docs: add v1.0.6 changelog

Change-Id: Ic5a1d128c9ec903c0e1a9a673f7da8340e775dc0
2026-07-04 06:29:52 +08:00 · 2026-04-08 21:50:08 +08:00
562 changed files with 9806 additions and 63823 deletions
--- a/.codecov.yml
+++ b/.codecov.yml
@@ -6,6 +6,3 @@ coverage:
    patch:
      default:
        target: 60%
-
-github_checks:
-  annotations: true
--- a/.github/workflows/arch-audit.yml
+++ b/.github/workflows/arch-audit.yml
@@ -1,116 +0,0 @@
-name: Architecture Audit
-
-on:
-  schedule:
-    - cron: '0 9 * * 1' # Monday 09:00 UTC
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-jobs:
-  audit:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
-      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
-        with:
-          go-version-file: go.mod
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
-        with:
-          python-version: '3.x'
-      - name: Fetch meta data
-        run: python3 scripts/fetch_meta.py
-
-      - name: Dead code detection
-        run: |
-          echo "## Dead Code" >> report.md
-          go run golang.org/x/tools/cmd/deadcode@v0.31.0 -test ./... 2>&1 | tee deadcode.txt
-          count=$(wc -l < deadcode.txt | tr -d ' ')
-          echo "Found **$count** unreachable functions" >> report.md
-          echo '```' >> report.md
-          cat deadcode.txt >> report.md
-          echo '```' >> report.md
-
-      - name: Package complexity
-        run: |
-          echo "## Package Complexity" >> report.md
-          echo "" >> report.md
-          echo "Packages exceeding 2 000 lines or 20 files:" >> report.md
-          echo "" >> report.md
-          echo "| Package | Files | Lines | Deps |" >> report.md
-          echo "|---------|-------|-------|------|" >> report.md
-          found=0
-          for pkg in $(go list ./cmd/... ./internal/... ./shortcuts/...); do
-            dir=$(go list -f '{{.Dir}}' "$pkg")
-            files=$(find "$dir" -maxdepth 1 -name '*.go' ! -name '*_test.go' | wc -l | tr -d ' ')
-            lines=$(find "$dir" -maxdepth 1 -name '*.go' ! -name '*_test.go' -exec cat {} + 2>/dev/null | wc -l | tr -d ' ')
-            deps=$(go list -f '{{len .Imports}}' "$pkg")
-            if [ "$lines" -gt 2000 ] || [ "$files" -gt 20 ]; then
-              echo "| **$pkg** | **$files** | **$lines** | **$deps** |" >> report.md
-              found=1
-            fi
-          done
-          if [ "$found" = "0" ]; then
-            echo "| _(none)_ | | | |" >> report.md
-          fi
-
-      - name: Dependency freshness
-        run: |
-          echo "## Outdated Dependencies" >> report.md
-          echo '```' >> report.md
-          go list -m -u all 2>/dev/null | grep '\[' >> report.md || echo "All dependencies up to date" >> report.md
-          echo '```' >> report.md
-
-      - name: Circular dependency check
-        run: |
-          echo "## Circular Dependencies" >> report.md
-          go list -f '{{.ImportPath}} {{join .Imports " "}}' ./... | \
-            go run golang.org/x/tools/cmd/digraph@v0.31.0 scc 2>&1 | tee cycles.txt
-          if [ -s cycles.txt ]; then
-            echo '```' >> report.md
-            cat cycles.txt >> report.md
-            echo '```' >> report.md
-          else
-            echo "No circular dependencies detected." >> report.md
-          fi
-
-      - name: E2E coverage gaps
-        run: |
-          echo "## E2E Coverage Gaps" >> report.md
-          echo "" >> report.md
-          echo "Shortcut domains without E2E tests:" >> report.md
-          echo "" >> report.md
-          found=0
-          for domain in $(ls -d shortcuts/*/); do
-            name=$(basename "$domain")
-            if [ "$name" = "common" ]; then continue; fi
-            if [ ! -d "tests/cli_e2e/$name" ]; then
-              echo "- **$name** (no tests/cli_e2e/$name/)" >> report.md
-              found=1
-            fi
-          done
-          if [ "$found" = "0" ]; then
-            echo "All shortcut domains have E2E test directories." >> report.md
-          fi
-
-      - name: Coverage
-        run: |
-          echo "## Coverage" >> report.md
-          packages=$(go list ./... | grep -v 'tests/cli_e2e')
-          go test -coverprofile=coverage.txt -covermode=atomic $packages 2>/dev/null || true
-          total=$(go tool cover -func=coverage.txt 2>/dev/null | grep total | awk '{print $3}')
-          echo "Current total coverage: **${total:-n/a}**" >> report.md
-
-      - name: Publish report
-        run: |
-          echo "# Architecture Audit Report — $(date +%Y-%m-%d)" > $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-          cat report.md >> $GITHUB_STEP_SUMMARY
-
-      - name: Upload report artifact
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
-        with:
-          name: arch-audit-${{ github.run_number }}
-          path: report.md
-          retention-days: 90
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,334 +0,0 @@
-name: CI
-
-on:
-  push:
-    branches: [main]
-  pull_request:
-    branches: [main]
-  workflow_dispatch:
-
-permissions:
-  contents: read
-  actions: read
-  checks: write
-  pull-requests: write
-
-jobs:
-  # ── Layer 1: Fast Gate ─────────────────────────────────────────────
-  fast-gate:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
-      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
-        with:
-          go-version-file: go.mod
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
-        with:
-          python-version: '3.x'
-      - name: Fetch meta data
-        run: python3 scripts/fetch_meta.py
-      - name: Build
-        run: go build ./...
-      - name: Vet
-        run: go vet ./...
-      - name: Check formatting
-        run: |
-          unformatted=$(gofmt -l .)
-          if [ -n "$unformatted" ]; then
-            echo "$unformatted"
-            echo "::error::Unformatted Go files detected — run 'gofmt -w .' and commit"
-            exit 1
-          fi
-      - name: Check go.mod tidiness
-        run: |
-          go mod tidy
-          if ! git diff --quiet go.mod go.sum; then
-            echo "::error::go.mod or go.sum is not tidy. Run 'go mod tidy' and commit the changes."
-            git diff go.mod go.sum
-            exit 1
-          fi
-
-  # ── Layer 2: Quality Gate ──────────────────────────────────────────
-  unit-test:
-    needs: fast-gate
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
-      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
-        with:
-          go-version-file: go.mod
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
-        with:
-          python-version: '3.x'
-      - name: Fetch meta data
-        run: python3 scripts/fetch_meta.py
-      - name: Run tests
-        run: go test -v -race -count=1 -timeout=5m ./cmd/... ./internal/... ./shortcuts/...
-
-  lint:
-    needs: fast-gate
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
-        with:
-          fetch-depth: 0
-      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
-        with:
-          go-version-file: go.mod
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
-        with:
-          python-version: '3.x'
-      - name: Fetch meta data
-        run: python3 scripts/fetch_meta.py
-      - name: Run golangci-lint
-        run: go run github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.1.6 run --new-from-rev=origin/main
-
-  coverage:
-    needs: fast-gate
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
-      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
-        with:
-          go-version-file: go.mod
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
-        with:
-          python-version: '3.x'
-      - name: Fetch meta data
-        run: python3 scripts/fetch_meta.py
-      - name: Run tests with coverage
-        run: |
-          packages=$(go list ./... | grep -v '^github.com/larksuite/cli/tests/cli_e2e$' | grep -v '^github.com/larksuite/cli/tests/cli_e2e/')
-          go test -race -coverprofile=coverage.txt -covermode=atomic $packages
-      - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@3f20e214133d0983f9a10f3d63b0faf9241a3daa # v6
-        with:
-          files: coverage.txt
-          token: ${{ secrets.CODECOV_TOKEN }}
-      - name: Check coverage threshold
-        run: |
-          total=$(go tool cover -func=coverage.txt | grep total | awk '{print $3}' | tr -d '%')
-          threshold=40
-          echo "Coverage: ${total}% (threshold: ${threshold}%)"
-          if (( $(echo "$total < $threshold" | bc -l) )); then
-            echo "::error::Coverage ${total}% is below threshold ${threshold}%"
-            exit 1
-          fi
-      - name: Coverage summary
-        if: ${{ !cancelled() }}
-        run: |
-          if [ ! -f coverage.txt ]; then
-            echo "No coverage data available" >> $GITHUB_STEP_SUMMARY
-            exit 0
-          fi
-          total=$(go tool cover -func=coverage.txt | grep total | awk '{print $3}')
-          echo "## Coverage Report" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo "**Total coverage: ${total}**" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo "<details><summary>Details</summary>" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo '```' >> $GITHUB_STEP_SUMMARY
-          go tool cover -func=coverage.txt >> $GITHUB_STEP_SUMMARY
-          echo '```' >> $GITHUB_STEP_SUMMARY
-          echo "</details>" >> $GITHUB_STEP_SUMMARY
-
-  deadcode:
-    needs: fast-gate
-    if: ${{ github.event_name == 'pull_request' }}
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
-        with:
-          fetch-depth: 0
-      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
-        with:
-          go-version-file: go.mod
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
-        with:
-          python-version: '3.x'
-      - name: Fetch meta data
-        run: python3 scripts/fetch_meta.py
-      - name: Dead code check (incremental)
-        run: |
-          # Analyze current HEAD (strip line:col for stable diff across line shifts)
-          # Filter "go: downloading ..." lines to avoid false diffs from module cache state
-          go run golang.org/x/tools/cmd/deadcode@v0.31.0 -test ./... 2>&1 | \
-            grep -v '^go: ' | \
-            sed 's/:[0-9][0-9]*:[0-9][0-9]*:/:/' | sort > /tmp/dc-head.txt
-
-          # Analyze base branch via worktree
-          git worktree add -q /tmp/dc-base "origin/${{ github.base_ref }}"
-          (cd /tmp/dc-base && python3 scripts/fetch_meta.py && \
-           go run golang.org/x/tools/cmd/deadcode@v0.31.0 -test ./... 2>&1 | \
-            grep -v '^go: ' | \
-            sed 's/:[0-9][0-9]*:[0-9][0-9]*:/:/' | sort > /tmp/dc-base.txt) || {
-            echo "::warning::Failed to analyze base branch — skipping incremental dead code check"
-            git worktree remove -f /tmp/dc-base 2>/dev/null || true
-            exit 0
-          }
-          git worktree remove -f /tmp/dc-base
-
-          # Only new dead code blocks the PR
-          comm -23 /tmp/dc-head.txt /tmp/dc-base.txt > /tmp/dc-new.txt
-          if [ -s /tmp/dc-new.txt ]; then
-            echo "::group::New dead code"
-            cat /tmp/dc-new.txt
-            echo "::endgroup::"
-            echo "::error::New dead code detected — remove unreachable functions before merging"
-            exit 1
-          fi
-          echo "No new dead code introduced"
-
-  # ── Layer 3: E2E Gate ──────────────────────────────────────────────
-  e2e-dry-run:
-    needs: [unit-test, lint]
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
-      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
-        with:
-          go-version-file: go.mod
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
-        with:
-          python-version: '3.x'
-      - name: Build lark-cli
-        run: make build
-      - name: Run dry-run E2E tests
-        env:
-          LARK_CLI_BIN: ${{ github.workspace }}/lark-cli
-          LARKSUITE_CLI_APP_ID: dry-run
-          LARKSUITE_CLI_APP_SECRET: dry-run
-          LARKSUITE_CLI_BRAND: feishu
-        run: go test -v -count=1 -timeout=5m ./tests/cli_e2e/... -run 'DryRun|Regression'
-
-  e2e-live:
-    needs: [unit-test, lint]
-    if: ${{ github.event_name != 'pull_request' || !github.event.pull_request.head.repo.fork }}
-    runs-on: ubuntu-latest
-    env:
-      TEST_BOT1_APP_ID: ${{ secrets.TEST_BOT1_APP_ID }}
-      TEST_BOT1_APP_SECRET: ${{ secrets.TEST_BOT1_APP_SECRET }}
-      TEST_USER_ACCESS_TOKEN: ${{ secrets.TEST_USER_ACCESS_TOKEN }}
-    steps:
-      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
-      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
-        with:
-          go-version-file: go.mod
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
-        with:
-          python-version: '3.x'
-      - name: Build lark-cli
-        run: make build
-      - name: Configure bot credentials
-        run: |
-          if [ -z "$TEST_BOT1_APP_ID" ] || [ -z "$TEST_BOT1_APP_SECRET" ]; then
-            echo "::error::Missing required secrets: TEST_BOT1_APP_ID / TEST_BOT1_APP_SECRET"
-            exit 1
-          fi
-          printf '%s\n' "$TEST_BOT1_APP_SECRET" | ./lark-cli config init --app-id "$TEST_BOT1_APP_ID" --app-secret-stdin
-      - name: Run CLI E2E tests
-        env:
-          LARK_CLI_BIN: ${{ github.workspace }}/lark-cli
-        run: |
-          packages=$(go list ./tests/cli_e2e/... | grep -v '^github.com/larksuite/cli/tests/cli_e2e$' | grep -v '/demo$')
-          if [ -z "$packages" ]; then
-            echo "No CLI E2E packages to test after exclusions."
-            exit 1
-          fi
-          packages_arg=$(printf '%s\n' "$packages" | paste -sd' ' -)
-          go run gotest.tools/gotestsum@v1.12.3 --rerun-fails=2 --rerun-fails-max-failures=20 --packages="$packages_arg" --format testname --junitfile cli-e2e-report.xml -- -count=1 -v
-      - name: Publish CLI E2E test report
-        if: ${{ !cancelled() }}
-        uses: dorny/test-reporter@a43b3a5f7366b97d083190328d2c652e1a8b6aa2 # v3.0.0
-        with:
-          name: CLI E2E Tests
-          path: cli-e2e-report.xml
-          reporter: java-junit
-          use-actions-summary: true
-          list-suites: all
-          list-tests: all
-
-  # ── Layer 4: Security & Compliance (parallel with L2-L3) ──────────
-  security:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
-        with:
-          fetch-depth: 0
-      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
-        with:
-          go-version-file: go.mod
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
-        with:
-          python-version: '3.x'
-      - name: Fetch meta data
-        run: python3 scripts/fetch_meta.py
-      - name: Gitleaks
-        if: ${{ github.event_name != 'pull_request' || !github.event.pull_request.head.repo.fork }}
-        uses: gitleaks/gitleaks-action@ff98106e4c7b2bc287b24eaf42907196329070c7 # v2.3.9
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_KEY }}
-      - name: govulncheck
-        continue-on-error: true
-        run: go run golang.org/x/vuln/cmd/govulncheck@v1.1.4 ./...
-      - name: Check dependency licenses
-        run: go run github.com/google/go-licenses/v2@v2.0.1 check ./... --disallowed_types=forbidden,restricted,reciprocal,unknown
-
-  license-header:
-    if: ${{ github.event_name == 'pull_request' }}
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
-      - name: Check license headers
-        uses: apache/skywalking-eyes/header@8c96ee223558797cdd9eba82c0919258e1cf2dad
-        with:
-          config: .licenserc.yaml
-
-  # ── Results Gate (single required check for branch protection) ─────
-  results:
-    if: ${{ always() }}
-    needs: [fast-gate, unit-test, lint, coverage, deadcode, e2e-dry-run, e2e-live, security, license-header]
-    runs-on: ubuntu-latest
-    steps:
-      - name: Evaluate results
-        run: |
-          echo "## CI Results" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo "| Layer | Job | Status |" >> $GITHUB_STEP_SUMMARY
-          echo "|-------|-----|--------|" >> $GITHUB_STEP_SUMMARY
-          echo "| L1 | fast-gate | ${{ needs.fast-gate.result }} |" >> $GITHUB_STEP_SUMMARY
-          echo "| L2 | unit-test | ${{ needs.unit-test.result }} |" >> $GITHUB_STEP_SUMMARY
-          echo "| L2 | lint | ${{ needs.lint.result }} |" >> $GITHUB_STEP_SUMMARY
-          echo "| L2 | coverage | ${{ needs.coverage.result }} |" >> $GITHUB_STEP_SUMMARY
-          echo "| L2 | deadcode | ${{ needs.deadcode.result }} |" >> $GITHUB_STEP_SUMMARY
-          echo "| L3 | e2e-dry-run | ${{ needs.e2e-dry-run.result }} |" >> $GITHUB_STEP_SUMMARY
-          echo "| L3 | e2e-live | ${{ needs.e2e-live.result }} |" >> $GITHUB_STEP_SUMMARY
-          echo "| L4 | security | ${{ needs.security.result }} |" >> $GITHUB_STEP_SUMMARY
-          echo "| L4 | license-header | ${{ needs.license-header.result }} |" >> $GITHUB_STEP_SUMMARY
-
-          # Any failure or cancellation in any job blocks the merge.
-          # Legitimately skipped jobs (deadcode on push, e2e-live on fork,
-          # license-header on push) are OK.
-          FAILED=0
-          for result in \
-            "${{ needs.fast-gate.result }}" \
-            "${{ needs.unit-test.result }}" \
-            "${{ needs.lint.result }}" \
-            "${{ needs.coverage.result }}" \
-            "${{ needs.deadcode.result }}" \
-            "${{ needs.e2e-dry-run.result }}" \
-            "${{ needs.e2e-live.result }}" \
-            "${{ needs.security.result }}" \
-            "${{ needs.license-header.result }}"; do
-            if [ "$result" = "failure" ] || [ "$result" = "cancelled" ]; then
-              FAILED=1
-            fi
-          done
-
-          if [ "$FAILED" = "1" ]; then
-            echo ""
-            echo "::error::One or more CI jobs failed — see table above"
-            exit 1
-          fi
--- a/.github/workflows/cli-e2e.yml
+++ b/.github/workflows/cli-e2e.yml
@@ -0,0 +1,135 @@
+name: CLI E2E Tests
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "**.go"
+      - go.mod
+      - go.sum
+      - Makefile
+      - scripts/fetch_meta.py
+      - tests/cli_e2e/**
+      - .github/workflows/cli-e2e.yml
+  pull_request:
+    branches: [main]
+    paths:
+      - "**.go"
+      - go.mod
+      - go.sum
+      - Makefile
+      - scripts/fetch_meta.py
+      - tests/cli_e2e/**
+      - .github/workflows/cli-e2e.yml
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  cli-e2e:
+    # Forked pull_request runs do not receive repository/org secrets except GITHUB_TOKEN.
+    if: ${{ github.event_name != 'pull_request' || !github.event.pull_request.head.repo.fork }}
+    runs-on: ubuntu-latest
+    env:
+      TEST_BOT1_APP_ID: ${{ secrets.TEST_BOT1_APP_ID }}
+      TEST_BOT1_APP_SECRET: ${{ secrets.TEST_BOT1_APP_SECRET }}
+    steps:
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
+        with:
+          go-version-file: go.mod
+
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
+        with:
+          python-version: '3.x'
+
+      - name: Build lark-cli
+        run: make build
+
+      - name: Configure bot credentials
+        run: |
+          if [ -z "$TEST_BOT1_APP_ID" ] || [ -z "$TEST_BOT1_APP_SECRET" ]; then
+            echo "::error::Missing required secrets: TEST_BOT1_APP_ID / TEST_BOT1_APP_SECRET"
+            exit 1
+          fi
+          printf '%s\n' "$TEST_BOT1_APP_SECRET" | ./lark-cli config init --app-id "$TEST_BOT1_APP_ID" --app-secret-stdin
+
+      - name: Run CLI E2E tests
+        env:
+          LARK_CLI_BIN: ${{ github.workspace }}/lark-cli
+        run: |
+          packages=$(go list ./tests/cli_e2e/... | grep -v '^github.com/larksuite/cli/tests/cli_e2e$' | grep -v '/demo$')
+          if [ -z "$packages" ]; then
+            echo "No CLI E2E packages to test after exclusions."
+            exit 1
+          fi
+          go run gotest.tools/gotestsum@v1.12.3 --format testname --junitfile cli-e2e-report.xml -- -count=1 -v $packages
+
+      - name: Summarize CLI E2E test report
+        if: ${{ !cancelled() }}
+        run: |
+          python3 - <<'PY'
+          import os
+          import xml.etree.ElementTree as ET
+
+          report_path = "cli-e2e-report.xml"
+          summary_path = os.environ["GITHUB_STEP_SUMMARY"]
+
+          root = ET.parse(report_path).getroot()
+          suites = [root] if root.tag == "testsuite" else root.findall("testsuite")
+
+          tests = failures = errors = skipped = 0
+          failed_cases = []
+          skipped_cases = []
+
+          for suite in suites:
+            tests += int(suite.attrib.get("tests", 0))
+            failures += int(suite.attrib.get("failures", 0))
+            errors += int(suite.attrib.get("errors", 0))
+            skipped += int(suite.attrib.get("skipped", 0))
+
+            for case in suite.findall("testcase"):
+              classname = case.attrib.get("classname", "")
+              name = case.attrib.get("name", "")
+              label = f"{classname}.{name}" if classname else name
+
+              failure = case.find("failure")
+              error = case.find("error")
+              skipped_node = case.find("skipped")
+
+              if failure is not None or error is not None:
+                message = ""
+                node = failure if failure is not None else error
+                if node is not None:
+                  message = node.attrib.get("message", "") or (node.text or "").strip()
+                failed_cases.append((label, message))
+              elif skipped_node is not None:
+                message = skipped_node.attrib.get("message", "") or (skipped_node.text or "").strip()
+                skipped_cases.append((label, message))
+
+          passed = tests - failures - errors - skipped
+
+          with open(summary_path, "a", encoding="utf-8") as f:
+            f.write("## CLI E2E Test Report\n\n")
+            f.write(f"- Total: {tests}\n")
+            f.write(f"- Passed: {passed}\n")
+            f.write(f"- Failed: {failures}\n")
+            f.write(f"- Errors: {errors}\n")
+            f.write(f"- Skipped: {skipped}\n\n")
+
+            if failed_cases:
+              f.write("### Failed Tests\n\n")
+              for label, message in failed_cases:
+                detail = f" - {message}" if message else ""
+                f.write(f"- `{label}`{detail}\n")
+              f.write("\n")
+
+            if skipped_cases:
+              f.write("### Skipped Tests\n\n")
+              for label, message in skipped_cases:
+                detail = f" - {message}" if message else ""
+                f.write(f"- `{label}`{detail}\n")
+              f.write("\n")
+          PY
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -0,0 +1,58 @@
+name: Coverage
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "**.go"
+      - "!tests/cli_e2e/**"
+      - go.mod
+      - go.sum
+      - .github/workflows/coverage.yml
+  pull_request:
+    branches: [main]
+    paths:
+      - "**.go"
+      - "!tests/cli_e2e/**"
+      - go.mod
+      - go.sum
+      - .github/workflows/coverage.yml
+
+permissions:
+  contents: read
+
+jobs:
+  coverage:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+
+      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
+        with:
+          go-version-file: go.mod
+
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+        with:
+          python-version: '3.x'
+
+      - name: Fetch meta data
+        run: python3 scripts/fetch_meta.py
+
+      - name: Run tests with coverage
+        run: |
+          packages=$(go list ./... | grep -v '^github.com/larksuite/cli/tests/cli_e2e$' | grep -v '^github.com/larksuite/cli/tests/cli_e2e/')
+          go test -race -coverprofile=coverage.txt -covermode=atomic $packages
+
+      - name: Generate coverage report
+        run: |
+          total=$(go tool cover -func=coverage.txt | grep total | awk '{print $3}')
+          echo "## Coverage Report" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "**Total coverage: ${total}**" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "<details><summary>Details</summary>" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo '```' >> $GITHUB_STEP_SUMMARY
+          go tool cover -func=coverage.txt >> $GITHUB_STEP_SUMMARY
+          echo '```' >> $GITHUB_STEP_SUMMARY
+          echo "</details>" >> $GITHUB_STEP_SUMMARY
--- a/.github/workflows/gitleaks.yml
+++ b/.github/workflows/gitleaks.yml
@@ -0,0 +1,28 @@
+name: Gitleaks
+
+on:
+  pull_request:
+    branches: [main]
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  gitleaks:
+    # Forked pull_request runs do not receive repository/org secrets except GITHUB_TOKEN.
+    if: ${{ github.event_name != 'pull_request' || !github.event.pull_request.head.repo.fork }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+        with:
+          fetch-depth: 0
+
+      - uses: gitleaks/gitleaks-action@ff98106e4c7b2bc287b24eaf42907196329070c7 # v2.3.9
+        env:
+          # GITHUB_TOKEN is provided automatically by GitHub Actions.
+          # GITLEAKS_KEY must be configured as a repository secret.
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_KEY }}
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -0,0 +1,60 @@
+name: Lint
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "**.go"
+      - go.mod
+      - go.sum
+      - .golangci.yml
+      - .github/workflows/lint.yml
+  pull_request:
+    branches: [main]
+    paths:
+      - "**.go"
+      - go.mod
+      - go.sum
+      - .golangci.yml
+      - .github/workflows/lint.yml
+
+permissions:
+  contents: read
+
+jobs:
+  golangci-lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          fetch-depth: 0
+
+      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
+        with:
+          go-version-file: go.mod
+
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+        with:
+          python-version: '3.x'
+
+      - name: Fetch meta_data.json
+        run: python3 scripts/fetch_meta.py
+
+      - name: Ensure go.mod and go.sum are tidy
+        run: |
+          go mod tidy
+          if ! git diff --quiet go.mod go.sum; then
+            echo "::error::go.mod or go.sum is not tidy. Run 'go mod tidy' and commit the changes."
+            git diff go.mod go.sum
+            exit 1
+          fi
+
+      - name: Run golangci-lint
+        run: go run github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.1.6 run --new-from-rev=origin/main
+
+      - name: Run govulncheck
+        continue-on-error: true # informational until Go version is upgraded
+        run: go run golang.org/x/vuln/cmd/govulncheck@v1.1.4 ./...
+
+      - name: Check dependency licenses
+        run: go run github.com/google/go-licenses/v2@v2.0.1 check ./... --disallowed_types=forbidden,restricted,reciprocal,unknown
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -0,0 +1,43 @@
+name: Tests
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "**.go"
+      - go.mod
+      - go.sum
+      - .github/workflows/tests.yml
+  pull_request:
+    branches: [main]
+    paths:
+      - "**.go"
+      - go.mod
+      - go.sum
+      - .github/workflows/tests.yml
+
+permissions:
+  contents: read
+
+jobs:
+  unit-test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+
+      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
+        with:
+          go-version-file: go.mod
+
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+        with:
+          python-version: '3.x'
+
+      - name: Fetch meta data
+        run: python3 scripts/fetch_meta.py
+
+      - name: Run tests
+        run: go test -v -race -count=1 -timeout=5m ./cmd/... ./internal/... ./shortcuts/...
+
+      - name: Build
+        run: go build -v ./...
--- a/.gitignore
+++ b/.gitignore
@@ -31,9 +31,6 @@ tests/mail/reports/

 /log/

-
 # Generated / test artifacts
-.hammer/
 internal/registry/meta_data.json
 cmd/api/download.bin
-app.log
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -27,7 +27,6 @@ linters:
    - reassign        # checks that package variables are not reassigned
    - unconvert       # removes unnecessary type conversions
    - unused          # checks for unused constants, variables, functions and types
-    - depguard        # blocks forbidden package imports
    - forbidigo       # forbids specific function calls

    # To enable later after fixing existing issues:
@@ -46,7 +45,6 @@ linters:
        linters:
          - bodyclose
          - gocritic
-          - depguard
          - forbidigo
      - path-except: (shortcuts/|internal/)
        linters:
@@ -56,74 +54,79 @@ linters:
          - forbidigo

  settings:
-    depguard:
-      rules:
-        shortcuts-no-vfs:
-          files:
-            - "**/shortcuts/**"
-          deny:
-            - pkg: "github.com/larksuite/cli/internal/vfs"
-              desc: >-
-                shortcuts must not import internal/vfs directly.
-                Use runtime.FileIO() for file operations or runtime.ValidatePath() for path validation.
-            - pkg: "github.com/larksuite/cli/internal/vfs/localfileio"
-              desc: >-
-                shortcuts must not import internal/vfs/localfileio directly.
-                Use runtime.FileIO() for file operations or runtime.ValidatePath() for path validation.
-        shortcuts-no-raw-http:
-          files:
-            - "**/shortcuts/**"
-          deny:
-            - pkg: "net/http"
-              desc: >-
-                use RuntimeContext.DoAPI/CallAPI/DoAPIJSON instead of raw net/http.
-                The client layer handles auth, headers, and error normalization.
    forbidigo:
      forbid:
-        # ── os: already wrapped in internal/vfs ──
-        - pattern: os\.(Stat|Lstat|Open|OpenFile|Rename|ReadFile|WriteFile|Getwd|UserHomeDir|ReadDir)\b
-          msg: "use the corresponding vfs.Xxx() from internal/vfs"
-        - pattern: os\.(Create|CreateTemp|MkdirTemp)\b
+        # ── Filesystem operations: use internal/vfs instead ──
+        - pattern: os\.Stat\b
+          msg: "use vfs.Stat() from internal/vfs"
+        - pattern: os\.Lstat\b
+          msg: "use vfs.Lstat() from internal/vfs"
+        - pattern: os\.Open\b
+          msg: "use vfs.Open() from internal/vfs"
+        - pattern: os\.OpenFile\b
+          msg: "use vfs.OpenFile() from internal/vfs"
+        - pattern: os\.Create\b
+          msg: "use vfs.OpenFile() from internal/vfs"
+        - pattern: os\.CreateTemp\b
          msg: >-
-            internal/: use vfs.CreateTemp() or vfs.OpenFile().
-            shortcuts/: avoid temp files — use io.Reader streaming or in-memory buffers.
-        - pattern: os\.Mkdir(All)?\b
+            internal/: use vfs.CreateTemp() from internal/vfs.
+            shortcuts/: avoid temp files entirely — use io.Reader streaming or in-memory buffers instead.
+        - pattern: os\.Mkdir\b
+          msg: "use vfs.MkdirAll() from internal/vfs"
+        - pattern: os\.MkdirAll\b
          msg: "use vfs.MkdirAll() from internal/vfs"
        - pattern: os\.Remove\b
          msg: >-
            internal/: use vfs.Remove() from internal/vfs.
-            shortcuts/: avoid temp files — use io.Reader streaming or in-memory buffers.
+            shortcuts/: avoid temp files entirely — use io.Reader streaming or in-memory buffers instead.
        - pattern: os\.RemoveAll\b
          msg: >-
            internal/: add RemoveAll to internal/vfs/fs.go first, then use vfs.RemoveAll().
-            shortcuts/: avoid temp files — use io.Reader streaming or in-memory buffers.
-        # ── os: not yet in vfs — add to vfs/fs.go first ──
-        - pattern: os\.(Chdir|Chmod|Chown|Lchown|Chtimes|CopyFS|DirFS|Link|Symlink|Readlink|Truncate|SameFile)\b
-          msg: "add this function to internal/vfs/fs.go first, then use vfs.Xxx()"
-        # ── os: IO streams ──
-        - pattern: os\.Std(in|out|err)\b
-          msg: "use IOStreams (In/Out/ErrOut) instead of os.Stdin/Stdout/Stderr"
-        # ── os: process ──
+            shortcuts/: avoid temp files entirely — use io.Reader streaming or in-memory buffers instead.
+        - pattern: os\.Rename\b
+          msg: "use vfs.Rename() from internal/vfs"
+        - pattern: os\.ReadFile\b
+          msg: "use vfs.ReadFile() from internal/vfs"
+        - pattern: os\.WriteFile\b
+          msg: "use vfs.WriteFile() from internal/vfs"
+        - pattern: os\.ReadDir\b
+          msg: "add ReadDir to internal/vfs/fs.go first, then use vfs.ReadDir()"
+        - pattern: os\.Getwd\b
+          msg: "use vfs.Getwd() from internal/vfs"
+        - pattern: os\.Chdir\b
+          msg: "add Chdir to internal/vfs/fs.go first, then use vfs.Chdir()"
+        - pattern: os\.UserHomeDir\b
+          msg: "use vfs.UserHomeDir() from internal/vfs"
+        - pattern: os\.Chmod\b
+          msg: "add Chmod to internal/vfs/fs.go first, then use vfs.Chmod()"
+        - pattern: os\.Chown\b
+          msg: "add Chown to internal/vfs/fs.go first, then use vfs.Chown()"
+        - pattern: os\.Lchown\b
+          msg: "add Lchown to internal/vfs/fs.go first, then use vfs.Lchown()"
+        - pattern: os\.Link\b
+          msg: "add Link to internal/vfs/fs.go first, then use vfs.Link()"
+        - pattern: os\.Symlink\b
+          msg: "add Symlink to internal/vfs/fs.go first, then use vfs.Symlink()"
+        - pattern: os\.Readlink\b
+          msg: "add Readlink to internal/vfs/fs.go first, then use vfs.Readlink()"
+        - pattern: os\.Truncate\b
+          msg: "add Truncate to internal/vfs/fs.go first, then use vfs.Truncate()"
+        - pattern: os\.DirFS\b
+          msg: "add DirFS to internal/vfs/fs.go first, then use vfs.DirFS()"
+        - pattern: os\.SameFile\b
+          msg: "add SameFile to internal/vfs/fs.go first, then use vfs.SameFile()"
+        # ── IO streams: use IOStreams from cmdutil instead ──
+        - pattern: os\.Stdin\b
+          msg: "use IOStreams.In instead of os.Stdin"
+        - pattern: os\.Stdout\b
+          msg: "use IOStreams.Out instead of os.Stdout"
+        - pattern: os\.Stderr\b
+          msg: "use IOStreams.ErrOut instead of os.Stderr"
+        # ── Process-level rules ──
        - pattern: os\.Exit\b
          msg: >-
            Do not use os.Exit in shortcuts/. Return an error instead and let
            the caller (cmd layer) decide how to terminate.
-        # ── output: shortcuts must use ctx.Out() ──
-        - pattern: fmt\.Print(f|ln)?\b
-          msg: >-
-            use ctx.Out() or ctx.OutFormat() for structured JSON output.
-            fmt.Print* bypasses the output envelope and breaks --jq/--format.
-        # ── logging: shortcuts must return errors, not log.Fatal ──
-        - pattern: log\.(Print|Fatal|Panic)(f|ln)?\b
-          msg: >-
-            use structured error return, not log.Fatal/Panic.
-            Shortcuts must return errors to the framework for proper exit code handling.
-        # ── filepath: functions that access the filesystem ──
-        - pattern: filepath\.(EvalSymlinks|Walk|WalkDir|Glob|Abs)\b
-          msg: >-
-            These filepath functions access the filesystem directly.
-            internal/: use vfs helpers or localfileio path validation.
-            shortcuts/: use runtime.ValidatePath() or runtime.FileIO().
      analyze-types: true
    gocritic:
      disabled-checks:
--- a/.licenserc.yaml
+++ b/.licenserc.yaml
@@ -1,16 +0,0 @@
-header:
-  license:
-    content: |
-      Copyright (c) [year] Lark Technologies Pte. Ltd.
-      SPDX-License-Identifier: MIT
-    copyright-year: "2026"
-
-  paths:
-    - '**/*.go'
-    - '**/*.js'
-    - '**/*.py'
-
-  paths-ignore:
-    - '**/testdata/**'
-
-  comment: on-failure
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -18,11 +18,9 @@ make test           # Full: vet + unit + integration
 ## Pre-PR Checks (match CI gates)

 1. `make unit-test`
-2. `go vet ./...`
-3. `gofmt -l .` — must produce no output
-4. `go mod tidy` — must not change `go.mod`/`go.sum`
-5. `go run github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.1.6 run --new-from-rev=origin/main`
-6. If dependencies changed: `go run github.com/google/go-licenses/v2@v2.0.1 check ./... --disallowed_types=forbidden,restricted,reciprocal,unknown`
+2. `go mod tidy` — must not change `go.mod`/`go.sum`
+3. `go run github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.1.6 run --new-from-rev=origin/main`
+4. If dependencies changed: `go run github.com/google/go-licenses/v2@v2.0.1 check ./... --disallowed_types=forbidden,restricted,reciprocal,unknown`

 ## Commit & PR

@@ -78,26 +76,3 @@ CLI arguments are untrusted (they come from AI agents). Call `validate.SafeInput
 - Every behavior change needs a test alongside the change.
 - `cmdutil.TestFactory(t, config)` for test factories.
 - `t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())` to isolate config state.
-
-### E2E Testing
-
-**Dry-run E2E (required for every shortcut change)**
- Validates request structure without calling real APIs
- Place in `tests/cli_e2e/dryrun/` or the corresponding domain directory
- Set env vars `LARKSUITE_CLI_APP_ID`/`APP_SECRET`/`BRAND`, use `--dry-run`, assert method/URL/params
- No secrets needed — runs on fork PRs
- Explore correct params with `lark-cli <domain> --help` and `lark-cli schema` first
-
-**Live E2E (required for new flows or behavior changes)**
- Validates real API round-trips
- Place in `tests/cli_e2e/<domain>/`
- Must be self-contained: create -> use -> cleanup
- Needs bot credentials (CI secrets, skipped on fork PRs)
- Reference: `tests/cli_e2e/task/task_status_workflow_test.go`
-
-| Change | Dry-run E2E | Live E2E |
-|--------|:-----------:|:--------:|
-| New shortcut | Required | Required |
-| Modify shortcut flags/params | Required | If behavior changes |
-| Shortcut bug fix | Required | If regression risk |
-| Internal refactor (no shortcut impact) | Not needed | Not needed |
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,188 +2,6 @@

 All notable changes to this project will be documented in this file.

-## [v1.0.14] - 2026-04-17
-
-### Features
-
- **mail**: Add email priority support for compose and read (#538)
- **mail**: Support scheduled send (#534)
- **drive**: Support sheet cell comments in `+add-comment` (#518)
- **doc**: Add `--file-view` flag to `+media-insert` (#419)
- **base**: Auto grant current user for bot create and copy (#497)
- **base**: Add identity priority strategy and error handling (#505)
- **auth**: Improve login scope handling and messages (#523)
- Add OKR business domain (#522)
-
-### Documentation
-
- **wiki**: Improve wiki skill docs and add wiki domain template (#512)
- **task**: Document `custom_fields` and `custom_field_options` API resources and permissions (#524)
-
-### Refactor
-
- **skills**: Introduce `lark-doc-whiteboard.md` and streamline whiteboard workflow (#502)
-
-## [v1.0.13] - 2026-04-16
-
-### Features
-
- **im**: Support user access token for file, image, audio, and video upload, aligning upload and send identity with `--as` flag (#474)
- **drive**: Add `drive +create-folder` shortcut with root-folder fallback and bot-mode auto-grant (#470)
- **wiki**: Add bot-mode auto-grant support to `wiki +node-create` (#470)
- **doc**: Default `skip_task_detail` in `docs +fetch` to reduce unnecessary task detail expansion (#471)
-
-### Bug Fixes
-
- **im**: Preserve original URL filename for uploaded file messages instead of generic `media.ext` names (#514)
- **whiteboard**: Use atomic overwrite API parameter for `whiteboard +update`, replacing read-then-delete approach (#483)
-
-### Documentation
-
- **base**: Unify record batch write limit to 200 and enforce serial writes for continuous operations (#499)
- **base**: Remove redundant reference documentation and command grouping chapters from SKILL.md (#500)
-
-### CI
-
- Consolidate workflows into layered CI pyramid with single `results` gate (#510)
-
-## [v1.0.12] - 2026-04-15
-
-### Features
-
- Add guided npm install flow that installs or upgrades the CLI, installs AI skills, and walks through app config and auth login (#464)
- **mail**: Add email signature support with `+signature`, `--signature-id` compose flags, and draft signature edit operations (#485)
- **mail**: Return recall hints for sent emails when recall is available (#481)
- **slides**: Add `+media-upload` and support `@path` image placeholders in `+create --slides` (#450)
-
-### Documentation
-
- **mail**: Add recipient search guidance to the mail skill workflow (#437)
- **calendar/vc**: Route past meeting queries to `lark-vc` and clarify historical date matching in skills (#482, #480)
-
-## [v1.0.11] - 2026-04-14
-
-### Features
-
- **sheets**: Add dropdown shortcuts for data validation management (`+set-dropdown`, `+update-dropdown`, `+get-dropdown`, `+delete-dropdown`) (#461)
- **task**: Add task search, tasklist search, related-task, set-ancestor, and subscribe-event shortcuts (#377)
- Streamline interactive login by removing the extra auth confirmation step (#451)
-
-### Bug Fixes
-
- **base**: Validate JSON object inputs for base shortcuts and reject `null` objects (#458)
-
-### Documentation
-
- **sheets**: Document value formats for formulas and special field types (#456)
- **readme**: Add Attendance to the features table (#460)
-
-## [v1.0.10] - 2026-04-13
-
-### Features
-
- **im**: Support im oapi range download for large files (#283)
- **sheets**: Add filter view and condition shortcuts (#422)
- **wiki**: Add wiki move shortcut with async task polling (#436)
- **drive**: Add drive `+create-shortcut` shortcut (#432)
- **drive**: Add drive files patch metadata API (#444)
- **task**: Support `--section-guid` flag in tasklist-task-add shortcut (#430)
-
-### Bug Fixes
-
- **base**: Support large base attachment uploads (#441)
- **config**: Clarify init copy for TTY, preserve original for AI (#448)
- **im**: Reject `--user-id` under bot identity for chat-messages-list (#340)
- **mail**: Add missing scopes for mail `+watch` shortcut (#357)
- **mail**: Restrict `--output-dir` to current working directory (#376)
-
-### Documentation
-
- **wiki**: Add wiki member operations to lark-wiki skill (#417)
- **task**: Document sections API resources, permissions, and URL parsing (#430)
- **doc**: Clarify when markdown escaping is needed (#312)
-
-## [v1.0.9] - 2026-04-11
-
-### Features
-
- Add attendance `user_task.query` (#405)
- Support minutes search (#359)
- **slides**: Add slides `+create` shortcut with `--slides` one-step creation (#389)
- **slides**: Return presentation URL in slides `+create` output (#425)
- **sheets**: Add dimension shortcuts for row/column operations (#413)
- **sheets**: Add cell operation shortcuts for merge, replace, and style (#412)
- **drive**: Add drive folder delete shortcut with async task polling (#415)
-
-### Documentation
-
- **drive**: Add guide for granting document permission to current bot (#414)
-
-## [v1.0.8] - 2026-04-10
-
-### Features
-
- Add `update` command with self-update, verification, and rollback (#391)
- Add `--file` flag for multipart/form-data file uploads (#395)
- Support file comment reply reactions (#380)
- **base**: Add `+dashboard-arrange` command for auto-arranging dashboard blocks layout and `text` block type with Markdown support (#388)
- **base**: Add record batch `+add` / `+set` shortcuts (#277)
- **base**: Add `+record-search` for keyword-based record search (#328)
- **base**: Add view visible fields `+get` / `+set` shortcuts (#326)
- **base**: Add record field filters (#327)
- **base**: Optimize workflow skills (#345)
- **calendar**: Add room find workflow (#403)
- **mail**: Add `--page-token` and `--page-size` to mail `+triage` (#301)
- **whiteboard**: Add `+query` shortcut and enhance `+update` with Mermaid/PlantUML support (#382)
-
-### Bug Fixes
-
- Improve error hints for sandbox and initialization issues (#384)
- Fix markdown line breaks support (#338)
- Return raw base field and view responses (#378)
- **base**: Return raw table list response and clarify sort help (#393)
- **calendar**: Add default video meeting to `+create` (#383)
- **mail**: Replace `os.Exit` with graceful shutdown in mail watch (#350)
-
-### Documentation
-
- **base**: Document Base attachment download via docs `+media-download` (#404)
- Reorganize lark-base skill guidance (#374)
-
-## [v1.0.7] - 2026-04-09
-
-### Features
-
- Auto-grant current user access for bot-created docs, sheets, imports, and uploads (#360)
- **mail**: Add `send_as` alias support, mailbox/sender discovery APIs, and mail rules API
- **vc**: Extract note doc tokens from calendar event relation API (#333)
- **wiki**: Add wiki node create shortcut (#320)
- **sheets**: Add `+write-image` shortcut (#343)
- **docs**: Add media-preview shortcut (#334)
- **docs**: Add support for additional search filters (#353)
-
-### Bug Fixes
-
- **api**: Support stdin and quoted JSON inputs on Windows (#367)
- **doc**: Post-process `docs +fetch` output to improve round-trip fidelity (#214)
- **run**: Add missing binary check for lark-cli execution (#362)
- **config**: Validate appId and appSecret keychain key consistency (#295)
-
-### Refactor
-
- Route base import guidance to drive `+import` (#368)
- Migrate mail shortcuts to FileIO (#356)
- Migrate drive/doc/sheets shortcuts to FileIO (#339)
- Migrate base shortcuts to FileIO (#347)
-
-### Documentation
-
- **lark-doc**: Document advanced boolean and intitle search syntax for AI agents (#210)
-
-### Chore
-
- Add depguard and forbidigo rules to guide FileIO adoption (#342)
-
 ## [v1.0.6] - 2026-04-08

 ### Features
@@ -404,14 +222,6 @@ Bundled AI agent skills for intelligent assistance:
 - Bilingual documentation (English & Chinese).
 - CI/CD pipelines: linting, testing, coverage reporting, and automated releases.

-[v1.0.14]: https://github.com/larksuite/cli/releases/tag/v1.0.14
-[v1.0.13]: https://github.com/larksuite/cli/releases/tag/v1.0.13
-[v1.0.12]: https://github.com/larksuite/cli/releases/tag/v1.0.12
-[v1.0.11]: https://github.com/larksuite/cli/releases/tag/v1.0.11
-[v1.0.10]: https://github.com/larksuite/cli/releases/tag/v1.0.10
-[v1.0.9]: https://github.com/larksuite/cli/releases/tag/v1.0.9
-[v1.0.8]: https://github.com/larksuite/cli/releases/tag/v1.0.8
-[v1.0.7]: https://github.com/larksuite/cli/releases/tag/v1.0.7
 [v1.0.6]: https://github.com/larksuite/cli/releases/tag/v1.0.6
 [v1.0.5]: https://github.com/larksuite/cli/releases/tag/v1.0.5
 [v1.0.4]: https://github.com/larksuite/cli/releases/tag/v1.0.4
--- a/README.md
+++ b/README.md
@@ -6,14 +6,14 @@

 [中文版](./README.zh.md) | [English](./README.md)

-The official [Lark/Feishu](https://www.larksuite.com/) CLI tool, maintained by the [larksuite](https://github.com/larksuite) team — built for humans and AI Agents. Covers core business domains including Messenger, Docs, Base, Sheets, Slides, Calendar, Mail, Tasks, Meetings, and more, with 200+ commands and 22 AI Agent [Skills](./skills/).
+The official [Lark/Feishu](https://www.larksuite.com/) CLI tool, maintained by the [larksuite](https://github.com/larksuite) team — built for humans and AI Agents. Covers core business domains including Messenger, Docs, Base, Sheets, Calendar, Mail, Tasks, Meetings, and more, with 200+ commands and 20 AI Agent [Skills](./skills/).

 [Install](#installation--quick-start) · [AI Agent Skills](#agent-skills) · [Auth](#authentication) · [Commands](#three-layer-command-system) · [Advanced](#advanced-usage) · [Security](#security--risk-warnings-read-before-use) · [Contributing](#contributing)

 ## Why lark-cli?

- **Agent-Native Design** — 22 structured [Skills](./skills/) out of the box, compatible with popular AI tools — Agents can operate Lark with zero extra setup
- **Wide Coverage** — 14 business domains, 200+ curated commands, 22 AI Agent [Skills](./skills/)
+- **Agent-Native Design** — 20 structured [Skills](./skills/) out of the box, compatible with popular AI tools — Agents can operate Lark with zero extra setup
+- **Wide Coverage** — 12 business domains, 200+ curated commands, 20 AI Agent [Skills](./skills/)
 - **AI-Friendly & Optimized** — Every command is tested with real Agents, featuring concise parameters, smart defaults, and structured output to maximize Agent call success rates
 - **Open Source, Zero Barriers** — MIT license, ready to use, just `npm install`
 - **Up and Running in 3 Minutes** — One-click app creation, interactive login, from install to first API call in just 3 steps
@@ -30,15 +30,12 @@ The official [Lark/Feishu](https://www.larksuite.com/) CLI tool, maintained by t
 | 📁 Drive      | Upload and download files, search docs & wiki, manage comments                                                                    |
 | 📊 Base       | Create and manage tables, fields, records, views, dashboards, workflows, forms, roles & permissions, data aggregation & analytics |
 | 📈 Sheets     | Create, read, write, append, find, and export spreadsheet data                                                                    |
-| 🖼️ Slides     | Create and manage presentations, read presentation content, and add or remove slides                                              |
 | ✅ Tasks      | Create, query, update, and complete tasks; manage task lists, subtasks, comments & reminders                                      |
 | 📚 Wiki       | Create and manage knowledge spaces, nodes, and documents                                                                          |
 | 👤 Contact    | Search users by name/email/phone, get user profiles                                                                               |
 | 📧 Mail       | Browse, search, read emails, send, reply, forward, manage drafts, watch new mail                                                  |
 | 🎥 Meetings   | Search meeting records, query meeting minutes & recordings                                                                        |
-| 🕐 Attendance | Query personal attendance check-in records                                                                                        |
 | ✍️ Approval   | Query approval tasks, approve/reject/transfer tasks, cancel and CC instances                                                      |
-| 🎯 OKR        | Query, create, update OKRs; manage objective & key results, alignments and indicators.                                            |

 ## Installation & Quick Start

@@ -139,7 +136,6 @@ lark-cli auth status
 | `lark-doc`                      | Create, read, update, search documents (Markdown-based)                                                        |
 | `lark-drive`                    | Upload, download files, manage permissions & comments                                                          |
 | `lark-sheets`                   | Create, read, write, append, find, export spreadsheets                                                         |
-| `lark-slides`                   | Create and manage presentations, read presentation content, and add or remove slides                          |
 | `lark-base`                     | Tables, fields, records, views, dashboards, data aggregation & analytics                                       |
 | `lark-task`                     | Tasks, task lists, subtasks, reminders, member assignment                                                      |
 | `lark-mail`                     | Browse, search, read emails, send, reply, forward, draft management, watch new mail                            |
@@ -151,7 +147,6 @@ lark-cli auth status
 | `lark-minutes`                  | Minutes metadata & AI artifacts (summary, todos, chapters)                                                     |
 | `lark-openapi-explorer`         | Explore underlying APIs from official docs                                                                     |
 | `lark-skill-maker`              | Custom skill creation framework                                                                                |
-| `lark-attendance`               | Query personal attendance check-in records                                                                     |
 | `lark-approval`                 | Query approval tasks, approve/reject/transfer tasks, cancel and CC instances                                   |
 | `lark-workflow-meeting-summary` | Workflow: meeting minutes aggregation & structured report                                                      |
 | `lark-workflow-standup-report`  | Workflow: agenda & todo summary                                                                                |
@@ -201,7 +196,7 @@ Prefixed with `+`, designed to be friendly for both humans and AI, with smart de
 ```bash
 lark-cli calendar +agenda
 lark-cli im +messages-send --chat-id "oc_xxx" --text "Hello"
-lark-cli docs +create --doc-format markdown --content "<title>Weekly Report</title>\n# Progress\n- Completed feature X"
+lark-cli docs +create --title "Weekly Report" --markdown "# Progress\n- Completed feature X"
 ```

 Run `lark-cli <service> --help` to see all shortcut commands.
--- a/README.zh.md
+++ b/README.zh.md
@@ -6,14 +6,14 @@

 [中文版](./README.zh.md) | [English](./README.md)

-飞书官方 CLI 工具，由 [larksuite](https://github.com/larksuite) 团队维护 — 让人类和 AI Agent 都能在终端中操作飞书。覆盖消息、文档、多维表格、电子表格、幻灯片、日历、邮箱、任务、会议等核心业务域，提供 200+ 命令及 22 个 AI Agent [Skills](./skills/)。
+飞书官方 CLI 工具，由 [larksuite](https://github.com/larksuite) 团队维护 — 让人类和 AI Agent 都能在终端中操作飞书。覆盖消息、文档、多维表格、电子表格、日历、邮箱、任务、会议等核心业务域，提供 200+ 命令及 20 个 AI Agent [Skills](./skills/)。

 [安装](#安装与快速开始) · [AI Agent Skills](#agent-skills) · [认证](#认证) · [命令](#三层命令调用) · [进阶用法](#进阶用法) · [安全](#安全与风险提示使用前必读) · [贡献](#贡献)

 ## 为什么选 lark-cli？

- **为 Agent 原生设计** — 22 个 [Skills](./skills/) 开箱即用，适配主流 AI 工具，Agent 无需额外适配即可操作飞书
- **覆盖面广** — 14 大业务域、200+ 精选命令、22 个 AI Agent [Skills](./skills/)
+- **为 Agent 原生设计** — [Skills](./skills/) 开箱即用，适配主流 AI 工具，Agent 无需额外适配即可操作飞书
+- **覆盖面广** — 12 大业务域、200+ 精选命令、 20 个 AI Agent [Skills](./skills/)
 - **AI 友好调优** — 每条命令经过 Agent 实测验证，提供更友好的参数、智能默认值和结构化输出，大幅提升 Agent 调用成功率
 - **开源零门槛** — MIT 协议，开箱即用，`npm install` 即可使用
 - **三分钟上手** — 一键创建应用、交互式登录授权，从安装到第一次 API 调用只需三步
@@ -30,15 +30,12 @@
 | 📁 云空间   | 上传和下载文件、搜索文档与知识库、管理评论                      |
 | 📊 多维表格 | 创建和管理数据表、字段、记录、视图、仪表盘、自动化流程、表单、角色权限，数据聚合分析 |
 | 📈 电子表格 | 创建、读取、写入、追加、查找和导出表格数据                      |
-| 🖼️ 幻灯片   | 创建和管理演示文稿、读取演示文稿内容，以及新增或删除幻灯片页面 |
 | ✅ 任务     | 创建、查询、更新和完成任务；管理任务清单、子任务、评论与提醒             |
 | 📚 知识库   | 创建和管理知识空间、节点和文档                            |
 | 👤 通讯录   | 按姓名/邮箱/手机号搜索用户、获取用户信息                      |
 | 📧 邮箱     | 浏览、搜索、阅读邮件，发送、回复、转发邮件，管理草稿，监听新邮件           |
 | 🎥 视频会议 | 搜索会议记录、查询会议纪要与录制                           |
-| 🕐 考勤打卡 | 查询个人考勤打卡记录                                |
 | ✍️ 审批     | 查询审批任务、同意/拒绝/转交审批任务、撤回与抄送审批实例              |
-| 🎯 OKR  | 查询、创建、更新 OKR，管理目标、关键结果、对齐和指标               |

 ## 安装与快速开始

@@ -140,7 +137,6 @@ lark-cli auth status
 | `lark-doc`                      | 创建、读取、更新、搜索文档（基于 Markdown）                |
 | `lark-drive`                    | 上传、下载文件，管理权限与评论                           |
 | `lark-sheets`                   | 创建、读取、写入、追加、查找、导出电子表格                     |
-| `lark-slides`                   | 创建和管理演示文稿、读取演示文稿内容，以及新增或删除幻灯片页面 |
 | `lark-base`                     | 多维表格、字段、记录、视图、仪表盘、数据聚合分析                  |
 | `lark-task`                     | 任务、任务清单、子任务、提醒、成员分配                       |
 | `lark-mail`                     | 浏览、搜索、阅读邮件，发送、回复、转发，草稿管理，监听新邮件            |
@@ -152,7 +148,6 @@ lark-cli auth status
 | `lark-minutes`                  | 妙记元数据与 AI 产物（总结、待办、章节）                    |
 | `lark-openapi-explorer`         | 从官方文档探索底层 API                             |
 | `lark-skill-maker`              | 自定义 skill 创建框架                            |
-| `lark-attendance`               | 查询个人考勤打卡记录                                |
 | `lark-approval`                 | 审批任务查询、同意/拒绝/转交审批任务、撤回与抄送审批实例             |
 | `lark-workflow-meeting-summary` | 工作流：会议纪要汇总与结构化报告                          |
 | `lark-workflow-standup-report`  | 工作流：日程待办摘要                                |
@@ -202,7 +197,7 @@ CLI 提供三种粒度的调用方式，覆盖从快速操作到完全自定义
 ```bash
 lark-cli calendar +agenda
 lark-cli im +messages-send --chat-id "oc_xxx" --text "Hello"
-lark-cli docs +create --doc-format markdown --content "<title>周报</title>\n# 本周进展\n- 完成了 X 功能"
+lark-cli docs +create --title "周报" --markdown "# 本周进展\n- 完成了 X 功能"
 ```

 运行 `lark-cli <service> --help` 查看所有快捷命令。
--- a/cmd/api/api.go
+++ b/cmd/api/api.go
@@ -5,6 +5,7 @@ package api

 import (
 	"context"
+	"encoding/json"
 	"fmt"
 	"io"
 	"regexp"
@@ -41,7 +42,17 @@ type APIOptions struct {
 	Format    string
 	JqExpr    string
 	DryRun    bool
-	File      string
+}
+
+func parseJsonOpt(input, label string) (map[string]interface{}, error) {
+	if input == "" {
+		return nil, nil
+	}
+	var result map[string]interface{}
+	if err := json.Unmarshal([]byte(input), &result); err != nil {
+		return nil, output.ErrValidation("%s invalid format, expected JSON object", label)
+	}
+	return result, nil
 }

 var urlPrefixRe = regexp.MustCompile(`https?://[^/]+(/open-apis/.+)`)
@@ -77,8 +88,8 @@ func NewCmdApi(f *cmdutil.Factory, runF func(*APIOptions) error) *cobra.Command
 		},
 	}

-	cmd.Flags().StringVar(&opts.Params, "params", "", "query parameters JSON (supports - for stdin)")
-	cmd.Flags().StringVar(&opts.Data, "data", "", "request body JSON (supports - for stdin)")
+	cmd.Flags().StringVar(&opts.Params, "params", "", "query parameters JSON")
+	cmd.Flags().StringVar(&opts.Data, "data", "", "request body JSON")
 	cmd.Flags().StringVar(&asStr, "as", "auto", "identity type: user | bot | auto (default)")
 	cmd.Flags().StringVarP(&opts.Output, "output", "o", "", "output file path for binary responses")
 	cmd.Flags().BoolVar(&opts.PageAll, "page-all", false, "automatically paginate through all pages")
@@ -88,7 +99,6 @@ func NewCmdApi(f *cmdutil.Factory, runF func(*APIOptions) error) *cobra.Command
 	cmd.Flags().StringVar(&opts.Format, "format", "json", "output format: json|ndjson|table|csv")
 	cmd.Flags().StringVarP(&opts.JqExpr, "jq", "q", "", "jq expression to filter JSON output")
 	cmd.Flags().BoolVar(&opts.DryRun, "dry-run", false, "print request without executing")
-	cmd.Flags().StringVar(&opts.File, "file", "", "file to upload as multipart/form-data ([field=]path, supports - for stdin)")

 	cmd.ValidArgsFunction = func(_ *cobra.Command, args []string, _ string) ([]string, cobra.ShellCompDirective) {
 		if len(args) == 0 {
@@ -96,10 +106,10 @@ func NewCmdApi(f *cmdutil.Factory, runF func(*APIOptions) error) *cobra.Command
 		}
 		return nil, cobra.ShellCompDirectiveNoFileComp
 	}
-	cmdutil.RegisterFlagCompletion(cmd, "as", func(_ *cobra.Command, _ []string, _ string) ([]string, cobra.ShellCompDirective) {
+	_ = cmd.RegisterFlagCompletionFunc("as", func(_ *cobra.Command, _ []string, _ string) ([]string, cobra.ShellCompDirective) {
 		return []string{"user", "bot"}, cobra.ShellCompDirectiveNoFileComp
 	})
-	cmdutil.RegisterFlagCompletion(cmd, "format", func(_ *cobra.Command, _ []string, _ string) ([]string, cobra.ShellCompDirective) {
+	_ = cmd.RegisterFlagCompletionFunc("format", func(_ *cobra.Command, _ []string, _ string) ([]string, cobra.ShellCompDirective) {
 		return []string{"json", "ndjson", "table", "csv"}, cobra.ShellCompDirectiveNoFileComp
 	})

@@ -107,24 +117,20 @@ func NewCmdApi(f *cmdutil.Factory, runF func(*APIOptions) error) *cobra.Command
 }

 // buildAPIRequest validates flags and builds a RawApiRequest.
-// When dryRun is true and a file is provided, file reading is skipped and
-// FileUploadMeta is returned instead so the caller can render dry-run output.
-func buildAPIRequest(opts *APIOptions) (client.RawApiRequest, *cmdutil.FileUploadMeta, error) {
-	stdin := opts.Factory.IOStreams.In
-
-	// Validate --file mutual exclusions first.
-	if err := cmdutil.ValidateFileFlag(opts.File, opts.Params, opts.Data, opts.Output, opts.PageAll, opts.Method); err != nil {
-		return client.RawApiRequest{}, nil, err
-	}
-
-	// stdin conflict: --params and --data cannot both read from stdin, regardless of --file.
-	if opts.Params == "-" && opts.Data == "-" {
-		return client.RawApiRequest{}, nil, output.ErrValidation("--params and --data cannot both read from stdin (-)")
-	}
-
-	params, err := cmdutil.ParseJSONMap(opts.Params, "--params", stdin)
+func buildAPIRequest(opts *APIOptions) (client.RawApiRequest, error) {
+	params, err := parseJsonOpt(opts.Params, "--params")
 	if err != nil {
-		return client.RawApiRequest{}, nil, err
+		return client.RawApiRequest{}, err
+	}
+	if params == nil {
+		params = map[string]interface{}{}
+	}
+	var data interface{}
+	if opts.Data != "" {
+		data, err = parseJsonOpt(opts.Data, "--data")
+		if err != nil {
+			return client.RawApiRequest{}, err
+		}
 	}
 	if opts.PageSize > 0 {
 		params["page_size"] = opts.PageSize
@@ -134,53 +140,14 @@ func buildAPIRequest(opts *APIOptions) (client.RawApiRequest, *cmdutil.FileUploa
 		Method: opts.Method,
 		URL:    normalisePath(opts.Path),
 		Params: params,
+		Data:   data,
 		As:     opts.As,
 	}
-
-	if opts.File != "" {
-		// File upload path: build formdata.
-		fieldName, filePath, isStdin := cmdutil.ParseFileFlag(opts.File, "file")
-
-		// Parse --data as JSON map for form fields (not as body).
-		var dataFields any
-		if opts.Data != "" {
-			dataFields, err = cmdutil.ParseOptionalBody(opts.Method, opts.Data, stdin)
-			if err != nil {
-				return client.RawApiRequest{}, nil, err
-			}
-			if _, ok := dataFields.(map[string]any); !ok {
-				return client.RawApiRequest{}, nil, output.ErrValidation("--data must be a JSON object when used with --file")
-			}
-		}
-
-		if opts.DryRun {
-			return request, &cmdutil.FileUploadMeta{
-				FieldName: fieldName, FilePath: filePath, FormFields: dataFields,
-			}, nil
-		}
-
-		fd, err := cmdutil.BuildFormdata(
-			opts.Factory.ResolveFileIO(opts.Ctx),
-			fieldName, filePath, isStdin, stdin, dataFields,
-		)
-		if err != nil {
-			return client.RawApiRequest{}, nil, err
-		}
-		request.Data = fd
-		request.ExtraOpts = append(request.ExtraOpts, larkcore.WithFileUpload())
-	} else {
-		// Normal path: JSON body.
-		data, err := cmdutil.ParseOptionalBody(opts.Method, opts.Data, stdin)
-		if err != nil {
-			return client.RawApiRequest{}, nil, err
-		}
-		request.Data = data
-		if opts.Output != "" {
-			request.ExtraOpts = append(request.ExtraOpts, larkcore.WithFileDownload())
-		}
+	// WithFileDownload tells the SDK to skip CodeError parsing on 200 OK.
+	if opts.Output != "" {
+		request.ExtraOpts = append(request.ExtraOpts, larkcore.WithFileDownload())
 	}
-
-	return request, nil, nil
+	return request, nil
 }

 func apiRun(opts *APIOptions) error {
@@ -198,7 +165,7 @@ func apiRun(opts *APIOptions) error {
 		return err
 	}

-	request, fileMeta, err := buildAPIRequest(opts)
+	request, err := buildAPIRequest(opts)
 	if err != nil {
 		return err
 	}
@@ -209,9 +176,6 @@ func apiRun(opts *APIOptions) error {
 	}

 	if opts.DryRun {
-		if fileMeta != nil {
-			return cmdutil.PrintDryRunWithFile(f.IOStreams.Out, request, config, opts.Format, fileMeta.FieldName, fileMeta.FilePath, fileMeta.FormFields)
-		}
 		return apiDryRun(f, request, config, opts.Format)
 	}
 	// Identity info is now included in the JSON envelope; skip stderr printing.
--- a/cmd/api/api_test.go
+++ b/cmd/api/api_test.go
@@ -5,7 +5,6 @@ package api

 import (
 	"errors"
-	"os"
 	"sort"
 	"strings"
 	"testing"
@@ -200,22 +199,6 @@ func TestApiCmd_PageLimitDefault(t *testing.T) {
 	}
 }

-func TestApiCmd_ParamsAndDataBothStdinConflict(t *testing.T) {
-	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
-	})
-
-	cmd := NewCmdApi(f, nil)
-	cmd.SetArgs([]string{"POST", "/open-apis/test", "--as", "bot", "--params", "-", "--data", "-"})
-	err := cmd.Execute()
-	if err == nil {
-		t.Fatal("expected error when both --params and --data use stdin")
-	}
-	if !strings.Contains(err.Error(), "cannot both read from stdin") {
-		t.Errorf("expected stdin conflict error, got: %v", err)
-	}
-}
-
 func TestApiCmd_OutputAndPageAllConflict(t *testing.T) {
 	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
 		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
@@ -707,98 +690,3 @@ func TestApiCmd_MethodUppercase(t *testing.T) {
 		t.Errorf("expected method POST (uppercased), got %s", gotOpts.Method)
 	}
 }
-
-func TestApiCmd_FileFlagParsing(t *testing.T) {
-	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
-	})
-	var gotOpts *APIOptions
-	cmd := NewCmdApi(f, func(opts *APIOptions) error {
-		gotOpts = opts
-		return nil
-	})
-	cmd.SetArgs([]string{"POST", "/open-apis/test", "--file", "image=photo.jpg", "--data", `{"image_type":"message"}`})
-	err := cmd.Execute()
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if gotOpts.File != "image=photo.jpg" {
-		t.Errorf("expected File = %q, got %q", "image=photo.jpg", gotOpts.File)
-	}
-}
-
-func TestApiCmd_FileAndOutputConflict(t *testing.T) {
-	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
-	})
-	cmd := NewCmdApi(f, func(opts *APIOptions) error {
-		return apiRun(opts)
-	})
-	cmd.SetArgs([]string{"POST", "/open-apis/test", "--as", "bot", "--file", "photo.jpg", "--output", "out.json"})
-	err := cmd.Execute()
-	if err == nil {
-		t.Fatal("expected error for --file with --output")
-	}
-	if !strings.Contains(err.Error(), "mutually exclusive") {
-		t.Errorf("expected mutual exclusion error, got: %v", err)
-	}
-}
-
-func TestApiCmd_FileWithGET(t *testing.T) {
-	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
-	})
-	cmd := NewCmdApi(f, func(opts *APIOptions) error {
-		return apiRun(opts)
-	})
-	cmd.SetArgs([]string{"GET", "/open-apis/test", "--as", "bot", "--file", "photo.jpg"})
-	err := cmd.Execute()
-	if err == nil {
-		t.Fatal("expected error for --file with GET")
-	}
-	if !strings.Contains(err.Error(), "requires POST") {
-		t.Errorf("expected method error, got: %v", err)
-	}
-}
-
-func TestApiCmd_FileStdinConflictWithData(t *testing.T) {
-	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
-	})
-	cmd := NewCmdApi(f, func(opts *APIOptions) error {
-		return apiRun(opts)
-	})
-	cmd.SetArgs([]string{"POST", "/open-apis/test", "--as", "bot", "--file", "-", "--data", "-"})
-	err := cmd.Execute()
-	if err == nil {
-		t.Fatal("expected error for --file stdin with --data stdin")
-	}
-	if !strings.Contains(err.Error(), "cannot both read from stdin") {
-		t.Errorf("expected stdin conflict error, got: %v", err)
-	}
-}
-
-func TestApiCmd_DryRunWithFile(t *testing.T) {
-	tmpDir := t.TempDir()
-	tmpFile := tmpDir + "/test.jpg"
-	if err := os.WriteFile(tmpFile, []byte("fake-image"), 0600); err != nil {
-		t.Fatal(err)
-	}
-
-	f, stdout, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
-		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
-	})
-	cmd := NewCmdApi(f, nil)
-	cmd.SetArgs([]string{"POST", "/open-apis/im/v1/images", "--file", "image=" + tmpFile, "--data", `{"image_type":"message"}`, "--dry-run", "--as", "bot"})
-	err := cmd.Execute()
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	out := stdout.String()
-	if !strings.Contains(out, "image") {
-		t.Errorf("expected dry-run output to mention file field, got: %s", out)
-	}
-	if !strings.Contains(out, "Dry Run") {
-		t.Errorf("expected dry-run header, got: %s", out)
-	}
-}
--- a/cmd/auth/login.go
+++ b/cmd/auth/login.go
@@ -72,7 +72,7 @@ browser. Run it in the background and retrieve the verification URL from its out
 	cmd.Flags().BoolVar(&opts.NoWait, "no-wait", false, "initiate device authorization and return immediately; use --device-code to complete")
 	cmd.Flags().StringVar(&opts.DeviceCode, "device-code", "", "poll and complete authorization with a device code from a previous --no-wait call")

-	cmdutil.RegisterFlagCompletion(cmd, "domain", func(_ *cobra.Command, _ []string, toComplete string) ([]string, cobra.ShellCompDirective) {
+	_ = cmd.RegisterFlagCompletionFunc("domain", func(_ *cobra.Command, _ []string, toComplete string) ([]string, cobra.ShellCompDirective) {
 		return completeDomain(toComplete), cobra.ShellCompDirectiveNoFileComp
 	})

@@ -134,7 +134,18 @@ func authLoginRun(opts *LoginOptions) error {
 	// Expand --domain all to all available domains (from_meta projects + shortcut services)
 	for _, d := range selectedDomains {
 		if strings.EqualFold(d, "all") {
-			selectedDomains = sortedKnownDomains()
+			domainSet := make(map[string]bool)
+			for _, p := range registry.ListFromMetaProjects() {
+				domainSet[p] = true
+			}
+			for _, sc := range shortcuts.AllShortcuts() {
+				domainSet[sc.Service] = true
+			}
+			selectedDomains = make([]string, 0, len(domainSet))
+			for d := range domainSet {
+				selectedDomains = append(selectedDomains, d)
+			}
+			sort.Strings(selectedDomains)
 			break
 		}
 	}
@@ -440,8 +451,6 @@ func findProfileByName(multi *core.MultiAppConfig, profileName string) *core.App

 // collectScopesForDomains collects API scopes (from from_meta projects) and
 // shortcut scopes for the given domain names.
-// Domains with auth_domain children are automatically expanded to include
-// their children's scopes.
 func collectScopesForDomains(domains []string, identity string) []string {
 	scopeSet := make(map[string]bool)

@@ -450,16 +459,11 @@ func collectScopesForDomains(domains []string, identity string) []string {
 		scopeSet[s] = true
 	}

-	// 2. Expand domains: include auth_domain children
+	// 2. Shortcut scopes matching by Service (only include shortcuts supporting the identity)
 	domainSet := make(map[string]bool, len(domains))
 	for _, d := range domains {
 		domainSet[d] = true
-		for _, child := range registry.GetAuthChildren(d) {
-			domainSet[child] = true
-		}
 	}
-
-	// 3. Shortcut scopes matching by Service (only include shortcuts supporting the identity)
 	for _, sc := range shortcuts.AllShortcuts() {
 		if domainSet[sc.Service] && shortcutSupportsIdentity(sc, identity) {
 			for _, s := range sc.ScopesForIdentity(identity) {
@@ -468,7 +472,7 @@ func collectScopesForDomains(domains []string, identity string) []string {
 		}
 	}

-	// 4. Deduplicate and sort
+	// 3. Deduplicate and sort
 	result := make([]string, 0, len(scopeSet))
 	for s := range scopeSet {
 		result = append(result, s)
@@ -477,20 +481,14 @@ func collectScopesForDomains(domains []string, identity string) []string {
 	return result
 }

-// allKnownDomains returns all valid auth domain names (from_meta projects +
-// shortcut services), excluding domains that have auth_domain set (they are
-// folded into their parent domain).
+// allKnownDomains returns all valid domain names (from_meta projects + shortcut services).
 func allKnownDomains() map[string]bool {
 	domains := make(map[string]bool)
 	for _, p := range registry.ListFromMetaProjects() {
-		if !registry.HasAuthDomain(p) {
-			domains[p] = true
-		}
+		domains[p] = true
 	}
 	for _, sc := range shortcuts.AllShortcuts() {
-		if !registry.HasAuthDomain(sc.Service) {
-			domains[sc.Service] = true
-		}
+		domains[sc.Service] = true
 	}
 	return domains
 }
--- a/cmd/auth/login_interactive.go
+++ b/cmd/auth/login_interactive.go
@@ -34,12 +34,8 @@ func getDomainMetadata(lang string) []domainMeta {
 	seen := make(map[string]bool)
 	var domains []domainMeta

-	// 1. Domains from from_meta projects (skip domains with auth_domain)
+	// 1. Domains from from_meta projects
 	for _, project := range registry.ListFromMetaProjects() {
-		if registry.HasAuthDomain(project) {
-			seen[project] = true
-			continue
-		}
 		dm := buildDomainMeta(project, lang)
 		domains = append(domains, dm)
 		seen[project] = true
@@ -56,14 +52,13 @@ func getDomainMetadata(lang string) []domainMeta {
 	}

 	// 3. Auto-discover remaining shortcut services that are listed as shortcut-only domains
-	//    (skip domains with auth_domain — they are folded into their parent)
 	shortcutOnlySet := make(map[string]bool)
 	for _, n := range shortcutOnlyNames {
 		shortcutOnlySet[n] = true
 	}
 	for _, sc := range shortcuts.AllShortcuts() {
 		if !seen[sc.Service] {
-			if shortcutOnlySet[sc.Service] && !registry.HasAuthDomain(sc.Service) {
+			if shortcutOnlySet[sc.Service] {
 				dm := buildDomainMeta(sc.Service, lang)
 				domains = append(domains, dm)
 			}
@@ -184,6 +179,27 @@ func runInteractiveLogin(ios *cmdutil.IOStreams, lang string, msg *loginMsg) (*i
 	}
 	fmt.Fprintf(ios.ErrOut, msg.SummaryScopes, len(scopes), scopePreview)

+	// Phase 2: confirmation
+	var confirmed bool
+	form2 := huh.NewForm(
+		huh.NewGroup(
+			huh.NewConfirm().
+				Title(msg.ConfirmAuth).
+				Value(&confirmed),
+		),
+	).WithTheme(cmdutil.ThemeFeishu())
+
+	if err := form2.Run(); err != nil {
+		if err == huh.ErrUserAborted {
+			return nil, output.ErrBare(1)
+		}
+		return nil, err
+	}
+
+	if !confirmed {
+		return nil, output.ErrBare(1)
+	}
+
 	return &interactiveResult{
 		Domains:    selectedDomains,
 		ScopeLevel: permLevel,
--- a/cmd/auth/login_messages.go
+++ b/cmd/auth/login_messages.go
@@ -24,7 +24,6 @@ type loginMsg struct {
 	WaitingAuth        string
 	AuthSuccess        string
 	LoginSuccess       string
-	AuthorizedUser     string
 	ScopeMismatch      string
 	ScopeHint          string
 	RequestedScopes    string
@@ -59,10 +58,9 @@ var loginMsgZh = &loginMsg{

 	OpenURL:            "在浏览器中打开以下链接进行认证:\n\n",
 	WaitingAuth:        "等待用户授权...",
-	AuthSuccess:        "授权已完成，正在获取用户信息并校验授权结果...",
-	LoginSuccess:       "授权成功! 用户: %s (%s)",
-	AuthorizedUser:     "当前授权账号: %s (%s)",
-	ScopeMismatch:      "授权结果异常：以下请求 scopes 未被授予: %s",
+	AuthSuccess:        "授权成功，正在获取用户信息...",
+	LoginSuccess:       "登录成功! 用户: %s (%s)",
+	ScopeMismatch:      "授权完成，但以下请求 scopes 未被授予: %s",
 	ScopeHint:          "以上结果是本次授权请求用户最终确认后的结果，请勿持续重试；Scopes 未授予的原因是多样的，如 scope 被禁用；具体原因已通过授权页提示用户。可执行 `lark-cli auth status` 查看账号当前已授予的全部 scopes；",
 	RequestedScopes:    "  本次请求 scopes: %s\n",
 	NewlyGrantedScopes: "  本次新授予 scopes: %s\n",
@@ -95,10 +93,9 @@ var loginMsgEn = &loginMsg{

 	OpenURL:            "Open this URL in your browser to authenticate:\n\n",
 	WaitingAuth:        "Waiting for user authorization...",
-	AuthSuccess:        "Authorization completed, fetching user info and validating granted scopes...",
-	LoginSuccess:       "Authorization successful! User: %s (%s)",
-	AuthorizedUser:     "Authorized account: %s (%s)",
-	ScopeMismatch:      "authorization result is abnormal: these requested scopes were not granted: %s",
+	AuthSuccess:        "Authorization successful, fetching user info...",
+	LoginSuccess:       "Login successful! User: %s (%s)",
+	ScopeMismatch:      "authorization completed, but these requested scopes were not granted: %s",
 	ScopeHint:          "The result above is the user's final confirmation for this authorization request. Do not retry continuously. Scopes may be not granted for various reasons, such as a scope being disabled. The specific reason has already been shown to the user on the authorization page. Run `lark-cli auth status` to inspect all scopes currently granted to the account.",
 	RequestedScopes:    "  Requested scopes: %s\n",
 	NewlyGrantedScopes: "  Newly granted scopes: %s\n",
--- a/cmd/auth/login_messages_test.go
+++ b/cmd/auth/login_messages_test.go
@@ -69,12 +69,6 @@ func TestLoginMsg_FormatStrings(t *testing.T) {
 			t.Errorf("%s LoginSuccess has no format verb", lang)
 		}

-		// AuthorizedUser should contain two %s placeholders (userName, openId)
-		got = fmt.Sprintf(msg.AuthorizedUser, "testuser", "ou_123")
-		if got == msg.AuthorizedUser {
-			t.Errorf("%s AuthorizedUser has no format verb", lang)
-		}
-
 		// SummaryDomains should contain %s
 		got = fmt.Sprintf(msg.SummaryDomains, "calendar, task")
 		if got == msg.SummaryDomains {
--- a/cmd/auth/login_result.go
+++ b/cmd/auth/login_result.go
@@ -1,6 +1,3 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
 package auth

 import (
@@ -190,13 +187,13 @@ func handleLoginScopeIssue(opts *LoginOptions, msg *loginMsg, f *cmdutil.Factory

 	fmt.Fprintln(f.IOStreams.ErrOut)
 	if loginSucceeded {
-		fmt.Fprintln(f.IOStreams.ErrOut, issue.Message)
-		if msg.AuthorizedUser != "" {
-			fmt.Fprintf(f.IOStreams.ErrOut, "%s\n", fmt.Sprintf(msg.AuthorizedUser, userName, openId))
-		}
+		output.PrintSuccess(f.IOStreams.ErrOut, fmt.Sprintf(msg.LoginSuccess, userName, openId))
 	} else {
 		fmt.Fprintln(f.IOStreams.ErrOut, issue.Message)
 	}
+	if loginSucceeded {
+		fmt.Fprintln(f.IOStreams.ErrOut, issue.Message)
+	}
 	writeLoginScopeBreakdown(f.IOStreams, msg, issue.Summary)
 	if issue.Hint != "" {
 		fmt.Fprintln(f.IOStreams.ErrOut, issue.Hint)
--- a/cmd/auth/login_scope_cache.go
+++ b/cmd/auth/login_scope_cache.go
@@ -1,6 +1,3 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
 package auth

 import (
--- a/cmd/auth/login_scope_cache_test.go
+++ b/cmd/auth/login_scope_cache_test.go
@@ -1,6 +1,3 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
 package auth

 import (
--- a/cmd/auth/login_strict_test.go
+++ b/cmd/auth/login_strict_test.go
@@ -1,6 +1,3 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
 package auth

 import (
--- a/cmd/auth/login_test.go
+++ b/cmd/auth/login_test.go
@@ -363,7 +363,7 @@ func TestWriteLoginSuccess_JSONIncludesScopeDiff(t *testing.T) {
 func TestHandleLoginScopeIssue_NonJSONAlignsWithLoginSuccess(t *testing.T) {
 	f, _, stderr, _ := cmdutil.TestFactory(t, nil)
 	err := handleLoginScopeIssue(&LoginOptions{}, getLoginMsg("zh"), f, &loginScopeIssue{
-		Message: "授权结果异常：以下请求 scopes 未被授予: im:message:send",
+		Message: "授权完成，但以下请求 scopes 未被授予: im:message:send",
 		Hint:    "以上结果是本次授权请求用户最终确认后的结果，请勿持续重试；Scopes 未授予的原因是多样的，如 scope 被禁用；具体原因已通过授权页提示用户。可执行 `lark-cli auth status` 查看账号当前已授予的全部 scopes；",
 		Summary: &loginScopeSummary{
 			Requested: []string{"im:message:send"},
@@ -376,8 +376,8 @@ func TestHandleLoginScopeIssue_NonJSONAlignsWithLoginSuccess(t *testing.T) {
 	}
 	got := stderr.String()
 	for _, want := range []string{
-		"授权结果异常：以下请求 scopes 未被授予: im:message:send",
-		"当前授权账号: tester (ou_user)",
+		"OK: 登录成功! 用户: tester (ou_user)",
+		"授权完成，但以下请求 scopes 未被授予: im:message:send",
 		"本次请求 scopes: im:message:send",
 		"本次新授予 scopes: （空）",
 		"本次未授予 scopes: im:message:send",
@@ -392,15 +392,15 @@ func TestHandleLoginScopeIssue_NonJSONAlignsWithLoginSuccess(t *testing.T) {
 	if strings.Contains(got, "最终已授权 scopes:") {
 		t.Fatalf("stderr should not contain final granted scopes, got:\n%s", got)
 	}
-	if strings.Contains(got, "授权成功") {
-		t.Fatalf("stderr should not contain success wording, got:\n%s", got)
+	if strings.Contains(got, "ERROR:") {
+		t.Fatalf("stderr should not contain error prefix, got:\n%s", got)
 	}
 }

 func TestHandleLoginScopeIssue_JSONAlignsWithLoginSuccess(t *testing.T) {
 	f, stdout, _, _ := cmdutil.TestFactory(t, nil)
 	err := handleLoginScopeIssue(&LoginOptions{JSON: true}, getLoginMsg("en"), f, &loginScopeIssue{
-		Message: "authorization result is abnormal: these requested scopes were not granted: im:message:send",
+		Message: "authorization completed, but these requested scopes were not granted: im:message:send",
 		Hint:    "Granted scopes: base:app:copy. Check app scopes.",
 		Summary: &loginScopeSummary{
 			Requested: []string{"im:message:send"},
@@ -469,7 +469,7 @@ func TestWriteLoginSuccess_TextOutputScenarios(t *testing.T) {
 				Granted:        []string{"im:message:send", "im:message:reply"},
 			},
 			expectedPresent: []string{
-				"授权成功! 用户: tester (ou_user)",
+				"登录成功! 用户: tester (ou_user)",
 				"本次请求 scopes: im:message:send im:message:reply",
 				"本次新授予 scopes: im:message:send",
 				"本次未授予 scopes: （空）",
@@ -619,8 +619,8 @@ func TestAuthLoginRun_MissingRequestedScopeAlignsWithLoginSuccess(t *testing.T)
 	}
 	got := stderr.String()
 	for _, want := range []string{
-		"授权结果异常：以下请求 scopes 未被授予: im:message:send",
-		"当前授权账号: tester (ou_user)",
+		"OK: 登录成功! 用户: tester (ou_user)",
+		"授权完成，但以下请求 scopes 未被授予: im:message:send",
 		"本次请求 scopes: im:message:send",
 		"本次未授予 scopes: im:message:send",
 		"以上结果是本次授权请求用户最终确认后的结果，请勿持续重试",
@@ -634,9 +634,6 @@ func TestAuthLoginRun_MissingRequestedScopeAlignsWithLoginSuccess(t *testing.T)
 	if strings.Contains(got, "最终已授权 scopes:") {
 		t.Fatalf("stderr should not contain final granted scopes, got:\n%s", got)
 	}
-	if strings.Contains(got, "OK: 授权成功") {
-		t.Fatalf("stderr should not contain success prefix when scopes are missing, got:\n%s", got)
-	}
 	if strings.Contains(got, "ERROR:") {
 		t.Fatalf("stderr should not contain error prefix, got:\n%s", got)
 	}
@@ -746,7 +743,7 @@ func TestAuthLoginRun_DeviceCodeUsesCachedRequestedScopes(t *testing.T) {
 	}
 	got := stderr.String()
 	for _, want := range []string{
-		"OK: 授权成功! 用户: tester (ou_user)",
+		"OK: 登录成功! 用户: tester (ou_user)",
 		"本次请求 scopes: im:message:send",
 		"本次新授予 scopes: im:message:send",
 		"可执行 `lark-cli auth status` 查看账号当前已授予的全部 scopes；",
@@ -774,7 +771,7 @@ func TestWriteLoginSuccess_TextOutputEnglishIncludesStatusHintWhenNoMissingScope

 	got := stderr.String()
 	for _, want := range []string{
-		"Authorization successful! User: tester (ou_user)",
+		"Login successful! User: tester (ou_user)",
 		"Requested scopes: im:message:send",
 		"Newly granted scopes: im:message:send",
 		"Not granted scopes: (none)",
@@ -906,37 +903,3 @@ func TestGetDomainMetadata_ExcludesEvent(t *testing.T) {
 		}
 	}
 }
-
-func TestAllKnownDomains_ExcludesAuthDomainChildren(t *testing.T) {
-	domains := allKnownDomains()
-	if domains["whiteboard"] {
-		t.Error("whiteboard should not appear in known auth domains (it has auth_domain=docs)")
-	}
-	if !domains["docs"] {
-		t.Error("docs should still be a known auth domain")
-	}
-}
-
-func TestCollectScopesForDomains_ExpandsAuthDomainChildren(t *testing.T) {
-	scopes := collectScopesForDomains([]string{"docs"}, "user")
-	// docs domain should include whiteboard shortcut scopes (board:whiteboard:*)
-	found := false
-	for _, s := range scopes {
-		if strings.HasPrefix(s, "board:whiteboard:") {
-			found = true
-			break
-		}
-	}
-	if !found {
-		t.Error("collectScopesForDomains([docs]) should include whiteboard scopes (board:whiteboard:*)")
-	}
-}
-
-func TestGetDomainMetadata_ExcludesAuthDomainChildren(t *testing.T) {
-	domains := getDomainMetadata("zh")
-	for _, dm := range domains {
-		if dm.Name == "whiteboard" {
-			t.Error("whiteboard should not appear in interactive domain list (has auth_domain=docs)")
-		}
-	}
-}
--- a/cmd/build.go
+++ b/cmd/build.go
@@ -1,115 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package cmd
-
-import (
-	"context"
-	"io"
-	"os"
-
-	"golang.org/x/term"
-
-	"github.com/larksuite/cli/cmd/api"
-	"github.com/larksuite/cli/cmd/auth"
-	"github.com/larksuite/cli/cmd/completion"
-	cmdconfig "github.com/larksuite/cli/cmd/config"
-	"github.com/larksuite/cli/cmd/doctor"
-	"github.com/larksuite/cli/cmd/profile"
-	"github.com/larksuite/cli/cmd/schema"
-	"github.com/larksuite/cli/cmd/service"
-	cmdupdate "github.com/larksuite/cli/cmd/update"
-	"github.com/larksuite/cli/internal/build"
-	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/keychain"
-	"github.com/larksuite/cli/shortcuts"
-	"github.com/spf13/cobra"
-)
-
-// BuildOption configures optional aspects of the command tree construction.
-type BuildOption func(*buildConfig)
-
-type buildConfig struct {
-	streams  *cmdutil.IOStreams
-	keychain keychain.KeychainAccess
-}
-
-// WithIO sets the IO streams for the CLI. If not provided, os.Stdin/Stdout/Stderr are used.
-func WithIO(in io.Reader, out, errOut io.Writer) BuildOption {
-	return func(c *buildConfig) {
-		isTerminal := false
-		if f, ok := in.(*os.File); ok {
-			isTerminal = term.IsTerminal(int(f.Fd()))
-		}
-		c.streams = &cmdutil.IOStreams{In: in, Out: out, ErrOut: errOut, IsTerminal: isTerminal}
-	}
-}
-
-// WithKeychain sets the secret storage backend. If not provided, the platform keychain is used.
-func WithKeychain(kc keychain.KeychainAccess) BuildOption {
-	return func(c *buildConfig) {
-		c.keychain = kc
-	}
-}
-
-// Build constructs the full command tree without executing.
-// Returns only the cobra.Command; Factory is internal.
-// Use Execute for the standard production entry point.
-func Build(ctx context.Context, inv cmdutil.InvocationContext, opts ...BuildOption) *cobra.Command {
-	_, rootCmd := buildInternal(ctx, inv, opts...)
-	return rootCmd
-}
-
-// buildInternal is the internal constructor that also returns Factory for error handling.
-func buildInternal(ctx context.Context, inv cmdutil.InvocationContext, opts ...BuildOption) (*cmdutil.Factory, *cobra.Command) {
-	cfg := &buildConfig{
-		streams: cmdutil.SystemIO(),
-	}
-	for _, o := range opts {
-		o(cfg)
-	}
-
-	f := cmdutil.NewDefault(cfg.streams, inv)
-	if cfg.keychain != nil {
-		f.Keychain = cfg.keychain
-	}
-
-	globals := &GlobalOptions{Profile: inv.Profile}
-	rootCmd := &cobra.Command{
-		Use:     "lark-cli",
-		Short:   "Lark/Feishu CLI — OAuth authorization, UAT management, API calls",
-		Long:    rootLong,
-		Version: build.Version,
-	}
-
-	rootCmd.SetContext(ctx)
-	rootCmd.SetIn(cfg.streams.In)
-	rootCmd.SetOut(cfg.streams.Out)
-	rootCmd.SetErr(cfg.streams.ErrOut)
-
-	installTipsHelpFunc(rootCmd)
-	rootCmd.SilenceErrors = true
-
-	RegisterGlobalFlags(rootCmd.PersistentFlags(), globals)
-	rootCmd.PersistentPreRun = func(cmd *cobra.Command, args []string) {
-		cmd.SilenceUsage = true
-	}
-
-	rootCmd.AddCommand(cmdconfig.NewCmdConfig(f))
-	rootCmd.AddCommand(auth.NewCmdAuth(f))
-	rootCmd.AddCommand(profile.NewCmdProfile(f))
-	rootCmd.AddCommand(doctor.NewCmdDoctor(f))
-	rootCmd.AddCommand(api.NewCmdApi(f, nil))
-	rootCmd.AddCommand(schema.NewCmdSchema(f, nil))
-	rootCmd.AddCommand(completion.NewCmdCompletion(f))
-	rootCmd.AddCommand(cmdupdate.NewCmdUpdate(f))
-	service.RegisterServiceCommands(rootCmd, f)
-	shortcuts.RegisterShortcuts(rootCmd, f)
-
-	// Prune commands incompatible with strict mode.
-	if mode := f.ResolveStrictMode(ctx); mode.IsActive() {
-		pruneForStrictMode(rootCmd, mode)
-	}
-
-	return f, rootCmd
-}
--- a/cmd/config/init_interactive.go
+++ b/cmd/config/init_interactive.go
@@ -177,26 +177,17 @@ func runCreateAppFlow(ctx context.Context, f *cmdutil.Factory, brandOverride cor
 	// Step 2: Build and display verification URL + QR code
 	verificationURL := larkauth.BuildVerificationURL(authResp.VerificationUriComplete, build.Version)

-	// Branch on TTY: human-friendly copy in interactive terminals,
-	// preserve original copy for AI / non-interactive callers.
-	if f.IOStreams.IsTerminal {
-		fmt.Fprintf(f.IOStreams.ErrOut, "%s", msg.ScanQRCode)
-		qr, qrErr := qrcode.New(verificationURL, qrcode.Medium)
-		if qrErr == nil {
-			fmt.Fprint(f.IOStreams.ErrOut, qr.ToSmallString(false))
-		}
-		fmt.Fprintf(f.IOStreams.ErrOut, "%s", msg.ScanOrOpenLink)
-		fmt.Fprintf(f.IOStreams.ErrOut, "  %s\n\n", verificationURL)
-		fmt.Fprintf(f.IOStreams.ErrOut, "%s\n", msg.WaitingForScan)
-	} else {
-		qr, qrErr := qrcode.New(verificationURL, qrcode.Medium)
-		if qrErr == nil {
-			fmt.Fprint(f.IOStreams.ErrOut, qr.ToSmallString(false))
-		}
-		fmt.Fprintf(f.IOStreams.ErrOut, "%s", msg.OpenLinkNonTTY)
-		fmt.Fprintf(f.IOStreams.ErrOut, "  %s\n\n", verificationURL)
-		fmt.Fprintf(f.IOStreams.ErrOut, "%s\n", msg.WaitingForScanNonTTY)
+	// Show QR code in terminal
+	qr, qrErr := qrcode.New(verificationURL, qrcode.Medium)
+	if qrErr == nil {
+		fmt.Fprint(f.IOStreams.ErrOut, qr.ToSmallString(false))
 	}
+
+	fmt.Fprintf(f.IOStreams.ErrOut, "%s", msg.ScanOrOpenLink)
+	fmt.Fprintf(f.IOStreams.ErrOut, "  %s\n\n", verificationURL)
+
+	// Step 3: Poll for result
+	fmt.Fprintf(f.IOStreams.ErrOut, "%s\n", msg.WaitingForScan)
 	result, err := larkauth.PollAppRegistration(ctx, httpClient, core.BrandFeishu, authResp.DeviceCode, authResp.Interval, authResp.ExpiresIn, f.IOStreams.ErrOut)
 	if err != nil {
 		return nil, output.ErrAuth("%v", err)
--- a/cmd/config/init_messages.go
+++ b/cmd/config/init_messages.go
@@ -10,56 +10,45 @@ import (
 )

 type initMsg struct {
-	SelectAction      string
-	CreateNewApp      string
-	ConfigExistingApp string
-	Platform          string
-	SelectPlatform    string
-	Feishu            string
-	// TTY (interactive) variants
-	ScanQRCode     string // header shown above QR code
-	ScanOrOpenLink string // post-QR alt link prompt ("or open...")
-	WaitingForScan string // active polling indicator
-	// Non-TTY (AI / non-interactive) variants — preserve original copy
-	OpenLinkNonTTY       string // primary link prompt
-	WaitingForScanNonTTY string // passive waiting indicator
-	DetectedLarkTenant   string
-	AppCreated           string
-	ConfigSaved          string
+	SelectAction       string
+	CreateNewApp       string
+	ConfigExistingApp  string
+	Platform           string
+	SelectPlatform     string
+	Feishu             string
+	ScanOrOpenLink     string
+	WaitingForScan     string
+	DetectedLarkTenant string
+	AppCreated         string
+	ConfigSaved        string
 }

 var initMsgZh = &initMsg{
-	SelectAction:         "选择操作",
-	CreateNewApp:         "一键配置应用 (推荐) ",
-	ConfigExistingApp:    "手动输入应用凭证",
-	Platform:             "平台",
-	SelectPlatform:       "选择平台",
-	Feishu:               "飞书",
-	ScanQRCode:           "\n使用飞书 / Lark 扫码配置应用：\n\n",
-	ScanOrOpenLink:       "\n或打开以下链接完成配置：\n",
-	WaitingForScan:       "正在获取你的应用配置结果...",
-	OpenLinkNonTTY:       "\n打开以下链接配置应用:\n\n",
-	WaitingForScanNonTTY: "等待配置应用...",
-	DetectedLarkTenant:   "[lark-cli] 检测到 Lark 租户，切换端点重试...",
-	AppCreated:           "应用配置成功! App ID: %s",
-	ConfigSaved:          "应用配置成功! App ID: %s",
+	SelectAction:       "选择操作",
+	CreateNewApp:       "一键配置应用 (推荐) ",
+	ConfigExistingApp:  "手动输入应用凭证",
+	Platform:           "平台",
+	SelectPlatform:     "选择平台",
+	Feishu:             "飞书",
+	ScanOrOpenLink:     "\n打开以下链接配置应用:\n\n",
+	WaitingForScan:     "等待配置应用...",
+	DetectedLarkTenant: "[lark-cli] 检测到 Lark 租户，切换端点重试...",
+	AppCreated:         "应用配置成功! App ID: %s",
+	ConfigSaved:        "应用配置成功! App ID: %s",
 }

 var initMsgEn = &initMsg{
-	SelectAction:         "Select action",
-	CreateNewApp:         "Set up your app with one click (Recommended)",
-	ConfigExistingApp:    "Enter app credentials yourself",
-	Platform:             "Platform",
-	SelectPlatform:       "Select platform",
-	Feishu:               "Feishu",
-	ScanQRCode:           "\nScan the QR code with Feishu/Lark:\n\n",
-	ScanOrOpenLink:       "\nOr open the link below in your browser:\n",
-	WaitingForScan:       "Fetching configuration results...",
-	OpenLinkNonTTY:       "\nOpen the link below to configure app:\n\n",
-	WaitingForScanNonTTY: "Waiting for app configuration...",
-	DetectedLarkTenant:   "[lark-cli] Detected Lark tenant, switching endpoint...",
-	AppCreated:           "App configured! App ID: %s",
-	ConfigSaved:          "App configured! App ID: %s",
+	SelectAction:       "Select action",
+	CreateNewApp:       "Set up your app with one click (Recommended)",
+	ConfigExistingApp:  "Enter app credentials yourself",
+	Platform:           "Platform",
+	SelectPlatform:     "Select platform",
+	Feishu:             "Feishu",
+	ScanOrOpenLink:     "\nOpen the link below to configure app:\n\n",
+	WaitingForScan:     "Waiting for app configuration...",
+	DetectedLarkTenant: "[lark-cli] Detected Lark tenant, switching endpoint...",
+	AppCreated:         "App configured! App ID: %s",
+	ConfigSaved:        "App configured! App ID: %s",
 }

 func getInitMsg(lang string) *initMsg {
--- a/cmd/config/init_messages_test.go
+++ b/cmd/config/init_messages_test.go
@@ -48,20 +48,17 @@ func TestInitMsgEn_AllFieldsNonEmpty(t *testing.T) {
 func assertAllFieldsNonEmpty(t *testing.T, msg *initMsg, label string) {
 	t.Helper()
 	fields := map[string]string{
-		"SelectAction":         msg.SelectAction,
-		"CreateNewApp":         msg.CreateNewApp,
-		"ConfigExistingApp":    msg.ConfigExistingApp,
-		"Platform":             msg.Platform,
-		"SelectPlatform":       msg.SelectPlatform,
-		"Feishu":               msg.Feishu,
-		"ScanQRCode":           msg.ScanQRCode,
-		"ScanOrOpenLink":       msg.ScanOrOpenLink,
-		"WaitingForScan":       msg.WaitingForScan,
-		"OpenLinkNonTTY":       msg.OpenLinkNonTTY,
-		"WaitingForScanNonTTY": msg.WaitingForScanNonTTY,
-		"DetectedLarkTenant":   msg.DetectedLarkTenant,
-		"AppCreated":           msg.AppCreated,
-		"ConfigSaved":          msg.ConfigSaved,
+		"SelectAction":       msg.SelectAction,
+		"CreateNewApp":       msg.CreateNewApp,
+		"ConfigExistingApp":  msg.ConfigExistingApp,
+		"Platform":           msg.Platform,
+		"SelectPlatform":     msg.SelectPlatform,
+		"Feishu":             msg.Feishu,
+		"ScanOrOpenLink":     msg.ScanOrOpenLink,
+		"WaitingForScan":     msg.WaitingForScan,
+		"DetectedLarkTenant": msg.DetectedLarkTenant,
+		"AppCreated":         msg.AppCreated,
+		"ConfigSaved":        msg.ConfigSaved,
 	}
 	for name, val := range fields {
 		if val == "" {
--- a/cmd/diagnose_scope_test.go
+++ b/cmd/diagnose_scope_test.go
@@ -1,203 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package cmd
-
-import (
-	"encoding/json"
-	"os"
-	"path/filepath"
-	"sort"
-	"strings"
-	"testing"
-
-	"github.com/larksuite/cli/internal/registry"
-	"github.com/larksuite/cli/shortcuts"
-	shortcutTypes "github.com/larksuite/cli/shortcuts/common"
-)
-
-// ── Data types ────────────────────────────────────────────────────────
-
-type diagMethodEntry struct {
-	Domain   string   `json:"domain"`
-	Type     string   `json:"type"`     // "api" or "shortcut"
-	Method   string   `json:"method"`   // "calendar.calendars.search" or "+agenda"
-	Scope    string   `json:"scope"`    // minimum-privilege scope
-	Identity []string `json:"identity"` // ["user"], ["bot"], or ["user","bot"]
-}
-
-type diagScopeInfo struct {
-	Scope      string `json:"scope"`
-	Recommend  bool   `json:"recommend"`
-	InPriority bool   `json:"in_priority"`
-}
-
-type diagOutput struct {
-	Methods []diagMethodEntry `json:"methods"`
-	Scopes  []diagScopeInfo   `json:"scopes"`
-}
-
-// ── Core logic ────────────────────────────────────────────────────────
-
-// diagAllKnownDomains returns sorted, deduplicated domain names from both
-// from_meta projects and shortcuts.
-func diagAllKnownDomains() []string {
-	seen := make(map[string]bool)
-	for _, p := range registry.ListFromMetaProjects() {
-		seen[p] = true
-	}
-	for _, s := range shortcuts.AllShortcuts() {
-		if s.Service != "" {
-			seen[s.Service] = true
-		}
-	}
-	result := make([]string, 0, len(seen))
-	for d := range seen {
-		result = append(result, d)
-	}
-	sort.Strings(result)
-	return result
-}
-
-// methodKey uniquely identifies a method+scope pair for merging identities.
-type methodKey struct {
-	domain string
-	typ    string
-	method string
-	scope  string
-}
-
-// diagBuild builds the full output: flat methods list (merged identities) + scopes.
-func diagBuild(domains []string) diagOutput {
-	recommend := registry.LoadAutoApproveSet()
-	identities := []string{"user", "bot"}
-
-	merged := make(map[methodKey]*diagMethodEntry)
-	allSC := shortcuts.AllShortcuts()
-
-	for _, domain := range domains {
-		for _, identity := range identities {
-			for _, ce := range registry.CollectCommandScopes([]string{domain}, identity) {
-				for _, scope := range ce.Scopes {
-					method := domain + "." + strings.ReplaceAll(ce.Command, " ", ".")
-					k := methodKey{domain, "api", method, scope}
-					if e, ok := merged[k]; ok {
-						e.Identity = appendUniq(e.Identity, identity)
-					} else {
-						merged[k] = &diagMethodEntry{
-							Domain: domain, Type: "api",
-							Method: method,
-							Scope:  scope, Identity: []string{identity},
-						}
-					}
-				}
-			}
-
-			for _, sc := range allSC {
-				if sc.Service != domain || !diagShortcutSupportsIdentity(&sc, identity) {
-					continue
-				}
-				for _, scope := range sc.ScopesForIdentity(identity) {
-					k := methodKey{domain, "shortcut", sc.Command, scope}
-					if e, ok := merged[k]; ok {
-						e.Identity = appendUniq(e.Identity, identity)
-					} else {
-						merged[k] = &diagMethodEntry{
-							Domain: domain, Type: "shortcut",
-							Method: sc.Command,
-							Scope:  scope, Identity: []string{identity},
-						}
-					}
-				}
-			}
-		}
-	}
-
-	methods := make([]diagMethodEntry, 0, len(merged))
-	scopeSet := make(map[string]bool)
-	for _, e := range merged {
-		methods = append(methods, *e)
-		scopeSet[e.Scope] = true
-	}
-	sort.Slice(methods, func(i, j int) bool {
-		if methods[i].Domain != methods[j].Domain {
-			return methods[i].Domain < methods[j].Domain
-		}
-		if methods[i].Type != methods[j].Type {
-			return methods[i].Type < methods[j].Type
-		}
-		if methods[i].Method != methods[j].Method {
-			return methods[i].Method < methods[j].Method
-		}
-		return methods[i].Scope < methods[j].Scope
-	})
-
-	scopeList := make([]string, 0, len(scopeSet))
-	for s := range scopeSet {
-		scopeList = append(scopeList, s)
-	}
-	sort.Strings(scopeList)
-
-	priorities := registry.LoadScopePriorities()
-	scopes := make([]diagScopeInfo, len(scopeList))
-	for i, s := range scopeList {
-		_, inPri := priorities[s]
-		scopes[i] = diagScopeInfo{Scope: s, Recommend: recommend[s], InPriority: inPri}
-	}
-
-	return diagOutput{Methods: methods, Scopes: scopes}
-}
-
-func diagShortcutSupportsIdentity(sc *shortcutTypes.Shortcut, identity string) bool {
-	if len(sc.AuthTypes) == 0 {
-		return identity == "user"
-	}
-	for _, a := range sc.AuthTypes {
-		if a == identity {
-			return true
-		}
-	}
-	return false
-}
-
-func appendUniq(ss []string, s string) []string {
-	for _, existing := range ss {
-		if existing == s {
-			return ss
-		}
-	}
-	return append(ss, s)
-}
-
-// ── Snapshot generation ───────────────────────────────────────────────
-//
-// Generates a JSON snapshot of all API methods and shortcuts with their
-// minimum-privilege scopes. Consumed by scripts/scope_audit.py.
-//
-// Usage:
-//
-//	SCOPE_SNAPSHOT_DIR=/tmp/scope-audit go test ./cmd/ -run TestScopeSnapshot -v
-func TestScopeSnapshot(t *testing.T) {
-	dir := os.Getenv("SCOPE_SNAPSHOT_DIR")
-	if dir == "" {
-		t.Skip("set SCOPE_SNAPSHOT_DIR to enable snapshot generation")
-	}
-
-	registry.Init()
-	result := diagBuild(diagAllKnownDomains())
-
-	if err := os.MkdirAll(dir, 0o755); err != nil {
-		t.Fatalf("mkdir: %v", err)
-	}
-	path := filepath.Join(dir, "snapshot.json")
-
-	data, err := json.MarshalIndent(result, "", "  ")
-	if err != nil {
-		t.Fatalf("marshal: %v", err)
-	}
-	if err := os.WriteFile(path, data, 0o644); err != nil {
-		t.Fatalf("write: %v", err)
-	}
-
-	t.Logf("Wrote %s (%d methods, %d scopes)", path, len(result.Methods), len(result.Scopes))
-}
--- a/cmd/doctor/doctor.go
+++ b/cmd/doctor/doctor.go
@@ -238,7 +238,7 @@ func checkCLIUpdate() []checkResult {
 	if update.IsNewer(latest, current) {
 		return []checkResult{warn("cli_update",
 			fmt.Sprintf("%s → %s available", current, latest),
-			"run: lark-cli update (or: npm install -g @larksuite/cli)")}
+			"run: npm update -g @larksuite/cli")}
 	}
 	return []checkResult{pass("cli_update", latest+" (up to date)")}
 }
--- a/cmd/init.go
+++ b/cmd/init.go
@@ -1,18 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package cmd
-
-import "github.com/larksuite/cli/internal/vfs"
-
-// SetDefaultFS replaces the global filesystem implementation used by internal
-// packages. The provided fs must implement the vfs.FS interface. If fs is nil,
-// the default OS filesystem is restored.
-//
-// Call this before Build or Execute to take effect.
-func SetDefaultFS(fs vfs.FS) {
-	if fs == nil {
-		fs = vfs.OsFs{}
-	}
-	vfs.DefaultFS = fs
-}
--- a/cmd/root.go
+++ b/cmd/root.go
@@ -14,6 +14,14 @@ import (
 	"os"
 	"strconv"

+	"github.com/larksuite/cli/cmd/api"
+	"github.com/larksuite/cli/cmd/auth"
+	"github.com/larksuite/cli/cmd/completion"
+	cmdconfig "github.com/larksuite/cli/cmd/config"
+	"github.com/larksuite/cli/cmd/doctor"
+	"github.com/larksuite/cli/cmd/profile"
+	"github.com/larksuite/cli/cmd/schema"
+	"github.com/larksuite/cli/cmd/service"
 	internalauth "github.com/larksuite/cli/internal/auth"
 	"github.com/larksuite/cli/internal/build"
 	"github.com/larksuite/cli/internal/cmdutil"
@@ -21,6 +29,7 @@ import (
 	"github.com/larksuite/cli/internal/output"
 	"github.com/larksuite/cli/internal/registry"
 	"github.com/larksuite/cli/internal/update"
+	"github.com/larksuite/cli/shortcuts"
 	"github.com/spf13/cobra"
 )

@@ -85,9 +94,37 @@ func Execute() int {
 		fmt.Fprintln(os.Stderr, "Error:", err)
 		return 1
 	}
-	configureFlagCompletions(os.Args)
+	f := cmdutil.NewDefault(inv)

-	f, rootCmd := buildInternal(context.Background(), inv)
+	globals := &GlobalOptions{Profile: inv.Profile}
+	rootCmd := &cobra.Command{
+		Use:     "lark-cli",
+		Short:   "Lark/Feishu CLI — OAuth authorization, UAT management, API calls",
+		Long:    rootLong,
+		Version: build.Version,
+	}
+	installTipsHelpFunc(rootCmd)
+	rootCmd.SilenceErrors = true
+
+	RegisterGlobalFlags(rootCmd.PersistentFlags(), globals)
+	rootCmd.PersistentPreRun = func(cmd *cobra.Command, args []string) {
+		cmd.SilenceUsage = true
+	}
+
+	rootCmd.AddCommand(cmdconfig.NewCmdConfig(f))
+	rootCmd.AddCommand(auth.NewCmdAuth(f))
+	rootCmd.AddCommand(profile.NewCmdProfile(f))
+	rootCmd.AddCommand(doctor.NewCmdDoctor(f))
+	rootCmd.AddCommand(api.NewCmdApi(f, nil))
+	rootCmd.AddCommand(schema.NewCmdSchema(f, nil))
+	rootCmd.AddCommand(completion.NewCmdCompletion(f))
+	service.RegisterServiceCommands(rootCmd, f)
+	shortcuts.RegisterShortcuts(rootCmd, f)
+
+	// Prune commands incompatible with strict mode.
+	if mode := f.ResolveStrictMode(context.Background()); mode.IsActive() {
+		pruneForStrictMode(rootCmd, mode)
+	}

 	// --- Update check (non-blocking) ---
 	if !isCompletionCommand(os.Args) {
@@ -151,12 +188,6 @@ func isCompletionCommand(args []string) bool {
 	return false
 }

-// configureFlagCompletions enables cmdutil.RegisterFlagCompletion only when
-// the invocation will actually serve a __complete request.
-func configureFlagCompletions(args []string) {
-	cmdutil.SetFlagCompletionsDisabled(!isCompletionCommand(args))
-}
-
 // handleRootError dispatches a command error to the appropriate handler
 // and returns the process exit code.
 func handleRootError(f *cmdutil.Factory, err error) int {
--- a/cmd/root_integration_test.go
+++ b/cmd/root_integration_test.go
@@ -135,7 +135,7 @@ func newStrictModeDefaultFactory(t *testing.T, profile string, mode core.StrictM
 		t.Fatalf("SaveMultiAppConfig() error = %v", err)
 	}

-	f := cmdutil.NewDefault(nil, cmdutil.InvocationContext{Profile: profile})
+	f := cmdutil.NewDefault(cmdutil.InvocationContext{Profile: profile})
 	stdout := &bytes.Buffer{}
 	stderr := &bytes.Buffer{}
 	f.IOStreams = &cmdutil.IOStreams{In: nil, Out: stdout, ErrOut: stderr}
--- a/cmd/root_test.go
+++ b/cmd/root_test.go
@@ -196,28 +196,3 @@ func TestRootLong_AgentSkillsLinkTargetsReadmeSection(t *testing.T) {
 		t.Fatalf("root help should not reference the removed install-ai-agent-skills anchor, got:\n%s", rootLong)
 	}
 }
-
-func TestConfigureFlagCompletions(t *testing.T) {
-	t.Cleanup(func() { cmdutil.SetFlagCompletionsDisabled(false) })
-
-	tests := []struct {
-		name         string
-		args         []string
-		wantDisabled bool
-	}{
-		{"plain command", []string{"im", "+send"}, true},
-		{"help flag", []string{"im", "--help"}, true},
-		{"no args", []string{}, true},
-		{"__complete request", []string{"__complete", "im", "+send", ""}, false},
-		{"completion subcommand", []string{"completion", "bash"}, false},
-	}
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			cmdutil.SetFlagCompletionsDisabled(!tc.wantDisabled)
-			configureFlagCompletions(tc.args)
-			if got := cmdutil.FlagCompletionsDisabled(); got != tc.wantDisabled {
-				t.Fatalf("FlagCompletionsDisabled() = %v, want %v", got, tc.wantDisabled)
-			}
-		})
-	}
-}
--- a/cmd/schema/schema.go
+++ b/cmd/schema/schema.go
@@ -4,14 +4,12 @@
 package schema

 import (
-	"context"
 	"fmt"
 	"io"
 	"sort"
 	"strings"

 	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/output"
 	"github.com/larksuite/cli/internal/registry"
 	"github.com/larksuite/cli/internal/util"
@@ -21,7 +19,6 @@ import (
 // SchemaOptions holds all inputs for the schema command.
 type SchemaOptions struct {
 	Factory *cmdutil.Factory
-	Ctx     context.Context

 	// Positional args
 	Path string
@@ -44,7 +41,7 @@ func printServices(w io.Writer) {
 	fmt.Fprintf(w, "\n%sUsage: lark-cli schema <service>.<resource>.<method>%s\n", output.Dim, output.Reset)
 }

-func printResourceList(w io.Writer, spec map[string]interface{}, mode core.StrictMode) {
+func printResourceList(w io.Writer, spec map[string]interface{}) {
 	name := registry.GetStrFromMap(spec, "name")
 	version := registry.GetStrFromMap(spec, "version")
 	title := registry.GetStrFromMap(spec, "title")
@@ -58,13 +55,9 @@ func printResourceList(w io.Writer, spec map[string]interface{}, mode core.Stric

 	resources, _ := spec["resources"].(map[string]interface{})
 	for _, resName := range sortedKeys(resources) {
+		fmt.Fprintf(w, "  %s%s%s\n", output.Cyan, resName, output.Reset)
 		resMap, _ := resources[resName].(map[string]interface{})
 		methods, _ := resMap["methods"].(map[string]interface{})
-		methods = filterMethodsByStrictMode(methods, mode)
-		if len(methods) == 0 {
-			continue
-		}
-		fmt.Fprintf(w, "  %s%s%s\n", output.Cyan, resName, output.Reset)
 		for _, methodName := range sortedKeys(methods) {
 			m, _ := methods[methodName].(map[string]interface{})
 			httpMethod := registry.GetStrFromMap(m, "httpMethod")
@@ -80,12 +73,6 @@ func printResourceList(w io.Writer, spec map[string]interface{}, mode core.Stric
 	fmt.Fprintf(w, "%sUsage: lark-cli schema %s.<resource>.<method>%s\n", output.Dim, name, output.Reset)
 }

-// hasFileFields returns true if any requestBody field has type "file".
-func hasFileFields(method map[string]interface{}) (bool, []string) {
-	names := cmdutil.DetectFileFields(method)
-	return len(names) > 0, names
-}
-
 func printMethodDetail(w io.Writer, spec map[string]interface{}, resName, methodName string, method map[string]interface{}) {
 	servicePath := registry.GetStrFromMap(spec, "servicePath")
 	specName := registry.GetStrFromMap(spec, "name")
@@ -93,7 +80,6 @@ func printMethodDetail(w io.Writer, spec map[string]interface{}, resName, method
 	fullPath := servicePath + "/" + methodPath
 	httpMethod := registry.GetStrFromMap(method, "httpMethod")
 	desc := registry.GetStrFromMap(method, "description")
-	isFileUpload, fileFieldNames := hasFileFields(method)

 	fmt.Fprintf(w, "%s%s.%s.%s%s\n\n", output.Bold, specName, resName, methodName, output.Reset)

@@ -152,25 +138,11 @@ func printMethodDetail(w io.Writer, spec map[string]interface{}, resName, method
 		if len(params) == 0 {
 			fmt.Fprintf(w, "%sParameters:%s\n\n", output.Bold, output.Reset)
 		}
-		fileUploadTag := ""
-		if isFileUpload {
-			fileUploadTag = fmt.Sprintf("  %s[file upload]%s", output.Yellow, output.Reset)
-		}
-		fmt.Fprintf(w, "  %s--data%s  <json>  %soptional%s%s\n", output.Cyan, output.Reset, output.Dim, output.Reset, fileUploadTag)
+		fmt.Fprintf(w, "  %s--data%s  <json>  %soptional%s\n", output.Cyan, output.Reset, output.Dim, output.Reset)
 		requestBody, _ := method["requestBody"].(map[string]interface{})
 		if len(requestBody) > 0 {
 			printNestedFields(w, requestBody, "      ", "")
 		}
-
-		if isFileUpload {
-			if len(fileFieldNames) == 1 {
-				fmt.Fprintf(w, "\n  %s--file%s  <[field=]path>  %sfile upload%s\n", output.Cyan, output.Reset, output.Dim, output.Reset)
-				fmt.Fprintf(w, "      Upload file as multipart/form-data. Default field: %q\n", fileFieldNames[0])
-			} else {
-				fmt.Fprintf(w, "\n  %s--file%s  <field=path>  %sfile upload%s\n", output.Cyan, output.Reset, output.Dim, output.Reset)
-				fmt.Fprintf(w, "      Upload file as multipart/form-data. Fields: %s\n", strings.Join(fileFieldNames, ", "))
-			}
-		}
 		fmt.Fprintln(w)
 	}

@@ -212,13 +184,7 @@ func printMethodDetail(w io.Writer, spec map[string]interface{}, resName, method
 	}

 	// CLI example
-	if isFileUpload && len(fileFieldNames) == 1 {
-		fmt.Fprintf(w, "%sCLI:%s      lark-cli %s %s %s --file <path>\n", output.Bold, output.Reset, specName, resName, methodName)
-	} else if isFileUpload {
-		fmt.Fprintf(w, "%sCLI:%s      lark-cli %s %s %s --file <field=path>\n", output.Bold, output.Reset, specName, resName, methodName)
-	} else {
-		fmt.Fprintf(w, "%sCLI:%s      lark-cli %s %s %s\n", output.Bold, output.Reset, specName, resName, methodName)
-	}
+	fmt.Fprintf(w, "%sCLI:%s      lark-cli %s %s %s\n", output.Bold, output.Reset, specName, resName, methodName)

 	// Docs
 	if docUrl := registry.GetStrFromMap(method, "docUrl"); docUrl != "" {
@@ -366,7 +332,6 @@ func NewCmdSchema(f *cmdutil.Factory, runF func(*SchemaOptions) error) *cobra.Co
 			if len(args) > 0 {
 				opts.Path = args[0]
 			}
-			opts.Ctx = cmd.Context()
 			if runF != nil {
 				return runF(opts)
 			}
@@ -377,7 +342,7 @@ func NewCmdSchema(f *cmdutil.Factory, runF func(*SchemaOptions) error) *cobra.Co

 	cmd.ValidArgsFunction = completeSchemaPath
 	cmd.Flags().StringVar(&opts.Format, "format", "json", "output format: json (default) | pretty")
-	cmdutil.RegisterFlagCompletion(cmd, "format", func(_ *cobra.Command, _ []string, _ string) ([]string, cobra.ShellCompDirective) {
+	_ = cmd.RegisterFlagCompletionFunc("format", func(_ *cobra.Command, _ []string, _ string) ([]string, cobra.ShellCompDirective) {
 		return []string{"json", "pretty"}, cobra.ShellCompDirectiveNoFileComp
 	})

@@ -459,7 +424,6 @@ func completeSchemaPath(_ *cobra.Command, args []string, toComplete string) ([]s

 func schemaRun(opts *SchemaOptions) error {
 	out := opts.Factory.IOStreams.Out
-	mode := opts.Factory.ResolveStrictMode(opts.Ctx)

 	if opts.Path == "" {
 		printServices(out)
@@ -478,9 +442,9 @@ func schemaRun(opts *SchemaOptions) error {

 	if len(parts) == 1 {
 		if opts.Format == "pretty" {
-			printResourceList(out, spec, mode)
+			printResourceList(out, spec)
 		} else {
-			output.PrintJson(out, filterSpecByStrictMode(spec, mode))
+			output.PrintJson(out, spec)
 		}
 		return nil
 	}
@@ -501,7 +465,6 @@ func schemaRun(opts *SchemaOptions) error {
 		if opts.Format == "pretty" {
 			fmt.Fprintf(out, "%s%s.%s%s\n\n", output.Bold, serviceName, resName, output.Reset)
 			methods, _ := resource["methods"].(map[string]interface{})
-			methods = filterMethodsByStrictMode(methods, mode)
 			for _, mName := range sortedKeys(methods) {
 				m, _ := methods[mName].(map[string]interface{})
 				httpMethod := registry.GetStrFromMap(m, "httpMethod")
@@ -510,26 +473,13 @@ func schemaRun(opts *SchemaOptions) error {
 			}
 			fmt.Fprintf(out, "\n%sUsage: lark-cli schema %s.%s.<method>%s\n", output.Dim, serviceName, resName, output.Reset)
 		} else {
-			// For JSON output, filter methods in a copy to avoid mutating the registry.
-			if mode.IsActive() {
-				filtered := make(map[string]interface{})
-				for k, v := range resource {
-					filtered[k] = v
-				}
-				if methods, ok := resource["methods"].(map[string]interface{}); ok {
-					filtered["methods"] = filterMethodsByStrictMode(methods, mode)
-				}
-				output.PrintJson(out, filtered)
-			} else {
-				output.PrintJson(out, resource)
-			}
+			output.PrintJson(out, resource)
 		}
 		return nil
 	}

 	methodName := remaining[0]
 	methods, _ := resource["methods"].(map[string]interface{})
-	methods = filterMethodsByStrictMode(methods, mode)
 	method, ok := methods[methodName].(map[string]interface{})
 	if !ok {
 		var mNames []string
@@ -548,67 +498,3 @@ func schemaRun(opts *SchemaOptions) error {
 	}
 	return nil
 }
-
-// filterSpecByStrictMode returns a shallow copy of spec with each resource's methods
-// filtered by strict mode. Returns the original spec when strict mode is off.
-func filterSpecByStrictMode(spec map[string]interface{}, mode core.StrictMode) map[string]interface{} {
-	if !mode.IsActive() {
-		return spec
-	}
-	result := make(map[string]interface{}, len(spec))
-	for k, v := range spec {
-		result[k] = v
-	}
-	resources, _ := spec["resources"].(map[string]interface{})
-	if resources == nil {
-		return result
-	}
-	filteredRes := make(map[string]interface{}, len(resources))
-	for resName, resVal := range resources {
-		resMap, ok := resVal.(map[string]interface{})
-		if !ok {
-			continue
-		}
-		methods, _ := resMap["methods"].(map[string]interface{})
-		filtered := filterMethodsByStrictMode(methods, mode)
-		if len(filtered) == 0 {
-			continue
-		}
-		resCopy := make(map[string]interface{}, len(resMap))
-		for k, v := range resMap {
-			resCopy[k] = v
-		}
-		resCopy["methods"] = filtered
-		filteredRes[resName] = resCopy
-	}
-	result["resources"] = filteredRes
-	return result
-}
-
-// filterMethodsByStrictMode removes methods incompatible with the active strict mode.
-// Returns the original map unmodified when strict mode is off.
-func filterMethodsByStrictMode(methods map[string]interface{}, mode core.StrictMode) map[string]interface{} {
-	if !mode.IsActive() || methods == nil {
-		return methods
-	}
-	token := registry.IdentityToAccessToken(string(mode.ForcedIdentity()))
-	filtered := make(map[string]interface{}, len(methods))
-	for name, val := range methods {
-		m, ok := val.(map[string]interface{})
-		if !ok {
-			continue
-		}
-		tokens, _ := m["accessTokens"].([]interface{})
-		if tokens == nil {
-			filtered[name] = val
-			continue
-		}
-		for _, t := range tokens {
-			if ts, ok := t.(string); ok && ts == token {
-				filtered[name] = val
-				break
-			}
-		}
-	}
-	return filtered
-}
--- a/cmd/schema/schema_test.go
+++ b/cmd/schema/schema_test.go
@@ -4,7 +4,6 @@
 package schema

 import (
-	"bytes"
 	"strings"
 	"testing"

@@ -62,123 +61,3 @@ func TestSchemaCmd_UnknownService(t *testing.T) {
 		t.Errorf("expected 'Unknown service' error, got: %v", err)
 	}
 }
-
-func TestPrintMethodDetail_FileUpload(t *testing.T) {
-	spec := map[string]interface{}{
-		"name":        "im",
-		"servicePath": "/open-apis/im/v1",
-	}
-	method := map[string]interface{}{
-		"path":        "images",
-		"httpMethod":  "POST",
-		"description": "Upload an image",
-		"requestBody": map[string]interface{}{
-			"image_type": map[string]interface{}{
-				"type":     "string",
-				"required": true,
-			},
-			"image": map[string]interface{}{
-				"type":     "file",
-				"required": true,
-			},
-		},
-		"accessTokens": []interface{}{"user", "tenant"},
-	}
-
-	var buf bytes.Buffer
-	printMethodDetail(&buf, spec, "images", "create", method)
-	out := buf.String()
-
-	if !strings.Contains(out, "file upload") {
-		t.Errorf("expected 'file upload' marker in output, got:\n%s", out)
-	}
-	if !strings.Contains(out, "--file") {
-		t.Errorf("expected '--file' in output, got:\n%s", out)
-	}
-	if !strings.Contains(out, `"image"`) {
-		t.Errorf("expected default field name 'image' in output, got:\n%s", out)
-	}
-	if !strings.Contains(out, "--file <path>") {
-		t.Errorf("expected CLI example with --file <path>, got:\n%s", out)
-	}
-}
-
-func TestPrintMethodDetail_NoFileUpload(t *testing.T) {
-	spec := map[string]interface{}{
-		"name":        "calendar",
-		"servicePath": "/open-apis/calendar/v4",
-	}
-	method := map[string]interface{}{
-		"path":        "events",
-		"httpMethod":  "POST",
-		"description": "Create an event",
-		"requestBody": map[string]interface{}{
-			"summary": map[string]interface{}{
-				"type":     "string",
-				"required": true,
-			},
-		},
-	}
-
-	var buf bytes.Buffer
-	printMethodDetail(&buf, spec, "events", "create", method)
-	out := buf.String()
-
-	if strings.Contains(out, "file upload") {
-		t.Errorf("did not expect 'file upload' marker for non-file method, got:\n%s", out)
-	}
-	if strings.Contains(out, "--file") {
-		t.Errorf("did not expect '--file' for non-file method, got:\n%s", out)
-	}
-}
-
-func TestHasFileFields(t *testing.T) {
-	tests := []struct {
-		name       string
-		method     map[string]interface{}
-		wantBool   bool
-		wantFields []string
-	}{
-		{
-			name: "has file field",
-			method: map[string]interface{}{
-				"requestBody": map[string]interface{}{
-					"image": map[string]interface{}{"type": "file"},
-					"name":  map[string]interface{}{"type": "string"},
-				},
-			},
-			wantBool:   true,
-			wantFields: []string{"image"},
-		},
-		{
-			name: "no file field",
-			method: map[string]interface{}{
-				"requestBody": map[string]interface{}{
-					"name": map[string]interface{}{"type": "string"},
-				},
-			},
-			wantBool:   false,
-			wantFields: nil,
-		},
-		{
-			name:       "no requestBody",
-			method:     map[string]interface{}{},
-			wantBool:   false,
-			wantFields: nil,
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			got, names := hasFileFields(tt.method)
-			if got != tt.wantBool {
-				t.Errorf("hasFileFields() = %v, want %v", got, tt.wantBool)
-			}
-			if tt.wantFields == nil && names != nil {
-				t.Errorf("expected nil names, got %v", names)
-			}
-			if tt.wantFields != nil && len(names) != len(tt.wantFields) {
-				t.Errorf("expected %d field names, got %d", len(tt.wantFields), len(names))
-			}
-		})
-	}
-}
--- a/cmd/service/service.go
+++ b/cmd/service/service.go
@@ -5,6 +5,7 @@ package service

 import (
 	"context"
+	"encoding/json"
 	"fmt"
 	"io"
 	"strings"
@@ -101,23 +102,16 @@ type ServiceMethodOptions struct {
 	SchemaPath string

 	// Flags
-	Params     string
-	Data       string
-	As         core.Identity
-	Output     string
-	PageAll    bool
-	PageLimit  int
-	PageDelay  int
-	Format     string
-	JqExpr     string
-	DryRun     bool
-	File       string   // --file flag value
-	FileFields []string // auto-detected file field names from metadata
-}
-
-// detectFileFields delegates to the shared cmdutil.DetectFileFields helper.
-func detectFileFields(method map[string]interface{}) []string {
-	return cmdutil.DetectFileFields(method)
+	Params    string
+	Data      string
+	As        core.Identity
+	Output    string
+	PageAll   bool
+	PageLimit int
+	PageDelay int
+	Format    string
+	JqExpr    string
+	DryRun    bool
 }

 func registerMethod(parent *cobra.Command, spec map[string]interface{}, method map[string]interface{}, name string, resName string, f *cmdutil.Factory) {
@@ -154,10 +148,10 @@ func NewCmdServiceMethod(f *cmdutil.Factory, spec, method map[string]interface{}
 		},
 	}

-	cmd.Flags().StringVar(&opts.Params, "params", "", "URL/query parameters JSON (supports - for stdin)")
+	cmd.Flags().StringVar(&opts.Params, "params", "", "URL/query parameters JSON")
 	switch httpMethod {
 	case "POST", "PUT", "PATCH", "DELETE":
-		cmd.Flags().StringVar(&opts.Data, "data", "", "request body JSON (supports - for stdin)")
+		cmd.Flags().StringVar(&opts.Data, "data", "", "request body JSON")
 	}
 	cmd.Flags().StringVar(&asStr, "as", "auto", "identity type: user | bot | auto (default)")
 	cmd.Flags().StringVarP(&opts.Output, "output", "o", "", "output file path for binary responses")
@@ -168,19 +162,10 @@ func NewCmdServiceMethod(f *cmdutil.Factory, spec, method map[string]interface{}
 	cmd.Flags().StringVarP(&opts.JqExpr, "jq", "q", "", "jq expression to filter JSON output")
 	cmd.Flags().BoolVar(&opts.DryRun, "dry-run", false, "print request without executing")

-	// Conditionally register --file for methods with file-type fields.
-	fileFields := detectFileFields(method)
-	opts.FileFields = fileFields
-	if len(fileFields) > 0 {
-		switch httpMethod {
-		case "POST", "PUT", "PATCH", "DELETE":
-			cmd.Flags().StringVar(&opts.File, "file", "", "file to upload ([field=]path, supports - for stdin)")
-		}
-	}
-	cmdutil.RegisterFlagCompletion(cmd, "as", func(_ *cobra.Command, _ []string, _ string) ([]string, cobra.ShellCompDirective) {
+	_ = cmd.RegisterFlagCompletionFunc("as", func(_ *cobra.Command, _ []string, _ string) ([]string, cobra.ShellCompDirective) {
 		return []string{"user", "bot"}, cobra.ShellCompDirectiveNoFileComp
 	})
-	cmdutil.RegisterFlagCompletion(cmd, "format", func(_ *cobra.Command, _ []string, _ string) ([]string, cobra.ShellCompDirective) {
+	_ = cmd.RegisterFlagCompletionFunc("format", func(_ *cobra.Command, _ []string, _ string) ([]string, cobra.ShellCompDirective) {
 		return []string{"json", "ndjson", "table", "csv"}, cobra.ShellCompDirectiveNoFileComp
 	})

@@ -228,15 +213,12 @@ func serviceMethodRun(opts *ServiceMethodOptions) error {
 		}
 	}

-	request, fileMeta, err := buildServiceRequest(opts)
+	request, err := buildServiceRequest(opts)
 	if err != nil {
 		return err
 	}

 	if opts.DryRun {
-		if fileMeta != nil {
-			return cmdutil.PrintDryRunWithFile(f.IOStreams.Out, request, config, opts.Format, fileMeta.FieldName, fileMeta.FilePath, fileMeta.FormFields)
-		}
 		return serviceDryRun(f, request, config, opts.Format)
 	}

@@ -322,28 +304,19 @@ func checkServiceScopes(ctx context.Context, cred *credential.CredentialProvider
 }

 // buildServiceRequest parses flags, builds the URL with path/query params, and returns a RawApiRequest.
-// When dryRun is true and a file is provided, file reading is skipped and
-// FileUploadMeta is returned instead so the caller can render dry-run output.
-func buildServiceRequest(opts *ServiceMethodOptions) (client.RawApiRequest, *cmdutil.FileUploadMeta, error) {
+func buildServiceRequest(opts *ServiceMethodOptions) (client.RawApiRequest, error) {
 	spec := opts.Spec
 	method := opts.Method
 	schemaPath := opts.SchemaPath
 	httpMethod := registry.GetStrFromMap(method, "httpMethod")

-	// stdin is an io.Reader consumed at most once. Only one of --params/--data
-	// may use "-" (stdin); the conflict check below prevents silent data loss.
-	stdin := opts.Factory.IOStreams.In
-
-	// Validate --file mutual exclusions.
-	if err := cmdutil.ValidateFileFlag(opts.File, opts.Params, opts.Data, opts.Output, opts.PageAll, httpMethod); err != nil {
-		return client.RawApiRequest{}, nil, err
-	}
-	if opts.Params == "-" && opts.Data == "-" {
-		return client.RawApiRequest{}, nil, output.ErrValidation("--params and --data cannot both read from stdin (-)")
-	}
-	params, err := cmdutil.ParseJSONMap(opts.Params, "--params", stdin)
-	if err != nil {
-		return client.RawApiRequest{}, nil, err
+	var params map[string]interface{}
+	if opts.Params != "" {
+		if err := json.Unmarshal([]byte(opts.Params), &params); err != nil {
+			return client.RawApiRequest{}, output.ErrValidation("--params invalid JSON format")
+		}
+	} else {
+		params = map[string]interface{}{}
 	}

 	url := registry.GetStrFromMap(spec, "servicePath") + "/" + registry.GetStrFromMap(method, "path")
@@ -356,13 +329,13 @@ func buildServiceRequest(opts *ServiceMethodOptions) (client.RawApiRequest, *cmd
 		}
 		val, ok := params[name]
 		if !ok || util.IsEmptyValue(val) {
-			return client.RawApiRequest{}, nil, output.ErrWithHint(output.ExitValidation, "validation",
+			return client.RawApiRequest{}, output.ErrWithHint(output.ExitValidation, "validation",
 				fmt.Sprintf("missing required path parameter: %s", name),
 				fmt.Sprintf("lark-cli schema %s", schemaPath))
 		}
 		valStr := fmt.Sprintf("%v", val)
 		if err := validate.ResourceName(valStr, name); err != nil {
-			return client.RawApiRequest{}, nil, output.ErrValidation("%s", err)
+			return client.RawApiRequest{}, output.ErrValidation("%s", err)
 		}
 		url = strings.Replace(url, "{"+name+"}", validate.EncodePathSegment(valStr), 1)
 		delete(params, name)
@@ -378,7 +351,7 @@ func buildServiceRequest(opts *ServiceMethodOptions) (client.RawApiRequest, *cmd
 		required, _ := p["required"].(bool)
 		isPaginationParam := opts.PageAll && (name == "page_token" || name == "page_size")
 		if required && !isPaginationParam && (!exists || util.IsEmptyValue(value)) {
-			return client.RawApiRequest{}, nil, output.ErrWithHint(output.ExitValidation, "validation",
+			return client.RawApiRequest{}, output.ErrWithHint(output.ExitValidation, "validation",
 				fmt.Sprintf("missing required query parameter: %s", name),
 				fmt.Sprintf("lark-cli schema %s", schemaPath))
 		}
@@ -392,60 +365,22 @@ func buildServiceRequest(opts *ServiceMethodOptions) (client.RawApiRequest, *cmd
 		}
 	}

+	data, err := cmdutil.ParseOptionalBody(httpMethod, opts.Data)
+	if err != nil {
+		return client.RawApiRequest{}, err
+	}
+
 	request := client.RawApiRequest{
 		Method: httpMethod,
 		URL:    url,
 		Params: queryParams,
+		Data:   data,
 		As:     opts.As,
 	}
-
-	if opts.File != "" {
-		// File upload: determine default field name from metadata.
-		defaultField := "file"
-		if len(opts.FileFields) == 1 {
-			defaultField = opts.FileFields[0]
-		}
-		fieldName, filePath, isStdin := cmdutil.ParseFileFlag(opts.File, defaultField)
-
-		// Parse --data as form fields.
-		var dataFields any
-		if opts.Data != "" {
-			dataFields, err = cmdutil.ParseOptionalBody(httpMethod, opts.Data, stdin)
-			if err != nil {
-				return client.RawApiRequest{}, nil, err
-			}
-			if _, ok := dataFields.(map[string]any); !ok {
-				return client.RawApiRequest{}, nil, output.ErrValidation("--data must be a JSON object when used with --file")
-			}
-		}
-
-		if opts.DryRun {
-			return request, &cmdutil.FileUploadMeta{
-				FieldName: fieldName, FilePath: filePath, FormFields: dataFields,
-			}, nil
-		}
-
-		fd, err := cmdutil.BuildFormdata(
-			opts.Factory.ResolveFileIO(opts.Ctx),
-			fieldName, filePath, isStdin, stdin, dataFields,
-		)
-		if err != nil {
-			return client.RawApiRequest{}, nil, err
-		}
-		request.Data = fd
-		request.ExtraOpts = append(request.ExtraOpts, larkcore.WithFileUpload())
-	} else {
-		data, err := cmdutil.ParseOptionalBody(httpMethod, opts.Data, stdin)
-		if err != nil {
-			return client.RawApiRequest{}, nil, err
-		}
-		request.Data = data
-		if opts.Output != "" {
-			request.ExtraOpts = append(request.ExtraOpts, larkcore.WithFileDownload())
-		}
+	if opts.Output != "" {
+		request.ExtraOpts = append(request.ExtraOpts, larkcore.WithFileDownload())
 	}
-
-	return request, nil, nil
+	return request, nil
 }

 func serviceDryRun(f *cmdutil.Factory, request client.RawApiRequest, config *core.CliConfig, format string) error {
--- a/cmd/service/service_test.go
+++ b/cmd/service/service_test.go
@@ -4,7 +4,6 @@
 package service

 import (
-	"os"
 	"strings"
 	"testing"

@@ -309,7 +308,7 @@ func TestServiceMethod_InvalidParamsJSON(t *testing.T) {
 	if err == nil {
 		t.Fatal("expected error for invalid JSON")
 	}
-	if !strings.Contains(err.Error(), "--params invalid format") {
+	if !strings.Contains(err.Error(), "--params invalid JSON format") {
 		t.Errorf("unexpected error: %v", err)
 	}
 }
@@ -332,24 +331,6 @@ func TestServiceMethod_InvalidDataJSON(t *testing.T) {
 	}
 }

-func TestServiceMethod_ParamsAndDataBothStdinConflict(t *testing.T) {
-	f, _, _, _ := cmdutil.TestFactory(t, testConfig)
-	spec := map[string]interface{}{
-		"name": "svc", "servicePath": "/open-apis/svc/v1",
-	}
-	method := map[string]interface{}{"path": "items", "httpMethod": "POST", "parameters": map[string]interface{}{}}
-	cmd := NewCmdServiceMethod(f, spec, method, "create", "items", nil)
-	cmd.SetArgs([]string{"--params", "-", "--data", "-", "--dry-run"})
-
-	err := cmd.Execute()
-	if err == nil {
-		t.Fatal("expected error when both --params and --data use stdin")
-	}
-	if !strings.Contains(err.Error(), "cannot both read from stdin") {
-		t.Errorf("expected stdin conflict error, got: %v", err)
-	}
-}
-
 func TestServiceMethod_OutputAndPageAllConflict(t *testing.T) {
 	f, _, _, _ := cmdutil.TestFactory(t, testConfig)
 	spec := map[string]interface{}{
@@ -711,144 +692,6 @@ func TestScopeAwareChecker_ScopeError_BotMode(t *testing.T) {
 	}
 }

-// ── file upload ──
-
-func imImageMethod() map[string]interface{} {
-	return map[string]interface{}{
-		"path":       "images",
-		"httpMethod": "POST",
-		"requestBody": map[string]interface{}{
-			"image_type": map[string]interface{}{
-				"type":     "string",
-				"required": true,
-			},
-			"image": map[string]interface{}{
-				"type":     "file",
-				"required": true,
-			},
-		},
-		"accessTokens": []interface{}{"user", "tenant"},
-	}
-}
-
-func imSpec() map[string]interface{} {
-	return map[string]interface{}{
-		"name":        "im",
-		"servicePath": "/open-apis/im/v1",
-	}
-}
-
-func TestServiceMethod_FileFlagRegistered(t *testing.T) {
-	f, _, _, _ := cmdutil.TestFactory(t, testConfig)
-	cmd := NewCmdServiceMethod(f, imSpec(), imImageMethod(), "create", "images", nil)
-	flag := cmd.Flags().Lookup("file")
-	if flag == nil {
-		t.Fatal("expected --file flag to be registered for file upload method")
-	}
-}
-
-func TestServiceMethod_FileFlagNotRegistered(t *testing.T) {
-	f, _, _, _ := cmdutil.TestFactory(t, testConfig)
-	cmd := NewCmdServiceMethod(f, driveSpec(), driveMethod("POST", nil), "copy", "files", nil)
-	flag := cmd.Flags().Lookup("file")
-	if flag != nil {
-		t.Fatal("expected --file flag NOT to be registered for non-file method")
-	}
-}
-
-func TestServiceMethod_FileFlagNotRegisteredForGET(t *testing.T) {
-	getMethod := map[string]interface{}{
-		"path":       "images",
-		"httpMethod": "GET",
-		"requestBody": map[string]interface{}{
-			"image": map[string]interface{}{
-				"type": "file",
-			},
-		},
-	}
-	f, _, _, _ := cmdutil.TestFactory(t, testConfig)
-	cmd := NewCmdServiceMethod(f, imSpec(), getMethod, "get", "images", nil)
-	flag := cmd.Flags().Lookup("file")
-	if flag != nil {
-		t.Fatal("expected --file flag NOT to be registered for GET method")
-	}
-}
-
-func TestServiceMethod_FileUpload_DryRun(t *testing.T) {
-	tmpDir := t.TempDir()
-	tmpFile := tmpDir + "/test.jpg"
-	if err := os.WriteFile(tmpFile, []byte("fake-image"), 0600); err != nil {
-		t.Fatal(err)
-	}
-
-	f, stdout, _, _ := cmdutil.TestFactory(t, testConfig)
-	cmd := NewCmdServiceMethod(f, imSpec(), imImageMethod(), "create", "images", nil)
-	cmd.SetArgs([]string{
-		"--file", "image=" + tmpFile,
-		"--data", `{"image_type":"message"}`,
-		"--dry-run",
-		"--as", "bot",
-	})
-	err := cmd.Execute()
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	out := stdout.String()
-	if !strings.Contains(out, "image") {
-		t.Errorf("expected dry-run output to mention file field, got: %s", out)
-	}
-	if !strings.Contains(out, "Dry Run") {
-		t.Errorf("expected dry-run header, got: %s", out)
-	}
-}
-
-func TestDetectFileFields(t *testing.T) {
-	tests := []struct {
-		name   string
-		method map[string]interface{}
-		want   []string
-	}{
-		{
-			name: "single file field",
-			method: map[string]interface{}{
-				"requestBody": map[string]interface{}{
-					"image": map[string]interface{}{"type": "file"},
-					"name":  map[string]interface{}{"type": "string"},
-				},
-			},
-			want: []string{"image"},
-		},
-		{
-			name: "no file fields",
-			method: map[string]interface{}{
-				"requestBody": map[string]interface{}{
-					"name": map[string]interface{}{"type": "string"},
-				},
-			},
-			want: nil,
-		},
-		{
-			name:   "no requestBody",
-			method: map[string]interface{}{},
-			want:   nil,
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			got := detectFileFields(tt.method)
-			if len(got) != len(tt.want) {
-				t.Errorf("detectFileFields() = %v, want %v", got, tt.want)
-				return
-			}
-			for i := range got {
-				if got[i] != tt.want[i] {
-					t.Errorf("detectFileFields()[%d] = %q, want %q", i, got[i], tt.want[i])
-				}
-			}
-		})
-	}
-}
-
 // ── helpers ──

 func isExitError(err error, target **output.ExitError) bool {
--- a/cmd/update/update.go
+++ b/cmd/update/update.go
@@ -1,314 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package cmdupdate
-
-import (
-	"fmt"
-	"runtime"
-	"strings"
-
-	"github.com/spf13/cobra"
-
-	"github.com/larksuite/cli/internal/build"
-	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/output"
-	"github.com/larksuite/cli/internal/selfupdate"
-	"github.com/larksuite/cli/internal/update"
-)
-
-const (
-	repoURL      = "https://github.com/larksuite/cli"
-	maxNpmOutput = 2000
-	osWindows    = "windows"
-)
-
-// Overridable for testing.
-var (
-	fetchLatest    = func() (string, error) { return update.FetchLatest() }
-	currentVersion = func() string { return build.Version }
-	currentOS      = runtime.GOOS
-	newUpdater     = func() *selfupdate.Updater { return selfupdate.New() }
-)
-
-func isWindows() bool { return currentOS == osWindows }
-
-func releaseURL(version string) string {
-	return repoURL + "/releases/tag/v" + strings.TrimPrefix(version, "v")
-}
-
-func changelogURL() string { return repoURL + "/blob/main/CHANGELOG.md" }
-
-// --- Terminal symbols (ASCII fallback on Windows) ---
-
-func symOK() string {
-	if isWindows() {
-		return "[OK]"
-	}
-	return "✓"
-}
-
-func symFail() string {
-	if isWindows() {
-		return "[FAIL]"
-	}
-	return "✗"
-}
-
-func symWarn() string {
-	if isWindows() {
-		return "[WARN]"
-	}
-	return "⚠"
-}
-
-func symArrow() string {
-	if isWindows() {
-		return "->"
-	}
-	return "→"
-}
-
-// --- Command ---
-
-// UpdateOptions holds inputs for the update command.
-type UpdateOptions struct {
-	Factory *cmdutil.Factory
-	JSON    bool
-	Force   bool
-	Check   bool
-}
-
-// NewCmdUpdate creates the update command.
-func NewCmdUpdate(f *cmdutil.Factory) *cobra.Command {
-	opts := &UpdateOptions{Factory: f}
-
-	cmd := &cobra.Command{
-		Use:   "update",
-		Short: "Update lark-cli to the latest version",
-		Long: `Update lark-cli to the latest version.
-
-Detects the installation method automatically:
-  - npm install: runs npm install -g @larksuite/cli@<version>
-  - manual/other: shows GitHub Releases download URL
-
-Use --json for structured output (for AI agents and scripts).
-Use --check to only check for updates without installing.`,
-		RunE: func(cmd *cobra.Command, args []string) error {
-			return updateRun(opts)
-		},
-	}
-	cmdutil.DisableAuthCheck(cmd)
-	cmd.Flags().BoolVar(&opts.JSON, "json", false, "structured JSON output")
-	cmd.Flags().BoolVar(&opts.Force, "force", false, "force reinstall even if already up to date")
-	cmd.Flags().BoolVar(&opts.Check, "check", false, "only check for updates, do not install")
-
-	return cmd
-}
-
-func updateRun(opts *UpdateOptions) error {
-	io := opts.Factory.IOStreams
-	cur := currentVersion()
-	updater := newUpdater()
-
-	updater.CleanupStaleFiles()
-	output.PendingNotice = nil
-
-	// 1. Fetch latest version
-	latest, err := fetchLatest()
-	if err != nil {
-		return reportError(opts, io, output.ExitNetwork, "network", "failed to check latest version: %s", err)
-	}
-
-	// 2. Validate version format
-	if update.ParseVersion(latest) == nil {
-		return reportError(opts, io, output.ExitInternal, "update_error", "invalid version from registry: %s", latest)
-	}
-
-	// 3. Compare versions
-	if !opts.Force && !update.IsNewer(latest, cur) {
-		if opts.JSON {
-			output.PrintJson(io.Out, map[string]interface{}{
-				"ok": true, "previous_version": cur, "current_version": cur,
-				"latest_version": latest, "action": "already_up_to_date",
-				"message": fmt.Sprintf("lark-cli %s is already up to date", cur),
-			})
-			return nil
-		}
-		fmt.Fprintf(io.ErrOut, "%s lark-cli %s is already up to date\n", symOK(), cur)
-		return nil
-	}
-
-	// 4. Detect installation method
-	detect := updater.DetectInstallMethod()
-
-	// 5. --check
-	if opts.Check {
-		return reportCheckResult(opts, io, cur, latest, detect.CanAutoUpdate())
-	}
-
-	// 6. Execute update
-	if !detect.CanAutoUpdate() {
-		return doManualUpdate(opts, io, cur, latest, detect)
-	}
-	return doNpmUpdate(opts, io, cur, latest, updater)
-}
-
-// --- Output helpers ---
-
-func reportError(opts *UpdateOptions, io *cmdutil.IOStreams, exitCode int, errType, format string, args ...interface{}) error {
-	msg := fmt.Sprintf(format, args...)
-	if opts.JSON {
-		output.PrintJson(io.Out, map[string]interface{}{
-			"ok": false, "error": map[string]interface{}{"type": errType, "message": msg},
-		})
-		return output.ErrBare(exitCode)
-	}
-	return output.Errorf(exitCode, errType, "%s", msg)
-}
-
-func reportCheckResult(opts *UpdateOptions, io *cmdutil.IOStreams, cur, latest string, canAutoUpdate bool) error {
-	if opts.JSON {
-		output.PrintJson(io.Out, map[string]interface{}{
-			"ok": true, "previous_version": cur, "current_version": cur,
-			"latest_version": latest, "action": "update_available",
-			"auto_update": canAutoUpdate,
-			"message":     fmt.Sprintf("lark-cli %s %s %s available", cur, symArrow(), latest),
-			"url":         releaseURL(latest), "changelog": changelogURL(),
-		})
-		return nil
-	}
-	fmt.Fprintf(io.ErrOut, "Update available: %s %s %s\n", cur, symArrow(), latest)
-	fmt.Fprintf(io.ErrOut, "  Release:   %s\n", releaseURL(latest))
-	fmt.Fprintf(io.ErrOut, "  Changelog: %s\n", changelogURL())
-	if canAutoUpdate {
-		fmt.Fprintf(io.ErrOut, "\nRun `lark-cli update` to install.\n")
-	} else {
-		fmt.Fprintf(io.ErrOut, "\nDownload the release above to update manually.\n")
-	}
-	return nil
-}
-
-func doManualUpdate(opts *UpdateOptions, io *cmdutil.IOStreams, cur, latest string, detect selfupdate.DetectResult) error {
-	reason := detect.ManualReason()
-	if opts.JSON {
-		output.PrintJson(io.Out, map[string]interface{}{
-			"ok": true, "previous_version": cur, "latest_version": latest,
-			"action":  "manual_required",
-			"message": fmt.Sprintf("Automatic update unavailable: %s (path: %s)", reason, detect.ResolvedPath),
-			"url":     releaseURL(latest), "changelog": changelogURL(),
-		})
-		return nil
-	}
-	fmt.Fprintf(io.ErrOut, "Automatic update unavailable: %s (path: %s).\n\n", reason, detect.ResolvedPath)
-	fmt.Fprintf(io.ErrOut, "To update manually, download the latest release:\n")
-	fmt.Fprintf(io.ErrOut, "  Release:   %s\n", releaseURL(latest))
-	fmt.Fprintf(io.ErrOut, "  Changelog: %s\n", changelogURL())
-	fmt.Fprintf(io.ErrOut, "\nOr install via npm:\n  npm install -g %s@%s\n", selfupdate.NpmPackage, latest)
-	fmt.Fprintf(io.ErrOut, "\nAfter updating, also update skills:\n  npx -y skills add larksuite/cli -g -y\n")
-	return nil
-}
-
-func doNpmUpdate(opts *UpdateOptions, io *cmdutil.IOStreams, cur, latest string, updater *selfupdate.Updater) error {
-	restore, err := updater.PrepareSelfReplace()
-	if err != nil {
-		return reportError(opts, io, output.ExitAPI, "update_error", "failed to prepare update: %s", err)
-	}
-
-	if !opts.JSON {
-		fmt.Fprintf(io.ErrOut, "Updating lark-cli %s %s %s via npm ...\n", cur, symArrow(), latest)
-	}
-
-	npmResult := updater.RunNpmInstall(latest)
-	if npmResult.Err != nil {
-		restore()
-		combined := npmResult.CombinedOutput()
-		if opts.JSON {
-			output.PrintJson(io.Out, map[string]interface{}{
-				"ok": false, "error": map[string]interface{}{
-					"type": "update_error", "message": fmt.Sprintf("npm install failed: %s", npmResult.Err),
-					"detail": selfupdate.Truncate(combined, maxNpmOutput),
-					"hint":   permissionHint(combined),
-				},
-			})
-			return output.ErrBare(output.ExitAPI)
-		}
-		if npmResult.Stdout.Len() > 0 {
-			fmt.Fprint(io.ErrOut, npmResult.Stdout.String())
-		}
-		if npmResult.Stderr.Len() > 0 {
-			fmt.Fprint(io.ErrOut, npmResult.Stderr.String())
-		}
-		fmt.Fprintf(io.ErrOut, "\n%s Update failed: %s\n", symFail(), npmResult.Err)
-		if hint := permissionHint(combined); hint != "" {
-			fmt.Fprintf(io.ErrOut, "  %s\n", hint)
-		}
-		return output.ErrBare(output.ExitAPI)
-	}
-
-	// Verify the new binary is functional before proceeding.
-	// If corrupt, restore the previous version from .old.
-	if err := updater.VerifyBinary(latest); err != nil {
-		restore()
-		msg := fmt.Sprintf("new binary verification failed: %s", err)
-		hint := verificationFailureHint(updater, latest)
-		if opts.JSON {
-			output.PrintJson(io.Out, map[string]interface{}{
-				"ok":    false,
-				"error": map[string]interface{}{"type": "update_error", "message": msg, "hint": hint},
-			})
-			return output.ErrBare(output.ExitAPI)
-		}
-		fmt.Fprintf(io.ErrOut, "\n%s %s\n", symFail(), msg)
-		fmt.Fprintf(io.ErrOut, "  %s\n", hint)
-		return output.ErrBare(output.ExitAPI)
-	}
-
-	// Skills update (best-effort).
-	skillsResult := updater.RunSkillsUpdate()
-
-	if opts.JSON {
-		result := map[string]interface{}{
-			"ok": true, "previous_version": cur, "current_version": latest,
-			"latest_version": latest, "action": "updated",
-			"message": fmt.Sprintf("lark-cli updated from %s to %s", cur, latest),
-			"url":     releaseURL(latest), "changelog": changelogURL(),
-		}
-		if skillsResult.Err != nil {
-			result["skills_warning"] = fmt.Sprintf("skills update failed: %s", skillsResult.Err)
-			if detail := strings.TrimSpace(skillsResult.Stderr.String()); detail != "" {
-				result["skills_detail"] = selfupdate.Truncate(detail, maxNpmOutput)
-			}
-		}
-		output.PrintJson(io.Out, result)
-		return nil
-	}
-
-	fmt.Fprintf(io.ErrOut, "\n%s Successfully updated lark-cli from %s to %s\n", symOK(), cur, latest)
-	fmt.Fprintf(io.ErrOut, "  Changelog: %s\n", changelogURL())
-	fmt.Fprintf(io.ErrOut, "\nUpdating skills ...\n")
-	if skillsResult.Err != nil {
-		fmt.Fprintf(io.ErrOut, "%s Skills update failed: %s\n", symWarn(), skillsResult.Err)
-		if detail := strings.TrimSpace(skillsResult.Stderr.String()); detail != "" {
-			fmt.Fprintf(io.ErrOut, "  %s\n", selfupdate.Truncate(detail, 500))
-		}
-		fmt.Fprintf(io.ErrOut, "  Run manually: npx -y skills add larksuite/cli -g -y\n")
-	} else {
-		fmt.Fprintf(io.ErrOut, "%s Skills updated\n", symOK())
-	}
-	return nil
-}
-
-func permissionHint(npmOutput string) string {
-	if strings.Contains(npmOutput, "EACCES") && !isWindows() {
-		return "Permission denied. Try: sudo lark-cli update, or adjust your npm global prefix: https://docs.npmjs.com/resolving-eacces-permissions-errors"
-	}
-	return ""
-}
-
-func verificationFailureHint(updater *selfupdate.Updater, latest string) string {
-	if updater.CanRestorePreviousVersion() {
-		return "the previous version has been restored"
-	}
-	return fmt.Sprintf("automatic rollback is unavailable on this platform; reinstall manually: npm install -g %s@%s, or download %s", selfupdate.NpmPackage, latest, releaseURL(latest))
-}
--- a/cmd/update/update_test.go
+++ b/cmd/update/update_test.go
@@ -1,851 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package cmdupdate
-
-import (
-	"bytes"
-	"errors"
-	"fmt"
-	"strings"
-	"testing"
-
-	"github.com/larksuite/cli/internal/cmdutil"
-	"github.com/larksuite/cli/internal/core"
-	"github.com/larksuite/cli/internal/output"
-	"github.com/larksuite/cli/internal/selfupdate"
-)
-
-// newTestFactory creates a test factory with minimal config.
-func newTestFactory(t *testing.T) (*cmdutil.Factory, *bytes.Buffer, *bytes.Buffer) {
-	t.Helper()
-	f, stdout, stderr, _ := cmdutil.TestFactory(t, &core.CliConfig{})
-	return f, stdout, stderr
-}
-
-// mockDetect sets up newUpdater to return an Updater with the given DetectResult.
-// It preserves any existing NpmInstallOverride/SkillsUpdateOverride that may be set later.
-func mockDetect(t *testing.T, result selfupdate.DetectResult) {
-	t.Helper()
-	origNew := newUpdater
-	newUpdater = func() *selfupdate.Updater {
-		u := selfupdate.New()
-		u.DetectOverride = func() selfupdate.DetectResult { return result }
-		return u
-	}
-	t.Cleanup(func() { newUpdater = origNew })
-}
-
-// mockDetectAndNpm sets up newUpdater with detect, npm install, and skills overrides all at once.
-func mockDetectAndNpm(t *testing.T, result selfupdate.DetectResult,
-	npmFn func(string) *selfupdate.NpmResult,
-	skillsFn func() *selfupdate.NpmResult) {
-	t.Helper()
-	origNew := newUpdater
-	newUpdater = func() *selfupdate.Updater {
-		u := selfupdate.New()
-		u.DetectOverride = func() selfupdate.DetectResult { return result }
-		u.NpmInstallOverride = npmFn
-		u.SkillsUpdateOverride = skillsFn
-		u.VerifyOverride = func(string) error { return nil }
-		return u
-	}
-	t.Cleanup(func() { newUpdater = origNew })
-}
-
-func TestUpdateAlreadyUpToDate_JSON(t *testing.T) {
-	f, stdout, _ := newTestFactory(t)
-
-	cmd := NewCmdUpdate(f)
-	cmd.SetArgs([]string{"--json"})
-
-	origFetch := fetchLatest
-	fetchLatest = func() (string, error) { return "1.0.0", nil }
-	defer func() { fetchLatest = origFetch }()
-
-	origVersion := currentVersion
-	currentVersion = func() string { return "1.0.0" }
-	defer func() { currentVersion = origVersion }()
-
-	err := cmd.Execute()
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-
-	out := stdout.String()
-	if !strings.Contains(out, `"action": "already_up_to_date"`) {
-		t.Errorf("expected already_up_to_date in JSON output, got: %s", out)
-	}
-	if !strings.Contains(out, `"ok": true`) {
-		t.Errorf("expected ok:true in JSON output, got: %s", out)
-	}
-}
-
-func TestUpdateAlreadyUpToDate_Human(t *testing.T) {
-	f, _, stderr := newTestFactory(t)
-
-	cmd := NewCmdUpdate(f)
-	cmd.SetArgs([]string{})
-
-	origFetch := fetchLatest
-	fetchLatest = func() (string, error) { return "1.0.0", nil }
-	defer func() { fetchLatest = origFetch }()
-
-	origVersion := currentVersion
-	currentVersion = func() string { return "1.0.0" }
-	defer func() { currentVersion = origVersion }()
-
-	err := cmd.Execute()
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-
-	out := stderr.String()
-	if !strings.Contains(out, "already up to date") {
-		t.Errorf("expected 'already up to date' in stderr, got: %s", out)
-	}
-}
-
-func TestUpdateManual_JSON(t *testing.T) {
-	f, stdout, _ := newTestFactory(t)
-	cmd := NewCmdUpdate(f)
-	cmd.SetArgs([]string{"--json"})
-	cmd.SilenceErrors = true
-	cmd.SilenceUsage = true
-
-	origFetch := fetchLatest
-	fetchLatest = func() (string, error) { return "2.0.0", nil }
-	defer func() { fetchLatest = origFetch }()
-	origVersion := currentVersion
-	currentVersion = func() string { return "1.0.0" }
-	defer func() { currentVersion = origVersion }()
-	mockDetect(t, selfupdate.DetectResult{Method: selfupdate.InstallManual, ResolvedPath: "/usr/local/bin/lark-cli"})
-
-	err := cmd.Execute()
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	out := stdout.String()
-	if !strings.Contains(out, `"action": "manual_required"`) {
-		t.Errorf("expected manual_required in output, got: %s", out)
-	}
-	if !strings.Contains(out, "not installed via npm") {
-		t.Errorf("expected accurate reason in output, got: %s", out)
-	}
-	if !strings.Contains(out, "releases/tag/v2.0.0") {
-		t.Errorf("expected version-pinned URL in output, got: %s", out)
-	}
-}
-
-func TestUpdateManual_Human(t *testing.T) {
-	f, _, stderr := newTestFactory(t)
-	cmd := NewCmdUpdate(f)
-	cmd.SetArgs([]string{})
-
-	origFetch := fetchLatest
-	fetchLatest = func() (string, error) { return "2.0.0", nil }
-	defer func() { fetchLatest = origFetch }()
-	origVersion := currentVersion
-	currentVersion = func() string { return "1.0.0" }
-	defer func() { currentVersion = origVersion }()
-	mockDetect(t, selfupdate.DetectResult{Method: selfupdate.InstallManual, ResolvedPath: "/usr/local/bin/lark-cli"})
-
-	err := cmd.Execute()
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	out := stderr.String()
-	if !strings.Contains(out, "not installed via npm") {
-		t.Errorf("expected 'not installed via npm' in stderr, got: %s", out)
-	}
-	if !strings.Contains(out, "releases/tag/v2.0.0") {
-		t.Errorf("expected version-pinned URL in stderr, got: %s", out)
-	}
-}
-
-func TestUpdateNpm_JSON(t *testing.T) {
-	f, stdout, _ := newTestFactory(t)
-	cmd := NewCmdUpdate(f)
-	cmd.SetArgs([]string{"--json"})
-
-	origFetch := fetchLatest
-	fetchLatest = func() (string, error) { return "2.0.0", nil }
-	defer func() { fetchLatest = origFetch }()
-	origVersion := currentVersion
-	currentVersion = func() string { return "1.0.0" }
-	defer func() { currentVersion = origVersion }()
-	mockDetectAndNpm(t,
-		selfupdate.DetectResult{Method: selfupdate.InstallNpm, ResolvedPath: "/node_modules/@larksuite/cli/bin/lark-cli", NpmAvailable: true},
-		func(version string) *selfupdate.NpmResult { return &selfupdate.NpmResult{} },
-		func() *selfupdate.NpmResult { return &selfupdate.NpmResult{} },
-	)
-
-	err := cmd.Execute()
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	out := stdout.String()
-	if !strings.Contains(out, `"action": "updated"`) {
-		t.Errorf("expected updated in output, got: %s", out)
-	}
-}
-
-func TestUpdateNpm_Human(t *testing.T) {
-	f, _, stderr := newTestFactory(t)
-	cmd := NewCmdUpdate(f)
-	cmd.SetArgs([]string{})
-
-	origFetch := fetchLatest
-	fetchLatest = func() (string, error) { return "2.0.0", nil }
-	defer func() { fetchLatest = origFetch }()
-	origVersion := currentVersion
-	currentVersion = func() string { return "1.0.0" }
-	defer func() { currentVersion = origVersion }()
-	mockDetectAndNpm(t,
-		selfupdate.DetectResult{Method: selfupdate.InstallNpm, ResolvedPath: "/node_modules/@larksuite/cli/bin/lark-cli", NpmAvailable: true},
-		func(version string) *selfupdate.NpmResult { return &selfupdate.NpmResult{} },
-		func() *selfupdate.NpmResult { return &selfupdate.NpmResult{} },
-	)
-
-	err := cmd.Execute()
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	out := stderr.String()
-	if !strings.Contains(out, "Successfully updated") {
-		t.Errorf("expected success message in stderr, got: %s", out)
-	}
-}
-
-func TestUpdateForce_JSON(t *testing.T) {
-	f, stdout, _ := newTestFactory(t)
-	cmd := NewCmdUpdate(f)
-	cmd.SetArgs([]string{"--force", "--json"})
-
-	origFetch := fetchLatest
-	fetchLatest = func() (string, error) { return "1.0.0", nil }
-	defer func() { fetchLatest = origFetch }()
-	origVersion := currentVersion
-	currentVersion = func() string { return "1.0.0" }
-	defer func() { currentVersion = origVersion }()
-	mockDetectAndNpm(t,
-		selfupdate.DetectResult{Method: selfupdate.InstallNpm, ResolvedPath: "/node_modules/@larksuite/cli/bin/lark-cli", NpmAvailable: true},
-		func(version string) *selfupdate.NpmResult { return &selfupdate.NpmResult{} },
-		func() *selfupdate.NpmResult { return &selfupdate.NpmResult{} },
-	)
-
-	err := cmd.Execute()
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	out := stdout.String()
-	if !strings.Contains(out, `"action": "updated"`) {
-		t.Errorf("expected updated in JSON output, got: %s", out)
-	}
-}
-
-func TestUpdateFetchError_JSON(t *testing.T) {
-	f, stdout, _ := newTestFactory(t)
-	cmd := NewCmdUpdate(f)
-	cmd.SetArgs([]string{"--json"})
-
-	origFetch := fetchLatest
-	fetchLatest = func() (string, error) { return "", errors.New("network timeout") }
-	defer func() { fetchLatest = origFetch }()
-
-	err := cmd.Execute()
-	// cobra silences errors when RunE returns; we just check stdout
-	_ = err
-	out := stdout.String()
-	if !strings.Contains(out, `"ok": false`) {
-		t.Errorf("expected ok:false in JSON output, got: %s", out)
-	}
-	if !strings.Contains(out, "network timeout") {
-		t.Errorf("expected 'network timeout' in JSON output, got: %s", out)
-	}
-}
-
-func TestUpdateFetchError_Human(t *testing.T) {
-	f, _, _ := newTestFactory(t)
-	cmd := NewCmdUpdate(f)
-	cmd.SetArgs([]string{})
-
-	origFetch := fetchLatest
-	fetchLatest = func() (string, error) { return "", errors.New("network timeout") }
-	defer func() { fetchLatest = origFetch }()
-
-	// Suppress cobra's default error printing.
-	cmd.SilenceErrors = true
-	cmd.SilenceUsage = true
-
-	err := cmd.Execute()
-	if err == nil {
-		t.Fatal("expected non-nil error, got nil")
-	}
-	var exitErr *output.ExitError
-	if !errors.As(err, &exitErr) {
-		t.Fatalf("expected *output.ExitError, got %T: %v", err, err)
-	}
-	if exitErr.Code != output.ExitNetwork {
-		t.Errorf("expected ExitNetwork (%d), got %d", output.ExitNetwork, exitErr.Code)
-	}
-}
-
-func TestUpdateInvalidVersion_JSON(t *testing.T) {
-	f, stdout, _ := newTestFactory(t)
-	cmd := NewCmdUpdate(f)
-	cmd.SetArgs([]string{"--json"})
-
-	origFetch := fetchLatest
-	fetchLatest = func() (string, error) { return "not-a-version", nil }
-	defer func() { fetchLatest = origFetch }()
-
-	_ = cmd.Execute()
-	out := stdout.String()
-	if !strings.Contains(out, "invalid version") {
-		t.Errorf("expected 'invalid version' in JSON output, got: %s", out)
-	}
-}
-
-func TestUpdateDevVersion_JSON(t *testing.T) {
-	f, stdout, _ := newTestFactory(t)
-	cmd := NewCmdUpdate(f)
-	cmd.SetArgs([]string{"--json"})
-
-	origFetch := fetchLatest
-	fetchLatest = func() (string, error) { return "1.0.0", nil }
-	defer func() { fetchLatest = origFetch }()
-	origVersion := currentVersion
-	currentVersion = func() string { return "DEV" }
-	defer func() { currentVersion = origVersion }()
-	mockDetectAndNpm(t,
-		selfupdate.DetectResult{Method: selfupdate.InstallNpm, ResolvedPath: "/node_modules/@larksuite/cli/bin/lark-cli", NpmAvailable: true},
-		func(version string) *selfupdate.NpmResult { return &selfupdate.NpmResult{} },
-		func() *selfupdate.NpmResult { return &selfupdate.NpmResult{} },
-	)
-
-	err := cmd.Execute()
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	out := stdout.String()
-	if !strings.Contains(out, `"action": "updated"`) {
-		t.Errorf("expected updated in JSON output, got: %s", out)
-	}
-}
-
-func TestUpdateNpmFail_JSON(t *testing.T) {
-	f, stdout, _ := newTestFactory(t)
-	cmd := NewCmdUpdate(f)
-	cmd.SetArgs([]string{"--json"})
-
-	origFetch := fetchLatest
-	fetchLatest = func() (string, error) { return "2.0.0", nil }
-	defer func() { fetchLatest = origFetch }()
-	origVersion := currentVersion
-	currentVersion = func() string { return "1.0.0" }
-	defer func() { currentVersion = origVersion }()
-
-	origNew := newUpdater
-	newUpdater = func() *selfupdate.Updater {
-		u := selfupdate.New()
-		u.DetectOverride = func() selfupdate.DetectResult {
-			return selfupdate.DetectResult{Method: selfupdate.InstallNpm, ResolvedPath: "/node_modules/@larksuite/cli/bin/lark-cli", NpmAvailable: true}
-		}
-		u.NpmInstallOverride = func(version string) *selfupdate.NpmResult {
-			r := &selfupdate.NpmResult{}
-			fmt.Fprint(&r.Stderr, "EACCES: permission denied")
-			r.Err = errors.New("npm install failed")
-			return r
-		}
-		return u
-	}
-	defer func() { newUpdater = origNew }()
-
-	_ = cmd.Execute()
-	out := stdout.String()
-	if !strings.Contains(out, "permission denied") {
-		t.Errorf("expected 'permission denied' in JSON output, got: %s", out)
-	}
-	if !strings.Contains(out, `"hint"`) {
-		t.Errorf("expected 'hint' field in JSON output, got: %s", out)
-	}
-}
-
-func TestUpdateNpmFail_Human(t *testing.T) {
-	f, _, stderr := newTestFactory(t)
-	cmd := NewCmdUpdate(f)
-	cmd.SetArgs([]string{})
-
-	origFetch := fetchLatest
-	fetchLatest = func() (string, error) { return "2.0.0", nil }
-	defer func() { fetchLatest = origFetch }()
-	origVersion := currentVersion
-	currentVersion = func() string { return "1.0.0" }
-	defer func() { currentVersion = origVersion }()
-
-	origNew := newUpdater
-	newUpdater = func() *selfupdate.Updater {
-		u := selfupdate.New()
-		u.DetectOverride = func() selfupdate.DetectResult {
-			return selfupdate.DetectResult{Method: selfupdate.InstallNpm, ResolvedPath: "/node_modules/@larksuite/cli/bin/lark-cli", NpmAvailable: true}
-		}
-		u.NpmInstallOverride = func(version string) *selfupdate.NpmResult {
-			r := &selfupdate.NpmResult{}
-			fmt.Fprint(&r.Stderr, "EACCES: permission denied")
-			r.Err = errors.New("npm install failed")
-			return r
-		}
-		return u
-	}
-	defer func() { newUpdater = origNew }()
-
-	cmd.SilenceErrors = true
-	cmd.SilenceUsage = true
-	_ = cmd.Execute()
-	out := stderr.String()
-	if !strings.Contains(out, "Update failed") {
-		t.Errorf("expected 'Update failed' in stderr, got: %s", out)
-	}
-	if !strings.Contains(out, "Permission denied") {
-		t.Errorf("expected permission hint in stderr, got: %s", out)
-	}
-}
-
-func TestUpdateNpmVerifyFail_JSON_NoRestoreHintWhenBackupUnavailable(t *testing.T) {
-	f, stdout, _ := newTestFactory(t)
-	cmd := NewCmdUpdate(f)
-	cmd.SetArgs([]string{"--json"})
-
-	origFetch := fetchLatest
-	fetchLatest = func() (string, error) { return "2.0.0", nil }
-	defer func() { fetchLatest = origFetch }()
-	origVersion := currentVersion
-	currentVersion = func() string { return "1.0.0" }
-	defer func() { currentVersion = origVersion }()
-
-	origNew := newUpdater
-	newUpdater = func() *selfupdate.Updater {
-		u := selfupdate.New()
-		u.DetectOverride = func() selfupdate.DetectResult {
-			return selfupdate.DetectResult{Method: selfupdate.InstallNpm, ResolvedPath: "/node_modules/@larksuite/cli/bin/lark-cli", NpmAvailable: true}
-		}
-		u.NpmInstallOverride = func(version string) *selfupdate.NpmResult { return &selfupdate.NpmResult{} }
-		u.VerifyOverride = func(string) error { return errors.New("bad binary") }
-		u.RestoreAvailableOverride = func() bool { return false }
-		u.SkillsUpdateOverride = func() *selfupdate.NpmResult {
-			t.Fatal("skills update should not run when binary verification fails")
-			return nil
-		}
-		return u
-	}
-	defer func() { newUpdater = origNew }()
-
-	err := cmd.Execute()
-	if err == nil {
-		t.Fatal("expected verification failure")
-	}
-	var exitErr *output.ExitError
-	if !errors.As(err, &exitErr) {
-		t.Fatalf("expected *output.ExitError, got %T: %v", err, err)
-	}
-	if exitErr.Code != output.ExitAPI {
-		t.Fatalf("expected ExitAPI (%d), got %d", output.ExitAPI, exitErr.Code)
-	}
-
-	out := stdout.String()
-	if !strings.Contains(out, "automatic rollback is unavailable") {
-		t.Errorf("expected unavailable rollback hint, got: %s", out)
-	}
-	if strings.Contains(out, "previous version has been restored") {
-		t.Errorf("should not claim restore when no backup is available, got: %s", out)
-	}
-	if !strings.Contains(out, "npm install -g @larksuite/cli@2.0.0") {
-		t.Errorf("expected manual reinstall command in hint, got: %s", out)
-	}
-}
-
-func TestUpdateCheck_JSON_Npm(t *testing.T) {
-	f, stdout, _ := newTestFactory(t)
-	cmd := NewCmdUpdate(f)
-	cmd.SetArgs([]string{"--json", "--check"})
-
-	origFetch := fetchLatest
-	fetchLatest = func() (string, error) { return "2.0.0", nil }
-	defer func() { fetchLatest = origFetch }()
-	origVersion := currentVersion
-	currentVersion = func() string { return "1.0.0" }
-	defer func() { currentVersion = origVersion }()
-	mockDetect(t, selfupdate.DetectResult{Method: selfupdate.InstallNpm, ResolvedPath: "/node_modules/@larksuite/cli/bin/lark-cli", NpmAvailable: true})
-
-	err := cmd.Execute()
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	out := stdout.String()
-	if !strings.Contains(out, `"action": "update_available"`) {
-		t.Errorf("expected update_available action, got: %s", out)
-	}
-	if !strings.Contains(out, `"auto_update": true`) {
-		t.Errorf("expected auto_update:true for npm, got: %s", out)
-	}
-	if !strings.Contains(out, "releases/tag/v2.0.0") {
-		t.Errorf("expected version-pinned release URL, got: %s", out)
-	}
-	if !strings.Contains(out, "CHANGELOG") {
-		t.Errorf("expected changelog URL, got: %s", out)
-	}
-}
-
-func TestUpdateCheck_Human_Npm(t *testing.T) {
-	f, _, stderr := newTestFactory(t)
-	cmd := NewCmdUpdate(f)
-	cmd.SetArgs([]string{"--check"})
-
-	origFetch := fetchLatest
-	fetchLatest = func() (string, error) { return "2.0.0", nil }
-	defer func() { fetchLatest = origFetch }()
-	origVersion := currentVersion
-	currentVersion = func() string { return "1.0.0" }
-	defer func() { currentVersion = origVersion }()
-	mockDetect(t, selfupdate.DetectResult{Method: selfupdate.InstallNpm, ResolvedPath: "/node_modules/@larksuite/cli/bin/lark-cli", NpmAvailable: true})
-
-	err := cmd.Execute()
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	out := stderr.String()
-	if !strings.Contains(out, "Update available") {
-		t.Errorf("expected 'Update available' in stderr, got: %s", out)
-	}
-	if !strings.Contains(out, "lark-cli update") {
-		t.Errorf("expected 'lark-cli update' instruction for npm, got: %s", out)
-	}
-}
-
-func TestUpdateCheck_Human_Manual(t *testing.T) {
-	f, _, stderr := newTestFactory(t)
-	cmd := NewCmdUpdate(f)
-	cmd.SetArgs([]string{"--check"})
-
-	origFetch := fetchLatest
-	fetchLatest = func() (string, error) { return "2.0.0", nil }
-	defer func() { fetchLatest = origFetch }()
-	origVersion := currentVersion
-	currentVersion = func() string { return "1.0.0" }
-	defer func() { currentVersion = origVersion }()
-	mockDetect(t, selfupdate.DetectResult{Method: selfupdate.InstallManual, ResolvedPath: "/usr/local/bin/lark-cli"})
-
-	err := cmd.Execute()
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	out := stderr.String()
-	if !strings.Contains(out, "Update available") {
-		t.Errorf("expected 'Update available' in stderr, got: %s", out)
-	}
-	if !strings.Contains(out, "manually") {
-		t.Errorf("expected manual download instruction for non-npm, got: %s", out)
-	}
-	if strings.Contains(out, "lark-cli update` to install") {
-		t.Errorf("should NOT suggest 'lark-cli update' for manual install, got: %s", out)
-	}
-}
-
-func TestUpdateNpmNotFound_FallsBackToManual(t *testing.T) {
-	f, stdout, _ := newTestFactory(t)
-	cmd := NewCmdUpdate(f)
-	cmd.SetArgs([]string{"--json"})
-
-	origFetch := fetchLatest
-	fetchLatest = func() (string, error) { return "2.0.0", nil }
-	defer func() { fetchLatest = origFetch }()
-	origVersion := currentVersion
-	currentVersion = func() string { return "1.0.0" }
-	defer func() { currentVersion = origVersion }()
-	// npm detected (node_modules in path) but npm binary not available
-	mockDetect(t, selfupdate.DetectResult{
-		Method:       selfupdate.InstallNpm,
-		ResolvedPath: "/node_modules/@larksuite/cli/bin/lark-cli",
-		NpmAvailable: false,
-	})
-
-	err := cmd.Execute()
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	out := stdout.String()
-	if !strings.Contains(out, `"action": "manual_required"`) {
-		t.Errorf("expected manual_required when npm not found, got: %s", out)
-	}
-	// Must say "npm is not available", not generic "not installed via npm"
-	if !strings.Contains(out, "npm is not available") {
-		t.Errorf("expected 'npm is not available' reason when npm detected but missing, got: %s", out)
-	}
-}
-
-func TestReleaseURL(t *testing.T) {
-	got := releaseURL("2.0.0")
-	if got != "https://github.com/larksuite/cli/releases/tag/v2.0.0" {
-		t.Errorf("expected version-pinned URL, got: %s", got)
-	}
-	got2 := releaseURL("v1.5.0")
-	if got2 != "https://github.com/larksuite/cli/releases/tag/v1.5.0" {
-		t.Errorf("expected no double v prefix, got: %s", got2)
-	}
-}
-
-func TestPermissionHint(t *testing.T) {
-	origOS := currentOS
-	defer func() { currentOS = origOS }()
-
-	// Linux: EACCES should produce a hint with npm prefix guidance.
-	currentOS = "linux"
-	hint := permissionHint("EACCES: permission denied, access '/usr/local/lib'")
-	if !strings.Contains(hint, "npm global prefix") {
-		t.Errorf("expected npm prefix hint on linux, got: %s", hint)
-	}
-	if strings.Contains(hint, "sudo npm install -g") {
-		t.Errorf("should not suggest raw sudo npm install, got: %s", hint)
-	}
-
-	// Windows: EACCES hint is suppressed (no EACCES on Windows).
-	currentOS = "windows"
-	hint = permissionHint("EACCES: permission denied")
-	if hint != "" {
-		t.Errorf("expected empty hint on Windows, got: %s", hint)
-	}
-
-	// Non-EACCES error: always empty.
-	currentOS = "linux"
-	if got := permissionHint("some other error"); got != "" {
-		t.Errorf("expected empty hint for non-EACCES, got: %s", got)
-	}
-}
-
-func TestUpdateWindows_NpmSuccess_JSON(t *testing.T) {
-	// With the rename trick, Windows npm installs can now auto-update.
-	f, stdout, _ := newTestFactory(t)
-	cmd := NewCmdUpdate(f)
-	cmd.SetArgs([]string{"--json"})
-
-	origFetch := fetchLatest
-	fetchLatest = func() (string, error) { return "2.0.0", nil }
-	defer func() { fetchLatest = origFetch }()
-	origVersion := currentVersion
-	currentVersion = func() string { return "1.0.0" }
-	defer func() { currentVersion = origVersion }()
-	origOS := currentOS
-	currentOS = osWindows
-	defer func() { currentOS = origOS }()
-	mockDetectAndNpm(t,
-		selfupdate.DetectResult{Method: selfupdate.InstallNpm, ResolvedPath: `C:\npm\node_modules\@larksuite\cli\bin\lark-cli.exe`, NpmAvailable: true},
-		func(version string) *selfupdate.NpmResult { return &selfupdate.NpmResult{} },
-		func() *selfupdate.NpmResult { return &selfupdate.NpmResult{} },
-	)
-
-	err := cmd.Execute()
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	out := stdout.String()
-	if !strings.Contains(out, `"action": "updated"`) {
-		t.Errorf("expected updated on Windows with rename trick, got: %s", out)
-	}
-}
-
-func TestUpdateWindows_Check_JSON(t *testing.T) {
-	// --check on Windows npm should report auto_update: true (rename trick available).
-	f, stdout, _ := newTestFactory(t)
-	cmd := NewCmdUpdate(f)
-	cmd.SetArgs([]string{"--json", "--check"})
-
-	origFetch := fetchLatest
-	fetchLatest = func() (string, error) { return "2.0.0", nil }
-	defer func() { fetchLatest = origFetch }()
-	origVersion := currentVersion
-	currentVersion = func() string { return "1.0.0" }
-	defer func() { currentVersion = origVersion }()
-	origOS := currentOS
-	currentOS = osWindows
-	defer func() { currentOS = origOS }()
-	mockDetect(t, selfupdate.DetectResult{Method: selfupdate.InstallNpm, ResolvedPath: `C:\node_modules\@larksuite\cli\bin\lark-cli.exe`, NpmAvailable: true})
-
-	err := cmd.Execute()
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	out := stdout.String()
-	if !strings.Contains(out, `"auto_update": true`) {
-		t.Errorf("expected auto_update:true on Windows (rename trick), got: %s", out)
-	}
-}
-
-func TestUpdateWindows_Symbols(t *testing.T) {
-	origOS := currentOS
-	defer func() { currentOS = origOS }()
-
-	currentOS = "windows"
-	if symOK() != "[OK]" {
-		t.Errorf("expected [OK] on Windows, got: %s", symOK())
-	}
-	if symFail() != "[FAIL]" {
-		t.Errorf("expected [FAIL] on Windows, got: %s", symFail())
-	}
-	if symWarn() != "[WARN]" {
-		t.Errorf("expected [WARN] on Windows, got: %s", symWarn())
-	}
-	if symArrow() != "->" {
-		t.Errorf("expected -> on Windows, got: %s", symArrow())
-	}
-
-	currentOS = "darwin"
-	if symOK() != "\u2713" {
-		t.Errorf("expected \u2713 on darwin, got: %s", symOK())
-	}
-	if symArrow() != "\u2192" {
-		t.Errorf("expected \u2192 on darwin, got: %s", symArrow())
-	}
-}
-
-func TestUpdateNpm_SkillsSuccess_JSON(t *testing.T) {
-	f, stdout, _ := newTestFactory(t)
-	cmd := NewCmdUpdate(f)
-	cmd.SetArgs([]string{"--json"})
-
-	origFetch := fetchLatest
-	fetchLatest = func() (string, error) { return "2.0.0", nil }
-	defer func() { fetchLatest = origFetch }()
-	origVersion := currentVersion
-	currentVersion = func() string { return "1.0.0" }
-	defer func() { currentVersion = origVersion }()
-	mockDetectAndNpm(t,
-		selfupdate.DetectResult{Method: selfupdate.InstallNpm, ResolvedPath: "/node_modules/@larksuite/cli/bin/lark-cli", NpmAvailable: true},
-		func(version string) *selfupdate.NpmResult { return &selfupdate.NpmResult{} },
-		func() *selfupdate.NpmResult { return &selfupdate.NpmResult{} },
-	)
-
-	err := cmd.Execute()
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	out := stdout.String()
-	// Should NOT have skills_warning when skills succeed
-	if strings.Contains(out, "skills_warning") {
-		t.Errorf("expected no skills_warning on success, got: %s", out)
-	}
-}
-
-func TestUpdateNpm_SkillsFail_JSON(t *testing.T) {
-	f, stdout, _ := newTestFactory(t)
-	cmd := NewCmdUpdate(f)
-	cmd.SetArgs([]string{"--json"})
-
-	origFetch := fetchLatest
-	fetchLatest = func() (string, error) { return "2.0.0", nil }
-	defer func() { fetchLatest = origFetch }()
-	origVersion := currentVersion
-	currentVersion = func() string { return "1.0.0" }
-	defer func() { currentVersion = origVersion }()
-
-	origNew := newUpdater
-	newUpdater = func() *selfupdate.Updater {
-		u := selfupdate.New()
-		u.DetectOverride = func() selfupdate.DetectResult {
-			return selfupdate.DetectResult{Method: selfupdate.InstallNpm, ResolvedPath: "/node_modules/@larksuite/cli/bin/lark-cli", NpmAvailable: true}
-		}
-		u.NpmInstallOverride = func(version string) *selfupdate.NpmResult { return &selfupdate.NpmResult{} }
-		u.VerifyOverride = func(string) error { return nil }
-		// Skills update fails
-		u.SkillsUpdateOverride = func() *selfupdate.NpmResult {
-			r := &selfupdate.NpmResult{}
-			r.Stderr.WriteString("npx: command not found")
-			r.Err = fmt.Errorf("exit status 127")
-			return r
-		}
-		return u
-	}
-	defer func() { newUpdater = origNew }()
-
-	err := cmd.Execute()
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	out := stdout.String()
-	// CLI update should still succeed (ok:true)
-	if !strings.Contains(out, `"ok": true`) {
-		t.Errorf("expected ok:true despite skills failure, got: %s", out)
-	}
-	if !strings.Contains(out, `"action": "updated"`) {
-		t.Errorf("expected action:updated despite skills failure, got: %s", out)
-	}
-	// Should have skills_warning with detail
-	if !strings.Contains(out, "skills_warning") {
-		t.Errorf("expected skills_warning in output, got: %s", out)
-	}
-	if !strings.Contains(out, "skills_detail") {
-		t.Errorf("expected skills_detail in output, got: %s", out)
-	}
-}
-
-func TestUpdateNpm_SkillsFail_Human(t *testing.T) {
-	f, _, stderr := newTestFactory(t)
-	cmd := NewCmdUpdate(f)
-	cmd.SetArgs([]string{})
-
-	origFetch := fetchLatest
-	fetchLatest = func() (string, error) { return "2.0.0", nil }
-	defer func() { fetchLatest = origFetch }()
-	origVersion := currentVersion
-	currentVersion = func() string { return "1.0.0" }
-	defer func() { currentVersion = origVersion }()
-
-	origNew := newUpdater
-	newUpdater = func() *selfupdate.Updater {
-		u := selfupdate.New()
-		u.DetectOverride = func() selfupdate.DetectResult {
-			return selfupdate.DetectResult{Method: selfupdate.InstallNpm, ResolvedPath: "/node_modules/@larksuite/cli/bin/lark-cli", NpmAvailable: true}
-		}
-		u.NpmInstallOverride = func(version string) *selfupdate.NpmResult { return &selfupdate.NpmResult{} }
-		u.VerifyOverride = func(string) error { return nil }
-		u.SkillsUpdateOverride = func() *selfupdate.NpmResult {
-			r := &selfupdate.NpmResult{}
-			r.Stderr.WriteString("npx: command not found")
-			r.Err = fmt.Errorf("exit status 127")
-			return r
-		}
-		return u
-	}
-	defer func() { newUpdater = origNew }()
-
-	err := cmd.Execute()
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	out := stderr.String()
-	// CLI update should still show success
-	if !strings.Contains(out, "Successfully updated") {
-		t.Errorf("expected CLI success message, got: %s", out)
-	}
-	// Skills warning should be shown
-	if !strings.Contains(out, "Skills update failed") {
-		t.Errorf("expected skills failure warning, got: %s", out)
-	}
-	if !strings.Contains(out, "npx -y skills add") {
-		t.Errorf("expected manual skills command hint, got: %s", out)
-	}
-}
-
-func TestTruncate(t *testing.T) {
-	long := strings.Repeat("x", 3000)
-	got := selfupdate.Truncate(long, 2000)
-	if len(got) != 2000 {
-		t.Errorf("expected truncated length 2000, got %d", len(got))
-	}
-
-	short := "hello"
-	got2 := selfupdate.Truncate(short, 2000)
-	if got2 != "hello" {
-		t.Errorf("expected 'hello', got %q", got2)
-	}
-}
--- a/extension/credential/env/env_test.go
+++ b/extension/credential/env/env_test.go
@@ -1,6 +1,3 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
 package env

 import (
--- a/extension/credential/registry_test.go
+++ b/extension/credential/registry_test.go
@@ -1,6 +1,3 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
 package credential

 import (
--- a/extension/fileio/types.go
+++ b/extension/fileio/types.go
@@ -6,7 +6,6 @@ package fileio
 import (
 	"context"
 	"io"
-	"io/fs"
 )

 // Provider creates FileIO instances.
@@ -47,7 +46,6 @@ type FileIO interface {
 type FileInfo interface {
 	Size() int64
 	IsDir() bool
-	Mode() fs.FileMode
 }

 // File is the interface returned by FileIO.Open.
--- a/internal/auth/auth_response_log.go
+++ b/internal/auth/auth_response_log.go
@@ -1,6 +1,3 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
 package auth

 import (
--- a/internal/cmdutil/completion.go
+++ b/internal/cmdutil/completion.go
@@ -1,37 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package cmdutil
-
-import (
-	"sync/atomic"
-
-	"github.com/spf13/cobra"
-)
-
-// Cobra keeps completion callbacks in a package-global map keyed by
-// *pflag.Flag with no removal path, so registrations made for a *cobra.Command
-// outlive the command itself. Skip registration when the current invocation
-// will not serve a completion request.
-var flagCompletionsDisabled atomic.Bool
-
-// SetFlagCompletionsDisabled switches RegisterFlagCompletion between
-// registering and no-op. Typically set once at process start.
-func SetFlagCompletionsDisabled(disabled bool) {
-	flagCompletionsDisabled.Store(disabled)
-}
-
-// FlagCompletionsDisabled reports the current switch state.
-func FlagCompletionsDisabled() bool {
-	return flagCompletionsDisabled.Load()
-}
-
-// RegisterFlagCompletion wraps (*cobra.Command).RegisterFlagCompletionFunc
-// and honors the package switch. The underlying error is swallowed to match
-// the `_ = cmd.RegisterFlagCompletionFunc(...)` style already used here.
-func RegisterFlagCompletion(cmd *cobra.Command, flagName string, fn cobra.CompletionFunc) {
-	if flagCompletionsDisabled.Load() {
-		return
-	}
-	_ = cmd.RegisterFlagCompletionFunc(flagName, fn)
-}
--- a/internal/cmdutil/completion_test.go
+++ b/internal/cmdutil/completion_test.go
@@ -1,78 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package cmdutil
-
-import (
-	"runtime"
-	"sync/atomic"
-	"testing"
-	"time"
-
-	"github.com/spf13/cobra"
-)
-
-func TestSetFlagCompletionsDisabled_RoundTrip(t *testing.T) {
-	t.Cleanup(func() { SetFlagCompletionsDisabled(false) })
-
-	if FlagCompletionsDisabled() {
-		t.Fatal("expected default false")
-	}
-	SetFlagCompletionsDisabled(true)
-	if !FlagCompletionsDisabled() {
-		t.Fatal("expected true after Set(true)")
-	}
-	SetFlagCompletionsDisabled(false)
-	if FlagCompletionsDisabled() {
-		t.Fatal("expected false after Set(false)")
-	}
-}
-
-// When disabled, a *cobra.Command must be collectable after the caller drops
-// its reference — i.e. the wrapper did not touch cobra's global map.
-func TestRegisterFlagCompletion_Disabled_DoesNotRetainCommand(t *testing.T) {
-	SetFlagCompletionsDisabled(true)
-	t.Cleanup(func() { SetFlagCompletionsDisabled(false) })
-
-	const N = 5
-	var collected atomic.Int32
-	func() {
-		for range N {
-			cmd := &cobra.Command{Use: "x"}
-			cmd.Flags().String("foo", "", "")
-			RegisterFlagCompletion(cmd, "foo", func(_ *cobra.Command, _ []string, _ string) ([]cobra.Completion, cobra.ShellCompDirective) {
-				return nil, cobra.ShellCompDirectiveNoFileComp
-			})
-			runtime.SetFinalizer(cmd, func(_ *cobra.Command) { collected.Add(1) })
-		}
-	}()
-	// Finalizers run on a dedicated goroutine after GC; loop to give it time.
-	for range 30 {
-		runtime.GC()
-		time.Sleep(20 * time.Millisecond)
-	}
-	if got := collected.Load(); int(got) != N {
-		t.Fatalf("expected %d *cobra.Command finalizers to fire when completions disabled, got %d", N, got)
-	}
-}
-
-// When enabled, the registered completion must be reachable via cobra.
-func TestRegisterFlagCompletion_Enabled_DoesRegister(t *testing.T) {
-	SetFlagCompletionsDisabled(false)
-
-	cmd := &cobra.Command{Use: "x"}
-	cmd.Flags().String("foo", "", "")
-	want := []cobra.Completion{"a", "b"}
-	RegisterFlagCompletion(cmd, "foo", func(_ *cobra.Command, _ []string, _ string) ([]cobra.Completion, cobra.ShellCompDirective) {
-		return want, cobra.ShellCompDirectiveNoFileComp
-	})
-
-	fn, ok := cmd.GetFlagCompletionFunc("foo")
-	if !ok {
-		t.Fatal("expected completion func to be registered")
-	}
-	got, _ := fn(cmd, nil, "")
-	if len(got) != 2 || got[0] != "a" || got[1] != "b" {
-		t.Fatalf("unexpected completion result: %v", got)
-	}
-}
--- a/internal/cmdutil/dryrun.go
+++ b/internal/cmdutil/dryrun.go
@@ -215,51 +215,6 @@ func encodeParams(params map[string]interface{}) string {
 	return vals.Encode()
 }

-// PrintDryRunWithFile outputs a dry-run summary for file upload requests.
-// Instead of serializing the Formdata body, it shows file metadata.
-func PrintDryRunWithFile(w io.Writer, request client.RawApiRequest, config *core.CliConfig, format, fileField, filePath string, formFields any) error {
-	dr := NewDryRunAPI()
-	switch request.Method {
-	case "POST":
-		dr.POST(request.URL)
-	case "PUT":
-		dr.PUT(request.URL)
-	case "PATCH":
-		dr.PATCH(request.URL)
-	case "DELETE":
-		dr.DELETE(request.URL)
-	default:
-		dr.GET(request.URL)
-	}
-	if len(request.Params) > 0 {
-		dr.Params(request.Params)
-	}
-	filePathDisplay := filePath
-	if filePathDisplay == "" {
-		filePathDisplay = "<stdin>"
-	}
-	fileInfo := map[string]any{
-		"file": map[string]string{"field": fileField, "path": filePathDisplay},
-	}
-	if formFields != nil {
-		fileInfo["form_fields"] = formFields
-	}
-	fileInfo["options"] = []string{"WithFileUpload"}
-	dr.Body(fileInfo)
-	dr.Set("as", string(request.As))
-	dr.Set("appId", config.AppID)
-	if config.UserOpenId != "" {
-		dr.Set("userOpenId", config.UserOpenId)
-	}
-	fmt.Fprintln(w, "=== Dry Run ===")
-	if format == "pretty" {
-		fmt.Fprint(w, dr.Format())
-	} else {
-		output.PrintJson(w, dr)
-	}
-	return nil
-}
-
 // PrintDryRun outputs a standardised dry-run summary using DryRunAPI.
 // When format is "pretty", outputs human-readable text; otherwise JSON.
 func PrintDryRun(w io.Writer, request client.RawApiRequest, config *core.CliConfig, format string) error {
--- a/internal/cmdutil/factory_default.go
+++ b/internal/cmdutil/factory_default.go
@@ -8,11 +8,13 @@ import (
 	"fmt"
 	"io"
 	"net/http"
+	"os"
 	"sync"
 	"time"

 	lark "github.com/larksuite/oapi-sdk-go/v3"
 	larkcore "github.com/larksuite/oapi-sdk-go/v3/core"
+	"golang.org/x/term"

 	extcred "github.com/larksuite/cli/extension/credential"
 	"github.com/larksuite/cli/extension/fileio"
@@ -32,26 +34,27 @@ import (
 //	Phase 2: Credential (sole data source for account info)
 //	Phase 3: Config derived from Credential
 //	Phase 4: LarkClient derived from Credential
-func NewDefault(streams *IOStreams, inv InvocationContext) *Factory {
-	if streams == nil {
-		streams = SystemIO()
-	}
+func NewDefault(inv InvocationContext) *Factory {
 	f := &Factory{
 		Keychain:   keychain.Default(),
 		Invocation: inv,
-		IOStreams:  streams,
+	}
+	f.IOStreams = &IOStreams{
+		In:         os.Stdin,
+		Out:        os.Stdout,
+		ErrOut:     os.Stderr,
+		IsTerminal: term.IsTerminal(int(os.Stdin.Fd())),
 	}

 	// Phase 0: FileIO provider (no dependency)
 	f.FileIOProvider = fileio.GetProvider()

 	// Phase 1: HttpClient (no credential dependency)
-	f.HttpClient = cachedHttpClientFunc(f)
+	f.HttpClient = cachedHttpClientFunc()

 	// Phase 2: Credential (sole data source)
-	// Keychain is read via closure so callers can replace f.Keychain after construction.
 	f.Credential = buildCredentialProvider(credentialDeps{
-		Keychain:   func() keychain.KeychainAccess { return f.Keychain },
+		Keychain:   f.Keychain,
 		Profile:    inv.Profile,
 		HttpClient: f.HttpClient,
 		ErrOut:     f.IOStreams.ErrOut,
@@ -90,9 +93,9 @@ func safeRedirectPolicy(req *http.Request, via []*http.Request) error {
 	return nil
 }

-func cachedHttpClientFunc(f *Factory) func() (*http.Client, error) {
+func cachedHttpClientFunc() func() (*http.Client, error) {
 	return sync.OnceValues(func() (*http.Client, error) {
-		util.WarnIfProxied(f.IOStreams.ErrOut)
+		util.WarnIfProxied(os.Stderr)

 		var transport http.RoundTripper = util.NewBaseTransport()
 		transport = &RetryTransport{Base: transport}
@@ -119,7 +122,7 @@ func cachedLarkClientFunc(f *Factory) func() (*lark.Client, error) {
 			lark.WithLogLevel(larkcore.LogLevelError),
 			lark.WithHeaders(BaseSecurityHeaders()),
 		}
-		util.WarnIfProxied(f.IOStreams.ErrOut)
+		util.WarnIfProxied(os.Stderr)
 		opts = append(opts, lark.WithHttpClient(&http.Client{
 			Transport:     buildSDKTransport(),
 			CheckRedirect: safeRedirectPolicy,
@@ -139,7 +142,7 @@ func buildSDKTransport() http.RoundTripper {
 }

 type credentialDeps struct {
-	Keychain   func() keychain.KeychainAccess
+	Keychain   keychain.KeychainAccess
 	Profile    string
 	HttpClient func() (*http.Client, error)
 	ErrOut     io.Writer
--- a/internal/cmdutil/factory_default_test.go
+++ b/internal/cmdutil/factory_default_test.go
@@ -63,7 +63,7 @@ func TestNewDefault_InvocationProfileUsedByStrictModeAndConfig(t *testing.T) {
 		t.Fatalf("SaveMultiAppConfig() error = %v", err)
 	}

-	f := NewDefault(nil, InvocationContext{Profile: "target"})
+	f := NewDefault(InvocationContext{Profile: "target"})
 	if got := f.ResolveStrictMode(context.Background()); got != core.StrictModeBot {
 		t.Fatalf("ResolveStrictMode() = %q, want %q", got, core.StrictModeBot)
 	}
@@ -103,7 +103,7 @@ func TestNewDefault_InvocationProfileMissingSticksAcrossEarlyStrictMode(t *testi
 		t.Fatalf("SaveMultiAppConfig() error = %v", err)
 	}

-	f := NewDefault(nil, InvocationContext{Profile: "missing"})
+	f := NewDefault(InvocationContext{Profile: "missing"})
 	if got := f.ResolveStrictMode(context.Background()); got != core.StrictModeOff {
 		t.Fatalf("ResolveStrictMode() = %q, want %q", got, core.StrictModeOff)
 	}
@@ -144,7 +144,7 @@ func TestNewDefault_ResolveAs_UsesDefaultAsFromEnvAccount(t *testing.T) {
 	t.Setenv(envvars.CliTenantAccessToken, "")
 	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())

-	f := NewDefault(nil, InvocationContext{})
+	f := NewDefault(InvocationContext{})
 	cmd := newCmdWithAsFlag("auto", false)

 	got := f.ResolveAs(context.Background(), cmd, "auto")
@@ -164,7 +164,7 @@ func TestNewDefault_ConfigReturnsCliConfigCopyOfCredentialAccount(t *testing.T)
 	t.Setenv(envvars.CliTenantAccessToken, "")
 	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())

-	f := NewDefault(nil, InvocationContext{})
+	f := NewDefault(InvocationContext{})

 	acct, err := f.Credential.ResolveAccount(context.Background())
 	if err != nil {
@@ -189,7 +189,7 @@ func TestNewDefault_ConfigUsesRuntimePlaceholderForTokenOnlyEnvAccount(t *testin
 	t.Setenv(envvars.CliTenantAccessToken, "")
 	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())

-	f := NewDefault(nil, InvocationContext{})
+	f := NewDefault(InvocationContext{})

 	acct, err := f.Credential.ResolveAccount(context.Background())
 	if err != nil {
@@ -217,7 +217,7 @@ func TestNewDefault_FileIOProviderDoesNotResolveDuringInitialization(t *testing.
 	fileio.Register(provider)
 	t.Cleanup(func() { fileio.Register(prev) })

-	f := NewDefault(nil, InvocationContext{})
+	f := NewDefault(InvocationContext{})
 	if f.FileIOProvider != provider {
 		t.Fatalf("NewDefault() provider = %T, want %T", f.FileIOProvider, provider)
 	}
--- a/internal/cmdutil/factory_http_test.go
+++ b/internal/cmdutil/factory_http_test.go
@@ -4,12 +4,11 @@
 package cmdutil

 import (
-	"io"
 	"testing"
 )

 func TestCachedHttpClientFunc_ReturnsSameInstance(t *testing.T) {
-	fn := cachedHttpClientFunc(&Factory{IOStreams: &IOStreams{ErrOut: io.Discard}})
+	fn := cachedHttpClientFunc()

 	c1, err := fn()
 	if err != nil {
@@ -29,7 +28,7 @@ func TestCachedHttpClientFunc_ReturnsSameInstance(t *testing.T) {
 }

 func TestCachedHttpClientFunc_HasTimeout(t *testing.T) {
-	fn := cachedHttpClientFunc(&Factory{IOStreams: &IOStreams{ErrOut: io.Discard}})
+	fn := cachedHttpClientFunc()
 	c, _ := fn()
 	if c.Timeout == 0 {
 		t.Error("expected non-zero timeout")
@@ -37,7 +36,7 @@ func TestCachedHttpClientFunc_HasTimeout(t *testing.T) {
 }

 func TestCachedHttpClientFunc_HasRedirectPolicy(t *testing.T) {
-	fn := cachedHttpClientFunc(&Factory{IOStreams: &IOStreams{ErrOut: io.Discard}})
+	fn := cachedHttpClientFunc()
 	c, _ := fn()
 	if c.CheckRedirect == nil {
 		t.Error("expected CheckRedirect to be set (safeRedirectPolicy)")
--- a/internal/cmdutil/fileupload.go
+++ b/internal/cmdutil/fileupload.go
@@ -1,144 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package cmdutil
-
-import (
-	"bytes"
-	"fmt"
-	"io"
-	"strconv"
-	"strings"
-
-	"github.com/larksuite/cli/extension/fileio"
-	"github.com/larksuite/cli/internal/output"
-	"github.com/larksuite/cli/internal/registry"
-	larkcore "github.com/larksuite/oapi-sdk-go/v3/core"
-)
-
-// DetectFileFields returns field names with type "file" in the method's requestBody.
-func DetectFileFields(method map[string]interface{}) []string {
-	rb, _ := method["requestBody"].(map[string]interface{})
-	var fields []string
-	for name, field := range rb {
-		f, _ := field.(map[string]interface{})
-		if registry.GetStrFromMap(f, "type") == "file" {
-			fields = append(fields, name)
-		}
-	}
-	return fields
-}
-
-// ParseFileFlag parses a --file flag value into its components.
-// The format is either "path" or "field=path". When no explicit "field="
-// prefix is present, defaultField is used as the field name.
-// A path of "-" indicates stdin; in that case filePath is empty and isStdin is true.
-func ParseFileFlag(raw, defaultField string) (fieldName, filePath string, isStdin bool) {
-	if idx := strings.IndexByte(raw, '='); idx > 0 {
-		fieldName = raw[:idx]
-		filePath = raw[idx+1:]
-	} else {
-		fieldName = defaultField
-		filePath = raw
-	}
-	if filePath == "-" {
-		return fieldName, "", true
-	}
-	return fieldName, filePath, false
-}
-
-// ValidateFileFlag checks mutual exclusion rules for the --file flag.
-// Returns nil if file is empty (flag not provided).
-func ValidateFileFlag(file, params, data, outputPath string, pageAll bool, httpMethod string) error {
-	if file == "" {
-		return nil
-	}
-
-	_, filePath, isStdin := ParseFileFlag(file, "file")
-	if !isStdin && filePath == "" {
-		return output.ErrValidation("--file: empty file path")
-	}
-
-	if outputPath != "" {
-		return output.ErrValidation("--file and --output are mutually exclusive")
-	}
-	if pageAll {
-		return output.ErrValidation("--file and --page-all are mutually exclusive")
-	}
-	if isStdin && data == "-" {
-		return output.ErrValidation("--file and --data cannot both read from stdin")
-	}
-	if isStdin && params == "-" {
-		return output.ErrValidation("--file and --params cannot both read from stdin")
-	}
-
-	switch httpMethod {
-	case "POST", "PUT", "PATCH", "DELETE":
-	default:
-		return output.ErrValidation("--file requires POST, PUT, PATCH, or DELETE method")
-	}
-
-	return nil
-}
-
-// FileUploadMeta holds file upload metadata for dry-run display.
-// Returned by request builders when dry-run mode skips actual file reading.
-type FileUploadMeta struct {
-	FieldName  string
-	FilePath   string
-	FormFields any
-}
-
-// BuildFormdata constructs a multipart form data payload for file upload.
-// If isStdin is true, the file content is read from stdin.
-// Top-level keys from dataJSON are added as text form fields.
-func BuildFormdata(fileIO fileio.FileIO, fieldName, filePath string, isStdin bool, stdin io.Reader, dataJSON any) (*larkcore.Formdata, error) {
-	fd := larkcore.NewFormdata()
-
-	if isStdin {
-		if stdin == nil {
-			return nil, output.ErrValidation("--file: stdin is not available")
-		}
-		data, err := io.ReadAll(stdin)
-		if err != nil {
-			return nil, output.ErrValidation("--file: failed to read stdin: %v", err)
-		}
-		if len(data) == 0 {
-			return nil, output.ErrValidation("--file: stdin is empty")
-		}
-		fd.AddFile(fieldName, bytes.NewReader(data))
-	} else {
-		f, err := fileIO.Open(filePath)
-		if err != nil {
-			return nil, output.ErrValidation("cannot open file: %s", filePath)
-		}
-		defer f.Close()
-		data, err := io.ReadAll(f)
-		if err != nil {
-			return nil, output.ErrValidation("--file: failed to read %s: %v", filePath, err)
-		}
-		fd.AddFile(fieldName, bytes.NewReader(data))
-	}
-
-	// Add top-level JSON keys as text form fields.
-	if m, ok := dataJSON.(map[string]any); ok {
-		for k, v := range m {
-			fd.AddField(k, formatFormFieldValue(v))
-		}
-	}
-
-	return fd, nil
-}
-
-// formatFormFieldValue renders a JSON-unmarshalled value as a multipart form
-// field string. float64 is handled specially: fmt's default %v/%g switches to
-// scientific notation for values >= ~1e6 (e.g. "1.185356e+06"), which some
-// backends reject when parsing the field as an integer. Use decimal notation
-// instead so size / block_num / offset-style numeric fields round-trip cleanly.
-// All other types fall through to %v.
-func formatFormFieldValue(v any) string {
-	if n, ok := v.(float64); ok {
-		return strconv.FormatFloat(n, 'f', -1, 64)
-	}
-	return fmt.Sprintf("%v", v)
-}
--- a/internal/cmdutil/fileupload_test.go
+++ b/internal/cmdutil/fileupload_test.go
@@ -1,375 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package cmdutil
-
-import (
-	"bytes"
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-
-	"github.com/larksuite/cli/internal/vfs/localfileio"
-)
-
-func TestParseFileFlag(t *testing.T) {
-	tests := []struct {
-		name         string
-		raw          string
-		defaultField string
-		wantField    string
-		wantPath     string
-		wantStdin    bool
-	}{
-		{
-			name:         "simple filename uses default field",
-			raw:          "photo.jpg",
-			defaultField: "file",
-			wantField:    "file",
-			wantPath:     "photo.jpg",
-			wantStdin:    false,
-		},
-		{
-			name:         "simple filename with custom default",
-			raw:          "photo.jpg",
-			defaultField: "image",
-			wantField:    "image",
-			wantPath:     "photo.jpg",
-			wantStdin:    false,
-		},
-		{
-			name:         "explicit field prefix",
-			raw:          "image=photo.jpg",
-			defaultField: "file",
-			wantField:    "image",
-			wantPath:     "photo.jpg",
-			wantStdin:    false,
-		},
-		{
-			name:         "stdin bare",
-			raw:          "-",
-			defaultField: "file",
-			wantField:    "file",
-			wantPath:     "",
-			wantStdin:    true,
-		},
-		{
-			name:         "stdin with field prefix",
-			raw:          "image=-",
-			defaultField: "file",
-			wantField:    "image",
-			wantPath:     "",
-			wantStdin:    true,
-		},
-		{
-			name:         "path with equals sign (only first equals splits)",
-			raw:          "field=path/to/file=1.jpg",
-			defaultField: "file",
-			wantField:    "field",
-			wantPath:     "path/to/file=1.jpg",
-			wantStdin:    false,
-		},
-		{
-			name:         "absolute path no prefix",
-			raw:          "/tmp/photo.jpg",
-			defaultField: "file",
-			wantField:    "file",
-			wantPath:     "/tmp/photo.jpg",
-			wantStdin:    false,
-		},
-		{
-			name:         "absolute path with field prefix",
-			raw:          "image=/tmp/photo.jpg",
-			defaultField: "file",
-			wantField:    "image",
-			wantPath:     "/tmp/photo.jpg",
-			wantStdin:    false,
-		},
-		{
-			name:         "empty field prefix falls through to default",
-			raw:          "=photo.jpg",
-			defaultField: "file",
-			wantField:    "file",
-			wantPath:     "=photo.jpg",
-			wantStdin:    false,
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			field, path, isStdin := ParseFileFlag(tt.raw, tt.defaultField)
-			if field != tt.wantField {
-				t.Errorf("field = %q, want %q", field, tt.wantField)
-			}
-			if path != tt.wantPath {
-				t.Errorf("path = %q, want %q", path, tt.wantPath)
-			}
-			if isStdin != tt.wantStdin {
-				t.Errorf("isStdin = %v, want %v", isStdin, tt.wantStdin)
-			}
-		})
-	}
-}
-
-func TestValidateFileFlag(t *testing.T) {
-	tests := []struct {
-		name       string
-		file       string
-		params     string
-		data       string
-		outputPath string
-		pageAll    bool
-		httpMethod string
-		wantErr    string // empty means no error
-	}{
-		{
-			name:       "empty file is valid",
-			file:       "",
-			httpMethod: "GET",
-			wantErr:    "",
-		},
-		{
-			name:       "empty file path",
-			file:       "field=",
-			httpMethod: "POST",
-			wantErr:    "--file: empty file path",
-		},
-		{
-			name:       "file with output",
-			file:       "photo.jpg",
-			outputPath: "out.json",
-			httpMethod: "POST",
-			wantErr:    "--file and --output are mutually exclusive",
-		},
-		{
-			name:       "file with page-all",
-			file:       "photo.jpg",
-			pageAll:    true,
-			httpMethod: "POST",
-			wantErr:    "--file and --page-all are mutually exclusive",
-		},
-		{
-			name:       "stdin file with stdin data",
-			file:       "-",
-			data:       "-",
-			httpMethod: "POST",
-			wantErr:    "--file and --data cannot both read from stdin",
-		},
-		{
-			name:       "stdin file with stdin params",
-			file:       "-",
-			params:     "-",
-			httpMethod: "POST",
-			wantErr:    "--file and --params cannot both read from stdin",
-		},
-		{
-			name:       "file with GET method",
-			file:       "photo.jpg",
-			httpMethod: "GET",
-			wantErr:    "--file requires POST, PUT, PATCH, or DELETE method",
-		},
-		{
-			name:       "file with POST method",
-			file:       "photo.jpg",
-			httpMethod: "POST",
-			wantErr:    "",
-		},
-		{
-			name:       "file with PUT method",
-			file:       "photo.jpg",
-			httpMethod: "PUT",
-			wantErr:    "",
-		},
-		{
-			name:       "file with PATCH method",
-			file:       "photo.jpg",
-			httpMethod: "PATCH",
-			wantErr:    "",
-		},
-		{
-			name:       "file with DELETE method",
-			file:       "photo.jpg",
-			httpMethod: "DELETE",
-			wantErr:    "",
-		},
-		{
-			name:       "stdin with field prefix and data stdin",
-			file:       "image=-",
-			data:       "-",
-			httpMethod: "POST",
-			wantErr:    "--file and --data cannot both read from stdin",
-		},
-		{
-			name:       "stdin with field prefix and params stdin",
-			file:       "image=-",
-			params:     "-",
-			httpMethod: "POST",
-			wantErr:    "--file and --params cannot both read from stdin",
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			err := ValidateFileFlag(tt.file, tt.params, tt.data, tt.outputPath, tt.pageAll, tt.httpMethod)
-			if tt.wantErr == "" {
-				if err != nil {
-					t.Errorf("unexpected error: %v", err)
-				}
-				return
-			}
-			if err == nil {
-				t.Fatalf("expected error containing %q, got nil", tt.wantErr)
-			}
-			if !strings.Contains(err.Error(), tt.wantErr) {
-				t.Errorf("error = %q, want containing %q", err.Error(), tt.wantErr)
-			}
-		})
-	}
-}
-
-func TestBuildFormdata(t *testing.T) {
-	fio := &localfileio.LocalFileIO{}
-
-	t.Run("stdin success", func(t *testing.T) {
-		stdin := bytes.NewReader([]byte("file-content-here"))
-		fd, err := BuildFormdata(fio, "file", "", true, stdin, nil)
-		if err != nil {
-			t.Fatalf("unexpected error: %v", err)
-		}
-		if fd == nil {
-			t.Fatal("expected non-nil Formdata")
-		}
-	})
-
-	t.Run("stdin nil reader", func(t *testing.T) {
-		_, err := BuildFormdata(fio, "file", "", true, nil, nil)
-		if err == nil {
-			t.Fatal("expected error for nil stdin")
-		}
-		if !strings.Contains(err.Error(), "stdin is not available") {
-			t.Errorf("error = %q, want containing %q", err.Error(), "stdin is not available")
-		}
-	})
-
-	t.Run("stdin empty", func(t *testing.T) {
-		stdin := bytes.NewReader([]byte{})
-		_, err := BuildFormdata(fio, "file", "", true, stdin, nil)
-		if err == nil {
-			t.Fatal("expected error for empty stdin")
-		}
-		if !strings.Contains(err.Error(), "stdin is empty") {
-			t.Errorf("error = %q, want containing %q", err.Error(), "stdin is empty")
-		}
-	})
-
-	t.Run("file open success", func(t *testing.T) {
-		dir := t.TempDir()
-		TestChdir(t, dir)
-
-		if err := os.WriteFile(filepath.Join(dir, "test.txt"), []byte("hello"), 0600); err != nil {
-			t.Fatalf("failed to create test file: %v", err)
-		}
-
-		fd, err := BuildFormdata(fio, "photo", "test.txt", false, nil, nil)
-		if err != nil {
-			t.Fatalf("unexpected error: %v", err)
-		}
-		if fd == nil {
-			t.Fatal("expected non-nil Formdata")
-		}
-	})
-
-	t.Run("file not found", func(t *testing.T) {
-		dir := t.TempDir()
-		TestChdir(t, dir)
-
-		_, err := BuildFormdata(fio, "file", "nonexistent.txt", false, nil, nil)
-		if err == nil {
-			t.Fatal("expected error for missing file")
-		}
-		if !strings.Contains(err.Error(), "cannot open file:") {
-			t.Errorf("error = %q, want containing %q", err.Error(), "cannot open file:")
-		}
-	})
-
-	t.Run("dataJSON fields added", func(t *testing.T) {
-		dir := t.TempDir()
-		TestChdir(t, dir)
-
-		if err := os.WriteFile(filepath.Join(dir, "upload.bin"), []byte("data"), 0600); err != nil {
-			t.Fatalf("failed to create test file: %v", err)
-		}
-
-		dataJSON := map[string]any{
-			"file_name":   "report.pdf",
-			"parent_type": "doc_image",
-			"size":        1024,
-		}
-
-		fd, err := BuildFormdata(fio, "file", "upload.bin", false, nil, dataJSON)
-		if err != nil {
-			t.Fatalf("unexpected error: %v", err)
-		}
-		if fd == nil {
-			t.Fatal("expected non-nil Formdata")
-		}
-	})
-
-	t.Run("dataJSON nil is fine", func(t *testing.T) {
-		stdin := bytes.NewReader([]byte("content"))
-		fd, err := BuildFormdata(fio, "file", "", true, stdin, nil)
-		if err != nil {
-			t.Fatalf("unexpected error: %v", err)
-		}
-		if fd == nil {
-			t.Fatal("expected non-nil Formdata")
-		}
-	})
-
-	t.Run("dataJSON non-map is ignored", func(t *testing.T) {
-		stdin := bytes.NewReader([]byte("content"))
-		fd, err := BuildFormdata(fio, "file", "", true, stdin, "not-a-map")
-		if err != nil {
-			t.Fatalf("unexpected error: %v", err)
-		}
-		if fd == nil {
-			t.Fatal("expected non-nil Formdata")
-		}
-	})
-}
-
-// TestFormatFormFieldValue locks in the fix for the float64 -> scientific
-// notation bug. JSON numbers unmarshal to float64, and fmt's default %v for
-// float64 delegates to %g which switches to scientific notation at ~1e6
-// (e.g. 1185356 -> "1.185356e+06"). Backends that parse the form field as an
-// integer reject that, surfacing as a generic "params error".
-func TestFormatFormFieldValue(t *testing.T) {
-	t.Parallel()
-
-	tests := []struct {
-		name string
-		in   any
-		want string
-	}{
-		{"float64 large integer avoids scientific", float64(1185356), "1185356"},
-		{"float64 below scientific threshold", float64(358934), "358934"},
-		{"float64 zero", float64(0), "0"},
-		{"float64 huge", float64(20 * 1024 * 1024), "20971520"},
-		{"float64 negative", float64(-42), "-42"},
-		{"float64 fractional preserved", float64(3.14), "3.14"},
-		{"string pass-through", "hello", "hello"},
-		{"bool true", true, "true"},
-		{"int via %v", 42, "42"},
-		{"int64 via %v", int64(9007199254740992), "9007199254740992"},
-	}
-
-	for _, temp := range tests {
-		tt := temp
-		t.Run(tt.name, func(t *testing.T) {
-			t.Parallel()
-			got := formatFormFieldValue(tt.in)
-			if got != tt.want {
-				t.Fatalf("formatFormFieldValue(%v) = %q, want %q", tt.in, got, tt.want)
-			}
-		})
-	}
-}
--- a/internal/cmdutil/iostreams.go
+++ b/internal/cmdutil/iostreams.go
@@ -3,12 +3,7 @@

 package cmdutil

-import (
-	"io"
-	"os"
-
-	"golang.org/x/term"
-)
+import "io"

 // IOStreams provides the standard input/output/error streams.
 // Commands should use these instead of os.Stdin/Stdout/Stderr
@@ -19,13 +14,3 @@ type IOStreams struct {
 	ErrOut     io.Writer
 	IsTerminal bool
 }
-
-// SystemIO creates an IOStreams wired to the process's standard file descriptors.
-func SystemIO() *IOStreams {
-	return &IOStreams{
-		In:         os.Stdin,                            //nolint:forbidigo // entry point for real stdio
-		Out:        os.Stdout,                           //nolint:forbidigo // entry point for real stdio
-		ErrOut:     os.Stderr,                           //nolint:forbidigo // entry point for real stdio
-		IsTerminal: term.IsTerminal(int(os.Stdin.Fd())), //nolint:forbidigo // need Fd() for terminal check
-	}
-}
--- a/internal/cmdutil/json.go
+++ b/internal/cmdutil/json.go
@@ -5,46 +5,35 @@ package cmdutil

 import (
 	"encoding/json"
-	"io"

 	"github.com/larksuite/cli/internal/output"
 )

 // ParseOptionalBody parses --data JSON for methods that accept a request body.
-// Supports stdin (-) and single-quote stripping via ResolveInput.
 // Returns (nil, nil) if the method has no body or data is empty.
-func ParseOptionalBody(httpMethod, data string, stdin io.Reader) (interface{}, error) {
+func ParseOptionalBody(httpMethod, data string) (interface{}, error) {
 	switch httpMethod {
 	case "POST", "PUT", "PATCH", "DELETE":
 	default:
 		return nil, nil
 	}
-	resolved, err := ResolveInput(data, stdin)
-	if err != nil {
-		return nil, output.ErrValidation("--data: %s", err)
-	}
-	if resolved == "" {
+	if data == "" {
 		return nil, nil
 	}
 	var body interface{}
-	if err := json.Unmarshal([]byte(resolved), &body); err != nil {
+	if err := json.Unmarshal([]byte(data), &body); err != nil {
 		return nil, output.ErrValidation("--data invalid JSON format")
 	}
 	return body, nil
 }

 // ParseJSONMap parses a JSON string into a map. Returns an empty map if input is empty.
-// Supports stdin (-) and single-quote stripping via ResolveInput.
-func ParseJSONMap(input, label string, stdin io.Reader) (map[string]any, error) {
-	resolved, err := ResolveInput(input, stdin)
-	if err != nil {
-		return nil, output.ErrValidation("%s: %s", label, err)
-	}
-	if resolved == "" {
+func ParseJSONMap(input, label string) (map[string]any, error) {
+	if input == "" {
 		return map[string]any{}, nil
 	}
 	var result map[string]any
-	if err := json.Unmarshal([]byte(resolved), &result); err != nil {
+	if err := json.Unmarshal([]byte(input), &result); err != nil {
 		return nil, output.ErrValidation("%s invalid format, expected JSON object", label)
 	}
 	return result, nil
--- a/internal/cmdutil/json_test.go
+++ b/internal/cmdutil/json_test.go
@@ -23,7 +23,7 @@ func TestParseOptionalBody(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			got, err := ParseOptionalBody(tt.method, tt.data, nil)
+			got, err := ParseOptionalBody(tt.method, tt.data)
 			if (err != nil) != tt.wantErr {
 				t.Errorf("ParseOptionalBody() error = %v, wantErr %v", err, tt.wantErr)
 				return
@@ -53,7 +53,7 @@ func TestParseJSONMap(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			got, err := ParseJSONMap(tt.input, tt.label, nil)
+			got, err := ParseJSONMap(tt.input, tt.label)
 			if (err != nil) != tt.wantErr {
 				t.Errorf("ParseJSONMap() error = %v, wantErr %v", err, tt.wantErr)
 				return
--- a/internal/cmdutil/resolve.go
+++ b/internal/cmdutil/resolve.go
@@ -1,46 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package cmdutil
-
-import (
-	"fmt"
-	"io"
-	"strings"
-)
-
-// ResolveInput resolves special input conventions for a raw flag value:
-//   - "-"      → read all bytes from stdin
-//   - "'...'"  → strip surrounding single quotes (Windows cmd.exe compatibility)
-//   - other    → return as-is
-//
-// This allows callers to bypass shell quoting issues (especially on Windows
-// PowerShell) by piping JSON via stdin instead of command-line arguments.
-func ResolveInput(raw string, stdin io.Reader) (string, error) {
-	if raw == "" {
-		return "", nil
-	}
-
-	// stdin
-	if raw == "-" {
-		if stdin == nil {
-			return "", fmt.Errorf("stdin is not available")
-		}
-		data, err := io.ReadAll(stdin)
-		if err != nil {
-			return "", fmt.Errorf("failed to read stdin: %w", err)
-		}
-		s := strings.TrimSpace(string(data))
-		if s == "" {
-			return "", fmt.Errorf("stdin is empty (did you forget to pipe input?)")
-		}
-		return s, nil
-	}
-
-	// strip surrounding single quotes (Windows cmd.exe passes them literally)
-	if len(raw) >= 2 && raw[0] == '\'' && raw[len(raw)-1] == '\'' {
-		raw = raw[1 : len(raw)-1]
-	}
-
-	return raw, nil
-}
--- a/internal/cmdutil/resolve_test.go
+++ b/internal/cmdutil/resolve_test.go
@@ -1,189 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package cmdutil
-
-import (
-	"fmt"
-	"strings"
-	"testing"
-)
-
-func TestResolveInput_Stdin(t *testing.T) {
-	got, err := ResolveInput("-", strings.NewReader(`{"key":"value"}`))
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if got != `{"key":"value"}` {
-		t.Errorf("got %q, want %q", got, `{"key":"value"}`)
-	}
-}
-
-func TestResolveInput_Stdin_TrimNewline(t *testing.T) {
-	got, err := ResolveInput("-", strings.NewReader("{\"k\":\"v\"}\n"))
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if got != `{"k":"v"}` {
-		t.Errorf("got %q, want %q", got, `{"k":"v"}`)
-	}
-}
-
-func TestResolveInput_Stdin_Empty(t *testing.T) {
-	_, err := ResolveInput("-", strings.NewReader(""))
-	if err == nil {
-		t.Error("expected error for empty stdin")
-	}
-	if !strings.Contains(err.Error(), "stdin is empty") {
-		t.Errorf("expected 'stdin is empty' error, got: %v", err)
-	}
-}
-
-type errorReader struct{}
-
-func (errorReader) Read([]byte) (int, error) { return 0, fmt.Errorf("disk failure") }
-
-func TestResolveInput_Stdin_ReadError(t *testing.T) {
-	_, err := ResolveInput("-", errorReader{})
-	if err == nil || !strings.Contains(err.Error(), "failed to read stdin") {
-		t.Errorf("expected read error, got: %v", err)
-	}
-}
-
-func TestResolveInput_Stdin_WhitespaceOnly(t *testing.T) {
-	_, err := ResolveInput("-", strings.NewReader("  \n\t\n  "))
-	if err == nil {
-		t.Error("expected error for whitespace-only stdin")
-	}
-}
-
-func TestResolveInput_Stdin_Nil(t *testing.T) {
-	_, err := ResolveInput("-", nil)
-	if err == nil {
-		t.Error("expected error for nil stdin")
-	}
-}
-
-func TestResolveInput_StripSingleQuotes(t *testing.T) {
-	tests := []struct {
-		name string
-		in   string
-		want string
-	}{
-		{"cmd.exe JSON", `'{"key":"value"}'`, `{"key":"value"}`},
-		{"cmd.exe empty", `'{}'`, `{}`},
-		{"no quotes", `{"key":"value"}`, `{"key":"value"}`},
-		{"just quotes", `''`, ``},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			got, err := ResolveInput(tt.in, nil)
-			if err != nil {
-				t.Fatalf("unexpected error: %v", err)
-			}
-			if got != tt.want {
-				t.Errorf("got %q, want %q", got, tt.want)
-			}
-		})
-	}
-}
-
-func TestResolveInput_Empty(t *testing.T) {
-	got, err := ResolveInput("", nil)
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if got != "" {
-		t.Errorf("got %q, want empty", got)
-	}
-}
-
-func TestResolveInput_PlainValue(t *testing.T) {
-	got, err := ResolveInput(`{"already":"valid"}`, nil)
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if got != `{"already":"valid"}` {
-		t.Errorf("got %q, want %q", got, `{"already":"valid"}`)
-	}
-}
-
-func TestResolveInput_AtPrefixPassedThrough(t *testing.T) {
-	// Without @file support, @-prefixed values are passed as-is
-	got, err := ResolveInput("@something", nil)
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if got != "@something" {
-		t.Errorf("got %q, want %q", got, "@something")
-	}
-}
-
-// Integration: ResolveInput flows through ParseJSONMap correctly.
-func TestParseJSONMap_WithStdin(t *testing.T) {
-	stdin := strings.NewReader(`{"message_id":"om_xxx","user_id_type":"open_id"}`)
-	got, err := ParseJSONMap("-", "--params", stdin)
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if len(got) != 2 {
-		t.Errorf("got %d keys, want 2", len(got))
-	}
-}
-
-func TestParseJSONMap_StripSingleQuotes_CmdExe(t *testing.T) {
-	got, err := ParseJSONMap(`'{"key":"value"}'`, "--params", nil)
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if got["key"] != "value" {
-		t.Errorf("got %v, want key=value", got)
-	}
-}
-
-func TestParseOptionalBody_WithStdin(t *testing.T) {
-	stdin := strings.NewReader(`{"text":"hello"}`)
-	got, err := ParseOptionalBody("POST", "-", stdin)
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if got == nil {
-		t.Fatal("expected non-nil body")
-	}
-	m, ok := got.(map[string]interface{})
-	if !ok {
-		t.Fatalf("expected map, got %T", got)
-	}
-	if m["text"] != "hello" {
-		t.Errorf("got %v, want text=hello", m)
-	}
-}
-
-// Simulates exact strings Go receives on different Windows shells.
-func TestParseJSONMap_WindowsShellScenarios(t *testing.T) {
-	tests := []struct {
-		name    string
-		input   string
-		wantLen int
-		wantErr bool
-	}{
-		{"bash: normal JSON", `{"a":"1","b":"2"}`, 2, false},
-		{"cmd.exe: single-quoted", `'{"a":"1","b":"2"}'`, 2, false}, // strip ' fix
-		{"PS 5.x: mangled", `{a:1,b:2}`, 0, true},                   // unrecoverable
-		{"PS 5.x: empty JSON OK", `{}`, 0, false},                   // no inner "
-		{"PS 7.3+: normal JSON", `{"a":"1"}`, 1, false},             // already fixed
-		{"PS escaped: correct", `{"a":"1"}`, 1, false},              // after CommandLineToArgvW
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			got, err := ParseJSONMap(tt.input, "--params", nil)
-			if (err != nil) != tt.wantErr {
-				t.Errorf("error = %v, wantErr %v", err, tt.wantErr)
-				return
-			}
-			if !tt.wantErr && len(got) != tt.wantLen {
-				t.Errorf("got %d keys, want %d", len(got), tt.wantLen)
-			}
-		})
-	}
-}
--- a/internal/core/config.go
+++ b/internal/core/config.go
@@ -163,16 +163,6 @@ type CliConfig struct {
 	SupportedIdentities uint8 `json:"-"` // bitflag: 1=user, 2=bot; set by credential provider
 }

-// identityBotBit is the bit flag for bot identity in SupportedIdentities.
-// Must match extension/credential.SupportsBot.
-const identityBotBit uint8 = 1 << 1
-
-// CanBot reports whether the current credential context supports bot identity.
-// Returns true when SupportedIdentities is unset (0, unknown) or includes the bot bit.
-func (c *CliConfig) CanBot() bool {
-	return c.SupportedIdentities == 0 || c.SupportedIdentities&identityBotBit != 0
-}
-
 // GetConfigDir returns the config directory path.
 // If the home directory cannot be determined, it falls back to a relative path
 // and prints a warning to stderr.
@@ -250,12 +240,6 @@ func ResolveConfigFromMulti(raw *MultiAppConfig, kc keychain.KeychainAccess, pro
 		}
 	}

-	if err := ValidateSecretKeyMatch(app.AppId, app.AppSecret); err != nil {
-		return nil, &ConfigError{Code: 2, Type: "config",
-			Message: "appId and appSecret keychain key are out of sync",
-			Hint:    err.Error()}
-	}
-
 	secret, err := ResolveSecretInput(app.AppSecret, kc)
 	if err != nil {
 		// If the error comes from the keychain, it will already be wrapped as an ExitError.
--- a/internal/core/config_test.go
+++ b/internal/core/config_test.go
@@ -5,21 +5,9 @@ package core

 import (
 	"encoding/json"
-	"errors"
 	"testing"
-
-	"github.com/larksuite/cli/internal/keychain"
 )

-// stubKeychain is a minimal KeychainAccess that always returns ErrNotFound.
-type stubKeychain struct{}
-
-func (stubKeychain) Get(service, account string) (string, error) {
-	return "", keychain.ErrNotFound
-}
-func (stubKeychain) Set(service, account, value string) error { return nil }
-func (stubKeychain) Remove(service, account string) error     { return nil }
-
 func TestAppConfig_LangSerialization(t *testing.T) {
 	app := AppConfig{
 		AppId: "cli_test", AppSecret: PlainSecret("secret"),
@@ -85,85 +73,6 @@ func TestMultiAppConfig_RoundTrip(t *testing.T) {
 	}
 }

-func TestResolveConfigFromMulti_RejectsSecretKeyMismatch(t *testing.T) {
-	raw := &MultiAppConfig{
-		Apps: []AppConfig{
-			{
-				AppId: "cli_new_app",
-				AppSecret: SecretInput{Ref: &SecretRef{
-					Source: "keychain",
-					ID:     "appsecret:cli_old_app",
-				}},
-				Brand: BrandFeishu,
-			},
-		},
-	}
-
-	_, err := ResolveConfigFromMulti(raw, nil, "")
-	if err == nil {
-		t.Fatal("expected error for mismatched appId and appSecret keychain key")
-	}
-	var cfgErr *ConfigError
-	if !errors.As(err, &cfgErr) {
-		t.Fatalf("expected ConfigError, got %T: %v", err, err)
-	}
-	if cfgErr.Hint == "" {
-		t.Error("expected non-empty hint in ConfigError")
-	}
-}
-
-func TestResolveConfigFromMulti_AcceptsPlainSecret(t *testing.T) {
-	raw := &MultiAppConfig{
-		Apps: []AppConfig{
-			{
-				AppId:     "cli_abc",
-				AppSecret: PlainSecret("my-secret"),
-				Brand:     BrandFeishu,
-			},
-		},
-	}
-
-	cfg, err := ResolveConfigFromMulti(raw, nil, "")
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if cfg.AppID != "cli_abc" {
-		t.Errorf("AppID = %q, want %q", cfg.AppID, "cli_abc")
-	}
-}
-
-func TestResolveConfigFromMulti_MatchingKeychainRefPassesValidation(t *testing.T) {
-	// Keychain ref matches appId, so validation passes.
-	// The subsequent ResolveSecretInput will fail (no real keychain),
-	// but that proves the mismatch check itself passed.
-	raw := &MultiAppConfig{
-		Apps: []AppConfig{
-			{
-				AppId: "cli_abc",
-				AppSecret: SecretInput{Ref: &SecretRef{
-					Source: "keychain",
-					ID:     "appsecret:cli_abc",
-				}},
-				Brand: BrandFeishu,
-			},
-		},
-	}
-
-	_, err := ResolveConfigFromMulti(raw, stubKeychain{}, "")
-	if err == nil {
-		// stubKeychain returns ErrNotFound, so we expect a keychain error,
-		// but NOT a mismatch error — that's the point of this test.
-		t.Fatal("expected error (keychain entry not found), got nil")
-	}
-	// The error should come from keychain resolution, NOT from our mismatch check.
-	var cfgErr *ConfigError
-	if errors.As(err, &cfgErr) {
-		if cfgErr.Message == "appId and appSecret keychain key are out of sync" {
-			t.Fatal("error came from mismatch check, but keys should match")
-		}
-	}
-}
-
 func TestResolveConfigFromMulti_DoesNotUseEnvProfileFallback(t *testing.T) {
 	t.Setenv("LARKSUITE_CLI_PROFILE", "missing")

@@ -187,24 +96,3 @@ func TestResolveConfigFromMulti_DoesNotUseEnvProfileFallback(t *testing.T) {
 		t.Fatalf("ResolveConfigFromMulti() profile = %q, want %q", cfg.ProfileName, "active")
 	}
 }
-
-func TestCliConfig_CanBot(t *testing.T) {
-	tests := []struct {
-		name                string
-		supportedIdentities uint8
-		want                bool
-	}{
-		{"unset (0) defaults to true", 0, true},
-		{"user only", 1, false},
-		{"bot only", 2, true},
-		{"both", 3, true},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			cfg := &CliConfig{SupportedIdentities: tt.supportedIdentities}
-			if got := cfg.CanBot(); got != tt.want {
-				t.Errorf("CanBot() = %v, want %v", got, tt.want)
-			}
-		})
-	}
-}
--- a/internal/core/secret_resolve.go
+++ b/internal/core/secret_resolve.go
@@ -52,25 +52,6 @@ func ForStorage(appId string, input SecretInput, kc keychain.KeychainAccess) (Se
 	return SecretInput{Ref: &SecretRef{Source: "keychain", ID: key}}, nil
 }

-// ValidateSecretKeyMatch checks that the appSecret keychain key references the
-// expected appId. This prevents silent mismatches when config.json is edited by
-// hand (e.g. appId changed but appSecret.id still points to the old app).
-// Only applicable when appSecret is a keychain SecretRef; other forms are skipped.
-func ValidateSecretKeyMatch(appId string, secret SecretInput) error {
-	if secret.Ref == nil || secret.Ref.Source != "keychain" {
-		return nil
-	}
-	expected := secretAccountKey(appId)
-	if secret.Ref.ID != expected {
-		return fmt.Errorf(
-			"appSecret keychain key %q does not match appId %q (expected %q); "+
-				"please run `lark-cli config init` to reconfigure",
-			secret.Ref.ID, appId, expected,
-		)
-	}
-	return nil
-}
-
 // RemoveSecretStore cleans up keychain entries when an app is removed.
 // Errors are intentionally ignored — cleanup is best-effort.
 func RemoveSecretStore(input SecretInput, kc keychain.KeychainAccess) {
--- a/internal/core/secret_resolve_test.go
+++ b/internal/core/secret_resolve_test.go
@@ -1,59 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package core
-
-import (
-	"strings"
-	"testing"
-)
-
-func TestValidateSecretKeyMatch_KeychainMatches(t *testing.T) {
-	secret := SecretInput{Ref: &SecretRef{Source: "keychain", ID: "appsecret:cli_abc123"}}
-	if err := ValidateSecretKeyMatch("cli_abc123", secret); err != nil {
-		t.Errorf("expected no error, got: %v", err)
-	}
-}
-
-func TestValidateSecretKeyMatch_KeychainMismatch(t *testing.T) {
-	secret := SecretInput{Ref: &SecretRef{Source: "keychain", ID: "appsecret:cli_old_app"}}
-	err := ValidateSecretKeyMatch("cli_new_app", secret)
-	if err == nil {
-		t.Fatal("expected error for mismatched appId and keychain key")
-	}
-	// Verify the error message contains useful context
-	msg := err.Error()
-	for _, want := range []string{"cli_old_app", "cli_new_app", "appsecret:cli_new_app", "config init"} {
-		if !strings.Contains(msg, want) {
-			t.Errorf("error message missing %q: %s", want, msg)
-		}
-	}
-}
-
-func TestValidateSecretKeyMatch_PlainSecret_Skipped(t *testing.T) {
-	secret := PlainSecret("some-secret")
-	if err := ValidateSecretKeyMatch("cli_abc123", secret); err != nil {
-		t.Errorf("plain secret should be skipped, got: %v", err)
-	}
-}
-
-func TestValidateSecretKeyMatch_FileRef_Skipped(t *testing.T) {
-	secret := SecretInput{Ref: &SecretRef{Source: "file", ID: "/tmp/secret.txt"}}
-	if err := ValidateSecretKeyMatch("cli_abc123", secret); err != nil {
-		t.Errorf("file ref should be skipped, got: %v", err)
-	}
-}
-
-func TestValidateSecretKeyMatch_ZeroValue_Skipped(t *testing.T) {
-	if err := ValidateSecretKeyMatch("cli_abc123", SecretInput{}); err != nil {
-		t.Errorf("zero SecretInput should be skipped, got: %v", err)
-	}
-}
-
-func TestValidateSecretKeyMatch_EmptyAppId_Mismatch(t *testing.T) {
-	secret := SecretInput{Ref: &SecretRef{Source: "keychain", ID: "appsecret:cli_abc123"}}
-	err := ValidateSecretKeyMatch("", secret)
-	if err == nil {
-		t.Fatal("expected error when appId is empty but keychain key references a real app")
-	}
-}
--- a/internal/credential/credential_provider_test.go
+++ b/internal/credential/credential_provider_test.go
@@ -1,6 +1,3 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
 package credential

 import (
--- a/internal/credential/default_provider.go
+++ b/internal/credential/default_provider.go
@@ -21,14 +21,11 @@ import (

 // DefaultAccountProvider resolves account from config.json via keychain.
 type DefaultAccountProvider struct {
-	keychain func() keychain.KeychainAccess
+	keychain keychain.KeychainAccess
 	profile  string
 }

-func NewDefaultAccountProvider(kc func() keychain.KeychainAccess, profile string) *DefaultAccountProvider {
-	if kc == nil {
-		kc = keychain.Default
-	}
+func NewDefaultAccountProvider(kc keychain.KeychainAccess, profile string) *DefaultAccountProvider {
 	return &DefaultAccountProvider{keychain: kc, profile: profile}
 }

@@ -39,7 +36,7 @@ func (p *DefaultAccountProvider) ResolveAccount(ctx context.Context) (*Account,
 		return nil, &core.ConfigError{Code: 2, Type: "config", Message: "not configured", Hint: "run `lark-cli config init --new` in the background. It blocks and outputs a verification URL — retrieve the URL and open it in a browser to complete setup."}
 	}

-	cfg, err := core.ResolveConfigFromMulti(multi, p.keychain(), p.profile)
+	cfg, err := core.ResolveConfigFromMulti(multi, p.keychain, p.profile)
 	if err != nil {
 		return nil, err
 	}
--- a/internal/credential/default_provider_test.go
+++ b/internal/credential/default_provider_test.go
@@ -1,6 +1,3 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
 package credential

 import (
--- a/internal/credential/integration_test.go
+++ b/internal/credential/integration_test.go
@@ -1,6 +1,3 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
 package credential_test

 import (
@@ -12,7 +9,6 @@ import (
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/credential"
 	"github.com/larksuite/cli/internal/envvars"
-	"github.com/larksuite/cli/internal/keychain"
 )

 type noopKC struct{}
@@ -100,7 +96,7 @@ func TestFullChain_ConfigStrictMode(t *testing.T) {
 	}

 	ep := &envprovider.Provider{}
-	defaultAcct := credential.NewDefaultAccountProvider(func() keychain.KeychainAccess { return &noopKC{} }, "")
+	defaultAcct := credential.NewDefaultAccountProvider(&noopKC{}, "")

 	cp := credential.NewCredentialProvider(
 		[]extcred.Provider{ep},
--- a/internal/credential/types.go
+++ b/internal/credential/types.go
@@ -1,6 +1,3 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
 package credential

 import (
--- a/internal/credential/types_test.go
+++ b/internal/credential/types_test.go
@@ -1,6 +1,3 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
 package credential

 import (
--- a/internal/keychain/auth_log.go
+++ b/internal/keychain/auth_log.go
@@ -1,6 +1,3 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
 package keychain

 import (
--- a/internal/keychain/auth_log_test.go
+++ b/internal/keychain/auth_log_test.go
@@ -1,6 +1,3 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
 package keychain

 import (
--- a/internal/keychain/keychain.go
+++ b/internal/keychain/keychain.go
@@ -36,10 +36,10 @@ func wrapError(op string, err error) error {
 	}

 	msg := fmt.Sprintf("keychain %s failed: %v", op, err)
-	hint := "Check if the OS keychain/credential manager is locked or accessible. If running inside a sandbox or CI environment, please ensure the process has the necessary permissions to access the keychain, you can try running this outside the sandbox."
+	hint := "Check if the OS keychain/credential manager is locked or accessible. If running inside a sandbox or CI environment, please ensure the process has the necessary permissions to access the keychain."

 	if errors.Is(err, errNotInitialized) {
-		hint = "The keychain master key may have been cleaned up or deleted. If running inside a sandbox or CI environment, please ensure the process has the necessary permissions to access the keychain, you can try running this outside the sandbox. Otherwise, please reconfigure the CLI by running lark-cli config init."
+		hint = "The keychain master key may have been cleaned up or deleted. Please reconfigure the CLI by running `lark-cli config init`."
 	}

 	func() {
--- a/internal/keychain/keychain_darwin_test.go
+++ b/internal/keychain/keychain_darwin_test.go
@@ -1,6 +1,3 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
 //go:build darwin

 package keychain
--- a/internal/keychain/keychain_other_test.go
+++ b/internal/keychain/keychain_other_test.go
@@ -1,6 +1,3 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
 //go:build linux

 package keychain
--- a/internal/output/format.go
+++ b/internal/output/format.go
@@ -8,7 +8,6 @@ import (
 	"encoding/json"
 	"fmt"
 	"io"
-	"reflect"
 	"sort"
 )

@@ -16,29 +15,6 @@ import (
 var knownArrayFields = []string{
 	"items", "files", "events", "rooms", "records", "nodes",
 	"members", "departments", "calendar_list", "acl_list", "freebusy_list",
-	"chats", "messages", "tasks", "created_tasks",
-}
-
-// asGenericSlice converts any slice value into []interface{}.
-// Returns the slice and true when v is a slice, regardless of element type
-// ([]interface{}, []map[string]interface{}, []MyStruct, etc.). This keeps
-// formatter logic working when business code uses typed slices.
-func asGenericSlice(v interface{}) ([]interface{}, bool) {
-	if v == nil {
-		return nil, false
-	}
-	if s, ok := v.([]interface{}); ok {
-		return s, true
-	}
-	rv := reflect.ValueOf(v)
-	if rv.Kind() != reflect.Slice {
-		return nil, false
-	}
-	out := make([]interface{}, rv.Len())
-	for i := 0; i < rv.Len(); i++ {
-		out[i] = rv.Index(i).Interface()
-	}
-	return out, true
 }

 // FindArrayField finds the primary array field in a response's data object.
@@ -47,7 +23,7 @@ func asGenericSlice(v interface{}) ([]interface{}, bool) {
 func FindArrayField(data map[string]interface{}) string {
 	for _, name := range knownArrayFields {
 		if arr, ok := data[name]; ok {
-			if _, isArr := asGenericSlice(arr); isArr {
+			if _, isArr := arr.([]interface{}); isArr {
 				return name
 			}
 		}
@@ -55,7 +31,7 @@ func FindArrayField(data map[string]interface{}) string {
 	// Fallback: lexicographically first array field (deterministic)
 	var candidates []string
 	for k, v := range data {
-		if _, isArr := asGenericSlice(v); isArr {
+		if _, isArr := v.([]interface{}); isArr {
 			candidates = append(candidates, k)
 		}
 	}
@@ -92,12 +68,11 @@ func toGeneric(v interface{}) interface{} {
 //  1. Lark API envelope: result["data"][arrayField]  (e.g. {"code":0,"data":{"items":[…]}})
 //  2. Direct map: result[arrayField]                 (e.g. {"members":[…],"total":5})
 //
-// If data is already a slice, it is returned as a []interface{}. Typed slices
-// such as []map[string]interface{} are also accepted via asGenericSlice.
+// If data is already a plain []interface{}, it is returned as-is.
 func ExtractItems(data interface{}) []interface{} {
 	resultMap, ok := data.(map[string]interface{})
 	if !ok {
-		if arr, ok := asGenericSlice(data); ok {
+		if arr, ok := data.([]interface{}); ok {
 			return arr
 		}
 		return nil
@@ -106,7 +81,7 @@ func ExtractItems(data interface{}) []interface{} {
 	// Strategy 1: Lark API envelope — result["data"][arrayField]
 	if dataObj, ok := resultMap["data"].(map[string]interface{}); ok {
 		if field := FindArrayField(dataObj); field != "" {
-			if items, ok := asGenericSlice(dataObj[field]); ok {
+			if items, ok := dataObj[field].([]interface{}); ok {
 				return items
 			}
 		}
@@ -115,7 +90,7 @@ func ExtractItems(data interface{}) []interface{} {
 	// Strategy 2: direct map — result[arrayField]
 	// Covers shortcut-level data like {"members":[…], "total":5, "has_more":false}
 	if field := FindArrayField(resultMap); field != "" {
-		if items, ok := asGenericSlice(resultMap[field]); ok {
+		if items, ok := resultMap[field].([]interface{}); ok {
 			return items
 		}
 	}
--- a/internal/output/format_test.go
+++ b/internal/output/format_test.go
@@ -266,113 +266,6 @@ func TestExtractItems(t *testing.T) {
 	}
 }

-// Regression: shortcuts often collect results into typed slices like
-// []map[string]interface{} instead of []interface{}. ExtractItems must
-// recognise those so --format table/csv/ndjson render the array rather
-// than falling back to a key/value view of the envelope.
-func TestExtractItems_TypedSlice(t *testing.T) {
-	cases := []struct {
-		name string
-		data interface{}
-		want int
-	}{
-		{
-			name: "direct map with []map[string]interface{} under known field",
-			data: map[string]interface{}{
-				"chats": []map[string]interface{}{
-					{"chat_id": "oc_a", "name": "Alice"},
-					{"chat_id": "oc_b", "name": "Bob"},
-				},
-				"has_more": true,
-				"total":    float64(2),
-			},
-			want: 2,
-		},
-		{
-			name: "envelope with []map[string]interface{} under data.messages",
-			data: map[string]interface{}{
-				"data": map[string]interface{}{
-					"messages": []map[string]interface{}{
-						{"message_id": "om_1"},
-					},
-				},
-			},
-			want: 1,
-		},
-		{
-			name: "direct map with []map[string]interface{} under created_tasks",
-			data: map[string]interface{}{
-				"created_tasks": []map[string]interface{}{
-					{"task_id": "t1"},
-					{"task_id": "t2"},
-					{"task_id": "t3"},
-				},
-			},
-			want: 3,
-		},
-		{
-			name: "typed slice of structs via fallback",
-			data: map[string]interface{}{
-				"widgets": []struct {
-					Name string `json:"name"`
-				}{{Name: "x"}, {Name: "y"}},
-			},
-			want: 2,
-		},
-		{
-			name: "raw typed slice passed directly",
-			data: []map[string]interface{}{
-				{"k": "v"},
-			},
-			want: 1,
-		},
-	}
-
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			items := ExtractItems(tc.data)
-			if len(items) != tc.want {
-				t.Fatalf("expected %d items, got %d (%v)", tc.want, len(items), items)
-			}
-		})
-	}
-}
-
-// Regression: --format table on the 7 affected shortcuts used to print
-// the envelope as a key/value table because the typed slice was ignored.
-// After the fix, the array should be expanded into a proper header row.
-func TestFormatValue_Table_TypedSlice(t *testing.T) {
-	data := map[string]interface{}{
-		"chats": []map[string]interface{}{
-			{"chat_id": "oc_abc", "name": "Lark test"},
-		},
-		"has_more": true,
-		"total":    float64(1),
-	}
-
-	var buf bytes.Buffer
-	FormatValue(&buf, data, FormatTable)
-	out := buf.String()
-
-	if !strings.Contains(out, "chat_id") {
-		t.Errorf("table output should expose chat_id column, got:\n%s", out)
-	}
-	if !strings.Contains(out, "oc_abc") {
-		t.Errorf("table output should contain the chat row, got:\n%s", out)
-	}
-	// The fallback bug manifested as the envelope being rendered as rows:
-	// the 'has_more' / 'total' envelope keys would appear as first-column
-	// labels. A correct render puts the array's element keys in the header
-	// and keeps envelope metadata out of the table body.
-	lines := strings.Split(strings.TrimRight(out, "\n"), "\n")
-	for _, line := range lines {
-		trimmed := strings.TrimSpace(line)
-		if strings.HasPrefix(trimmed, "has_more") || strings.HasPrefix(trimmed, "total ") {
-			t.Errorf("envelope field leaked into table body:\n%s", out)
-		}
-	}
-}
-
 func TestFormatValue_LegacyFormats(t *testing.T) {
 	data := map[string]interface{}{
 		"data": map[string]interface{}{
--- a/internal/output/lark_errors.go
+++ b/internal/output/lark_errors.go
@@ -33,14 +33,6 @@ const (
 	LarkErrRefreshRevoked     = 20064 // refresh_token revoked
 	LarkErrRefreshAlreadyUsed = 20073 // refresh_token already consumed (single-use rotation)
 	LarkErrRefreshServerError = 20050 // refresh endpoint server-side error, retryable
-
-	// Drive shortcut / cross-space constraints.
-	LarkErrDriveResourceContention = 1061045 // resource contention occurred, please retry
-	LarkErrDriveCrossTenantUnit    = 1064510 // cross tenant and unit not support
-	LarkErrDriveCrossBrand         = 1064511 // cross brand not support
-
-	// Sheets float image: width/height/offset out of range or invalid.
-	LarkErrSheetsFloatImageInvalidDims = 1310246
 )

 // ClassifyLarkError maps a Lark API error code + message to (exitCode, errType, hint).
@@ -68,20 +60,6 @@ func ClassifyLarkError(code int, msg string) (int, string, string) {
 	// rate limit
 	case LarkErrRateLimit:
 		return ExitAPI, "rate_limit", "please try again later"
-
-	// drive-specific constraints that benefit from actionable hints
-	case LarkErrDriveResourceContention:
-		return ExitAPI, "conflict", "please retry later and avoid concurrent duplicate requests"
-	case LarkErrDriveCrossTenantUnit:
-		return ExitAPI, "cross_tenant_unit", "operate on source and target within the same tenant and region/unit"
-	case LarkErrDriveCrossBrand:
-		return ExitAPI, "cross_brand", "operate on source and target within the same brand environment"
-
-	// sheets-specific constraints that benefit from actionable hints
-	case LarkErrSheetsFloatImageInvalidDims:
-		return ExitAPI, "invalid_params",
-			"check --width / --height / --offset-x / --offset-y: " +
-				"width/height must be >= 20 px; offsets must be >= 0 and less than the anchor cell's width/height"
 	}

 	return ExitAPI, "api_error", ""
--- a/internal/output/lark_errors_test.go
+++ b/internal/output/lark_errors_test.go
@@ -1,71 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package output
-
-import (
-	"strings"
-	"testing"
-)
-
-// TestClassifyLarkError_DriveCreateShortcutConstraints verifies known Drive shortcut errors map to actionable hints.
-func TestClassifyLarkError_DriveCreateShortcutConstraints(t *testing.T) {
-	t.Parallel()
-
-	tests := []struct {
-		name         string
-		code         int
-		wantExitCode int
-		wantType     string
-		wantHint     string
-	}{
-		{
-			name:         "resource contention",
-			code:         LarkErrDriveResourceContention,
-			wantExitCode: ExitAPI,
-			wantType:     "conflict",
-			wantHint:     "avoid concurrent duplicate requests",
-		},
-		{
-			name:         "cross tenant unit",
-			code:         LarkErrDriveCrossTenantUnit,
-			wantExitCode: ExitAPI,
-			wantType:     "cross_tenant_unit",
-			wantHint:     "same tenant and region/unit",
-		},
-		{
-			name:         "cross brand",
-			code:         LarkErrDriveCrossBrand,
-			wantExitCode: ExitAPI,
-			wantType:     "cross_brand",
-			wantHint:     "same brand environment",
-		},
-		{
-			name:         "sheets float image invalid dims",
-			code:         LarkErrSheetsFloatImageInvalidDims,
-			wantExitCode: ExitAPI,
-			wantType:     "invalid_params",
-			wantHint:     "--width / --height / --offset-x / --offset-y",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			t.Parallel()
-
-			gotExitCode, gotType, gotHint := ClassifyLarkError(tt.code, "raw msg")
-			if gotExitCode != tt.wantExitCode {
-				t.Fatalf("exitCode=%d, want %d", gotExitCode, tt.wantExitCode)
-			}
-			if gotType != tt.wantType {
-				t.Fatalf("type=%q, want %q", gotType, tt.wantType)
-			}
-			if gotHint == "" {
-				t.Fatal("expected non-empty hint")
-			}
-			if !strings.Contains(gotHint, tt.wantHint) {
-				t.Fatalf("hint=%q, want substring %q", gotHint, tt.wantHint)
-			}
-		})
-	}
-}
--- a/internal/registry/registry_test.go
+++ b/internal/registry/registry_test.go
@@ -564,54 +564,3 @@ func TestCollectScopesForProjects_NonexistentProject(t *testing.T) {
 		t.Errorf("expected empty scopes for nonexistent project, got %d", len(scopes))
 	}
 }
-
-// --- auth_domain functions ---
-
-func TestGetAuthDomain_Configured(t *testing.T) {
-	// whiteboard has auth_domain: "docs" in service_descriptions.json
-	if got := GetAuthDomain("whiteboard"); got != "docs" {
-		t.Errorf("GetAuthDomain(whiteboard) = %q, want %q", got, "docs")
-	}
-}
-
-func TestGetAuthDomain_NotConfigured(t *testing.T) {
-	if got := GetAuthDomain("calendar"); got != "" {
-		t.Errorf("GetAuthDomain(calendar) = %q, want empty", got)
-	}
-}
-
-func TestGetAuthDomain_Unknown(t *testing.T) {
-	if got := GetAuthDomain("nonexistent_xyz"); got != "" {
-		t.Errorf("GetAuthDomain(nonexistent_xyz) = %q, want empty", got)
-	}
-}
-
-func TestHasAuthDomain(t *testing.T) {
-	if !HasAuthDomain("whiteboard") {
-		t.Error("HasAuthDomain(whiteboard) = false, want true")
-	}
-	if HasAuthDomain("calendar") {
-		t.Error("HasAuthDomain(calendar) = true, want false")
-	}
-}
-
-func TestGetAuthChildren(t *testing.T) {
-	children := GetAuthChildren("docs")
-	found := false
-	for _, c := range children {
-		if c == "whiteboard" {
-			found = true
-			break
-		}
-	}
-	if !found {
-		t.Errorf("GetAuthChildren(docs) = %v, want to contain 'whiteboard'", children)
-	}
-}
-
-func TestGetAuthChildren_NoChildren(t *testing.T) {
-	children := GetAuthChildren("calendar")
-	if len(children) != 0 {
-		t.Errorf("GetAuthChildren(calendar) = %v, want empty", children)
-	}
-}
--- a/internal/registry/scope_overrides.json
+++ b/internal/registry/scope_overrides.json
@@ -4,7 +4,8 @@
    "im:message:send_as_bot": 1,
    "calendar:calendar:read": 70,
    "calendar:calendar:readonly": 1,
-    "sheets:spreadsheet:write_only": 60,
+    "sheets:spreadsheet:write_only": 45,
+    "docs:document.comment:delete": 60,
    "drive:drive:readonly": 1,
    "docs:doc:readonly": 1,
    "sheets:spreadsheet:readonly": 1,
--- a/internal/registry/scope_priorities.json
+++ b/internal/registry/scope_priorities.json
--- a/internal/registry/service_desc.go
+++ b/internal/registry/service_desc.go
@@ -19,9 +19,8 @@ type serviceDescLocale struct {

 // serviceDescEntry holds bilingual descriptions for a service domain.
 type serviceDescEntry struct {
-	En         serviceDescLocale `json:"en"`
-	Zh         serviceDescLocale `json:"zh"`
-	AuthDomain string            `json:"auth_domain,omitempty"`
+	En serviceDescLocale `json:"en"`
+	Zh serviceDescLocale `json:"zh"`
 }

 var serviceDescMap map[string]serviceDescEntry
@@ -77,31 +76,3 @@ func GetServiceDetailDescription(name, lang string) string {
 	}
 	return loc.Description
 }
-
-// GetAuthDomain returns the auth_domain for a service, or "" if not set.
-// When auth_domain is set, the service's scopes are collected under the
-// parent domain during auth login.
-func GetAuthDomain(service string) string {
-	m := loadServiceDescriptions()
-	if entry, ok := m[service]; ok {
-		return entry.AuthDomain
-	}
-	return ""
-}
-
-// HasAuthDomain reports whether the service has an auth_domain configured.
-func HasAuthDomain(service string) bool {
-	return GetAuthDomain(service) != ""
-}
-
-// GetAuthChildren returns all service names whose auth_domain equals parent.
-func GetAuthChildren(parent string) []string {
-	m := loadServiceDescriptions()
-	var children []string
-	for name, entry := range m {
-		if entry.AuthDomain == parent {
-			children = append(children, name)
-		}
-	}
-	return children
-}
--- a/internal/registry/service_descriptions.json
+++ b/internal/registry/service_descriptions.json
@@ -43,10 +43,6 @@
    "en": { "title": "Sheets", "description": "Spreadsheet operations" },
    "zh": { "title": "电子表格", "description": "电子表格操作" }
  },
-  "slides": {
-    "en": { "title": "Slides", "description": "Create and manage presentations, read content, and add or remove slides" },
-    "zh": { "title": "幻灯片", "description": "创建和管理演示文稿、读取内容，以及新增或删除幻灯片页面" }
-  },
  "task": {
    "en": { "title": "Task", "description": "Task, task list, and subtask management" },
    "zh": { "title": "任务", "description": "任务、清单、子任务管理" }
@@ -57,15 +53,10 @@
  },
  "whiteboard": {
    "en": { "title": "Whiteboard", "description": "Create and edit boards" },
-    "zh": { "title": "画板", "description": "画板创建、编辑" },
-    "auth_domain": "docs"
+    "zh": { "title": "画板", "description": "画板创建、编辑" }
  },
  "wiki": {
    "en": { "title": "Wiki", "description": "Wiki space and node management" },
    "zh": { "title": "知识库", "description": "知识空间、节点管理" }
-  },
-  "okr": {
-    "en": { "title": "OKR", "description": "Lark OKR objectives, key results, alignments, indicators" },
-    "zh": { "title": "OKR", "description": "飞书 OKR 目标、关键结果、对齐、量化指标" }
  }
 }
--- a/internal/selfupdate/updater.go
+++ b/internal/selfupdate/updater.go
@@ -1,240 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-// Package selfupdate handles installation detection, npm-based updates,
-// skills updates, and platform-specific binary replacement for the CLI
-// self-update flow.
-package selfupdate
-
-import (
-	"bytes"
-	"context"
-	"fmt"
-	"os/exec"
-	"strings"
-	"time"
-
-	"github.com/larksuite/cli/internal/vfs"
-)
-
-// InstallMethod describes how the CLI was installed.
-type InstallMethod int
-
-const (
-	InstallNpm InstallMethod = iota
-	InstallManual
-)
-
-const (
-	NpmPackage = "@larksuite/cli"
-)
-
-const (
-	npmInstallTimeout   = 10 * time.Minute
-	skillsUpdateTimeout = 2 * time.Minute
-	verifyTimeout       = 10 * time.Second
-)
-
-// DetectResult holds installation detection results.
-type DetectResult struct {
-	Method       InstallMethod
-	ResolvedPath string
-	NpmAvailable bool
-}
-
-// CanAutoUpdate returns true if the CLI can update itself automatically.
-func (d DetectResult) CanAutoUpdate() bool {
-	return d.Method == InstallNpm && d.NpmAvailable
-}
-
-// ManualReason returns a human-readable explanation of why auto-update is unavailable.
-func (d DetectResult) ManualReason() string {
-	if d.Method == InstallNpm && !d.NpmAvailable {
-		return "installed via npm, but npm is not available in PATH"
-	}
-	return "not installed via npm"
-}
-
-// NpmResult holds the result of an npm install or skills update execution.
-type NpmResult struct {
-	Stdout bytes.Buffer
-	Stderr bytes.Buffer
-	Err    error
-}
-
-// CombinedOutput returns stdout + stderr concatenated.
-func (r *NpmResult) CombinedOutput() string {
-	return r.Stdout.String() + r.Stderr.String()
-}
-
-// Updater manages self-update operations.
-// Platform-specific methods (PrepareSelfReplace, CleanupStaleFiles)
-// are in updater_unix.go and updater_windows.go.
-//
-// Override DetectOverride / NpmInstallOverride / SkillsUpdateOverride / VerifyOverride
-// / RestoreAvailableOverride for testing.
-type Updater struct {
-	DetectOverride           func() DetectResult
-	NpmInstallOverride       func(version string) *NpmResult
-	SkillsUpdateOverride     func() *NpmResult
-	VerifyOverride           func(expectedVersion string) error
-	RestoreAvailableOverride func() bool
-
-	// backupCreated is set to true by PrepareSelfReplace (Windows) when the
-	// running binary is successfully renamed to .old. Used by
-	// CanRestorePreviousVersion to report whether rollback is possible.
-	backupCreated bool
-}
-
-// New creates an Updater with default (real) behavior.
-func New() *Updater { return &Updater{} }
-
-// DetectInstallMethod determines how the CLI was installed and whether
-// npm is available for auto-update.
-func (u *Updater) DetectInstallMethod() DetectResult {
-	if u.DetectOverride != nil {
-		return u.DetectOverride()
-	}
-	exe, err := vfs.Executable()
-	if err != nil {
-		return DetectResult{Method: InstallManual}
-	}
-	resolved, err := vfs.EvalSymlinks(exe)
-	if err != nil {
-		return DetectResult{Method: InstallManual, ResolvedPath: exe}
-	}
-
-	method := InstallManual
-	if strings.Contains(resolved, "node_modules") {
-		method = InstallNpm
-	}
-
-	npmAvailable := false
-	if method == InstallNpm {
-		if _, err := exec.LookPath("npm"); err == nil {
-			npmAvailable = true
-		}
-	}
-
-	return DetectResult{
-		Method:       method,
-		ResolvedPath: resolved,
-		NpmAvailable: npmAvailable,
-	}
-}
-
-// RunNpmInstall executes npm install -g @larksuite/cli@<version>.
-func (u *Updater) RunNpmInstall(version string) *NpmResult {
-	if u.NpmInstallOverride != nil {
-		return u.NpmInstallOverride(version)
-	}
-	r := &NpmResult{}
-	npmPath, err := exec.LookPath("npm")
-	if err != nil {
-		r.Err = fmt.Errorf("npm not found in PATH: %w", err)
-		return r
-	}
-	ctx, cancel := context.WithTimeout(context.Background(), npmInstallTimeout)
-	defer cancel()
-	cmd := exec.CommandContext(ctx, npmPath, "install", "-g", NpmPackage+"@"+version)
-	cmd.Stdout = &r.Stdout
-	cmd.Stderr = &r.Stderr
-	r.Err = cmd.Run()
-	if ctx.Err() == context.DeadlineExceeded {
-		r.Err = fmt.Errorf("npm install timed out after %s", npmInstallTimeout)
-	}
-	return r
-}
-
-// RunSkillsUpdate installs skills, trying the .well-known source first and
-// falling back to the GitHub repo on failure or timeout.
-func (u *Updater) RunSkillsUpdate() *NpmResult {
-	if u.SkillsUpdateOverride != nil {
-		return u.SkillsUpdateOverride()
-	}
-	r := u.runSkillsAdd("https://open.feishu.cn")
-	if r.Err != nil {
-		r = u.runSkillsAdd("larksuite/cli")
-	}
-	return r
-}
-
-func (u *Updater) runSkillsAdd(source string) *NpmResult {
-	r := &NpmResult{}
-	npxPath, err := exec.LookPath("npx")
-	if err != nil {
-		r.Err = fmt.Errorf("npx not found in PATH: %w", err)
-		return r
-	}
-	ctx, cancel := context.WithTimeout(context.Background(), skillsUpdateTimeout)
-	defer cancel()
-	cmd := exec.CommandContext(ctx, npxPath, "-y", "skills", "add", source, "-g", "-y")
-	cmd.Stdout = &r.Stdout
-	cmd.Stderr = &r.Stderr
-	r.Err = cmd.Run()
-	if ctx.Err() == context.DeadlineExceeded {
-		r.Err = fmt.Errorf("skills update timed out after %s", skillsUpdateTimeout)
-	}
-	return r
-}
-
-// VerifyBinary checks that the installed binary reports the expected version
-// by running "lark-cli --version" and comparing the version token exactly.
-// Output format is "lark-cli version X.Y.Z"; the last field is extracted and
-// compared against expectedVersion (both stripped of any "v" prefix).
-func (u *Updater) VerifyBinary(expectedVersion string) error {
-	if u.VerifyOverride != nil {
-		return u.VerifyOverride(expectedVersion)
-	}
-	// Prefer the current executable path (what the user actually launched).
-	// Use Executable() directly without EvalSymlinks — after npm install the
-	// symlink target may have changed, but the path itself is still valid for
-	// execution. Fall back to LookPath only if Executable() fails entirely.
-	exe, err := vfs.Executable()
-	if err != nil {
-		exe, err = exec.LookPath("lark-cli")
-		if err != nil {
-			return fmt.Errorf("cannot locate binary: %w", err)
-		}
-	}
-	ctx, cancel := context.WithTimeout(context.Background(), verifyTimeout)
-	defer cancel()
-	out, err := exec.CommandContext(ctx, exe, "--version").Output()
-	if ctx.Err() == context.DeadlineExceeded {
-		return fmt.Errorf("binary verification timed out after %s", verifyTimeout)
-	}
-	if err != nil {
-		return fmt.Errorf("binary not executable: %w", err)
-	}
-	fields := strings.Fields(strings.TrimSpace(string(out)))
-	if len(fields) == 0 {
-		return fmt.Errorf("empty version output")
-	}
-	actual := strings.TrimPrefix(fields[len(fields)-1], "v")
-	expected := strings.TrimPrefix(expectedVersion, "v")
-	if actual != expected {
-		return fmt.Errorf("expected version %s, got %q", expectedVersion, actual)
-	}
-	return nil
-}
-
-// Truncate returns the last maxLen runes of s.
-func Truncate(s string, maxLen int) string {
-	if maxLen <= 0 {
-		return ""
-	}
-	r := []rune(s)
-	if len(r) <= maxLen {
-		return s
-	}
-	return string(r[len(r)-maxLen:])
-}
-
-// resolveExe returns the resolved path of the current running binary.
-func (u *Updater) resolveExe() (string, error) {
-	exe, err := vfs.Executable()
-	if err != nil {
-		return "", err
-	}
-	return vfs.EvalSymlinks(exe)
-}
--- a/internal/selfupdate/updater_test.go
+++ b/internal/selfupdate/updater_test.go
@@ -1,89 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package selfupdate
-
-import (
-	"os"
-	"path/filepath"
-	"runtime"
-	"testing"
-
-	"github.com/larksuite/cli/internal/vfs"
-)
-
-type executableTestFS struct {
-	vfs.OsFs
-	exe string
-}
-
-func (f executableTestFS) Executable() (string, error) { return f.exe, nil }
-
-func TestResolveExe(t *testing.T) {
-	u := New()
-	p, err := u.resolveExe()
-	if err != nil {
-		t.Fatalf("resolveExe() error: %v", err)
-	}
-	if !filepath.IsAbs(p) {
-		t.Errorf("expected absolute path, got: %s", p)
-	}
-}
-
-func TestPrepareSelfReplace_ReturnsNoError(t *testing.T) {
-	u := New()
-	restore, err := u.PrepareSelfReplace()
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	restore()
-}
-
-func TestCleanupStaleFiles_NoPanic(t *testing.T) {
-	u := New()
-	u.CleanupStaleFiles()
-}
-
-func TestVerifyBinaryChecksVersion(t *testing.T) {
-	if runtime.GOOS == "windows" {
-		t.Skip("uses a POSIX shell script")
-	}
-
-	dir := t.TempDir()
-	exe := filepath.Join(dir, "lark-cli")
-	// Script prints version string matching real CLI format when --version is passed.
-	script := "#!/bin/sh\nif [ \"$1\" = \"--version\" ]; then echo \"lark-cli version 2.0.0\"; exit 0; fi\nexit 12\n"
-	if err := os.WriteFile(exe, []byte(script), 0755); err != nil {
-		t.Fatalf("write test binary: %v", err)
-	}
-
-	// Mock vfs.Executable to return our test script, matching VerifyBinary's
-	// primary lookup path. Also prepend to PATH for the LookPath fallback.
-	origFS := vfs.DefaultFS
-	vfs.DefaultFS = executableTestFS{OsFs: vfs.OsFs{}, exe: exe}
-	t.Cleanup(func() { vfs.DefaultFS = origFS })
-
-	origPath := os.Getenv("PATH")
-	t.Setenv("PATH", dir+string(os.PathListSeparator)+origPath)
-
-	// Matching version → success.
-	if err := New().VerifyBinary("2.0.0"); err != nil {
-		t.Fatalf("VerifyBinary(matching) error = %v, want nil", err)
-	}
-
-	// Mismatched version → error.
-	if err := New().VerifyBinary("3.0.0"); err == nil {
-		t.Fatal("VerifyBinary(mismatched) expected error, got nil")
-	}
-
-	// Substring of actual version must not match (e.g. "0.0" is in "2.0.0").
-	if err := New().VerifyBinary("0.0"); err == nil {
-		t.Fatal("VerifyBinary(substring) expected error, got nil")
-	}
-
-	// Version that is a prefix of actual must not match (e.g. "2.0.0" in "12.0.0").
-	// Binary reports "2.0.0", asking for "12.0.0" must fail.
-	if err := New().VerifyBinary("12.0.0"); err == nil {
-		t.Fatal("VerifyBinary(prefix-mismatch) expected error, got nil")
-	}
-}
--- a/internal/selfupdate/updater_unix.go
+++ b/internal/selfupdate/updater_unix.go
@@ -1,24 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-//go:build !windows
-
-package selfupdate
-
-// PrepareSelfReplace is a no-op on Unix.
-// Unix allows overwriting a running executable via inode semantics.
-func (u *Updater) PrepareSelfReplace() (restore func(), err error) {
-	return func() {}, nil
-}
-
-// CleanupStaleFiles is a no-op on Unix (no .old files are created).
-func (u *Updater) CleanupStaleFiles() {}
-
-// CanRestorePreviousVersion reports whether PrepareSelfReplace created a
-// restorable backup for the current update attempt.
-func (u *Updater) CanRestorePreviousVersion() bool {
-	if u.RestoreAvailableOverride != nil {
-		return u.RestoreAvailableOverride()
-	}
-	return u.backupCreated
-}
--- a/internal/selfupdate/updater_windows.go
+++ b/internal/selfupdate/updater_windows.go
@@ -1,87 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-//go:build windows
-
-package selfupdate
-
-import (
-	"fmt"
-
-	"github.com/larksuite/cli/internal/vfs"
-)
-
-// PrepareSelfReplace renames the running .exe to .old so that npm's
-// postinstall script can write the new binary without hitting EBUSY.
-// Returns a restore function that undoes the rename on failure.
-func (u *Updater) PrepareSelfReplace() (restore func(), err error) {
-	noop := func() {}
-
-	exe, err := u.resolveExe()
-	if err != nil {
-		return noop, nil // best-effort; don't block update
-	}
-
-	oldPath := exe + ".old"
-
-	// Clean up stale .old from a previous upgrade.
-	vfs.Remove(oldPath)
-
-	// Rename running.exe → running.exe.old (Windows allows rename of locked files).
-	if err := vfs.Rename(exe, oldPath); err != nil {
-		return noop, fmt.Errorf("cannot rename binary for update: %w", err)
-	}
-	u.backupCreated = true
-
-	// Restore: move .old back to the original path.
-	// Guard with Stat: run.js may have already recovered .old on its own
-	// during VerifyBinary; if .old is gone, skip to avoid deleting the
-	// only working binary.
-	// On any failure, clear backupCreated so CanRestorePreviousVersion
-	// reports the real outcome instead of claiming success.
-	restore = func() {
-		if _, err := vfs.Stat(oldPath); err != nil {
-			u.backupCreated = false
-			return
-		}
-		vfs.Remove(exe)
-		if err := vfs.Rename(oldPath, exe); err != nil {
-			u.backupCreated = false
-		}
-	}
-
-	return restore, nil
-}
-
-// CleanupStaleFiles removes leftover .old files from previous upgrades.
-// If the original binary is missing but .old exists (crash mid-update),
-// it restores the .old to recover the installation.
-func (u *Updater) CleanupStaleFiles() {
-	exe, err := u.resolveExe()
-	if err != nil {
-		return
-	}
-	oldPath := exe + ".old"
-
-	if _, err := vfs.Stat(oldPath); err != nil {
-		return // no .old file
-	}
-
-	if _, err := vfs.Stat(exe); err != nil {
-		// Original missing, .old exists — restore to recover.
-		vfs.Rename(oldPath, exe)
-		return
-	}
-
-	// Both exist — .old is stale, clean up.
-	vfs.Remove(oldPath)
-}
-
-// CanRestorePreviousVersion reports whether PrepareSelfReplace created a
-// restorable backup for the current update attempt.
-func (u *Updater) CanRestorePreviousVersion() bool {
-	if u.RestoreAvailableOverride != nil {
-		return u.RestoreAvailableOverride()
-	}
-	return u.backupCreated
-}
--- a/internal/update/update.go
+++ b/internal/update/update.go
@@ -218,8 +218,8 @@ func fetchLatestVersion() (string, error) {
 // is considered newer — an unparseable local version is assumed outdated.
 // When a cannot be parsed, returns false (can't confirm it's newer).
 func IsNewer(a, b string) bool {
-	ap := parseVersionDetail(a)
-	bp := parseVersionDetail(b)
+	ap := ParseVersion(a)
+	bp := ParseVersion(b)
 	if ap == nil {
 		return false // can't confirm remote is newer
 	}
@@ -227,59 +227,28 @@ func IsNewer(a, b string) bool {
 		return true // local version unparseable → assume outdated
 	}
 	for i := 0; i < 3; i++ {
-		if ap.core[i] > bp.core[i] {
+		if ap[i] > bp[i] {
 			return true
 		}
-		if ap.core[i] < bp.core[i] {
+		if ap[i] < bp[i] {
 			return false
 		}
 	}
-	return comparePrerelease(ap.prerelease, bp.prerelease) > 0
+	return false
 }

 // ParseVersion parses "X.Y.Z" (with optional "v" prefix and pre-release suffix)
 // into [major, minor, patch]. Returns nil on invalid input.
 func ParseVersion(v string) []int {
-	parsed := parseVersionDetail(v)
-	if parsed == nil {
-		return nil
-	}
-	return []int{parsed.core[0], parsed.core[1], parsed.core[2]}
-}
-
-type parsedVersion struct {
-	core       [3]int
-	prerelease string
-}
-
-// validPrerelease matches semver pre-release identifiers (dot-separated).
-// Each identifier is either: "0", a non-zero-leading numeric, or alphanumeric with at least one letter/hyphen.
-// Rejects empty identifiers ("1.0.0-"), leading-zero numerics ("1.0.0-01"), etc.
-var validPrerelease = regexp.MustCompile(
-	`^(?:0|[1-9]\d*|[0-9]*[a-zA-Z-][0-9a-zA-Z-]*)` +
-		`(?:\.(?:0|[1-9]\d*|[0-9]*[a-zA-Z-][0-9a-zA-Z-]*))*$`)
-
-func parseVersionDetail(v string) *parsedVersion {
 	v = strings.TrimPrefix(v, "v")
-	if idx := strings.Index(v, "+"); idx >= 0 {
-		v = v[:idx]
-	}
-	prerelease := ""
-	if idx := strings.Index(v, "-"); idx >= 0 {
-		prerelease = v[idx+1:]
-		v = v[:idx]
-		if prerelease == "" || !validPrerelease.MatchString(prerelease) {
-			return nil
-		}
-	}
 	parts := strings.SplitN(v, ".", 3)
 	if len(parts) != 3 {
 		return nil
 	}
-	var nums [3]int
+	nums := make([]int, 3)
 	for i, p := range parts {
-		if len(p) > 1 && p[0] == '0' {
-			return nil // leading zero in core part (e.g. "01.0.0")
+		if idx := strings.IndexAny(p, "-+"); idx >= 0 {
+			p = p[:idx]
 		}
 		n, err := strconv.Atoi(p)
 		if err != nil {
@@ -287,56 +256,5 @@ func parseVersionDetail(v string) *parsedVersion {
 		}
 		nums[i] = n
 	}
-	return &parsedVersion{core: nums, prerelease: prerelease}
-}
-
-func comparePrerelease(a, b string) int {
-	if a == "" && b == "" {
-		return 0
-	}
-	if a == "" {
-		return 1
-	}
-	if b == "" {
-		return -1
-	}
-	ap := strings.Split(a, ".")
-	bp := strings.Split(b, ".")
-	for i := 0; i < len(ap) && i < len(bp); i++ {
-		cmp := comparePrereleaseIdentifier(ap[i], bp[i])
-		if cmp != 0 {
-			return cmp
-		}
-	}
-	switch {
-	case len(ap) > len(bp):
-		return 1
-	case len(ap) < len(bp):
-		return -1
-	default:
-		return 0
-	}
-}
-
-func comparePrereleaseIdentifier(a, b string) int {
-	an, aErr := strconv.Atoi(a)
-	bn, bErr := strconv.Atoi(b)
-	aNumeric := aErr == nil
-	bNumeric := bErr == nil
-	switch {
-	case aNumeric && bNumeric:
-		if an > bn {
-			return 1
-		}
-		if an < bn {
-			return -1
-		}
-		return 0
-	case aNumeric:
-		return -1
-	case bNumeric:
-		return 1
-	default:
-		return strings.Compare(a, b)
-	}
+	return nums
 }
--- a/internal/update/update_test.go
+++ b/internal/update/update_test.go
@@ -56,9 +56,6 @@ func TestIsNewer(t *testing.T) {
 		{"1.0.0", "9b933f1", true},                  // bare commit hash → assume outdated
 		{"", "1.0.0", false},                        // empty remote → false
 		{"1.1.0", "v1.0.0-12-g9b933f1-dirty", true}, // git describe: 1.1.0 > 1.0.0
-		{"1.0.0", "1.0.0-rc.1", true},               // stable release > prerelease
-		{"1.0.0-rc.2", "1.0.0-rc.1", true},          // prerelease identifiers are ordered
-		{"1.0.0-rc.1", "1.0.0", false},              // prerelease < stable release
 	}
 	for _, tt := range tests {
 		got := IsNewer(tt.a, tt.b)
@@ -77,16 +74,6 @@ func TestParseVersion(t *testing.T) {
 		{"v1.2.3", []int{1, 2, 3}},
 		{"0.0.1", []int{0, 0, 1}},
 		{"1.0.0-beta.1", []int{1, 0, 0}},
-		{"1.0.0-rc.1", []int{1, 0, 0}},
-		{"1.0.0-0", []int{1, 0, 0}},
-		{"1.0.0+build.123", []int{1, 0, 0}},
-		{"1.0.0-beta.1+build", []int{1, 0, 0}},
-		{"1.0.0-", nil},        // empty pre-release
-		{"1.0.0-01", nil},      // leading zero in numeric pre-release
-		{"1.0.0-beta..1", nil}, // empty identifier between dots
-		{"01.0.0", nil},        // leading zero in major
-		{"1.00.0", nil},        // leading zero in minor
-		{"1.0.00", nil},        // leading zero in patch
 		{"DEV", nil},
 		{"", nil},
 		{"1.2", nil},
--- a/internal/util/strings_test.go
+++ b/internal/util/strings_test.go
@@ -1,53 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package util
-
-import "testing"
-
-func TestTruncateStr(t *testing.T) {
-	tests := []struct {
-		name string
-		s    string
-		n    int
-		want string
-	}{
-		{"short string", "hello", 10, "hello"},
-		{"exact length", "hello", 5, "hello"},
-		{"truncate", "hello world", 5, "hello"},
-		{"empty", "", 5, ""},
-		{"zero limit", "hello", 0, ""},
-		{"CJK characters", "你好世界测试", 4, "你好世界"},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			if got := TruncateStr(tt.s, tt.n); got != tt.want {
-				t.Errorf("TruncateStr(%q, %d) = %q, want %q", tt.s, tt.n, got, tt.want)
-			}
-		})
-	}
-}
-
-func TestTruncateStrWithEllipsis(t *testing.T) {
-	tests := []struct {
-		name string
-		s    string
-		n    int
-		want string
-	}{
-		{"short string", "hello", 10, "hello"},
-		{"exact length", "hello", 5, "hello"},
-		{"truncate with ellipsis", "hello world", 8, "hello..."},
-		{"limit less than 3", "hello", 2, "he"},
-		{"limit equals 3", "hello world", 3, "..."},
-		{"empty", "", 5, ""},
-		{"CJK with ellipsis", "你好世界测试", 5, "你好..."},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			if got := TruncateStrWithEllipsis(tt.s, tt.n); got != tt.want {
-				t.Errorf("TruncateStrWithEllipsis(%q, %d) = %q, want %q", tt.s, tt.n, got, tt.want)
-			}
-		})
-	}
-}
--- a/internal/vfs/default.go
+++ b/internal/vfs/default.go
@@ -1,6 +1,3 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
 package vfs

 import (
@@ -31,5 +28,3 @@ func MkdirAll(path string, perm fs.FileMode) error     { return DefaultFS.MkdirA
 func ReadDir(name string) ([]os.DirEntry, error)       { return DefaultFS.ReadDir(name) }
 func Remove(name string) error                         { return DefaultFS.Remove(name) }
 func Rename(oldpath, newpath string) error             { return DefaultFS.Rename(oldpath, newpath) }
-func EvalSymlinks(path string) (string, error)         { return DefaultFS.EvalSymlinks(path) }
-func Executable() (string, error)                      { return DefaultFS.Executable() }
--- a/internal/vfs/fs.go
+++ b/internal/vfs/fs.go
@@ -1,6 +1,3 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
 package vfs

 import (
@@ -29,8 +26,4 @@ type FS interface {
 	ReadDir(name string) ([]os.DirEntry, error)
 	Remove(name string) error
 	Rename(oldpath, newpath string) error
-
-	// Path resolution
-	EvalSymlinks(path string) (string, error)
-	Executable() (string, error)
 }
--- a/internal/vfs/osfs.go
+++ b/internal/vfs/osfs.go
@@ -1,12 +1,8 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
 package vfs

 import (
 	"io/fs"
 	"os"
-	"path/filepath"
 )

 // OsFs delegates every method to the os standard library.
@@ -34,7 +30,3 @@ func (OsFs) MkdirAll(path string, perm fs.FileMode) error { return os.MkdirAll(p
 func (OsFs) ReadDir(name string) ([]os.DirEntry, error)   { return os.ReadDir(name) }
 func (OsFs) Remove(name string) error                     { return os.Remove(name) }
 func (OsFs) Rename(oldpath, newpath string) error         { return os.Rename(oldpath, newpath) }
-
-// Path resolution
-func (OsFs) EvalSymlinks(path string) (string, error) { return filepath.EvalSymlinks(path) }
-func (OsFs) Executable() (string, error)              { return os.Executable() }
--- a/internal/vfs/osfs_test.go
+++ b/internal/vfs/osfs_test.go
@@ -1,6 +1,3 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
 package vfs

 import (
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,84 +0,0 @@
-{
-  "name": "@larksuite/cli",
-  "version": "1.0.11",
-  "lockfileVersion": 3,
-  "requires": true,
-  "packages": {
-    "": {
-      "name": "@larksuite/cli",
-      "version": "1.0.11",
-      "cpu": [
-        "x64",
-        "arm64"
-      ],
-      "hasInstallScript": true,
-      "license": "MIT",
-      "os": [
-        "darwin",
-        "linux",
-        "win32"
-      ],
-      "dependencies": {
-        "@clack/prompts": "^1.2.0"
-      },
-      "bin": {
-        "lark-cli": "scripts/run.js"
-      },
-      "engines": {
-        "node": ">=16"
-      }
-    },
-    "node_modules/@clack/core": {
-      "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/@clack/core/-/core-1.2.0.tgz",
-      "integrity": "sha512-qfxof/3T3t9DPU/Rj3OmcFyZInceqj/NVtO9rwIuJqCUgh32gwPjpFQQp/ben07qKlhpwq7GzfWpST4qdJ5Drg==",
-      "license": "MIT",
-      "dependencies": {
-        "fast-wrap-ansi": "^0.1.3",
-        "sisteransi": "^1.0.5"
-      }
-    },
-    "node_modules/@clack/prompts": {
-      "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/@clack/prompts/-/prompts-1.2.0.tgz",
-      "integrity": "sha512-4jmztR9fMqPMjz6H/UZXj0zEmE43ha1euENwkckKKel4XpSfokExPo5AiVStdHSAlHekz4d0CA/r45Ok1E4D3w==",
-      "license": "MIT",
-      "dependencies": {
-        "@clack/core": "1.2.0",
-        "fast-string-width": "^1.1.0",
-        "fast-wrap-ansi": "^0.1.3",
-        "sisteransi": "^1.0.5"
-      }
-    },
-    "node_modules/fast-string-truncated-width": {
-      "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/fast-string-truncated-width/-/fast-string-truncated-width-1.2.1.tgz",
-      "integrity": "sha512-Q9acT/+Uu3GwGj+5w/zsGuQjh9O1TyywhIwAxHudtWrgF09nHOPrvTLhQevPbttcxjr/SNN7mJmfOw/B1bXgow==",
-      "license": "MIT"
-    },
-    "node_modules/fast-string-width": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/fast-string-width/-/fast-string-width-1.1.0.tgz",
-      "integrity": "sha512-O3fwIVIH5gKB38QNbdg+3760ZmGz0SZMgvwJbA1b2TGXceKE6A2cOlfogh1iw8lr049zPyd7YADHy+B7U4W9bQ==",
-      "license": "MIT",
-      "dependencies": {
-        "fast-string-truncated-width": "^1.2.0"
-      }
-    },
-    "node_modules/fast-wrap-ansi": {
-      "version": "0.1.6",
-      "resolved": "https://registry.npmjs.org/fast-wrap-ansi/-/fast-wrap-ansi-0.1.6.tgz",
-      "integrity": "sha512-HlUwET7a5gqjURj70D5jl7aC3Zmy4weA1SHUfM0JFI0Ptq987NH2TwbBFLoERhfwk+E+eaq4EK3jXoT+R3yp3w==",
-      "license": "MIT",
-      "dependencies": {
-        "fast-string-width": "^1.1.0"
-      }
-    },
-    "node_modules/sisteransi": {
-      "version": "1.0.5",
-      "resolved": "https://registry.npmjs.org/sisteransi/-/sisteransi-1.0.5.tgz",
-      "integrity": "sha512-bLGGlR1QxBcynn2d5YmDX4MGjlZvy2MRBDRNHLJ8VI6l6+9FUiyTFNJ0IveOSP0bcXgVDPRcfGqA0pjaqUpfVg==",
-      "license": "MIT"
-    }
-  }
-}
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
  "name": "@larksuite/cli",
-  "version": "1.0.14",
+  "version": "1.0.6",
  "description": "The official CLI for Lark/Feishu open platform",
  "bin": {
    "lark-cli": "scripts/run.js"
@@ -27,11 +27,7 @@
  "license": "MIT",
  "files": [
    "scripts/install.js",
-    "scripts/install-wizard.js",
    "scripts/run.js",
    "CHANGELOG.md"
-  ],
-  "dependencies": {
-    "@clack/prompts": "^1.2.0"
-  }
+  ]
 }
--- a/rebase-420/dd05477.md
+++ b/rebase-420/dd05477.md
@@ -1,70 +0,0 @@
-# Cherry-pick 冲突解决报告: `dd05477`
-
- **原始 commit**: `dd05477` feat: add SetDefaultFS to allow replacing the global filesystem implementation
- **作者**: tuxedomm, 2026-04-09
- **新 commit**: `4d84994`
- **目标分支**: `feat/main_rebased_420`（基于 `larksuite/cli` 最新 main）
-
-## 改动范围
-
-10 个文件, +179 / -70:
-
- **新增**: `cmd/build.go`, `cmd/init.go`
- **修改**: `cmd/root.go`, `cmd/root_integration_test.go`, `internal/cmdutil/factory_default.go`, `internal/cmdutil/factory_default_test.go`, `internal/cmdutil/factory_http_test.go`, `internal/cmdutil/iostreams.go`, `internal/credential/default_provider.go`, `internal/credential/integration_test.go`
-
-核心意图:
- 把 `cmd.Execute()` 里的 root 命令组装逻辑抽取到新文件 `cmd/build.go` 的 `buildInternal()`, 并暴露 `Build()` 作为库入口
- 引入 `cmd/init.go` 里的 `SetDefaultFS(fs vfs.FS)` 允许调用方在 `Build/Execute` 之前替换全局 fs
- `cmdutil.NewDefault(inv)` 签名调整为 `NewDefault(streams *IOStreams, inv InvocationContext)`
- `credentialDeps.Keychain` 从 `keychain.KeychainAccess` 改为 `func() keychain.KeychainAccess`（惰性读取, 允许构造后替换）
- `cmdutil.SystemIO()` 新函数封装对真实 stdio 的引用
-
-## 冲突情况
-
-只有一个文件冲突: `cmd/root.go`（2 处）
-
-| 位置 | HEAD(main) | fork(dd05477) |
-|---|---|---|
-| imports 段 | 保留 `cmd/api`, `cmd/auth`, `cmd/completion`, `cmdconfig`, `cmd/doctor`, `cmd/profile`, `cmd/schema`, `cmd/service`, `cmdupdate`, `shortcuts` 等 | 全部删除（这些 import 随 Execute 函数体一起搬去新文件 `cmd/build.go`）|
-| `Execute()` 函数体 | 完整包含 Factory 构造 + rootCmd 构造 + 子命令注册 + strict-mode 剪枝 | 精简为 `f, rootCmd := buildInternal(context.Background(), inv)` |
-
-### 为什么会冲突
-
-fork 的 dd05477 比 fork 之前落后 main 很多 commit, 而 main 上(比如 PR #391)在 fork 不知道的情况下加了 `rootCmd.AddCommand(cmdupdate.NewCmdUpdate(f))` 这一行 —— 它处于 fork 想整体搬走的那段代码里。git 无法自动判断这一行应该保留还是跟着搬, 所以报冲突。
-
-## 解决方案
-
-**两处冲突都采用 fork 的重构结构**（把 imports / 组装逻辑搬去 `cmd/build.go`）, 但在 `cmd/build.go` 的 `buildInternal()` 里**追加**了 main 新增的 update 命令。
-
-### 具体改动
-
-在 `cmd/build.go` 里:
-
-```go
-// imports 段补上
-cmdupdate "github.com/larksuite/cli/cmd/update"
-
-// 在 rootCmd.AddCommand(completion.NewCmdCompletion(f)) 之后追加
-rootCmd.AddCommand(cmdupdate.NewCmdUpdate(f))
-```
-
-如果不这样做, 就会丢失 main PR #391 引入的 `lark-cli update` 子命令。
-
-## 非冲突文件处理
-
-其余 9 个文件的 patch 全部直接应用, 无语义冲突:
-
- `cmd/build.go`, `cmd/init.go`: 新增文件
- `cmd/root_integration_test.go`, `internal/cmdutil/factory_default_test.go`, `internal/cmdutil/factory_http_test.go`, `internal/credential/integration_test.go`: 跟随签名变更调整调用方（`NewDefault(nil, ...)`、`cachedHttpClientFunc(&Factory{...})` 等）
- `internal/cmdutil/factory_default.go`, `internal/cmdutil/iostreams.go`, `internal/credential/default_provider.go`: 签名/结构体字段类型调整
- `cmd/root.go`: 冲突段外其余部分（update 检查、错误处理等）保持原样
-
-## 验证
-
- `go build ./...` 通过
- `go test ./cmd/... ./internal/cmdutil/... ./internal/credential/...` 全部通过
-
-## 依赖
-
- `internal/vfs` 包（`DefaultFS`、`OsFs`、`FS` interface）在 main 上已存在, `SetDefaultFS` 要切换的全局状态有完整基础
- `cmdupdate` 包（main PR #391）已存在
--- a/scripts/install-wizard.js
+++ b/scripts/install-wizard.js
@@ -1,372 +0,0 @@
-#!/usr/bin/env node
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-const fs = require("fs");
-const path = require("path");
-const { execFileSync, execFile } = require("child_process");
-const p = require("@clack/prompts");
-
-const PKG = "@larksuite/cli";
-const SKILLS_REPO = "https://open.feishu.cn";
-const SKILLS_REPO_FALLBACK = "larksuite/cli";
-const isWindows = process.platform === "win32";
-
-// ---------------------------------------------------------------------------
-// i18n
-// ---------------------------------------------------------------------------
-
-const messages = {
-  zh: {
-    setup:          "正在设置 Feishu/Lark CLI...",
-    step1:          "正在安装 %s...",
-    step1Upgrade:   "正在升级 %s (v%s → v%s)...",
-    step1Skip:      "已安装 (v%s)，跳过",
-    step1Done:      "已全局安装",
-    step1Upgraded:  "已升级到 v%s",
-    step1Fail:      "全局安装失败。运行以下命令重试: npm install -g %s",
-    step2:          "安装 AI Skills",
-    step2Skip:      "已安装，跳过",
-    step2Spinner:   "正在安装 Skills...",
-    step2Done:      "Skills 已安装",
-    step2Fail:      "Skills 安装失败。运行以下命令重试: npx skills add %s -y -g",
-    step3:          "正在配置应用...",
-    step3NotFound:  "未找到 lark-cli，终止",
-    step3Found:     "发现已配置应用 (App ID: %s)，继续使用？",
-    step3Skip:      "跳过应用配置",
-    step3Done:      "应用已配置",
-    step3Fail:      "应用配置失败。运行以下命令重试: lark-cli config init --new",
-    step4:          "授权",
-    step4NotFound:  "未找到 lark-cli，跳过授权",
-    step4Confirm:   "允许 AI 访问你的飞书数据（消息、文档、日历等）？",
-    step4Skip:      "跳过授权。后续运行 lark-cli auth login 完成授权",
-    step4Done:      "授权完成",
-    step4Fail:      "授权失败。运行以下命令重试: lark-cli auth login",
-    done:           "安装完成！\n现在可以对你的 AI 工具（Claude Code、Trae 等）说：\"Feishu/Lark CLI 能帮我做什么？结合我的情况推荐一下从哪里开始\"",
-    cancelled:      "安装已取消",
-  },
-  en: {
-    setup:          "Setting up Feishu/Lark CLI...",
-    step1:          "Installing %s globally...",
-    step1Upgrade:   "Upgrading %s (v%s → v%s)...",
-    step1Skip:      "Already installed (v%s). Skipped",
-    step1Done:      "Installed globally",
-    step1Upgraded:  "Upgraded to v%s",
-    step1Fail:      "Failed to install globally. Run manually: npm install -g %s",
-    step2:          "Install AI skills",
-    step2Skip:      "Already installed. Skipped",
-    step2Spinner:   "Installing skills...",
-    step2Done:      "Skills installed",
-    step2Fail:      "Failed to install skills. Run manually: npx skills add %s -y -g",
-    step3:          "Configuring app...",
-    step3NotFound:  "lark-cli not found. Aborting",
-    step3Found:     "Found existing app (App ID: %s). Use this app?",
-    step3Skip:      "Skipped app configuration",
-    step3Done:      "App configured",
-    step3Fail:      "Failed to configure app. Run manually: lark-cli config init --new",
-    step4:          "Authorization",
-    step4NotFound:  "lark-cli not found. Skipping authorization",
-    step4Confirm:   "Allow AI to access your Feishu/Lark data (messages, docs, calendar, etc.)?",
-    step4Skip:      "Skipped. Run lark-cli auth login to authorize later",
-    step4Done:      "Authorization complete",
-    step4Fail:      "Failed to authorize. Run lark-cli auth login to retry",
-    done:           "You are all set!\nNow try asking your AI tool (Claude Code, Trae, etc.): \"What can Feishu/Lark CLI help me with, and where should I start?\"",
-    cancelled:      "Installation cancelled",
-  },
-};
-
-// ---------------------------------------------------------------------------
-// Helpers
-// ---------------------------------------------------------------------------
-
-function handleCancel(value, msg) {
-  if (p.isCancel(value)) {
-    p.cancel(msg.cancelled);
-    process.exit(0);
-  }
-  return value;
-}
-
-function execCmd(cmd, args, opts) {
-  if (isWindows) {
-    return execFileSync("cmd.exe", ["/c", cmd, ...args], opts);
-  }
-  return execFileSync(cmd, args, opts);
-}
-
-function run(cmd, args, opts = {}) {
-  execCmd(cmd, args, { stdio: "inherit", ...opts });
-}
-
-function runSilent(cmd, args, opts = {}) {
-  return execCmd(cmd, args, {
-    stdio: ["ignore", "pipe", "pipe"],
-    ...opts,
-  });
-}
-
-function runSilentAsync(cmd, args, opts = {}) {
-  const actualCmd = isWindows ? "cmd.exe" : cmd;
-  const actualArgs = isWindows ? ["/c", cmd, ...args] : args;
-  return new Promise((resolve, reject) => {
-    execFile(actualCmd, actualArgs, {
-      stdio: ["ignore", "pipe", "pipe"],
-      ...opts,
-    }, (err, stdout) => {
-      if (err) reject(err);
-      else resolve(stdout);
-    });
-  });
-}
-
-function fmt(template, ...values) {
-  let i = 0;
-  return template.replace(/%s/g, () => values[i++] ?? "");
-}
-
-/** Resolve the path of globally installed lark-cli (skip npx temp copies). */
-function whichLarkCli() {
-  try {
-    const prefix = execFileSync("npm", ["prefix", "-g"], {
-      stdio: ["ignore", "pipe", "pipe"],
-    }).toString().trim();
-    const bin = isWindows
-      ? path.join(prefix, "lark-cli.cmd")
-      : path.join(prefix, "bin", "lark-cli");
-    if (fs.existsSync(bin)) return bin;
-  } catch (_) {
-    // fall through
-  }
-  // Fallback to which/where if npm prefix lookup fails.
-  try {
-    const cmd = isWindows ? "where" : "which";
-    return execFileSync(cmd, ["lark-cli"], { stdio: ["ignore", "pipe", "pipe"] })
-      .toString()
-      .split("\n")[0]
-      .trim();
-  } catch (_) {
-    return null;
-  }
-}
-
-/** Get the latest version of @larksuite/cli from the registry. Returns version or null. */
-function getLatestVersion() {
-  try {
-    const out = runSilent("npm", ["view", PKG, "version"], { timeout: 15000 });
-    const ver = out.toString().trim();
-    return /^\d+\.\d+\.\d+/.test(ver) ? ver : null;
-  } catch (_) {
-    return null;
-  }
-}
-
-/** Compare two semver strings. Returns true if a < b. */
-function semverLessThan(a, b) {
-  const pa = a.replace(/-.*$/, "").split(".").map(Number);
-  const pb = b.replace(/-.*$/, "").split(".").map(Number);
-  for (let i = 0; i < 3; i++) {
-    if ((pa[i] || 0) < (pb[i] || 0)) return true;
-    if ((pa[i] || 0) > (pb[i] || 0)) return false;
-  }
-  return false;
-}
-
-/** Check whether @larksuite/cli is truly installed in npm global prefix. Returns version or null. */
-function getGloballyInstalledVersion() {
-  try {
-    const out = runSilent("npm", ["list", "-g", PKG], { timeout: 15000 });
-    const match = out.toString().match(/@(\d+\.\d+\.\d+[^\s]*)/);
-    return match ? match[1] : "unknown";
-  } catch (_) {
-    return null;
-  }
-}
-
-/** Check whether lark-cli config already exists. Returns app ID or null. */
-function getExistingAppId(binPath) {
-  try {
-    const out = runSilent(binPath, ["config", "show"], { timeout: 10000 });
-    const json = JSON.parse(out.toString());
-    return json.appId || null;
-  } catch (_) {
-    return null;
-  }
-}
-
-/** Parse --lang from process.argv, returns "zh", "en", or null. */
-function parseLangArg() {
-  const args = process.argv.slice(2);
-  for (let i = 0; i < args.length; i++) {
-    if (args[i] === "--lang" && args[i + 1]) {
-      const val = args[i + 1].toLowerCase();
-      if (val === "zh" || val === "en") return val;
-    }
-    if (args[i].startsWith("--lang=")) {
-      const val = args[i].split("=")[1].toLowerCase();
-      if (val === "zh" || val === "en") return val;
-    }
-  }
-  return null;
-}
-
-// ---------------------------------------------------------------------------
-// Steps
-// ---------------------------------------------------------------------------
-
-async function stepSelectLang() {
-  const fromArg = parseLangArg();
-  if (fromArg) return fromArg;
-
-  const lang = await p.select({
-    message: "请选择语言 / Select language",
-    options: [
-      { value: "zh", label: "中文" },
-      { value: "en", label: "English" },
-    ],
-  });
-  return handleCancel(lang, messages.zh);
-}
-
-async function stepInstallGlobally(msg) {
-  const installedVer = getGloballyInstalledVersion();
-  const latestVer = getLatestVersion();
-  const needsUpgrade = installedVer && latestVer && semverLessThan(installedVer, latestVer);
-
-  if (installedVer && !needsUpgrade) {
-    p.log.info(fmt(msg.step1Skip, installedVer));
-    return false;
-  }
-
-  const s = p.spinner();
-  if (needsUpgrade) {
-    s.start(fmt(msg.step1Upgrade, PKG, installedVer, latestVer));
-  } else {
-    s.start(fmt(msg.step1, PKG));
-  }
-  try {
-    await runSilentAsync("npm", ["install", "-g", PKG], { timeout: 120000 });
-    s.stop(needsUpgrade ? fmt(msg.step1Upgraded, latestVer) : msg.step1Done);
-    return needsUpgrade;
-  } catch (_) {
-    s.stop(fmt(msg.step1Fail, PKG));
-    process.exit(1);
-  }
-}
-
-async function skillsAlreadyInstalled() {
-  try {
-    const out = await runSilentAsync("npx", ["-y", "skills", "ls", "-g"], {
-      timeout: 120000,
-    });
-    return /^lark-/m.test(out.toString());
-  } catch (_) {
-    return false;
-  }
-}
-
-async function stepInstallSkills(msg) {
-  const s = p.spinner();
-  s.start(msg.step2Spinner);
-  try {
-    if (await skillsAlreadyInstalled()) {
-      s.stop(msg.step2Skip);
-      return;
-    }
-    try {
-      await runSilentAsync("npx", ["-y", "skills", "add", SKILLS_REPO, "-y", "-g"], {
-        timeout: 120000,
-      });
-    } catch (_) {
-      await runSilentAsync("npx", ["-y", "skills", "add", SKILLS_REPO_FALLBACK, "-y", "-g"], {
-        timeout: 120000,
-      });
-    }
-    s.stop(msg.step2Done);
-  } catch (_) {
-    s.stop(fmt(msg.step2Fail, SKILLS_REPO_FALLBACK));
-    process.exit(1);
-  }
-}
-
-async function stepConfigInit(msg, lang) {
-  const s = p.spinner();
-  s.start(msg.step3);
-
-  const larkCli = whichLarkCli();
-  if (!larkCli) {
-    s.stop(msg.step3NotFound);
-    process.exit(1);
-  }
-
-  const appId = getExistingAppId(larkCli);
-  s.stop(msg.step3);
-
-  if (appId) {
-    const reuse = await p.confirm({
-      message: fmt(msg.step3Found, appId),
-    });
-    if (handleCancel(reuse, msg) && reuse) {
-      p.log.info(msg.step3Skip);
-      return;
-    }
-  }
-
-  try {
-    run(larkCli, ["config", "init", "--new", "--lang", lang]);
-    p.log.success(msg.step3Done);
-  } catch (_) {
-    p.log.error(msg.step3Fail);
-    process.exit(1);
-  }
-}
-
-async function stepAuthLogin(msg) {
-  const larkCli = whichLarkCli();
-  if (!larkCli) {
-    p.log.warn(msg.step4NotFound);
-    return;
-  }
-
-  const yes = await p.confirm({
-    message: msg.step4Confirm,
-  });
-  if (p.isCancel(yes)) {
-    p.cancel(msg.cancelled);
-    process.exit(0);
-  }
-  if (!yes) {
-    p.log.info(msg.step4Skip);
-    return;
-  }
-
-  p.log.step(msg.step4);
-  try {
-    run(larkCli, ["auth", "login"]);
-    p.log.success(msg.step4Done);
-  } catch (_) {
-    p.log.warn(msg.step4Fail);
-  }
-}
-
-// ---------------------------------------------------------------------------
-// Main
-// ---------------------------------------------------------------------------
-
-async function main() {
-  const lang = await stepSelectLang();
-  const msg = messages[lang];
-
-  p.intro(msg.setup);
-
-  await stepInstallGlobally(msg);
-  await stepInstallSkills(msg);
-  await stepConfigInit(msg, lang);
-  await stepAuthLogin(msg);
-
-  p.outro(msg.done);
-}
-
-main().catch((err) => {
-  p.cancel("Unexpected error: " + (err.message || err));
-  process.exit(1);
-});
--- a/scripts/install.js
+++ b/scripts/install.js
@@ -1,12 +1,9 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
 const fs = require("fs");
 const path = require("path");
-const { execFileSync } = require("child_process");
+const { execSync } = require("child_process");
 const os = require("os");

-const VERSION = require("../package.json").version.replace(/-.*$/, "");
+const VERSION = require("../package.json").version;
 const REPO = "larksuite/cli";
 const NAME = "lark-cli";

@@ -43,16 +40,13 @@ const dest = path.join(binDir, NAME + (isWindows ? ".exe" : ""));
 fs.mkdirSync(binDir, { recursive: true });

 function download(url, destPath) {
-  const args = [
-    "--fail", "--location", "--silent", "--show-error",
-    "--connect-timeout", "10", "--max-time", "120",
-    "--output", destPath,
-  ];
  // --ssl-revoke-best-effort: on Windows (Schannel), avoid CRYPT_E_REVOCATION_OFFLINE
  // errors when the certificate revocation list server is unreachable
-  if (isWindows) args.unshift("--ssl-revoke-best-effort");
-  args.push(url);
-  execFileSync("curl", args, { stdio: ["ignore", "ignore", "pipe"] });
+  const sslFlag = isWindows ? "--ssl-revoke-best-effort " : "";
+  execSync(
+    `curl ${sslFlag}--fail --location --silent --show-error --connect-timeout 10 --max-time 120 --output "${destPath}" "${url}"`,
+    { stdio: ["ignore", "ignore", "pipe"] }
+  );
 }

 function install() {
@@ -67,12 +61,12 @@ function install() {
    }

    if (isWindows) {
-      execFileSync("powershell", [
-        "-Command",
-        `Expand-Archive -Path '${archivePath}' -DestinationPath '${tmpDir}'`,
-      ], { stdio: "ignore" });
+      execSync(
+        `powershell -Command "Expand-Archive -Path '${archivePath}' -DestinationPath '${tmpDir}'"`,
+        { stdio: "ignore" }
+      );
    } else {
-      execFileSync("tar", ["-xzf", archivePath, "-C", tmpDir], {
+      execSync(`tar -xzf "${archivePath}" -C "${tmpDir}"`, {
        stdio: "ignore",
      });
    }
@@ -88,16 +82,6 @@ function install() {
  }
 }

-// When triggered as a postinstall hook under npx, skip the binary download.
-// The "install" wizard doesn't need it, and run.js calls install.js directly
-// (with LARK_CLI_RUN=1) for other commands that do need the binary.
-const isNpxPostinstall =
-  process.env.npm_command === "exec" && !process.env.LARK_CLI_RUN;
-
-if (isNpxPostinstall) {
-  process.exit(0);
-}
-
 try {
  install();
 } catch (err) {
--- a/scripts/issue-labels/index.js
+++ b/scripts/issue-labels/index.js
@@ -1,6 +1,3 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
 /*
 * Issue labeler for this repository.
 *
--- a/Show More
+++ b/Show More