortcut.Mount(fixture, factory)
-	root.SetArgs([]string{"fixture", "+emit", "--as", "bot", "--format", opts.format})
-
-	err := root.Execute()
-	return emitterCapture{stdout: stdout.String(), stderr: stderr.String(), err: err}
-}
-
 func runEmitterSuccess(data interface{}, config output.EmitterConfig, ok bool, opts output.EmitOptions) emitterCapture {
 	stdout := &bytes.Buffer{}
 	stderr := &bytes.Buffer{}
@@ -487,13 +446,7 @@ func runEmitterSuccess(data interface{}, config output.EmitterConfig, ok bool, o
 	return emitterCapture{stdout: stdout.String(), stderr: stderr.String(), err: err}
 }
 
-func runEmitterWithRuntimeContextContract(
-	data interface{},
-	config output.EmitterConfig,
-	ok bool,
-	opts output.EmitOptions,
-	keepError bool,
-) emitterCapture {
+func runEmitterWithRuntimeContextContract(data interface{}, config output.EmitterConfig, ok bool, opts output.EmitOptions) emitterCapture {
 	capture := runEmitterSuccess(data, config, ok, opts)
 	if capture.err != nil {
 		var safetyErr *errs.ContentSafetyError
@@ -504,9 +457,6 @@ func runEmitterWithRuntimeContextContract(
 			capture.stderr += fmt.Sprintf("error: %v\n", capture.err)
 			return capture
 		}
-		if keepError {
-			return capture
-		}
 		capture.err = nil
 	}
 	if !ok {
@@ -596,10 +546,11 @@ func TestEmitterMatchesWriteSuccessEnvelopeLegacyOracle(t *testing.T) {
 				Identity:       "bot",
 				NoticeProvider: func() map[string]interface{} { return notice },
 			}, true, output.EmitOptions{
-				Format: output.FormatJSON,
-				Raw:    false,
-				JQ:     tc.jq,
-				DryRun: tc.dryRun,
+				Format:          "",
+				Raw:             false,
+				JQ:              tc.jq,
+				DryRun:          tc.dryRun,
+				JQSafetyWarning: true,
 			})
 			assertEmitterGolden(t, want, current)
 
@@ -654,14 +605,23 @@ func TestEmitterStreamPageMatchesPaginationLegacyOracle(t *testing.T) {
 		{name: "table", format: output.FormatTable},
 		{name: "csv", format: output.FormatCSV},
 		{
-			name:       "table warn",
-			format:     output.FormatTable,
+			name:       "warn",
+			format:     output.FormatNDJSON,
 			safetyMode: "warn",
 			safetyAlert: &extcs.Alert{
 				Provider:     "emitter-oracle",
 				MatchedRules: []string{"fixture-rule"},
 			},
 		},
+		{
+			name:       "block",
+			format:     output.FormatTable,
+			safetyMode: "block",
+			safetyAlert: &extcs.Alert{
+				Provider:     "emitter-oracle",
+				MatchedRules: []string{"fixture-rule"},
+			},
+		},
 	}
 
 	pages := []interface{}{
@@ -680,7 +640,7 @@ func TestEmitterStreamPageMatchesPaginationLegacyOracle(t *testing.T) {
 			t.Cleanup(func() { extcs.Register(nil) })
 
 			legacy := runPaginationOracle(pages, tc.format)
-			current := runEmitterStreamPages(pages, tc.format)
+			current := runEmitterStreamPages(pages, tc.format.String())
 
 			assertEmitterBytes(t, legacy, current)
 			assertEquivalentError(t, legacy.err, current.err)
@@ -707,7 +667,7 @@ func runPaginationOracle(pages []interface{}, format output.Format) emitterCaptu
 	return emitterCapture{stdout: stdout.String(), stderr: stderr.String(), err: emitErr}
 }
 
-func runEmitterStreamPages(pages []interface{}, format output.Format) emitterCapture {
+func runEmitterStreamPages(pages []interface{}, format string) emitterCapture {
 	stdout := &bytes.Buffer{}
 	stderr := &bytes.Buffer{}
 	emitter := output.NewEmitter(output.EmitterConfig{
@@ -722,9 +682,6 @@ func runEmitterStreamPages(pages []interface{}, format output.Format) emitterCap
 			break
 		}
 	}
-	if emitErr == nil {
-		emitErr = emitter.FinishStream()
-	}
 	return emitterCapture{stdout: stdout.String(), stderr: stderr.String(), err: emitErr}
 }
 
@@ -749,7 +706,7 @@ func TestEmitterCapturesNoticeAndColorDependencies(t *testing.T) {
 			return map[string]interface{}{"source": "captured"}
 		},
 	})
-	if err := emitter.Success(map[string]interface{}{"id": "1"}, output.EmitOptions{Format: output.FormatJSON}); err != nil {
+	if err := emitter.Success(map[string]interface{}{"id": "1"}, output.EmitOptions{Format: "json"}); err != nil {
 		t.Fatalf("Emitter.Success() error = %v", err)
 	}
 	if strings.Contains(stdout.String(), "global") || !strings.Contains(stdout.String(), "captured") {
@@ -757,7 +714,7 @@ func TestEmitterCapturesNoticeAndColorDependencies(t *testing.T) {
 	}
 
 	stdout.Reset()
-	if err := emitter.Success(map[string]interface{}{"id": "1"}, output.EmitOptions{Format: output.FormatPretty,
+	if err := emitter.Success(map[string]interface{}{"id": "1"}, output.EmitOptions{Format: "pretty",
 		Pretty: func(w io.Writer, colorEnabled bool) error {
 			colorSeen = colorEnabled
 			_, err := fmt.Fprintln(w, "pretty")
@@ -769,6 +726,14 @@ func TestEmitterCapturesNoticeAndColorDependencies(t *testing.T) {
 	if !colorSeen {
 		t.Fatal("PrettyRenderer did not receive captured ColorEnabled value")
 	}
+
+	stdout.Reset()
+	if err := emitter.Success(map[string]interface{}{"ok": true, "id": "1"}, output.EmitOptions{Format: "yaml"}); err != nil {
+		t.Fatalf("Emitter.Success(unknown format) error = %v", err)
+	}
+	if strings.Contains(stdout.String(), "global") || !strings.Contains(stdout.String(), "captured") {
+		t.Fatalf("legacy JSON fallback consulted global notice:\n%s", stdout.String())
+	}
 }
 
 type failingEmitterWriter struct {
@@ -786,7 +751,7 @@ func TestEmitterPropagatesOutputError(t *testing.T) {
 		CommandPath: "lark-cli fixture +emit",
 	})
 	err := emitter.Success(map[string]interface{}{"id": "1"}, output.EmitOptions{
-		Raw: true, Format: output.FormatJSON,
+		Raw: true, Format: "json",
 		JQ: ".data",
 	})
 	if !errors.Is(err, sentinel) {

internal/output/envelope_success.go

@@ -41,9 +41,10 @@ func WriteSuccessEnvelope(data interface{}, opts SuccessEnvelopeOptions) error {
 		Identity:       opts.Identity,
 		NoticeProvider: GetNotice,
 	}).Success(data, EmitOptions{
-		Format: FormatJSON,
-		Raw:    false,
-		JQ:     opts.JqExpr,
-		DryRun: opts.DryRun,
+		Format:          "",
+		Raw:             false,
+		JQ:              opts.JqExpr,
+		DryRun:          opts.DryRun,
+		JQSafetyWarning: true,
 	})
 }

internal/output/format.go

@@ -9,8 +9,6 @@ import (
 	"fmt"
 	"io"
 	"sort"
-
-	"github.com/larksuite/cli/errs"
 )
 
 // Known array field names for pagination.
@@ -116,22 +114,8 @@ func FormatValue(w io.Writer, data interface{}, format Format) {
 
 // WriteFormatted formats a single response and returns marshal or write errors.
 func WriteFormatted(w io.Writer, data interface{}, format Format) error {
-	if !format.Valid() {
-		return errs.NewInternalError(errs.SubtypeUnknown,
-			"internal: unknown output format %d", int(format))
-	}
 	data = toGeneric(data)
 	switch format {
-	case FormatJSON:
-		return WriteJSON(w, data)
-	case FormatPretty:
-		switch data.(type) {
-		case map[string]interface{}, []interface{}:
-			return WriteTable(w, data)
-		default:
-			_, err := fmt.Fprintln(w, cellStr(data))
-			return err
-		}
 	case FormatNDJSON:
 		items := ExtractItems(data)
 		if items != nil {
@@ -153,9 +137,9 @@ func WriteFormatted(w io.Writer, data interface{}, format Format) error {
 		}
 		return WriteCSV(w, data)
 
+	default: // FormatJSON
+		return WriteJSON(w, data)
 	}
-	return errs.NewInternalError(errs.SubtypeUnknown,
-		"internal: unknown output format %d", int(format))
 }
 
 // PaginatedFormatter holds state across paginated calls to ensure
@@ -182,10 +166,6 @@ func (pf *PaginatedFormatter) FormatPage(data interface{}) {
 
 // WritePage formats one page of items and returns marshal or write errors.
 func (pf *PaginatedFormatter) WritePage(data interface{}) error {
-	if !pf.Format.Valid() {
-		return errs.NewInternalError(errs.SubtypeUnknown,
-			"internal: unknown output format %d", int(pf.Format))
-	}
 	switch pf.Format {
 	case FormatJSON, FormatNDJSON:
 		if arr, ok := data.([]interface{}); ok {
@@ -214,8 +194,7 @@ func (pf *PaginatedFormatter) WritePage(data interface{}) error {
 			return writeCSVRows(w, rows, cols, isFirst)
 		})
 	}
-	return errs.NewInternalError(errs.SubtypeUnknown,
-		"internal: unknown output format %d", int(pf.Format))
+	return nil
 }
 
 // formatStructuredPage handles column-locking logic shared by table and csv.

internal/output/format_test.go

@@ -6,11 +6,8 @@ package output
 import (
 	"bytes"
 	"encoding/json"
-	"errors"
 	"strings"
 	"testing"
-
-	"github.com/larksuite/cli/errs"
 )
 
 func TestFormatValue_JSON(t *testing.T) {
@@ -101,18 +98,6 @@ func TestFormatValue_CSV(t *testing.T) {
 	}
 }
 
-func TestWriteFormatted_InvalidFormatReturnsInternalErrorWithoutOutput(t *testing.T) {
-	var buf bytes.Buffer
-	err := WriteFormatted(&buf, map[string]interface{}{"id": "1"}, Format(99))
-	problem, ok := errs.ProblemOf(err)
-	if !ok || problem.Category != errs.CategoryInternal || problem.Subtype != errs.SubtypeUnknown {
-		t.Fatalf("WriteFormatted() problem = %#v, %v; want internal/unknown", problem, ok)
-	}
-	if buf.Len() != 0 {
-		t.Fatalf("WriteFormatted() wrote %d bytes, want 0", buf.Len())
-	}
-}
-
 func TestPaginatedFormatter_JSON(t *testing.T) {
 	var buf bytes.Buffer
 	pf := NewPaginatedFormatter(&buf, FormatJSON)
@@ -185,22 +170,6 @@ func TestPaginatedFormatter_CSV(t *testing.T) {
 	}
 }
 
-func TestPaginatedFormatterWritePage_InvalidFormatReturnsInternalErrorWithoutOutput(t *testing.T) {
-	var buf bytes.Buffer
-	pf := NewPaginatedFormatter(&buf, Format(99))
-	err := pf.WritePage([]interface{}{map[string]interface{}{"id": "1"}})
-	var internalErr *errs.InternalError
-	if !errors.As(err, &internalErr) {
-		t.Fatalf("WritePage() error = %T, want *errs.InternalError", err)
-	}
-	if internalErr.Category != errs.CategoryInternal || internalErr.Subtype != errs.SubtypeUnknown {
-		t.Fatalf("WritePage() problem = %s/%s, want internal/unknown", internalErr.Category, internalErr.Subtype)
-	}
-	if buf.Len() != 0 {
-		t.Fatalf("WritePage() wrote %d bytes, want 0", buf.Len())
-	}
-}
-
 func TestPaginatedFormatter_ColumnConsistency(t *testing.T) {
 	// Page 1 has {a, b}, page 2 has {a, b, c} — c should be ignored in CSV
 	var buf bytes.Buffer

internal/output/format_type.go

@@ -3,12 +3,7 @@
 
 package output
 
-import (
-	"fmt"
-	"strings"
-
-	"github.com/larksuite/cli/errs"
-)
+import "strings"
 
 // Format represents an output format type.
 type Format int
@@ -18,22 +13,11 @@ const (
 	FormatNDJSON
 	FormatTable
 	FormatCSV
-	FormatPretty
 )
 
-// Valid reports whether f is one of the defined output formats.
-func (f Format) Valid() bool {
-	return f >= FormatJSON && f <= FormatPretty
-}
-
 // ParseFormat parses a format string into a Format value.
 // The second return value is false if the format string was not recognized,
 // in which case FormatJSON is returned as default.
-//
-// Prefer ParseFormatStrict at flag boundaries so an unknown --format fails
-// loudly instead of degrading to JSON. ParseFormat's lenient fallback is kept
-// for internal callers that only need a best-effort classification (e.g.
-// ValidateJqFlags, which folds any non-JSON — known or not — into one branch).
 func ParseFormat(s string) (Format, bool) {
 	switch strings.ToLower(s) {
 	case "json", "":
@@ -44,41 +28,21 @@ func ParseFormat(s string) (Format, bool) {
 		return FormatTable, true
 	case "csv":
 		return FormatCSV, true
-	case "pretty":
-		return FormatPretty, true
 	default:
 		return FormatJSON, false
 	}
 }
 
-// ParseFormatStrict parses a --format value into a typed Format, returning a
-// typed ValidationError for any unrecognized value instead of silently falling
-// back to JSON. Flag boundaries use this so an unknown format is a typed
-// failure the caller cannot accidentally serve as JSON, and so the Emitter
-// downstream only ever receives a canonical Format.
-func ParseFormatStrict(s string) (Format, error) {
-	if f, ok := ParseFormat(s); ok {
-		return f, nil
-	}
-	return FormatJSON, errs.NewValidationError(errs.SubtypeInvalidArgument,
-		"unknown output format %q (want json, ndjson, table, csv, or pretty)", s).
-		WithParam("--format")
-}
-
 // String returns the string representation of a Format.
 func (f Format) String() string {
 	switch f {
-	case FormatJSON:
-		return "json"
 	case FormatNDJSON:
 		return "ndjson"
 	case FormatTable:
 		return "table"
 	case FormatCSV:
 		return "csv"
-	case FormatPretty:
-		return "pretty"
 	default:
-		return fmt.Sprintf("unknown(%d)", int(f))
+		return "json"
 	}
 }

internal/output/format_type_test.go

@@ -3,11 +3,7 @@
 
 package output
 
-import (
-	"testing"
-
-	"github.com/larksuite/cli/errs"
-)
+import "testing"
 
 func TestParseFormat(t *testing.T) {
 	tests := []struct {
@@ -27,9 +23,6 @@ func TestParseFormat(t *testing.T) {
 		{"csv", FormatCSV, true},
 		{"CSV", FormatCSV, true},
 		{"Csv", FormatCSV, true},
-		{"pretty", FormatPretty, true},
-		{"PRETTY", FormatPretty, true},
-		{"Pretty", FormatPretty, true},
 		{"", FormatJSON, true},
 		// Legacy/unknown values fall back to JSON with ok=false
 		{"data", FormatJSON, false},
@@ -62,8 +55,7 @@ func TestFormatString(t *testing.T) {
 		{FormatNDJSON, "ndjson"},
 		{FormatTable, "table"},
 		{FormatCSV, "csv"},
-		{FormatPretty, "pretty"},
-		{Format(99), "unknown(99)"},
+		{Format(99), "json"}, // unknown falls back
 	}
 
 	for _, tt := range tests {
@@ -75,59 +67,3 @@ func TestFormatString(t *testing.T) {
 		})
 	}
 }
-
-func TestFormatValid(t *testing.T) {
-	for _, format := range []Format{FormatJSON, FormatNDJSON, FormatTable, FormatCSV, FormatPretty} {
-		if !format.Valid() {
-			t.Errorf("Format(%d).Valid() = false, want true", format)
-		}
-	}
-	if Format(99).Valid() {
-		t.Error("Format(99).Valid() = true, want false")
-	}
-}
-
-func TestParseFormatStrict(t *testing.T) {
-	valid := []struct {
-		input string
-		want  Format
-	}{
-		{"", FormatJSON},
-		{"json", FormatJSON},
-		{"JSON", FormatJSON},
-		{"ndjson", FormatNDJSON},
-		{"table", FormatTable},
-		{"csv", FormatCSV},
-		{"pretty", FormatPretty},
-		{"Pretty", FormatPretty},
-	}
-	for _, tt := range valid {
-		t.Run("valid/"+tt.input, func(t *testing.T) {
-			got, err := ParseFormatStrict(tt.input)
-			if err != nil {
-				t.Fatalf("ParseFormatStrict(%q) error = %v, want nil", tt.input, err)
-			}
-			if got != tt.want {
-				t.Errorf("ParseFormatStrict(%q) = %v, want %v", tt.input, got, tt.want)
-			}
-		})
-	}
-
-	// Unknown values are a typed validation error on --format, never a silent
-	// fallback to JSON.
-	for _, input := range []string{"yaml", "xml", "data", "raw", "tabel"} {
-		t.Run("unknown/"+input, func(t *testing.T) {
-			got, err := ParseFormatStrict(input)
-			if err == nil {
-				t.Fatalf("ParseFormatStrict(%q) error = nil, want validation error", input)
-			}
-			problem, ok := errs.ProblemOf(err)
-			if !ok || problem.Category != errs.CategoryValidation {
-				t.Fatalf("ParseFormatStrict(%q) problem = %#v, %v; want validation category", input, problem, ok)
-			}
-			if got != FormatJSON {
-				t.Errorf("ParseFormatStrict(%q) format = %v, want FormatJSON sentinel", input, got)
-			}
-		})
-	}
-}

internal/output/jq.go

@@ -70,14 +70,7 @@ func ValidateJqFlags(jqExpr, outputFlag, format string) error {
 	if outputFlag != "" {
 		return errs.NewValidationError(errs.SubtypeInvalidArgument, "--jq and --output are mutually exclusive")
 	}
-	// Classify via ParseFormat so the JSON check is case-insensitive and shares
-	// the single canonical format definition. Only a recognized JSON format is
-	// compatible with --jq; every other value conflicts and is rejected: known
-	// non-JSON framework formats ("csv", "pretty", ...) and values ParseFormat
-	// does not recognize as JSON (a shortcut's own "markdown"/"data" enum, or an
-	// unknown format that ParseFormatStrict rejects downstream). The !ok guard
-	// keeps those unrecognized values out of the JSON-compatible branch.
-	if f, ok := ParseFormat(format); !ok || f != FormatJSON {
+	if format != "" && format != "json" {
 		return errs.NewValidationError(errs.SubtypeInvalidArgument, "--jq and --format %s are mutually exclusive", format)
 	}
 	return ValidateJqExpression(jqExpr)

internal/output/jq_test.go

@@ -160,13 +160,8 @@ func TestValidateJqFlags(t *testing.T) {
 		{name: "empty jq is noop", jqExpr: "", outputFlag: "file.json", format: "csv", wantErr: ""},
 		{name: "jq only", jqExpr: ".data", outputFlag: "", format: "", wantErr: ""},
 		{name: "jq with json format", jqExpr: ".data", outputFlag: "", format: "json", wantErr: ""},
-		// Format classification is case-insensitive via ParseFormat: an
-		// upper/mixed-case JSON must not be mistaken for a conflicting format.
-		{name: "jq with uppercase JSON format", jqExpr: ".data", outputFlag: "", format: "JSON", wantErr: ""},
-		{name: "jq with mixed-case Json format", jqExpr: ".data", outputFlag: "", format: "Json", wantErr: ""},
 		{name: "jq and output conflict", jqExpr: ".data", outputFlag: "out.json", format: "", wantErr: "--jq and --output are mutually exclusive"},
 		{name: "jq and csv conflict", jqExpr: ".data", outputFlag: "", format: "csv", wantErr: "--jq and --format csv are mutually exclusive"},
-		{name: "jq and pretty conflict", jqExpr: ".data", outputFlag: "", format: "pretty", wantErr: "--jq and --format pretty are mutually exclusive"},
 		{name: "jq and ndjson conflict", jqExpr: ".data", outputFlag: "", format: "ndjson", wantErr: "--jq and --format ndjson are mutually exclusive"},
 		{name: "invalid expression", jqExpr: "invalid[", outputFlag: "", format: "", wantErr: "invalid jq expression"},
 	}

internal/output/print.go

@@ -81,6 +81,21 @@ func injectNotice(data interface{}) {
 	m["_notice"] = notice
 }
 
+// PrintNdjson prints data as NDJSON (Newline Delimited JSON) to w.
+func PrintNdjson(w io.Writer, data interface{}) {
+	if arr, ok := data.([]interface{}); ok {
+		for _, item := range arr {
+			if err := WriteNDJSON(w, item); isOutputMarshalError(err) {
+				legacyStderrf("ndjson marshal error: %v\n", err)
+			}
+		}
+		return
+	}
+	if err := WriteNDJSON(w, data); isOutputMarshalError(err) {
+		legacyStderrf("ndjson marshal error: %v\n", err)
+	}
+}
+
 // WriteNDJSON writes data as NDJSON and returns marshal or write errors.
 func WriteNDJSON(w io.Writer, data interface{}) error {
 	emit := func(item interface{}) error {

internal/output/testdata/runtime_context_legacy.golden.json

@@ -5,7 +5,7 @@
       "stderr": ""
     },
     "format_raw_json_preserves_html": {
-      "stdout": "{\n  \"ok\": true,\n  \"identity\": \"bot\",\n  \"data\": {\n    \"html\": \"<p>a&b</p>\"\n  }\n}\n",
+      "stdout": "{\n  \"ok\": true,\n  \"identity\": \"bot\",\n  \"data\": {\n    \"html\": \"\u003cp\u003ea\u0026b\u003c/p\u003e\"\n  }\n}\n",
       "stderr": ""
     },
     "jq_invalid_expression": {
@@ -22,9 +22,9 @@
         "exit_code": 2
       }
     },
-    "jq_safety_alert_writes_stderr_warning": {
+    "jq_safety_alert_without_stderr_warning": {
       "stdout": "1\n",
-      "stderr": "warning: content safety alert from emitter-oracle (rules: fixture-rule)\n"
+      "stderr": ""
     },
     "jq_scalar": {
       "stdout": "Alice\n",
@@ -62,12 +62,16 @@
       "stdout": "pretty:fixture\n",
       "stderr": ""
     },
+    "pretty_without_renderer": {
+      "stdout": "{\n  \"ok\": true,\n  \"identity\": \"bot\",\n  \"data\": {\n    \"name\": \"Alice\"\n  }\n}\n",
+      "stderr": ""
+    },
     "raw_jq_complex": {
-      "stdout": "{\n  \"html\": \"<p>a&b</p>\"\n}\n",
+      "stdout": "{\n  \"html\": \"\u003cp\u003ea\u0026b\u003c/p\u003e\"\n}\n",
       "stderr": ""
     },
     "raw_json_preserves_html": {
-      "stdout": "{\n  \"ok\": true,\n  \"identity\": \"bot\",\n  \"data\": {\n    \"html\": \"<p>a&b</p>\"\n  }\n}\n",
+      "stdout": "{\n  \"ok\": true,\n  \"identity\": \"bot\",\n  \"data\": {\n    \"html\": \"\u003cp\u003ea\u0026b\u003c/p\u003e\"\n  }\n}\n",
       "stderr": ""
     },
     "scanner_block": {
@@ -87,27 +91,17 @@
         "exit_code": 6
       }
     },
-    "scanner_error_block_mode_fails_closed": {
-      "stdout": "",
-      "stderr": "warning: content safety scan error: scanner unavailable\n",
-      "error": {
-        "go_type": "*errs.ContentSafetyError",
-        "json": {
-          "type": "policy",
-          "subtype": "content_safety",
-          "message": "content-safety scan did not complete; blocked (block mode)"
-        },
-        "message": "content-safety scan did not complete; blocked (block mode)",
-        "exit_code": 6
-      }
-    },
-    "scanner_error_warn_mode_fails_open": {
+    "scanner_error_fails_open": {
       "stdout": "{\n  \"ok\": true,\n  \"identity\": \"bot\",\n  \"data\": {\n    \"id\": \"1\"\n  }\n}\n",
       "stderr": "warning: content safety scan error: scanner unavailable\n"
     },
     "table_with_safety_warning": {
       "stdout": "id  name \n──  ─────\n1   Alice\n",
       "stderr": "warning: content safety alert from emitter-oracle (rules: fixture-rule)\n"
+    },
+    "unknown_format_data_envelope_notice": {
+      "stdout": "{\n  \"_notice\": {\n    \"skills\": {\n      \"current\": \"1.0.0\"\n    }\n  },\n  \"ok\": true,\n  \"value\": \"fixture\"\n}\n",
+      "stderr": "warning: unknown format \"yaml\", falling back to json\n"
     }
   }
 }

internal/qualitygate/config/README.md

@@ -45,6 +45,18 @@ Adding a new row requires approval from the matching CODEOWNERS or quality gate
 
 `legacy-commands.txt` only covers hand-authored legacy commands. Generated OpenAPI service commands are intentionally excluded from `command-manifest.json`; they are included in `command-index.json` only so command references can be checked against the real CLI surface.
 
+## Public Domain Allowlists
+
+`internal/qualitygate/config/allowlists/public-domains.txt` contains supported public hostnames approved for Go source. `fixture-domains.txt` contains test-only hostnames used by `*_test.go`, the repository-root `tests/` directory, or any `testdata/` directory; fixture entries do not apply to production Go files or `skills/`.
+
+Keep one lowercase exact hostname per line, sorted alphabetically. Wildcards, suffix rules, duplicates, schemes, ports, and paths are rejected; approving `larkoffice.com` does not approve its subdomains.
+
+RFC 2606 reserves the `.test`, `.example`, `.invalid`, and `.localhost` namespaces plus the exact names `example.com`, `example.net`, and `example.org`. These names are accepted without an allowlist entry and must not be listed.
+
+Every public entry needs a current non-fixture Go use, evidence that it is a supported public endpoint, and CODEOWNER approval. Other test-only hostnames belong in the fixture list. Tenant-specific, private-control-plane, and internal API hostnames are not eligible.
+
+`lint/domaincontract` validates both lists and scans complete Go files. In CI, unapproved-host findings are limited to values whose expressions intersect added lines; list validation and unused-entry checks remain repository-wide. See `lint/README.md` for scanner semantics.
+
 ## Semantic Blocker Policy
 
 The semantic reviewer can propose findings, but the local gatekeeper recomputes whether each finding is reproducible from `facts.json`. A finding blocks only when all of these are true:

internal/qualitygate/config/allowlists/fixture-domains.txt

@@ -0,0 +1,24 @@
+# Exact test-only hostnames. Keep sorted.
+abc.feishu.cn
+attacker.example.com
+bytedance.feishu.cn
+cdn.feishu.cn
+evil.example.com
+example.feishu.cn
+example.larkoffice.com
+example.larksuite.com
+feishu.cn
+feishu.doubao.com
+gateway.docker.internal
+host.containers.internal
+host.docker.internal
+host.lima.internal
+lf3-static.bytednsdoc.com
+meetings.feishu.cn
+meetings.larksuite.com
+p3-lark-file.byteimg.com
+passport.feishu.cn
+sample.feishu.cn
+x.feishu.cn
+xxx.feishu.cn
+xxx.larksuite.com

internal/qualitygate/config/allowlists/public-domains.txt

@@ -0,0 +1,18 @@
+# Exact public hostnames. Keep sorted.
+accounts.feishu.cn
+accounts.larksuite.com
+applink.feishu.cn
+applink.larksuite.com
+ark.ap-southeast.bytepluses.com
+github.com
+larkoffice.com
+lf-larkemail.bytetos.com
+mcp.feishu.cn
+mcp.larksuite.com
+open.feishu.cn
+open.larksuite.com
+registry.npmjs.org
+registry.npmmirror.com
+sf16-sg.tiktokcdn.com
+www.feishu.cn
+www.larksuite.com

internal/registry/remote.go

@@ -180,8 +180,8 @@ func saveCachedMerged(data []byte, cm CacheMeta) error {
 // localVersion is sent as data_version query param for server-side version comparison.
 // Returns (data, reg, err). A nil reg means the version is unchanged (not modified).
 func fetchRemoteMerged(localVersion string) (data []byte, reg *MergedRegistry, err error) {
-	// Route through the shared proxy-plugin-aware transport so remote API
-	// definition fetches honor proxy plugin mode instead of bypassing it.
+	// Remote metadata is platform traffic and must honor both the shared proxy
+	// configuration and the registered platform transport extension.
 	client := transport.NewHTTPClient(fetchTimeout)
 	req, err := http.NewRequest("GET", remoteMetaURL(localVersion), nil)
 	if err != nil {

internal/riskcontrol/osmodel.go

@@ -0,0 +1,142 @@
+// Copyright (c) 2026 Lark Technologies Pte. Ltd.
+// SPDX-License-Identifier: MIT
+
+// Package deviceinfo collects the platform hardware product model and the
+// platform values used by device-related risk-control headers.
+package riskcontrol
+
+import (
+	"runtime"
+	"strings"
+	"sync"
+	"unicode"
+	"unicode/utf8"
+
+	"golang.org/x/net/http/httpguts"
+)
+
+// OSType is the server-side risk-control operating-system enum.
+type OSType string
+
+// OS type enum values for X-Agent-Os-Type.
+const (
+	OSTypeUnknown = "0"
+	OSTypeWindows = "1"
+	OSTypeLinux   = "2"
+	OSTypeMacOS   = "3"
+)
+
+const (
+	// TerminalTypePC is the fixed X-Agent-Terminal-Type value for the CLI.
+	TerminalTypePC = "1"
+
+	// Unknown is used when the hardware product model cannot be collected.
+	Unknown = "Unknown"
+
+	// deviceModelMaxBytes bounds the value added to X-Agent-Device-Type.
+	// Device models are short identifiers; a larger value is treated as
+	// malformed rather than truncated so the header never misrepresents it.
+	deviceModelMaxBytes = 256
+)
+
+// Snapshot contains the deliberately small risk-control signal set.
+// ProductModel is omitted when the platform cannot provide a safe value.
+type Snapshot struct {
+	OSType       OSType
+	ProductModel string
+}
+
+// Source supplies one immutable process-level snapshot.
+type Source interface {
+	Snapshot() Snapshot
+}
+
+// HostSource lazily reads host signals once, after outbound policy authorizes
+// the first request. Failed probes are cached and are not retried per request.
+type HostSource struct {
+	once      sync.Once
+	value     Snapshot
+	readModel func() string
+}
+
+// NewHostSource creates the production host signal source.
+func NewHostSource() *HostSource {
+	return &HostSource{readModel: readDeviceModel}
+}
+
+// Snapshot returns the cached host signal snapshot.
+func (s *HostSource) Snapshot() Snapshot {
+	if s == nil {
+		return Snapshot{}
+	}
+	s.once.Do(func() {
+		readModel := s.readModel
+		if readModel == nil {
+			readModel = readDeviceModel
+		}
+		s.value = Snapshot{
+			OSType:       GetOSType(OSName()),
+			ProductModel: normalizeDeviceModel(readModel()),
+		}
+	})
+	return s.value
+}
+
+// normalizeModel removes non-printable characters and returns a model only
+// when the remaining text is safe to use as an HTTP header value. Input that
+// cannot produce a valid model is rejected so Get can fall back to Unknown.
+func normalizeDeviceModel(model string) string {
+	if !utf8.ValidString(model) {
+		return ""
+	}
+	model = strings.Map(func(r rune) rune {
+		switch {
+		case r == '\r' || r == '\n' || r == '\x00':
+			return -1
+		case unicode.IsSpace(r):
+			return ' '
+		case unicode.IsPrint(r):
+			return r
+		default:
+			return -1
+		}
+	}, model)
+
+	model = strings.Join(strings.Fields(model), " ")
+
+	if model == "" || len(model) > deviceModelMaxBytes {
+		return ""
+	}
+	if !httpguts.ValidHeaderFieldValue(model) {
+		return ""
+	}
+	return model
+}
+
+// GetOSType maps a platform name to the X-Agent-Os-Type enum.
+func GetOSType(osName string) OSType {
+	switch osName {
+	case "Windows":
+		return OSTypeWindows
+	case "Linux":
+		return OSTypeLinux
+	case "MacOS":
+		return OSTypeMacOS
+	default:
+		return OSTypeUnknown
+	}
+}
+
+// OSName returns the platform name used by GetOSType.
+func OSName() string {
+	switch runtime.GOOS {
+	case "darwin":
+		return "MacOS"
+	case "windows":
+		return "Windows"
+	case "linux":
+		return "Linux"
+	default:
+		return runtime.GOOS
+	}
+}

internal/riskcontrol/osmodel_darwin.go

@@ -0,0 +1,27 @@
+//go:build darwin
+
+// Copyright (c) 2026 Lark Technologies Pte. Ltd.
+// SPDX-License-Identifier: MIT
+
+package riskcontrol
+
+import "golang.org/x/sys/unix"
+
+// readDeviceModel reads the current product key first and falls back to the
+// legacy model key. Trying both keys is more robust than branching on a macOS
+// version because virtualized or restricted environments may expose only one.
+func readDeviceModel() string {
+	return readDarwinDeviceModel(unix.Sysctl)
+}
+
+func readDarwinDeviceModel(readSysctl func(string) (string, error)) string {
+	for _, key := range [...]string{"hw.product", "hw.model"} {
+		model, err := readSysctl(key)
+		if err == nil {
+			if model = normalizeDeviceModel(model); model != "" {
+				return model
+			}
+		}
+	}
+	return ""
+}

internal/riskcontrol/osmodel_darwin_test.go

@@ -0,0 +1,48 @@
+//go:build darwin
+
+// Copyright (c) 2026 Lark Technologies Pte. Ltd.
+// SPDX-License-Identifier: MIT
+
+package riskcontrol
+
+import (
+	"errors"
+	"reflect"
+	"testing"
+)
+
+func TestReadDarwinDeviceModelPrefersProductAndFallsBackToModel(t *testing.T) {
+	t.Run("product available", func(t *testing.T) {
+		var keys []string
+		got := readDarwinDeviceModel(func(key string) (string, error) {
+			keys = append(keys, key)
+			if key == "hw.product" {
+				return "Mac16,1", nil
+			}
+			return "", errors.New("unexpected fallback")
+		})
+		if got != "Mac16,1" {
+			t.Fatalf("model = %q, want %q", got, "Mac16,1")
+		}
+		if want := []string{"hw.product"}; !reflect.DeepEqual(keys, want) {
+			t.Fatalf("sysctl keys = %v, want %v", keys, want)
+		}
+	})
+
+	t.Run("product unavailable", func(t *testing.T) {
+		var keys []string
+		got := readDarwinDeviceModel(func(key string) (string, error) {
+			keys = append(keys, key)
+			if key == "hw.model" {
+				return "MacBookPro18,3", nil
+			}
+			return "", errors.New("not available")
+		})
+		if got != "MacBookPro18,3" {
+			t.Fatalf("model = %q, want %q", got, "MacBookPro18,3")
+		}
+		if want := []string{"hw.product", "hw.model"}; !reflect.DeepEqual(keys, want) {
+			t.Fatalf("sysctl keys = %v, want %v", keys, want)
+		}
+	})
+}

internal/riskcontrol/osmodel_linux.go

@@ -0,0 +1,17 @@
+//go:build linux
+
+// Copyright (c) 2026 Lark Technologies Pte. Ltd.
+// SPDX-License-Identifier: MIT
+
+package riskcontrol
+
+// readDeviceModel returns a stable device model for Linux. DMI and device-tree
+// values vary widely and can expose the host or virtualization platform when
+// the CLI runs in a container or sandbox.
+func readDeviceModel() string {
+	return readLinuxDeviceModel()
+}
+
+func readLinuxDeviceModel() string {
+	return "linux"
+}

internal/riskcontrol/osmodel_linux_test.go

@@ -0,0 +1,20 @@
+//go:build linux
+
+// Copyright (c) 2026 Lark Technologies Pte. Ltd.
+// SPDX-License-Identifier: MIT
+
+package riskcontrol
+
+import "testing"
+
+func TestReadDeviceModelReturnsLinux(t *testing.T) {
+	if got := readDeviceModel(); got != "linux" {
+		t.Fatalf("readDeviceModel() = %q, want %q", got, "linux")
+	}
+}
+
+func TestReadLinuxDeviceModel(t *testing.T) {
+	if got := readLinuxDeviceModel(); got != "linux" {
+		t.Fatalf("readLinuxDeviceModel() = %q, want %q", got, "linux")
+	}
+}

internal/riskcontrol/osmodel_other.go

@@ -0,0 +1,11 @@
+//go:build !darwin && !windows && !linux
+
+// Copyright (c) 2026 Lark Technologies Pte. Ltd.
+// SPDX-License-Identifier: MIT
+
+package riskcontrol
+
+// readDeviceModel returns an empty model on unsupported platforms.
+func readDeviceModel() string {
+	return ""
+}

internal/riskcontrol/osmodel_test.go

@@ -0,0 +1,143 @@
+// Copyright (c) 2026 Lark Technologies Pte. Ltd.
+// SPDX-License-Identifier: MIT
+
+package riskcontrol
+
+import (
+	"fmt"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"unicode"
+)
+
+func TestHostSourceCachesNonEmptyModel(t *testing.T) {
+	calls := 0
+	s := &HostSource{readModel: func() string {
+		calls++
+		return "  MacBookPro18,3\n"
+	}}
+
+	if got := s.Snapshot(); got.ProductModel != "MacBookPro18,3" {
+		t.Fatalf("first Snapshot().ProductModel = %q, want %q", got.ProductModel, "MacBookPro18,3")
+	}
+	if got := s.Snapshot(); got.ProductModel != "MacBookPro18,3" {
+		t.Fatalf("second Snapshot().ProductModel = %q, want cached model", got.ProductModel)
+	}
+	if calls != 1 {
+		t.Fatalf("read called %d times, want 1", calls)
+	}
+}
+
+func TestHostSourceCachesEmptyModel(t *testing.T) {
+	calls := 0
+	s := &HostSource{readModel: func() string {
+		calls++
+		return ""
+	}}
+
+	if got := s.Snapshot(); got.ProductModel != "" {
+		t.Fatalf("first Snapshot().ProductModel = %q, want empty", got.ProductModel)
+	}
+	if got := s.Snapshot(); got.ProductModel != "" {
+		t.Fatalf("second Snapshot().ProductModel = %q, want cached empty result", got.ProductModel)
+	}
+	if calls != 1 {
+		t.Fatalf("read called %d times, want 1", calls)
+	}
+}
+
+func TestHostSourceReadsOnceAcrossConcurrentCalls(t *testing.T) {
+	var calls atomic.Int32
+	s := &HostSource{readModel: func() string {
+		calls.Add(1)
+		return "ThinkPad X1 Carbon"
+	}}
+
+	const goroutines = 32
+	var wg sync.WaitGroup
+	wg.Add(goroutines)
+	for i := 0; i < goroutines; i++ {
+		go func() {
+			defer wg.Done()
+			snapshot := s.Snapshot()
+			if snapshot.ProductModel != "ThinkPad X1 Carbon" {
+				t.Errorf("Snapshot().ProductModel = %q, want %q", snapshot.ProductModel, "ThinkPad X1 Carbon")
+			}
+		}()
+	}
+	wg.Wait()
+
+	if got := calls.Load(); got != 1 {
+		t.Fatalf("read called %d times, want 1", got)
+	}
+}
+
+func TestNormalizeDeviceModel(t *testing.T) {
+	tests := []struct {
+		name  string
+		model string
+		want  string
+	}{
+		{name: "trims surrounding whitespace", model: "  MacBookPro18,3\n", want: "MacBookPro18,3"},
+		{name: "trims device tree terminator", model: "Raspberry Pi 5\x00", want: "Raspberry Pi 5"},
+		{name: "allows printable Unicode", model: "联想 ThinkPad X1", want: "联想 ThinkPad X1"},
+		{name: "rejects empty", model: " \t\r\n"},
+		{name: "rejects invalid UTF-8", model: string([]byte{'M', 0xff, '1'})},
+		{name: "removes CRLF", model: "model\r\nname", want: "modelname"},
+		{name: "normalizes tab", model: "model\tname", want: "model name"},
+		{name: "removes NUL", model: "model\x00name", want: "modelname"},
+		{name: "removes control character", model: "model\x1fname", want: "modelname"},
+		{name: "removes DEL", model: "model\x7fname", want: "modelname"},
+		{name: "normalizes Unicode line separator", model: "model\u2028name", want: "model name"},
+		{name: "collapses whitespace", model: "  model\t \u00a0 name  ", want: "model name"},
+		{name: "accepts maximum byte length", model: strings.Repeat("a", deviceModelMaxBytes), want: strings.Repeat("a", deviceModelMaxBytes)},
+		{name: "rejects overlong value", model: strings.Repeat("a", deviceModelMaxBytes+1)},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := normalizeDeviceModel(tt.model); got != tt.want {
+				t.Fatalf("normalizeDeviceModel(%q) = %q, want %q", tt.model, got, tt.want)
+			}
+		})
+	}
+}
+
+func TestNormalizeDeviceModelRemovesHTTPControlBytes(t *testing.T) {
+	for value := 0; value <= 0x7f; value++ {
+		if value >= 0x20 && value < 0x7f {
+			continue
+		}
+		t.Run(fmt.Sprintf("0x%02x", value), func(t *testing.T) {
+			model := "model" + string(rune(value)) + "name"
+			want := "modelname"
+			if value != '\r' && value != '\n' && value != '\x00' && unicode.IsSpace(rune(value)) {
+				want = "model name"
+			}
+			if got := normalizeDeviceModel(model); got != want {
+				t.Fatalf("normalizeDeviceModel(%q) = %q, want %q", model, got, want)
+			}
+		})
+	}
+}
+
+func TestGetOSType(t *testing.T) {
+	tests := []struct {
+		name string
+		want OSType
+	}{
+		{name: "Windows", want: OSTypeWindows},
+		{name: "Linux", want: OSTypeLinux},
+		{name: "MacOS", want: OSTypeMacOS},
+		{name: "unknown", want: OSTypeUnknown},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := GetOSType(tt.name); got != tt.want {
+				t.Errorf("GetOSType(%q) = %q, want %q", tt.name, got, tt.want)
+			}
+		})
+	}
+}

internal/riskcontrol/osmodel_windows.go

@@ -0,0 +1,44 @@
+//go:build windows
+
+// Copyright (c) 2026 Lark Technologies Pte. Ltd.
+// SPDX-License-Identifier: MIT
+
+package riskcontrol
+
+import "golang.org/x/sys/windows/registry"
+
+// systemInfoRegistryPaths lists registry locations in device-model lookup order.
+var systemInfoRegistryPaths = [...]string{
+	`HARDWARE\DESCRIPTION\System\BIOS`,
+	`SYSTEM\CurrentControlSet\Control\SystemInformation`,
+	`SYSTEM\HardwareConfig\Current`,
+}
+
+// readDeviceModel returns the first product name found in the Windows registry.
+func readDeviceModel() string {
+	return readWindowsDeviceModel(readWindowsRegistryModel)
+}
+
+func readWindowsRegistryModel(path string) (string, error) {
+	key, err := registry.OpenKey(registry.LOCAL_MACHINE, path, registry.READ)
+	if err != nil {
+		return "", err
+	}
+	defer key.Close()
+
+	model, _, err := key.GetStringValue("SystemProductName")
+	return model, err
+}
+
+func readWindowsDeviceModel(readRegistryModel func(string) (string, error)) string {
+	for _, path := range systemInfoRegistryPaths {
+		model, err := readRegistryModel(path)
+		if err != nil {
+			continue
+		}
+		if model = normalizeDeviceModel(model); model != "" {
+			return model
+		}
+	}
+	return ""
+}

internal/riskcontrol/osmodel_windows_test.go

@@ -0,0 +1,78 @@
+//go:build windows
+
+// Copyright (c) 2026 Lark Technologies Pte. Ltd.
+// SPDX-License-Identifier: MIT
+
+package riskcontrol
+
+import (
+	"errors"
+	"reflect"
+	"testing"
+)
+
+func TestReadWindowsDeviceModelFallback(t *testing.T) {
+	readError := errors.New("registry read failed")
+	tests := []struct {
+		name      string
+		values    map[string]string
+		errors    map[string]error
+		want      string
+		wantPaths []string
+	}{
+		{
+			name:      "first path wins",
+			values:    map[string]string{systemInfoRegistryPaths[0]: "Surface Laptop"},
+			want:      "Surface Laptop",
+			wantPaths: []string{systemInfoRegistryPaths[0]},
+		},
+		{
+			name: "read failure falls back",
+			errors: map[string]error{
+				systemInfoRegistryPaths[0]: readError,
+			},
+			values: map[string]string{
+				systemInfoRegistryPaths[1]: "ThinkPad X1 Carbon",
+			},
+			want:      "ThinkPad X1 Carbon",
+			wantPaths: systemInfoRegistryPaths[:2],
+		},
+		{
+			name: "empty normalized value falls back",
+			values: map[string]string{
+				systemInfoRegistryPaths[0]: " \r\n\x00",
+				systemInfoRegistryPaths[1]: "Latitude 7450",
+			},
+			want:      "Latitude 7450",
+			wantPaths: systemInfoRegistryPaths[:2],
+		},
+		{
+			name: "all paths fail",
+			errors: map[string]error{
+				systemInfoRegistryPaths[0]: readError,
+				systemInfoRegistryPaths[1]: readError,
+				systemInfoRegistryPaths[2]: readError,
+			},
+			wantPaths: systemInfoRegistryPaths[:],
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			var paths []string
+			got := readWindowsDeviceModel(func(path string) (string, error) {
+				paths = append(paths, path)
+				if err := tt.errors[path]; err != nil {
+					return "", err
+				}
+				return tt.values[path], nil
+			})
+			if got != tt.want {
+				t.Fatalf("model = %q, want %q", got, tt.want)
+			}
+			if !reflect.DeepEqual(paths, tt.wantPaths) {
+				t.Fatalf("registry paths = %v, want %v", paths, tt.wantPaths)
+			}
+		})
+	}
+}

internal/riskcontrol/transport.go

@@ -0,0 +1,162 @@
+// Copyright (c) 2026 Lark Technologies Pte. Ltd.
+// SPDX-License-Identifier: MIT
+
+package riskcontrol
+
+import (
+	"net/http"
+	"net/url"
+	"strings"
+
+	"github.com/larksuite/cli/internal/core"
+	internaltransport "github.com/larksuite/cli/internal/transport"
+)
+
+var _ internaltransport.RoundTripperDecorator = (*Transport)(nil)
+
+const (
+	HeaderProductModel = "X-Agent-Device-Type"
+	HeaderOSType       = "X-Agent-Os-Type"
+)
+
+var restrictedHeaders = [...]string{HeaderProductModel, HeaderOSType}
+
+// Transport is the feature's final outbound boundary. It removes caller- or
+// extension-supplied signal headers first and writes trusted values only after
+// authorizing an official SDK origin and authentication state.
+type Transport struct {
+	next   http.RoundTripper
+	source Source
+}
+
+// NewTransport creates the final SDK outbound policy boundary. A nil source
+// disables collection and injection while preserving restricted-header
+// stripping for opt-out and extension-credential requests.
+func NewTransport(next http.RoundTripper, source Source) *Transport {
+	if next == nil {
+		next = internaltransport.Fallback()
+	}
+	return &Transport{
+		next:   next,
+		source: source,
+	}
+}
+
+// BaseRoundTripper exposes the network transport so policy routers can clone
+// and rebuild the complete decorator graph without dropping risk control.
+func (t *Transport) BaseRoundTripper() http.RoundTripper {
+	if t == nil || t.next == nil {
+		return internaltransport.Fallback()
+	}
+	return t.next
+}
+
+// WithBaseRoundTripper returns an equivalent risk-control boundary over base.
+func (t *Transport) WithBaseRoundTripper(base http.RoundTripper) http.RoundTripper {
+	if t == nil {
+		return NewTransport(base, nil)
+	}
+	cloned := *t
+	if base == nil {
+		base = internaltransport.Fallback()
+	}
+	cloned.next = base
+	return &cloned
+}
+
+// RoundTrip implements http.RoundTripper.
+func (t *Transport) RoundTrip(req *http.Request) (*http.Response, error) {
+	req = req.Clone(req.Context())
+	if req.Header == nil {
+		req.Header = make(http.Header)
+	}
+	stripRestrictedHeaders(req.Header)
+
+	if t.source != nil && t.routeAllowsSignals(req) {
+		snapshot := t.source.Snapshot()
+		if isSupportedOSType(snapshot.OSType) {
+			req.Header.Set(HeaderOSType, string(snapshot.OSType))
+		}
+		if model := normalizeDeviceModel(snapshot.ProductModel); model != "" {
+			req.Header.Set(HeaderProductModel, model)
+		}
+	}
+	return t.next.RoundTrip(req)
+}
+
+func isSupportedOSType(value OSType) bool {
+	switch value {
+	case OSTypeWindows, OSTypeLinux, OSTypeMacOS:
+		return true
+	default:
+		return false
+	}
+}
+
+func stripRestrictedHeaders(header http.Header) {
+	for name := range header {
+		for _, restricted := range restrictedHeaders {
+			if strings.EqualFold(name, restricted) {
+				delete(header, name)
+				break
+			}
+		}
+	}
+}
+
+type origin struct {
+	scheme string
+	host   string
+	port   string
+}
+
+var officialFeishuOrigins = [...]origin{
+	apiOrigin(core.BrandFeishu, core.ResolveEndpoints(core.BrandFeishu).Open),
+	apiOrigin(core.BrandLark, core.ResolveEndpoints(core.BrandLark).Open),
+	apiOrigin(core.BrandFeishu, core.ResolveEndpoints(core.BrandFeishu).Accounts),
+	apiOrigin(core.BrandLark, core.ResolveEndpoints(core.BrandLark).Accounts),
+}
+
+func (t *Transport) routeAllowsSignals(req *http.Request) bool {
+	if req == nil || req.URL == nil {
+		return false
+	}
+	return isOfficialFeishuOrigin(originOf(req.URL))
+}
+
+func originOf(value *url.URL) origin {
+	if value == nil {
+		return origin{}
+	}
+	scheme := strings.ToLower(value.Scheme)
+	port := value.Port()
+	if port == "" {
+		switch scheme {
+		case "https":
+			port = "443"
+		case "http":
+			port = "80"
+		}
+	}
+	return origin{scheme: scheme, host: strings.ToLower(value.Hostname()), port: port}
+}
+
+func apiOrigin(brand core.LarkBrand, endpointURL string) origin {
+	endpoint, err := url.Parse(endpointURL)
+	if err != nil {
+		return origin{}
+	}
+	return originOf(endpoint)
+}
+
+func isOfficialFeishuOrigin(candidate origin) bool {
+	if candidate.scheme != "https" || candidate.port != "443" {
+		return false
+	}
+	for _, official := range officialFeishuOrigins {
+		if candidate == official {
+			return true
+		}
+	}
+	return false
+}

internal/riskcontrol/transport_test.go

@@ -0,0 +1,124 @@
+// Copyright (c) 2026 Lark Technologies Pte. Ltd.
+// SPDX-License-Identifier: MIT
+
+package riskcontrol
+
+import (
+	"net/http"
+	"strings"
+	"sync/atomic"
+	"testing"
+)
+
+type roundTripFunc func(*http.Request) (*http.Response, error)
+
+func (f roundTripFunc) RoundTrip(req *http.Request) (*http.Response, error) {
+	return f(req)
+}
+
+type countingSource struct {
+	calls atomic.Int32
+}
+
+func (s *countingSource) Snapshot() Snapshot {
+	s.calls.Add(1)
+	return Snapshot{OSType: OSTypeMacOS, ProductModel: "Mac16,1"}
+}
+
+type staticSource Snapshot
+
+func (s staticSource) Snapshot() Snapshot { return Snapshot(s) }
+
+func TestTransportAuthorizesBeforeCollecting(t *testing.T) {
+	tests := []struct {
+		name          string
+		requestURL    string
+		authorization string
+		wantSignals   bool
+	}{
+		{name: "authenticated official HTTPS", requestURL: "https://open.feishu.cn/open-apis/test", authorization: "Bearer token", wantSignals: true},
+		{name: "Lark official HTTPS", requestURL: "https://open.larksuite.com/open-apis/test", authorization: "Bearer token", wantSignals: true},
+		{name: "official explicit HTTPS port", requestURL: "https://OPEN.FEISHU.CN:443/open-apis/test", authorization: "Bearer token", wantSignals: true},
+		{name: "unauthenticated", requestURL: "https://open.feishu.cn/open-apis/test", wantSignals: true},
+		{name: "official non-OpenAPI origin", requestURL: "https://accounts.feishu.cn/open-apis/test", authorization: "Bearer token", wantSignals: true},
+		{name: "off domain", requestURL: "https://example.com/test", authorization: "Bearer token", wantSignals: false},
+		{name: "lookalike", requestURL: "https://open.feishu.cn.evil.example/test", authorization: "Bearer token", wantSignals: false},
+		{name: "plain HTTP", requestURL: "http://open.feishu.cn/test", authorization: "Bearer token", wantSignals: false},
+		{name: "non-default port", requestURL: "https://open.feishu.cn:8443/test", authorization: "Bearer token", wantSignals: false},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			source := &countingSource{}
+			var received http.Header
+			base := roundTripFunc(func(req *http.Request) (*http.Response, error) {
+				received = req.Header.Clone()
+				return &http.Response{StatusCode: http.StatusOK, Body: http.NoBody}, nil
+			})
+			req, err := http.NewRequest(http.MethodGet, test.requestURL, nil)
+			if err != nil {
+				t.Fatal(err)
+			}
+			req.Header.Set("Authorization", test.authorization)
+			req.Header.Set(HeaderOSType, "caller-value")
+			req.Header.Set(HeaderProductModel, "caller-value")
+			req.Header["x-agent-device-type"] = []string{"non-canonical-caller-value"}
+
+			resp, err := NewTransport(base, source).RoundTrip(req)
+			if err != nil {
+				t.Fatal(err)
+			}
+			resp.Body.Close()
+
+			gotSignals := received.Get(HeaderOSType) != ""
+			if gotSignals != test.wantSignals {
+				t.Fatalf("signals present = %t, want %t; headers=%v", gotSignals, test.wantSignals, received)
+			}
+			wantCalls := int32(0)
+			if test.wantSignals {
+				wantCalls = 1
+			}
+			if got := source.calls.Load(); got != wantCalls {
+				t.Fatalf("Snapshot calls = %d, want %d", got, wantCalls)
+			}
+			if got := req.Header.Get(HeaderOSType); got != "caller-value" {
+				t.Fatalf("caller request OS header = %q, want unchanged", got)
+			}
+			if got := req.Header.Get(HeaderProductModel); got != "caller-value" {
+				t.Fatalf("caller request product-model header = %q, want unchanged", got)
+			}
+			if !test.wantSignals {
+				for name := range received {
+					if strings.EqualFold(name, HeaderProductModel) || strings.EqualFold(name, HeaderOSType) {
+						t.Fatalf("restricted header leaked as %q", name)
+					}
+				}
+			}
+		})
+	}
+}
+
+func TestTransportValidatesSourceSnapshot(t *testing.T) {
+	var received http.Header
+	base := roundTripFunc(func(req *http.Request) (*http.Response, error) {
+		received = req.Header.Clone()
+		return &http.Response{StatusCode: http.StatusOK, Body: http.NoBody}, nil
+	})
+	req, err := http.NewRequest(http.MethodGet, "https://open.feishu.cn/open-apis/test", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	req.Header.Set("Authorization", "Bearer token")
+
+	resp, err := NewTransport(base, staticSource{
+		OSType:       OSType("unsupported"),
+		ProductModel: "unsafe\nvalue",
+	}).RoundTrip(req)
+	if err != nil {
+		t.Fatal(err)
+	}
+	resp.Body.Close()
+	if received.Get(HeaderOSType) == "" && received.Get(HeaderProductModel) == "" {
+		t.Fatalf("no signals collected: %v", received)
+	}
+}

internal/security/contentsafety/provider.go

@@ -24,15 +24,6 @@ type regexProvider struct {
 func (p *regexProvider) Name() string { return "regex" }
 
 func (p *regexProvider) Scan(ctx context.Context, req extcs.ScanRequest) (*extcs.Alert, error) {
-	return p.scan(ctx, req, false)
-}
-
-func (p *regexProvider) ScanFullText(ctx context.Context, req extcs.ScanRequest) (*extcs.Alert, error) {
-	req.FullText = true
-	return p.scan(ctx, req, true)
-}
-
-func (p *regexProvider) scan(ctx context.Context, req extcs.ScanRequest, fullText bool) (*extcs.Alert, error) {
 	cfg, err := p.loadOrCreate(req.ErrOut)
 	if err != nil {
 		return nil, err
@@ -46,11 +37,9 @@ func (p *regexProvider) scan(ctx context.Context, req extcs.ScanRequest, fullTex
 	}
 
 	data := normalize(req.Data)
-	s := &scanner{rules: cfg.Rules, fullText: fullText}
+	s := &scanner{rules: cfg.Rules}
 	hits := make(map[string]struct{})
-	if err := s.walk(ctx, data, hits, 0); err != nil {
-		return nil, err
-	}
+	s.walk(ctx, data, hits, 0)
 
 	if len(hits) == 0 {
 		return nil, nil

internal/security/contentsafety/provider_test.go

@@ -4,22 +4,15 @@
 package contentsafety
 
 import (
-	"bytes"
 	"context"
-	"errors"
 	"io"
 	"os"
 	"path/filepath"
-	"strings"
 	"testing"
 
-	"github.com/larksuite/cli/errs"
 	extcs "github.com/larksuite/cli/extension/contentsafety"
-	"github.com/larksuite/cli/internal/output"
 )
 
-var _ extcs.FullTextProvider = (*regexProvider)(nil)
-
 func writeTestConfig(t *testing.T, content string) string {
 	t.Helper()
 	dir := t.TempDir()
@@ -77,28 +70,6 @@ func TestProvider_ScanCleanData(t *testing.T) {
 	}
 }
 
-func TestProvider_ScanCanceledContextReturnsError(t *testing.T) {
-	dir := writeTestConfig(t, `{
-		"allowlist": ["all"],
-		"rules": [{"id": "r1", "pattern": "(?i)inject"}]
-	}`)
-	p := &regexProvider{configDir: dir}
-	ctx, cancel := context.WithCancel(context.Background())
-	cancel()
-
-	alert, err := p.Scan(ctx, extcs.ScanRequest{
-		Path:   "im.messages_search",
-		Data:   map[string]any{"text": "Hello, clean data"},
-		ErrOut: io.Discard,
-	})
-	if alert != nil {
-		t.Fatalf("Scan() alert = %v, want nil", alert)
-	}
-	if !errors.Is(err, context.Canceled) {
-		t.Fatalf("Scan() error = %v, want context.Canceled", err)
-	}
-}
-
 func TestProvider_ScanNotInAllowlist(t *testing.T) {
 	dir := writeTestConfig(t, `{
 		"allowlist": ["im"],
@@ -170,169 +141,6 @@ func TestProvider_ScanNestedData(t *testing.T) {
 	}
 }
 
-func TestProvider_FullTextBypassesPerStringCap(t *testing.T) {
-	dir := writeTestConfig(t, `{
-		"allowlist": ["all"],
-		"rules": [{"id": "tail", "pattern": "TAIL_MARKER"}]
-	}`)
-	p := &regexProvider{configDir: dir}
-	text := strings.Repeat("x", maxStringBytes+1) + "TAIL_MARKER"
-
-	alert, err := p.Scan(context.Background(), extcs.ScanRequest{
-		Path:   "test",
-		Data:   text,
-		ErrOut: io.Discard,
-	})
-	if err != nil {
-		t.Fatalf("Scan() structured-data error = %v", err)
-	}
-	if alert != nil {
-		t.Fatalf("structured-data scan should retain the per-string cap, got %v", alert)
-	}
-
-	alert, err = p.ScanFullText(context.Background(), extcs.ScanRequest{
-		Path:   "test",
-		Data:   text,
-		ErrOut: io.Discard,
-	})
-	if err != nil {
-		t.Fatalf("ScanFullText() error = %v", err)
-	}
-	if alert == nil || len(alert.MatchedRules) != 1 || alert.MatchedRules[0] != "tail" {
-		t.Fatalf("full-text scan alert = %v, want tail match", alert)
-	}
-}
-
-func TestEmitterStructuredBlockFullTextWritesZeroBytesAndWarnEmits(t *testing.T) {
-	dir := writeTestConfig(t, `{
-		"allowlist": ["all"],
-		"rules": [
-			{"id": "prefix", "pattern": "PREFIX_MARKER"},
-			{"id": "tail", "pattern": "TAIL_MARKER"}
-		]
-	}`)
-	p := &regexProvider{configDir: dir}
-	extcs.Register(p)
-	t.Cleanup(func() { extcs.Register(nil) })
-	data := map[string]any{
-		"text": "PREFIX_MARKER" + strings.Repeat("x", maxStringBytes+1) + "TAIL_MARKER",
-	}
-
-	t.Setenv("LARKSUITE_CLI_CONTENT_SAFETY_MODE", "block")
-	blockStdout := &bytes.Buffer{}
-	blockEmitter := output.NewEmitter(output.EmitterConfig{
-		Out:         blockStdout,
-		ErrOut:      io.Discard,
-		CommandPath: "lark-cli fixture +emit",
-	})
-	err := blockEmitter.Success(data, output.EmitOptions{Format: output.FormatJSON})
-	var safetyErr *errs.ContentSafetyError
-	if !errors.As(err, &safetyErr) {
-		t.Fatalf("block Emitter.Success() error = %T, want *errs.ContentSafetyError", err)
-	}
-	foundTail := false
-	for _, ruleID := range safetyErr.Rules {
-		if ruleID == "tail" {
-			foundTail = true
-			break
-		}
-	}
-	if !foundTail {
-		t.Fatalf("block matched rules = %v, want tail match beyond per-string cap", safetyErr.Rules)
-	}
-	if blockStdout.Len() != 0 {
-		t.Fatalf("block stdout bytes = %d, want 0", blockStdout.Len())
-	}
-
-	t.Setenv("LARKSUITE_CLI_CONTENT_SAFETY_MODE", "warn")
-	warnStdout := &bytes.Buffer{}
-	warnStderr := &bytes.Buffer{}
-	warnEmitter := output.NewEmitter(output.EmitterConfig{
-		Out:         warnStdout,
-		ErrOut:      warnStderr,
-		CommandPath: "lark-cli fixture +emit",
-	})
-	if err := warnEmitter.Success(data, output.EmitOptions{Format: output.FormatJSON}); err != nil {
-		t.Fatalf("warn Emitter.Success() error = %v", err)
-	}
-	if warnStdout.Len() == 0 {
-		t.Fatal("warn stdout bytes = 0, want emitted structured payload")
-	}
-	if !strings.Contains(warnStdout.String(), `"_content_safety_alert"`) ||
-		!strings.Contains(warnStdout.String(), `"prefix"`) {
-		t.Fatalf("warn stdout = %q, want embedded prefix content-safety warning", warnStdout.String())
-	}
-	if warnStderr.Len() != 0 {
-		t.Fatalf("warn stderr = %q, want empty for JSON envelope warning", warnStderr.String())
-	}
-}
-
-func TestEmitterStructuredBlockDepthIncompleteWritesZeroBytes(t *testing.T) {
-	dir := writeTestConfig(t, `{
-		"allowlist": ["all"],
-		"rules": [{"id": "deep", "pattern": "DEEP_MARKER"}]
-	}`)
-	p := &regexProvider{configDir: dir}
-	extcs.Register(p)
-	t.Cleanup(func() { extcs.Register(nil) })
-	var data any = "DEEP_MARKER"
-	for i := 0; i < maxDepth+5; i++ {
-		data = map[string]any{"nested": data}
-	}
-
-	t.Setenv("LARKSUITE_CLI_CONTENT_SAFETY_MODE", "block")
-	stdout := &bytes.Buffer{}
-	emitter := output.NewEmitter(output.EmitterConfig{
-		Out:         stdout,
-		ErrOut:      io.Discard,
-		CommandPath: "lark-cli fixture +emit",
-	})
-	err := emitter.Success(data, output.EmitOptions{Format: output.FormatJSON})
-	var safetyErr *errs.ContentSafetyError
-	if !errors.As(err, &safetyErr) {
-		t.Fatalf("Emitter.Success() error = %T, want *errs.ContentSafetyError", err)
-	}
-	if !strings.Contains(safetyErr.Message, "scan did not complete") {
-		t.Fatalf("Emitter.Success() error = %v, want scan-incomplete message", err)
-	}
-	if stdout.Len() != 0 {
-		t.Fatalf("block stdout bytes = %d, want 0", stdout.Len())
-	}
-}
-
-func TestProvider_ScanDetectsInjectionInMapKey(t *testing.T) {
-	// A rule match hiding in a map key (which JSON/NDJSON/table/CSV all emit)
-	// must be detected, not just matches in values.
-	dir := writeTestConfig(t, `{
-		"allowlist": ["all"],
-		"rules": [{"id": "override", "pattern": "(?i)ignore previous instructions"}]
-	}`)
-	p := &regexProvider{configDir: dir}
-	data := map[string]any{"ignore previous instructions": "ok"}
-
-	for _, tc := range []struct {
-		name string
-		scan func() (*extcs.Alert, error)
-	}{
-		{"Scan", func() (*extcs.Alert, error) {
-			return p.Scan(context.Background(), extcs.ScanRequest{Path: "test", Data: data, ErrOut: io.Discard})
-		}},
-		{"ScanFullText", func() (*extcs.Alert, error) {
-			return p.ScanFullText(context.Background(), extcs.ScanRequest{Path: "test", Data: data, ErrOut: io.Discard})
-		}},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			alert, err := tc.scan()
-			if err != nil {
-				t.Fatalf("%s() error = %v", tc.name, err)
-			}
-			if alert == nil || len(alert.MatchedRules) != 1 || alert.MatchedRules[0] != "override" {
-				t.Fatalf("%s() alert = %v, want override match on the map key", tc.name, alert)
-			}
-		})
-	}
-}
-
 func TestProvider_EmptyRulesNoAlert(t *testing.T) {
 	dir := writeTestConfig(t, `{"allowlist":["all"],"rules":[]}`)
 	p := &regexProvider{configDir: dir}

internal/security/contentsafety/scanner.go

@@ -5,8 +5,6 @@ package contentsafety
 
 import (
 	"context"
-	"errors"
-	"fmt"
 	"regexp"
 )
 
@@ -15,52 +13,38 @@ const (
 	maxDepth       = 64
 )
 
-var errScanIncomplete = errors.New("content safety scan incomplete")
-
 type rule struct {
 	ID      string
 	Pattern *regexp.Regexp
 }
 
 type scanner struct {
-	rules    []rule
-	fullText bool
+	rules []rule
 }
 
-func (s *scanner) walk(ctx context.Context, v any, hits map[string]struct{}, depth int) error {
-	if err := ctx.Err(); err != nil {
-		return err
-	}
+func (s *scanner) walk(ctx context.Context, v any, hits map[string]struct{}, depth int) {
 	if depth > maxDepth {
-		if s.fullText {
-			return fmt.Errorf("%w: maximum depth %d exceeded", errScanIncomplete, maxDepth)
-		}
-		return nil
+		return
+	}
+	if ctx.Err() != nil {
+		return
 	}
 	switch t := v.(type) {
 	case string:
 		s.scanString(t, hits)
 	case map[string]any:
-		for k, child := range t {
-			// Scan the key too: JSON/NDJSON/table/CSV all emit map keys, so a
-			// rule match hiding in a key must not slip past block mode.
-			s.scanString(k, hits)
-			if err := s.walk(ctx, child, hits, depth+1); err != nil {
-				return err
-			}
+		for _, child := range t {
+			s.walk(ctx, child, hits, depth+1)
 		}
 	case []any:
 		for _, child := range t {
-			if err := s.walk(ctx, child, hits, depth+1); err != nil {
-				return err
-			}
+			s.walk(ctx, child, hits, depth+1)
 		}
 	}
-	return ctx.Err()
 }
 
 func (s *scanner) scanString(text string, hits map[string]struct{}) {
-	if !s.fullText && len(text) > maxStringBytes {
+	if len(text) > maxStringBytes {
 		text = text[:maxStringBytes]
 	}
 	for _, r := range s.rules {

internal/security/contentsafety/scanner_test.go

@@ -5,7 +5,6 @@ package contentsafety
 
 import (
 	"context"
-	"errors"
 	"regexp"
 	"testing"
 )
@@ -46,23 +45,6 @@ func TestScanString_Truncate(t *testing.T) {
 	}
 }
 
-func TestScanString_FullTextDoesNotTruncate(t *testing.T) {
-	s := &scanner{
-		rules:    []rule{testRule("tail", `TAIL_MARKER`)},
-		fullText: true,
-	}
-	big := make([]byte, maxStringBytes+100)
-	for i := range big {
-		big[i] = 'x'
-	}
-	copy(big[maxStringBytes+10:], "TAIL_MARKER")
-	hits := make(map[string]struct{})
-	s.scanString(string(big), hits)
-	if _, ok := hits["tail"]; !ok {
-		t.Error("full-text scan should match marker beyond maxStringBytes")
-	}
-}
-
 func TestScanString_SkipsDuplicate(t *testing.T) {
 	s := &scanner{rules: []rule{testRule("r1", `match`)}}
 	hits := map[string]struct{}{"r1": {}}
@@ -80,34 +62,16 @@ func TestWalk_NestedMap(t *testing.T) {
 		},
 	}
 	hits := make(map[string]struct{})
-	if err := s.walk(context.Background(), data, hits, 0); err != nil {
-		t.Fatalf("walk() error = %v", err)
-	}
+	s.walk(context.Background(), data, hits, 0)
 	if _, ok := hits["found"]; !ok {
 		t.Error("expected to find 'inject' in nested map")
 	}
 }
 
-func TestWalk_ScansMapKeys(t *testing.T) {
-	// JSON/NDJSON/table/CSV all emit map keys, so a rule match hiding in a key
-	// must be scanned too — not only the value.
-	s := &scanner{rules: []rule{testRule("found", `(?i)inject`)}}
-	data := map[string]any{"please inject this": "harmless value"}
-	hits := make(map[string]struct{})
-	if err := s.walk(context.Background(), data, hits, 0); err != nil {
-		t.Fatalf("walk() error = %v", err)
-	}
-	if _, ok := hits["found"]; !ok {
-		t.Error("expected to match a rule hiding in a map key")
-	}
-}
-
 func TestWalk_Array(t *testing.T) {
 	s := &scanner{rules: []rule{testRule("found", `(?i)inject`)}}
 	hits := make(map[string]struct{})
-	if err := s.walk(context.Background(), []any{"normal", "try to inject"}, hits, 0); err != nil {
-		t.Fatalf("walk() error = %v", err)
-	}
+	s.walk(context.Background(), []any{"normal", "try to inject"}, hits, 0)
 	if _, ok := hits["found"]; !ok {
 		t.Error("expected to find 'inject' in array")
 	}
@@ -120,42 +84,18 @@ func TestWalk_MaxDepth(t *testing.T) {
 		data = map[string]any{"n": data}
 	}
 	hits := make(map[string]struct{})
-	if err := s.walk(context.Background(), data, hits, 0); err != nil {
-		t.Fatalf("walk() error = %v", err)
-	}
+	s.walk(context.Background(), data, hits, 0)
 	if _, ok := hits["deep"]; ok {
 		t.Error("should not reach string beyond maxDepth")
 	}
 }
 
-func TestWalk_FullTextMaxDepthReturnsIncomplete(t *testing.T) {
-	s := &scanner{
-		rules:    []rule{testRule("deep", `secret`)},
-		fullText: true,
-	}
-	var data any = "secret"
-	for i := 0; i < maxDepth+5; i++ {
-		data = map[string]any{"n": data}
-	}
-	hits := make(map[string]struct{})
-	err := s.walk(context.Background(), data, hits, 0)
-	if !errors.Is(err, errScanIncomplete) {
-		t.Fatalf("walk() error = %v, want errScanIncomplete", err)
-	}
-	if _, ok := hits["deep"]; ok {
-		t.Error("full-text walk should report incomplete before matching data beyond maxDepth")
-	}
-}
-
 func TestWalk_ContextCancel(t *testing.T) {
 	s := &scanner{rules: []rule{testRule("found", `target`)}}
 	ctx, cancel := context.WithCancel(context.Background())
 	cancel()
 	hits := make(map[string]struct{})
-	err := s.walk(ctx, map[string]any{"key": "target"}, hits, 0)
-	if !errors.Is(err, context.Canceled) {
-		t.Fatalf("walk() error = %v, want context.Canceled", err)
-	}
+	s.walk(ctx, map[string]any{"key": "target"}, hits, 0)
 	if _, ok := hits["found"]; ok {
 		t.Error("should not match after context cancel")
 	}

internal/transport/config.go

@@ -2,7 +2,7 @@
 // SPDX-License-Identifier: MIT
 
 // Package transport owns how the CLI assembles its outbound HTTP transport: the
-// shared base RoundTripper (Shared/Fallback/NewHTTPClient), the LARK_CLI_NO_PROXY
+// shared base RoundTripper (Shared/Fallback and the HTTP client constructors), the LARK_CLI_NO_PROXY
 // direct-egress clone, and the ~/.lark-cli/proxy_config.json proxy-plugin mode.
 //
 // Proxy-plugin mode forces all outbound HTTP(S) requests through a fixed loopback

internal/transport/default_client.go

@@ -0,0 +1,258 @@
+// Copyright (c) 2026 Lark Technologies Pte. Ltd.
+// SPDX-License-Identifier: MIT
+
+package transport
+
+import (
+	"context"
+	"net/http"
+	"net/url"
+	"strings"
+	"sync"
+
+	larkws "github.com/larksuite/oapi-sdk-go/v3/ws"
+
+	"github.com/larksuite/cli/errs"
+	exttransport "github.com/larksuite/cli/extension/transport"
+	"github.com/larksuite/cli/internal/core"
+)
+
+type requestMatcher func(*http.Request) bool
+type transportPolicyBuilder func(http.RoundTripper) http.RoundTripper
+
+type sdkBootstrapRedirectContextKey struct{}
+
+var (
+	// larkws pins this client during package initialization.
+	sdkBootstrapHTTPClient = http.DefaultClient
+	installDefaultClientMu sync.Mutex
+)
+
+// sdkBootstrapTransport applies the platform HTTP policy only to dependency
+// bootstrap requests selected by match. Unmatched DefaultClient traffic is
+// delegated directly to the previous transport.
+type sdkBootstrapTransport struct {
+	base                http.RoundTripper
+	match               requestMatcher
+	buildPlatformPolicy transportPolicyBuilder
+
+	policyMu sync.RWMutex
+}
+
+func (t *sdkBootstrapTransport) RoundTrip(req *http.Request) (*http.Response, error) {
+	if !t.isBootstrapRequest(req) {
+		return t.fallbackTransport().RoundTrip(req)
+	}
+
+	base := t.base
+	if base == nil {
+		// Resolve Shared lazily so bridge installation never initializes
+		// workspace-scoped proxy state ahead of workspace selection.
+		base = Shared()
+	}
+	buildPlatformPolicy := t.platformPolicyBuilder()
+	if buildPlatformPolicy == nil {
+		return nil, errs.NewInternalError(
+			errs.SubtypeUnknown,
+			"SDK bootstrap transport policy is not configured",
+		)
+	}
+	base = buildPlatformPolicy(base)
+	if base == nil {
+		return nil, errs.NewInternalError(
+			errs.SubtypeUnknown,
+			"SDK bootstrap transport policy returned a nil transport",
+		)
+	}
+
+	// Resolve extensions per hop so redirects retain platform policy.
+	extended := WrapWithExtensionForClass(base, exttransport.RequestClassPlatform)
+	guarded := &sameOriginRedirectTransport{base: extended}
+	return guarded.RoundTrip(req)
+}
+
+func (t *sdkBootstrapTransport) platformPolicyBuilder() transportPolicyBuilder {
+	t.policyMu.RLock()
+	defer t.policyMu.RUnlock()
+	return t.buildPlatformPolicy
+}
+
+func (t *sdkBootstrapTransport) setPlatformPolicyBuilder(build transportPolicyBuilder) {
+	t.policyMu.Lock()
+	t.buildPlatformPolicy = build
+	t.policyMu.Unlock()
+}
+
+func (t *sdkBootstrapTransport) isBootstrapRequest(req *http.Request) bool {
+	if req == nil {
+		return false
+	}
+	if _, redirected := req.Context().Value(sdkBootstrapRedirectContextKey{}).(struct{}); redirected {
+		return true
+	}
+	return t.match != nil && t.match(req)
+}
+
+func (t *sdkBootstrapTransport) fallbackTransport() http.RoundTripper {
+	if t.base != nil {
+		return t.base
+	}
+	// Preserve net/http's dynamic nil-Transport fallback.
+	return http.DefaultTransport
+}
+
+// sameOriginRedirectTransport rejects redirects before net/http can replay a
+// bootstrap request to a different logical origin.
+type sameOriginRedirectTransport struct {
+	base http.RoundTripper
+}
+
+func (t *sameOriginRedirectTransport) RoundTrip(req *http.Request) (*http.Response, error) {
+	resp, err := t.base.RoundTrip(req)
+	if err != nil || resp == nil || !isFollowedRedirect(resp.StatusCode) {
+		return resp, err
+	}
+
+	location := resp.Header.Get("Location")
+	if location == "" {
+		return resp, nil
+	}
+	target, parseErr := req.URL.Parse(location)
+	if parseErr != nil {
+		if resp.Body != nil {
+			_ = resp.Body.Close()
+		}
+		return nil, errs.NewInternalError(
+			errs.SubtypeInvalidResponse,
+			"platform request returned an invalid redirect location: %v",
+			parseErr,
+		).WithCause(parseErr)
+	}
+	if sameOrigin(req.URL, target) {
+		return resp, nil
+	}
+
+	if resp.Body != nil {
+		_ = resp.Body.Close()
+	}
+	return nil, errs.NewSecurityPolicyError(
+		errs.SubtypeAccessDenied,
+		"platform bootstrap blocked cross-origin redirect from %q to %q",
+		originName(req.URL),
+		originName(target),
+	)
+}
+
+// sdkBootstrapRedirectPolicy preserves the prior hook and marks each redirect hop.
+func sdkBootstrapRedirectPolicy(
+	match requestMatcher,
+	previous func(*http.Request, []*http.Request) error,
+) func(*http.Request, []*http.Request) error {
+	return func(req *http.Request, via []*http.Request) error {
+		if previous != nil {
+			if err := previous(req, via); err != nil {
+				return err
+			}
+		} else if len(via) >= 10 {
+			// Retain net/http's default redirect limit.
+			return errs.NewNetworkError(
+				errs.SubtypeNetworkTransport,
+				"stopped after 10 redirects",
+			)
+		}
+
+		if req == nil || len(via) == 0 || match == nil || !match(via[0]) {
+			return nil
+		}
+
+		ctx := context.WithValue(req.Context(), sdkBootstrapRedirectContextKey{}, struct{}{})
+		*req = *req.WithContext(ctx)
+		return nil
+	}
+}
+
+func originName(candidate *url.URL) string {
+	if candidate == nil {
+		return ""
+	}
+	return strings.ToLower(candidate.Scheme) + "://" + candidate.Host
+}
+
+func sameOrigin(left, right *url.URL) bool {
+	if left == nil || right == nil {
+		return false
+	}
+	return strings.EqualFold(left.Scheme, right.Scheme) &&
+		strings.EqualFold(left.Hostname(), right.Hostname()) &&
+		originPort(left) == originPort(right)
+}
+
+func originPort(candidate *url.URL) string {
+	if port := candidate.Port(); port != "" {
+		return port
+	}
+	switch strings.ToLower(candidate.Scheme) {
+	case "http":
+		return "80"
+	case "https":
+		return "443"
+	default:
+		return ""
+	}
+}
+
+func isFollowedRedirect(status int) bool {
+	switch status {
+	case http.StatusMovedPermanently,
+		http.StatusFound,
+		http.StatusSeeOther,
+		http.StatusTemporaryRedirect,
+		http.StatusPermanentRedirect:
+		return true
+	default:
+		return false
+	}
+}
+
+// InstallSDKTransportBridge wraps larkws's captured HTTP bootstrap client. All
+// requests through that client hit the bridge, but only matched bootstrap
+// traffic uses platform policy. The SDK owns the subsequent WebSocket dial,
+// which does not use this net/http transport.
+func InstallSDKTransportBridge(buildPlatformPolicy func(http.RoundTripper) http.RoundTripper) {
+	installDefaultClientMu.Lock()
+	defer installDefaultClientMu.Unlock()
+	installSDKTransportBridge(
+		sdkBootstrapHTTPClient,
+		isSDKWebSocketBootstrapRequest,
+		buildPlatformPolicy,
+	)
+}
+
+func isSDKWebSocketBootstrapRequest(req *http.Request) bool {
+	return req != nil &&
+		req.Method == http.MethodPost &&
+		core.IsPlatformEndpointURL(req.URL) &&
+		req.URL.Path == larkws.GenEndpointUri
+}
+
+func installSDKTransportBridge(
+	client *http.Client,
+	match requestMatcher,
+	buildPlatformPolicy transportPolicyBuilder,
+) {
+	if client == nil {
+		return
+	}
+	if existing, ok := client.Transport.(*sdkBootstrapTransport); ok {
+		existing.setPlatformPolicyBuilder(buildPlatformPolicy)
+		return
+	}
+	base := client.Transport
+	previousRedirect := client.CheckRedirect
+	client.Transport = &sdkBootstrapTransport{
+		base:                base,
+		match:               match,
+		buildPlatformPolicy: buildPlatformPolicy,
+	}
+	client.CheckRedirect = sdkBootstrapRedirectPolicy(match, previousRedirect)
+}

internal/transport/extension.go

@@ -0,0 +1,120 @@
+// Copyright (c) 2026 Lark Technologies Pte. Ltd.
+// SPDX-License-Identifier: MIT
+
+package transport
+
+import (
+	"context"
+	"net/http"
+
+	exttransport "github.com/larksuite/cli/extension/transport"
+)
+
+var _ RoundTripperDecorator = (*ExtensionMiddleware)(nil)
+
+type resolvedExtension struct {
+	provider    exttransport.Provider
+	interceptor exttransport.Interceptor
+}
+
+func resolveExtension() *resolvedExtension {
+	p := exttransport.GetProvider()
+	if p == nil {
+		return nil
+	}
+	interceptor := p.ResolveInterceptor(context.Background())
+	if interceptor == nil {
+		return nil
+	}
+	return &resolvedExtension{provider: p, interceptor: interceptor}
+}
+
+func (e *resolvedExtension) wrap(base http.RoundTripper, class exttransport.RequestClass, enforceScope bool) http.RoundTripper {
+	if base == nil {
+		base = Shared()
+	}
+	if e == nil {
+		return base
+	}
+	if enforceScope {
+		if scoped, ok := e.provider.(exttransport.ScopedProvider); ok && !scoped.SupportsRequestClass(class) {
+			return base
+		}
+	}
+	return &ExtensionMiddleware{Base: base, Ext: e.interceptor, ExtName: e.provider.Name()}
+}
+
+// ExtensionMiddleware wraps the built-in transport chain with extension
+// pre/post hooks. The built-in chain always executes unless an
+// exttransport.AbortableInterceptor rejects the request.
+//
+// The original request context is restored after the pre hook to prevent an
+// extension from replacing cancellation, deadlines, or built-in values. The
+// request is cloned so URL and header mutations do not alter the caller's
+// request object. The body remains shared; interceptors that consume it must
+// restore it before returning.
+type ExtensionMiddleware struct {
+	Base    http.RoundTripper
+	Ext     exttransport.Interceptor
+	ExtName string
+}
+
+// BaseRoundTripper returns the wrapped built-in transport chain.
+func (m *ExtensionMiddleware) BaseRoundTripper() http.RoundTripper {
+	if m.Base == nil {
+		return Shared()
+	}
+	return m.Base
+}
+
+// WithBaseRoundTripper clones the middleware over base.
+func (m *ExtensionMiddleware) WithBaseRoundTripper(base http.RoundTripper) http.RoundTripper {
+	cloned := *m
+	cloned.Base = base
+	return &cloned
+}
+
+// RoundTrip invokes the extension pre hook, the wrapped transport, and then
+// the optional post hook. Abortable interceptors can stop the request before
+// the wrapped transport is called.
+func (m *ExtensionMiddleware) RoundTrip(req *http.Request) (*http.Response, error) {
+	origCtx := req.Context()
+	req = req.Clone(origCtx)
+
+	var (
+		post     func(*http.Response, error)
+		abortErr error
+	)
+	if a, ok := m.Ext.(exttransport.AbortableInterceptor); ok {
+		post, abortErr = a.PreRoundTripE(req)
+	} else {
+		post = m.Ext.PreRoundTrip(req)
+	}
+	if abortErr != nil {
+		if post != nil {
+			post(nil, abortErr)
+		}
+		return nil, &exttransport.AbortError{Extension: m.ExtName, Reason: abortErr}
+	}
+
+	req = req.WithContext(origCtx)
+	resp, err := m.BaseRoundTripper().RoundTrip(req)
+	if post != nil {
+		post(resp, err)
+	}
+	return resp, err
+}
+
+// WrapWithExtension wraps base with the currently registered transport
+// extension. With no registered provider or no resolved interceptor, base is
+// returned unchanged.
+func WrapWithExtension(base http.RoundTripper) http.RoundTripper {
+	return resolveExtension().wrap(base, "", false)
+}
+
+// WrapWithExtensionForClass wraps base only when the registered provider
+// supports class. Providers without the optional ScopedProvider interface keep
+// their historical all-request behavior.
+func WrapWithExtensionForClass(base http.RoundTripper, class exttransport.RequestClass) http.RoundTripper {
+	return resolveExtension().wrap(base, class, true)
+}

internal/transport/extension_test.go

@@ -0,0 +1,924 @@
+// Copyright (c) 2026 Lark Technologies Pte. Ltd.
+// SPDX-License-Identifier: MIT
+
+package transport
+
+import (
+	"context"
+	"errors"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"strconv"
+	"strings"
+	"sync/atomic"
+	"testing"
+
+	larkws "github.com/larksuite/oapi-sdk-go/v3/ws"
+
+	"github.com/larksuite/cli/errs"
+	exttransport "github.com/larksuite/cli/extension/transport"
+)
+
+type testProvider struct {
+	interceptor  exttransport.Interceptor
+	resolveCalls *int
+}
+
+func (p testProvider) Name() string { return "test-provider" }
+
+func (p testProvider) ResolveInterceptor(context.Context) exttransport.Interceptor {
+	if p.resolveCalls != nil {
+		*p.resolveCalls++
+	}
+	return p.interceptor
+}
+
+type scopedTestProvider struct {
+	testProvider
+	supported exttransport.RequestClass
+}
+
+func (p scopedTestProvider) SupportsRequestClass(class exttransport.RequestClass) bool {
+	return class == p.supported
+}
+
+type testHeaderInterceptor struct {
+	calls int
+}
+
+func (i *testHeaderInterceptor) PreRoundTrip(req *http.Request) func(*http.Response, error) {
+	i.calls++
+	req.Header.Set("X-Test-Platform", "routed")
+	return nil
+}
+
+type abortingTestInterceptor struct {
+	reason error
+	post   func(*http.Response, error)
+}
+
+func (i *abortingTestInterceptor) PreRoundTrip(*http.Request) func(*http.Response, error) {
+	panic("PreRoundTrip called for abortable interceptor")
+}
+
+func (i *abortingTestInterceptor) PreRoundTripE(*http.Request) (func(*http.Response, error), error) {
+	return i.post, i.reason
+}
+
+func TestLegacyProviderKeepsAllRequestBehavior(t *testing.T) {
+	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
+	unsetProxyPluginEnv(t)
+	resetProxyPluginState()
+	t.Setenv(EnvNoProxy, "")
+
+	interceptor := &testHeaderInterceptor{}
+	previousProvider := exttransport.GetProvider()
+	exttransport.Register(testProvider{interceptor: interceptor})
+	t.Cleanup(func() { exttransport.Register(previousProvider) })
+
+	received := make(chan string, 2)
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
+		received <- req.Header.Get("X-Test-Platform")
+		w.WriteHeader(http.StatusNoContent)
+	}))
+	t.Cleanup(server.Close)
+
+	for _, client := range []*http.Client{
+		ClientForRequestClass(NewHTTPClient(0), exttransport.RequestClassPlatform),
+		NewExternalHTTPClient(0),
+	} {
+		resp, err := client.Get(server.URL)
+		if err != nil {
+			t.Fatal(err)
+		}
+		resp.Body.Close()
+	}
+
+	if got := <-received; got != "routed" {
+		t.Fatalf("platform request header = %q, want routed", got)
+	}
+	if got := <-received; got != "routed" {
+		t.Fatalf("external request header = %q, want routed for legacy provider", got)
+	}
+	if interceptor.calls != 2 {
+		t.Fatalf("extension calls = %d, want exactly 2", interceptor.calls)
+	}
+}
+
+func TestScopedProviderOnlyRunsForSupportedRequestClass(t *testing.T) {
+	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
+	unsetProxyPluginEnv(t)
+	resetProxyPluginState()
+	t.Setenv(EnvNoProxy, "")
+
+	interceptor := &testHeaderInterceptor{}
+	previousProvider := exttransport.GetProvider()
+	exttransport.Register(scopedTestProvider{
+		testProvider: testProvider{interceptor: interceptor},
+		supported:    exttransport.RequestClassPlatform,
+	})
+	t.Cleanup(func() { exttransport.Register(previousProvider) })
+
+	received := make(chan string, 2)
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
+		received <- req.Header.Get("X-Test-Platform")
+		w.WriteHeader(http.StatusNoContent)
+	}))
+	t.Cleanup(server.Close)
+
+	clients := []*http.Client{
+		ClientForRequestClass(NewHTTPClient(0), exttransport.RequestClassPlatform),
+		NewExternalHTTPClient(0),
+	}
+	for _, client := range clients {
+		resp, err := client.Get(server.URL)
+		if err != nil {
+			t.Fatal(err)
+		}
+		resp.Body.Close()
+	}
+
+	if got := <-received; got != "routed" {
+		t.Fatalf("platform request header = %q, want routed", got)
+	}
+	if got := <-received; got != "" {
+		t.Fatalf("external request received scoped provider header %q", got)
+	}
+	if interceptor.calls != 1 {
+		t.Fatalf("extension calls = %d, want exactly 1", interceptor.calls)
+	}
+}
+
+func TestHTTPPolicyRouterResolvesProviderOnce(t *testing.T) {
+	resolveCalls := 0
+	previousProvider := exttransport.GetProvider()
+	exttransport.Register(testProvider{
+		interceptor:  &testHeaderInterceptor{},
+		resolveCalls: &resolveCalls,
+	})
+	t.Cleanup(func() { exttransport.Register(previousProvider) })
+
+	base := roundTripFunc(func(req *http.Request) (*http.Response, error) {
+		return &http.Response{StatusCode: http.StatusNoContent, Body: http.NoBody, Request: req}, nil
+	})
+	_ = NewHTTPPolicyRouter(base, base)
+
+	if resolveCalls != 1 {
+		t.Fatalf("ResolveInterceptor() calls = %d, want 1 per router", resolveCalls)
+	}
+}
+
+func TestSDKBootstrapBridgeBlocksCrossOriginRedirectAfterSameOriginHop(t *testing.T) {
+	var externalCalls atomic.Int32
+	var relayBody string
+	base := roundTripFunc(func(req *http.Request) (*http.Response, error) {
+		if req.URL.Host == "external.example" {
+			externalCalls.Add(1)
+			return noContentResponse(req), nil
+		}
+		switch req.URL.Path {
+		case "/bootstrap":
+			return redirectResponse(req, http.StatusTemporaryRedirect, "/relay"), nil
+		case "/relay":
+			body, err := io.ReadAll(req.Body)
+			if err != nil {
+				return nil, err
+			}
+			relayBody = string(body)
+			return redirectResponse(
+				req,
+				http.StatusPermanentRedirect,
+				"https://external.example/target",
+			), nil
+		default:
+			return noContentResponse(req), nil
+		}
+	})
+
+	client := &http.Client{Transport: base}
+	installSDKTransportBridge(client, func(req *http.Request) bool {
+		return req.URL != nil && req.URL.Path == "/bootstrap"
+	}, identityTransportPolicy)
+
+	const secret = "app_secret=secret"
+	req, err := http.NewRequest(
+		http.MethodPost,
+		"https://platform.example/bootstrap",
+		strings.NewReader(secret),
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+	resp, err := client.Do(req)
+	if resp != nil && resp.Body != nil {
+		resp.Body.Close()
+	}
+	if err == nil || !strings.Contains(err.Error(), "cross-origin redirect") {
+		t.Fatalf("Do() error = %v, want cross-origin redirect rejection", err)
+	}
+	if problem, ok := errs.ProblemOf(err); !ok ||
+		problem.Category != errs.CategoryPolicy ||
+		problem.Subtype != errs.SubtypeAccessDenied {
+		t.Fatalf("Do() problem = %#v, %v; want policy/access_denied", problem, ok)
+	}
+	if relayBody != secret {
+		t.Fatalf("same-origin relay body = %q, want %q", relayBody, secret)
+	}
+	if got := externalCalls.Load(); got != 0 {
+		t.Fatalf("cross-origin target calls = %d, want 0", got)
+	}
+}
+
+func TestSDKBootstrapRedirectGuardClassifiesInvalidLocation(t *testing.T) {
+	base := roundTripFunc(func(req *http.Request) (*http.Response, error) {
+		return redirectResponse(req, http.StatusFound, "%"), nil
+	})
+	client := &http.Client{Transport: &sameOriginRedirectTransport{base: base}}
+	resp, err := client.Get("https://platform.example/bootstrap")
+	if resp != nil && resp.Body != nil {
+		resp.Body.Close()
+	}
+	if err == nil || !strings.Contains(err.Error(), "invalid redirect location") {
+		t.Fatalf("Do() error = %v, want invalid redirect rejection", err)
+	}
+	problem, ok := errs.ProblemOf(err)
+	if !ok || problem.Category != errs.CategoryInternal || problem.Subtype != errs.SubtypeInvalidResponse {
+		t.Fatalf("Do() problem = %#v, %v; want internal/invalid_response", problem, ok)
+	}
+}
+
+type redirectPolicyInterceptor struct {
+	calls int
+}
+
+func (i *redirectPolicyInterceptor) PreRoundTrip(req *http.Request) func(*http.Response, error) {
+	i.calls++
+	req.Header.Set("X-Extension-Hop", strconv.Itoa(i.calls))
+	req.Header.Set("X-Reserved", "extension")
+	return nil
+}
+
+func TestSDKBootstrapBridgeRetainsPoliciesAcrossSameOriginRedirect(t *testing.T) {
+	previousProvider := exttransport.GetProvider()
+	interceptor := &redirectPolicyInterceptor{}
+	exttransport.Register(scopedTestProvider{
+		testProvider: testProvider{interceptor: interceptor},
+		supported:    exttransport.RequestClassPlatform,
+	})
+	t.Cleanup(func() { exttransport.Register(previousProvider) })
+
+	var finalHeaders http.Header
+	base := roundTripFunc(func(req *http.Request) (*http.Response, error) {
+		switch req.URL.Path {
+		case "/bootstrap":
+			return redirectResponse(req, http.StatusTemporaryRedirect, "/next"), nil
+		case "/next":
+			finalHeaders = req.Header.Clone()
+			return noContentResponse(req), nil
+		default:
+			return noContentResponse(req), nil
+		}
+	})
+
+	builtInCalls := 0
+	client := &http.Client{Transport: base}
+	installSDKTransportBridge(
+		client,
+		func(req *http.Request) bool {
+			return req.URL != nil && req.URL.Path == "/bootstrap"
+		},
+		func(base http.RoundTripper) http.RoundTripper {
+			return roundTripFunc(func(req *http.Request) (*http.Response, error) {
+				builtInCalls++
+				req = req.Clone(req.Context())
+				req.Header.Set("X-Builtin-Hop", strconv.Itoa(builtInCalls))
+				req.Header.Set("X-Reserved", "trusted")
+				return base.RoundTrip(req)
+			})
+		},
+	)
+
+	req, err := http.NewRequest(
+		http.MethodPost,
+		"https://platform.example/bootstrap",
+		strings.NewReader("body"),
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+	resp, err := client.Do(req)
+	if err != nil {
+		t.Fatal(err)
+	}
+	resp.Body.Close()
+
+	if finalHeaders == nil {
+		t.Fatal("same-origin redirect target was not called")
+	}
+	if interceptor.calls != 2 {
+		t.Fatalf("extension calls = %d, want 2", interceptor.calls)
+	}
+	if builtInCalls != 2 {
+		t.Fatalf("built-in policy calls = %d, want 2", builtInCalls)
+	}
+	if got := finalHeaders.Get("X-Extension-Hop"); got != "2" {
+		t.Fatalf("final X-Extension-Hop = %q, want 2", got)
+	}
+	if got := finalHeaders.Get("X-Builtin-Hop"); got != "2" {
+		t.Fatalf("final X-Builtin-Hop = %q, want 2", got)
+	}
+	if got := finalHeaders.Get("X-Reserved"); got != "trusted" {
+		t.Fatalf("final X-Reserved = %q, want trusted built-in value", got)
+	}
+}
+
+type redirectRewriteInterceptor struct {
+	target       *url.URL
+	postLocation string
+	calls        int
+}
+
+func (i *redirectRewriteInterceptor) PreRoundTrip(req *http.Request) func(*http.Response, error) {
+	i.calls++
+	req.URL.Scheme = i.target.Scheme
+	req.URL.Host = i.target.Host
+	if i.postLocation == "" {
+		return nil
+	}
+	return func(resp *http.Response, err error) {
+		if err == nil && resp != nil && isFollowedRedirect(resp.StatusCode) {
+			resp.Header.Set("Location", i.postLocation)
+		}
+	}
+}
+
+func TestSDKBootstrapRedirectGuardUsesLogicalURLAfterExtensionRewrite(t *testing.T) {
+	sidecarURL, err := url.Parse("https://sidecar.example")
+	if err != nil {
+		t.Fatal(err)
+	}
+	sidecarCalls := 0
+	base := roundTripFunc(func(req *http.Request) (*http.Response, error) {
+		if req.URL.Host != sidecarURL.Host {
+			t.Fatalf("network host = %q, want extension target %q", req.URL.Host, sidecarURL.Host)
+		}
+		sidecarCalls++
+		switch req.URL.Path {
+		case "/bootstrap":
+			return redirectResponse(
+				req,
+				http.StatusTemporaryRedirect,
+				"https://platform.example/next",
+			), nil
+		case "/next":
+			return noContentResponse(req), nil
+		default:
+			return noContentResponse(req), nil
+		}
+	})
+
+	previousProvider := exttransport.GetProvider()
+	interceptor := &redirectRewriteInterceptor{target: sidecarURL}
+	exttransport.Register(scopedTestProvider{
+		testProvider: testProvider{interceptor: interceptor},
+		supported:    exttransport.RequestClassPlatform,
+	})
+	t.Cleanup(func() { exttransport.Register(previousProvider) })
+
+	client := &http.Client{Transport: base}
+	installSDKTransportBridge(client, func(req *http.Request) bool {
+		return req.URL != nil && req.URL.Path == "/bootstrap"
+	}, identityTransportPolicy)
+
+	req, err := http.NewRequest(
+		http.MethodPost,
+		"https://platform.example/bootstrap",
+		strings.NewReader("body"),
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+	resp, err := client.Do(req)
+	if err != nil {
+		t.Fatal(err)
+	}
+	resp.Body.Close()
+
+	if sidecarCalls != 2 {
+		t.Fatalf("sidecar calls = %d, want 2", sidecarCalls)
+	}
+	if interceptor.calls != 2 {
+		t.Fatalf("extension calls = %d, want 2", interceptor.calls)
+	}
+}
+
+func TestSDKBootstrapRedirectGuardChecksLocationAfterExtensionPostHook(t *testing.T) {
+	var externalCalls atomic.Int32
+	sidecarURL, err := url.Parse("https://sidecar.example")
+	if err != nil {
+		t.Fatal(err)
+	}
+	base := roundTripFunc(func(req *http.Request) (*http.Response, error) {
+		if req.URL.Host == "external.example" {
+			externalCalls.Add(1)
+			return noContentResponse(req), nil
+		}
+		return redirectResponse(
+			req,
+			http.StatusTemporaryRedirect,
+			"https://platform.example/next",
+		), nil
+	})
+
+	previousProvider := exttransport.GetProvider()
+	exttransport.Register(scopedTestProvider{
+		testProvider: testProvider{interceptor: &redirectRewriteInterceptor{
+			target:       sidecarURL,
+			postLocation: "https://external.example/target",
+		}},
+		supported: exttransport.RequestClassPlatform,
+	})
+	t.Cleanup(func() { exttransport.Register(previousProvider) })
+
+	client := &http.Client{Transport: base}
+	installSDKTransportBridge(client, func(req *http.Request) bool {
+		return req.URL != nil && req.URL.Path == "/bootstrap"
+	}, identityTransportPolicy)
+	req, err := http.NewRequest(
+		http.MethodPost,
+		"https://platform.example/bootstrap",
+		strings.NewReader("secret"),
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+	resp, err := client.Do(req)
+	if resp != nil && resp.Body != nil {
+		resp.Body.Close()
+	}
+	if err == nil || !strings.Contains(err.Error(), "cross-origin redirect") {
+		t.Fatalf("Do() error = %v, want post-hook Location rejection", err)
+	}
+	if problem, ok := errs.ProblemOf(err); !ok ||
+		problem.Category != errs.CategoryPolicy ||
+		problem.Subtype != errs.SubtypeAccessDenied {
+		t.Fatalf("Do() problem = %#v, %v; want policy/access_denied", problem, ok)
+	}
+	if got := externalCalls.Load(); got != 0 {
+		t.Fatalf("post-hook redirect target calls = %d, want 0", got)
+	}
+}
+
+func TestSameOriginNormalizesDefaultPort(t *testing.T) {
+	left, err := url.Parse("https://platform.example/bootstrap")
+	if err != nil {
+		t.Fatal(err)
+	}
+	right, err := url.Parse("https://platform.example:443/next")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !sameOrigin(left, right) {
+		t.Fatal("sameOrigin() = false for equivalent default HTTPS ports")
+	}
+}
+
+func TestDefaultClientBridgeCoversWebSocketSDKBootstrap(t *testing.T) {
+	preserveHTTPClientState(t, sdkBootstrapHTTPClient)
+	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
+	unsetProxyPluginEnv(t)
+	resetProxyPluginState()
+	t.Setenv(EnvNoProxy, "1")
+
+	previousProvider := exttransport.GetProvider()
+	interceptor := &testHeaderInterceptor{}
+	exttransport.Register(scopedTestProvider{
+		testProvider: testProvider{interceptor: interceptor},
+		supported:    exttransport.RequestClassPlatform,
+	})
+	t.Cleanup(func() { exttransport.Register(previousProvider) })
+
+	seenHeader := make(chan string, 1)
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
+		seenHeader <- req.Header.Get("X-Test-Platform")
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(http.StatusBadRequest)
+		_, _ = io.WriteString(w, `{"code":400,"msg":"stop after bootstrap"}`)
+	}))
+	t.Cleanup(server.Close)
+
+	installSDKTransportBridge(sdkBootstrapHTTPClient, func(req *http.Request) bool {
+		return req.URL != nil && req.URL.Host == strings.TrimPrefix(server.URL, "http://")
+	}, identityTransportPolicy)
+
+	client := larkws.NewClient(
+		"test-app",
+		"test-secret",
+		larkws.WithDomain(server.URL),
+		larkws.WithAutoReconnect(false),
+	)
+	if err := client.Start(context.Background()); err == nil {
+		t.Fatal("WebSocket SDK Start() error = nil, want bootstrap failure")
+	}
+	if got := <-seenHeader; got != "routed" {
+		t.Fatalf("WebSocket bootstrap header = %q, want routed", got)
+	}
+	if interceptor.calls != 1 {
+		t.Fatalf("extension calls = %d, want exactly 1 bootstrap call", interceptor.calls)
+	}
+}
+
+func TestSDKTransportBridgeUsesPinnedClientAfterGlobalReplacement(t *testing.T) {
+	preserveHTTPClientState(t, sdkBootstrapHTTPClient)
+	oldDefaultClient := http.DefaultClient
+	t.Cleanup(func() { http.DefaultClient = oldDefaultClient })
+
+	var pinnedCalls atomic.Int32
+	pinnedHeader := make(chan string, 1)
+	sdkBootstrapHTTPClient.Transport = roundTripFunc(func(req *http.Request) (*http.Response, error) {
+		pinnedCalls.Add(1)
+		pinnedHeader <- req.Header.Get("X-Pinned-Bridge")
+		return &http.Response{
+			StatusCode: http.StatusBadRequest,
+			Header:     http.Header{"Content-Type": []string{"application/json"}},
+			Body:       io.NopCloser(strings.NewReader(`{"code":400,"msg":"stop"}`)),
+			Request:    req,
+		}, nil
+	})
+	sdkBootstrapHTTPClient.CheckRedirect = nil
+
+	var replacementCalls atomic.Int32
+	http.DefaultClient = &http.Client{Transport: roundTripFunc(func(req *http.Request) (*http.Response, error) {
+		replacementCalls.Add(1)
+		return &http.Response{
+			StatusCode: http.StatusBadRequest,
+			Body:       http.NoBody,
+			Request:    req,
+		}, nil
+	})}
+
+	InstallSDKTransportBridge(func(base http.RoundTripper) http.RoundTripper {
+		return roundTripFunc(func(req *http.Request) (*http.Response, error) {
+			req = req.Clone(req.Context())
+			req.Header.Set("X-Pinned-Bridge", "routed")
+			return base.RoundTrip(req)
+		})
+	})
+
+	client := larkws.NewClient(
+		"test-app",
+		"test-secret",
+		larkws.WithAutoReconnect(false),
+	)
+	if err := client.Start(context.Background()); err == nil {
+		t.Fatal("WebSocket SDK Start() error = nil, want bootstrap failure")
+	}
+	if got := pinnedCalls.Load(); got != 1 {
+		t.Fatalf("SDK-pinned client calls = %d, want 1", got)
+	}
+	if got := <-pinnedHeader; got != "routed" {
+		t.Fatalf("SDK-pinned bridge header = %q, want routed", got)
+	}
+	if got := replacementCalls.Load(); got != 0 {
+		t.Fatalf("replacement DefaultClient calls = %d, want 0", got)
+	}
+}
+
+func TestSDKWebSocketBootstrapMatcherIsNarrow(t *testing.T) {
+	tests := []struct {
+		name   string
+		method string
+		url    string
+		want   bool
+	}{
+		{
+			name:   "platform bootstrap",
+			method: http.MethodPost,
+			url:    "https://open.feishu.cn/callback/ws/endpoint",
+			want:   true,
+		},
+		{
+			name:   "other platform path",
+			method: http.MethodPost,
+			url:    "https://open.feishu.cn/open-apis/test",
+		},
+		{
+			name:   "wrong bootstrap method",
+			method: http.MethodGet,
+			url:    "https://open.feishu.cn/callback/ws/endpoint",
+		},
+		{
+			name:   "external lookalike",
+			method: http.MethodPost,
+			url:    "https://external.example/callback/ws/endpoint",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			req, err := http.NewRequest(tt.method, tt.url, nil)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if got := isSDKWebSocketBootstrapRequest(req); got != tt.want {
+				t.Fatalf("isSDKWebSocketBootstrapRequest() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestSDKTransportBridgeLeavesOtherPlatformPathsUntouched(t *testing.T) {
+	previousProvider := exttransport.GetProvider()
+	interceptor := &testHeaderInterceptor{}
+	exttransport.Register(scopedTestProvider{
+		testProvider: testProvider{interceptor: interceptor},
+		supported:    exttransport.RequestClassPlatform,
+	})
+	t.Cleanup(func() { exttransport.Register(previousProvider) })
+
+	baseCalls := 0
+	client := &http.Client{Transport: roundTripFunc(func(req *http.Request) (*http.Response, error) {
+		baseCalls++
+		return &http.Response{StatusCode: http.StatusNoContent, Body: http.NoBody, Request: req}, nil
+	})}
+	installSDKTransportBridge(client, isSDKWebSocketBootstrapRequest, nil)
+
+	req, err := http.NewRequest(http.MethodGet, "https://open.feishu.cn/open-apis/test", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	resp, err := client.Do(req)
+	if err != nil {
+		t.Fatal(err)
+	}
+	resp.Body.Close()
+
+	if baseCalls != 1 {
+		t.Fatalf("base calls = %d, want 1", baseCalls)
+	}
+	if interceptor.calls != 0 {
+		t.Fatalf("extension calls = %d, want 0 for unmatched DefaultClient traffic", interceptor.calls)
+	}
+}
+
+func TestSDKTransportBridgeNilBasePreservesDefaultTransportForUnmatchedRequest(t *testing.T) {
+	oldDefaultTransport := http.DefaultTransport
+	t.Cleanup(func() { http.DefaultTransport = oldDefaultTransport })
+
+	unsetProxyPluginEnv(t)
+	resetProxyPluginState()
+	t.Setenv(EnvNoProxy, "1")
+
+	var firstCalls atomic.Int32
+	http.DefaultTransport = roundTripFunc(func(req *http.Request) (*http.Response, error) {
+		firstCalls.Add(1)
+		return &http.Response{StatusCode: http.StatusNoContent, Body: http.NoBody, Request: req}, nil
+	})
+	client := &http.Client{}
+	installSDKTransportBridge(client, func(*http.Request) bool { return false }, nil)
+
+	var currentCalls atomic.Int32
+	http.DefaultTransport = roundTripFunc(func(req *http.Request) (*http.Response, error) {
+		currentCalls.Add(1)
+		return &http.Response{StatusCode: http.StatusNoContent, Body: http.NoBody, Request: req}, nil
+	})
+
+	req, err := http.NewRequest(http.MethodGet, "http://127.0.0.1:1/unmatched", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	resp, err := client.Do(req)
+	if err != nil {
+		t.Fatal(err)
+	}
+	resp.Body.Close()
+
+	if got := firstCalls.Load(); got != 0 {
+		t.Fatalf("install-time DefaultTransport calls = %d, want 0", got)
+	}
+	if got := currentCalls.Load(); got != 1 {
+		t.Fatalf("request-time DefaultTransport calls = %d, want 1", got)
+	}
+}
+
+func TestSDKTransportBridgeUpdatesPlatformPolicy(t *testing.T) {
+	client := &http.Client{Transport: roundTripFunc(func(req *http.Request) (*http.Response, error) {
+		return noContentResponse(req), nil
+	})}
+	var firstCalls, secondCalls int
+	build := func(calls *int) transportPolicyBuilder {
+		return func(base http.RoundTripper) http.RoundTripper {
+			*calls++
+			return base
+		}
+	}
+	match := func(*http.Request) bool { return true }
+	installSDKTransportBridge(client, match, build(&firstCalls))
+	installSDKTransportBridge(client, match, build(&secondCalls))
+	req, err := http.NewRequest(http.MethodPost, "https://platform.example/bootstrap", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	resp, err := client.Do(req)
+	if err != nil {
+		t.Fatal(err)
+	}
+	resp.Body.Close()
+	if firstCalls != 0 || secondCalls != 1 {
+		t.Fatalf("policy calls = (%d, %d), want (0, 1)", firstCalls, secondCalls)
+	}
+}
+
+func TestSDKBootstrapTransportFailsClosedWithoutPlatformPolicy(t *testing.T) {
+	var baseCalls atomic.Int32
+	client := &http.Client{Transport: roundTripFunc(func(req *http.Request) (*http.Response, error) {
+		baseCalls.Add(1)
+		return &http.Response{
+			StatusCode: http.StatusNoContent,
+			Body:       http.NoBody,
+			Request:    req,
+		}, nil
+	})}
+	installSDKTransportBridge(client, func(*http.Request) bool { return true }, nil)
+
+	req, err := http.NewRequest(http.MethodPost, "https://platform.example/bootstrap", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	resp, err := client.Do(req)
+	if resp != nil && resp.Body != nil {
+		resp.Body.Close()
+	}
+	if err == nil || !strings.Contains(err.Error(), "policy is not configured") {
+		t.Fatalf("Do() error = %v, want missing policy rejection", err)
+	}
+	if problem, ok := errs.ProblemOf(err); !ok ||
+		problem.Category != errs.CategoryInternal ||
+		problem.Subtype != errs.SubtypeUnknown {
+		t.Fatalf("Do() problem = %#v, %v; want internal/unknown", problem, ok)
+	}
+	if got := baseCalls.Load(); got != 0 {
+		t.Fatalf("base transport calls = %d, want 0", got)
+	}
+}
+
+func TestSDKBootstrapTransportFailsClosedForNilPlatformTransport(t *testing.T) {
+	var baseCalls atomic.Int32
+	client := &http.Client{Transport: roundTripFunc(func(req *http.Request) (*http.Response, error) {
+		baseCalls.Add(1)
+		return &http.Response{
+			StatusCode: http.StatusNoContent,
+			Body:       http.NoBody,
+			Request:    req,
+		}, nil
+	})}
+	installSDKTransportBridge(client, func(*http.Request) bool { return true }, func(http.RoundTripper) http.RoundTripper {
+		return nil
+	})
+
+	req, err := http.NewRequest(http.MethodPost, "https://platform.example/bootstrap", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	resp, err := client.Do(req)
+	if resp != nil && resp.Body != nil {
+		resp.Body.Close()
+	}
+	if err == nil || !strings.Contains(err.Error(), "nil transport") {
+		t.Fatalf("Do() error = %v, want nil policy transport rejection", err)
+	}
+	if problem, ok := errs.ProblemOf(err); !ok ||
+		problem.Category != errs.CategoryInternal ||
+		problem.Subtype != errs.SubtypeUnknown {
+		t.Fatalf("Do() problem = %#v, %v; want internal/unknown", problem, ok)
+	}
+	if got := baseCalls.Load(); got != 0 {
+		t.Fatalf("base transport calls = %d, want 0", got)
+	}
+}
+
+func TestSDKBootstrapRedirectPolicyRetainsDefaultLimit(t *testing.T) {
+	policy := sdkBootstrapRedirectPolicy(nil, nil)
+	via := make([]*http.Request, 10)
+	err := policy(&http.Request{}, via)
+	if err == nil {
+		t.Fatal("redirect policy error = nil after 10 redirects")
+	}
+	if problem, ok := errs.ProblemOf(err); !ok ||
+		problem.Category != errs.CategoryNetwork ||
+		problem.Subtype != errs.SubtypeNetworkTransport {
+		t.Fatalf("redirect problem = %#v, %v; want network/transport", problem, ok)
+	}
+}
+
+func TestExtensionMiddlewareUsesFallbackWhenBaseIsNil(t *testing.T) {
+	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
+	unsetProxyPluginEnv(t)
+	resetProxyPluginState()
+	t.Setenv(EnvNoProxy, "")
+
+	previous := http.DefaultTransport
+	var calls atomic.Int32
+	http.DefaultTransport = roundTripFunc(func(req *http.Request) (*http.Response, error) {
+		calls.Add(1)
+		return &http.Response{
+			StatusCode: http.StatusNoContent,
+			Body:       http.NoBody,
+			Request:    req,
+		}, nil
+	})
+	t.Cleanup(func() { http.DefaultTransport = previous })
+
+	req, err := http.NewRequest(http.MethodGet, "https://external.example/file", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	resp, err := (&ExtensionMiddleware{Ext: &testHeaderInterceptor{}}).RoundTrip(req)
+	if err != nil {
+		t.Fatal(err)
+	}
+	resp.Body.Close()
+	if got := calls.Load(); got != 1 {
+		t.Fatalf("fallback transport calls = %d, want 1", got)
+	}
+}
+
+func TestExtensionMiddlewareAbortsBeforeBase(t *testing.T) {
+	reason := errors.New("blocked")
+	baseCalled := false
+	postCalled := false
+	interceptor := &abortingTestInterceptor{
+		reason: reason,
+		post: func(resp *http.Response, err error) {
+			postCalled = true
+			if resp != nil || err != reason {
+				t.Errorf("post arguments = (%v, %v), want (nil, reason)", resp, err)
+			}
+		},
+	}
+	middleware := &ExtensionMiddleware{
+		Base: roundTripFunc(func(*http.Request) (*http.Response, error) {
+			baseCalled = true
+			return nil, nil
+		}),
+		Ext:     interceptor,
+		ExtName: "test-provider",
+	}
+
+	resp, err := middleware.RoundTrip(httptest.NewRequest(http.MethodGet, "https://example.com", nil))
+	if resp != nil {
+		t.Fatalf("response = %v, want nil", resp)
+	}
+	var abortErr *exttransport.AbortError
+	if !errors.As(err, &abortErr) {
+		t.Fatalf("error = %T, want *transport.AbortError", err)
+	}
+	if abortErr.Extension != "test-provider" || abortErr.Reason != reason {
+		t.Fatalf("abort error = %#v, want provider and reason", abortErr)
+	}
+	if baseCalled {
+		t.Fatal("base transport was called")
+	}
+	if !postCalled {
+		t.Fatal("post hook was not called")
+	}
+}
+
+func preserveHTTPClientState(t *testing.T, client *http.Client) {
+	t.Helper()
+	oldTransport := client.Transport
+	oldCheckRedirect := client.CheckRedirect
+	t.Cleanup(func() {
+		client.Transport = oldTransport
+		client.CheckRedirect = oldCheckRedirect
+	})
+}
+
+func identityTransportPolicy(base http.RoundTripper) http.RoundTripper {
+	return base
+}
+
+func redirectResponse(req *http.Request, status int, location string) *http.Response {
+	return &http.Response{
+		StatusCode: status,
+		Header:     http.Header{"Location": []string{location}},
+		Body:       http.NoBody,
+		Request:    req,
+	}
+}
+
+func noContentResponse(req *http.Request) *http.Response {
+	return &http.Response{
+		StatusCode: http.StatusNoContent,
+		Body:       http.NoBody,
+		Request:    req,
+	}
+}
+
+type roundTripFunc func(*http.Request) (*http.Response, error)
+
+func (f roundTripFunc) RoundTrip(req *http.Request) (*http.Response, error) {
+	return f(req)
+}

internal/transport/policy_router.go

@@ -0,0 +1,232 @@
+// Copyright (c) 2026 Lark Technologies Pte. Ltd.
+// SPDX-License-Identifier: MIT
+
+package transport
+
+import (
+	"context"
+	"net/http"
+
+	"github.com/larksuite/cli/errs"
+	exttransport "github.com/larksuite/cli/extension/transport"
+	"github.com/larksuite/cli/internal/core"
+)
+
+type requestClassContextKey struct{}
+type forcedRequestClassContextKey struct{}
+
+// HTTPPolicyRouter selects an HTTP transport policy from request intent and
+// the endpoint catalog. Explicit request intent takes precedence; otherwise
+// known platform endpoints use the platform policy and all other URLs use the
+// external policy.
+type HTTPPolicyRouter struct {
+	platform http.RoundTripper
+	external http.RoundTripper
+}
+
+// RoundTripperDecorator describes a transport layer that can be rebuilt over
+// a cloned base transport. Connection-policy helpers use this contract to
+// preserve retry, response, and extension layers while safely customizing the
+// innermost *http.Transport.
+type RoundTripperDecorator interface {
+	BaseRoundTripper() http.RoundTripper
+	WithBaseRoundTripper(http.RoundTripper) http.RoundTripper
+}
+
+// NewHTTPPolicyRouter constructs a router over two policy chains. A nil chain
+// falls back to the shared proxy-aware transport. The currently registered
+// extension provider is resolved once and applied according to its optional
+// ScopedProvider contract.
+func NewHTTPPolicyRouter(platform, external http.RoundTripper) *HTTPPolicyRouter {
+	if platform == nil {
+		platform = Shared()
+	}
+	if external == nil {
+		external = Shared()
+	}
+
+	extension := resolveExtension()
+	return &HTTPPolicyRouter{
+		platform: extension.wrap(platform, exttransport.RequestClassPlatform, true),
+		external: extension.wrap(external, exttransport.RequestClassExternal, true),
+	}
+}
+
+// RoundTrip dispatches the request to its selected policy chain.
+func (r *HTTPPolicyRouter) RoundTrip(req *http.Request) (*http.Response, error) {
+	if req == nil {
+		return nil, errs.NewInternalError(
+			errs.SubtypeUnknown,
+			"HTTP policy router received a nil request",
+		)
+	}
+	class, err := classifyRequest(req)
+	if err != nil {
+		return nil, err
+	}
+	if class == exttransport.RequestClassPlatform {
+		return r.platform.RoundTrip(req)
+	}
+	return r.external.RoundTrip(req)
+}
+
+func (r *HTTPPolicyRouter) transportForClass(class exttransport.RequestClass) (http.RoundTripper, bool) {
+	switch class {
+	case exttransport.RequestClassPlatform:
+		return r.platform, true
+	case exttransport.RequestClassExternal:
+		return r.external, true
+	default:
+		return nil, false
+	}
+}
+
+func classifyRequest(req *http.Request) (exttransport.RequestClass, error) {
+	if explicit, ok := req.Context().Value(requestClassContextKey{}).(exttransport.RequestClass); ok {
+		switch explicit {
+		case exttransport.RequestClassPlatform, exttransport.RequestClassExternal:
+			return explicit, nil
+		default:
+			return "", errs.NewInternalError(
+				errs.SubtypeUnknown,
+				"unsupported HTTP request class %q",
+				explicit,
+			)
+		}
+	}
+	if core.IsPlatformEndpointURL(req.URL) {
+		return exttransport.RequestClassPlatform, nil
+	}
+	return exttransport.RequestClassExternal, nil
+}
+
+// WithRequestClass returns a shallow copy of req with explicit routing intent.
+func WithRequestClass(req *http.Request, class exttransport.RequestClass) *http.Request {
+	if req == nil {
+		return nil
+	}
+	ctx := context.WithValue(req.Context(), requestClassContextKey{}, class)
+	return req.WithContext(ctx)
+}
+
+func withForcedRequestClass(req *http.Request, class exttransport.RequestClass) *http.Request {
+	if req == nil {
+		return nil
+	}
+	if _, forced := req.Context().Value(forcedRequestClassContextKey{}).(struct{}); forced {
+		return req
+	}
+	ctx := context.WithValue(req.Context(), requestClassContextKey{}, class)
+	ctx = context.WithValue(ctx, forcedRequestClassContextKey{}, struct{}{})
+	return req.WithContext(ctx)
+}
+
+type requestClassTransport struct {
+	base  http.RoundTripper
+	class exttransport.RequestClass
+}
+
+func (t *requestClassTransport) RoundTrip(req *http.Request) (*http.Response, error) {
+	return t.base.RoundTrip(withForcedRequestClass(req, t.class))
+}
+
+// CloneHTTPTransport exposes a structural cloning capability without requiring
+// higher-level safety helpers to import this package. The explicit request
+// class selects the policy branch that must be rebuilt.
+func (t *requestClassTransport) CloneHTTPTransport() (http.RoundTripper, *http.Transport, bool) {
+	return CloneHTTPTransportForRequestClass(t.base, t.class)
+}
+
+// TransformHTTPTransport clones the selected policy branch and replaces its
+// concrete transport in place. Keeping the replacement at the graph leaf is
+// important for policies that must observe requests after outer decorators
+// have run, such as proxy selection.
+func (t *requestClassTransport) TransformHTTPTransport(transform func(*http.Transport) (http.RoundTripper, bool)) (http.RoundTripper, bool) {
+	return transformHTTPTransportForRequestClass(t.base, t.class, transform, 0)
+}
+
+// ClientForRequestClass clones client and forces all of its requests through a
+// specific policy class. The original client is never mutated.
+func ClientForRequestClass(client *http.Client, class exttransport.RequestClass) *http.Client {
+	if client == nil {
+		client = &http.Client{}
+	}
+	cloned := *client
+	base := client.Transport
+	if base == nil {
+		base = Shared()
+	}
+	cloned.Transport = &requestClassTransport{base: base, class: class}
+	return &cloned
+}
+
+// CloneHTTPTransportForRequestClass selects one policy branch, clones its
+// innermost *http.Transport, and rebuilds every composable decorator around
+// the clone. Callers can customize concrete before using rebuilt. The original
+// transport graph is never mutated.
+func CloneHTTPTransportForRequestClass(base http.RoundTripper, class exttransport.RequestClass) (rebuilt http.RoundTripper, concrete *http.Transport, ok bool) {
+	rebuilt, ok = transformHTTPTransportForRequestClass(base, class, func(cloned *http.Transport) (http.RoundTripper, bool) {
+		concrete = cloned
+		return cloned, true
+	}, 0)
+	if !ok {
+		return nil, nil, false
+	}
+	return rebuilt, concrete, true
+}
+
+func transformHTTPTransportForRequestClass(
+	base http.RoundTripper,
+	class exttransport.RequestClass,
+	transform func(*http.Transport) (http.RoundTripper, bool),
+	depth int,
+) (http.RoundTripper, bool) {
+	if depth > 32 {
+		return nil, false
+	}
+	if base == nil || transform == nil {
+		if transform == nil {
+			return nil, false
+		}
+		base = Shared()
+	}
+
+	switch current := base.(type) {
+	case *http.Transport:
+		cloned := cloneHTTPTransport(current)
+		rebuilt, valid := transform(cloned)
+		return rebuilt, valid && rebuilt != nil
+	case *requestClassTransport:
+		return transformHTTPTransportForRequestClass(current.base, class, transform, depth+1)
+	case *HTTPPolicyRouter:
+		selected, valid := current.transportForClass(class)
+		if !valid {
+			return nil, false
+		}
+		return transformHTTPTransportForRequestClass(selected, class, transform, depth+1)
+	case RoundTripperDecorator:
+		inner := current.BaseRoundTripper()
+		if inner == nil || inner == base {
+			return nil, false
+		}
+		rebuiltInner, valid := transformHTTPTransportForRequestClass(inner, class, transform, depth+1)
+		if !valid {
+			return nil, false
+		}
+		rebuilt := current.WithBaseRoundTripper(rebuiltInner)
+		return rebuilt, rebuilt != nil
+	default:
+		return nil, false
+	}
+}
+
+func cloneHTTPTransport(source *http.Transport) *http.Transport {
+	cloned := source.Clone()
+	// Clone leaves an auto-configured h2 handler on source.
+	if cloned.TLSNextProto == nil {
+		if _, ok := source.TLSNextProto["h2"]; ok {
+			cloned.ForceAttemptHTTP2 = true
+		}
+	}
+	return cloned
+}

internal/transport/policy_router_test.go

@@ -0,0 +1,351 @@
+// Copyright (c) 2026 Lark Technologies Pte. Ltd.
+// SPDX-License-Identifier: MIT
+
+package transport
+
+import (
+	"errors"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"strings"
+	"testing"
+
+	"github.com/larksuite/cli/errs"
+	exttransport "github.com/larksuite/cli/extension/transport"
+)
+
+type cloneTestDecorator struct {
+	base http.RoundTripper
+}
+
+func (d *cloneTestDecorator) RoundTrip(req *http.Request) (*http.Response, error) {
+	return d.base.RoundTrip(req)
+}
+
+func (d *cloneTestDecorator) BaseRoundTripper() http.RoundTripper {
+	return d.base
+}
+
+func (d *cloneTestDecorator) WithBaseRoundTripper(base http.RoundTripper) http.RoundTripper {
+	return &cloneTestDecorator{base: base}
+}
+
+type headerCloneTestDecorator struct {
+	base http.RoundTripper
+}
+
+func (d *headerCloneTestDecorator) RoundTrip(req *http.Request) (*http.Response, error) {
+	req = req.Clone(req.Context())
+	req.Header.Set("X-Decorator", "applied")
+	return d.base.RoundTrip(req)
+}
+
+func (d *headerCloneTestDecorator) BaseRoundTripper() http.RoundTripper {
+	return d.base
+}
+
+func (d *headerCloneTestDecorator) WithBaseRoundTripper(base http.RoundTripper) http.RoundTripper {
+	return &headerCloneTestDecorator{base: base}
+}
+
+func TestHTTPPolicyRouterClassifiesFromEndpointCatalog(t *testing.T) {
+	exttransport.Register(nil)
+
+	platformCalls := 0
+	externalCalls := 0
+	router := NewHTTPPolicyRouter(
+		roundTripFunc(func(req *http.Request) (*http.Response, error) {
+			platformCalls++
+			return &http.Response{StatusCode: http.StatusNoContent, Body: http.NoBody, Request: req}, nil
+		}),
+		roundTripFunc(func(req *http.Request) (*http.Response, error) {
+			externalCalls++
+			return &http.Response{StatusCode: http.StatusNoContent, Body: http.NoBody, Request: req}, nil
+		}),
+	)
+
+	for _, rawURL := range []string{
+		"https://open.feishu.cn/open-apis/test",
+		"https://example.com/file",
+	} {
+		req, err := http.NewRequest(http.MethodGet, rawURL, nil)
+		if err != nil {
+			t.Fatal(err)
+		}
+		resp, err := router.RoundTrip(req)
+		if err != nil {
+			t.Fatal(err)
+		}
+		resp.Body.Close()
+	}
+
+	if platformCalls != 1 || externalCalls != 1 {
+		t.Fatalf("platform calls = %d, external calls = %d; want 1 each", platformCalls, externalCalls)
+	}
+}
+
+func TestHTTPPolicyRouterExplicitClassOverridesCatalog(t *testing.T) {
+	exttransport.Register(nil)
+
+	platformCalls := 0
+	externalCalls := 0
+	router := NewHTTPPolicyRouter(
+		roundTripFunc(func(req *http.Request) (*http.Response, error) {
+			platformCalls++
+			return &http.Response{StatusCode: http.StatusNoContent, Body: http.NoBody, Request: req}, nil
+		}),
+		roundTripFunc(func(req *http.Request) (*http.Response, error) {
+			externalCalls++
+			return &http.Response{StatusCode: http.StatusNoContent, Body: http.NoBody, Request: req}, nil
+		}),
+	)
+
+	req, err := http.NewRequest(http.MethodGet, "https://open.feishu.cn/open-apis/test", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	req = WithRequestClass(req, exttransport.RequestClassExternal)
+	resp, err := router.RoundTrip(req)
+	if err != nil {
+		t.Fatal(err)
+	}
+	resp.Body.Close()
+
+	if platformCalls != 0 || externalCalls != 1 {
+		t.Fatalf("platform calls = %d, external calls = %d; want 0 and 1", platformCalls, externalCalls)
+	}
+}
+
+func TestClientForRequestClassOutermostIntentWins(t *testing.T) {
+	exttransport.Register(nil)
+	platformCalls := 0
+	externalCalls := 0
+	router := NewHTTPPolicyRouter(
+		roundTripFunc(func(req *http.Request) (*http.Response, error) {
+			platformCalls++
+			return &http.Response{StatusCode: http.StatusNoContent, Body: http.NoBody, Request: req}, nil
+		}),
+		roundTripFunc(func(req *http.Request) (*http.Response, error) {
+			externalCalls++
+			return &http.Response{StatusCode: http.StatusNoContent, Body: http.NoBody, Request: req}, nil
+		}),
+	)
+
+	platform := ClientForRequestClass(&http.Client{Transport: router}, exttransport.RequestClassPlatform)
+	external := ClientForRequestClass(platform, exttransport.RequestClassExternal)
+	resp, err := external.Get("https://open.feishu.cn/open-apis/test")
+	if err != nil {
+		t.Fatal(err)
+	}
+	resp.Body.Close()
+
+	if platformCalls != 0 || externalCalls != 1 {
+		t.Fatalf("platform calls = %d, external calls = %d; want outer external intent to win", platformCalls, externalCalls)
+	}
+}
+
+func TestHTTPPolicyRouterRejectsInvalidExplicitClass(t *testing.T) {
+	exttransport.Register(nil)
+	router := NewHTTPPolicyRouter(nil, nil)
+	req, err := http.NewRequest(http.MethodGet, "https://example.com", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	req = WithRequestClass(req, exttransport.RequestClass("invalid"))
+	if _, err := router.RoundTrip(req); err == nil || !strings.Contains(err.Error(), "unsupported HTTP request class") {
+		t.Fatalf("RoundTrip() error = %v, want unsupported request class", err)
+	} else if problem, ok := errs.ProblemOf(err); !ok ||
+		problem.Category != errs.CategoryInternal ||
+		problem.Subtype != errs.SubtypeUnknown {
+		t.Fatalf("RoundTrip() problem = %#v, %v; want internal/unknown", problem, ok)
+	}
+}
+
+func TestHTTPPolicyRouterRejectsNilRequest(t *testing.T) {
+	router := NewHTTPPolicyRouter(nil, nil)
+	_, err := router.RoundTrip(nil)
+	problem, ok := errs.ProblemOf(err)
+	if !ok || problem.Category != errs.CategoryInternal || problem.Subtype != errs.SubtypeUnknown {
+		t.Fatalf("RoundTrip() problem = %#v, %v; want internal/unknown", problem, ok)
+	}
+}
+
+func TestHTTPPolicyRouterReclassifiesRedirectTargets(t *testing.T) {
+	interceptor := &testHeaderInterceptor{}
+	exttransport.Register(scopedTestProvider{
+		testProvider: testProvider{interceptor: interceptor},
+		supported:    exttransport.RequestClassPlatform,
+	})
+	t.Cleanup(func() { exttransport.Register(nil) })
+
+	receivedHeader := make(chan string, 1)
+	external := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
+		receivedHeader <- req.Header.Get("X-Test-Platform")
+		w.WriteHeader(http.StatusNoContent)
+	}))
+	t.Cleanup(external.Close)
+
+	router := NewHTTPPolicyRouter(
+		roundTripFunc(func(req *http.Request) (*http.Response, error) {
+			return &http.Response{
+				StatusCode: http.StatusFound,
+				Header:     http.Header{"Location": []string{external.URL}},
+				Body:       http.NoBody,
+				Request:    req,
+			}, nil
+		}),
+		http.DefaultTransport,
+	)
+	client := &http.Client{Transport: router}
+	req, err := http.NewRequest(http.MethodGet, "https://open.feishu.cn/start", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	resp, err := client.Do(req)
+	if err != nil {
+		t.Fatal(err)
+	}
+	resp.Body.Close()
+
+	if got := <-receivedHeader; got != "" {
+		t.Fatalf("redirect target received platform-scoped header %q", got)
+	}
+	if interceptor.calls != 1 {
+		t.Fatalf("extension calls = %d, want only the initial platform request", interceptor.calls)
+	}
+}
+
+func TestCloneHTTPTransportForRequestClassRebuildsDecorators(t *testing.T) {
+	wantErr := errors.New("preserved proxy policy")
+	base := &http.Transport{
+		Proxy: func(*http.Request) (*url.URL, error) {
+			return nil, wantErr
+		},
+	}
+	decorated := &cloneTestDecorator{base: base}
+	router := NewHTTPPolicyRouter(decorated, decorated)
+
+	rebuilt, concrete, ok := CloneHTTPTransportForRequestClass(router, exttransport.RequestClassExternal)
+	if !ok {
+		t.Fatal("CloneHTTPTransportForRequestClass() ok = false")
+	}
+	if concrete == base {
+		t.Fatal("CloneHTTPTransportForRequestClass() reused the original *http.Transport")
+	}
+	if _, ok := rebuilt.(*cloneTestDecorator); !ok {
+		t.Fatalf("rebuilt transport type = %T, want *cloneTestDecorator", rebuilt)
+	}
+
+	req, err := http.NewRequest(http.MethodGet, "https://external.example/file", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := rebuilt.RoundTrip(req); !errors.Is(err, wantErr) {
+		t.Fatalf("RoundTrip() error = %v, want %v", err, wantErr)
+	}
+}
+
+func TestCloneHTTPTransportForRequestClassPreservesAutomaticHTTP2(t *testing.T) {
+	previousProvider := exttransport.GetProvider()
+	exttransport.Register(nil)
+	t.Cleanup(func() { exttransport.Register(previousProvider) })
+	source := &http.Transport{
+		Proxy: http.ProxyURL(&url.URL{Scheme: "http", Host: "proxy.example:8080"}),
+	}
+	router := NewHTTPPolicyRouter(&http.Transport{}, source)
+
+	_, cloned, ok := CloneHTTPTransportForRequestClass(router, exttransport.RequestClassExternal)
+	if !ok {
+		t.Fatal("CloneHTTPTransportForRequestClass() ok = false")
+	}
+	if !cloned.ForceAttemptHTTP2 {
+		t.Fatal("ForceAttemptHTTP2 = false, want true")
+	}
+	if cloned.TLSNextProto != nil {
+		t.Fatal("TLSNextProto is non-nil, want automatic HTTP/2")
+	}
+}
+
+func TestCloneHTTPTransportForRequestClassKeepsOutermostIntent(t *testing.T) {
+	platformErr := errors.New("platform transport")
+	externalErr := errors.New("external transport")
+	newBlocked := func(reason error) *http.Transport {
+		return &http.Transport{Proxy: func(*http.Request) (*url.URL, error) { return nil, reason }}
+	}
+	router := NewHTTPPolicyRouter(newBlocked(platformErr), newBlocked(externalErr))
+	platform := ClientForRequestClass(&http.Client{Transport: router}, exttransport.RequestClassPlatform)
+	external := ClientForRequestClass(platform, exttransport.RequestClassExternal)
+
+	source, ok := external.Transport.(interface {
+		CloneHTTPTransport() (http.RoundTripper, *http.Transport, bool)
+	})
+	if !ok {
+		t.Fatalf("transport type %T has no clone capability", external.Transport)
+	}
+	rebuilt, _, ok := source.CloneHTTPTransport()
+	if !ok {
+		t.Fatal("CloneHTTPTransport() ok = false")
+	}
+	req, err := http.NewRequest(http.MethodGet, "https://open.feishu.cn/open-apis/test", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := rebuilt.RoundTrip(req); !errors.Is(err, externalErr) {
+		t.Fatalf("RoundTrip() error = %v, want outer external transport error %v", err, externalErr)
+	}
+}
+
+func TestClientForRequestClassOverridesCallerIntent(t *testing.T) {
+	platformErr := errors.New("platform transport")
+	externalErr := errors.New("external transport")
+	newBlocked := func(reason error) *http.Transport {
+		return &http.Transport{Proxy: func(*http.Request) (*url.URL, error) { return nil, reason }}
+	}
+	router := NewHTTPPolicyRouter(newBlocked(platformErr), newBlocked(externalErr))
+	client := ClientForRequestClass(&http.Client{Transport: router}, exttransport.RequestClassExternal)
+	req, err := http.NewRequest(http.MethodGet, "https://external.example/file", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	req = WithRequestClass(req, exttransport.RequestClassPlatform)
+
+	if _, err := client.Do(req); !errors.Is(err, externalErr) {
+		t.Fatalf("Do() error = %v, want forced external transport error %v", err, externalErr)
+	}
+}
+
+func TestTransformHTTPTransportReplacesLeafInsideDecorators(t *testing.T) {
+	exttransport.Register(nil)
+	decorated := &headerCloneTestDecorator{base: &http.Transport{}}
+	router := NewHTTPPolicyRouter(decorated, decorated)
+	client := ClientForRequestClass(&http.Client{Transport: router}, exttransport.RequestClassExternal)
+
+	source, ok := client.Transport.(interface {
+		TransformHTTPTransport(func(*http.Transport) (http.RoundTripper, bool)) (http.RoundTripper, bool)
+	})
+	if !ok {
+		t.Fatalf("transport type %T has no transform capability", client.Transport)
+	}
+	rebuilt, ok := source.TransformHTTPTransport(func(*http.Transport) (http.RoundTripper, bool) {
+		return roundTripFunc(func(req *http.Request) (*http.Response, error) {
+			if got := req.Header.Get("X-Decorator"); got != "applied" {
+				t.Fatalf("leaf received X-Decorator = %q, want applied", got)
+			}
+			return &http.Response{StatusCode: http.StatusNoContent, Body: http.NoBody, Request: req}, nil
+		}), true
+	})
+	if !ok {
+		t.Fatal("TransformHTTPTransport() ok = false")
+	}
+
+	req, err := http.NewRequest(http.MethodGet, "https://external.example/file", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	resp, err := rebuilt.RoundTrip(req)
+	if err != nil {
+		t.Fatal(err)
+	}
+	resp.Body.Close()
+}

internal/transport/shared.go

@@ -8,6 +8,8 @@ import (
 	"os"
 	"sync"
 	"time"
+
+	exttransport "github.com/larksuite/cli/extension/transport"
 )
 
 // Shared returns the base http.RoundTripper for all CLI HTTP clients.
@@ -55,21 +57,29 @@ func Fallback() *http.Transport {
 	return noProxyTransport()
 }
 
-// NewHTTPClient returns an *http.Client whose Transport is the shared,
-// proxy-plugin-aware base (see Shared). Prefer this over a bare &http.Client{}
-// for outbound requests: a bare client falls back to http.DefaultTransport and
-// therefore silently bypasses proxy plugin mode (fixed proxy + trusted CA, or
-// fail-closed), creating an audit blind spot.
+// NewHTTPClient returns a policy-routed client over the shared proxy-aware
+// transport. Known platform endpoints use the platform request class; all
+// other URLs use the external request class. Existing unscoped transport
+// providers continue to apply to both classes.
 //
 // A zero timeout means no client-level timeout (callers relying on context
 // deadlines pass 0).
 func NewHTTPClient(timeout time.Duration) *http.Client {
+	base := Shared()
 	return &http.Client{
-		Transport: Shared(),
+		Transport: NewHTTPPolicyRouter(base, base),
 		Timeout:   timeout,
 	}
 }
 
+// NewExternalHTTPClient returns a client for user-provided, pre-signed, CDN,
+// package-registry, and other non-platform URLs. It forces the external policy
+// while preserving the shared proxy configuration and the historical behavior
+// of unscoped transport providers. A zero timeout means no client-level timeout.
+func NewExternalHTTPClient(timeout time.Duration) *http.Client {
+	return ClientForRequestClass(NewHTTPClient(timeout), exttransport.RequestClassExternal)
+}
+
 // noProxyTransport is a proxy-disabled clone of http.DefaultTransport, lazily
 // built the first time LARK_CLI_NO_PROXY is observed set.
 var noProxyTransport = sync.OnceValue(func() *http.Transport {

internal/transport/shared_test.go

@@ -88,23 +88,24 @@ func TestShared_NoProxyOverridesSystemProxy(t *testing.T) {
 	}
 }
 
-// TestNewHTTPClient verifies the factory wires the shared proxy-plugin-aware
-// transport (instead of a bare client that bypasses proxy plugin mode).
-func TestNewHTTPClient(t *testing.T) {
+// TestHTTPClientConstructors verifies both the policy-routed client and its
+// forced-external view retain explicit transports and configured timeouts.
+func TestHTTPClientConstructors(t *testing.T) {
 	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
 	unsetProxyPluginEnv(t)
 	resetProxyPluginState()
 	t.Setenv(EnvNoProxy, "")
 
-	c := NewHTTPClient(7 * time.Second)
-	if c.Transport == nil {
-		t.Fatal("NewHTTPClient transport is nil; want shared transport")
-	}
-	if c.Transport != Shared() {
-		t.Errorf("NewHTTPClient transport = %v, want Shared()", c.Transport)
-	}
-	if c.Timeout != 7*time.Second {
-		t.Errorf("NewHTTPClient timeout = %v, want 7s", c.Timeout)
+	for name, client := range map[string]*http.Client{
+		"routed":   NewHTTPClient(7 * time.Second),
+		"external": NewExternalHTTPClient(7 * time.Second),
+	} {
+		if client.Transport == nil {
+			t.Fatalf("%s client transport is nil", name)
+		}
+		if client.Timeout != 7*time.Second {
+			t.Errorf("%s client timeout = %v, want 7s", name, client.Timeout)
+		}
 	}
 }
 
@@ -153,4 +154,32 @@ func TestShared_MalformedConfigFailsClosedEvenWithNoProxy(t *testing.T) {
 	if err == nil {
 		t.Fatalf("RoundTrip() err = nil (resp=%v); malformed config must fail closed", resp)
 	}
+
+	for name, test := range map[string]struct {
+		client *http.Client
+		url    string
+	}{
+		"platform": {
+			client: NewHTTPClient(time.Second),
+			url:    "https://open.feishu.cn/open-apis/test",
+		},
+		"external": {
+			client: NewHTTPClient(time.Second),
+			url:    "https://external.example/test",
+		},
+		"forced external": {
+			client: NewExternalHTTPClient(time.Second),
+			url:    "https://external.example/test",
+		},
+	} {
+		t.Run(name, func(t *testing.T) {
+			resp, err := test.client.Get(test.url)
+			if err == nil {
+				if resp != nil && resp.Body != nil {
+					resp.Body.Close()
+				}
+				t.Fatalf("policy-routed client succeeded with malformed proxy config")
+			}
+		})
+	}
 }

internal/update/update.go

@@ -62,10 +62,7 @@ func httpClient() *http.Client {
 	if DefaultClient != nil {
 		return DefaultClient
 	}
-	return &http.Client{
-		Timeout:   fetchTimeout,
-		Transport: transport.Shared(),
-	}
+	return transport.NewExternalHTTPClient(fetchTimeout)
 }
 
 // updateState is persisted to disk for caching.

internal/update/update_test.go

@@ -4,6 +4,7 @@
 package update
 
 import (
+	"context"
 	"encoding/json"
 	"net/http"
 	"net/http/httptest"
@@ -12,6 +13,8 @@ import (
 	"path/filepath"
 	"testing"
 	"time"
+
+	exttransport "github.com/larksuite/cli/extension/transport"
 )
 
 // roundTripFunc adapts a function to http.RoundTripper.
@@ -19,6 +22,30 @@ type roundTripFunc func(*http.Request) (*http.Response, error)
 
 func (f roundTripFunc) RoundTrip(req *http.Request) (*http.Response, error) { return f(req) }
 
+type updateExternalProvider struct {
+	interceptor exttransport.Interceptor
+}
+
+func (p updateExternalProvider) Name() string { return "update-external-test" }
+
+func (p updateExternalProvider) ResolveInterceptor(context.Context) exttransport.Interceptor {
+	return p.interceptor
+}
+
+func (updateExternalProvider) SupportsRequestClass(class exttransport.RequestClass) bool {
+	return class == exttransport.RequestClassExternal
+}
+
+type updateExternalInterceptor struct {
+	calls int
+}
+
+func (i *updateExternalInterceptor) PreRoundTrip(req *http.Request) func(*http.Response, error) {
+	i.calls++
+	req.Header.Set("X-External-Route", "1")
+	return nil
+}
+
 // clearSkipEnv unsets all env vars that shouldSkip checks,
 // preventing the host environment (e.g. CI=true) from polluting test results.
 func clearSkipEnv(t *testing.T) {
@@ -242,6 +269,46 @@ func TestRefreshCache(t *testing.T) {
 	RefreshCache("1.0.0")
 }
 
+func TestHTTPClientUsesExternalRequestClass(t *testing.T) {
+	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
+	t.Setenv("LARK_CLI_NO_PROXY", "")
+	previousClient := DefaultClient
+	DefaultClient = nil
+	t.Cleanup(func() { DefaultClient = previousClient })
+
+	previousProvider := exttransport.GetProvider()
+	interceptor := &updateExternalInterceptor{}
+	exttransport.Register(updateExternalProvider{interceptor: interceptor})
+	t.Cleanup(func() { exttransport.Register(previousProvider) })
+
+	previousTransport := http.DefaultTransport
+	var receivedHeader string
+	http.DefaultTransport = roundTripFunc(func(req *http.Request) (*http.Response, error) {
+		receivedHeader = req.Header.Get("X-External-Route")
+		return &http.Response{
+			StatusCode: http.StatusNoContent,
+			Header:     make(http.Header),
+			Body:       http.NoBody,
+			Request:    req,
+		}, nil
+	})
+	t.Cleanup(func() { http.DefaultTransport = previousTransport })
+
+	req, err := http.NewRequest(http.MethodGet, "https://open.feishu.cn/npm/latest", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	resp, err := httpClient().Do(req)
+	if err != nil {
+		t.Fatal(err)
+	}
+	resp.Body.Close()
+
+	if interceptor.calls != 1 || receivedHeader != "1" {
+		t.Fatalf("external route = calls %d, header %q; want 1, %q", interceptor.calls, receivedHeader, "1")
+	}
+}
+
 func TestPendingAtomicAccess(t *testing.T) {
 	// Initially nil
 	if got := GetPending(); got != nil {

internal/validate/path.go

@@ -17,6 +17,13 @@ func SafeInputPath(path string) (string, error) {
 	return localfileio.SafeInputPath(path)
 }
 
+// LocalInputPath validates a local input path without restricting it to the
+// current working directory. It delegates to localfileio.LocalInputPath so
+// command validation and shared local-file readers use one policy.
+func LocalInputPath(path string) (string, error) {
+	return localfileio.LocalInputPath(path)
+}
+
 // SafeEnvDirPath validates an environment-provided application directory path.
 // Delegates to localfileio.SafeEnvDirPath.
 func SafeEnvDirPath(path, envName string) (string, error) {

internal/validate/path_test.go

@@ -211,6 +211,18 @@ func TestSafeLocalFlagPath(t *testing.T) {
 	}
 }
 
+func TestLocalInputPath_AllowsLocalPathsAndRejectsUnsafeCharacters(t *testing.T) {
+	for _, path := range []string{"/tmp/report.pdf", "../report.pdf"} {
+		got, err := LocalInputPath(path)
+		if err != nil || got != path {
+			t.Fatalf("LocalInputPath(%q) = %q, %v; want unchanged path", path, got, err)
+		}
+	}
+	if _, err := LocalInputPath("report\n.pdf"); err == nil {
+		t.Fatal("LocalInputPath() unexpectedly accepted a control character")
+	}
+}
+
 func TestSafeUploadPath_AllowsTempFileAbsolutePath(t *testing.T) {
 	// GIVEN: a real temp file (absolute path under os.TempDir())
 	f, err := os.CreateTemp("", "upload-test-*.bin")