docs(slides): document table dimensions

.github/workflows/ci.yml

@@ -1,5 +1,4 @@
 name: CI
-run-name: ${{ github.event_name == 'pull_request' && format('CI / {0}', github.event.pull_request.number) || '' }}
 
 on:
   push:
@@ -9,12 +8,6 @@ on:
     types: [opened, synchronize, reopened, edited]
   workflow_dispatch:
 
-# PR metadata edits can retrigger full CI for the same head. Keep only the
-# newest run for a pull request; push and manual runs use a unique run ID.
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-
 permissions:
   contents: read
   actions: read
@@ -302,11 +295,6 @@ jobs:
   e2e-dry-run:
     needs: [unit-test, lint, script-test, deterministic-gate]
     runs-on: ubuntu-latest
-    timeout-minutes: 20
-    outputs:
-      mode: ${{ steps.e2e_domains.outputs.mode }}
-      reason: ${{ steps.e2e_domains.outputs.reason }}
-      live_packages: ${{ steps.e2e_domains.outputs.live_packages }}
     steps:
       - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
         with:
@@ -320,23 +308,6 @@ jobs:
       - name: Resolve CLI E2E domains
         id: e2e_domains
         run: node scripts/e2e_domains.js
-      - name: Validate CLI E2E domain outputs
-        env:
-          E2E_MODE: ${{ steps.e2e_domains.outputs.mode }}
-          E2E_LIVE_PACKAGES: ${{ steps.e2e_domains.outputs.live_packages }}
-        run: |
-          case "$E2E_MODE" in
-            skip)
-              [ -z "$E2E_LIVE_PACKAGES" ] || { echo "::error::Skip mode must not resolve live packages"; exit 1; }
-              ;;
-            full|subset)
-              [ -n "$E2E_LIVE_PACKAGES" ] || { echo "::error::No live packages resolved for mode $E2E_MODE"; exit 1; }
-              ;;
-            *)
-              echo "::error::Invalid CLI E2E mode: $E2E_MODE"
-              exit 1
-              ;;
-          esac
       - name: Build lark-cli
         if: ${{ steps.e2e_domains.outputs.mode != 'skip' }}
         run: make build
@@ -370,22 +341,16 @@ jobs:
           fi
 
   e2e-live:
-    needs: [unit-test, lint, script-test, deterministic-gate, e2e-dry-run]
-    if: ${{ always() && (github.event_name != 'pull_request' || !github.event.pull_request.head.repo.fork) && needs.unit-test.result == 'success' && needs.lint.result == 'success' && needs.script-test.result == 'success' && needs.deterministic-gate.result == 'success' && needs.e2e-dry-run.result == 'success' && (needs.e2e-dry-run.outputs.mode == 'full' || needs.e2e-dry-run.outputs.mode == 'subset') && needs.e2e-dry-run.outputs.live_packages != '' }}
+    needs: [unit-test, lint, script-test, deterministic-gate]
+    if: ${{ github.event_name != 'pull_request' || !github.event.pull_request.head.repo.fork }}
     runs-on: ubuntu-latest
-    timeout-minutes: 30
-    # Live E2E uses one repository-wide execution slot.
-    concurrency:
-      group: lark-cli-e2e-live
-      cancel-in-progress: false
-      queue: max
     permissions:
-      actions: read
       contents: read
       checks: write
     env:
       TEST_BOT1_APP_ID: ${{ secrets.TEST_BOT1_APP_ID }}
-      LARKSUITE_CLI_BRAND: feishu
+      TEST_BOT1_APP_SECRET: ${{ secrets.TEST_BOT1_APP_SECRET }}
+      TEST_USER_ACCESS_TOKEN: ${{ secrets.TEST_USER_ACCESS_TOKEN }}
     steps:
       - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
         with:
@@ -396,68 +361,31 @@ jobs:
       - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
           python-version: '3.x'
+      - name: Resolve CLI E2E domains
+        id: e2e_domains
+        run: node scripts/e2e_domains.js
       - name: Build lark-cli
-        id: build_cli
+        if: ${{ steps.e2e_domains.outputs.mode != 'skip' }}
         run: make build
-      - name: Prepare shared live E2E tenant token
-        id: live_e2e_tat
-        env:
-          LARKSUITE_CLI_APP_ID: ${{ secrets.TEST_BOT1_APP_ID }}
-          TEST_BOT1_APP_SECRET: ${{ secrets.TEST_BOT1_APP_SECRET }}
-        run: node scripts/fetch_e2e_tat.js
-      - name: Run CLI E2E tests
-        # Keep an active Go test alive so t.Cleanup can finish. A queued stale
-        # run is rejected below before it can start live E2E.
-        if: ${{ always() && steps.build_cli.outcome == 'success' && steps.live_e2e_tat.outcome == 'success' }}
-        shell: bash
-        env:
-          GH_TOKEN: ${{ github.token }}
-          REPOSITORY: ${{ github.repository }}
-          EVENT_NAME: ${{ github.event_name }}
-          RUN_ID: ${{ github.run_id }}
-          RUN_NUMBER: ${{ github.run_number }}
-          RUN_GENERATION: ${{ github.event_name == 'pull_request' && format('CI / {0}', github.event.pull_request.number) || '' }}
-          LARK_CLI_BIN: ${{ github.workspace }}/lark-cli
-          E2E_MODE: ${{ needs.e2e-dry-run.outputs.mode }}
-          E2E_REASON: ${{ needs.e2e-dry-run.outputs.reason }}
-          E2E_LIVE_PACKAGES: ${{ needs.e2e-dry-run.outputs.live_packages }}
-          E2E_TENANT_AUTH_FILE: ${{ steps.live_e2e_tat.outputs.path }}
-          TEST_USER_ACCESS_TOKEN: ${{ secrets.TEST_USER_ACCESS_TOKEN }}
+      - name: Configure bot credentials
+        if: ${{ steps.e2e_domains.outputs.mode != 'skip' }}
         run: |
-          if [ "$EVENT_NAME" = "pull_request" ]; then
-            workflow_id="$(gh api "repos/$REPOSITORY/actions/runs/$RUN_ID" --jq '.workflow_id')"
-            newer_runs="$(
-              gh api --paginate -X GET "repos/$REPOSITORY/actions/workflows/$workflow_id/runs" \
-                -f event=pull_request -f branch="$GITHUB_HEAD_REF" -f per_page=100 |
-                jq -r --arg repository "$REPOSITORY" --arg generation "$RUN_GENERATION" --argjson run_number "$RUN_NUMBER" \
-                  '.workflow_runs[] | select(.head_repository.full_name == $repository and .display_title == $generation and .run_number > $run_number) | .id'
-            )"
-            if [ -n "$newer_runs" ]; then
-              echo "::error::Superseded before live E2E started by newer workflow run(s): $newer_runs"
-              exit 1
-            fi
-          fi
-          if [ -z "${E2E_TENANT_AUTH_FILE:-}" ] || [ ! -f "$E2E_TENANT_AUTH_FILE" ]; then
-            echo "::error::Missing shared live E2E tenant token file"
+          if [ -z "$TEST_BOT1_APP_ID" ] || [ -z "$TEST_BOT1_APP_SECRET" ]; then
+            echo "::error::Missing required secrets: TEST_BOT1_APP_ID / TEST_BOT1_APP_SECRET"
             exit 1
           fi
-          export TEST_TENANT_ACCESS_TOKEN="$(cat "$E2E_TENANT_AUTH_FILE")"
-          rm -f "$E2E_TENANT_AUTH_FILE"
-          if ! LARKSUITE_CLI_APP_ID="$TEST_BOT1_APP_ID" \
-            LARKSUITE_CLI_TENANT_ACCESS_TOKEN="$TEST_TENANT_ACCESS_TOKEN" \
-            ./lark-cli whoami --as bot | node -e '
-            let input = "";
-            process.stdin.setEncoding("utf8");
-            process.stdin.on("data", (chunk) => { input += chunk; });
-            process.stdin.on("end", () => {
-              const result = JSON.parse(input);
-              if (result.identity !== "bot" || result.available !== true || result.tokenStatus !== "ready") process.exit(1);
-            });
-          '; then
-            echo "::error::Tenant credential preflight failed"
-            exit 1
+          printf '%s\n' "$TEST_BOT1_APP_SECRET" | ./lark-cli config init --app-id "$TEST_BOT1_APP_ID" --app-secret-stdin
+      - name: Run CLI E2E tests
+        env:
+          LARK_CLI_BIN: ${{ github.workspace }}/lark-cli
+          E2E_MODE: ${{ steps.e2e_domains.outputs.mode }}
+          E2E_REASON: ${{ steps.e2e_domains.outputs.reason }}
+          E2E_LIVE_PACKAGES: ${{ steps.e2e_domains.outputs.live_packages }}
+        run: |
+          if [ "$E2E_MODE" = "skip" ]; then
+            echo "No live CLI E2E needed: $E2E_REASON"
+            exit 0
           fi
-          echo "Tenant credential preflight succeeded"
           packages="$E2E_LIVE_PACKAGES"
           if [ -z "$packages" ]; then
             echo "::error::No live CLI E2E packages resolved for mode $E2E_MODE"
@@ -467,7 +395,7 @@ jobs:
           echo "Live CLI E2E packages: $packages"
           go run gotest.tools/gotestsum@v1.12.3 --rerun-fails=2 --rerun-fails-max-failures=20 --packages="$packages" --format testname --junitfile cli-e2e-report.xml -- -count=1 -v
       - name: Publish CLI E2E test report
-        if: ${{ !cancelled() }}
+        if: ${{ !cancelled() && steps.e2e_domains.outputs.mode != 'skip' }}
         uses: dorny/test-reporter@a43b3a5f7366b97d083190328d2c652e1a8b6aa2 # v3.0.0
         with:
           name: CLI E2E Tests
@@ -544,8 +472,8 @@ jobs:
           echo "| L4 | sidecar-integration (observe-only) | ${{ needs.sidecar-integration.result }} |" >> $GITHUB_STEP_SUMMARY
 
           # Any failure or cancellation in any job blocks the merge.
-          # Legitimately skipped jobs (deadcode on push, e2e-live when not
-          # needed or on a fork, license-header on push) are OK.
+          # Legitimately skipped jobs (deadcode on push, e2e-live on fork,
+          # license-header on push) are OK.
           #
           # plugin-integration and sidecar-integration are intentionally NOT
           # in this loop yet: they run on every PR and their status is shown

CHANGELOG.md

@@ -2,58 +2,6 @@
 
 All notable changes to this project will be documented in this file.
 
-## [v1.0.73] - 2026-07-20
-
-### Features
-
-- **apps**: design_html support, creative-design skill, unified TOS publish (#1901)
-
-### Bug Fixes
-
-- **slides**: detect visual elements outside canvas
-- reduce public content credential fixture false positives
-- standardize CLI shortcut text in English (#1942)
-
-### Documentation
-
-- **base**: reduce filter and update retry loops (#1879)
-- **vc**: default transcript routing to smart notes over minutes (#1961)
-- clarify local trigger automation (#1958)
-
-### Tests
-
-- synchronize temporary Git maintenance (#1946)
-
-### Misc
-
-- **slides**: update lark-slides skill to 0715 snapshot (#1933)
-- [codex] support bot menu events (#1765)
-
-## [v1.0.72] - 2026-07-17
-
-### Features
-
-- **slides**: lint table out of canvas
-- **slides**: report resolved table size mismatches
-- **approval**: support approval event consumption (#1924)
-
-### Bug Fixes
-
-- **vc**: don't fail +detail for in-progress meetings (#1930)
-- stabilize drive delete E2E terminal-state checks (#1939)
-
-### Documentation
-
-- **slides**: document table dimensions
-- document base field default values (#1500)
-- **sheets**: use English placeholder in table-get guidance (#1936)
-
-### Tests
-
-- stabilize live e2e auth retries (#1904)
-- use tri-state wiki node identity in delete verification (#1931)
-- fix drive cover download retries (#1934)
-
 ## [v1.0.71] - 2026-07-16
 
 ### Features
@@ -1579,8 +1527,6 @@ Bundled AI agent skills for intelligent assistance:
 - Bilingual documentation (English & Chinese).
 - CI/CD pipelines: linting, testing, coverage reporting, and automated releases.
 
-[v1.0.73]: https://github.com/larksuite/cli/releases/tag/v1.0.73
-[v1.0.72]: https://github.com/larksuite/cli/releases/tag/v1.0.72
 [v1.0.71]: https://github.com/larksuite/cli/releases/tag/v1.0.71
 [v1.0.70]: https://github.com/larksuite/cli/releases/tag/v1.0.70
 [v1.0.69]: https://github.com/larksuite/cli/releases/tag/v1.0.69

Makefile

@@ -51,7 +51,7 @@ script-test:
 	bash scripts/resolve-changed-from.test.sh
 	bash scripts/ci-workflow.test.sh
 	bash scripts/semantic-review-workflow.test.sh
-	$(NODE) --test scripts/e2e_domains.test.js scripts/fetch_e2e_tat.test.js scripts/semantic-review-verify-artifact.test.js scripts/pr-quality-summary.test.js scripts/semantic-review-publish.test.js scripts/ci-quality-summary-publish.test.js
+	$(NODE) --test scripts/e2e_domains.test.js scripts/semantic-review-verify-artifact.test.js scripts/pr-quality-summary.test.js scripts/semantic-review-publish.test.js scripts/ci-quality-summary-publish.test.js
 
 # ./extension/... keeps the public plugin SDK in the default test matrix.
 unit-test: fetch_meta

cmd/event/list_test.go

@@ -17,8 +17,6 @@ import (
 
 func TestEventLookup_VCMeetingLifecycleKeys(t *testing.T) {
 	for _, key := range []string{
-		"approval.instance.status_changed_v4",
-		"approval.task.status_changed_v4",
 		"vc.meeting.participant_meeting_started_v1",
 		"vc.meeting.participant_meeting_joined_v1",
 	} {
@@ -38,8 +36,6 @@ func TestRunList_TextOutput(t *testing.T) {
 	out := stdout.String()
 	for _, want := range []string{
 		"KEY", "AUTH", "PARAMS", "DESCRIPTION",
-		"approval.instance.status_changed_v4",
-		"approval.task.status_changed_v4",
 		"im.message.receive_v1",
 		"im.message.message_read_v1",
 		"task.task.update_user_access_v2",
@@ -94,8 +90,6 @@ func TestRunList_JSONOutput(t *testing.T) {
 		t.Fatal("event list JSON missing task.task.update_user_access_v2")
 	}
 	for _, want := range []string{
-		"approval.instance.status_changed_v4",
-		"approval.task.status_changed_v4",
 		"vc.meeting.participant_meeting_started_v1",
 		"vc.meeting.participant_meeting_joined_v1",
 	} {

cmd/event/schema_test.go

@@ -19,29 +19,6 @@ import (
 	_ "github.com/larksuite/cli/events"
 )
 
-type approvalSchemaJSONPayload struct {
-	JQRootPath           string                           `json:"jq_root_path"`
-	AuthTypes            []string                         `json:"auth_types"`
-	Scopes               []string                         `json:"scopes"`
-	Params               []approvalSchemaJSONParam        `json:"params"`
-	ResolvedOutputSchema approvalSchemaJSONResolvedSchema `json:"resolved_output_schema"`
-}
-
-type approvalSchemaJSONParam struct {
-	Name            string `json:"name"`
-	Type            string `json:"type"`
-	Required        bool   `json:"required"`
-	SubscriptionKey bool   `json:"subscription_key"`
-}
-
-type approvalSchemaJSONResolvedSchema struct {
-	Properties map[string]approvalSchemaJSONProperty `json:"properties"`
-}
-
-type approvalSchemaJSONProperty struct {
-	Format string `json:"format"`
-}
-
 func TestRunSchema_ProcessedKey_Text(t *testing.T) {
 	f, stdout, _, _ := cmdutil.TestFactory(t, &core.CliConfig{AppID: "test"})
 
@@ -181,60 +158,6 @@ func TestRunSchema_TaskUpdateUserAccessJSON(t *testing.T) {
 	}
 }
 
-func TestRunSchema_ApprovalStatusChangedJSON(t *testing.T) {
-	tests := []struct {
-		key   string
-		scope string
-	}{
-		{"approval.instance.status_changed_v4", "approval:instance:read"},
-		{"approval.task.status_changed_v4", "approval:task:read"},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.key, func(t *testing.T) {
-			t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
-			f, stdout, _, _ := cmdutil.TestFactory(t, &core.CliConfig{AppID: "test"})
-
-			if err := runSchema(f, tc.key, true); err != nil {
-				t.Fatalf("runSchema json: %v", err)
-			}
-
-			var payload approvalSchemaJSONPayload
-			if err := json.Unmarshal(stdout.Bytes(), &payload); err != nil {
-				t.Fatalf("output is not valid JSON: %v\n%s", err, stdout.String())
-			}
-			if payload.JQRootPath != "." {
-				t.Errorf("jq_root_path = %v, want .", payload.JQRootPath)
-			}
-			if got := payload.AuthTypes; !reflect.DeepEqual(got, []string{"user"}) {
-				t.Errorf("auth_types = %#v, want user", got)
-			}
-			if got := payload.Scopes; !reflect.DeepEqual(got, []string{tc.scope}) {
-				t.Errorf("scopes = %#v, want %s", got, tc.scope)
-			}
-			if len(payload.Params) != 1 {
-				t.Fatalf("params = %#v, want one subscription_type param", payload.Params)
-			}
-			param := payload.Params[0]
-			if param.Name != "subscription_type" || param.Type != "multi" || param.Required || param.SubscriptionKey {
-				t.Fatalf("subscription_type param = %#v, want optional multi non-subscription-key param", param)
-			}
-			props := payload.ResolvedOutputSchema.Properties
-			for _, field := range []string{"type", "event_id", "timestamp", "approval_code", "instance_code", "status", "operate_time"} {
-				if _, ok := props[field]; !ok {
-					t.Errorf("approval schema missing flat field %q: %+v", field, props)
-				}
-			}
-			if _, ok := props["event"]; ok {
-				t.Errorf("approval Custom schema should be flat, got envelope field event: %+v", props)
-			}
-			if got := props["operate_time"].Format; got != "timestamp_ms" {
-				t.Errorf("operate_time format = %v, want timestamp_ms", got)
-			}
-		})
-	}
-}
-
 func TestRunSchema_JSONOutput_VCMeetingLifecycleKeys(t *testing.T) {
 	for _, key := range []string{
 		"vc.meeting.participant_meeting_started_v1",

events/application/menu.go

@@ -1,107 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package application
-
-import (
-	"context"
-	"encoding/json"
-	"strings"
-
-	"github.com/larksuite/cli/internal/event"
-)
-
-// BotMenuOutput is the flattened shape for application.bot.menu_v6.
-type BotMenuOutput struct {
-	Type            string `json:"type"                         desc:"Event type; always application.bot.menu_v6"`
-	EventID         string `json:"event_id,omitempty"           desc:"Globally unique event ID; safe for deduplication"`
-	Timestamp       string `json:"timestamp,omitempty"          desc:"Event delivery time (ms timestamp string); prefers header.create_time" kind:"timestamp_ms"`
-	AppID           string `json:"app_id,omitempty"             desc:"Application ID from the event header"`
-	TenantKey       string `json:"tenant_key,omitempty"         desc:"Tenant key from the event header"`
-	EventKey        string `json:"event_key,omitempty"          desc:"Developer-defined bot menu event key"`
-	MenuTimestamp   string `json:"menu_timestamp,omitempty"     desc:"Menu click timestamp from the event body"                           kind:"timestamp_ms"`
-	OperatorID      string `json:"operator_id,omitempty"        desc:"Operator open_id; kept as a short alias of operator_open_id"        kind:"open_id"`
-	OperatorOpenID  string `json:"operator_open_id,omitempty"   desc:"Operator open_id"                                                   kind:"open_id"`
-	OperatorUnionID string `json:"operator_union_id,omitempty"  desc:"Operator union_id"                                                  kind:"union_id"`
-	OperatorUserID  string `json:"operator_user_id,omitempty"   desc:"Operator user_id"                                                   kind:"user_id"`
-	OperatorName    string `json:"operator_name,omitempty"      desc:"Operator display name"`
-}
-
-func processBotMenu(_ context.Context, _ event.APIClient, raw *event.RawEvent, _ map[string]string) (json.RawMessage, error) {
-	var envelope struct {
-		Header struct {
-			EventID    string `json:"event_id"`
-			EventType  string `json:"event_type"`
-			CreateTime string `json:"create_time"`
-			AppID      string `json:"app_id"`
-			TenantKey  string `json:"tenant_key"`
-		} `json:"header"`
-		Event struct {
-			EventKey  string          `json:"event_key"`
-			Timestamp json.RawMessage `json:"timestamp"`
-			Operator  struct {
-				OperatorID struct {
-					OpenID  string `json:"open_id"`
-					UnionID string `json:"union_id"`
-					UserID  string `json:"user_id"`
-				} `json:"operator_id"`
-				OperatorName string `json:"operator_name"`
-			} `json:"operator"`
-		} `json:"event"`
-	}
-	if err := json.Unmarshal(raw.Payload, &envelope); err != nil {
-		return raw.Payload, nil //nolint:nilerr // passthrough on malformed payload so consumers still see the event
-	}
-
-	menuTimestamp := timestampMillisString(envelope.Event.Timestamp)
-	timestamp := envelope.Header.CreateTime
-	if timestamp == "" {
-		timestamp = menuTimestamp
-	}
-	operatorID := envelope.Event.Operator.OperatorID.OpenID
-
-	out := &BotMenuOutput{
-		Type:            eventTypeBotMenuV6,
-		EventID:         envelope.Header.EventID,
-		Timestamp:       timestamp,
-		AppID:           envelope.Header.AppID,
-		TenantKey:       envelope.Header.TenantKey,
-		EventKey:        envelope.Event.EventKey,
-		MenuTimestamp:   menuTimestamp,
-		OperatorID:      operatorID,
-		OperatorOpenID:  operatorID,
-		OperatorUnionID: envelope.Event.Operator.OperatorID.UnionID,
-		OperatorUserID:  envelope.Event.Operator.OperatorID.UserID,
-		OperatorName:    envelope.Event.Operator.OperatorName,
-	}
-	return json.Marshal(out)
-}
-
-func rawScalarString(raw json.RawMessage) string {
-	s := strings.TrimSpace(string(raw))
-	if s == "" || s == "null" {
-		return ""
-	}
-	var text string
-	if err := json.Unmarshal(raw, &text); err == nil {
-		return text
-	}
-	return s
-}
-
-func timestampMillisString(raw json.RawMessage) string {
-	s := rawScalarString(raw)
-	if len(s) == 10 && allDigits(s) {
-		return s + "000"
-	}
-	return s
-}
-
-func allDigits(s string) bool {
-	for _, r := range s {
-		if r < '0' || r > '9' {
-			return false
-		}
-	}
-	return s != ""
-}

events/application/menu_test.go

@@ -1,227 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package application
-
-import (
-	"context"
-	"encoding/json"
-	"reflect"
-	"testing"
-	"time"
-
-	"github.com/larksuite/cli/internal/event"
-)
-
-func TestKeysBotMenuMetadata(t *testing.T) {
-	keys := Keys()
-	if len(keys) != 1 {
-		t.Fatalf("len(Keys()) = %d, want 1", len(keys))
-	}
-
-	def := keys[0]
-	if def.Key != eventTypeBotMenuV6 {
-		t.Errorf("Key = %q, want %q", def.Key, eventTypeBotMenuV6)
-	}
-	if def.EventType != eventTypeBotMenuV6 {
-		t.Errorf("EventType = %q, want %q", def.EventType, eventTypeBotMenuV6)
-	}
-	if def.SubscriptionType != "" {
-		t.Errorf("SubscriptionType = %q, want default event subscription", def.SubscriptionType)
-	}
-	if def.Schema.Custom == nil {
-		t.Fatal("Schema.Custom is nil")
-	}
-	if def.Schema.Custom.Type != reflect.TypeOf(BotMenuOutput{}) {
-		t.Errorf("custom type = %v, want BotMenuOutput", def.Schema.Custom.Type)
-	}
-	if def.Schema.Native != nil {
-		t.Fatal("Schema.Native must be nil for processed output")
-	}
-	if def.Process == nil {
-		t.Fatal("Process is nil")
-	}
-	if !reflect.DeepEqual(def.AuthTypes, []string{"bot"}) {
-		t.Errorf("AuthTypes = %#v", def.AuthTypes)
-	}
-	if !reflect.DeepEqual(def.RequiredConsoleEvents, []string{eventTypeBotMenuV6}) {
-		t.Errorf("RequiredConsoleEvents = %#v", def.RequiredConsoleEvents)
-	}
-}
-
-func TestBotMenuRegistersCleanly(t *testing.T) {
-	const key = eventTypeBotMenuV6
-	event.UnregisterKeyForTest(key)
-	t.Cleanup(func() { event.UnregisterKeyForTest(key) })
-
-	for _, def := range Keys() {
-		event.RegisterKey(def)
-	}
-	if _, ok := event.Lookup(key); !ok {
-		t.Fatalf("event.Lookup(%q) not registered", key)
-	}
-}
-
-func TestProcessBotMenu(t *testing.T) {
-	payload := `{
-		"schema": "2.0",
-		"header": {
-			"event_id": "ev_menu_001",
-			"event_type": "application.bot.menu_v6",
-			"create_time": "1776409469273",
-			"app_id": "cli_test",
-			"tenant_key": "tenant_test"
-		},
-		"event": {
-			"event_key": "start_eval",
-			"timestamp": 1776409469000,
-			"operator": {
-				"operator_id": {
-					"open_id": "ou_operator",
-					"union_id": "on_operator",
-					"user_id": "user_operator"
-				},
-				"operator_name": "Test User"
-			}
-		}
-	}`
-	out := runBotMenu(t, payload)
-
-	if out.Type != eventTypeBotMenuV6 {
-		t.Errorf("Type = %q, want %q", out.Type, eventTypeBotMenuV6)
-	}
-	if out.EventID != "ev_menu_001" {
-		t.Errorf("EventID = %q", out.EventID)
-	}
-	if out.Timestamp != "1776409469273" {
-		t.Errorf("Timestamp = %q", out.Timestamp)
-	}
-	if out.EventKey != "start_eval" {
-		t.Errorf("EventKey = %q", out.EventKey)
-	}
-	if out.MenuTimestamp != "1776409469000" {
-		t.Errorf("MenuTimestamp = %q", out.MenuTimestamp)
-	}
-	if out.OperatorID != "ou_operator" || out.OperatorOpenID != "ou_operator" {
-		t.Errorf("OperatorID/OperatorOpenID = %q/%q", out.OperatorID, out.OperatorOpenID)
-	}
-	if out.OperatorUnionID != "on_operator" {
-		t.Errorf("OperatorUnionID = %q", out.OperatorUnionID)
-	}
-	if out.OperatorUserID != "user_operator" {
-		t.Errorf("OperatorUserID = %q", out.OperatorUserID)
-	}
-	if out.OperatorName != "Test User" {
-		t.Errorf("OperatorName = %q", out.OperatorName)
-	}
-	if out.AppID != "cli_test" || out.TenantKey != "tenant_test" {
-		t.Errorf("AppID/TenantKey = %q/%q", out.AppID, out.TenantKey)
-	}
-}
-
-func TestProcessBotMenuStringTimestampFallback(t *testing.T) {
-	payload := `{
-		"schema": "2.0",
-		"header": {
-			"event_id": "ev_menu_002",
-			"event_type": "application.bot.menu_v6"
-		},
-		"event": {
-			"event_key": "start_eval",
-			"timestamp": "1776409469001",
-			"operator": {
-				"operator_id": {"open_id": "ou_operator"}
-			}
-		}
-	}`
-	out := runBotMenu(t, payload)
-
-	if out.Timestamp != "1776409469001" {
-		t.Errorf("Timestamp fallback = %q", out.Timestamp)
-	}
-	if out.MenuTimestamp != "1776409469001" {
-		t.Errorf("MenuTimestamp = %q", out.MenuTimestamp)
-	}
-}
-
-func TestProcessBotMenuSecondsTimestampFallback(t *testing.T) {
-	payload := `{
-		"schema": "2.0",
-		"header": {
-			"event_id": "ev_menu_seconds",
-			"event_type": "application.bot.menu_v6"
-		},
-		"event": {
-			"event_key": "start_eval",
-			"timestamp": 1694592375,
-			"operator": {
-				"operator_id": {"open_id": "ou_operator"}
-			}
-		}
-	}`
-	out := runBotMenu(t, payload)
-
-	if out.Timestamp != "1694592375000" {
-		t.Errorf("Timestamp fallback = %q, want seconds normalized to milliseconds", out.Timestamp)
-	}
-	if out.MenuTimestamp != "1694592375000" {
-		t.Errorf("MenuTimestamp = %q, want seconds normalized to milliseconds", out.MenuTimestamp)
-	}
-}
-
-func TestProcessBotMenuTypeUsesLocalConstant(t *testing.T) {
-	payload := `{
-		"schema": "2.0",
-		"header": {
-			"event_id": "ev_menu_003",
-			"event_type": "unexpected.event_type",
-			"create_time": "1776409469275"
-		},
-		"event": {
-			"event_key": "start_eval",
-			"operator": {
-				"operator_id": {"open_id": "ou_operator"}
-			}
-		}
-	}`
-	out := runBotMenu(t, payload)
-
-	if out.Type != eventTypeBotMenuV6 {
-		t.Errorf("Type = %q, want %q", out.Type, eventTypeBotMenuV6)
-	}
-}
-
-func TestProcessBotMenuMalformedPayload(t *testing.T) {
-	raw := &event.RawEvent{
-		EventID:   "ev_bad",
-		EventType: eventTypeBotMenuV6,
-		Payload:   json.RawMessage(`not json`),
-		Timestamp: time.Now(),
-	}
-	got, err := processBotMenu(context.Background(), nil, raw, nil)
-	if err != nil {
-		t.Fatalf("Process should swallow parse errors, got %v", err)
-	}
-	if string(got) != "not json" {
-		t.Errorf("malformed fallback output = %q, want original bytes", string(got))
-	}
-}
-
-func runBotMenu(t *testing.T, payload string) BotMenuOutput {
-	t.Helper()
-	raw := &event.RawEvent{
-		EventID:   "ev_test",
-		EventType: eventTypeBotMenuV6,
-		Payload:   json.RawMessage(payload),
-		Timestamp: time.Now(),
-	}
-	got, err := processBotMenu(context.Background(), nil, raw, nil)
-	if err != nil {
-		t.Fatalf("processBotMenu: %v", err)
-	}
-	var out BotMenuOutput
-	if err := json.Unmarshal(got, &out); err != nil {
-		t.Fatalf("unmarshal output: %v\n%s", err, got)
-	}
-	return out
-}

events/application/register.go

@@ -1,31 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-// Package application registers Application-domain EventKeys.
-package application
-
-import (
-	"reflect"
-
-	"github.com/larksuite/cli/internal/event"
-)
-
-const eventTypeBotMenuV6 = "application.bot.menu_v6"
-
-// Keys returns all Application-domain EventKey definitions.
-func Keys() []event.KeyDefinition {
-	return []event.KeyDefinition{
-		{
-			Key:         eventTypeBotMenuV6,
-			DisplayName: "Bot menu",
-			Description: "Triggered when a user clicks a custom bot menu item whose action is configured as a push event.",
-			EventType:   eventTypeBotMenuV6,
-			Schema: event.SchemaDef{
-				Custom: &event.SchemaSpec{Type: reflect.TypeOf(BotMenuOutput{})},
-			},
-			Process:               processBotMenu,
-			AuthTypes:             []string{"bot"},
-			RequiredConsoleEvents: []string{eventTypeBotMenuV6},
-		},
-	}
-}

events/approval/preconsume.go

@@ -1,155 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package approval
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"strings"
-
-	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/event"
-)
-
-type approvalEventType string
-type approvalSubscriptionPath string
-
-type approvalSubscriptionConfig struct {
-	eventType     approvalEventType
-	subscribePath approvalSubscriptionPath
-}
-
-func approvalSubscriptionPreConsume(cfg approvalSubscriptionConfig) func(context.Context, event.APIClient, map[string]string) (func() error, error) {
-	return func(ctx context.Context, rt event.APIClient, params map[string]string) (func() error, error) {
-		if rt == nil {
-			return nil, errs.NewInternalError(errs.SubtypeUnknown,
-				"runtime API client is required for pre-consume subscription")
-		}
-
-		eventType := string(cfg.eventType)
-		subscribePath := string(cfg.subscribePath)
-		subscriptionTypes, err := approvalSubscriptionTypes(eventType, params)
-		if err != nil {
-			return nil, err
-		}
-
-		registered := make([]string, 0, len(subscriptionTypes))
-		for _, subscriptionType := range subscriptionTypes {
-			body := map[string]string{"subscription_type": subscriptionType}
-			if _, err := rt.CallAPI(ctx, "POST", subscribePath, body); err != nil {
-				return nil, approvalSubscriptionRegistrationError(eventType, registered, subscriptionType, err)
-			}
-			registered = append(registered, subscriptionType)
-		}
-
-		// Approval subscriptions are durable user-auth relations. Consuming events
-		// should not cancel that relation when this local process exits.
-		return nil, nil
-	}
-}
-
-func approvalSubscriptionTypes(eventType string, params map[string]string) ([]string, error) {
-	raw := strings.TrimSpace(params["subscription_type"])
-	if raw == "" {
-		return append([]string(nil), approvalAllSubscriptionTypes...), nil
-	}
-
-	values, err := parseApprovalSubscriptionTypeValues(raw)
-	if err != nil {
-		return nil, invalidApprovalSubscriptionTypeError(eventType, raw)
-	}
-
-	selected := make(map[string]bool, len(values))
-	for _, value := range values {
-		value = strings.TrimSpace(value)
-		switch value {
-		case approvalSubscriptionTypeInvolved, approvalSubscriptionTypeManaged:
-			selected[value] = true
-		default:
-			return nil, invalidApprovalSubscriptionTypeError(eventType, value)
-		}
-	}
-
-	result := make([]string, 0, len(selected))
-	for _, value := range approvalAllSubscriptionTypes {
-		if selected[value] {
-			result = append(result, value)
-		}
-	}
-	if len(result) == 0 {
-		return nil, invalidApprovalSubscriptionTypeError(eventType, raw)
-	}
-	return result, nil
-}
-
-func parseApprovalSubscriptionTypeValues(raw string) ([]string, error) {
-	if strings.HasPrefix(raw, "[") {
-		var values []string
-		if err := json.Unmarshal([]byte(raw), &values); err != nil {
-			return nil, err
-		}
-		return values, nil
-	}
-	return strings.Split(raw, ","), nil
-}
-
-func approvalSubscriptionRegistrationError(eventType string, registered []string, failed string, err error) error {
-	if err == nil {
-		return nil
-	}
-
-	msg := fmt.Sprintf(
-		"approval subscription pre-consume failed for EventKey %s: failed subscription_type %s",
-		eventType,
-		failed,
-	)
-	hint := fmt.Sprintf(
-		"no approval subscription relation was registered for EventKey %s; fix the cause and retry",
-		eventType,
-	)
-	if len(registered) > 0 {
-		msg = fmt.Sprintf(
-			"approval subscription pre-consume partially completed for EventKey %s: registered subscription_type(s) [%s], failed subscription_type %s",
-			eventType,
-			strings.Join(registered, ", "),
-			failed,
-		)
-		hint = fmt.Sprintf(
-			"server-side approval subscription relation(s) already registered for EventKey %s: %s; after fixing the cause, retry with --param subscription_type=%s to register the failed relation",
-			eventType,
-			strings.Join(registered, ", "),
-			failed,
-		)
-	}
-
-	if p, ok := errs.ProblemOf(err); ok {
-		if upstream := strings.TrimSpace(p.Message); upstream != "" {
-			p.Message = msg + ": " + upstream
-		} else {
-			p.Message = msg
-		}
-		if upstreamHint := strings.TrimSpace(p.Hint); upstreamHint != "" {
-			p.Hint = upstreamHint + "\n" + hint
-		} else {
-			p.Hint = hint
-		}
-		return err
-	}
-	return errs.NewInternalError(errs.SubtypeSDKError, "%s: %v", msg, err).
-		WithHint("%s", hint).
-		WithCause(err)
-}
-
-func invalidApprovalSubscriptionTypeError(eventType, value string) error {
-	return errs.NewValidationError(errs.SubtypeInvalidArgument,
-		"invalid subscription_type for EventKey %s: %q", eventType, value).
-		WithParam("--param").
-		WithHint("omit subscription_type to register both approval subscription relations, or pass --param subscription_type=%s, --param subscription_type=%s, or --param subscription_type=%s,%s; run `lark-cli event schema %s` for details",
-			approvalSubscriptionTypeInvolved,
-			approvalSubscriptionTypeManaged,
-			approvalSubscriptionTypeInvolved,
-			approvalSubscriptionTypeManaged,
-			eventType)
-}

events/approval/register.go

@@ -1,179 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-// Package approval registers Approval-domain EventKeys.
-package approval
-
-import (
-	"context"
-	"encoding/json"
-	"reflect"
-
-	"github.com/larksuite/cli/internal/event"
-)
-
-const (
-	eventTypeApprovalInstanceStatusChangedV4 = "approval.instance.status_changed_v4"
-	eventTypeApprovalTaskStatusChangedV4     = "approval.task.status_changed_v4"
-
-	pathApprovalInstancesSubscription = "/open-apis/approval/v4/instances/subscription"
-	pathApprovalTasksSubscription     = "/open-apis/approval/v4/tasks/subscription"
-
-	approvalSubscriptionTypeInvolved = "INVOLVED_APPROVAL"
-	approvalSubscriptionTypeManaged  = "MANAGED_APPROVAL"
-)
-
-var approvalAllSubscriptionTypes = []string{
-	approvalSubscriptionTypeInvolved,
-	approvalSubscriptionTypeManaged,
-}
-
-// Keys returns all Approval-domain EventKey definitions.
-func Keys() []event.KeyDefinition {
-	return []event.KeyDefinition{
-		{
-			Key:         eventTypeApprovalInstanceStatusChangedV4,
-			DisplayName: "Approval instance status changed",
-			Description: "Triggered after an approval instance status becomes visible to the requester or approval participants",
-			EventType:   eventTypeApprovalInstanceStatusChangedV4,
-			Params:      approvalSubscriptionParams(),
-			Schema: event.SchemaDef{
-				Custom: &event.SchemaSpec{Type: reflect.TypeOf(ApprovalInstanceStatusChangedV4Output{})},
-			},
-			Process: processApprovalInstanceStatusChanged,
-			PreConsume: approvalSubscriptionPreConsume(approvalSubscriptionConfig{
-				eventType:     eventTypeApprovalInstanceStatusChangedV4,
-				subscribePath: pathApprovalInstancesSubscription,
-			}),
-			Scopes: []string{"approval:instance:read"},
-			AuthTypes: []string{
-				"user",
-			},
-			RequiredConsoleEvents: []string{eventTypeApprovalInstanceStatusChangedV4},
-		},
-		{
-			Key:         eventTypeApprovalTaskStatusChangedV4,
-			DisplayName: "Approval task status changed",
-			Description: "Triggered after an approval task status becomes visible to the requester or task approver",
-			EventType:   eventTypeApprovalTaskStatusChangedV4,
-			Params:      approvalSubscriptionParams(),
-			Schema: event.SchemaDef{
-				Custom: &event.SchemaSpec{Type: reflect.TypeOf(ApprovalTaskStatusChangedV4Output{})},
-			},
-			Process: processApprovalTaskStatusChanged,
-			PreConsume: approvalSubscriptionPreConsume(approvalSubscriptionConfig{
-				eventType:     eventTypeApprovalTaskStatusChangedV4,
-				subscribePath: pathApprovalTasksSubscription,
-			}),
-			Scopes: []string{"approval:task:read"},
-			AuthTypes: []string{
-				"user",
-			},
-			RequiredConsoleEvents: []string{eventTypeApprovalTaskStatusChangedV4},
-		},
-	}
-}
-
-func approvalSubscriptionParams() []event.ParamDef {
-	return []event.ParamDef{
-		{
-			Name:        "subscription_type",
-			Type:        event.ParamMulti,
-			Description: "Approval subscription relation type(s) to register for the current authorized user. Omit to register both involved and managed approval relations.",
-			Values: []event.ParamValue{
-				{
-					Value: approvalSubscriptionTypeInvolved,
-					Desc:  "Receive events where the current user is the approval requester or approver.",
-				},
-				{
-					Value: approvalSubscriptionTypeManaged,
-					Desc:  "Receive events under approval definitions managed by the current user.",
-				},
-			},
-		},
-	}
-}
-
-func processApprovalInstanceStatusChanged(_ context.Context, _ event.APIClient, raw *event.RawEvent, _ map[string]string) (json.RawMessage, error) {
-	if raw == nil {
-		return nil, nil
-	}
-	var envelope struct {
-		Header struct {
-			EventID    string `json:"event_id"`
-			EventType  string `json:"event_type"`
-			CreateTime string `json:"create_time"`
-		} `json:"header"`
-		Event struct {
-			ApprovalCode string          `json:"approval_code"`
-			InstanceCode string          `json:"instance_code"`
-			ExternalID   string          `json:"external_id"`
-			Status       string          `json:"status"`
-			OperateTime  string          `json:"operate_time"`
-			StartUser    *ApprovalUserID `json:"start_user"`
-		} `json:"event"`
-	}
-	if err := json.Unmarshal(raw.Payload, &envelope); err != nil {
-		return raw.Payload, nil //nolint:nilerr // passthrough on malformed payload so consumers still see the event
-	}
-
-	out := &ApprovalInstanceStatusChangedV4Output{
-		Type:         envelope.Header.EventType,
-		EventID:      envelope.Header.EventID,
-		Timestamp:    envelope.Header.CreateTime,
-		ApprovalCode: envelope.Event.ApprovalCode,
-		InstanceCode: envelope.Event.InstanceCode,
-		ExternalID:   envelope.Event.ExternalID,
-		Status:       envelope.Event.Status,
-		OperateTime:  envelope.Event.OperateTime,
-		StartUser:    envelope.Event.StartUser,
-	}
-	if out.Type == "" {
-		out.Type = raw.EventType
-	}
-	return json.Marshal(out)
-}
-
-func processApprovalTaskStatusChanged(_ context.Context, _ event.APIClient, raw *event.RawEvent, _ map[string]string) (json.RawMessage, error) {
-	if raw == nil {
-		return nil, nil
-	}
-	var envelope struct {
-		Header struct {
-			EventID    string `json:"event_id"`
-			EventType  string `json:"event_type"`
-			CreateTime string `json:"create_time"`
-		} `json:"header"`
-		Event struct {
-			ApprovalCode   string          `json:"approval_code"`
-			InstanceCode   string          `json:"instance_code"`
-			TaskID         string          `json:"task_id"`
-			ExternalID     string          `json:"external_id"`
-			TaskExternalID string          `json:"task_external_id"`
-			AssignedUser   *ApprovalUserID `json:"assigned_user"`
-			Status         string          `json:"status"`
-			OperateTime    string          `json:"operate_time"`
-		} `json:"event"`
-	}
-	if err := json.Unmarshal(raw.Payload, &envelope); err != nil {
-		return raw.Payload, nil //nolint:nilerr // passthrough on malformed payload so consumers still see the event
-	}
-
-	out := &ApprovalTaskStatusChangedV4Output{
-		Type:           envelope.Header.EventType,
-		EventID:        envelope.Header.EventID,
-		Timestamp:      envelope.Header.CreateTime,
-		ApprovalCode:   envelope.Event.ApprovalCode,
-		InstanceCode:   envelope.Event.InstanceCode,
-		TaskID:         envelope.Event.TaskID,
-		ExternalID:     envelope.Event.ExternalID,
-		TaskExternalID: envelope.Event.TaskExternalID,
-		AssignedUser:   envelope.Event.AssignedUser,
-		Status:         envelope.Event.Status,
-		OperateTime:    envelope.Event.OperateTime,
-	}
-	if out.Type == "" {
-		out.Type = raw.EventType
-	}
-	return json.Marshal(out)
-}

events/approval/register_test.go

@@ -1,654 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package approval
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"reflect"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/event"
-	"github.com/larksuite/cli/internal/event/schemas"
-)
-
-type recordedCall struct {
-	method string
-	path   string
-	body   interface{}
-}
-
-type fakeAPIClient struct {
-	calls     []recordedCall
-	err       error
-	errOnCall int
-}
-
-func (f *fakeAPIClient) CallAPI(_ context.Context, method, path string, body interface{}) (json.RawMessage, error) {
-	f.calls = append(f.calls, recordedCall{method: method, path: path, body: body})
-	if f.err != nil && (f.errOnCall == 0 || f.errOnCall == len(f.calls)) {
-		return nil, f.err
-	}
-	return json.RawMessage(`{}`), nil
-}
-
-func TestKeysApprovalMetadata(t *testing.T) {
-	keys := Keys()
-	if len(keys) != 2 {
-		t.Fatalf("len(Keys()) = %d, want 2", len(keys))
-	}
-
-	tests := []struct {
-		key        string
-		scope      string
-		schemaType reflect.Type
-		subscribe  string
-	}{
-		{
-			key:        eventTypeApprovalInstanceStatusChangedV4,
-			scope:      "approval:instance:read",
-			schemaType: reflect.TypeOf(ApprovalInstanceStatusChangedV4Output{}),
-			subscribe:  pathApprovalInstancesSubscription,
-		},
-		{
-			key:        eventTypeApprovalTaskStatusChangedV4,
-			scope:      "approval:task:read",
-			schemaType: reflect.TypeOf(ApprovalTaskStatusChangedV4Output{}),
-			subscribe:  pathApprovalTasksSubscription,
-		},
-	}
-
-	byKey := make(map[string]event.KeyDefinition, len(keys))
-	for _, def := range keys {
-		byKey[def.Key] = def
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.key, func(t *testing.T) {
-			def, ok := byKey[tc.key]
-			if !ok {
-				t.Fatalf("missing key %s", tc.key)
-			}
-			if def.EventType != tc.key {
-				t.Errorf("EventType = %q, want %q", def.EventType, tc.key)
-			}
-			if def.Schema.Custom == nil || def.Schema.Custom.Type != tc.schemaType {
-				t.Fatalf("Custom schema Type = %v, want %v", def.Schema.Custom, tc.schemaType)
-			}
-			if def.Schema.Native != nil {
-				t.Fatal("approval events must use Custom schema while SDK event types are not exported")
-			}
-			if def.Process == nil {
-				t.Fatal("Process must flatten raw V2 envelopes")
-			}
-			if def.PreConsume == nil {
-				t.Fatal("PreConsume must subscribe approval user-auth events")
-			}
-			if !reflect.DeepEqual(def.Scopes, []string{tc.scope}) {
-				t.Errorf("Scopes = %#v, want %q", def.Scopes, tc.scope)
-			}
-			if !reflect.DeepEqual(def.AuthTypes, []string{"user"}) {
-				t.Errorf("AuthTypes = %#v, want user", def.AuthTypes)
-			}
-			if !reflect.DeepEqual(def.RequiredConsoleEvents, []string{tc.key}) {
-				t.Errorf("RequiredConsoleEvents = %#v, want %q", def.RequiredConsoleEvents, tc.key)
-			}
-			assertSubscriptionParam(t, def.Params)
-		})
-	}
-}
-
-func assertSubscriptionParam(t *testing.T, params []event.ParamDef) {
-	t.Helper()
-	if len(params) != 1 {
-		t.Fatalf("len(params) = %d, want 1", len(params))
-	}
-	p := params[0]
-	if p.Name != "subscription_type" || p.Type != event.ParamMulti || p.Required || p.SubscriptionKey {
-		t.Fatalf("subscription_type param = %+v, want optional multi non-subscription-key param", p)
-	}
-	got := map[string]string{}
-	for _, v := range p.Values {
-		got[v.Value] = v.Desc
-	}
-	for _, want := range []string{approvalSubscriptionTypeInvolved, approvalSubscriptionTypeManaged} {
-		if got[want] == "" {
-			t.Errorf("subscription_type value %q missing or empty desc; values=%+v", want, p.Values)
-		}
-	}
-}
-
-type reflectedApprovalSchema struct {
-	Properties map[string]reflectedApprovalSchemaProperty `json:"properties"`
-}
-
-type reflectedApprovalSchemaProperty struct {
-	Format     string                                     `json:"format"`
-	Enum       []string                                   `json:"enum"`
-	Properties map[string]reflectedApprovalSchemaProperty `json:"properties"`
-}
-
-func TestApprovalSchemasAnnotations(t *testing.T) {
-	tests := []struct {
-		name         string
-		schemaType   reflect.Type
-		eventType    string
-		statusValues []string
-		userField    string
-	}{
-		{
-			name:         "instance",
-			schemaType:   reflect.TypeOf(ApprovalInstanceStatusChangedV4Output{}),
-			eventType:    eventTypeApprovalInstanceStatusChangedV4,
-			statusValues: []string{"PENDING", "APPROVED", "REJECTED", "CANCELED", "DELETED", "REVERTED", "OVERTIME_CLOSE", "OVERTIME_RECOVER"},
-			userField:    "start_user",
-		},
-		{
-			name:         "task",
-			schemaType:   reflect.TypeOf(ApprovalTaskStatusChangedV4Output{}),
-			eventType:    eventTypeApprovalTaskStatusChangedV4,
-			statusValues: []string{"REVERTED", "PENDING", "APPROVED", "REJECTED", "TRANSFERRED", "ROLLBACK", "DONE", "OVERTIME_CLOSE", "OVERTIME_RECOVER"},
-			userField:    "assigned_user",
-		},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			var schema reflectedApprovalSchema
-			if err := json.Unmarshal(schemas.FromType(tc.schemaType), &schema); err != nil {
-				t.Fatalf("unmarshal schema: %v", err)
-			}
-			props := schema.Properties
-			eventTypeEnum := props["type"].Enum
-			if len(eventTypeEnum) != 1 || eventTypeEnum[0] != tc.eventType {
-				t.Fatalf("type enum = %v, want %s", eventTypeEnum, tc.eventType)
-			}
-			if got := props["timestamp"].Format; got != "timestamp_ms" {
-				t.Errorf("timestamp format = %v, want timestamp_ms", got)
-			}
-			assertEnumContains(t, props["status"].Enum, tc.statusValues)
-			if got := props["operate_time"].Format; got != "timestamp_ms" {
-				t.Errorf("event.operate_time format = %v, want timestamp_ms", got)
-			}
-
-			userProps := props[tc.userField].Properties
-			if got := userProps["open_id"].Format; got != "open_id" {
-				t.Errorf("%s.open_id format = %v, want open_id", tc.userField, got)
-			}
-			if got := userProps["union_id"].Format; got != "union_id" {
-				t.Errorf("%s.union_id format = %v, want union_id", tc.userField, got)
-			}
-			if got := userProps["user_id"].Format; got != "user_id" {
-				t.Errorf("%s.user_id format = %v, want user_id", tc.userField, got)
-			}
-		})
-	}
-}
-
-func assertEnumContains(t *testing.T, raw []string, wants []string) {
-	t.Helper()
-	got := make(map[string]bool, len(raw))
-	for _, v := range raw {
-		got[v] = true
-	}
-	for _, want := range wants {
-		if !got[want] {
-			t.Errorf("enum missing %q; enum=%v", want, raw)
-		}
-	}
-}
-
-func TestApprovalPreConsumeRegistersSubscriptionTypesWithoutCleanup(t *testing.T) {
-	tests := []struct {
-		name          string
-		eventType     string
-		subscribePath string
-		params        map[string]string
-		wantTypes     []string
-	}{
-		{
-			name:          "instance omitted subscription_type registers both",
-			eventType:     eventTypeApprovalInstanceStatusChangedV4,
-			subscribePath: pathApprovalInstancesSubscription,
-			wantTypes: []string{
-				approvalSubscriptionTypeInvolved,
-				approvalSubscriptionTypeManaged,
-			},
-		},
-		{
-			name:          "task explicit single managed",
-			eventType:     eventTypeApprovalTaskStatusChangedV4,
-			subscribePath: pathApprovalTasksSubscription,
-			params:        map[string]string{"subscription_type": approvalSubscriptionTypeManaged},
-			wantTypes:     []string{approvalSubscriptionTypeManaged},
-		},
-		{
-			name:          "task comma separated multi canonicalizes and deduplicates",
-			eventType:     eventTypeApprovalTaskStatusChangedV4,
-			subscribePath: pathApprovalTasksSubscription,
-			params: map[string]string{
-				"subscription_type": approvalSubscriptionTypeManaged + "," + approvalSubscriptionTypeInvolved + "," + approvalSubscriptionTypeManaged,
-			},
-			wantTypes: []string{
-				approvalSubscriptionTypeInvolved,
-				approvalSubscriptionTypeManaged,
-			},
-		},
-		{
-			name:          "instance json array multi",
-			eventType:     eventTypeApprovalInstanceStatusChangedV4,
-			subscribePath: pathApprovalInstancesSubscription,
-			params: map[string]string{
-				"subscription_type": `["MANAGED_APPROVAL","INVOLVED_APPROVAL"]`,
-			},
-			wantTypes: []string{
-				approvalSubscriptionTypeInvolved,
-				approvalSubscriptionTypeManaged,
-			},
-		},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			pc := approvalSubscriptionPreConsume(approvalSubscriptionConfig{
-				eventType:     approvalEventType(tc.eventType),
-				subscribePath: approvalSubscriptionPath(tc.subscribePath),
-			})
-			rt := &fakeAPIClient{}
-			cleanup, err := pc(context.Background(), rt, tc.params)
-			if err != nil {
-				t.Fatalf("PreConsume returned error: %v", err)
-			}
-			if cleanup != nil {
-				t.Fatal("cleanup must be nil; approval consume must not unsubscribe on exit")
-			}
-			assertSubscriptionCalls(t, rt.calls, tc.subscribePath, tc.wantTypes)
-		})
-	}
-}
-
-func assertSubscriptionCalls(t *testing.T, got []recordedCall, wantPath string, wantTypes []string) {
-	t.Helper()
-	if len(got) != len(wantTypes) {
-		t.Fatalf("calls after pre-consume = %d, want %d; calls=%+v", len(got), len(wantTypes), got)
-	}
-	for i, wantType := range wantTypes {
-		assertCall(t, got[i], "POST", wantPath, map[string]string{"subscription_type": wantType})
-	}
-}
-
-func assertCall(t *testing.T, got recordedCall, wantMethod, wantPath string, wantBody interface{}) {
-	t.Helper()
-	if got.method != wantMethod {
-		t.Errorf("method = %q, want %q", got.method, wantMethod)
-	}
-	if got.path != wantPath {
-		t.Errorf("path = %q, want %q", got.path, wantPath)
-	}
-	if !reflect.DeepEqual(got.body, wantBody) {
-		t.Errorf("body = %#v, want %#v", got.body, wantBody)
-	}
-}
-
-func TestApprovalPreConsumeValidationErrors(t *testing.T) {
-	t.Run("nil runtime", func(t *testing.T) {
-		pc := approvalSubscriptionPreConsume(approvalSubscriptionConfig{
-			eventType: eventTypeApprovalInstanceStatusChangedV4,
-		})
-		_, err := pc(context.Background(), nil, map[string]string{"subscription_type": approvalSubscriptionTypeInvolved})
-		if err == nil {
-			t.Fatal("expected nil runtime error")
-		}
-		p, ok := errs.ProblemOf(err)
-		if !ok || p.Category != errs.CategoryInternal {
-			t.Fatalf("err = %T/%v, want typed internal error", err, err)
-		}
-	})
-
-	for _, raw := range []string{"BAD", "[]", `["INVOLVED_APPROVAL",3]`} {
-		t.Run("invalid subscription type "+raw, func(t *testing.T) {
-			pc := approvalSubscriptionPreConsume(approvalSubscriptionConfig{
-				eventType: eventTypeApprovalInstanceStatusChangedV4,
-			})
-			cleanup, err := pc(context.Background(), &fakeAPIClient{}, map[string]string{"subscription_type": raw})
-			if err == nil {
-				t.Fatal("expected invalid subscription_type error")
-			}
-			if cleanup != nil {
-				t.Fatal("cleanup must be nil on validation error")
-			}
-			var ve *errs.ValidationError
-			if !errors.As(err, &ve) {
-				t.Fatalf("err = %T/%v, want *errs.ValidationError", err, err)
-			}
-			if ve.Subtype != errs.SubtypeInvalidArgument || ve.Param != "--param" {
-				t.Errorf("subtype/param = %s/%q, want invalid_argument/--param", ve.Subtype, ve.Param)
-			}
-			if ve.Hint == "" {
-				t.Error("invalid subscription_type should carry a hint")
-			}
-		})
-	}
-
-	t.Run("partial registration failure reports registered and failed relation types", func(t *testing.T) {
-		upstream := errs.NewAPIError(errs.SubtypeServerError, "approval subscription API failed")
-		rt := &fakeAPIClient{err: upstream, errOnCall: 2}
-		pc := approvalSubscriptionPreConsume(approvalSubscriptionConfig{
-			eventType:     eventTypeApprovalTaskStatusChangedV4,
-			subscribePath: pathApprovalTasksSubscription,
-		})
-
-		cleanup, err := pc(context.Background(), rt, map[string]string{})
-		if err == nil {
-			t.Fatal("expected partial registration error")
-		}
-		if cleanup != nil {
-			t.Fatal("cleanup must be nil on registration error")
-		}
-		assertSubscriptionCalls(t, rt.calls, pathApprovalTasksSubscription, []string{
-			approvalSubscriptionTypeInvolved,
-			approvalSubscriptionTypeManaged,
-		})
-		p, ok := errs.ProblemOf(err)
-		if !ok {
-			t.Fatalf("err = %T/%v, want typed error", err, err)
-		}
-		if p.Category != errs.CategoryAPI || p.Subtype != errs.SubtypeServerError {
-			t.Fatalf("category/subtype = %s/%s, want api/server_error", p.Category, p.Subtype)
-		}
-		for _, want := range []string{
-			"registered subscription_type(s) [INVOLVED_APPROVAL]",
-			"failed subscription_type MANAGED_APPROVAL",
-		} {
-			if !strings.Contains(p.Message, want) {
-				t.Errorf("partial error message missing %q: %q", want, p.Message)
-			}
-		}
-		for _, want := range []string{
-			"already registered",
-			"--param subscription_type=MANAGED_APPROVAL",
-		} {
-			if !strings.Contains(p.Hint, want) {
-				t.Errorf("partial error hint missing %q: %q", want, p.Hint)
-			}
-		}
-	})
-}
-
-func TestApprovalSubscriptionRegistrationErrorVariants(t *testing.T) {
-	t.Run("nil error", func(t *testing.T) {
-		if err := approvalSubscriptionRegistrationError(eventTypeApprovalTaskStatusChangedV4, nil, approvalSubscriptionTypeInvolved, nil); err != nil {
-			t.Fatalf("nil cause returned error: %v", err)
-		}
-	})
-
-	t.Run("typed error with existing hint and empty message", func(t *testing.T) {
-		upstream := errs.NewAPIError(errs.SubtypeServerError, "").WithHint("retry later")
-		err := approvalSubscriptionRegistrationError(
-			eventTypeApprovalTaskStatusChangedV4,
-			nil,
-			approvalSubscriptionTypeInvolved,
-			upstream,
-		)
-		if err != upstream {
-			t.Fatalf("typed error should be annotated in place; got %T/%v", err, err)
-		}
-		p, ok := errs.ProblemOf(err)
-		if !ok {
-			t.Fatalf("err = %T/%v, want typed error", err, err)
-		}
-		if !strings.Contains(p.Message, "failed subscription_type INVOLVED_APPROVAL") {
-			t.Errorf("message missing failed relation: %q", p.Message)
-		}
-		for _, want := range []string{"retry later", "no approval subscription relation was registered"} {
-			if !strings.Contains(p.Hint, want) {
-				t.Errorf("hint missing %q: %q", want, p.Hint)
-			}
-		}
-	})
-
-	t.Run("untyped error is wrapped with retry context", func(t *testing.T) {
-		cause := errors.New("transport closed")
-		err := approvalSubscriptionRegistrationError(
-			eventTypeApprovalTaskStatusChangedV4,
-			nil,
-			approvalSubscriptionTypeInvolved,
-			cause,
-		)
-		if !errors.Is(err, cause) {
-			t.Fatalf("wrapped error should preserve cause; got %T/%v", err, err)
-		}
-		p, ok := errs.ProblemOf(err)
-		if !ok {
-			t.Fatalf("err = %T/%v, want typed error", err, err)
-		}
-		if p.Category != errs.CategoryInternal || p.Subtype != errs.SubtypeSDKError {
-			t.Fatalf("category/subtype = %s/%s, want internal/sdk_error", p.Category, p.Subtype)
-		}
-		if !strings.Contains(p.Hint, "no approval subscription relation was registered") {
-			t.Errorf("hint missing no-registration context: %q", p.Hint)
-		}
-	})
-}
-
-func TestProcessApprovalInstanceStatusChanged(t *testing.T) {
-	out := runApprovalInstanceStatusChanged(t, `{
-		"schema": "2.0",
-		"header": {
-			"event_id": "evt_approval_instance_001",
-			"event_type": "approval.instance.status_changed_v4",
-			"create_time": "1710000000000"
-		},
-		"event": {
-			"approval_code": "approval_code_001",
-			"instance_code": "instance_code_001",
-			"external_id": "external_001",
-			"status": "PENDING",
-			"operate_time": "1666079207003",
-			"start_user": {
-				"open_id": "ou_start",
-				"union_id": "on_start",
-				"user_id": "user_start"
-			}
-		}
-	}`)
-
-	if out.Type != eventTypeApprovalInstanceStatusChangedV4 {
-		t.Errorf("Type = %q, want %q", out.Type, eventTypeApprovalInstanceStatusChangedV4)
-	}
-	if out.EventID != "evt_approval_instance_001" || out.Timestamp != "1710000000000" {
-		t.Errorf("EventID/Timestamp = %q/%q", out.EventID, out.Timestamp)
-	}
-	if out.ApprovalCode != "approval_code_001" || out.InstanceCode != "instance_code_001" {
-		t.Errorf("approval/instance code = %q/%q", out.ApprovalCode, out.InstanceCode)
-	}
-	if out.ExternalID != "external_001" || out.Status != "PENDING" || out.OperateTime != "1666079207003" {
-		t.Errorf("external/status/operate_time = %q/%q/%q", out.ExternalID, out.Status, out.OperateTime)
-	}
-	if out.StartUser == nil || out.StartUser.OpenID != "ou_start" || out.StartUser.UnionID != "on_start" || out.StartUser.UserID != "user_start" {
-		t.Fatalf("StartUser = %+v, want full user ids", out.StartUser)
-	}
-}
-
-func TestProcessApprovalTaskStatusChanged(t *testing.T) {
-	out := runApprovalTaskStatusChanged(t, `{
-		"schema": "2.0",
-		"header": {
-			"event_id": "evt_approval_task_001",
-			"event_type": "approval.task.status_changed_v4",
-			"create_time": "1710000000001"
-		},
-		"event": {
-			"approval_code": "approval_code_002",
-			"instance_code": "instance_code_002",
-			"task_id": "task_001",
-			"external_id": "external_002",
-			"task_external_id": "task_external_001",
-			"status": "APPROVED",
-			"operate_time": "1666079207004",
-			"assigned_user": {
-				"open_id": "ou_assignee",
-				"union_id": "on_assignee",
-				"user_id": "user_assignee"
-			}
-		}
-	}`)
-
-	if out.Type != eventTypeApprovalTaskStatusChangedV4 {
-		t.Errorf("Type = %q, want %q", out.Type, eventTypeApprovalTaskStatusChangedV4)
-	}
-	if out.EventID != "evt_approval_task_001" || out.Timestamp != "1710000000001" {
-		t.Errorf("EventID/Timestamp = %q/%q", out.EventID, out.Timestamp)
-	}
-	if out.ApprovalCode != "approval_code_002" || out.InstanceCode != "instance_code_002" || out.TaskID != "task_001" {
-		t.Errorf("approval/instance/task = %q/%q/%q", out.ApprovalCode, out.InstanceCode, out.TaskID)
-	}
-	if out.ExternalID != "external_002" || out.TaskExternalID != "task_external_001" || out.Status != "APPROVED" || out.OperateTime != "1666079207004" {
-		t.Errorf("external/task_external/status/operate_time = %q/%q/%q/%q", out.ExternalID, out.TaskExternalID, out.Status, out.OperateTime)
-	}
-	if out.AssignedUser == nil || out.AssignedUser.OpenID != "ou_assignee" || out.AssignedUser.UnionID != "on_assignee" || out.AssignedUser.UserID != "user_assignee" {
-		t.Fatalf("AssignedUser = %+v, want full user ids", out.AssignedUser)
-	}
-}
-
-func TestProcessApprovalStatusChangedUsesRawEventTypeFallback(t *testing.T) {
-	instance := runApprovalInstanceStatusChanged(t, `{
-		"schema": "2.0",
-		"header": {
-			"event_id": "evt_approval_instance_fallback",
-			"create_time": "1710000000002"
-		},
-		"event": {
-			"approval_code": "approval_code_fallback",
-			"instance_code": "instance_code_fallback",
-			"status": "APPROVED",
-			"operate_time": "1666079207005"
-		}
-	}`)
-	if instance.Type != eventTypeApprovalInstanceStatusChangedV4 {
-		t.Errorf("instance Type fallback = %q, want %q", instance.Type, eventTypeApprovalInstanceStatusChangedV4)
-	}
-
-	task := runApprovalTaskStatusChanged(t, `{
-		"schema": "2.0",
-		"header": {
-			"event_id": "evt_approval_task_fallback",
-			"create_time": "1710000000003"
-		},
-		"event": {
-			"approval_code": "approval_code_fallback",
-			"instance_code": "instance_code_fallback",
-			"task_id": "task_fallback",
-			"status": "DONE",
-			"operate_time": "1666079207006"
-		}
-	}`)
-	if task.Type != eventTypeApprovalTaskStatusChangedV4 {
-		t.Errorf("task Type fallback = %q, want %q", task.Type, eventTypeApprovalTaskStatusChangedV4)
-	}
-}
-
-func TestProcessApprovalStatusChangedMalformedPayloadPassthrough(t *testing.T) {
-	for _, tc := range []struct {
-		name      string
-		eventType string
-		process   event.ProcessFunc
-	}{
-		{"instance", eventTypeApprovalInstanceStatusChangedV4, processApprovalInstanceStatusChanged},
-		{"task", eventTypeApprovalTaskStatusChangedV4, processApprovalTaskStatusChanged},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			raw := &event.RawEvent{
-				EventType: tc.eventType,
-				Payload:   json.RawMessage(`not json`),
-				Timestamp: time.Now(),
-			}
-			got, err := tc.process(context.Background(), nil, raw, nil)
-			if err != nil {
-				t.Fatalf("Process should swallow parse errors, got %v", err)
-			}
-			if string(got) != "not json" {
-				t.Errorf("malformed fallback output = %q, want original bytes", string(got))
-			}
-		})
-	}
-}
-
-func TestProcessApprovalStatusChangedNilRaw(t *testing.T) {
-	for _, tc := range []struct {
-		name    string
-		process event.ProcessFunc
-	}{
-		{"instance", processApprovalInstanceStatusChanged},
-		{"task", processApprovalTaskStatusChanged},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			got, err := tc.process(context.Background(), nil, nil, nil)
-			if err != nil {
-				t.Fatalf("Process nil raw returned error: %v", err)
-			}
-			if got != nil {
-				t.Fatalf("Process nil raw output = %s, want nil", string(got))
-			}
-		})
-	}
-}
-
-func runApprovalInstanceStatusChanged(t *testing.T, payload string) ApprovalInstanceStatusChangedV4Output {
-	t.Helper()
-	raw := &event.RawEvent{
-		EventType: eventTypeApprovalInstanceStatusChangedV4,
-		Payload:   json.RawMessage(payload),
-		Timestamp: time.Now(),
-	}
-	got, err := processApprovalInstanceStatusChanged(context.Background(), nil, raw, nil)
-	if err != nil {
-		t.Fatalf("Process returned error: %v", err)
-	}
-	var out ApprovalInstanceStatusChangedV4Output
-	if err := json.Unmarshal(got, &out); err != nil {
-		t.Fatalf("Process output is not valid instance JSON: %v\nraw=%s", err, string(got))
-	}
-	return out
-}
-
-func runApprovalTaskStatusChanged(t *testing.T, payload string) ApprovalTaskStatusChangedV4Output {
-	t.Helper()
-	raw := &event.RawEvent{
-		EventType: eventTypeApprovalTaskStatusChangedV4,
-		Payload:   json.RawMessage(payload),
-		Timestamp: time.Now(),
-	}
-	got, err := processApprovalTaskStatusChanged(context.Background(), nil, raw, nil)
-	if err != nil {
-		t.Fatalf("Process returned error: %v", err)
-	}
-	var out ApprovalTaskStatusChangedV4Output
-	if err := json.Unmarshal(got, &out); err != nil {
-		t.Fatalf("Process output is not valid task JSON: %v\nraw=%s", err, string(got))
-	}
-	return out
-}
-
-func TestApprovalKeysRegisterCleanly(t *testing.T) {
-	for _, key := range []string{eventTypeApprovalInstanceStatusChangedV4, eventTypeApprovalTaskStatusChangedV4} {
-		event.UnregisterKeyForTest(key)
-		t.Cleanup(func() { event.UnregisterKeyForTest(key) })
-	}
-
-	for _, def := range Keys() {
-		event.RegisterKey(def)
-	}
-	for _, key := range []string{eventTypeApprovalInstanceStatusChangedV4, eventTypeApprovalTaskStatusChangedV4} {
-		if _, ok := event.Lookup(key); !ok {
-			t.Fatalf("event.Lookup(%q) not registered", key)
-		}
-	}
-}
-
-var _ event.APIClient = (*fakeAPIClient)(nil)

events/approval/types.go

@@ -1,42 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package approval
-
-// ApprovalUserID identifies a user in the three Lark ID formats included by
-// approval status-change events.
-type ApprovalUserID struct {
-	OpenID  string `json:"open_id,omitempty"  desc:"User open_id; prefixed with ou_" kind:"open_id"`
-	UnionID string `json:"union_id,omitempty" desc:"User union_id"                  kind:"union_id"`
-	UserID  string `json:"user_id,omitempty"  desc:"User id within the tenant"       kind:"user_id"`
-}
-
-// ApprovalInstanceStatusChangedV4Output is the flattened shape for
-// approval.instance.status_changed_v4.
-type ApprovalInstanceStatusChangedV4Output struct {
-	Type         string          `json:"type"                    desc:"Event type; always approval.instance.status_changed_v4" enum:"approval.instance.status_changed_v4"`
-	EventID      string          `json:"event_id,omitempty"      desc:"Globally unique event ID; safe for deduplication"`
-	Timestamp    string          `json:"timestamp,omitempty"     desc:"Event delivery time (ms timestamp string); taken from header.create_time when present" kind:"timestamp_ms"`
-	ApprovalCode string          `json:"approval_code,omitempty" desc:"Approval definition code; not a subscription dimension"`
-	InstanceCode string          `json:"instance_code,omitempty" desc:"Approval instance code"`
-	ExternalID   string          `json:"external_id,omitempty"   desc:"Third-party approval instance id; present only for third-party approvals"`
-	Status       string          `json:"status,omitempty"        desc:"Approval instance status" enum:"PENDING,APPROVED,REJECTED,CANCELED,DELETED,REVERTED,OVERTIME_CLOSE,OVERTIME_RECOVER"`
-	OperateTime  string          `json:"operate_time,omitempty"  desc:"Status change time in milliseconds" kind:"timestamp_ms"`
-	StartUser    *ApprovalUserID `json:"start_user,omitempty"    desc:"Approval instance starter; omitted when unavailable"`
-}
-
-// ApprovalTaskStatusChangedV4Output is the flattened shape for
-// approval.task.status_changed_v4.
-type ApprovalTaskStatusChangedV4Output struct {
-	Type           string          `json:"type"                      desc:"Event type; always approval.task.status_changed_v4" enum:"approval.task.status_changed_v4"`
-	EventID        string          `json:"event_id,omitempty"        desc:"Globally unique event ID; safe for deduplication"`
-	Timestamp      string          `json:"timestamp,omitempty"       desc:"Event delivery time (ms timestamp string); taken from header.create_time when present" kind:"timestamp_ms"`
-	ApprovalCode   string          `json:"approval_code,omitempty"     desc:"Approval definition code; not a subscription dimension"`
-	InstanceCode   string          `json:"instance_code,omitempty"     desc:"Approval instance code"`
-	TaskID         string          `json:"task_id,omitempty"           desc:"Approval task id"`
-	ExternalID     string          `json:"external_id,omitempty"       desc:"Third-party approval external id; present only for third-party approvals"`
-	TaskExternalID string          `json:"task_external_id,omitempty"  desc:"Third-party approval task external id; present only when emitted by the upstream service"`
-	AssignedUser   *ApprovalUserID `json:"assigned_user,omitempty"     desc:"Task assignee or operator user ids; omitted for automatic flows without an operator"`
-	Status         string          `json:"status,omitempty"            desc:"Approval task status" enum:"REVERTED,PENDING,APPROVED,REJECTED,TRANSFERRED,ROLLBACK,DONE,OVERTIME_CLOSE,OVERTIME_RECOVER"`
-	OperateTime    string          `json:"operate_time,omitempty"      desc:"Status change time in milliseconds" kind:"timestamp_ms"`
-}

events/register.go

@@ -5,8 +5,6 @@
 package events
 
 import (
-	"github.com/larksuite/cli/events/application"
-	"github.com/larksuite/cli/events/approval"
 	"github.com/larksuite/cli/events/im"
 	"github.com/larksuite/cli/events/minutes"
 	"github.com/larksuite/cli/events/task"
@@ -18,8 +16,6 @@ import (
 // Mail is intentionally omitted in this phase.
 func init() {
 	all := [][]event.KeyDefinition{
-		application.Keys(),
-		approval.Keys(),
 		im.Keys(),
 		minutes.Keys(),
 		task.Keys(),

internal/qualitygate/cmd/comment-audit/main.go

@@ -19,18 +19,12 @@ import (
 type eventPayload struct {
 	Comment *struct {
 		Body string `json:"body"`
-		Path string `json:"path"`
 	} `json:"comment"`
 	Review *struct {
 		Body string `json:"body"`
 	} `json:"review"`
 }
 
-type commentContent struct {
-	Body string
-	Path string
-}
-
 func main() {
 	eventPath := flag.String("event", os.Getenv("GITHUB_EVENT_PATH"), "GitHub event payload path")
 	kind := flag.String("kind", os.Getenv("GITHUB_EVENT_NAME"), "GitHub event kind")
@@ -40,11 +34,12 @@ func main() {
 		fmt.Fprintln(os.Stderr, "comment-audit: --event or GITHUB_EVENT_PATH is required")
 		os.Exit(2)
 	}
-	diags, err := auditEvent(*eventPath, *kind)
+	body, err := commentBody(*eventPath)
 	if err != nil {
 		fmt.Fprintf(os.Stderr, "comment-audit: %v\n", err)
 		os.Exit(2)
 	}
+	diags := diagnostics(publiccontent.ScanComment(*kind, body))
 	if len(diags) > 0 {
 		fmt.Fprintln(os.Stderr, auditFailureSummary(len(diags)))
 	}
@@ -52,44 +47,32 @@ func main() {
 	os.Exit(report.ExitCode(diags))
 }
 
-func auditEvent(eventPath, kind string) ([]report.Diagnostic, error) {
-	content, err := commentBody(eventPath)
-	if err != nil {
-		return nil, err
-	}
-	return scanCommentContent(kind, content), nil
-}
-
-func scanCommentContent(kind string, content commentContent) []report.Diagnostic {
-	return diagnostics(publiccontent.ScanCommentAtPath(kind, content.Path, content.Body))
-}
-
 func auditFailureSummary(count int) string {
 	return fmt.Sprintf("post-publication audit found public content findings: %d", count)
 }
 
-func commentBody(path string) (commentContent, error) {
+func commentBody(path string) (string, error) {
 	safePath, err := validate.SafeInputPath(path)
 	if err != nil {
-		return commentContent{}, errs.NewValidationError(errs.SubtypeInvalidArgument, "invalid --event: %v", err).
+		return "", errs.NewValidationError(errs.SubtypeInvalidArgument, "invalid --event: %v", err).
 			WithParam("--event").
 			WithCause(err)
 	}
 	data, err := vfs.ReadFile(safePath)
 	if err != nil {
-		return commentContent{}, err
+		return "", err
 	}
 	var payload eventPayload
 	if err := json.Unmarshal(data, &payload); err != nil {
-		return commentContent{}, err
+		return "", err
 	}
 	switch {
 	case payload.Comment != nil:
-		return commentContent{Body: payload.Comment.Body, Path: payload.Comment.Path}, nil
+		return payload.Comment.Body, nil
 	case payload.Review != nil:
-		return commentContent{Body: payload.Review.Body}, nil
+		return payload.Review.Body, nil
 	default:
-		return commentContent{}, nil
+		return "", nil
 	}
 }
 

internal/qualitygate/cmd/comment-audit/main_test.go

@@ -7,11 +7,9 @@ import (
 	"errors"
 	"os"
 	"path/filepath"
-	"strconv"
 	"testing"
 
 	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/qualitygate/publiccontent"
 )
 
 func TestCommentBodyReadsSafeRelativeEventPath(t *testing.T) {
@@ -34,92 +32,11 @@ func TestCommentBodyReadsSafeRelativeEventPath(t *testing.T) {
 	if err != nil {
 		t.Fatalf("commentBody() error = %v", err)
 	}
-	if got.Body != "clean comment" || got.Path != "" {
-		t.Fatalf("comment content = %#v", got)
+	if got != "clean comment" {
+		t.Fatalf("comment body = %q", got)
 	}
 }
 
-func TestCommentBodyReadsReviewCommentPath(t *testing.T) {
-	dir := t.TempDir()
-	if err := writeTestFile(filepath.Join(dir, "event.json"), `{"comment":{"body":"test suggestion","path":"cmd/agent/list_test.go"}}`); err != nil {
-		t.Fatal(err)
-	}
-	origDir, err := os.Getwd()
-	if err != nil {
-		t.Fatal(err)
-	}
-	if err := os.Chdir(dir); err != nil {
-		t.Fatal(err)
-	}
-	t.Cleanup(func() {
-		_ = os.Chdir(origDir)
-	})
-
-	got, err := commentBody("event.json")
-	if err != nil {
-		t.Fatalf("commentBody() error = %v", err)
-	}
-	if got.Body != "test suggestion" || got.Path != "cmd/agent/list_test.go" {
-		t.Fatalf("comment content = %#v", got)
-	}
-}
-
-func TestCommentAuditUsesReviewCommentPathForFixtureClassification(t *testing.T) {
-	dir := t.TempDir()
-	body := `CLIENT_SECRET=$(security find-generic-password -w)`
-	event := `{"comment":{"body":` + strconv.Quote(body) + `,"path":"scripts/config_test.sh"}}`
-	if err := writeTestFile(filepath.Join(dir, "event.json"), event); err != nil {
-		t.Fatal(err)
-	}
-	origDir, err := os.Getwd()
-	if err != nil {
-		t.Fatal(err)
-	}
-	if err := os.Chdir(dir); err != nil {
-		t.Fatal(err)
-	}
-	t.Cleanup(func() {
-		_ = os.Chdir(origDir)
-	})
-
-	diags, err := auditEvent("event.json", "pull_request_review_comment")
-	if err != nil {
-		t.Fatalf("auditEvent() error = %v", err)
-	}
-	for _, diag := range diags {
-		if diag.Rule == "public_content_generic_credential" {
-			t.Fatalf("review comment fixture should not be a credential diagnostic: %#v", diags)
-		}
-	}
-	pathless := publiccontent.ScanComment("pull_request_review_comment", body)
-	for _, finding := range pathless {
-		if finding.Rule == "public_content_generic_credential" {
-			return
-		}
-	}
-	t.Fatalf("test precondition failed: pathless comment should be classified as a credential: %#v", pathless)
-}
-
-func TestScanCommentContentPreservesReviewCommentPath(t *testing.T) {
-	providerValue := "gh" + "p_" + "1234567890abcdef" + "1234567890abcdef" + "1234"
-	content := commentContent{
-		Body: `cfg := &Config{AccessToken: "` + providerValue + `"}`,
-		Path: "cmd/agent/list_test.go",
-	}
-
-	diags := scanCommentContent("pull_request_review_comment", content)
-	for _, diag := range diags {
-		if diag.Rule != "public_content_generic_credential" {
-			continue
-		}
-		if diag.File != content.Path {
-			t.Fatalf("credential diagnostic file = %q, want %q", diag.File, content.Path)
-		}
-		return
-	}
-	t.Fatalf("missing provider credential diagnostic: %#v", diags)
-}
-
 func TestCommentBodyRejectsUnsafeEventPath(t *testing.T) {
 	path := filepath.Join(t.TempDir(), "event.json")
 	if err := writeTestFile(path, `{"comment":{"body":"clean"}}`); err != nil {

internal/qualitygate/diff/diff_test.go

@@ -6,11 +6,10 @@ package diff
 import (
 	"context"
 	"os"
+	"os/exec"
 	"path/filepath"
 	"reflect"
 	"testing"
-
-	"github.com/larksuite/cli/internal/testutil/gitcmd"
 )
 
 func TestScopeIncludesChangedSkillAndRelatedDomain(t *testing.T) {
@@ -123,7 +122,8 @@ func writeFile(t *testing.T, repo, rel, content string) {
 
 func runGit(t *testing.T, repo string, args ...string) {
 	t.Helper()
-	cmd := gitcmd.Command(repo, args...)
+	cmd := exec.Command("git", args...)
+	cmd.Dir = repo
 	if out, err := cmd.CombinedOutput(); err != nil {
 		t.Fatalf("git %v failed: %v\n%s", args, err, out)
 	}
@@ -131,7 +131,8 @@ func runGit(t *testing.T, repo string, args ...string) {
 
 func gitOutput(t *testing.T, repo string, args ...string) string {
 	t.Helper()
-	cmd := gitcmd.Command(repo, args...)
+	cmd := exec.Command("git", args...)
+	cmd.Dir = repo
 	out, err := cmd.Output()
 	if err != nil {
 		t.Fatalf("git %v failed: %v", args, err)

internal/qualitygate/publiccontent/collect_test.go

@@ -6,11 +6,10 @@ package publiccontent
 import (
 	"context"
 	"os"
+	"os/exec"
 	"path/filepath"
 	"strings"
 	"testing"
-
-	"github.com/larksuite/cli/internal/testutil/gitcmd"
 )
 
 func TestCollectScansOnlyCurrentContributionAndMetadata(t *testing.T) {
@@ -24,10 +23,9 @@ func TestCollectScansOnlyCurrentContributionAndMetadata(t *testing.T) {
 	runGit(t, repo, "add", "baseline.md")
 	runGit(t, repo, "commit", "-m", "base")
 
-	providerValue := "ghp_" + "1234567890abcdef1234567890abcdef1234"
 	writeFile(t, filepath.Join(repo, "docs", "public.md"), `# Public change
 
-api_`+`key = "`+providerValue+`"
+api_`+`key = "example-public-key"
 `)
 	runGit(t, repo, "add", "docs/public.md")
 	runGit(t, repo, "commit", "-m", "add public doc", "-m", "Change"+"-Id: I0123456789abcdef0123456789abcdef01234567")
@@ -201,14 +199,13 @@ func TestCollectDetectsQuotedJSONCredentialAssignments(t *testing.T) {
 	runGit(t, repo, "add", "docs/public.json")
 	runGit(t, repo, "commit", "-m", "base")
 
-	providerValue := "ghp_" + "1234567890abcdef1234567890abcdef1234"
 	writeFile(t, filepath.Join(repo, "docs", "public.json"), strings.Join([]string{
-		`{"access_` + `token":"` + providerValue + `"}`,
-		`{"client_` + `secret": "` + providerValue + `"}`,
-		`{"tenantAccess` + `Token":"` + providerValue + `"}`,
-		`{"github` + `Token":"` + providerValue + `"}`,
-		`{"vendorApi` + `Key":"` + providerValue + `"}`,
-		`{"slackBot` + `Token":"xoxb_` + `1234567890abcdef"}`,
+		`{"access_` + `token":"real-json-token"}`,
+		`{"client_` + `secret": "real ` + `secret value"}`,
+		`{"tenantAccess` + `Token":"real-tenant-camel-token"}`,
+		`{"github` + `Token":"real-github-token"}`,
+		`{"vendorApi` + `Key":"real-vendor-key"}`,
+		`{"slackBot` + `Token":"xoxb-real-token"}`,
 	}, "\n")+"\n")
 	runGit(t, repo, "add", "docs/public.json")
 	runGit(t, repo, "commit", "-m", "add json config")
@@ -218,7 +215,14 @@ func TestCollectDetectsQuotedJSONCredentialAssignments(t *testing.T) {
 	for _, item := range got {
 		if item.File == "docs/public.json" && item.Rule == "public_content_generic_credential" {
 			count++
-			for _, forbidden := range []string{providerValue, "xoxb_" + "1234567890abcdef"} {
+			for _, forbidden := range []string{
+				"real-json-token",
+				"real secret value",
+				"real-tenant-camel-token",
+				"real-github-token",
+				"real-vendor-key",
+				"xoxb-real-token",
+			} {
 				if strings.Contains(item.Excerpt, forbidden) {
 					t.Fatalf("JSON credential finding leaked value %q in excerpt %q", forbidden, item.Excerpt)
 				}
@@ -302,8 +306,8 @@ func TestCollectDetectsAngleWrappedRealisticCredentialValues(t *testing.T) {
 			count++
 		}
 	}
-	if count != 2 {
-		t.Fatalf("angle-wrapped provider credential findings = %d, want 2: %#v", count, got)
+	if count != 3 {
+		t.Fatalf("angle-wrapped realistic credential findings = %d, want 3: %#v", count, got)
 	}
 }
 
@@ -334,12 +338,12 @@ func TestCollectDetectsCredentialShapedValuesUnderBenignKeys(t *testing.T) {
 			count++
 		}
 	}
-	if count != 4 {
-		t.Fatalf("provider-shaped benign-key findings = %d, want 4: %#v", count, got)
+	if count != 7 {
+		t.Fatalf("credential-shaped benign-key findings = %d, want 7: %#v", count, got)
 	}
 }
 
-func TestCollectAllowsBareIdentifierCredentialsWithMetadataSuffixes(t *testing.T) {
+func TestCollectDetectsBareIdentifierCredentialsWithMetadataSuffixes(t *testing.T) {
 	repo := newGitRepo(t)
 	writeFile(t, filepath.Join(repo, "docs", "config.yaml"), "base: true\n")
 	runGit(t, repo, "add", "docs/config.yaml")
@@ -354,11 +358,15 @@ func TestCollectAllowsBareIdentifierCredentialsWithMetadataSuffixes(t *testing.T
 	runGit(t, repo, "commit", "-m", "add credential config")
 
 	got := collectFromPreviousCommit(t, repo)
+	var count int
 	for _, item := range got {
 		if item.File == "docs/config.yaml" && item.Rule == "public_content_generic_credential" {
-			t.Fatalf("readable metadata values should not be credential findings: %#v", got)
+			count++
 		}
 	}
+	if count != 3 {
+		t.Fatalf("metadata-suffixed bare credential findings = %d, want 3: %#v", count, got)
+	}
 }
 
 func TestCollectDetectsAccessKeyCredentials(t *testing.T) {
@@ -366,7 +374,7 @@ func TestCollectDetectsAccessKeyCredentials(t *testing.T) {
 	writeFile(t, filepath.Join(repo, "docs", "config.yaml"), "base: true\n")
 	runGit(t, repo, "add", "docs/config.yaml")
 	runGit(t, repo, "commit", "-m", "base")
-	accessKey := "AK" + "IAIOSFODNN7EXAMPXX"
+	accessKey := "AK" + "IAIOSFODNN7EXAMPX"
 
 	writeFile(t, filepath.Join(repo, "docs", "config.yaml"), strings.Join([]string{
 		"AWS_ACCESS_KEY_ID: " + accessKey,
@@ -383,7 +391,7 @@ func TestCollectDetectsAccessKeyCredentials(t *testing.T) {
 			continue
 		}
 		count++
-		if strings.Contains(item.Excerpt, accessKey) {
+		if strings.Contains(item.Excerpt, "AKIAIOSFODNN7EXAMPX") {
 			t.Fatalf("access key finding leaked value in excerpt %q", item.Excerpt)
 		}
 	}
@@ -424,7 +432,7 @@ func TestCollectDetectsPrivateKeyAssignments(t *testing.T) {
 	}
 }
 
-func TestCollectAllowsCredentialValuesThatLookLikeBareIdentifiers(t *testing.T) {
+func TestCollectDetectsCredentialValuesThatLookLikeBareIdentifiers(t *testing.T) {
 	repo := newGitRepo(t)
 	writeFile(t, filepath.Join(repo, "docs", "config.yaml"), "base: true\n")
 	runGit(t, repo, "add", "docs/config.yaml")
@@ -440,11 +448,15 @@ func TestCollectAllowsCredentialValuesThatLookLikeBareIdentifiers(t *testing.T)
 	runGit(t, repo, "commit", "-m", "add credential config")
 
 	got := collectFromPreviousCommit(t, repo)
+	var count int
 	for _, item := range got {
 		if item.File == "docs/config.yaml" && item.Rule == "public_content_generic_credential" {
-			t.Fatalf("readable identifiers should not be credential findings: %#v", got)
+			count++
 		}
 	}
+	if count != 4 {
+		t.Fatalf("bare identifier credential findings = %d, want 4: %#v", count, got)
+	}
 }
 
 func TestCollectAllowsBenignUnquotedTokenFields(t *testing.T) {
@@ -477,13 +489,12 @@ func TestCollectDetectsCredentialPhraseBeforeEnvironmentSuffix(t *testing.T) {
 	runGit(t, repo, "add", "docs/config.yaml")
 	runGit(t, repo, "commit", "-m", "base")
 
-	providerValue := "ghp_" + "1234567890abcdef1234567890abcdef1234"
 	writeFile(t, filepath.Join(repo, "docs", "config.yaml"), strings.Join([]string{
-		"API_KEY_OPENAI: " + providerValue,
-		"TOKEN_GITHUB: " + providerValue,
-		"CLIENT_SECRET_GOOGLE: " + providerValue,
-		"SECRET_KEY_BASE: " + providerValue,
-		"APP_PASSWORD_PROD: " + providerValue,
+		"API_KEY_OPENAI: real-openai-key",
+		"TOKEN_GITHUB: real-github-token",
+		"CLIENT_SECRET_GOOGLE: real-google-secret",
+		"SECRET_KEY_BASE: real-secret-key-base",
+		"APP_PASSWORD_PROD: real-prod-password",
 	}, "\n")+"\n")
 	runGit(t, repo, "add", "docs/config.yaml")
 	runGit(t, repo, "commit", "-m", "add credential config")
@@ -495,7 +506,13 @@ func TestCollectDetectsCredentialPhraseBeforeEnvironmentSuffix(t *testing.T) {
 			continue
 		}
 		count++
-		for _, forbidden := range []string{providerValue} {
+		for _, forbidden := range []string{
+			"real-openai-key",
+			"real-github-token",
+			"real-google-secret",
+			"real-secret-key-base",
+			"real-prod-password",
+		} {
 			if strings.Contains(item.Excerpt, forbidden) {
 				t.Fatalf("credential finding leaked value %q in excerpt %q", forbidden, item.Excerpt)
 			}
@@ -604,8 +621,7 @@ func TestCollectSkipsOnlyKnownQualityGateFixtureFiles(t *testing.T) {
 	writeFile(t, filepath.Join(repo, "internal", "qualitygate", "publiccontent", "scan_test.go"), "SECRET_TOKEN=fixture\n")
 	writeFile(t, filepath.Join(repo, "internal", "qualitygate", "publiccontent", "scan.go"), "const privateKeyFixture = \""+privateKeyBeginPrefix+privateKeyMarker+"\"\n")
 	writeFile(t, filepath.Join(repo, "internal", "qualitygate", "publiccontent", "rules.go"), "markers := []string{\"generated with automation\"}\n")
-	providerValue := "ghp_" + "1234567890abcdef1234567890abcdef1234"
-	writeFile(t, filepath.Join(repo, "tests", "e2e", "new-public-workflow.test.sh"), "SECRET_TOKEN="+providerValue+"\n")
+	writeFile(t, filepath.Join(repo, "tests", "e2e", "new-public-workflow.test.sh"), "SECRET_TOKEN=real-leak\n")
 	runGit(t, repo, "add", ".")
 	runGit(t, repo, "commit", "-m", "add scanner fixtures")
 
@@ -669,11 +685,10 @@ func TestCollectScansAddedLinesInSpecialPathNames(t *testing.T) {
 	runGit(t, repo, "add", ".")
 	runGit(t, repo, "commit", "-m", "base")
 
-	providerValue := "ghp_" + "1234567890abcdef1234567890abcdef1234"
-	writeFile(t, filepath.Join(repo, "docs", "has space.md"), "SECRET_TOKEN="+providerValue+"\n")
-	writeFile(t, filepath.Join(repo, `weird"quote.md`), "SECRET_TOKEN="+providerValue+"\n")
+	writeFile(t, filepath.Join(repo, "docs", "has space.md"), "SECRET_TOKEN=space-value\n")
+	writeFile(t, filepath.Join(repo, `weird"quote.md`), "SECRET_TOKEN=quote-value\n")
 	runGit(t, repo, "mv", "docs/old.md", "docs/new name.md")
-	writeFile(t, filepath.Join(repo, "docs", "new name.md"), "base\nSECRET_TOKEN="+providerValue+"\n")
+	writeFile(t, filepath.Join(repo, "docs", "new name.md"), "base\nSECRET_TOKEN=rename-value\n")
 	runGit(t, repo, "add", ".")
 	runGit(t, repo, "commit", "-m", "add special paths")
 
@@ -840,7 +855,8 @@ func runGit(t *testing.T, repo string, args ...string) {
 	if len(args) > 0 && args[0] == "commit" {
 		args = append([]string{"commit", "--no-verify"}, args[1:]...)
 	}
-	cmd := gitcmd.Command(repo, args...)
+	cmd := exec.Command("git", args...)
+	cmd.Dir = repo
 	out, err := cmd.CombinedOutput()
 	if err != nil {
 		t.Fatalf("git %v failed: %v\n%s", args, err, out)
@@ -849,7 +865,8 @@ func runGit(t *testing.T, repo string, args ...string) {
 
 func runGitOutput(t *testing.T, repo string, args ...string) []byte {
 	t.Helper()
-	cmd := gitcmd.Command(repo, args...)
+	cmd := exec.Command("git", args...)
+	cmd.Dir = repo
 	out, err := cmd.CombinedOutput()
 	if err != nil {
 		t.Fatalf("git %v failed: %v\n%s", args, err, out)

internal/qualitygate/publiccontent/comment_audit.go

@@ -4,15 +4,8 @@
 package publiccontent
 
 func ScanComment(kind, body string) []Finding {
-	return ScanCommentAtPath(kind, "", body)
-}
-
-func ScanCommentAtPath(kind, path, body string) []Finding {
 	if kind == "" {
 		kind = "comment"
 	}
-	if path == "" {
-		path = kind
-	}
-	return scanText(path, "comment", body, isDetectorRuleFile(path))
+	return scanText(kind, "comment", body, false)
 }

internal/qualitygate/publiccontent/comment_audit_test.go

@@ -3,10 +3,7 @@
 
 package publiccontent
 
-import (
-	"strings"
-	"testing"
-)
+import "testing"
 
 func TestScanCommentAuditsPublishedCommentBodies(t *testing.T) {
 	got := ScanComment("issue_comment", `The published comment included /tmp/harness`+`-agent/run and CCM`+`-Harness: stage-4`)
@@ -20,60 +17,3 @@ func TestScanCommentAuditsPublishedCommentBodies(t *testing.T) {
 		}
 	}
 }
-
-func TestScanCommentAllowsMermaidCredentialTerminology(t *testing.T) {
-	body := strings.Join([]string{
-		"```mermaid",
-		"sequenceDiagram",
-		"  participant Client",
-		"  participant AccessTokenHashTransport",
-		"  participant SecurityPolicyTransport",
-		"  Client->>AccessTokenHashTransport: Send request with bearer token",
-		"  AccessTokenHashTransport->>AccessTokenHashTransport: Clone request and inject token hash",
-		"  Client -> ClientSecret: Resolve configured credential",
-		"  AccessTokenHashTransport->>SecurityPolicyTransport: Forward enriched request",
-		"```",
-	}, "\n")
-
-	got := ScanComment("issue_comment", body)
-	for _, item := range got {
-		if item.Rule == "public_content_generic_credential" {
-			t.Fatalf("mermaid credential terminology should not be a credential finding: %#v", got)
-		}
-	}
-}
-
-func TestScanCommentDetectsCredentialAssignmentInsideMermaidMessage(t *testing.T) {
-	providerValue := strings.Join([]string{"gh", "p_", "1234567890abcdef", "1234567890abcdef", "1234"}, "")
-	credentialAssignment := "password=" + providerValue
-	body := strings.Join([]string{
-		"```mermaid",
-		"sequenceDiagram",
-		"  Client->>Server: Send " + credentialAssignment,
-		"```",
-	}, "\n")
-
-	got := ScanComment("issue_comment", body)
-	if !findingRules(got)["public_content_generic_credential"] {
-		t.Fatalf("credential assignment inside mermaid message should be reported: %#v", got)
-	}
-}
-
-func TestScanCommentAtPathAllowsTestFixtureCredentialPlaceholder(t *testing.T) {
-	body := `cfg := &core.CliConfig{AppID: "cli_x", AppSecret: "fake-secret"}`
-	got := ScanCommentAtPath("pull_request_review_comment", "cmd/agent/list_test.go", body)
-	for _, item := range got {
-		if item.Rule == "public_content_generic_credential" {
-			t.Fatalf("review comment test fixture should not be a credential finding: %#v", got)
-		}
-	}
-}
-
-func TestScanCommentAtPathDetectsProviderCredentialInTestFile(t *testing.T) {
-	providerValue := strings.Join([]string{"gh", "p_", "1234567890abcdef", "1234567890abcdef", "1234"}, "")
-	body := `cfg := &Config{AccessToken: "` + providerValue + `"}`
-	got := ScanCommentAtPath("pull_request_review_comment", "cmd/agent/list_test.go", body)
-	if !findingRules(got)["public_content_generic_credential"] {
-		t.Fatalf("provider credential in review comment should be reported: %#v", got)
-	}
-}

internal/qualitygate/publiccontent/credential.go

@@ -1,88 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package publiccontent
-
-import (
-	"encoding/base64"
-	"net/url"
-	"strings"
-)
-
-func credentialValueHasStrongEvidence(key, value string) bool {
-	normalized := strings.TrimRight(strings.TrimSpace(value), ",;")
-	normalized = strings.TrimSpace(strings.Trim(normalized, `"'<>`))
-	candidates := credentialEvidenceCandidates(unwrapCredentialValue(normalized))
-	for _, candidate := range candidates {
-		if providerCredentialIdentifier(candidate) {
-			return true
-		}
-	}
-	if isCredentialMetadataField(key) {
-		return false
-	}
-	for _, candidate := range candidates {
-		if highEntropyCredentialValue(strings.ToLower(candidate)) || base64PaddedCredentialValue(candidate) {
-			return true
-		}
-	}
-	return percentEncodedCredentialValue(strings.ToLower(candidates[0])) ||
-		commandSubstitutionLooksCredentialLike(strings.ToLower(normalized))
-}
-
-func credentialEvidenceCandidates(value string) []string {
-	candidates := []string{value}
-	for range 3 {
-		decoded, err := url.PathUnescape(value)
-		if err != nil || decoded == value {
-			break
-		}
-		candidates = append(candidates, decoded)
-		value = decoded
-	}
-	return candidates
-}
-
-func isCredentialMetadataField(key string) bool {
-	if isBenignTokenField(key) {
-		return true
-	}
-	parts := credentialKeyParts(strings.ReplaceAll(strings.ToLower(key), "-", "_"))
-	if len(parts) < 2 {
-		return false
-	}
-	switch parts[len(parts)-1] {
-	case "hash", "id", "kind", "marker", "prefix", "transport":
-		return true
-	default:
-		return false
-	}
-}
-
-func base64PaddedCredentialValue(value string) bool {
-	if len(value) < 16 || !strings.HasSuffix(value, "=") {
-		return false
-	}
-	if _, err := base64.StdEncoding.DecodeString(value); err != nil {
-		return false
-	}
-	return shannonEntropy(strings.TrimRight(value, "=")) >= 3.5
-}
-
-func percentEncodedCredentialValue(value string) bool {
-	if len(value) < 16 {
-		return false
-	}
-	var escapes int
-	for i := 0; i+2 < len(value); i++ {
-		if value[i] == '%' && isHexByte(value[i+1]) && isHexByte(value[i+2]) {
-			escapes++
-			i += 2
-		}
-	}
-	return escapes >= 2
-}
-
-func isHexByte(value byte) bool {
-	return (value >= '0' && value <= '9') || (value >= 'a' && value <= 'f')
-}

internal/qualitygate/publiccontent/rules.go

@@ -13,7 +13,7 @@ import (
 )
 
 var (
-	credentialAssignmentRE = regexp.MustCompile(`(?i)["']?\b[A-Za-z0-9_-]*(?:api[_-]?key|access[_-]?key|private[_-]?key|secret|password|passwd|token|webhook|access[_-]?token|client[_-]?secret)[A-Za-z0-9_-]*\b["']?\s*(?::=|[:=])\s*(?:!!str\s+)?(?:"((?:\\.|[^"\\])*)"|'((?:\\.|[^'\\])*)'|(\x60[^\x60]*\x60)|(\$\([^)]*\))|(\$\{\{[^}]+\}\})|([^"'\x60\s,}\]]+))`)
+	credentialAssignmentRE = regexp.MustCompile(`(?i)["']?\b[A-Za-z0-9_-]*(?:api[_-]?key|access[_-]?key|private[_-]?key|secret|password|passwd|token|webhook|access[_-]?token|client[_-]?secret)[A-Za-z0-9_-]*\b["']?\s*[:=]\s*(?:"((?:\\.|[^"\\])*)"|'((?:\\.|[^'\\])*)'|(\$\([^)]*\))|(\$\{\{[^}]+\}\})|([^"'\s,}\]]+))`)
 	jwtLikeRE              = regexp.MustCompile(`\b[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b`)
 	credentialURLRE        = regexp.MustCompile(`(?i)\b[a-z][a-z0-9+.-]*://[^/\s:@]*:[^@\s/]+@[^)\s]+`)
 	bearerHeaderRE         = regexp.MustCompile(`(?i)(?:\bAuthorization\s*:\s*Bearer\s+|["']Authorization["']\s*:\s*["']Bearer\s+)[A-Za-z0-9._+/=-]{12,}`)
@@ -383,63 +383,33 @@ func anglePlaceholderIdentifier(value string) bool {
 }
 
 func credentialShapedValue(value string) bool {
-	normalized := strings.TrimSpace(strings.Trim(strings.TrimSpace(value), `"'<>`))
+	normalized := strings.ToLower(strings.Trim(value, `"'<>`))
 	return credentialShapedIdentifier(normalized)
 }
 
 func credentialShapedIdentifier(value string) bool {
-	return providerCredentialIdentifier(value)
-}
-
-func providerCredentialIdentifier(value string) bool {
-	value = strings.TrimSpace(value)
 	switch {
-	case providerTokenWithBody(value, "sk_live_", 16, ""),
-		providerTokenWithBody(value, "sk_test_", 16, ""),
-		providerTokenWithBody(value, "ghp_", 16, ""),
-		providerTokenWithBody(value, "gho_", 16, ""),
-		providerTokenWithBody(value, "ghu_", 16, ""),
-		providerTokenWithBody(value, "github_pat_", 16, "_"),
-		providerTokenWithBody(value, "xoxb_", 16, "-"),
-		providerTokenWithBody(value, "xoxp_", 16, "-"),
-		providerTokenWithBody(value, "xoxa_", 16, "-"),
-		providerTokenWithBody(value, "xoxb-", 16, "-"),
-		providerTokenWithBody(value, "xoxp-", 16, "-"),
-		providerTokenWithBody(value, "xoxa-", 16, "-"),
-		awsAccessKeyIdentifier(value):
+	case strings.HasPrefix(value, "sk_live_"),
+		strings.HasPrefix(value, "sk_test_"),
+		strings.HasPrefix(value, "ghp_"),
+		strings.HasPrefix(value, "gho_"),
+		strings.HasPrefix(value, "ghu_"),
+		strings.HasPrefix(value, "github_pat_"),
+		strings.HasPrefix(value, "xoxb_"),
+		strings.HasPrefix(value, "xoxp_"),
+		strings.HasPrefix(value, "xoxa_"):
+		return true
+	case strings.HasPrefix(value, "real-") &&
+		(strings.Contains(value, "secret") ||
+			strings.Contains(value, "token") ||
+			strings.Contains(value, "key") ||
+			strings.Contains(value, "password")):
 		return true
 	default:
 		return false
 	}
 }
 
-func providerTokenWithBody(value, prefix string, minBodyLength int, separators string) bool {
-	body, ok := strings.CutPrefix(value, prefix)
-	if !ok || len(body) < minBodyLength {
-		return false
-	}
-	for _, r := range body {
-		if (r >= 'a' && r <= 'z') || (r >= 'A' && r <= 'Z') || (r >= '0' && r <= '9') || strings.ContainsRune(separators, r) {
-			continue
-		}
-		return false
-	}
-	return true
-}
-
-func awsAccessKeyIdentifier(value string) bool {
-	if len(value) != 20 || (!strings.HasPrefix(value, "AKIA") && !strings.HasPrefix(value, "ASIA")) {
-		return false
-	}
-	for _, r := range value[4:] {
-		if (r >= 'A' && r <= 'Z') || (r >= '0' && r <= '9') {
-			continue
-		}
-		return false
-	}
-	return true
-}
-
 func resourceTokenPlaceholderValue(value string) bool {
 	normalized := strings.ToLower(strings.Trim(value, `"'`))
 	switch normalized {

internal/qualitygate/publiccontent/scan.go

@@ -47,30 +47,15 @@ func scanText(file, source, text string, detectorFile bool) []Finding {
 			out = append(out, newFinding("public_content_private_key_block", file, privateKeyLine, source, "private key block"))
 			inPrivateKey = false
 		}
-		for _, location := range credentialAssignmentRE.FindAllStringIndex(line, -1) {
-			rawMatch := line[location[0]:location[1]]
-			if !validCredentialAssignmentStart(line, location[0], rawMatch) {
-				continue
-			}
-			match := credentialAssignmentRE.FindStringSubmatch(rawMatch)
-			if !isCredentialAssignmentMatch(rawMatch) {
+		for _, match := range credentialAssignmentRE.FindAllStringSubmatch(line, -1) {
+			if !isCredentialAssignmentMatch(match[0]) {
 				continue
 			}
 			value := credentialAssignmentValue(match)
-			keyName, _ := normalizedCredentialAssignmentKey(rawMatch)
-			evidenceValue := value
-			if sourceCodeFile(file) {
-				if rhs, ok := sourceCodeTypedCredentialRHS(line, location[0], rawMatch); ok {
-					evidenceValue = rhs
-				}
-			}
-			if !(isWebhookCredentialKey(keyName) && webhookAssignmentValueLooksCredentialLike(value)) &&
-				!credentialValueHasStrongEvidence(keyName, evidenceValue) {
-				continue
-			}
+			keyName, _ := normalizedCredentialAssignmentKey(match[0])
 			if value == "" ||
 				isNonSecretLiteralValue(value) ||
-				isBenignCodeCredentialExpression(file, line, location[0], rawMatch, value) ||
+				isBenignCodeCredentialExpression(file, line, match[0], value) ||
 				isPlaceholderValue(value) ||
 				isPermissionScopeIdentifierAssignment(keyName, value) ||
 				isResourceTokenPlaceholderAssignment(keyName, value) {
@@ -79,7 +64,7 @@ func scanText(file, source, text string, detectorFile bool) []Finding {
 			if looksLikeEqualityComparison(value) {
 				continue
 			}
-			out = append(out, newFinding("public_content_generic_credential", file, lineNo, source, redactAssignment(rawMatch)))
+			out = append(out, newFinding("public_content_generic_credential", file, lineNo, source, redactAssignment(match[0])))
 		}
 		for _, match := range jwtLikeRE.FindAllString(line, -1) {
 			if !isJWTToken(match) {
@@ -138,43 +123,21 @@ func scanText(file, source, text string, detectorFile bool) []Finding {
 	return out
 }
 
-func validCredentialAssignmentStart(line string, start int, match string) bool {
-	if start <= 0 || credentialAssignmentOperator(match) != ":" {
-		return true
-	}
-	prefix := strings.TrimSpace(line[:start])
-	for _, arrow := range []string{"-->>", "->>", "-->", "->"} {
-		if strings.HasSuffix(prefix, arrow) {
-			return false
-		}
-	}
-	return true
-}
-
-func credentialAssignmentOperator(match string) string {
-	key, ok := credentialAssignmentKey(match)
-	if !ok {
-		return ""
-	}
-	rest := strings.TrimSpace(match[len(key):])
-	if strings.HasPrefix(rest, ":=") {
-		return ":="
-	}
-	if strings.HasPrefix(rest, ":") {
-		return ":"
-	}
-	if strings.HasPrefix(rest, "=") {
-		return "="
-	}
-	return ""
-}
-
 func isCredentialAssignmentMatch(match string) bool {
-	name, _, ok := normalizedCredentialAssignment(match)
+	name, value, ok := normalizedCredentialAssignment(match)
 	if !ok {
 		return false
 	}
-	return isExplicitCredentialKey(name) || isWebhookCredentialKey(name)
+	if isWebhookCredentialKey(name) && webhookAssignmentValueLooksCredentialLike(value) {
+		return true
+	}
+	if isBenignTokenField(name) && !credentialShapedValue(value) {
+		return false
+	}
+	if isWeakTokenCredentialKey(name) && !weakTokenValueLooksCredentialLike(value) {
+		return false
+	}
+	return isExplicitCredentialKey(name)
 }
 
 func normalizedCredentialAssignmentKey(match string) (string, bool) {
@@ -325,7 +288,7 @@ func tokenLikePlaceholderKey(key string) bool {
 
 func tokenLikePlaceholderValue(key, value string) bool {
 	normalized := strings.ToLower(strings.Trim(value, `"'`))
-	if normalized == "" || credentialShapedIdentifier(strings.Trim(value, `"'`)) {
+	if normalized == "" || credentialShapedIdentifier(normalized) {
 		return false
 	}
 	if authCredentialTokenKey(key) {
@@ -360,8 +323,52 @@ func maskedTokenFixturePlaceholderValue(key, value string) bool {
 	return stars >= 6 && alnum > 0
 }
 
+func isWeakTokenCredentialKey(key string) bool {
+	if authCredentialTokenKey(key) || isStrongTokenCredentialKey(key) {
+		return false
+	}
+	return key == "token" ||
+		strings.HasSuffix(key, "_token") ||
+		strings.HasSuffix(key, "-token")
+}
+
+func isStrongTokenCredentialKey(key string) bool {
+	parts := credentialKeyParts(strings.ReplaceAll(strings.ToLower(key), "-", "_"))
+	for _, phrase := range [][2]string{
+		{"access", "token"},
+		{"refresh", "token"},
+		{"auth", "token"},
+		{"bearer", "token"},
+		{"session", "token"},
+		{"service", "token"},
+		{"bot", "token"},
+		{"api", "token"},
+		{"secret", "token"},
+	} {
+		if hasAdjacentCredentialParts(parts, phrase[0], phrase[1]) {
+			return true
+		}
+	}
+	return false
+}
+
+func weakTokenValueLooksCredentialLike(value string) bool {
+	normalized := strings.ToLower(strings.Trim(value, `"'<>`))
+	if normalized == "" ||
+		isNonSecretLiteralValue(value) ||
+		isPlaceholderValue(value) {
+		return false
+	}
+	candidate := unwrapCredentialValue(normalized)
+	return credentialShapedIdentifier(candidate) ||
+		highEntropyCredentialValue(candidate) ||
+		commandSubstitutionLooksCredentialLike(normalized) ||
+		(strings.Contains(normalized, "://") &&
+			urlRemainderLooksCredentialLike(removeAnglePlaceholders(normalized)))
+}
+
 func unwrapCredentialValue(value string) string {
-	value = strings.TrimSpace(strings.Trim(value, "\"'<>`"))
+	value = strings.TrimSpace(strings.Trim(value, `"'<>`))
 	if strings.HasPrefix(value, "${{") && strings.HasSuffix(value, "}}") {
 		value = strings.TrimSpace(strings.TrimSuffix(strings.TrimPrefix(value, "${{"), "}}"))
 	}
@@ -481,20 +488,17 @@ func numericStringPlaceholderValue(value string) bool {
 	return true
 }
 
-func isBenignCodeCredentialExpression(file, line string, matchStart int, match, value string) bool {
+func isBenignCodeCredentialExpression(file, line, match, value string) bool {
 	normalized := strings.TrimSpace(value)
 	if strings.HasPrefix(normalized, "regexp.MustCompile(") {
 		return true
 	}
-	if !sourceCodeFile(file) {
+	if !sourceCodeFile(file) || credentialShapedValue(value) {
 		return false
 	}
-	if rhs, ok := sourceCodeTypedCredentialRHS(line, matchStart, match); ok {
+	if rhs, ok := sourceCodeTypedCredentialRHS(line, match); ok {
 		return isBenignTypedCredentialRHS(rhs)
 	}
-	if credentialShapedValue(value) {
-		return false
-	}
 	rawValueQuoted := credentialAssignmentRawValueQuoted(match)
 	if sourceCodeLiteralLooksNonSecret(normalized, !rawValueQuoted) {
 		return true
@@ -514,16 +518,17 @@ func isBenignCodeCredentialExpression(file, line string, matchStart int, match,
 	return codeReferenceExpression(normalized)
 }
 
-func sourceCodeTypedCredentialRHS(line string, matchStart int, match string) (string, bool) {
-	if matchStart < 0 || matchStart+len(match) > len(line) || line[matchStart:matchStart+len(match)] != match {
+func sourceCodeTypedCredentialRHS(line, match string) (string, bool) {
+	idx := strings.Index(line, match)
+	if idx < 0 {
 		return "", false
 	}
 	key, ok := credentialAssignmentKey(match)
 	if !ok {
 		return "", false
 	}
-	rest := strings.TrimSpace(line[matchStart+len(key):])
-	if !strings.HasPrefix(rest, ":") || strings.HasPrefix(rest, ":=") {
+	rest := strings.TrimSpace(line[idx+len(key):])
+	if !strings.HasPrefix(rest, ":") {
 		return "", false
 	}
 	typeAndRHS := strings.TrimSpace(strings.TrimPrefix(rest, ":"))
@@ -531,12 +536,7 @@ func sourceCodeTypedCredentialRHS(line string, matchStart int, match string) (st
 	if assignmentIdx < 0 {
 		return "", false
 	}
-	rhs := strings.TrimSpace(typeAndRHS[assignmentIdx+1:])
-	parsed := credentialAssignmentRE.FindStringSubmatch("client_secret=" + rhs)
-	if parsed == nil {
-		return rhs, true
-	}
-	return credentialAssignmentValue(parsed), true
+	return strings.TrimSpace(typeAndRHS[assignmentIdx+1:]), true
 }
 
 func isBenignTypedCredentialRHS(value string) bool {
@@ -568,7 +568,7 @@ func credentialAssignmentRawValueQuoted(match string) bool {
 
 func sourceCodeFile(file string) bool {
 	switch filepath.Ext(file) {
-	case ".go", ".js", ".jsx", ".py", ".sh", ".ts", ".tsx":
+	case ".go", ".js", ".jsx", ".py", ".ts", ".tsx":
 		return true
 	default:
 		return false
@@ -593,7 +593,6 @@ func sourceCodeLiteralLooksNonSecret(value string, allowNumeric bool) bool {
 		sourceCodeFakeOrPlaceholderLiteral(literal) ||
 		sourceCodeCredentialTermLiteral(literal) ||
 		sourceCodeCredentialPrefixLiteral(literal) ||
-		sourceCodeStringExpressionLiteral(literal) ||
 		sourceCodeVocabularyLiteral(literal) ||
 		sourceCodeSchemaTypeLiteral(literal) ||
 		benignCredentialStatusLiteral(literal)
@@ -686,18 +685,6 @@ func sourceCodeCredentialPrefixLiteral(value string) bool {
 	}
 }
 
-func sourceCodeStringExpressionLiteral(value string) bool {
-	normalized := strings.TrimSpace(value)
-	if normalized == "" ||
-		credentialShapedIdentifier(normalized) ||
-		highEntropyCredentialValue(strings.ToLower(normalized)) {
-		return false
-	}
-	return strings.Contains(normalized, "${") ||
-		strings.Contains(normalized, "$(") ||
-		(strings.Contains(normalized, `\b`) && strings.ContainsAny(normalized, "|[]{}()+*?"))
-}
-
 func sourceCodeVocabularyLiteral(value string) bool {
 	switch strings.ToLower(value) {
 	case "bot", "tenant", "user":
@@ -766,7 +753,7 @@ func codeIdentifier(value string) bool {
 
 func isNonSecretLiteralValue(value string) bool {
 	switch strings.ToLower(strings.TrimSpace(strings.Trim(value, `"'`))) {
-	case "true", "false", "null", "nil", "{", "[", `\`:
+	case "true", "false", "null", "nil", "{", "[":
 		return true
 	default:
 		return false
@@ -993,7 +980,6 @@ func credentialURLPasswordFixture(password string) bool {
 	normalized := strings.ToLower(strings.Trim(password, `"'`))
 	switch normalized {
 	case "p",
-		"p%40ss",
 		"pass",
 		"password",
 		"pat_abc",

internal/qualitygate/publiccontent/scan_test.go

@@ -251,22 +251,26 @@ func TestScanFileDoesNotTreatURLEncodedCredentialAsPlaceholder(t *testing.T) {
 	}
 }
 
-func TestScanFileAllowsReadablePlaceholderMarkerSubstrings(t *testing.T) {
+func TestScanFileDoesNotTreatPlaceholderMarkerSubstringsAsPlaceholders(t *testing.T) {
 	got := ScanFile("docs/config.md", []byte(strings.Join([]string{
 		"API_KEY=notredactedreal",
 		"API_KEY=notplaceholdersecret",
 		"API_KEY=abcxxxxreal",
 	}, "\n")+"\n"))
+	var count int
 	for _, item := range got {
 		if item.Rule == "public_content_generic_credential" {
-			t.Fatalf("readable credential words should not be findings: %#v", got)
+			count++
 		}
 	}
+	if count != 3 {
+		t.Fatalf("placeholder-marker substring findings = %d, want 3: %#v", count, got)
+	}
 }
 
 func TestScanFileDetectsBase64PaddedCredentialAssignments(t *testing.T) {
 	paddedSecretPrefix := "dGhpc2lz" + "YXNlY3JldA"
-	paddedTokenPrefix := "UTdrMm1O" + "OXBSNHZYOA"
+	paddedTokenPrefix := "YWJj" + "ZGVmZ2g"
 	paddedSecret := base64PaddedFixture(paddedSecretPrefix)
 	paddedToken := base64PaddedFixture(paddedTokenPrefix)
 	got := ScanFile("docs/config.md", []byte(strings.Join([]string{
@@ -290,25 +294,17 @@ func TestScanFileDetectsBase64PaddedCredentialAssignments(t *testing.T) {
 	}
 }
 
-func TestScanFileAllowsReadableBase64Lookalike(t *testing.T) {
-	got := ScanFile("docs/config.md", []byte("client_secret=placeholder=\n"))
-	if findingRules(got)["public_content_generic_credential"] {
-		t.Fatalf("readable base64 lookalike should not be a credential finding: %#v", got)
-	}
-}
-
 func TestScanFileDetectsQuotedJSONCredentialAssignments(t *testing.T) {
-	providerValue := "ghp_" + "1234567890abcdef1234567890abcdef1234"
-	jsonToken := providerValue
-	jsonSecret := providerValue
-	jsonKey := providerValue
-	jsonTenantToken := providerValue
-	jsonAppSecret := providerValue
-	jsonPrefixedKey := providerValue
-	jsonTenantCamelToken := providerValue
-	jsonGithubToken := providerValue
-	jsonVendorKey := providerValue
-	jsonSlackBotToken := "xoxb_" + "1234567890abcdef"
+	jsonToken := "real-json-token"
+	jsonSecret := "real " + "secret value"
+	jsonKey := "real-json-key"
+	jsonTenantToken := "real-tenant-json-token"
+	jsonAppSecret := "real-app-secret"
+	jsonPrefixedKey := "real-prefixed-key"
+	jsonTenantCamelToken := "real-tenant-camel-token"
+	jsonGithubToken := "real-github-token"
+	jsonVendorKey := "real-vendor-key"
+	jsonSlackBotToken := "xoxb-real-token"
 	got := ScanFile("docs/public.json", []byte(strings.Join([]string{
 		`{"access_` + `token":"` + jsonToken + `"}`,
 		`{"client_` + `secret": "` + jsonSecret + `"}`,
@@ -338,13 +334,12 @@ func TestScanFileDetectsQuotedJSONCredentialAssignments(t *testing.T) {
 }
 
 func TestScanFileDetectsCredentialPhraseBeforeEnvironmentSuffix(t *testing.T) {
-	providerValue := "ghp_" + "1234567890abcdef1234567890abcdef1234"
 	got := ScanFile("docs/config.yaml", []byte(strings.Join([]string{
-		"API_KEY_OPENAI: " + providerValue,
-		"TOKEN_GITHUB: " + providerValue,
-		"CLIENT_SECRET_GOOGLE: " + providerValue,
-		"SECRET_KEY_BASE: " + providerValue,
-		"APP_PASSWORD_PROD: " + providerValue,
+		"API_KEY_OPENAI: real-openai-key",
+		"TOKEN_GITHUB: real-github-token",
+		"CLIENT_SECRET_GOOGLE: real-google-secret",
+		"SECRET_KEY_BASE: real-secret-key-base",
+		"APP_PASSWORD_PROD: real-prod-password",
 	}, "\n")+"\n"))
 	var count int
 	for _, item := range got {
@@ -352,7 +347,13 @@ func TestScanFileDetectsCredentialPhraseBeforeEnvironmentSuffix(t *testing.T) {
 			continue
 		}
 		count++
-		for _, forbidden := range []string{providerValue} {
+		for _, forbidden := range []string{
+			"real-openai-key",
+			"real-github-token",
+			"real-google-secret",
+			"real-secret-key-base",
+			"real-prod-password",
+		} {
 			if strings.Contains(item.Excerpt, forbidden) {
 				t.Fatalf("credential finding leaked value %q in excerpt %q", forbidden, item.Excerpt)
 			}
@@ -363,77 +364,85 @@ func TestScanFileDetectsCredentialPhraseBeforeEnvironmentSuffix(t *testing.T) {
 	}
 }
 
-func TestScanFileAllowsCredentialValuesThatLookLikeBareIdentifiers(t *testing.T) {
+func TestScanFileDetectsCredentialValuesThatLookLikeBareIdentifiers(t *testing.T) {
 	got := ScanFile("docs/config.yaml", []byte(strings.Join([]string{
 		"API_KEY_OPENAI: prod_key",
 		"CLIENT_SECRET_GOOGLE: prod_secret",
 		"TOKEN_GITHUB: github_token",
 		"APP_PASSWORD_PROD: prod_password",
 	}, "\n")+"\n"))
+	var count int
 	for _, item := range got {
 		if item.Rule == "public_content_generic_credential" {
-			t.Fatalf("readable identifiers should not be credential findings: %#v", got)
+			count++
 		}
 	}
+	if count != 4 {
+		t.Fatalf("bare identifier credential findings = %d, want 4: %#v", count, got)
+	}
 }
 
 func TestScanFileDetectsAngleWrappedRealisticCredentialValues(t *testing.T) {
 	stripeLike := "sk_" + "live_1234567890abcdef"
 	patLike := "gh" + "p_1234567890abcdef1234567890abcdef1234"
-	cases := []struct {
-		name string
-		text string
-		want bool
-	}{
-		{name: "stripe", text: "API_KEY: <" + stripeLike + ">", want: true},
-		{name: "github", text: "SECRET_TOKEN: <" + patLike + ">", want: true},
-		{name: "readable", text: "CLIENT_SECRET: <real-client-secret-value>", want: false},
+	got := ScanFile("docs/config.yaml", []byte(strings.Join([]string{
+		"API_KEY: <" + stripeLike + ">",
+		"SECRET_TOKEN: <" + patLike + ">",
+		"CLIENT_SECRET: <real-client-secret-value>",
+	}, "\n")+"\n"))
+	var count int
+	for _, item := range got {
+		if item.Rule == "public_content_generic_credential" {
+			count++
+		}
 	}
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			assertGenericCredentialFinding(t, "docs/config.yaml", tc.text, tc.want)
-		})
+	if count != 3 {
+		t.Fatalf("angle-wrapped realistic credential findings = %d, want 3: %#v", count, got)
 	}
 }
 
 func TestScanFileDetectsCredentialShapedValuesUnderBenignKeys(t *testing.T) {
 	stripeLike := "sk_" + "live_1234567890abcdef"
 	patLike := "gh" + "p_1234567890abcdef1234567890abcdef1234"
-	cases := []struct {
-		name string
-		text string
-		want bool
-	}{
-		{name: "expiry provider token", text: `{"access_token_expires_in":"` + patLike + `"}`, want: true},
-		{name: "expiry provider secret", text: `{"refresh_token_expires_in":"` + stripeLike + `"}`, want: true},
-		{name: "status readable", text: `{"client_secret_status":"real-client-secret-value"}`, want: false},
-		{name: "name readable", text: `{"client_secret_name":"real-client-secret-value"}`, want: false},
-		{name: "app provider token", text: `{"app_token":"` + patLike + `"}`, want: true},
-		{name: "sync provider secret", text: `{"sync_token":"` + stripeLike + `"}`, want: true},
-		{name: "target readable", text: `{"target_token":"real-client-secret-value"}`, want: false},
+	got := ScanFile("docs/public.json", []byte(strings.Join([]string{
+		`{"access_token_expires_in":"` + patLike + `"}`,
+		`{"refresh_token_expires_in":"` + stripeLike + `"}`,
+		`{"client_secret_status":"real-client-secret-value"}`,
+		`{"client_secret_name":"real-client-secret-value"}`,
+		`{"app_token":"` + patLike + `"}`,
+		`{"sync_token":"` + stripeLike + `"}`,
+		`{"target_token":"real-client-secret-value"}`,
+	}, "\n")+"\n"))
+	var count int
+	for _, item := range got {
+		if item.Rule == "public_content_generic_credential" {
+			count++
+		}
 	}
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			assertGenericCredentialFinding(t, "docs/public.json", tc.text, tc.want)
-		})
+	if count != 7 {
+		t.Fatalf("credential-shaped benign-key findings = %d, want 7: %#v", count, got)
 	}
 }
 
-func TestScanFileAllowsBareIdentifierCredentialsWithMetadataSuffixes(t *testing.T) {
+func TestScanFileDetectsBareIdentifierCredentialsWithMetadataSuffixes(t *testing.T) {
 	got := ScanFile("docs/config.yaml", []byte(strings.Join([]string{
 		"API_KEY_NAME: prod_key",
 		"CLIENT_SECRET_NAME: prod_secret",
 		"SECRET_STATUS: prod_secret",
 	}, "\n")+"\n"))
+	var count int
 	for _, item := range got {
 		if item.Rule == "public_content_generic_credential" {
-			t.Fatalf("readable metadata values should not be credential findings: %#v", got)
+			count++
 		}
 	}
+	if count != 3 {
+		t.Fatalf("metadata-suffixed bare credential findings = %d, want 3: %#v", count, got)
+	}
 }
 
 func TestScanFileDetectsAccessKeyCredentials(t *testing.T) {
-	accessKey := "AK" + "IAIOSFODNN7EXAMPXX"
+	accessKey := "AK" + "IAIOSFODNN7EXAMPX"
 	got := ScanFile("docs/config.yaml", []byte(strings.Join([]string{
 		"AWS_ACCESS_KEY_ID: " + accessKey,
 		"ACCESS_KEY_ID: " + accessKey,
@@ -584,18 +593,18 @@ func TestScanFileAllowsCredentialReferenceValues(t *testing.T) {
 
 func TestScanFileDetectsMalformedGithubExpressionCredentialValues(t *testing.T) {
 	stripeLike := "sk_" + "live_1234567890abcdef"
-	cases := []struct {
-		name string
-		text string
-		want bool
-	}{
-		{name: "provider", text: "API_KEY=${{" + stripeLike + "}}", want: true},
-		{name: "readable", text: "TOKEN=${{real-secret-token-value}}", want: false},
+	got := ScanFile("docs/config.yaml", []byte(strings.Join([]string{
+		"API_KEY=${{" + stripeLike + "}}",
+		"TOKEN=${{real-secret-token-value}}",
+	}, "\n")+"\n"))
+	var count int
+	for _, item := range got {
+		if item.Rule == "public_content_generic_credential" {
+			count++
+		}
 	}
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			assertGenericCredentialFinding(t, "docs/config.yaml", tc.text, tc.want)
-		})
+	if count != 2 {
+		t.Fatalf("malformed GitHub expression credential findings = %d, want 2: %#v", count, got)
 	}
 }
 
@@ -639,7 +648,6 @@ func TestScanFileAllowsCredentialURLPlaceholders(t *testing.T) {
 func TestScanFileAllowsCredentialURLFixtures(t *testing.T) {
 	got := ScanFile("fixtures/network_test.go", []byte(strings.Join([]string{
 		`proxy := "http://user:pass@proxy:8080"`,
-		`proxy := "http://user:p%40ss@proxy:8080/path"`,
 		`repo := "https://u:t@h/r.git"`,
 		`target := "https://attacker:pw@open.feishu.cn"`,
 		`proxy := "http://admin:s3cret@127.0.0.1:3128"`,
@@ -813,151 +821,35 @@ func TestScanFileDetectsWeakTokenFieldsWithHighConfidenceCredentialValues(t *tes
 	}
 }
 
-func TestScanFileAllowsStrongAuthTokenKeysWithoutStrongValueEvidence(t *testing.T) {
+func TestScanFileDetectsStrongAuthTokenKeysWithFixtureLikeValues(t *testing.T) {
 	got := ScanFile("docs/config.md", []byte(strings.Join([]string{
 		`{"access_token":"img_abc123"}`,
 		`{"api_token":"img_live_secret"}`,
 		`{"service_token":"ab********cd"}`,
 		`{"bot_token":"board_v3_example"}`,
 	}, "\n")+"\n"))
-	for _, item := range got {
-		if item.Rule == "public_content_generic_credential" {
-			t.Fatalf("token field names alone should not produce findings: %#v", got)
-		}
-	}
-}
-
-func TestScanFileAllowsTestFixtureSecretValues(t *testing.T) {
-	got := ScanFile("fixtures/calendar_meeting_test.go", []byte(strings.Join([]string{
-		`AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,`,
-		`cfg := &core.CliConfig{AppID: "a", AppSecret: "s"}`,
-		`os.WriteFile(path, []byte("FEISHU_APP_ID=cli_abc\nFEISHU_APP_SECRET=secret\n"), 0600)`,
-		`rt := &stubRoundTripper{respBody: ` + "`" + `{"access_token":"t","token_type":"Bearer"}` + "`" + `}`,
-		`envContent := "FEISHU_APP_ID=cli_hermes_abc\nFEISHU_APP_SECRET=hermes_secret_123\nFEISHU_DOMAIN=lark\n"`,
-		`os.WriteFile(path, []byte("FEISHU_APP_ID=cli_auto\nFEISHU_APP_SECRET=auto_secret\n"), 0600)`,
-		`os.WriteFile(path, []byte("FEISHU_APP_ID=cli_new_app\nFEISHU_APP_SECRET=new_secret\n"), 0600)`,
-		`if got := out.String(); got != "username=x-access-token\npassword=valid-pat\n\n" {`,
-		`if got := out.String(); got != "username=x-access-token\npassword=restored-pat\n\n" {`,
-		`if got := stdout.String(); got != "username=x-access-token\npassword=pat-token\n\n" {`,
-		`return &core.CliConfig{AppID: "dummy", AppSecret: "dummy"}`,
-		`os.WriteFile(path, []byte("API_KEY=replace-me\n"), 0600)`,
-		`body := "APP_ID=\"cli_xxxxx\"\nAPP_SECRET=\"xxxxx\"\n"`,
-	}, "\n")+"\n"))
-	for _, item := range got {
-		if item.Rule == "public_content_generic_credential" {
-			t.Fatalf("test fixture secret should not be credential finding: %#v", got)
-		}
-	}
-}
-
-func TestScanFileAllowsCredentialIdentifierFields(t *testing.T) {
-	got := ScanFile("fixtures/openapi_key_test.go", []byte(strings.Join([]string{
-		`"api_key_id": "k1",`,
-		`"secret_id": "s1",`,
-		`"token_id": "t1",`,
-		`"private_key_id": "pk1",`,
-	}, "\n")+"\n"))
-	for _, item := range got {
-		if item.Rule == "public_content_generic_credential" {
-			t.Fatalf("credential identifier fields should not be credential findings: %#v", got)
-		}
-	}
-}
-
-func TestScanFileDetectsCredentialShapedIdentifierFieldValues(t *testing.T) {
-	stripeLike := "sk_" + "live_1234567890abcdef"
-	githubToken := "ghp_" + "1234567890abcdef1234567890abcdef1234"
-	got := ScanFile("fixtures/openapi_key_test.go", []byte(strings.Join([]string{
-		`"api_key_id": "` + stripeLike + `",`,
-		`"token_id": "` + githubToken + `",`,
-	}, "\n")+"\n"))
 	var count int
 	for _, item := range got {
 		if item.Rule == "public_content_generic_credential" {
 			count++
 		}
 	}
-	if count != 2 {
-		t.Fatalf("credential-shaped identifier field findings = %d, want 2: %#v", count, got)
+	if count != 4 {
+		t.Fatalf("strong auth token key findings = %d, want 4: %#v", count, got)
 	}
 }
 
-func TestCredentialShapedValueTrimsWhitespaceBeforeDelimiters(t *testing.T) {
-	providerValue := "ghp_" + "1234567890abcdef1234567890abcdef1234"
-	if !credentialShapedValue(` "` + providerValue + `" `) {
-		t.Fatal("space-padded quoted provider credential should be recognized")
-	}
-}
-
-func TestScanFileDetectsProviderCredentialsAcrossAssignmentSyntaxes(t *testing.T) {
-	providerValue := strings.Join([]string{"gh", "p_", "1234567890abcdef", "1234567890abcdef", "1234"}, "")
-	tests := []struct {
-		name string
-		path string
-		text string
-	}{
-		{name: "Go raw string", path: "pkg/config.go", text: "const clientSecret = `" + providerValue + "`"},
-		{name: "TypeScript template literal", path: "pkg/config.ts", text: "const clientSecret = `" + providerValue + "`;"},
-		{name: "shell backtick", path: "scripts/config.sh", text: "client_secret=`" + providerValue + "`"},
-		{name: "YAML string tag", path: "docs/config.yaml", text: "client_secret: !!str " + providerValue},
-		{name: "YAML string tag double quoted", path: "docs/config.yaml", text: `client_secret: !!str "` + providerValue + `"`},
-		{name: "YAML string tag single quoted", path: "docs/config.yaml", text: `client_secret: !!str '` + providerValue + `'`},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			got := ScanFile(tt.path, []byte(tt.text+"\n"))
-			if !findingRules(got)["public_content_generic_credential"] {
-				t.Fatalf("provider credential should be reported: %#v", got)
-			}
-		})
-	}
-}
-
-func TestScanFileDetectsPercentEncodedProviderCredential(t *testing.T) {
-	providerBody := strings.Join([]string{"1234567890abcdef", "1234567890abcdef", "1234"}, "")
-	tests := []string{
-		"access_token: ghp%" + "5F" + providerBody,
-		"access_token_hash: ghp%" + "255F" + providerBody,
-	}
-	for _, text := range tests {
-		got := ScanFile("docs/config.yaml", []byte(text+"\n"))
-		if !findingRules(got)["public_content_generic_credential"] {
-			t.Fatalf("percent-encoded provider credential should be reported: %#v", got)
-		}
-	}
-}
-
-func TestScanFileRequiresCompleteProviderCredentialFormats(t *testing.T) {
-	got := ScanFile("docs/config.yaml", []byte(strings.Join([]string{
-		"token_type: asian",
-		"token_prefix: ASIA",
-		"token_prefix: ghp_",
-		"api_key: sk_live_example",
-		"token_prefix: asianmarketsegment01",
-		"token_prefix: ghp_placeholder_value",
-	}, "\n")+"\n"))
+func TestScanFileAllowsTestFixtureSecretValues(t *testing.T) {
+	got := ScanFile("fixtures/calendar_meeting_test.go", []byte(`AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,`+"\n"))
 	for _, item := range got {
 		if item.Rule == "public_content_generic_credential" {
-			t.Fatalf("incomplete provider prefixes should not be credential findings: %#v", got)
-		}
-	}
-}
-
-func TestScanFileAllowsEncodedTokenMetadataURL(t *testing.T) {
-	got := ScanFile("docs/config.yaml", []byte("token_url: https%3A%2F%2Fexample.invalid/oauth/token\n"))
-	for _, item := range got {
-		if item.Rule == "public_content_generic_credential" {
-			t.Fatalf("encoded token metadata URL should not be credential finding: %#v", got)
+			t.Fatalf("test fixture secret should not be credential finding: %#v", got)
 		}
 	}
 }
 
 func TestScanFileAllowsRegexpTokenValidators(t *testing.T) {
-	got := ScanFile("fixtures/minutes_detail.go", []byte(strings.Join([]string{
-		"var validMinuteTokenDetail = regexp.MustCompile(`^[a-z0-9]+$`)",
-		"REALISTIC_TOKEN_RE=\"\\\"${TOKEN_BODY}\\\"|\\`${TOKEN_BODY}\\`|\\\\b${TOKEN_BODY}\\\\b\"",
-	}, "\n")+"\n"))
+	got := ScanFile("fixtures/minutes_detail.go", []byte("var validMinuteTokenDetail = regexp.MustCompile(`^[a-z0-9]+$`)\n"))
 	for _, item := range got {
 		if item.Rule == "public_content_generic_credential" {
 			t.Fatalf("regexp token validator should not be credential finding: %#v", got)
@@ -1035,22 +927,6 @@ func TestScanFileAllowsSourceCodeCredentialNonSecretLiterals(t *testing.T) {
 	}
 }
 
-func TestScanFileAllowsSourceCodeSyntheticCredentialIdentifiers(t *testing.T) {
-	got := ScanFile("fixtures/sheets_media.go", []byte(strings.Join([]string{
-		`const fakeOfficeTokenPrefix = "fake_office_"`,
-		`const localOfficeTokenPrefix = "local_office_"`,
-		`const imageLiveSecretMarker = "img_live_secret"`,
-		`const imageProdKeyMarker = "img_prod_key"`,
-		`if strings.HasPrefix(spreadsheetToken, fakeOfficeTokenPrefix) {`,
-		`if strings.HasPrefix(spreadsheetToken, localOfficeTokenPrefix) {`,
-	}, "\n")+"\n"))
-	for _, item := range got {
-		if item.Rule == "public_content_generic_credential" {
-			t.Fatalf("source code token prefix references should not be credential findings: %#v", got)
-		}
-	}
-}
-
 func TestScanFileAllowsCredentialLikePublicPlaceholders(t *testing.T) {
 	got := ScanFile("fixtures/placeholders.md", []byte(strings.Join([]string{
 		`app_secret=***`,
@@ -1065,18 +941,22 @@ func TestScanFileAllowsCredentialLikePublicPlaceholders(t *testing.T) {
 	}
 }
 
-func TestScanFileAllowsPartiallyMaskedCredentialValues(t *testing.T) {
+func TestScanFileDetectsPartiallyMaskedCredentialValues(t *testing.T) {
 	got := ScanFile("fixtures/config.md", []byte(strings.Join([]string{
 		"client_secret=realprefix***realsuffix",
 		"client_secret=ab********cd",
 		"access_token=ab********cd",
 		"refresh_token=realprefix********realsuffix",
 	}, "\n")+"\n"))
+	var count int
 	for _, item := range got {
 		if item.Rule == "public_content_generic_credential" {
-			t.Fatalf("partially masked values should not be credential findings: %#v", got)
+			count++
 		}
 	}
+	if count != 4 {
+		t.Fatalf("partially masked credential findings = %d, want 4: %#v", count, got)
+	}
 }
 
 func TestScanFileAllowsDryRunCredentialPlaceholders(t *testing.T) {
@@ -1092,7 +972,6 @@ func TestScanFileAllowsDryRunCredentialPlaceholders(t *testing.T) {
 }
 
 func TestScanFileDetectsTypedCredentialAssignmentsWithSecretRHS(t *testing.T) {
-	providerValue := "ghp_" + "1234567890abcdef1234567890abcdef1234"
 	cases := []struct {
 		name string
 		file string
@@ -1101,47 +980,32 @@ func TestScanFileDetectsTypedCredentialAssignmentsWithSecretRHS(t *testing.T) {
 		{
 			name: "typescript simple secret",
 			file: "fixtures/source_secret.ts",
-			text: `const clientSecret: string = "` + providerValue + `"`,
+			text: `const clientSecret: string = "real-client-secret-value"`,
 		},
 		{
-			name: "typescript terminated secret",
+			name: "typescript numeric password",
 			file: "fixtures/source_secret.ts",
-			text: `const clientSecret: string = "` + providerValue + `";`,
-		},
-		{
-			name: "typescript secret with trailing comment",
-			file: "fixtures/source_secret.ts",
-			text: `const clientSecret: string = "` + providerValue + `"; // production`,
-		},
-		{
-			name: "typescript asserted secret",
-			file: "fixtures/source_secret.ts",
-			text: `const clientSecret: string = "` + providerValue + `" as const;`,
-		},
-		{
-			name: "typescript provider password",
-			file: "fixtures/source_secret.ts",
-			text: `const password: string = "` + providerValue + `"`,
+			text: `const password: string = "12345678901234567890"`,
 		},
 		{
 			name: "typescript union secret",
 			file: "fixtures/source_secret.ts",
-			text: `const clientSecret: string | undefined = "` + providerValue + `"`,
+			text: `const clientSecret: string | undefined = "real-client-secret-value"`,
 		},
 		{
 			name: "python simple secret",
 			file: "fixtures/source_secret.py",
-			text: `self.client_secret: str = "` + providerValue + `"`,
+			text: `self.client_secret: str = "real-client-secret-value"`,
 		},
 		{
 			name: "python union secret",
 			file: "fixtures/source_secret.py",
-			text: `self.client_secret: str | None = "` + providerValue + `"`,
+			text: `self.client_secret: str | None = "real-client-secret-value"`,
 		},
 		{
 			name: "python optional secret",
 			file: "fixtures/source_secret.py",
-			text: `self.client_secret: Optional[str] = "` + providerValue + `"`,
+			text: `self.client_secret: Optional[str] = "real-client-secret-value"`,
 		},
 	}
 	for _, tc := range cases {
@@ -1154,154 +1018,24 @@ func TestScanFileDetectsTypedCredentialAssignmentsWithSecretRHS(t *testing.T) {
 	}
 }
 
-func TestScanFileDetectsRepeatedTypedCredentialAssignments(t *testing.T) {
-	providerValue := "ghp_" + "1234567890abcdef1234567890abcdef1234"
-	assertGenericCredentialFinding(t, "fixtures/source_secret.ts", `const clientSecret: string = "placeholder";`, false)
-	assertGenericCredentialFinding(t, "fixtures/source_secret.ts", `const clientSecret: string = "`+providerValue+`";`, true)
-
-	got := ScanFile("fixtures/source_secret.ts", []byte(
-		`const clientSecret: string = "placeholder"; const clientSecret: string = "`+providerValue+`";`+"\n",
-	))
-	var count int
-	for _, item := range got {
-		if item.Rule == "public_content_generic_credential" {
-			count++
-		}
-	}
-	if count != 1 {
-		t.Fatalf("repeated typed credential findings = %d, want 1: %#v", count, got)
-	}
-}
-
 func TestScanFileDetectsCredentialShapedSourceCodeLiterals(t *testing.T) {
-	stripeLike := "sk_" + "live_1234567890abcdef"
 	githubToken := "ghp_" + "1234567890abcdef1234567890abcdef1234"
-	cases := []struct {
-		name string
-		text string
-		want bool
-	}{
-		{name: "stripe", text: `const ClientSecret = "` + stripeLike + `"`, want: true},
-		{name: "github", text: `const GithubToken = "` + githubToken + `"`, want: true},
-		{name: "password number", text: `const Password = "12345678901234567890"`, want: false},
-		{name: "secret number", text: `const ClientSecretNumber = "12345678901234567890"`, want: false},
-		{name: "format literal", text: `const ClientSecretFormat = "abc%sdefreal"`, want: false},
-		{name: "inline format literal", text: `fmt.Println("done"); const ClientSecret = "abc%sdefreal"`, want: false},
-	}
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			assertGenericCredentialFinding(t, "fixtures/source_secret.go", tc.text, tc.want)
-		})
-	}
-}
-
-func TestScanFileDetectsGoShortDeclarationCredentials(t *testing.T) {
-	providerSecret := "sk_" + "live_1234567890abcdef"
-	providerToken := "ghp_" + "1234567890abcdef1234567890abcdef1234"
 	got := ScanFile("fixtures/source_secret.go", []byte(strings.Join([]string{
-		`clientSecret := "` + providerSecret + `"`,
-		`accessToken := "` + providerToken + `"`,
+		`const ClientSecret = "real-client-secret-value"`,
+		`const GithubToken = "` + githubToken + `"`,
+		`const Password = "12345678901234567890"`,
+		`const ClientSecretNumber = "12345678901234567890"`,
+		`const ClientSecretFormat = "abc%sdefreal"`,
+		`fmt.Println("done"); const ClientSecret = "abc%sdefreal"`,
 	}, "\n")+"\n"))
-
 	var count int
 	for _, item := range got {
 		if item.Rule == "public_content_generic_credential" {
 			count++
 		}
 	}
-	if count != 2 {
-		t.Fatalf("Go short declaration credential findings = %d, want 2: %#v", count, got)
-	}
-}
-
-func TestGenericCredentialDecisionMatrix(t *testing.T) {
-	providerToken := "ghp_" + "1234567890abcdef1234567890abcdef1234"
-	highEntropyValue := "Q7k2mN9pR4vX8cL3" + "sT6yU1aD5fG0hJ2z"
-	tokenHash := "6f1ed002ab559585" + "9014ebf0951522d9" +
-		"a0e3c1f4206254d" + "28a13efbbc8d56a30"
-	tests := []struct {
-		name    string
-		path    string
-		text    string
-		comment bool
-		want    bool
-	}{
-		{name: "source synthetic token prefix", path: "pkg/sheets.go", text: `const localOfficeTokenPrefix = "local_office_"`, want: false},
-		{name: "source token kind state", path: "pkg/client.py", text: `self._token_kind: TokenKind | None = None`, want: false},
-		{name: "documentation token prefix", path: "docs/config.yaml", text: `token_prefix: local_office_`, want: false},
-		{name: "documentation token kind", path: "docs/config.yaml", text: `token_kind: bearer`, want: false},
-		{name: "documentation token hash", path: "docs/config.yaml", text: `access_token_hash: ` + tokenHash, want: false},
-		{name: "comment fixture placeholder", text: `AppSecret: "fake-secret"`, comment: true, want: false},
-		{name: "test fixture placeholder", path: "pkg/config_test.go", text: `AppSecret: "fake-secret"`, want: false},
-		{name: "test real-labeled token", path: "pkg/config_test.go", text: `token: "real-tenant-access-token"`, want: false},
-		{name: "test ambiguous concrete secret word", path: "pkg/config_test.go", text: `AppSecret: "supersecret"`, want: false},
-		{name: "resource token placeholder", path: "docs/images.md", text: `"token": "img_abc123"`, want: false},
-		{name: "partially masked token", path: "docs/auth.md", text: `token=ab********cd`, want: false},
-		{name: "source readable secret words", path: "pkg/config.go", text: `const AppSecret = "customer-prod-secret"`, want: false},
-		{name: "documentation readable secret words", path: "docs/config.yaml", text: `client_secret: customer-prod-secret`, want: false},
-		{name: "comment middle fixture marker", text: `API_KEY=prod-fake-key`, comment: true, want: false},
-		{name: "comment negated fixture marker", text: `AppSecret: "not-fake-secret"`, comment: true, want: false},
-		{name: "source with credential words", path: "pkg/config.go", text: `secretWithPassword := "hunter2"`, want: false},
-		{name: "production filename containing sample", path: "pkg/sampler.go", text: `clientSecret := "customer-prod-secret"`, want: false},
-		{name: "provider token under weak key", path: "docs/config.yaml", text: `token: ` + providerToken, want: true},
-		{name: "provider token under hash key", path: "docs/config.yaml", text: `access_token_hash: ` + providerToken, want: true},
-		{name: "high entropy strong secret", path: "docs/config.yaml", text: `client_secret: ` + highEntropyValue, want: true},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			var got []Finding
-			if tt.comment {
-				got = ScanComment("issue_comment", tt.text)
-			} else {
-				got = ScanFile(tt.path, []byte(tt.text+"\n"))
-			}
-			if actual := findingRules(got)["public_content_generic_credential"]; actual != tt.want {
-				t.Fatalf("generic credential finding = %v, want %v: %#v", actual, tt.want, got)
-			}
-		})
-	}
-}
-
-func TestScanFileClassifiesLowEvidenceTestFixtureCredentials(t *testing.T) {
-	providerToken := "ghp_" + "1234567890abcdef1234567890abcdef1234"
-	highEntropyValue := "Q7k2mN9pR4vX8cL3" + "sT6yU1aD5fG0hJ2z"
-	tests := []struct {
-		name  string
-		value string
-		want  bool
-	}{
-		{name: "human readable access token", value: "user-access-token", want: false},
-		{name: "delimited secret value", value: "secret-value", want: false},
-		{name: "underscored secret fixture", value: "plain_secret", want: false},
-		{name: "short delimited fixture", value: "t-abc", want: false},
-		{name: "embedded test marker", value: "perm-grant-test-secret-skip", want: false},
-		{name: "real labeled fixture", value: "real-token", want: false},
-		{name: "ambiguous concrete word", value: "supersecret", want: false},
-		{name: "provider token", value: providerToken, want: true},
-		{name: "high entropy secret", value: highEntropyValue, want: true},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			got := ScanFile("pkg/config_test.go", []byte(`AppSecret: "`+tt.value+`"`+"\n"))
-			if actual := findingRules(got)["public_content_generic_credential"]; actual != tt.want {
-				t.Fatalf("generic credential finding = %v, want %v: %#v", actual, tt.want, got)
-			}
-		})
-	}
-}
-
-func TestScanFileAllowsLowEvidenceTestFixtureAssignmentSyntaxes(t *testing.T) {
-	got := ScanFile("pkg/config_test.go", []byte(strings.Join([]string{
-		`secret := "secret-value"`,
-		`samplePassword := "sample-password"`,
-		`bodyWithToken := "plain text body\\nDownload: https://example.com/file?token=tok_aaa\\n"`,
-	}, "\n")+"\n"))
-	for _, item := range got {
-		if item.Rule == "public_content_generic_credential" {
-			t.Fatalf("low-evidence test fixture assignment should not be reported: %#v", got)
-		}
+	if count != 6 {
+		t.Fatalf("source code credential-shaped literal findings = %d, want 6: %#v", count, got)
 	}
 }
 
@@ -1382,10 +1116,9 @@ func TestScanFileAllowsClientTokenIdempotencyExamples(t *testing.T) {
 
 func TestScanFileDetectsCredentialShapedClientTokenValues(t *testing.T) {
 	stripeLike := "sk_" + "live_1234567890abcdef"
-	githubToken := "ghp_" + "1234567890abcdef1234567890abcdef1234"
 	got := ScanFile("fixtures/idempotency.md", []byte(strings.Join([]string{
 		`{"client_token":"` + stripeLike + `"}`,
-		`{"client_token":"` + githubToken + `"}`,
+		`{"client_token":"real-client-secret-value"}`,
 	}, "\n")+"\n"))
 	var count int
 	for _, item := range got {
@@ -1419,10 +1152,9 @@ func TestScanFileAllowsTokenLikePlaceholderExamples(t *testing.T) {
 
 func TestScanFileDetectsCredentialShapedTokenLikePlaceholderValues(t *testing.T) {
 	stripeLike := "sk_" + "live_1234567890abcdef"
-	githubToken := "ghp_" + "1234567890abcdef1234567890abcdef1234"
 	got := ScanFile("fixtures/placeholders.md", []byte(strings.Join([]string{
 		`{ "resource_token": "` + stripeLike + `" }`,
-		`{ "block_token": "` + githubToken + `" }`,
+		`{ "block_token": "real-client-secret-value" }`,
 	}, "\n")+"\n"))
 	var count int
 	for _, item := range got {
@@ -1636,43 +1368,39 @@ func TestScanFileAllowsConventionalCredentialPlaceholders(t *testing.T) {
 	}
 }
 
-func TestScanFileAllowsInvalidProviderPlaceholderLookalikes(t *testing.T) {
+func TestScanFileDetectsCredentialShapedPlaceholderLookalikes(t *testing.T) {
 	stripeLike := "sk_" + "live_1234567890abcdef"
 	got := ScanFile("docs/config.md", []byte(strings.Join([]string{
 		"client_secret: " + stripeLike + "_HERE",
 		"api_key: YOUR_" + stripeLike,
 	}, "\n")+"\n"))
+	var count int
 	for _, item := range got {
 		if item.Rule == "public_content_generic_credential" {
-			t.Fatalf("invalid provider placeholder lookalike should not be blocked: %#v", got)
+			count++
 		}
 	}
+	if count != 2 {
+		t.Fatalf("credential-shaped placeholder lookalike findings = %d, want 2: %#v", count, got)
+	}
 }
 
 func TestScanFileDetectsPercentWrappedCredentialValues(t *testing.T) {
 	stripeLike := "sk_" + "live_1234567890abcdef"
 	patLike := "gh" + "p_1234567890abcdef1234567890abcdef1234"
-	cases := []struct {
-		name string
-		text string
-		want bool
-	}{
-		{name: "stripe", text: "CLIENT_SECRET=%" + stripeLike + "%", want: true},
-		{name: "github", text: "GITHUB_TOKEN=%" + patLike + "%", want: true},
-		{name: "readable", text: "TOKEN=%real-secret-token-value%", want: false},
+	got := ScanFile("docs/config.md", []byte(strings.Join([]string{
+		"CLIENT_SECRET=%" + stripeLike + "%",
+		"GITHUB_TOKEN=%" + patLike + "%",
+		"TOKEN=%real-secret-token-value%",
+	}, "\n")+"\n"))
+	var count int
+	for _, item := range got {
+		if item.Rule == "public_content_generic_credential" {
+			count++
+		}
 	}
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			assertGenericCredentialFinding(t, "docs/config.md", tc.text, tc.want)
-		})
-	}
-}
-
-func assertGenericCredentialFinding(t *testing.T, file, text string, want bool) {
-	t.Helper()
-	got := ScanFile(file, []byte(text+"\n"))
-	if actual := findingRules(got)["public_content_generic_credential"]; actual != want {
-		t.Fatalf("generic credential finding = %v, want %v: %#v", actual, want, got)
+	if count != 3 {
+		t.Fatalf("percent-wrapped credential findings = %d, want 3: %#v", count, got)
 	}
 }
 

internal/qualitygate/rules/run_test.go

@@ -7,6 +7,7 @@ import (
 	"context"
 	"encoding/json"
 	"os"
+	"os/exec"
 	"path/filepath"
 	"strings"
 	"testing"
@@ -14,7 +15,6 @@ import (
 	qdiff "github.com/larksuite/cli/internal/qualitygate/diff"
 	"github.com/larksuite/cli/internal/qualitygate/manifest"
 	"github.com/larksuite/cli/internal/qualitygate/report"
-	"github.com/larksuite/cli/internal/testutil/gitcmd"
 	"github.com/larksuite/cli/internal/vfs"
 )
 
@@ -203,8 +203,7 @@ func TestRunCollectsPublicContentFindingsIntoDiagnosticsAndFacts(t *testing.T) {
 	if err := vfs.MkdirAll(filepath.Join(repo, "docs"), 0o755); err != nil {
 		t.Fatal(err)
 	}
-	providerValue := "ghp_" + "1234567890abcdef1234567890abcdef1234"
-	publicDoc := "api_" + "key = \"" + providerValue + "\"\n" +
+	publicDoc := "api_" + "key = \"example-public-key\"\n" +
 		"Public docs describe a pri" + "vate request header and trust classification detail.\n"
 	if err := vfs.WriteFile(filepath.Join(repo, "docs", "public.md"), []byte(publicDoc), 0o644); err != nil {
 		t.Fatal(err)
@@ -600,8 +599,7 @@ func TestNormalizeDiagnosticFileHandlesAbsoluteRepo(t *testing.T) {
 
 func runGit(t *testing.T, repo string, args ...string) {
 	t.Helper()
-	commandArgs := append([]string{"-c", "core.hooksPath=/dev/null"}, args...)
-	cmd := gitcmd.Command(repo, commandArgs...)
+	cmd := exec.Command("git", append([]string{"-c", "core.hooksPath=/dev/null", "-C", repo}, args...)...)
 	cmd.Env = append(os.Environ(), "GIT_AUTHOR_DATE=2026-06-17T00:00:00Z", "GIT_COMMITTER_DATE=2026-06-17T00:00:00Z")
 	out, err := cmd.CombinedOutput()
 	if err != nil {

internal/testutil/gitcmd/gitcmd.go

@@ -1,55 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-// Package gitcmd provides Git process helpers for tests that use temporary
-// repositories.
-package gitcmd
-
-import (
-	"os"
-	"os/exec"
-	"strconv"
-	"testing"
-)
-
-const (
-	maintenanceAutoDetach = "maintenance.autoDetach"
-	gcAutoDetach          = "gc.autoDetach"
-)
-
-// Command creates a Git command whose automatic maintenance stays in the
-// command lifecycle, so temporary repository cleanup cannot race a detached
-// maintenance process.
-func Command(dir string, args ...string) *exec.Cmd {
-	commandArgs := make([]string, 0, len(args)+4)
-	commandArgs = append(commandArgs,
-		"-c", maintenanceAutoDetach+"=false",
-		"-c", gcAutoDetach+"=false",
-	)
-	commandArgs = append(commandArgs, args...)
-	cmd := exec.Command("git", commandArgs...)
-	cmd.Dir = dir
-	return cmd
-}
-
-// SetSynchronousMaintenanceEnv applies the same lifecycle contract to every
-// Git process started by the current test, including processes created through
-// production command runners. Tests using it must not run in parallel.
-func SetSynchronousMaintenanceEnv(t *testing.T) {
-	t.Helper()
-	count := 0
-	if value, ok := os.LookupEnv("GIT_CONFIG_COUNT"); ok {
-		parsed, err := strconv.Atoi(value)
-		if err != nil || parsed < 0 {
-			t.Fatalf("invalid GIT_CONFIG_COUNT %q", value)
-		}
-		count = parsed
-	}
-	for _, key := range []string{maintenanceAutoDetach, gcAutoDetach} {
-		index := strconv.Itoa(count)
-		t.Setenv("GIT_CONFIG_KEY_"+index, key)
-		t.Setenv("GIT_CONFIG_VALUE_"+index, "false")
-		count++
-	}
-	t.Setenv("GIT_CONFIG_COUNT", strconv.Itoa(count))
-}

internal/testutil/gitcmd/gitcmd_test.go

@@ -1,47 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package gitcmd
-
-import (
-	"os/exec"
-	"strings"
-	"testing"
-)
-
-func TestCommandDisablesDetachedMaintenance(t *testing.T) {
-	for _, key := range []string{"maintenance.autoDetach", "gc.autoDetach"} {
-		cmd := Command(t.TempDir(), "config", "--get", "--type=bool", key)
-		out, err := cmd.CombinedOutput()
-		if err != nil {
-			t.Fatalf("git config %s: %v\n%s", key, err, out)
-		}
-		if got := strings.TrimSpace(string(out)); got != "false" {
-			t.Fatalf("%s = %q, want false", key, got)
-		}
-	}
-}
-
-func TestSetSynchronousMaintenanceEnv(t *testing.T) {
-	t.Setenv("GIT_CONFIG_COUNT", "1")
-	t.Setenv("GIT_CONFIG_KEY_0", "user.name")
-	t.Setenv("GIT_CONFIG_VALUE_0", "Existing Test User")
-	SetSynchronousMaintenanceEnv(t)
-	for key, want := range map[string]string{
-		"user.name":           "Existing Test User",
-		maintenanceAutoDetach: "false",
-		gcAutoDetach:          "false",
-	} {
-		cmd := exec.Command("git", "config", "--get", "--type=bool", key)
-		if key == "user.name" {
-			cmd = exec.Command("git", "config", "--get", key)
-		}
-		out, err := cmd.CombinedOutput()
-		if err != nil {
-			t.Fatalf("git config %s: %v\n%s", key, err, out)
-		}
-		if got := strings.TrimSpace(string(out)); got != want {
-			t.Fatalf("%s = %q, want %q", key, got, want)
-		}
-	}
-}

lint/errscontract/scan_test.go

@@ -34,12 +34,7 @@ func writeFixture(t *testing.T, files fixtureRepo) string {
 
 func runGit(t *testing.T, root string, args ...string) string {
 	t.Helper()
-	commandArgs := []string{
-		"-c", "maintenance.autoDetach=false",
-		"-c", "gc.autoDetach=false",
-	}
-	commandArgs = append(commandArgs, args...)
-	cmd := exec.Command("git", commandArgs...)
+	cmd := exec.Command("git", args...)
 	cmd.Dir = root
 	out, err := cmd.CombinedOutput()
 	if err != nil {
@@ -48,14 +43,6 @@ func runGit(t *testing.T, root string, args ...string) string {
 	return strings.TrimSpace(string(out))
 }
 
-func TestRunGitDisablesDetachedMaintenance(t *testing.T) {
-	for _, key := range []string{"maintenance.autoDetach", "gc.autoDetach"} {
-		if got := runGit(t, t.TempDir(), "config", "--get", "--type=bool", key); got != "false" {
-			t.Fatalf("%s = %q, want false", key, got)
-		}
-	}
-}
-
 func TestLoadSubtypeAllowlist_ExtractsTypedConstValues(t *testing.T) {
 	root := writeFixture(t, fixtureRepo{
 		"errs/subtypes.go": `package errs

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@larksuite/cli",
-  "version": "1.0.73",
+  "version": "1.0.71",
   "description": "The official CLI for Lark/Feishu open platform",
   "bin": {
     "lark-cli": "scripts/run.js"

scripts/ci-workflow.test.sh

@@ -18,11 +18,6 @@ workflow_permissions="$(awk '
   in_permissions && /^[^[:space:]]/ { exit }
   in_permissions { print }
 ' "$workflow")"
-workflow_concurrency="$(awk '
-  /^concurrency:/ { in_concurrency = 1; print; next }
-  in_concurrency && /^[^[:space:]]/ { exit }
-  in_concurrency { print }
-' "$workflow")"
 fast_gate_section="$(job_section fast-gate)"
 unit_test_section="$(job_section unit-test)"
 lint_section="$(awk '
@@ -51,27 +46,6 @@ results_section="$(awk '
   in_job { print }
 ' "$workflow")"
 fork_safe_guard="github.event_name != 'pull_request' || !github.event.pull_request.head.repo.fork"
-live_job_condition="always() && ($fork_safe_guard) && needs.unit-test.result == 'success' && needs.lint.result == 'success' && needs.script-test.result == 'success' && needs.deterministic-gate.result == 'success' && needs.e2e-dry-run.result == 'success' && (needs.e2e-dry-run.outputs.mode == 'full' || needs.e2e-dry-run.outputs.mode == 'subset') && needs.e2e-dry-run.outputs.live_packages != ''"
-
-if ! grep -Fq "run-name: \${{ github.event_name == 'pull_request' && format('CI / {0}', github.event.pull_request.number) || '' }}" "$workflow"; then
-  echo "CI should expose a stable PR generation while preserving default push and manual run titles" >&2
-  exit 1
-fi
-
-if ! grep -Fq "RUN_GENERATION: \${{ github.event_name == 'pull_request' && format('CI / {0}', github.event.pull_request.number) || '' }}" <<<"$section"; then
-  echo "the supersession generation should match the PR-only run name" >&2
-  exit 1
-fi
-
-if ! grep -Fq 'group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}' <<<"$workflow_concurrency"; then
-  echo "CI should deduplicate runs for the same pull request without grouping push or manual runs" >&2
-  exit 1
-fi
-
-if ! grep -Fq "cancel-in-progress: \${{ github.event_name == 'pull_request' }}" <<<"$workflow_concurrency"; then
-  echo "CI should cancel superseded pull request runs but preserve push and manual runs" >&2
-  exit 1
-fi
 
 for denied_permission in "checks: write" "pull-requests: write" "issues: write"; do
   if grep -Eq "^[[:space:]]*${denied_permission}$" <<<"$workflow_permissions"; then
@@ -236,84 +210,8 @@ if ! grep -Fq "deterministic-gate" <<<"$results_section"; then
   exit 1
 fi
 
-if ! grep -Fq "if: \${{ $live_job_condition }}" <<<"$section"; then
-  echo "e2e-live should preserve active cleanup while requiring a successful non-skip dry run and excluding fork pull requests"
-  exit 1
-fi
-
-if ! grep -Fq "needs: [unit-test, lint, script-test, deterministic-gate, e2e-dry-run]" <<<"$section"; then
-  echo "e2e-live should wait outside the exclusive queue until e2e-dry-run finishes"
-  exit 1
-fi
-
-if ! grep -Fq "timeout-minutes: 20" <<<"$dry_run_section"; then
-  echo "e2e-dry-run should bound the planning gate before live E2E" >&2
-  exit 1
-fi
-
-if ! grep -Fq "timeout-minutes: 30" <<<"$section"; then
-  echo "e2e-live should release the repository-wide slot after 30 minutes" >&2
-  exit 1
-fi
-
-if ! grep -Fq "group: lark-cli-e2e-live" <<<"$section"; then
-  echo "e2e-live should use one repository-wide execution slot" >&2
-  exit 1
-fi
-
-if ! grep -Fq "cancel-in-progress: false" <<<"$section"; then
-  echo "e2e-live should queue waiting runs instead of cancelling an active live test" >&2
-  exit 1
-fi
-
-if ! grep -Fq "queue: max" <<<"$section"; then
-  echo "e2e-live should preserve queued runs instead of replacing an existing pending run" >&2
-  exit 1
-fi
-
-if ! grep -Fq "actions: read" <<<"$section"; then
-  echo "e2e-live should use read-only Actions access for the supersession check" >&2
-  exit 1
-fi
-
-live_test_step="$(awk '
-  /^      - name: Run CLI E2E tests/ { in_step = 1 }
-  in_step { print }
-  in_step && /^      - name: Publish CLI E2E test report/ { exit }
-' <<<"$section")"
-
-if ! grep -Fq "if: \${{ always() && steps.build_cli.outcome == 'success' && steps.live_e2e_tat.outcome == 'success' }}" <<<"$live_test_step"; then
-  echo "the active live test step should survive ordinary workflow supersession only after setup succeeds" >&2
-  exit 1
-fi
-
-for required in \
-  'gh api "repos/$REPOSITORY/actions/runs/$RUN_ID"' \
-  'gh api --paginate -X GET "repos/$REPOSITORY/actions/workflows/$workflow_id/runs"' \
-  '-f event=pull_request -f branch="$GITHUB_HEAD_REF" -f per_page=100' \
-  '.head_repository.full_name == $repository and .display_title == $generation and .run_number > $run_number' \
-  '::error::Superseded before live E2E started' \
-  'exit 1'; do
-  if ! grep -Fq -- "$required" <<<"$live_test_step"; then
-    echo "the live startup check should fail closed before a superseded run starts live E2E: missing $required" >&2
-    exit 1
-  fi
-done
-
-if ! awk '
-  /if \[ -n "\$newer_runs" \]; then/ { superseded_state = 1; next }
-  superseded_state == 1 && /::error::Superseded before live E2E started/ { superseded_state = 2; next }
-  superseded_state == 2 && /^[[:space:]]+exit 1[[:space:]]*$/ { superseded_state = 3; next }
-  superseded_state > 0 && /^[[:space:]]+fi[[:space:]]*$/ {
-    if (superseded_state != 3) exit 2
-    superseded_closed = 1
-    superseded_state = 0
-    next
-  }
-  /go run gotest.tools\/gotestsum@/ { test_started = 1; if (!superseded_closed) exit 3 }
-  END { exit superseded_closed && test_started ? 0 : 1 }
-' <<<"$live_test_step"; then
-  echo "a superseded live run must stop before gotestsum starts" >&2
+if ! grep -Fq "if: \${{ $fork_safe_guard }}" <<<"$section"; then
+  echo "e2e-live should run on push and same-repository pull_request, but skip fork pull_request"
   exit 1
 fi
 
@@ -324,39 +222,6 @@ if ! grep -Fq "name: Resolve CLI E2E domains" <<<"$dry_run_section" ||
   exit 1
 fi
 
-for output in \
-  'mode: ${{ steps.e2e_domains.outputs.mode }}' \
-  'reason: ${{ steps.e2e_domains.outputs.reason }}' \
-  'live_packages: ${{ steps.e2e_domains.outputs.live_packages }}'; do
-  if ! grep -Fq "$output" <<<"$dry_run_section"; then
-    echo "e2e-dry-run should publish $output for the live job" >&2
-    exit 1
-  fi
-done
-
-for validation_contract in \
-  'case "$E2E_MODE" in' \
-  'skip)' \
-  '[ -z "$E2E_LIVE_PACKAGES" ]' \
-  'full|subset)' \
-  '[ -n "$E2E_LIVE_PACKAGES" ]' \
-  'Invalid CLI E2E mode' \
-  'exit 1'; do
-  if ! grep -Fq "$validation_contract" <<<"$dry_run_section"; then
-    echo "e2e-dry-run should fail invalid domain output before live can be skipped: missing $validation_contract" >&2
-    exit 1
-  fi
-done
-
-if ! awk '
-  /- name: Validate CLI E2E domain outputs/ { validated = 1 }
-  /- name: Build lark-cli/ { exit validated ? 0 : 1 }
-  END { if (!validated) exit 1 }
-' <<<"$dry_run_section"; then
-  echo "e2e-dry-run should validate domain outputs before building" >&2
-  exit 1
-fi
-
 if ! grep -Fq "steps.e2e_domains.outputs.dry_packages" <<<"$dry_run_section"; then
   echo "e2e-dry-run should use resolved dry_packages instead of always running the full suite"
   exit 1
@@ -379,21 +244,21 @@ if ! grep -Fq "No dry-run CLI E2E needed" <<<"$dry_run_section"; then
   exit 1
 fi
 
-if grep -Fq "name: Resolve CLI E2E domains" <<<"$section" ||
-   grep -Fq "run: node scripts/e2e_domains.js" <<<"$section"; then
-  echo "e2e-live should reuse e2e-dry-run outputs instead of resolving domains again"
+if ! grep -Fq "name: Resolve CLI E2E domains" <<<"$section" ||
+   ! grep -Fq "id: e2e_domains" <<<"$section" ||
+   ! grep -Fq "run: node scripts/e2e_domains.js" <<<"$section"; then
+  echo "e2e-live should resolve changed-file CLI E2E domains before credentials and tests"
   exit 1
 fi
 
-if ! grep -Fq "E2E_LIVE_PACKAGES: \${{ needs.e2e-dry-run.outputs.live_packages }}" <<<"$section"; then
-  echo "e2e-live should reuse live_packages resolved by e2e-dry-run"
+if ! grep -Fq "steps.e2e_domains.outputs.live_packages" <<<"$section"; then
+  echo "e2e-live should use resolved live_packages instead of always running the full suite"
   exit 1
 fi
 
-if ! grep -Fq "E2E_MODE: \${{ needs.e2e-dry-run.outputs.mode }}" <<<"$section" ||
-   ! grep -Fq "E2E_REASON: \${{ needs.e2e-dry-run.outputs.reason }}" <<<"$section" ||
+if ! grep -Fq "E2E_REASON: \${{ steps.e2e_domains.outputs.reason }}" <<<"$section" ||
    ! grep -Fq 'echo "Live CLI E2E domains: $E2E_MODE ($E2E_REASON)"' <<<"$section"; then
-  echo "e2e-live should consume the exact mode and reason produced by e2e-dry-run"
+  echo "e2e-live should pass dynamic domain output through env before shell use"
   exit 1
 fi
 
@@ -407,23 +272,16 @@ if ! awk '
   exit 1
 fi
 
-if grep -Fq "steps.e2e_domains.outputs" <<<"$section"; then
-  echo "e2e-live should not retain step-local domain outputs after adopting the dry-run job gate"
+if ! awk '
+  /^      - name: Build lark-cli/ { in_step = 1 }
+  in_step && /if: \$\{\{ steps\.e2e_domains\.outputs\.mode != '\''skip'\'' \}\}/ { found = 1 }
+  in_step && /^      - name:/ && !/Build lark-cli/ { in_step = 0 }
+  END { exit found ? 0 : 1 }
+' <<<"$section"; then
+  echo "e2e-live should skip building lark-cli when domain mode is skip"
   exit 1
 fi
 
-for step_name in "Build lark-cli" "Prepare shared live E2E tenant token"; do
-  live_setup_step="$(awk -v name="$step_name" '
-    $0 == "      - name: " name { in_step = 1 }
-    in_step { print }
-    in_step && /^      - name:/ && $0 != "      - name: " name { exit }
-  ' <<<"$section")"
-  if grep -Eq '^        if:' <<<"$live_setup_step"; then
-    echo "e2e-live $step_name should run unconditionally after the non-skip job gate" >&2
-    exit 1
-  fi
-done
-
 if ! grep -Fq "permissions:" <<<"$section" ||
    ! grep -Fq "contents: read" <<<"$section" ||
    ! grep -Fq "checks: write" <<<"$section"; then
@@ -441,88 +299,18 @@ if grep -Fq "live_e2e_credentials" <<<"$section" || grep -Fq "configured=false"
   exit 1
 fi
 
-if ! grep -Fq "node scripts/fetch_e2e_tat.js" <<<"$section"; then
-  echo "e2e-live should fetch the tenant token via the dedicated script"
-  exit 1
-fi
-
-if grep -Fq "config init" <<<"$section"; then
-  echo "e2e-live should use env credentials instead of config init"
-  exit 1
-fi
-
-if ! grep -Fq "TEST_BOT1_APP_ID: \${{ secrets.TEST_BOT1_APP_ID }}" <<<"$section"; then
-  echo "e2e-live should keep the bot app id under a test-only job env name"
-  exit 1
-fi
-
-if awk '
-  /^  e2e-live:/ { in_job = 1; next }
-  in_job && /^  [A-Za-z0-9_-]+:/ { in_job = 0 }
-  in_job && /^    env:/ { in_env = 1; next }
-  in_env && /^    steps:/ { in_env = 0 }
-  in_env && /LARKSUITE_CLI_APP_ID:/ { found_standard_app_id = 1 }
-  END { exit found_standard_app_id ? 0 : 1 }
-' "$workflow"; then
-  echo "e2e-live should not activate the env credential provider at job scope"
-  exit 1
-fi
-
-if ! grep -Fq "LARKSUITE_CLI_BRAND: feishu" <<<"$section"; then
-  echo "e2e-live should pin the env credential brand to feishu"
-  exit 1
-fi
-
-if awk '
-  /^  e2e-live:/ { in_job = 1; next }
-  in_job && /^  [A-Za-z0-9_-]+:/ { in_job = 0 }
-  in_job && /^    env:/ { in_env = 1; next }
-  in_env && /^    steps:/ { in_env = 0 }
-  in_env && /(SECRET|ACCESS_TOKEN):/ { found_sensitive = 1 }
-  END { exit found_sensitive ? 0 : 1 }
-' "$workflow"; then
-  echo "e2e-live should not expose live E2E credentials through job-level env"
+if ! grep -Fq "::error::Missing required secrets: TEST_BOT1_APP_ID / TEST_BOT1_APP_SECRET" <<<"$section"; then
+  echo "e2e-live should make missing bot credentials a visible configuration failure on eligible runs"
   exit 1
 fi
 
 if ! awk '
-  /^      - name: Prepare shared live E2E tenant token/ { in_step = 1 }
-  in_step && /id: live_e2e_tat/ { has_id = 1 }
-  in_step && /^        if:/ { has_if = 1 }
-  in_step && /LARKSUITE_CLI_APP_ID: \$\{\{ secrets\.TEST_BOT1_APP_ID \}\}/ { has_app_id = 1 }
-  in_step && /secrets\.TEST_BOT1_APP_SECRET/ { has_bot_credential = 1 }
-  in_step && /node scripts\/fetch_e2e_tat\.js/ { has_script = 1 }
-  in_step && /GITHUB_ENV/ { uses_github_env = 1 }
-  in_step && /^      - name:/ && !/Prepare shared live E2E tenant token/ { in_step = 0 }
-  END { exit has_id && !has_if && has_app_id && has_bot_credential && has_script && !uses_github_env ? 0 : 1 }
+  /^      - name: Configure bot credentials/ { in_step = 1 }
+  in_step && /if: \$\{\{ steps\.e2e_domains\.outputs\.mode != '\''skip'\'' \}\}/ { found = 1 }
+  in_step && /^      - name:/ && !/Configure bot credentials/ { in_step = 0 }
+  END { exit found ? 0 : 1 }
 ' <<<"$section"; then
-  echo "e2e-live should pass only a private tenant token file path through step output"
-  exit 1
-fi
-
-if ! awk '
-  /^      - name: Run CLI E2E tests/ { in_step = 1 }
-  in_step && /E2E_TENANT_AUTH_FILE: \$\{\{ steps\.live_e2e_tat\.outputs\.path \}\}/ { has_file = 1 }
-  in_step && /secrets\.TEST_USER_ACCESS_TOKEN/ { has_user_credential = 1 }
-  in_step && /Missing shared live E2E tenant token file/ { checks_file = 1 }
-  in_step && /^ *export / && /TEST_TENANT_ACCESS_TOKEN/ && /E2E_TENANT_AUTH_FILE/ { exports_test_tat = 1 }
-  in_step && /^ *export / && /LARKSUITE_CLI_TENANT_ACCESS_TOKEN/ { exports_standard_tat = 1 }
-  in_step && /LARKSUITE_CLI_APP_ID="\$TEST_BOT1_APP_ID"/ { scopes_preflight_app_id = 1 }
-  in_step && /LARKSUITE_CLI_TENANT_ACCESS_TOKEN="\$TEST_TENANT_ACCESS_TOKEN"/ { scopes_preflight_tat = 1 }
-  in_step && /lark-cli whoami --as bot/ { has_preflight = 1 }
-  in_step && /Tenant credential preflight failed/ { checks_preflight = 1 }
-  in_step && /TEST_USER_ACCESS_TOKEN/ && /secrets\.TEST_USER_ACCESS_TOKEN/ { has_user_env = 1 }
-  in_step && /LARKSUITE_CLI_USER_ACCESS_TOKEN/ && /secrets\.TEST_USER_ACCESS_TOKEN/ { has_global_user_env = 1 }
-  in_step && /trap / { has_trap = 1 }
-  in_step && /^      - name:/ && !/Run CLI E2E tests/ { in_step = 0 }
-  END { exit has_file && has_user_credential && checks_file && exports_test_tat && !exports_standard_tat && scopes_preflight_app_id && scopes_preflight_tat && has_preflight && checks_preflight && has_user_env && !has_global_user_env && !has_trap ? 0 : 1 }
-' <<<"$section"; then
-  echo "e2e-live should expose live E2E credentials only inside the test shell step"
-  exit 1
-fi
-
-if grep -Fq 'if [ "$E2E_MODE" = "skip" ]' <<<"$section"; then
-  echo "e2e-live should not retain an unreachable step-level skip branch"
+  echo "e2e-live should only configure bot credentials when domain mode is not skip"
   exit 1
 fi
 
@@ -531,8 +319,8 @@ if grep -Fq "steps.live_e2e_credentials.outputs.configured" <<<"$section"; then
   exit 1
 fi
 
-if ! grep -Fq "if: \${{ !cancelled() }}" <<<"$section"; then
-  echo "e2e-live report step should run after attempted live tests unless the workflow is cancelled"
+if ! grep -Fq "if: \${{ !cancelled() && steps.e2e_domains.outputs.mode != 'skip' }}" <<<"$section"; then
+  echo "e2e-live report step should run after attempted live tests unless the workflow is cancelled or domain mode is skip"
   exit 1
 fi
 
@@ -554,7 +342,7 @@ if grep -Fq '${{ secrets.CODECOV_TOKEN }}' <<<"$coverage_step" &&
 fi
 
 if grep -Fq '${{ secrets.' <<<"$section" &&
-   ! grep -Fq "$fork_safe_guard" <<<"$section"; then
+   ! grep -Fq "if: \${{ $fork_safe_guard }}" <<<"$section"; then
   echo "live E2E secrets should be available on push and same-repository pull_request, but not fork pull_request" >&2
   exit 1
 fi

scripts/fetch_e2e_tat.js

@@ -1,164 +0,0 @@
-#!/usr/bin/env node
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-// Fetches a live E2E tenant access token (TAT) for the shared bot identity.
-//
-// Invoked from the e2e-live CI job. Exchanges the bot app id/secret for a
-// tenant access token, writes the token to a private file under $RUNNER_TEMP,
-// and emits the file path as a step output so the test step can read it once
-// and then delete it.
-//
-// The secret arrives via environment variables; the OAuth parameter names are
-// literal because this is a source code file (.js), so the quality gate's
-// benign-code-credential exemption applies to the process.env references.
-
-const fs = require("node:fs");
-const http = require("node:http");
-const https = require("node:https");
-const path = require("node:path");
-const { URL } = require("node:url");
-
-const ENDPOINT = process.env.E2E_TAT_ENDPOINT || "https://accounts.feishu.cn/oauth/v3/token";
-const MAX_ATTEMPTS = 4;
-const RETRY_BASE_MS = parseInt(process.env.E2E_TAT_RETRY_BASE_MS || "1000", 10);
-
-function requireEnv(name) {
-  const value = process.env[name];
-  if (!value) {
-    console.error(`::error::Missing required environment variable: ${name}`);
-    process.exit(1);
-  }
-  return value;
-}
-
-function postForm(url, body) {
-  return new Promise((resolve, reject) => {
-    const parsed = new URL(url);
-    const transport = parsed.protocol === "http:" ? http : https;
-    const req = transport.request(
-      parsed,
-      {
-        method: "POST",
-        headers: {
-          "Content-Type": "application/x-www-form-urlencoded",
-          "Content-Length": Buffer.byteLength(body),
-        },
-        timeout: 20000,
-      },
-      (resp) => {
-        const chunks = [];
-        let settled = false;
-        const rejectOnce = (error) => {
-          if (!settled) {
-            settled = true;
-            reject(error);
-          }
-        };
-        resp.on("data", (chunk) => chunks.push(chunk));
-        resp.on("aborted", () => rejectOnce(new Error("response aborted before completion")));
-        resp.on("error", rejectOnce);
-        resp.on("close", () => {
-          if (!resp.complete) {
-            rejectOnce(new Error("response closed before completion"));
-          }
-        });
-        resp.on("end", () => {
-          if (!resp.complete) {
-            rejectOnce(new Error("response ended before completion"));
-            return;
-          }
-          settled = true;
-          resolve({
-            status: resp.statusCode,
-            body: Buffer.concat(chunks).toString("utf8"),
-            headers: resp.headers,
-          });
-        });
-      },
-    );
-    req.on("timeout", () => {
-      req.destroy();
-      reject(new Error("request timed out"));
-    });
-    req.on("error", reject);
-    req.write(body);
-    req.end();
-  });
-}
-
-function encodeForm(params) {
-  return Object.entries(params)
-    .map(([key, value]) => `${encodeURIComponent(key)}=${encodeURIComponent(value)}`)
-    .join("&");
-}
-
-function sleep(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
-}
-
-async function fetchTenantToken() {
-  const appId = requireEnv("LARKSUITE_CLI_APP_ID");
-  const appSecret = requireEnv("TEST_BOT1_APP_SECRET");
-
-  const body = encodeForm({
-    grant_type: "client_credentials",
-    client_id: appId,
-    client_secret: appSecret,
-  });
-
-  let lastError = "";
-  for (let attempt = 1; attempt <= MAX_ATTEMPTS; attempt++) {
-    try {
-      const { status, body: respBody, headers } = await postForm(ENDPOINT, body);
-      let payload;
-      try {
-        payload = JSON.parse(respBody);
-      } catch {
-        const logID = headers["x-tt-logid"] || headers["x-request-id"] || "unavailable";
-        lastError = `HTTP ${status}, log_id=${logID}, non-JSON response`;
-      }
-      if (payload) {
-        const token = payload.access_token;
-        if (status === 200 && payload.code === 0 && token) {
-          return token;
-        }
-        lastError = `HTTP ${status}, code=${payload.code}, error=${payload.error}, msg=${payload.msg || payload.error_description}`;
-      }
-    } catch (err) {
-      lastError = err.message;
-    }
-
-    if (attempt < MAX_ATTEMPTS) {
-      await sleep(2 ** (attempt - 1) * RETRY_BASE_MS);
-    }
-  }
-
-  console.error(`::error::Failed to fetch tenant access token: ${lastError}`);
-  process.exit(1);
-}
-
-async function main() {
-  const token = await fetchTenantToken();
-  console.log(`::add-mask::${token}`);
-
-  const tatPath = path.join(process.env.RUNNER_TEMP, "e2e-live-tat");
-  fs.writeFileSync(tatPath, token, { encoding: "utf8", mode: 0o600 });
-
-  if (process.env.GITHUB_OUTPUT) {
-    fs.appendFileSync(process.env.GITHUB_OUTPUT, `path=${tatPath}\n`);
-  }
-
-  console.log("Prepared shared live E2E tenant token");
-}
-
-if (require.main === module) {
-  main();
-}
-
-module.exports = {
-  encodeForm,
-  fetchTenantToken,
-  postForm,
-  requireEnv,
-};

scripts/fetch_e2e_tat.test.js

@@ -1,203 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-const assert = require("node:assert/strict");
-const fs = require("node:fs");
-const http = require("node:http");
-const os = require("node:os");
-const path = require("node:path");
-const { spawn } = require("node:child_process");
-const test = require("node:test");
-
-const scriptPath = path.join(__dirname, "fetch_e2e_tat.js");
-
-function startServer(handler) {
-  const server = http.createServer((req, res) => {
-    let body = "";
-    req.on("data", (chunk) => {
-      body += chunk;
-    });
-    req.on("end", () => {
-      handler(req, res, body);
-    });
-  });
-  return new Promise((resolve) => {
-    server.listen(0, "127.0.0.1", () => {
-      const port = server.address().port;
-      resolve({ server, port });
-    });
-  });
-}
-
-function abortResponse(res) {
-  res.writeHead(200, {
-    "Content-Type": "application/json",
-    "Content-Length": "100",
-  });
-  res.write('{"code":0');
-  setImmediate(() => res.destroy());
-}
-
-function runScript(envOverrides) {
-  const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "fetch-e2e-tat-"));
-  const githubOutput = path.join(tmpDir, "github-output");
-  const env = {
-    ...process.env,
-    LARKSUITE_CLI_APP_ID: "test_app_id",
-    TEST_BOT1_APP_SECRET: "test-secret",
-    RUNNER_TEMP: tmpDir,
-    GITHUB_OUTPUT: githubOutput,
-    E2E_TAT_RETRY_BASE_MS: "10",
-    ...envOverrides,
-  };
-
-  return new Promise((resolve) => {
-    const child = spawn(process.execPath, [scriptPath], {
-      cwd: path.join(__dirname, ".."),
-      env,
-    });
-
-    let stdout = "";
-    let stderr = "";
-    child.stdout.on("data", (data) => {
-      stdout += data;
-    });
-    child.stderr.on("data", (data) => {
-      stderr += data;
-    });
-    child.on("close", (code) => {
-      const output = fs.existsSync(githubOutput)
-        ? fs.readFileSync(githubOutput, "utf8")
-        : "";
-      resolve({ tmpDir, stdout, stderr, output, exitCode: code });
-    });
-  });
-}
-
-test("encodeForm encodes form parameters", () => {
-  const { encodeForm } = require(scriptPath);
-  const result = encodeForm({
-    grant_type: "client_credentials",
-    client_id: "abc&def",
-    client_secret: "test-secret",
-    note: "x=y",
-  });
-  const params = new URLSearchParams(result);
-  assert.equal(params.get("grant_type"), "client_credentials");
-  assert.equal(params.get("client_id"), "abc&def");
-  assert.equal(params.get("client_secret"), "test-secret");
-  assert.equal(params.get("note"), "x=y");
-});
-
-test("exits with error when app id is missing", async () => {
-  const result = await runScript({ LARKSUITE_CLI_APP_ID: "" });
-  assert.notEqual(result.exitCode, 0);
-  assert.match(result.stderr, /Missing required environment variable: LARKSUITE_CLI_APP_ID/);
-});
-
-test("exits with error when app secret is missing", async () => {
-  const result = await runScript({ TEST_BOT1_APP_SECRET: "" });
-  assert.notEqual(result.exitCode, 0);
-  assert.match(result.stderr, /Missing required environment variable: TEST_BOT1_APP_SECRET/);
-});
-
-test("fetches token and writes it to a private file", async () => {
-  const { server, port } = await startServer((req, res, body) => {
-    assert.equal(req.method, "POST");
-    const params = new URLSearchParams(body);
-    assert.equal(params.get("grant_type"), "client_credentials");
-    assert.equal(params.get("client_id"), "test_app_id");
-    assert.equal(params.get("client_secret"), "test-secret");
-    res.writeHead(200, { "Content-Type": "application/json" });
-    res.end(JSON.stringify({ code: 0, access_token: "test-token" }));
-  });
-
-  try {
-    const result = await runScript({
-      E2E_TAT_ENDPOINT: `http://127.0.0.1:${port}/token`,
-    });
-
-    assert.equal(result.exitCode, 0, `stderr: ${result.stderr}`);
-    assert.ok(result.stdout.includes("::add-mask::test-token"));
-    assert.ok(result.stdout.includes("Prepared shared live E2E tenant token"));
-
-    const tatPath = path.join(result.tmpDir, "e2e-live-tat");
-    assert.ok(fs.existsSync(tatPath), "token file should exist");
-
-    const stat = fs.statSync(tatPath);
-    assert.equal(stat.mode & 0o777, 0o600, "token file should be owner-only");
-    assert.equal(fs.readFileSync(tatPath, "utf8"), "test-token");
-
-    assert.ok(
-      result.output.includes(`path=${tatPath}`),
-      "should write path to GITHUB_OUTPUT",
-    );
-  } finally {
-    server.close();
-  }
-});
-
-test("retries an interrupted response and then succeeds", async () => {
-  let requestCount = 0;
-  const { server, port } = await startServer((req, res) => {
-    requestCount++;
-    if (requestCount === 1) {
-      abortResponse(res);
-      return;
-    }
-    res.writeHead(200, { "Content-Type": "application/json" });
-    res.end(JSON.stringify({ code: 0, access_token: "test-token" }));
-  });
-
-  try {
-    const result = await runScript({
-      E2E_TAT_ENDPOINT: `http://127.0.0.1:${port}/token`,
-    });
-
-    assert.equal(result.exitCode, 0, `stderr: ${result.stderr}`);
-    assert.equal(requestCount, 2);
-  } finally {
-    server.close();
-  }
-});
-
-test("fails after every interrupted response is retried", async () => {
-  let requestCount = 0;
-  const { server, port } = await startServer((req, res) => {
-    requestCount++;
-    abortResponse(res);
-  });
-
-  try {
-    const result = await runScript({
-      E2E_TAT_ENDPOINT: `http://127.0.0.1:${port}/token`,
-    });
-
-    assert.notEqual(result.exitCode, 0);
-    assert.equal(requestCount, 4);
-    assert.match(result.stderr, /Failed to fetch tenant access token/);
-  } finally {
-    server.close();
-  }
-});
-
-test("exits with error after all retries fail", async () => {
-  let requestCount = 0;
-  const { server, port } = await startServer((req, res) => {
-    requestCount++;
-    res.writeHead(500, { "Content-Type": "application/json" });
-    res.end(JSON.stringify({ code: 500, error: "server error" }));
-  });
-
-  try {
-    const result = await runScript({
-      E2E_TAT_ENDPOINT: `http://127.0.0.1:${port}/token`,
-    });
-
-    assert.notEqual(result.exitCode, 0);
-    assert.equal(requestCount, 4);
-    assert.match(result.stderr, /Failed to fetch tenant access token/);
-  } finally {
-    server.close();
-  }
-});

shortcuts/apps/apps_automation_skill_contract_test.go

@@ -1,469 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-package apps
-
-import (
-	"os"
-	"path/filepath"
-	"regexp"
-	"strings"
-	"testing"
-)
-
-const automationSkillDoc = "../../skills/lark-apps/references/lark-apps-automation.md"
-const localDevSkillDoc = "../../skills/lark-apps/references/lark-apps-local-dev.md"
-const larkAppsSkillDoc = "../../skills/lark-apps/SKILL.md"
-const releaseGetSkillDoc = "../../skills/lark-apps/references/lark-apps-release-get.md"
-
-func readAutomationSkillDoc(t *testing.T) string {
-	return readAppsSkillDoc(t, automationSkillDoc)
-}
-
-func readLocalDevSkillDoc(t *testing.T) string {
-	return readAppsSkillDoc(t, localDevSkillDoc)
-}
-
-func readReleaseGetSkillDoc(t *testing.T) string {
-	return readAppsSkillDoc(t, releaseGetSkillDoc)
-}
-
-func readAppsSkillDoc(t *testing.T, path string) string {
-	t.Helper()
-	raw, err := os.ReadFile(path)
-	if err != nil {
-		t.Fatalf("read skill doc %s: %v", path, err)
-	}
-	return string(raw)
-}
-
-func skillSection(t *testing.T, doc, heading string) string {
-	t.Helper()
-	start := strings.Index(doc, heading)
-	if start < 0 {
-		t.Fatalf("missing skill section %q", heading)
-	}
-	rest := doc[start+len(heading):]
-	if next := strings.Index(rest, "\n## "); next >= 0 {
-		return rest[:next]
-	}
-	return rest
-}
-
-func skillSubsection(t *testing.T, doc, heading string) string {
-	t.Helper()
-	start := strings.Index(doc, heading)
-	if start < 0 {
-		t.Fatalf("missing skill subsection %q", heading)
-	}
-	rest := doc[start+len(heading):]
-	end := len(rest)
-	for _, marker := range []string{"\n### ", "\n## "} {
-		if next := strings.Index(rest, marker); next >= 0 && next < end {
-			end = next
-		}
-	}
-	return rest[:end]
-}
-
-func requireInOrder(t *testing.T, text string, tokens ...string) {
-	t.Helper()
-	offset := 0
-	for _, token := range tokens {
-		idx := strings.Index(text[offset:], token)
-		if idx < 0 {
-			t.Fatalf("missing %q after %q", token, text[:offset])
-		}
-		offset += idx + len(token)
-	}
-}
-
-func requireFirstOccurrencesInOrder(t *testing.T, text string, tokens ...string) {
-	t.Helper()
-	previous := -1
-	for _, token := range tokens {
-		idx := strings.Index(text, token)
-		if idx < 0 {
-			t.Fatalf("missing %q", token)
-		}
-		if idx <= previous {
-			t.Fatalf("first %q at %d must follow the previous contract token at %d", token, idx, previous)
-		}
-		previous = idx
-	}
-}
-
-func TestAutomationSkillContract_ChangedHandlerStartWaitsForThisRelease(t *testing.T) {
-	section := skillSubsection(t, readAutomationSkillDoc(t), "### 实现或更新 handler 后发布并启动/测试")
-
-	requireInOrder(t, section,
-		"仅当本轮确实需要新增或修改 cron、webhook、record-change 的 `INSERT`、`UPDATE`、`DELETE` handler",
-		"+automation-get",
-		"记录发布前状态",
-		"--name",
-		"项目 guide",
-		"按项目 guide 完成同名业务 handler 并本地验证。",
-		"在 Git 已确认/预授权时 commit，然后执行",
-		"git push origin sprint/default",
-		"临时停用授权",
-		"+automation-disable",
-		"确认 disabled",
-		"+release-create --branch sprint/default",
-		"data.release_id",
-		"+release-get",
-		"data.status=finished",
-		"仅启动",
-		"+automation-enable",
-		"+automation-get",
-		"不制造 runtime probe",
-		"测试",
-		"运行时验证的操作级授权",
-		"完成全部 preflight",
-		"才执行 `+automation-enable`",
-		"真实 runtime",
-		"仅要求测试",
-		"恢复到发布前状态",
-	)
-	requireFirstOccurrencesInOrder(t, section,
-		"+automation-get",
-		"git push origin sprint/default",
-		"临时停用授权",
-		"+automation-disable",
-		"+release-create --branch sprint/default",
-		"data.status=finished",
-		"仅启动",
-	)
-	for _, boundary := range []string{
-		"仅当本轮确实需要新增或修改 cron、webhook、record-change 的 `INSERT`、`UPDATE`、`DELETE` handler，且用户要求把这次代码发布后启动或测试时，才使用此路径。",
-		"按项目 guide 完成同名业务 handler 并本地验证。",
-		"在 Git 已确认/预授权时 commit，然后执行 `git push origin sprint/default`。",
-		"若该命令本身返回错误或未返回 `data.release_id`：视为确认未创建本轮 release（新代码未上线），原本 enabled 的 trigger 恢复 enabled 并回读、原本 disabled 的保持 disabled 后停止；若因超时等导致结果未知，保持 disabled，先用 `+release-list --status finished --page-size 1` 核对是否已产生新 release 再决定。",
-		"只有 `data.status=finished` 才能继续；`publishing` 时每 20 秒继续轮询，整体最多约 5 分钟。",
-		"确认 `failed` 时报告发布失败，原本 enabled 的 trigger 仅在确认新代码未上线后恢复 enabled，原本 disabled 的保持 disabled。",
-		"发布状态仍不确定时不得进入 enable、probe 或状态恢复分支。",
-		"**仅启动**：取得持续启动授权后执行 `+automation-enable`，并用 `+automation-get` 确认 enabled；到此结束，不制造 runtime probe。",
-		"**测试（含“启动并测试”）**：先按下节“运行时验证的操作级授权”完成全部 preflight",
-		"若用户仅要求测试而不是持续启动，只在本轮 release 已 `finished` 且 probe 成功后恢复到发布前状态",
-		"无论用户是仅测试还是启动并测试，probe 失败、结果不确定或 enable 后提前结束时，一律 `+automation-disable` 并回读 disabled",
-		"不得把“发布前 enabled”当作失败后的恢复依据",
-		"没有通用的 `automation-debug` 或 trigger 日志 shortcut。",
-	} {
-		if !strings.Contains(section, boundary) {
-			t.Errorf("complete-start section must explain %q boundary", boundary)
-		}
-	}
-}
-
-func TestAutomationSkillContract_BindsTheExactNameAsUser(t *testing.T) {
-	doc := readAutomationSkillDoc(t)
-	for _, boundary := range []string{
-		"全部操作需 `--as user`（AuthType: user）。",
-		"当用户希望触发器实际执行业务代码时，先确认当前工作区是已初始化的应用项目，并读取其中与触发器任务匹配的 guide。",
-		"`--name` 是应用内唯一的 trigger 定位键；代码侧绑定名称必须与它逐字相同。不得用 trigger ID 或方法名代替它。具体 handler 语法和接入方式以项目 guide 为准。",
-	} {
-		if !strings.Contains(doc, boundary) {
-			t.Errorf("automation skill must preserve %q", boundary)
-		}
-	}
-}
-
-func TestAutomationSkillContract_RoutesAndDiagnosesUnfiredTriggers(t *testing.T) {
-	doc := readAutomationSkillDoc(t)
-	routeSection := skillSection(t, doc, "## 何时用本 skill（路由锚点）")
-	errorSection := skillSection(t, doc, "## 常见错误与决策场景")
-
-	if !strings.Contains(routeSection, "「触发器没反应 / enable 了不触发 / 为什么没执行 / 验证一下触发器」→ 先按「未触发时的诊断顺序」诊断；对 UPSERT 和 feishu-approval 仅验证配置边界，不承诺 handler 或 live 验证。") {
-		t.Error("routing anchors must direct unfired triggers to the bounded diagnostic flow")
-	}
-	if !strings.Contains(errorSection, "已证实的 cron、webhook、record-change（INSERT/UPDATE/DELETE）按「未触发时的诊断顺序」排查；UPSERT 和 feishu-approval 仅核对配置边界，不承诺 handler 或 live 验证。") {
-		t.Error("error table must preserve the bounded unfired-trigger diagnostic flow")
-	}
-}
-
-func TestAutomationSkillContract_ConfigurationStopsDisabled(t *testing.T) {
-	section := skillSubsection(t, readAutomationSkillDoc(t), "### 仅创建/配置触发器")
-
-	for _, boundary := range []string{
-		"用 `+automation-create` 创建，并省略 `--status` 或显式传 `disabled`，然后报告 name 和 disabled 状态。",
-		"不要传 `--status enabled`，也不要写 handler、commit/push、release 或 enable；更不能把创建 API 成功称为“可运行”。",
-		"默认 disabled 是这个意图的终点，不是稍后自动 enable 的待办。",
-	} {
-		if !strings.Contains(section, boundary) {
-			t.Errorf("configuration-only section must preserve %q", boundary)
-		}
-	}
-}
-
-func TestAutomationSkillContract_EnableExistingTriggerDoesNotPublish(t *testing.T) {
-	doc := readAutomationSkillDoc(t)
-	section := skillSubsection(t, doc, "### 仅启用已有 disabled trigger")
-	routeSection := skillSection(t, doc, "## 何时用本 skill（路由锚点）")
-
-	requireInOrder(t, section,
-		"用户只要求启用已存在且 disabled 的 trigger",
-		"+automation-get",
-		"+release-list --status finished --page-size 1",
-		"已完成线上 release",
-		"当前线上应用",
-		"不能证明该 trigger name 已绑定 handler",
-		"+automation-enable",
-		"+automation-get",
-		"不得修改 handler、commit/push 或 release",
-		"对 UPSERT 或 feishu-approval 只改变配置状态",
-	)
-	if !strings.Contains(section, "未发布时不得自动创建 release，也不得声称 trigger 已开始实际运行") {
-		t.Error("enable-only flow must distinguish configuration enablement from a published runtime")
-	}
-	if !strings.Contains(section, "即使存在 finished release，也只能把 enable 报告为配置激活") {
-		t.Error("enable-only flow must not infer handler provenance from app release history")
-	}
-	if strings.Contains(section, "apps +get") || strings.Contains(section, "`is_published`") {
-		t.Error("enable-only flow must use finished release history instead of an optional app detail field")
-	}
-	for _, forbidden := range []string{"git push", "+release-create"} {
-		if strings.Contains(section, forbidden) {
-			t.Errorf("enable-only flow must not contain %q", forbidden)
-		}
-	}
-	if !strings.Contains(routeSection, "「启用 / 启动已有 trigger」→ 先核对现有状态；只启用时不要修改源码或发布应用。") {
-		t.Error("routing anchors must keep existing-trigger enablement separate from code release")
-	}
-}
-
-func TestAutomationSkillContract_TestExistingTriggerDoesNotPublish(t *testing.T) {
-	section := skillSubsection(t, readAutomationSkillDoc(t), "### 测试已有线上 trigger（不改代码）")
-
-	requireInOrder(t, section,
-		"用户要求测试已经发布的 trigger",
-		"+automation-get",
-		"+release-list --status finished --page-size 1",
-		"当前线上代码",
-		"不得为测试自动修改源码、commit/push 或 release",
-		"在任何临时 enable 之前完成",
-		"测试请求已明确包含临时 enable，或另行取得 enable 授权",
-		"运行时验证的操作级授权",
-		"无论 probe 成功、失败、结果不确定，还是临时 enable 后提前结束或中断，最终都必须 `+automation-disable` 并回读 disabled",
-	)
-	for _, forbidden := range []string{"git push", "+release-create"} {
-		if strings.Contains(section, forbidden) {
-			t.Errorf("existing-trigger test flow must not contain %q", forbidden)
-		}
-	}
-}
-
-func TestAutomationSkillContract_HandlerOnlyStopsBeforeRelease(t *testing.T) {
-	section := skillSubsection(t, readAutomationSkillDoc(t), "### 仅完成 handler（不发布/不启用）")
-
-	for _, boundary := range []string{
-		"创建或定位已明确 name 的 disabled trigger，读取项目 guide，按其要求实现同名业务 handler，完成本地验证。",
-		"只在既有 Git 确认或预授权下 commit/push；停止在 `+release-create` 和 `+automation-enable` 之前。",
-		"用户没有明确“发布好”时，先问，不能默认把完整应用上线。",
-	} {
-		if !strings.Contains(section, boundary) {
-			t.Errorf("handler-only section must preserve %q", boundary)
-		}
-	}
-}
-
-func TestAutomationSkillContract_HandlerOnlyExcludesUnverifiedRuntimeTypes(t *testing.T) {
-	section := skillSubsection(t, readAutomationSkillDoc(t), "### 仅完成 handler（不发布/不启用）")
-
-	if !strings.Contains(section, "仅对 cron、webhook、record-change 的 `INSERT`、`UPDATE`、`DELETE` 使用此路径。") {
-		t.Error("handler-only flow must exclude UPSERT and feishu-approval without a verified runtime contract")
-	}
-}
-
-func TestAutomationSkillContract_PublishedHandlerStaysDisabled(t *testing.T) {
-	section := skillSubsection(t, readAutomationSkillDoc(t), "### 把 handler 发布好，但先不要启动")
-
-	for _, boundary := range []string{
-		"仅对 cron、webhook、record-change 的 `INSERT`、`UPDATE`、`DELETE` 使用此路径。",
-		"先用 `+automation-get` 定位；不存在时用 `+automation-create` 创建同名 disabled trigger，再次回读确认。",
-		"已存在时记录它是否 enabled。",
-		"若 trigger 已 enabled，先说明发布前必须临时停用以及可能造成的运行中断，并取得这次临时停用授权；未获授权时停止在发布前。",
-		"取得授权后，在发布前执行 `+automation-disable`，并再次用 `+automation-get` 确认 disabled。",
-		"按项目 guide 完成同名业务 handler 并本地验证后，commit、`git push origin sprint/default`。",
-		"随后发布完整应用：",
-		"若 `+release-create` 本身返回错误或未返回 `data.release_id`：视为确认未创建本轮 release（新代码未上线），原本 enabled 的 trigger 恢复 enabled 并回读、原本 disabled 的保持 disabled，然后停止；若因超时等导致创建结果未知，保持 disabled，先用 `+release-list --status finished --page-size 1` 核对是否已产生新 release 再决定。",
-		"取得 `data.release_id` 后，对**这一轮** ID 调用 `+release-get`：`publishing` 时每 20 秒继续轮询，整体最多约 5 分钟；超时且状态仍不确定时报告 `release_id` 和当前 status，并保持 disabled；只有 `data.status=finished` 才算完成。",
-		"确认 `failed` 且新代码未上线时，原本 enabled 的 trigger 恢复 enabled 并回读，原本 disabled 的保持 disabled。",
-		"release 是整个应用上线，可能影响既有线上功能；未获得启动或测试授权时，finished 后始终保持 disabled，不执行 `+automation-enable`。",
-	} {
-		if !strings.Contains(section, boundary) {
-			t.Errorf("publish-without-start section must preserve %q", boundary)
-		}
-	}
-	requireFirstOccurrencesInOrder(t, section,
-		"+automation-get",
-		"git push origin sprint/default",
-		"临时停用授权",
-		"+automation-disable",
-		"+release-create",
-	)
-}
-
-func TestAutomationSkillContract_UPSERTAndApprovalStayConfigurationOnly(t *testing.T) {
-	section := skillSubsection(t, readAutomationSkillDoc(t), "### UPSERT 与飞书审批边界")
-
-	for _, boundary := range []string{
-		"record-change 的 UPSERT 可创建 disabled 配置，但当前没有已证实的运行时代码契约；不得静默按 UPDATE 处理，也不得承诺 handler 或 live 验证。",
-		"feishu-approval 可创建 disabled 配置，并读取或更新 `event_type`、对应 status 和可选 `approval_code`。",
-		"当前没有已证实的运行时 handler 契约或实际投递验证；不要把 enable 或审批 API 成功称为业务代码已执行。",
-	} {
-		if !strings.Contains(section, boundary) {
-			t.Errorf("UPSERT/approval boundary section must preserve %q", boundary)
-		}
-	}
-}
-
-func TestAutomationSkillContract_RuntimeProbeRequiresOperationScope(t *testing.T) {
-	section := skillSubsection(t, readAutomationSkillDoc(t), "### 运行时验证的操作级授权")
-
-	for _, boundary := range []string{
-		"启用 trigger 的授权不等于制造 runtime 事件的授权，测试授权也不等于任意数据库写入授权。",
-		"record-change 在执行任何 DML 前，必须明确并取得覆盖以下作用域的授权",
-		"环境、表、操作、精确测试记录或筛选条件、payload、预期结果和清理方式",
-		"优先使用专用测试记录",
-		"`DELETE`",
-		"[lark-apps-db-execute.md](lark-apps-db-execute.md)",
-		"先 `SELECT count(*)`、执行 `--dry-run`",
-		"取得针对该删除目标的明确授权",
-		"+automation-list --trigger-type record-change --all",
-		"同一环境、表和操作可能命中的其他 enabled trigger",
-		"聚合业务影响",
-		"恢复 UPDATE 或清理 INSERT 也可能再次触发自动化",
-		"缺少安全、已授权且可清理的事件入口时，记录 blocked",
-	} {
-		if !strings.Contains(section, boundary) {
-			t.Errorf("runtime probe section must preserve %q", boundary)
-		}
-	}
-}
-
-func TestAutomationSkillContract_UsesResolvableSharedSkillLink(t *testing.T) {
-	doc := readAutomationSkillDoc(t)
-
-	if strings.Contains(doc, "](../lark-shared/SKILL.md)") {
-		t.Error("automation reference must not resolve lark-shared inside the lark-apps directory")
-	}
-	if !strings.Contains(doc, "](../../lark-shared/SKILL.md)") {
-		t.Error("automation reference must link to the sibling lark-shared skill")
-	}
-	sharedSkillDoc := filepath.Clean(filepath.Join(filepath.Dir(automationSkillDoc), "../../lark-shared/SKILL.md"))
-	if _, err := os.Stat(sharedSkillDoc); err != nil {
-		t.Fatalf("automation reference target %s must exist: %v", sharedSkillDoc, err)
-	}
-}
-
-func TestAppsSkillContract_AllSharedSkillLinksResolve(t *testing.T) {
-	docs := []string{larkAppsSkillDoc}
-	references, err := filepath.Glob("../../skills/lark-apps/references/*.md")
-	if err != nil {
-		t.Fatalf("glob lark-apps references: %v", err)
-	}
-	docs = append(docs, references...)
-	sharedLink := regexp.MustCompile(`\]\(([^)]+lark-shared/SKILL\.md)\)`)
-
-	for _, docPath := range docs {
-		doc := readAppsSkillDoc(t, docPath)
-		for _, match := range sharedLink.FindAllStringSubmatch(doc, -1) {
-			target := filepath.Clean(filepath.Join(filepath.Dir(docPath), match[1]))
-			if _, err := os.Stat(target); err != nil {
-				t.Errorf("%s shared-skill link %q resolves to missing target %s: %v", docPath, match[1], target, err)
-			}
-		}
-	}
-}
-
-func TestLocalDevSkillContract_UsesProjectGuideWithoutSyncInternals(t *testing.T) {
-	section := skillSection(t, readLocalDevSkillDoc(t), "## Trigger guide 的项目边界")
-
-	for _, boundary := range []string{
-		"先查看工作区 `.agents/skills/`，读取与自动化任务匹配的 `trigger-guide`。",
-		"文件缺失或不能覆盖当前任务时，报告项目缺少可用的领域 guide；不要在本 lark-cli reference 中猜测安装命令、版本或包内目录。",
-	} {
-		if !strings.Contains(section, boundary) {
-			t.Errorf("trigger-guide boundary section must explain %q", boundary)
-		}
-	}
-	for _, implementationShape := range []string{
-		"npx ", "skills sync", "data.", "skills_", "_CACHE_DIR", "nestjs-",
-		"@lark-apaas/miaoda-cli", "@lark-apaas/coding-steering", "miaoda-coding", "skills_common/",
-	} {
-		if strings.Contains(section, implementationShape) {
-			t.Errorf("local-dev skill must not expose project-sync implementation shape %q", implementationShape)
-		}
-	}
-}
-
-func TestAppsSkillContract_DoesNotExposeSteeringImplementation(t *testing.T) {
-	for name, doc := range map[string]string{
-		"automation": readAutomationSkillDoc(t),
-		"local-dev":  readLocalDevSkillDoc(t),
-	} {
-		for _, implementationShape := range []string{
-			"npx ", "skills sync", "@lark-apaas/miaoda-cli", "@lark-apaas/coding-steering", "miaoda-coding", "skills_common/",
-		} {
-			if strings.Contains(doc, implementationShape) {
-				t.Errorf("%s skill must not expose project-sync implementation shape %q", name, implementationShape)
-			}
-		}
-	}
-}
-
-func TestLocalDevSkillContract_UsesEnvironmentAndDefersEnableToAutomationSOP(t *testing.T) {
-	doc := readLocalDevSkillDoc(t)
-	releaseSection := skillSection(t, doc, "## 改完代码后部署上线")
-	for _, legacy := range []string{"--env dev", "--env online"} {
-		if strings.Contains(doc, legacy) {
-			t.Errorf("local-dev skill must not recommend legacy %q", legacy)
-		}
-	}
-	for _, boundary := range []string{
-		"`publishing` 时每 20 秒继续轮询，整体最多约 5 分钟；超时仍未完成时停止本轮轮询、报告 `release_id` 和当前 status。",
-		"若本次改动包含自动化 handler，在执行本节通用 commit/push/release 序列前就转到 [automation SOP](lark-apps-automation.md) 的匹配路径，由该 SOP 负责完整的状态门禁、commit/push、release 和可选 enable/test；不要先按本节发布再补 trigger 状态检查。",
-		"用户只要求启用已有 trigger 时，转到 [automation SOP 的「仅启用已有 disabled trigger」路径](lark-apps-automation.md#仅启用已有-disabled-trigger)；不得因 enable 反向修改 handler、commit/push 或 release。",
-		"使用 `--environment dev|online`，不要使用旧的 `--env`。只有确认应用已开启多环境时才引导 `--environment dev`；单环境应用省略 `--environment`（服务端选 online）或显式传 `--environment online`。",
-	} {
-		if !strings.Contains(doc, boundary) {
-			t.Errorf("local-dev skill must preserve %q", boundary)
-		}
-	}
-	routeIndex := strings.Index(releaseSection, "若本次改动包含自动化 handler")
-	releaseIndex := strings.Index(releaseSection, "+release-create")
-	if routeIndex < 0 || releaseIndex < 0 || routeIndex >= releaseIndex {
-		t.Error("automation routing must appear before the generic release sequence")
-	}
-}
-
-func TestLocalDevSkillContract_DoesNotRequireOnlineURL(t *testing.T) {
-	section := skillSection(t, readLocalDevSkillDoc(t), "## 改完代码后部署上线")
-
-	if strings.Contains(section, "`finished` 成功时该命令输出已含 `online_url`") {
-		t.Error("release guidance must not claim every finished release includes online_url")
-	}
-	if !strings.Contains(section, "若返回 `online_url`，可直接使用；未返回时不要编造链接。") {
-		t.Error("release guidance must explain that online_url is optional")
-	}
-}
-
-func TestLocalDevSkillContract_TreatsErrorLogsAsOptional(t *testing.T) {
-	section := skillSection(t, readLocalDevSkillDoc(t), "## 改完代码后部署上线")
-
-	if !strings.Contains(section, "`failed` 时若返回非空 `error_logs`，据此给出失败原因；否则只报告 `release_id` 和当前 status，不要编造原因") {
-		t.Error("release guidance must not promise error_logs on every failed release")
-	}
-}
-
-func TestReleaseSkillContract_TreatsOptionalOutputAsOptional(t *testing.T) {
-	releaseGet := readReleaseGetSkillDoc(t)
-	for _, boundary := range []string{
-		"`finished` 后才可能有 `online_url`。",
-		"若输出含 `online_url`，直接读取它作为本轮发布的线上访问链接；未返回时只报告发布完成，不要编造链接。",
-		"若输出含 `error_logs`（`step`/`error_log`），据此向用户转述关键失败步骤和可行动修复；未返回时不要编造失败原因。",
-	} {
-		if !strings.Contains(releaseGet, boundary) {
-			t.Errorf("release-get skill must preserve optional-output boundary %q", boundary)
-		}
-	}
-}

shortcuts/apps/apps_errors.go

@@ -8,6 +8,7 @@ import (
 
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/extension/fileio"
+	"github.com/larksuite/cli/internal/client"
 )
 
 func appsValidationError(format string, args ...any) *errs.ValidationError {
@@ -73,3 +74,32 @@ func appsInputPathEntryError(path string, err error) error {
 func appsFileIOError(err error, format string, args ...any) *errs.InternalError {
 	return errs.NewInternalError(errs.SubtypeFileIO, format, args...).WithCause(err)
 }
+
+// enrichHTMLPublishAPIError adapts a typed failure from the HTML publish
+// endpoint: refines endpoint-scoped business codes, prefixes the message with
+// command context, and attaches endpoint-specific recovery hints. A
+// still-untyped error is lifted at the SDK boundary instead.
+func enrichHTMLPublishAPIError(err error) error {
+	if err == nil {
+		return nil
+	}
+	p, ok := errs.ProblemOf(err)
+	if !ok {
+		return client.WrapDoAPIError(err)
+	}
+	// The HTML publish business codes (90001/90002) are scoped to this
+	// endpoint, not service-global, so their subtype classification lives
+	// here instead of the global errclass code table. Only an
+	// otherwise-unclassified API error is refined; a stronger upstream
+	// classification is never overridden.
+	if p.Category == errs.CategoryAPI && p.Subtype == errs.SubtypeUnknown && p.Code == errCodeAppNotFound {
+		p.Subtype = errs.SubtypeNotFound
+	}
+	if p.Message != "" {
+		p.Message = "html-publish failed: " + p.Message
+	}
+	if hint := buildHTMLPublishFailureHint(p.Code); hint != "" {
+		p.Hint = hint
+	}
+	return err
+}

shortcuts/apps/apps_errors_test.go

@@ -57,3 +57,57 @@ func TestAppsFileIOError_ClassifiesInternalFileIO(t *testing.T) {
 		t.Fatalf("cause chain not preserved: %v", err)
 	}
 }
+
+func TestEnrichHTMLPublishAPIError_LiftsUntypedBoundaryError(t *testing.T) {
+	err := enrichHTMLPublishAPIError(errors.New("connection reset by peer"))
+
+	problem := requireAppsProblem(t, err, errs.CategoryNetwork)
+	if problem.Subtype != errs.SubtypeNetworkTransport {
+		t.Fatalf("subtype = %q, want %q", problem.Subtype, errs.SubtypeNetworkTransport)
+	}
+}
+
+func TestEnrichHTMLPublishAPIError_PreservesClassificationAndAddsHint(t *testing.T) {
+	err := errs.NewAPIError(errs.SubtypeUnknown, "build failed").
+		WithCode(errCodeBuildFailed).
+		WithLogID("logid-build-failed")
+
+	got := enrichHTMLPublishAPIError(err)
+	if got != err {
+		t.Fatalf("typed error should be enriched in place")
+	}
+	problem := requireAppsAPIProblem(t, got)
+	if problem.Subtype != errs.SubtypeUnknown {
+		t.Fatalf("subtype = %q, want %q unchanged", problem.Subtype, errs.SubtypeUnknown)
+	}
+	if problem.Code != errCodeBuildFailed {
+		t.Fatalf("code = %d, want %d", problem.Code, errCodeBuildFailed)
+	}
+	if problem.LogID != "logid-build-failed" {
+		t.Fatalf("log_id = %q, want preserved", problem.LogID)
+	}
+	if !strings.Contains(problem.Message, "html-publish failed") {
+		t.Fatalf("message = %q, want html-publish context", problem.Message)
+	}
+	if problem.Hint == "" {
+		t.Fatalf("expected known-code recovery hint")
+	}
+}
+
+func TestEnrichHTMLPublishAPIError_ClassifiesAppNotFoundLocally(t *testing.T) {
+	err := errs.NewAPIError(errs.SubtypeUnknown, "app not found").WithCode(errCodeAppNotFound)
+
+	problem := requireAppsAPIProblem(t, enrichHTMLPublishAPIError(err))
+	if problem.Subtype != errs.SubtypeNotFound {
+		t.Fatalf("subtype = %q, want %q", problem.Subtype, errs.SubtypeNotFound)
+	}
+}
+
+func TestEnrichHTMLPublishAPIError_KeepsStrongerClassification(t *testing.T) {
+	err := errs.NewAPIError(errs.SubtypeRateLimit, "throttled").WithCode(errCodeAppNotFound)
+
+	problem := requireAppsAPIProblem(t, enrichHTMLPublishAPIError(err))
+	if problem.Subtype != errs.SubtypeRateLimit {
+		t.Fatalf("subtype = %q, want %q unchanged", problem.Subtype, errs.SubtypeRateLimit)
+	}
+}

shortcuts/apps/apps_get.go

@@ -17,11 +17,10 @@ import (
 var AppsGet = common.Shortcut{
 	Service:     appsService,
 	Command:     "+get",
-	Description: "Get a single app's detail by app ID or meta token (returns app_type, name, description, publish status, etc.)",
+	Description: "Get a single app's detail by app ID (returns app_type, name, description, publish status, etc.)",
 	Risk:        "read",
 	Tips: []string{
 		"Example: lark-cli apps +get --app-id <app_id>",
-		"Example: lark-cli apps +get --app-id <meta_token>",
 		"Example: lark-cli apps +get --app-id <app_id> --dry-run",
 		"Tip: extract app type with --jq '.data.app.app_type'",
 	},
@@ -29,7 +28,7 @@ var AppsGet = common.Shortcut{
 	AuthTypes: []string{"user"},
 	HasFormat: true,
 	Flags: []common.Flag{
-		{Name: "app-id", Desc: "app ID or meta token", Required: true},
+		{Name: "app-id", Desc: "app ID", Required: true},
 	},
 	Validate: func(ctx context.Context, rctx *common.RuntimeContext) error {
 		if strings.TrimSpace(rctx.Str("app-id")) == "" {
@@ -41,7 +40,7 @@ var AppsGet = common.Shortcut{
 		appID := strings.TrimSpace(rctx.Str("app-id"))
 		return common.NewDryRunAPI().
 			GET(fmt.Sprintf("%s/apps/%s", apiBasePath, validate.EncodePathSegment(appID))).
-			Desc("Get app detail (returns app_id, meta_token, app_type, name, description, icon_url, created_at, updated_at, is_published)")
+			Desc("Get app detail (returns app_id, app_type, name, description, icon_url, created_at, updated_at, is_published)")
 	},
 	Execute: func(ctx context.Context, rctx *common.RuntimeContext) error {
 		appID := strings.TrimSpace(rctx.Str("app-id"))
@@ -55,9 +54,6 @@ var AppsGet = common.Shortcut{
 				return
 			}
 			fmt.Fprintf(w, "app_id: %v\n", app["app_id"])
-			if mt, ok := app["meta_token"].(string); ok && mt != "" {
-				fmt.Fprintf(w, "meta_token: %s\n", mt)
-			}
 			fmt.Fprintf(w, "app_type: %v\n", app["app_type"])
 			fmt.Fprintf(w, "name: %v\n", app["name"])
 			if desc, ok := app["description"].(string); ok && desc != "" {

shortcuts/apps/apps_html_publish.go

@@ -14,6 +14,7 @@ import (
 
 	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/extension/fileio"
+	"github.com/larksuite/cli/internal/client"
 	"github.com/larksuite/cli/internal/validate"
 	"github.com/larksuite/cli/shortcuts/common"
 )
@@ -37,13 +38,9 @@ var AppsHTMLPublish = common.Shortcut{
 		{Name: "allow-sensitive", Type: "bool", Desc: "skip the credential-file scan (allow .env / .npmrc / .aws/credentials / etc. in the publish payload)"},
 	},
 	Validate: func(ctx context.Context, rctx *common.RuntimeContext) error {
-		appID := strings.TrimSpace(rctx.Str("app-id"))
-		if appID == "" {
+		if strings.TrimSpace(rctx.Str("app-id")) == "" {
 			return appsValidationParamError("--app-id", "--app-id is required")
 		}
-		if err := validateRealAppID(appID); err != nil {
-			return err
-		}
 		path := strings.TrimSpace(rctx.Str("path"))
 		if path == "" {
 			return appsValidationParamError("--path", "--path is required")
@@ -76,11 +73,9 @@ var AppsHTMLPublish = common.Shortcut{
 		appID := strings.TrimSpace(rctx.Str("app-id"))
 		path := strings.TrimSpace(rctx.Str("path"))
 		dry := common.NewDryRunAPI()
-		dry.Desc("Pack tar.gz → GET pre_release for TOS upload URL → PUT tar.gz to TOS → POST release-create with tos_path; returns release_id")
-		dry.GET(fmt.Sprintf("%s/apps/%s/pre_release", apiBasePath, validate.EncodePathSegment(appID))).
-			PUT("<presigned_upload_url> (from pre_release response)").
-			POST(fmt.Sprintf(releaseCreatePath, validate.EncodePathSegment(appID))).
-			Body(map[string]string{"tos_path": "<from pre_release response>"})
+		dry.Desc("Pack tar.gz and publish HTML app (actual API path determined at runtime by app type; returns url or release_id)")
+		dry.POST(fmt.Sprintf("%s/apps/%s/upload_and_release_html_code", apiBasePath, validate.EncodePathSegment(appID))).
+			Set("content_type", "multipart/form-data")
 
 		candidates, err := walkHTMLPublishCandidates(rctx.FileIO(), path)
 		if err != nil {
@@ -128,7 +123,16 @@ var AppsHTMLPublish = common.Shortcut{
 			Path:  strings.TrimSpace(rctx.Str("path")),
 		}
 
-		out, err := runHTMLPublishTOS(ctx, rctx, spec)
+		appType := queryAppType(ctx, rctx, spec.AppID)
+
+		var out map[string]interface{}
+		var err error
+		if appType == "modern_html" {
+			out, err = runHTMLPublishTOS(ctx, rctx, spec)
+		} else {
+			client := appsHTMLPublishAPI{runtime: rctx}
+			out, err = runHTMLPublish(ctx, rctx.FileIO(), client, spec)
+		}
 		if err != nil {
 			return err
 		}
@@ -260,7 +264,25 @@ func prepareHTMLPublishTarball(fio fileio.FileIO, path string) (*htmlPublishTarb
 	return tarball, nil
 }
 
-// runHTMLPublishTOS handles the publish path: validate → tar.gz →
+func runHTMLPublish(ctx context.Context, fio fileio.FileIO, publisher appsHTMLPublishClient, spec appsHTMLPublishSpec) (map[string]interface{}, error) {
+	tarball, err := prepareHTMLPublishTarball(fio, spec.Path)
+	if err != nil {
+		return nil, err
+	}
+
+	resp, err := publisher.HTMLPublish(ctx, spec.AppID, tarball)
+	if err != nil {
+		return nil, client.WrapDoAPIError(err)
+	}
+
+	out := map[string]interface{}{}
+	if resp.URL != "" {
+		out["url"] = resp.URL
+	}
+	return out, nil
+}
+
+// runHTMLPublishTOS handles the modern_html publish path: validate → tar.gz →
 // call pre_release to get TOS upload URL → upload tar.gz to TOS → return
 // tos_path for +release-create --tos-path.
 func runHTMLPublishTOS(ctx context.Context, rctx *common.RuntimeContext, spec appsHTMLPublishSpec) (map[string]interface{}, error) {

shortcuts/apps/apps_html_publish_test.go

@@ -5,6 +5,7 @@ package apps
 
 import (
 	"context"
+	"errors"
 	"net/http"
 	"net/http/httptest"
 	"os"
@@ -22,6 +23,20 @@ import (
 	"github.com/larksuite/cli/shortcuts/common"
 )
 
+type fakeAppsHTMLPublishClient struct {
+	resp  *htmlPublishResponse
+	err   error
+	calls []string
+}
+
+func (f *fakeAppsHTMLPublishClient) HTMLPublish(ctx context.Context, appID string, tarball *htmlPublishTarball) (*htmlPublishResponse, error) {
+	f.calls = append(f.calls, appID)
+	if f.err != nil {
+		return nil, f.err
+	}
+	return f.resp, nil
+}
+
 func writeAppsSampleSite(t *testing.T) string {
 	t.Helper()
 	dir := t.TempDir()
@@ -31,19 +46,71 @@ func writeAppsSampleSite(t *testing.T) string {
 	return dir
 }
 
-func TestPrepareHTMLPublishTarball_PathNotFound(t *testing.T) {
-	_, err := prepareHTMLPublishTarball(newTestFIO(), "/nonexistent")
-	if err == nil {
-		t.Fatalf("expected error")
+func TestRunHTMLPublish_HappyPath(t *testing.T) {
+	site := writeAppsSampleSite(t)
+	fake := &fakeAppsHTMLPublishClient{
+		resp: &htmlPublishResponse{URL: "https://miaoda/app_x"},
+	}
+	out, err := runHTMLPublish(context.Background(), newTestFIO(), fake, appsHTMLPublishSpec{AppID: "app_x", Path: site})
+	if err != nil {
+		t.Fatalf("err=%v", err)
+	}
+	if out["url"] != "https://miaoda/app_x" {
+		t.Fatalf("url=%v", out["url"])
+	}
+	if len(fake.calls) != 1 || fake.calls[0] != "app_x" {
+		t.Fatalf("calls=%v", fake.calls)
 	}
 }
 
-func TestPrepareHTMLPublishTarball_DirRequiresIndexHTML(t *testing.T) {
+func TestRunHTMLPublish_OnlyURLInEnvelope(t *testing.T) {
+	// Pin 概要设计 §5.3 不变量 4 "同步语义不会变成异步" (legacy html path only):
+	// envelope 只含 url，未来若有人加 status / release_id 字段会被这个测试拦截。
+	site := writeAppsSampleSite(t)
+	fake := &fakeAppsHTMLPublishClient{
+		resp: &htmlPublishResponse{URL: "https://miaoda/app_x"},
+	}
+	out, err := runHTMLPublish(context.Background(), newTestFIO(), fake, appsHTMLPublishSpec{AppID: "app_x", Path: site})
+	if err != nil {
+		t.Fatalf("err=%v", err)
+	}
+	if len(out) != 1 {
+		t.Fatalf("envelope should only contain 'url', got %d keys: %v", len(out), out)
+	}
+	if _, ok := out["url"]; !ok {
+		t.Fatalf("envelope missing 'url': %v", out)
+	}
+}
+
+func TestRunHTMLPublish_ClientErrorPropagated(t *testing.T) {
+	site := writeAppsSampleSite(t)
+	wantErr := errors.New("server timeout")
+	fake := &fakeAppsHTMLPublishClient{err: wantErr}
+	_, err := runHTMLPublish(context.Background(), newTestFIO(), fake, appsHTMLPublishSpec{AppID: "app_x", Path: site})
+	if !errors.Is(err, wantErr) {
+		t.Fatalf("err=%v", err)
+	}
+}
+
+func TestRunHTMLPublish_PathNotFound(t *testing.T) {
+	fake := &fakeAppsHTMLPublishClient{}
+	_, err := runHTMLPublish(context.Background(), newTestFIO(), fake, appsHTMLPublishSpec{AppID: "app_x", Path: "/nonexistent"})
+	if err == nil {
+		t.Fatalf("expected error")
+	}
+	if len(fake.calls) != 0 {
+		t.Fatalf("client should not be called when path invalid")
+	}
+}
+
+func TestRunHTMLPublish_DirRequiresIndexHTML(t *testing.T) {
+	// 目录形态：缺 index.html 应该被拦
 	dir := t.TempDir()
 	if err := os.WriteFile(filepath.Join(dir, "foo.html"), []byte("<html></html>"), 0o644); err != nil {
 		t.Fatalf("write: %v", err)
 	}
-	_, err := prepareHTMLPublishTarball(newTestFIO(), dir)
+	fake := &fakeAppsHTMLPublishClient{}
+	_, err := runHTMLPublish(context.Background(), newTestFIO(), fake, appsHTMLPublishSpec{AppID: "app_x", Path: dir})
 	if err == nil {
 		t.Fatalf("expected error for missing index.html")
 	}
@@ -54,9 +121,13 @@ func TestPrepareHTMLPublishTarball_DirRequiresIndexHTML(t *testing.T) {
 	if problem.Hint == "" {
 		t.Fatalf("expected non-empty hint")
 	}
+	if len(fake.calls) != 0 {
+		t.Fatalf("client should not be called when index.html missing")
+	}
 }
 
-func TestPrepareHTMLPublishTarball_DirWithIndexHTMLPasses(t *testing.T) {
+func TestRunHTMLPublish_DirWithIndexHTMLPasses(t *testing.T) {
+	// 目录含 index.html 应该正常走完
 	dir := t.TempDir()
 	if err := os.WriteFile(filepath.Join(dir, "index.html"), []byte("<html></html>"), 0o644); err != nil {
 		t.Fatalf("write fixture: %v", err)
@@ -64,49 +135,57 @@ func TestPrepareHTMLPublishTarball_DirWithIndexHTMLPasses(t *testing.T) {
 	if err := os.WriteFile(filepath.Join(dir, "extra.html"), []byte("<html></html>"), 0o644); err != nil {
 		t.Fatalf("write fixture: %v", err)
 	}
-	tarball, err := prepareHTMLPublishTarball(newTestFIO(), dir)
-	if err != nil {
+	fake := &fakeAppsHTMLPublishClient{resp: &htmlPublishResponse{URL: "https://miaoda/app_x"}}
+	if _, err := runHTMLPublish(context.Background(), newTestFIO(), fake, appsHTMLPublishSpec{AppID: "app_x", Path: dir}); err != nil {
 		t.Fatalf("err=%v", err)
 	}
-	if tarball == nil || tarball.Size == 0 {
-		t.Fatalf("expected non-empty tarball")
+	if len(fake.calls) != 1 {
+		t.Fatalf("client should be called when index.html present")
 	}
 }
 
-func TestPrepareHTMLPublishTarball_SingleFileRejectedIfNotNamedIndex(t *testing.T) {
+func TestRunHTMLPublish_SingleFileRejectedIfNotNamedIndex(t *testing.T) {
+	// 单文件形态：文件名不是 index.html 也要拦
 	dir := t.TempDir()
 	single := filepath.Join(dir, "foo.html")
 	if err := os.WriteFile(single, []byte("<html></html>"), 0o644); err != nil {
 		t.Fatalf("write fixture: %v", err)
 	}
-	_, err := prepareHTMLPublishTarball(newTestFIO(), single)
+	fake := &fakeAppsHTMLPublishClient{}
+	_, err := runHTMLPublish(context.Background(), newTestFIO(), fake, appsHTMLPublishSpec{AppID: "app_x", Path: single})
 	if err == nil {
 		t.Fatalf("single-file path 'foo.html' should be rejected (not named index.html)")
 	}
 	requireAppsValidationProblem(t, err)
+	if len(fake.calls) != 0 {
+		t.Fatalf("client must not be called when index.html missing")
+	}
 }
 
-func TestPrepareHTMLPublishTarball_SingleFileNamedIndexPasses(t *testing.T) {
+func TestRunHTMLPublish_SingleFileNamedIndexPasses(t *testing.T) {
+	// 单文件形态：文件名恰好就是 index.html → 放行
 	dir := t.TempDir()
 	single := filepath.Join(dir, "index.html")
 	if err := os.WriteFile(single, []byte("<html></html>"), 0o644); err != nil {
 		t.Fatalf("write fixture: %v", err)
 	}
-	tarball, err := prepareHTMLPublishTarball(newTestFIO(), single)
-	if err != nil {
+	fake := &fakeAppsHTMLPublishClient{resp: &htmlPublishResponse{URL: "https://miaoda/app_x"}}
+	if _, err := runHTMLPublish(context.Background(), newTestFIO(), fake, appsHTMLPublishSpec{AppID: "app_x", Path: single}); err != nil {
 		t.Fatalf("err=%v", err)
 	}
-	if tarball == nil || tarball.Size == 0 {
-		t.Fatalf("expected non-empty tarball")
+	if len(fake.calls) != 1 {
+		t.Fatalf("client should be called for single index.html")
 	}
 }
 
-func TestPrepareHTMLPublishTarball_RejectsOversizeTarball(t *testing.T) {
+func TestRunHTMLPublish_RejectsOversizeTarball(t *testing.T) {
+	// 把上限调到 100 字节验证拦截，defer 恢复原值避免污染其它测试。
 	orig := maxHTMLPublishTarballBytes
 	maxHTMLPublishTarballBytes = 100
 	defer func() { maxHTMLPublishTarballBytes = orig }()
 
 	dir := t.TempDir()
+	// 写 index.html（满足新加的 index 校验）+ 大文件超 100 字节上限。
 	if err := os.WriteFile(filepath.Join(dir, "index.html"), []byte("<html></html>"), 0o644); err != nil {
 		t.Fatalf("write: %v", err)
 	}
@@ -115,7 +194,8 @@ func TestPrepareHTMLPublishTarball_RejectsOversizeTarball(t *testing.T) {
 		t.Fatalf("write: %v", err)
 	}
 
-	_, err := prepareHTMLPublishTarball(newTestFIO(), dir)
+	fake := &fakeAppsHTMLPublishClient{}
+	_, err := runHTMLPublish(context.Background(), newTestFIO(), fake, appsHTMLPublishSpec{AppID: "app_x", Path: dir})
 	if err == nil {
 		t.Fatalf("expected oversize error")
 	}
@@ -126,6 +206,9 @@ func TestPrepareHTMLPublishTarball_RejectsOversizeTarball(t *testing.T) {
 	if problem.Hint == "" {
 		t.Fatalf("expected non-empty hint")
 	}
+	if len(fake.calls) != 0 {
+		t.Fatalf("client should not be called when tarball oversize")
+	}
 }
 
 func TestMaxHTMLPublishTarballBytes_Default(t *testing.T) {
@@ -181,17 +264,8 @@ func TestAppsHTMLPublish_DryRunPrintsManifest(t *testing.T) {
 		t.Fatalf("dry-run err=%v", err)
 	}
 	got := stdout.String()
-	if !strings.Contains(got, "/open-apis/spark/v1/apps/app_x/pre_release") {
-		t.Fatalf("dry-run missing pre_release endpoint: %s", got)
-	}
-	if !strings.Contains(got, "presigned_upload_url") {
-		t.Fatalf("dry-run missing TOS PUT step: %s", got)
-	}
-	if !strings.Contains(got, "/open-apis/spark/v1/apps/app_x/releases") {
-		t.Fatalf("dry-run missing release-create endpoint: %s", got)
-	}
-	if !strings.Contains(got, "tos_path") {
-		t.Fatalf("dry-run missing tos_path in release-create body: %s", got)
+	if !strings.Contains(got, "/open-apis/spark/v1/apps/app_x/upload_and_release_html_code") {
+		t.Fatalf("dry-run missing endpoint: %s", got)
 	}
 	if !strings.Contains(got, "index.html") {
 		t.Fatalf("dry-run missing file list: %s", got)
@@ -426,7 +500,9 @@ func TestRunHTMLPublish_RejectsOversizeRawCandidates(t *testing.T) {
 		t.Fatalf("write: %v", err)
 	}
 
-	_, err := prepareHTMLPublishTarball(newTestFIO(), dir)
+	fake := &fakeAppsHTMLPublishClient{}
+	_, err := runHTMLPublish(context.Background(), newTestFIO(), fake,
+		appsHTMLPublishSpec{AppID: "app_x", Path: dir})
 	if err == nil {
 		t.Fatalf("expected raw-size cap to fire")
 	}
@@ -434,6 +510,9 @@ func TestRunHTMLPublish_RejectsOversizeRawCandidates(t *testing.T) {
 	if !strings.Contains(problem.Message, "raw") || !strings.Contains(problem.Message, "bytes") {
 		t.Fatalf("expected message to explain raw-byte cap, got %q", problem.Message)
 	}
+	if len(fake.calls) != 0 {
+		t.Fatalf("client must not be called when raw cap hit")
+	}
 }
 
 func TestOversizeHTMLFiles(t *testing.T) {
@@ -476,7 +555,8 @@ func TestRunHTMLPublish_RejectsOversizeHTMLFile(t *testing.T) {
 	if err := os.WriteFile(filepath.Join(dir, "big.html"), []byte(strings.Repeat("x", 4096)), 0o644); err != nil {
 		t.Fatalf("write: %v", err)
 	}
-	_, err := prepareHTMLPublishTarball(newTestFIO(), dir)
+	fake := &fakeAppsHTMLPublishClient{}
+	_, err := runHTMLPublish(context.Background(), newTestFIO(), fake, appsHTMLPublishSpec{AppID: "app_x", Path: dir})
 	if err == nil {
 		t.Fatalf("expected per-file oversize error")
 	}
@@ -487,9 +567,13 @@ func TestRunHTMLPublish_RejectsOversizeHTMLFile(t *testing.T) {
 	if problem.Hint == "" {
 		t.Fatalf("expected non-empty hint")
 	}
+	if len(fake.calls) != 0 {
+		t.Fatalf("client must not be called when an HTML file is oversize")
+	}
 }
 
-func TestPrepareHTMLPublishTarball_IgnoresOversizeNonHTML(t *testing.T) {
+func TestRunHTMLPublish_IgnoresOversizeNonHTML(t *testing.T) {
+	// 单 .html 上限调小，但超限文件是 .png → 不被本护栏拦截，正常发布。
 	orig := maxHTMLPublishSingleHTMLFileBytes
 	maxHTMLPublishSingleHTMLFileBytes = 100
 	defer func() { maxHTMLPublishSingleHTMLFileBytes = orig }()
@@ -501,12 +585,12 @@ func TestPrepareHTMLPublishTarball_IgnoresOversizeNonHTML(t *testing.T) {
 	if err := os.WriteFile(filepath.Join(dir, "big.png"), []byte(strings.Repeat("x", 4096)), 0o644); err != nil {
 		t.Fatalf("write: %v", err)
 	}
-	tarball, err := prepareHTMLPublishTarball(newTestFIO(), dir)
-	if err != nil {
+	fake := &fakeAppsHTMLPublishClient{resp: &htmlPublishResponse{URL: "https://miaoda/app_x"}}
+	if _, err := runHTMLPublish(context.Background(), newTestFIO(), fake, appsHTMLPublishSpec{AppID: "app_x", Path: dir}); err != nil {
 		t.Fatalf("non-html oversize must not be blocked by the .html cap: %v", err)
 	}
-	if tarball == nil || tarball.Size == 0 {
-		t.Fatalf("expected non-empty tarball")
+	if len(fake.calls) != 1 {
+		t.Fatalf("client should be called; calls=%v", fake.calls)
 	}
 }
 

shortcuts/apps/apps_init.go

@@ -74,18 +74,15 @@ type appTypePolicy struct {
 	// skipSkillsSync skips the conditional `npx ... skills sync --local` step on
 	// the non-empty (`app sync`) scaffold path.
 	skipSkillsSync bool
-	// skipAppSync skips `npx ... app sync` on the non-empty repo path.
-	skipAppSync bool
 }
 
 // appTypePolicies maps an app_type to its +init control strategy. Types absent
 // from the map get the zero-value policy (install runs, env is pulled, skills
 // are synced).
 var appTypePolicies = map[string]appTypePolicy{
-	// modern_html / html are static HTML sites: no dependencies to install,
-	// no startup env vars to pull, no steering skills to sync, and no app sync.
-	"modern_html": {skipInstall: true, skipEnvPull: true, skipSkillsSync: true, skipAppSync: true},
-	"html":        {skipInstall: true, skipEnvPull: true, skipSkillsSync: true, skipAppSync: true},
+	// modern_html is a static HTML site: no dependencies to install, no startup
+	// env vars to pull, and no steering skills to sync.
+	"modern_html": {skipInstall: true, skipEnvPull: true, skipSkillsSync: true},
 }
 
 // policyForAppType returns the +init control strategy for appType. Unlisted
@@ -125,13 +122,9 @@ var AppsInit = common.Shortcut{
 		{Name: "source-path", Desc: "path to existing source files (e.g. HTML output from an agent) to incorporate into the initialized project"},
 	},
 	Validate: func(ctx context.Context, rctx *common.RuntimeContext) error {
-		appID := strings.TrimSpace(rctx.Str("app-id"))
-		if appID == "" {
+		if strings.TrimSpace(rctx.Str("app-id")) == "" {
 			return appsValidationParamError("--app-id", "--app-id is required")
 		}
-		if err := validateRealAppID(appID); err != nil {
-			return err
-		}
 		if sp := strings.TrimSpace(rctx.Str("source-path")); sp != "" {
 			if err := charcheck.RejectControlChars(sp, "--source-path"); err != nil {
 				return appsValidationParamError("--source-path", "%v", err).WithCause(err)
@@ -341,19 +334,11 @@ func ensureMetaAppID(dir, appID string) error {
 // each is not already resolvable from local/global/system config, so a
 // developer's existing identity is never overwritten. Each key is handled
 // independently (a machine with only user.name set still gets a default email).
-func ensureGitIdentity(ctx context.Context, dir, authorName, authorEmail string) error {
-	name := strings.TrimSpace(authorName)
-	if name == "" {
-		name = defaultGitUserName
-	}
-	email := strings.TrimSpace(authorEmail)
-	if email == "" {
-		email = defaultGitUserEmail
-	}
-	if err := ensureGitConfigValue(ctx, dir, "user.name", name); err != nil {
+func ensureGitIdentity(ctx context.Context, dir string) error {
+	if err := ensureGitConfigValue(ctx, dir, "user.name", defaultGitUserName); err != nil {
 		return err
 	}
-	return ensureGitConfigValue(ctx, dir, "user.email", email)
+	return ensureGitConfigValue(ctx, dir, "user.email", defaultGitUserEmail)
 }
 
 // ensureGitConfigValue sets <key>=fallback in the repo-local git config when key
@@ -415,16 +400,13 @@ func runScaffold(ctx context.Context, dir, appID, appType, sourcePath string) (s
 		}
 		return scaffoldKindInit, nil
 	}
-	policy := policyForAppType(appType)
-	if !policy.skipAppSync {
-		if _, stderr, err := initRunner.Run(ctx, dir, "npx", "-y", "--prefer-online", "--registry", npmRegistry, miaodaCLIPkg, "app", "sync"); err != nil {
-			return "", appsExternalToolError(err, "npx app sync failed: %s", gitErr(stderr, err))
-		}
+	if _, stderr, err := initRunner.Run(ctx, dir, "npx", "-y", "--prefer-online", "--registry", npmRegistry, miaodaCLIPkg, "app", "sync"); err != nil {
+		return "", appsExternalToolError(err, "npx app sync failed: %s", gitErr(stderr, err))
 	}
 	if err := ensureMetaAppID(dir, appID); err != nil {
 		return "", err
 	}
-	if !policy.skipSkillsSync && !hasSteeringSkills(dir) {
+	if !policyForAppType(appType).skipSkillsSync && !hasSteeringSkills(dir) {
 		if _, stderr, err := initRunner.Run(ctx, dir, "npx", "-y", "--prefer-online", "--registry", npmRegistry, miaodaCLIPkg, "skills", "sync", "--local"); err != nil {
 			return "", appsExternalToolError(err, "npx skills sync failed: %s", gitErr(stderr, err))
 		}
@@ -454,38 +436,26 @@ func scaffoldInitArgs(appType, appID, sourcePath string) []string {
 	return base
 }
 
-// credentialInitResult holds the fields parsed from +git-credential-init output.
-type credentialInitResult struct {
-	RepositoryURL     string
-	CommitAuthorName  string
-	CommitAuthorEmail string
-}
-
-// parseCredentialInitEnvelope extracts fields from a +git-credential-init JSON
-// envelope ({"ok":true,"data":{"repository_url":"...","commit_author_name":"...","commit_author_email":"..."}}).
-func parseCredentialInitEnvelope(stdout string) (credentialInitResult, error) {
+// parseRepoURLFromEnvelope extracts data.repository_url from a lark-cli JSON
+// envelope ({"ok":true,"data":{"repository_url":"..."}}). The field name
+// matches the contract emitted by `apps +git-credential-init`.
+func parseRepoURLFromEnvelope(stdout string) (string, error) {
 	var env struct {
 		OK   bool `json:"ok"`
 		Data struct {
-			RepositoryURL     string `json:"repository_url"`
-			CommitAuthorName  string `json:"commit_author_name"`
-			CommitAuthorEmail string `json:"commit_author_email"`
+			RepositoryURL string `json:"repository_url"`
 		} `json:"data"`
 	}
 	if err := json.Unmarshal([]byte(stdout), &env); err != nil {
-		return credentialInitResult{}, appsSubprocessEnvelopeError("could not parse +git-credential-init output as JSON: %v", err)
+		return "", appsSubprocessEnvelopeError("could not parse +git-credential-init output as JSON: %v", err)
 	}
 	if !env.OK {
-		return credentialInitResult{}, appsSubprocessEnvelopeError("+git-credential-init reported failure")
+		return "", appsSubprocessEnvelopeError("+git-credential-init reported failure")
 	}
 	if strings.TrimSpace(env.Data.RepositoryURL) == "" {
-		return credentialInitResult{}, appsSubprocessEnvelopeError("+git-credential-init returned no repository_url")
+		return "", appsSubprocessEnvelopeError("+git-credential-init returned no repository_url")
 	}
-	return credentialInitResult{
-		RepositoryURL:     env.Data.RepositoryURL,
-		CommitAuthorName:  env.Data.CommitAuthorName,
-		CommitAuthorEmail: env.Data.CommitAuthorEmail,
-	}, nil
+	return env.Data.RepositoryURL, nil
 }
 
 // parseEnvFileFromEnvelope extracts data.env_file from a `+env-pull` success
@@ -557,10 +527,7 @@ func appsInitExecute(ctx context.Context, rctx *common.RuntimeContext) error {
 		return err
 	}
 
-	appType, err := queryAppType(ctx, rctx, appID)
-	if err != nil {
-		return err
-	}
+	appType := queryAppType(ctx, rctx, appID)
 	policy := policyForAppType(appType)
 
 	// Already-initialized short-circuit: a dir containing .spark/meta.json is an
@@ -628,16 +595,16 @@ func appsInitExecute(ctx context.Context, rctx *common.RuntimeContext) error {
 	}
 
 	initLogf(rctx, "Issuing repository credentials for %s...", appID)
-	cred, err := issueCredentials(ctx, rctx, appID)
+	repoURL, err := issueCredentials(ctx, rctx, appID)
 	if err != nil {
 		return err
 	}
-	if err := validateRepoURLScheme(cred.RepositoryURL); err != nil {
+	if err := validateRepoURLScheme(repoURL); err != nil {
 		return err
 	}
 
 	initLogf(rctx, "Cloning into %s...", dir)
-	if _, stderr, err := initRunner.Run(ctx, "", "git", "clone", "--", cred.RepositoryURL, dir); err != nil {
+	if _, stderr, err := initRunner.Run(ctx, "", "git", "clone", "--", repoURL, dir); err != nil {
 		return appsExternalToolError(err, "git clone failed: %s", gitErr(stderr, err))
 	}
 	initLogf(rctx, "Checking out %s...", defaultInitBranch)
@@ -645,10 +612,9 @@ func appsInitExecute(ctx context.Context, rctx *common.RuntimeContext) error {
 		return appsExternalToolError(err, "git checkout %s failed: %s", defaultInitBranch, gitErr(stderr, err))
 	}
 
-	// Ensure a committer identity exists before the scaffold commit. Uses the
-	// author name/email from +git-credential-init when available; falls back
-	// to lark-cli-bot defaults when the server does not provide them.
-	if err := ensureGitIdentity(ctx, dir, cred.CommitAuthorName, cred.CommitAuthorEmail); err != nil {
+	// Ensure a committer identity exists before the scaffold commit; only sets
+	// repo-local defaults when none is configured (existing identity is kept).
+	if err := ensureGitIdentity(ctx, dir); err != nil {
 		return err
 	}
 
@@ -677,7 +643,7 @@ func appsInitExecute(ctx context.Context, rctx *common.RuntimeContext) error {
 
 	out := map[string]interface{}{
 		"app_id":         appID,
-		"repository_url": redactURLCredentials(cred.RepositoryURL),
+		"repository_url": redactURLCredentials(repoURL),
 		"branch":         defaultInitBranch,
 		"clone_path":     dir,
 		"scaffold":       scaffold,
@@ -755,10 +721,10 @@ func pullEnv(ctx context.Context, rctx *common.RuntimeContext, appID, dir string
 
 // issueCredentials runs `<self> apps +git-credential-init --app-id <id> --format json`
 // and returns the repo_url it reports. Forwards --as when set.
-func issueCredentials(ctx context.Context, rctx *common.RuntimeContext, appID string) (credentialInitResult, error) {
+func issueCredentials(ctx context.Context, rctx *common.RuntimeContext, appID string) (string, error) {
 	self, err := os.Executable()
 	if err != nil {
-		return credentialInitResult{}, errs.NewInternalError(errs.SubtypeUnknown, "cannot locate lark-cli executable: %v", err).WithCause(err)
+		return "", errs.NewInternalError(errs.SubtypeUnknown, "cannot locate lark-cli executable: %v", err).WithCause(err)
 	}
 	args := []string{"apps", "+git-credential-init", "--app-id", appID, "--format", "json"}
 	if as := strings.TrimSpace(rctx.Str("as")); as != "" {
@@ -766,11 +732,11 @@ func issueCredentials(ctx context.Context, rctx *common.RuntimeContext, appID st
 	}
 	stdout, stderr, err := initRunner.Run(ctx, "", self, args...)
 	if err != nil {
-		return credentialInitResult{}, appsExternalToolError(err, "apps +git-credential-init failed: %s", gitErr(stderr, err)).
+		return "", appsExternalToolError(err, "apps +git-credential-init failed: %s", gitErr(stderr, err)).
 			WithHint("ensure apps +git-credential-init is available and you are logged in").
 			WithCause(err)
 	}
-	return parseCredentialInitEnvelope(stdout)
+	return parseRepoURLFromEnvelope(stdout)
 }
 
 // commitAndPushIfDirty commits and pushes only when the working tree has

shortcuts/apps/apps_init_test.go

@@ -21,7 +21,6 @@ import (
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/httpmock"
-	"github.com/larksuite/cli/internal/testutil/gitcmd"
 	"github.com/larksuite/cli/shortcuts/common"
 )
 
@@ -111,24 +110,18 @@ func TestDefaultCloneDir(t *testing.T) {
 // --- pure-function tests ---
 
 func TestParseRepoURL(t *testing.T) {
-	result, err := parseCredentialInitEnvelope(`{"ok":true,"data":{"repository_url":"http://u:t@h/app_x.git","commit_author_name":"Alice","commit_author_email":"alice@example.com"}}`)
+	url, err := parseRepoURLFromEnvelope(`{"ok":true,"data":{"repository_url":"http://u:t@h/app_x.git"}}`)
 	if err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
-	if result.RepositoryURL != "http://u:t@h/app_x.git" {
-		t.Errorf("RepositoryURL got %q", result.RepositoryURL)
-	}
-	if result.CommitAuthorName != "Alice" {
-		t.Errorf("CommitAuthorName got %q", result.CommitAuthorName)
-	}
-	if result.CommitAuthorEmail != "alice@example.com" {
-		t.Errorf("CommitAuthorEmail got %q", result.CommitAuthorEmail)
+	if url != "http://u:t@h/app_x.git" {
+		t.Errorf("got %q", url)
 	}
 }
 
 func TestParseRepoURL_Errors(t *testing.T) {
 	for _, in := range []string{`not json`, `{"ok":false,"data":{}}`, `{"ok":true,"data":{}}`, `{"ok":true,"data":{"repository_url":""}}`} {
-		if _, err := parseCredentialInitEnvelope(in); err == nil {
+		if _, err := parseRepoURLFromEnvelope(in); err == nil {
 			t.Errorf("expected error for %q", in)
 		}
 	}
@@ -156,22 +149,6 @@ func withFakeRunner(t *testing.T, f *fakeCommandRunner) {
 	t.Cleanup(func() { initRunner = orig })
 }
 
-func stubAppType(reg *httpmock.Registry, appID, appType string) {
-	reg.Register(&httpmock.Stub{
-		Method: "GET",
-		URL:    "/open-apis/spark/v1/apps/" + appID,
-		Body: map[string]interface{}{
-			"code": float64(0),
-			"data": map[string]interface{}{
-				"app": map[string]interface{}{
-					"app_id":   appID,
-					"app_type": appType,
-				},
-			},
-		},
-	})
-}
-
 func credInitOK(repoURL string) fakeCallResult {
 	return fakeCallResult{stdout: `{"ok":true,"data":{"repository_url":"` + repoURL + `"}}`}
 }
@@ -336,8 +313,7 @@ func TestAppsInit_EmptyRepo_EndToEnd(t *testing.T) {
 		"git status":      {stdout: " M src/app.ts\n"}, // scaffold produced changes
 	}}
 	withFakeRunner(t, f)
-	factory, stdout, reg := newAppsExecuteFactory(t)
-	stubAppType(reg, "app_x", "FULL_STACK")
+	factory, stdout, _ := newAppsExecuteFactory(t)
 	dir := relCloneDir(t)
 	if err := runAppsShortcut(t, AppsInit, []string{"+init", "--app-id", "app_x", "--dir", dir, "--as", "user"}, factory, stdout); err != nil {
 		t.Fatalf("unexpected: %v", err)
@@ -378,8 +354,7 @@ func TestAppsInit_AlreadyInitialized_ShortCircuit(t *testing.T) {
 	}
 	f := &fakeCommandRunner{results: map[string]fakeCallResult{"env-pull": envPullOK(filepath.Join(abs, ".env.local"))}}
 	withFakeRunner(t, f)
-	factory, stdout, reg := newAppsExecuteFactory(t)
-	stubAppType(reg, "app_x", "FULL_STACK")
+	factory, stdout, _ := newAppsExecuteFactory(t)
 	if err := runAppsShortcut(t, AppsInit, []string{"+init", "--app-id", "app_x", "--dir", dir, "--as", "user"}, factory, stdout); err != nil {
 		t.Fatalf("unexpected: %v", err)
 	}
@@ -448,8 +423,7 @@ func TestAppsInit_HappyPathCleanTree(t *testing.T) {
 		"git status":      {},           // clean tree after scaffold -> no commit/push
 	}}
 	withFakeRunner(t, f)
-	factory, stdout, reg := newAppsExecuteFactory(t)
-	stubAppType(reg, "app_x", "FULL_STACK")
+	factory, stdout, _ := newAppsExecuteFactory(t)
 	dir := relCloneDir(t)
 
 	err := runAppsShortcut(t, AppsInit, []string{"+init", "--app-id", "app_x", "--dir", dir, "--as", "user"}, factory, stdout)
@@ -498,8 +472,7 @@ func TestAppsInit_DirtyTreeCommitPush(t *testing.T) {
 		"git status":      {stdout: " M file.txt"},
 	}}
 	withFakeRunner(t, f)
-	factory, stdout, reg := newAppsExecuteFactory(t)
-	stubAppType(reg, "app_x", "FULL_STACK")
+	factory, stdout, _ := newAppsExecuteFactory(t)
 	dir := relCloneDir(t)
 
 	err := runAppsShortcut(t, AppsInit, []string{"+init", "--app-id", "app_x", "--dir", dir, "--as", "user"}, factory, stdout)
@@ -569,8 +542,7 @@ func TestAppsInit_CloneFailure(t *testing.T) {
 		"git clone":       {stderr: "fatal: unable to access 'http://u:t@h/r.git'", err: errors.New("exit 128")},
 	}}
 	withFakeRunner(t, f)
-	factory, stdout, reg := newAppsExecuteFactory(t)
-	stubAppType(reg, "app_x", "FULL_STACK")
+	factory, stdout, _ := newAppsExecuteFactory(t)
 	dir := relCloneDir(t)
 
 	err := runAppsShortcut(t, AppsInit, []string{"+init", "--app-id", "app_x", "--dir", dir, "--as", "user"}, factory, stdout)
@@ -644,8 +616,7 @@ func TestAppsInit_AsPassthrough(t *testing.T) {
 		"git status":      {},
 	}}
 	withFakeRunner(t, f)
-	factory, stdout, reg := newAppsExecuteFactory(t)
-	stubAppType(reg, "app_x", "FULL_STACK")
+	factory, stdout, _ := newAppsExecuteFactory(t)
 	dir := relCloneDir(t)
 
 	// AppsInit.AuthTypes is ["user"], so the framework rejects --as bot. Use
@@ -751,7 +722,7 @@ func TestIsEmptyRepo(t *testing.T) {
 // newAppsExecuteFactoryWithStderr mirrors newAppsExecuteFactory but also returns
 // the stderr buffer, so tests can assert on the +init progress log lines that
 // initLogf writes to IO().ErrOut.
-func newAppsExecuteFactoryWithStderr(t *testing.T) (*cmdutil.Factory, *bytes.Buffer, *bytes.Buffer, *httpmock.Registry) {
+func newAppsExecuteFactoryWithStderr(t *testing.T) (*cmdutil.Factory, *bytes.Buffer, *bytes.Buffer) {
 	t.Helper()
 	t.Setenv("HOME", t.TempDir())
 	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
@@ -761,12 +732,12 @@ func newAppsExecuteFactoryWithStderr(t *testing.T) (*cmdutil.Factory, *bytes.Buf
 		Brand:      core.BrandFeishu,
 		UserOpenId: "ou_test",
 	}
-	factory, stdout, stderr, reg := cmdutil.TestFactory(t, cfg)
-	return factory, stdout, stderr, reg
+	factory, stdout, stderr, _ := cmdutil.TestFactory(t, cfg)
+	return factory, stdout, stderr
 }
 
 func TestAppsInit_Req1_Wording(t *testing.T) {
-	factory, stdout, _, _ := newAppsExecuteFactoryWithStderr(t)
+	factory, stdout, _ := newAppsExecuteFactoryWithStderr(t)
 	if err := runAppsShortcut(t, AppsInit, []string{"+init", "--app-id", "app_x", "--as", "user", "--dry-run"}, factory, stdout); err != nil {
 		t.Fatalf("dry-run err=%v", err)
 	}
@@ -795,8 +766,7 @@ func TestAppsInit_Req1_Wording(t *testing.T) {
 		"git status":      {},
 	}}
 	withFakeRunner(t, f)
-	factory2, stdout2, stderr2, reg2 := newAppsExecuteFactoryWithStderr(t)
-	stubAppType(reg2, "app_x", "FULL_STACK")
+	factory2, stdout2, stderr2 := newAppsExecuteFactoryWithStderr(t)
 	dir := relCloneDir(t)
 	if err := runAppsShortcut(t, AppsInit, []string{"+init", "--app-id", "app_x", "--dir", dir, "--as", "user"}, factory2, stdout2); err != nil {
 		t.Fatalf("run err=%v", err)
@@ -859,8 +829,7 @@ func TestAppsInit_EmptyRepo_TwoCommits(t *testing.T) {
 		"git status":      {stdout: " A src/app.ts\n A .spark/meta.json\n A .agent/skills/steering/x.md\n"},
 	}}
 	withFakeRunner(t, f)
-	factory, stdout, reg := newAppsExecuteFactory(t)
-	stubAppType(reg, "app_x", "FULL_STACK")
+	factory, stdout, _ := newAppsExecuteFactory(t)
 	dir := relCloneDir(t)
 	if err := runAppsShortcut(t, AppsInit, []string{"+init", "--app-id", "app_x", "--dir", dir, "--as", "user"}, factory, stdout); err != nil {
 		t.Fatalf("unexpected: %v", err)
@@ -901,8 +870,7 @@ func TestAppsInit_EmptyRepo_AppCodeOnly_SingleCommit(t *testing.T) {
 		"git status":      {stdout: " A src/app.ts\n"},
 	}}
 	withFakeRunner(t, f)
-	factory, stdout, reg := newAppsExecuteFactory(t)
-	stubAppType(reg, "app_x", "FULL_STACK")
+	factory, stdout, _ := newAppsExecuteFactory(t)
 	dir := relCloneDir(t)
 	if err := runAppsShortcut(t, AppsInit, []string{"+init", "--app-id", "app_x", "--dir", dir, "--as", "user"}, factory, stdout); err != nil {
 		t.Fatalf("unexpected: %v", err)
@@ -922,8 +890,7 @@ func TestAppsInit_EmptyRepo_ConfigOnly_SingleCommit(t *testing.T) {
 		"git status":      {stdout: " A .spark/meta.json\n"},
 	}}
 	withFakeRunner(t, f)
-	factory, stdout, reg := newAppsExecuteFactory(t)
-	stubAppType(reg, "app_x", "FULL_STACK")
+	factory, stdout, _ := newAppsExecuteFactory(t)
 	dir := relCloneDir(t)
 	if err := runAppsShortcut(t, AppsInit, []string{"+init", "--app-id", "app_x", "--dir", dir, "--as", "user"}, factory, stdout); err != nil {
 		t.Fatalf("unexpected: %v", err)
@@ -943,8 +910,7 @@ func TestAppsInit_NonEmpty_SingleInitCommit(t *testing.T) {
 		"git status":      {stdout: " M file.txt\n M .spark/meta.json\n"},
 	}}
 	withFakeRunner(t, f)
-	factory, stdout, reg := newAppsExecuteFactory(t)
-	stubAppType(reg, "app_x", "FULL_STACK")
+	factory, stdout, _ := newAppsExecuteFactory(t)
 	dir := relCloneDir(t)
 	if err := runAppsShortcut(t, AppsInit, []string{"+init", "--app-id", "app_x", "--dir", dir, "--as", "user"}, factory, stdout); err != nil {
 		t.Fatalf("unexpected: %v", err)
@@ -963,7 +929,8 @@ func TestAppsInit_NonEmpty_SingleInitCommit(t *testing.T) {
 // gitMust runs a git command in dir with a real binary, failing the test on error.
 func gitMust(t *testing.T, dir string, args ...string) string {
 	t.Helper()
-	cmd := gitcmd.Command(dir, args...)
+	cmd := exec.Command("git", args...)
+	cmd.Dir = dir
 	out, err := cmd.CombinedOutput()
 	if err != nil {
 		t.Fatalf("git %v in %s failed: %v\n%s", args, dir, err, out)
@@ -979,7 +946,6 @@ func TestCommitAndPushIfDirty_RealGit_IgnoredAgentDir(t *testing.T) {
 	if _, err := exec.LookPath("git"); err != nil {
 		t.Skip("git not available")
 	}
-	gitcmd.SetSynchronousMaintenanceEnv(t)
 	// Bare remote so `git push origin sprint/default` succeeds.
 	remote := t.TempDir()
 	gitMust(t, remote, "init", "--bare", "-q", "--initial-branch", defaultInitBranch)
@@ -1101,7 +1067,6 @@ func TestCommitAndPushIfDirty_RealGit_NonEmptyUpgrade(t *testing.T) {
 	if _, err := exec.LookPath("git"); err != nil {
 		t.Skip("git not available")
 	}
-	gitcmd.SetSynchronousMaintenanceEnv(t)
 	remote := t.TempDir()
 	gitMust(t, remote, "init", "--bare", "-q", "--initial-branch", defaultInitBranch)
 
@@ -1324,8 +1289,7 @@ func TestAppsInit_EnvPull_Success(t *testing.T) {
 		"env-pull":        envPullOK("/abs/app_x/.env.local"),
 	}}
 	withFakeRunner(t, f)
-	factory, stdout, reg := newAppsExecuteFactory(t)
-	stubAppType(reg, "app_x", "FULL_STACK")
+	factory, stdout, _ := newAppsExecuteFactory(t)
 	dir := relCloneDir(t)
 	if err := runAppsShortcut(t, AppsInit, []string{"+init", "--app-id", "app_x", "--dir", dir, "--as", "user"}, factory, stdout); err != nil {
 		t.Fatalf("unexpected error: %v", err)
@@ -1363,8 +1327,7 @@ func TestAppsInit_EnvPull_NonFatal(t *testing.T) {
 		},
 	}}
 	withFakeRunner(t, f)
-	factory, stdout, reg := newAppsExecuteFactory(t)
-	stubAppType(reg, "app_x", "FULL_STACK")
+	factory, stdout, _ := newAppsExecuteFactory(t)
 	dir := relCloneDir(t)
 	if err := runAppsShortcut(t, AppsInit, []string{"+init", "--app-id", "app_x", "--dir", dir, "--as", "user"}, factory, stdout); err != nil {
 		t.Fatalf("env-pull failure must be non-fatal, got: %v", err)
@@ -1403,8 +1366,7 @@ func TestAppsInit_AlreadyInitialized_RunsEnvPull(t *testing.T) {
 	envFile := filepath.Join(abs, ".env.local")
 	f := &fakeCommandRunner{results: map[string]fakeCallResult{"env-pull": envPullOK(envFile)}}
 	withFakeRunner(t, f)
-	factory, stdout, reg := newAppsExecuteFactory(t)
-	stubAppType(reg, "app_x", "FULL_STACK")
+	factory, stdout, _ := newAppsExecuteFactory(t)
 	if err := runAppsShortcut(t, AppsInit, []string{"+init", "--app-id", "app_x", "--dir", dir, "--as", "user"}, factory, stdout); err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
@@ -1451,8 +1413,7 @@ func TestAppsInit_AlreadyInitialized_EnvPullFailure_NonFatal(t *testing.T) {
 		},
 	}}
 	withFakeRunner(t, f)
-	factory, stdout, reg := newAppsExecuteFactory(t)
-	stubAppType(reg, "app_x", "FULL_STACK")
+	factory, stdout, _ := newAppsExecuteFactory(t)
 	if err := runAppsShortcut(t, AppsInit, []string{"+init", "--app-id", "app_x", "--dir", dir, "--as", "user"}, factory, stdout); err != nil {
 		t.Fatalf("env-pull failure must be non-fatal, got: %v", err)
 	}
@@ -1744,15 +1705,13 @@ func TestScaffoldInitArgs_WithAppType(t *testing.T) {
 }
 
 func TestPolicyForAppType(t *testing.T) {
-	// modern_html and html decouple all control points: skip install, env-pull, skills sync, app sync.
-	for _, at := range []string{"modern_html", "html"} {
-		if p := policyForAppType(at); !p.skipInstall || !p.skipEnvPull || !p.skipSkillsSync || !p.skipAppSync {
-			t.Errorf("%s policy = %+v, want all skip flags set", at, p)
-		}
+	// modern_html decouples all control points: skip install, env-pull, skills sync.
+	if p := policyForAppType("modern_html"); !p.skipInstall || !p.skipEnvPull || !p.skipSkillsSync {
+		t.Errorf("modern_html policy = %+v, want all skip flags set", p)
 	}
 	// Unlisted types (including "") get the zero-value policy: everything runs.
 	for _, at := range []string{"full_stack", "", "backend"} {
-		if p := policyForAppType(at); p.skipInstall || p.skipEnvPull || p.skipSkillsSync || p.skipAppSync {
+		if p := policyForAppType(at); p.skipInstall || p.skipEnvPull || p.skipSkillsSync {
 			t.Errorf("policy for %q = %+v, want zero value", at, p)
 		}
 	}
@@ -1798,7 +1757,7 @@ func configSetValue(calls [][]string, key string) (string, bool) {
 func TestEnsureGitIdentity_SetsDefaultsWhenUnset(t *testing.T) {
 	f := &fakeCommandRunner{} // no "git config" result → `--get` returns empty stdout
 	withFakeRunner(t, f)
-	if err := ensureGitIdentity(context.Background(), "/repo", "", ""); err != nil {
+	if err := ensureGitIdentity(context.Background(), "/repo"); err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
 	if v, ok := configSetValue(f.calls, "user.name"); !ok || v != defaultGitUserName {
@@ -1815,7 +1774,7 @@ func TestEnsureGitIdentity_RespectsExisting(t *testing.T) {
 		"git config": {stdout: "Existing Dev\n"},
 	}}
 	withFakeRunner(t, f)
-	if err := ensureGitIdentity(context.Background(), "/repo", "", ""); err != nil {
+	if err := ensureGitIdentity(context.Background(), "/repo"); err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
 	if _, ok := configSetValue(f.calls, "user.name"); ok {
@@ -1831,7 +1790,7 @@ func TestEnsureGitIdentity_SetFailurePropagates(t *testing.T) {
 		"git config": {stderr: "boom", err: errors.New("exit 1")},
 	}}
 	withFakeRunner(t, f)
-	if err := ensureGitIdentity(context.Background(), "/repo", "", ""); err == nil {
+	if err := ensureGitIdentity(context.Background(), "/repo"); err == nil {
 		t.Error("expected error when git config set fails")
 	}
 }

shortcuts/apps/apps_meta.go

@@ -13,25 +13,22 @@ import (
 )
 
 // queryAppType fetches the app's type string from the server via
-// GET /open-apis/spark/v1/apps/{identifier}. The identifier can be either
-// an app_id or a meta_token — the server resolves both. The server returns
-// uppercase app_type values ("HTML", "FULL_STACK", "MODERN_HTML");
-// this function normalizes to lowercase. Returns an error when the API
-// is unavailable or the response is malformed — callers must not proceed
-// with a fallback type to avoid creating the wrong project scaffold.
-func queryAppType(ctx context.Context, rctx *common.RuntimeContext, identifier string) (string, error) {
-	path := fmt.Sprintf("%s/apps/%s", apiBasePath, validate.EncodePathSegment(identifier))
+// GET /open-apis/spark/v1/apps/{appID}. The server returns uppercase
+// values ("HTML", "FULL_STACK", "MODERN_HTML"); this function normalizes
+// to lowercase. Returns "" when the API is unavailable or returns an
+// error — callers fall back to legacy behavior.
+func queryAppType(ctx context.Context, rctx *common.RuntimeContext, appID string) string {
+	path := fmt.Sprintf("%s/apps/%s", apiBasePath, validate.EncodePathSegment(appID))
 	data, err := rctx.CallAPITyped("GET", path, nil, nil)
 	if err != nil {
-		return "", err
+		fmt.Fprintf(rctx.IO().ErrOut, "→ Could not query app type: %v\n", err)
+		return ""
 	}
 	appRaw, _ := data["app"].(map[string]interface{})
 	if appRaw == nil {
-		return "", appsSubprocessEnvelopeError("query app type: response missing app object")
+		fmt.Fprintf(rctx.IO().ErrOut, "→ Could not query app type: response missing app object\n")
+		return ""
 	}
 	appType, _ := appRaw["app_type"].(string)
-	if strings.TrimSpace(appType) == "" {
-		return "", appsSubprocessEnvelopeError("query app type: response missing app_type")
-	}
-	return strings.ToLower(appType), nil
+	return strings.ToLower(appType)
 }

shortcuts/apps/apps_meta_test.go

@@ -43,10 +43,7 @@ func TestQueryAppType_Success(t *testing.T) {
 		},
 	})
 
-	result, err := queryAppType(context.Background(), rt, "app_test")
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
+	result := queryAppType(context.Background(), rt, "app_test")
 	if result != "modern_html" {
 		t.Errorf("queryAppType = %q, want modern_html", result)
 	}
@@ -68,10 +65,7 @@ func TestQueryAppType_FullStack(t *testing.T) {
 		},
 	})
 
-	result, err := queryAppType(context.Background(), rt, "app_fs")
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
+	result := queryAppType(context.Background(), rt, "app_fs")
 	if result != "full_stack" {
 		t.Errorf("queryAppType = %q, want full_stack", result)
 	}
@@ -93,10 +87,7 @@ func TestQueryAppType_Html(t *testing.T) {
 		},
 	})
 
-	result, err := queryAppType(context.Background(), rt, "app_html")
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
+	result := queryAppType(context.Background(), rt, "app_html")
 	if result != "html" {
 		t.Errorf("queryAppType = %q, want html", result)
 	}
@@ -111,9 +102,9 @@ func TestQueryAppType_APIError(t *testing.T) {
 		Body:   map[string]interface{}{"code": float64(99999), "msg": "internal error"},
 	})
 
-	_, err := queryAppType(context.Background(), rt, "app_bad")
-	if err == nil {
-		t.Error("expected error on API failure")
+	result := queryAppType(context.Background(), rt, "app_bad")
+	if result != "" {
+		t.Errorf("queryAppType = %q, want empty on error", result)
 	}
 }
 
@@ -128,9 +119,9 @@ func TestQueryAppType_MissingAppObject(t *testing.T) {
 		},
 	})
 
-	_, err := queryAppType(context.Background(), rt, "app_no")
-	if err == nil {
-		t.Error("expected error when app object missing")
+	result := queryAppType(context.Background(), rt, "app_no")
+	if result != "" {
+		t.Errorf("queryAppType = %q, want empty when app object missing", result)
 	}
 }
 
@@ -150,8 +141,8 @@ func TestQueryAppType_EmptyAppType(t *testing.T) {
 		},
 	})
 
-	_, err := queryAppType(context.Background(), rt, "app_empty")
-	if err == nil {
-		t.Error("expected error when app_type is empty")
+	result := queryAppType(context.Background(), rt, "app_empty")
+	if result != "" {
+		t.Errorf("queryAppType = %q, want empty when app_type is empty", result)
 	}
 }

shortcuts/apps/apps_release_create.go

@@ -31,13 +31,9 @@ var AppsReleaseCreate = common.Shortcut{
 		{Name: "branch", Desc: "release branch (server uses default if omitted)"},
 	},
 	Validate: func(ctx context.Context, rctx *common.RuntimeContext) error {
-		appID := strings.TrimSpace(rctx.Str("app-id"))
-		if appID == "" {
+		if strings.TrimSpace(rctx.Str("app-id")) == "" {
 			return appsValidationParamError("--app-id", "--app-id is required")
 		}
-		if err := validateRealAppID(appID); err != nil {
-			return err
-		}
 		return nil
 	},
 	DryRun: func(ctx context.Context, rctx *common.RuntimeContext) *common.DryRunAPI {

shortcuts/apps/apps_release_get.go

@@ -30,13 +30,9 @@ var AppsReleaseGet = common.Shortcut{
 		{Name: "release-id", Desc: "release ID (the release_id returned by +release-create)", Required: true},
 	},
 	Validate: func(ctx context.Context, rctx *common.RuntimeContext) error {
-		appID := strings.TrimSpace(rctx.Str("app-id"))
-		if appID == "" {
+		if strings.TrimSpace(rctx.Str("app-id")) == "" {
 			return appsValidationParamError("--app-id", "--app-id is required")
 		}
-		if err := validateRealAppID(appID); err != nil {
-			return err
-		}
 		if strings.TrimSpace(rctx.Str("release-id")) == "" {
 			return appsValidationParamError("--release-id", "--release-id is required")
 		}

shortcuts/apps/common.go

@@ -41,21 +41,6 @@ func withAppsHint(err error, hint string) error {
 	return err
 }
 
-// validateRealAppID checks that --app-id is a real app ID (app_ prefix).
-// meta_token values are rejected with a hint to resolve via +get first.
-func validateRealAppID(appID string) error {
-	if !strings.HasPrefix(appID, "app_") {
-		return errs.NewValidationError(errs.SubtypeInvalidArgument,
-			`--app-id must be an app_id starting with "app_".`,
-		).WithParam("--app-id").WithHint(
-			`If you have a meta_token or a /page/<token>/ link, first resolve it:
-lark-cli apps +get --app-id <meta_token> -q '.data.app.app_id'
-Then retry this command with the returned app_id.`,
-		)
-	}
-	return nil
-}
-
 // rejectOutputTraversal is a defense-in-depth pre-check on a user-supplied
 // --output path. The authoritative guard is the local FileIO layer
 // (validate.SafeOutputPath sandboxes every write to the cwd, resolving .. and

shortcuts/apps/git_credential.go

@@ -75,7 +75,6 @@ var AppsGitCredentialInit = common.Shortcut{
 				"save the issued PAT in the local system credential store",
 				"write app-scoped git credential metadata",
 				"configure a URL-scoped Git credential helper in global git config when possible",
-				"return commit_author_name and commit_author_email for repo-local git identity",
 			}).
 			Params(gitCredentialIssueParams(appID))
 	},
@@ -91,12 +90,6 @@ var AppsGitCredentialInit = common.Shortcut{
 			"repository_url": result.GitHTTPURL,
 			"status":         initStatus(result),
 		}
-		if result.CommitAuthorName != "" {
-			payload["commit_author_name"] = result.CommitAuthorName
-		}
-		if result.CommitAuthorEmail != "" {
-			payload["commit_author_email"] = result.CommitAuthorEmail
-		}
 		if result.ConfigWarning != "" {
 			payload["git_config_warning"] = result.ConfigWarning
 		}
@@ -468,13 +461,11 @@ func issuedFromData(appID string, data map[string]interface{}) (*gitcred.IssuedC
 		}
 	}
 	issued := &gitcred.IssuedCredential{
-		AppID:             firstString(source, "app_id", appID),
-		GitHTTPURL:        firstString(source, "gitURL", "GitURL", "GitUrl", "gitUrl", "git_url", "git_http_url", "repository_url"),
-		Username:          firstString(source, "username"),
-		PAT:               firstString(source, "token", "Token", "pat", "password"),
-		ExpiresAt:         firstInt64(source, "expiredTime", "ExpiredTime", "expired_time", "expires_at"),
-		CommitAuthorName:  firstString(source, "commit_author_name"),
-		CommitAuthorEmail: firstString(source, "commit_author_email"),
+		AppID:      firstString(source, "app_id", appID),
+		GitHTTPURL: firstString(source, "gitURL", "GitURL", "GitUrl", "gitUrl", "git_url", "git_http_url", "repository_url"),
+		Username:   firstString(source, "username"),
+		PAT:        firstString(source, "token", "Token", "pat", "password"),
+		ExpiresAt:  firstInt64(source, "expiredTime", "ExpiredTime", "expired_time", "expires_at"),
 	}
 	if issued.AppID == "" {
 		issued.AppID = appID

shortcuts/apps/git_credential_test.go

@@ -87,7 +87,6 @@ func TestAppsGitCredentialInitDryRunRequestShape(t *testing.T) {
 		"save the issued PAT in the local system credential store",
 		"write app-scoped git credential metadata",
 		"configure a URL-scoped Git credential helper in global git config when possible",
-		"return commit_author_name and commit_author_email for repo-local git identity",
 	})
 }
 

shortcuts/apps/gitcred/helper.go

@@ -129,13 +129,7 @@ func (m *Manager) Init(ctx context.Context, profile ProfileContext, appID string
 	if previous != nil && previous.PATRef != "" && previous.PATRef != ref {
 		_ = m.Secrets.Remove(previous.PATRef)
 	}
-	result := &InitResult{
-		AppID:             appID,
-		GitHTTPURL:        url,
-		Refreshed:         previous != nil,
-		CommitAuthorName:  issued.CommitAuthorName,
-		CommitAuthorEmail: issued.CommitAuthorEmail,
-	}
+	result := &InitResult{AppID: appID, GitHTTPURL: url, Refreshed: previous != nil}
 	if m.GitConfig != nil {
 		if err := m.GitConfig.SetHelper(ctx, url, appID); err != nil {
 			result.ConfigWarning = err.Error()

shortcuts/apps/gitcred/types.go

@@ -51,22 +51,18 @@ type CredentialRecord struct {
 }
 
 type IssuedCredential struct {
-	AppID             string
-	GitHTTPURL        string
-	Username          string
-	PAT               string
-	ExpiresAt         int64
-	CommitAuthorName  string
-	CommitAuthorEmail string
+	AppID      string
+	GitHTTPURL string
+	Username   string
+	PAT        string
+	ExpiresAt  int64
 }
 
 type InitResult struct {
-	AppID             string
-	GitHTTPURL        string
-	Refreshed         bool
-	ConfigWarning     string
-	CommitAuthorName  string
-	CommitAuthorEmail string
+	AppID         string
+	GitHTTPURL    string
+	Refreshed     bool
+	ConfigWarning string
 }
 
 type RemoveResult struct {

shortcuts/apps/html_publish_client.go

@@ -0,0 +1,73 @@
+// Copyright (c) 2026 Lark Technologies Pte. Ltd.
+// SPDX-License-Identifier: MIT
+
+package apps
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"net/http"
+
+	larkcore "github.com/larksuite/oapi-sdk-go/v3/core"
+
+	"github.com/larksuite/cli/errs"
+	"github.com/larksuite/cli/internal/client"
+	"github.com/larksuite/cli/internal/validate"
+	"github.com/larksuite/cli/shortcuts/common"
+)
+
+type htmlPublishResponse struct {
+	URL string
+}
+
+type appsHTMLPublishClient interface {
+	HTMLPublish(ctx context.Context, appID string, tarball *htmlPublishTarball) (*htmlPublishResponse, error)
+}
+
+type appsHTMLPublishAPI struct {
+	runtime *common.RuntimeContext
+}
+
+func (api appsHTMLPublishAPI) HTMLPublish(ctx context.Context, appID string, tarball *htmlPublishTarball) (*htmlPublishResponse, error) {
+	fd := larkcore.NewFormdata()
+	fd.AddFile("file", bytes.NewReader(tarball.Body))
+
+	apiResp, err := api.runtime.DoAPI(&larkcore.ApiReq{
+		HttpMethod: http.MethodPost,
+		ApiPath:    fmt.Sprintf("%s/apps/%s/upload_and_release_html_code", apiBasePath, validate.EncodePathSegment(appID)),
+		Body:       fd,
+	}, larkcore.WithFileUpload())
+	if err != nil {
+		return nil, client.WrapDoAPIError(err)
+	}
+	data, err := api.runtime.ClassifyAPIResponse(apiResp)
+	if err != nil {
+		return nil, enrichHTMLPublishAPIError(err)
+	}
+	url, _ := data["url"].(string)
+	if url == "" {
+		return nil, errs.NewInternalError(errs.SubtypeInvalidResponse,
+			"html-publish response is missing the published app url")
+	}
+	return &htmlPublishResponse{URL: url}, nil
+}
+
+// OAPI business error codes returned by the
+// /apps/{id}/upload_and_release_html_code endpoint. Owned by the backend
+// service; update when new codes are documented in the OAPI spec.
+const (
+	errCodeBuildFailed = 90001 // tar.gz uploaded but server-side build failed
+	errCodeAppNotFound = 90002 // app_id unknown or caller lacks permission
+)
+
+func buildHTMLPublishFailureHint(code int) string {
+	switch code {
+	case errCodeBuildFailed:
+		return "server-side build failed: run `lark-cli apps +html-publish --app-id <your-app-id> --path <path> --dry-run` to inspect the packaged file list"
+	case errCodeAppNotFound:
+		return "the app does not exist or the caller has no access; ask the user to confirm the app_id (extract it from the app URL https://miaoda.feishu.cn/app/app_xxx after /app/, or take the app_xxx string directly)"
+	default:
+		return ""
+	}
+}

shortcuts/apps/html_publish_client_test.go

@@ -0,0 +1,197 @@
+// Copyright (c) 2026 Lark Technologies Pte. Ltd.
+// SPDX-License-Identifier: MIT
+
+package apps
+
+import (
+	"bytes"
+	"context"
+	"mime"
+	"mime/multipart"
+	"strings"
+	"testing"
+
+	"github.com/larksuite/cli/errs"
+	"github.com/larksuite/cli/internal/cmdutil"
+	"github.com/larksuite/cli/internal/core"
+	"github.com/larksuite/cli/internal/httpmock"
+	"github.com/larksuite/cli/shortcuts/common"
+)
+
+func newAppsClientRuntime(t *testing.T) (*common.RuntimeContext, *httpmock.Registry) {
+	t.Helper()
+	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
+	cfg := &core.CliConfig{
+		AppID:      "test-app-" + strings.ToLower(t.Name()),
+		AppSecret:  "test-secret",
+		Brand:      core.BrandFeishu,
+		UserOpenId: "ou_test",
+	}
+	factory, _, _, reg := cmdutil.TestFactory(t, cfg)
+	rctx := common.TestNewRuntimeContextForAPI(context.Background(), nil, cfg, factory, core.AsUser)
+	return rctx, reg
+}
+
+func TestAppsHTMLPublishAPI_Success(t *testing.T) {
+	rctx, reg := newAppsClientRuntime(t)
+	stub := &httpmock.Stub{
+		Method: "POST",
+		URL:    "/open-apis/spark/v1/apps/app_x/upload_and_release_html_code",
+		Body: map[string]interface{}{
+			"code": 0,
+			"msg":  "success",
+			"data": map[string]interface{}{
+				"url": "https://miaoda.feishu.cn/app/app_x",
+			},
+		},
+	}
+	reg.Register(stub)
+
+	api := appsHTMLPublishAPI{runtime: rctx}
+	tarball := &htmlPublishTarball{Body: []byte("fake"), Size: 4, SHA256: "abc"}
+	resp, err := api.HTMLPublish(context.Background(), "app_x", tarball)
+	if err != nil {
+		t.Fatalf("err=%v", err)
+	}
+	if resp.URL != "https://miaoda.feishu.cn/app/app_x" {
+		t.Fatalf("url=%q", resp.URL)
+	}
+
+	ct := stub.CapturedHeaders.Get("Content-Type")
+	mt, params, err := mime.ParseMediaType(ct)
+	if err != nil || mt != "multipart/form-data" {
+		t.Fatalf("content type %q wrong", ct)
+	}
+	mr := multipart.NewReader(bytes.NewReader(stub.CapturedBody), params["boundary"])
+	saw := false
+	for {
+		p, err := mr.NextPart()
+		if err != nil {
+			break
+		}
+		if p.FormName() == "file" {
+			saw = true
+		}
+	}
+	if !saw {
+		t.Fatalf("multipart missing 'file' part")
+	}
+}
+
+func TestAppsHTMLPublishAPI_BusinessErrorHasHint(t *testing.T) {
+	rctx, reg := newAppsClientRuntime(t)
+	reg.Register(&httpmock.Stub{
+		Method: "POST",
+		URL:    "/open-apis/spark/v1/apps/app_x/upload_and_release_html_code",
+		Body: map[string]interface{}{
+			"code": 90001,
+			"msg":  "build failed: dependency conflict",
+		},
+	})
+
+	api := appsHTMLPublishAPI{runtime: rctx}
+	_, err := api.HTMLPublish(context.Background(), "app_x", &htmlPublishTarball{Body: []byte("fake")})
+	if err == nil {
+		t.Fatalf("expected error")
+	}
+	problem := requireAppsAPIProblem(t, err)
+	if problem.Code != errCodeBuildFailed {
+		t.Fatalf("code = %d, want %d", problem.Code, errCodeBuildFailed)
+	}
+	if problem.Hint == "" {
+		t.Fatalf("expected non-empty hint on code 90001")
+	}
+	if !strings.Contains(problem.Message, "build failed") {
+		t.Fatalf("missing failure message: %v", problem.Message)
+	}
+}
+
+func TestAppsHTMLPublishAPI_AppNotFoundClassified(t *testing.T) {
+	rctx, reg := newAppsClientRuntime(t)
+	reg.Register(&httpmock.Stub{
+		Method: "POST",
+		URL:    "/open-apis/spark/v1/apps/app_missing/upload_and_release_html_code",
+		Body: map[string]interface{}{
+			"code": errCodeAppNotFound,
+			"msg":  "app not found",
+		},
+	})
+
+	api := appsHTMLPublishAPI{runtime: rctx}
+	_, err := api.HTMLPublish(context.Background(), "app_missing", &htmlPublishTarball{Body: []byte("fake")})
+	problem := requireAppsAPIProblem(t, err)
+	if problem.Subtype != errs.SubtypeNotFound {
+		t.Fatalf("subtype = %q, want %q", problem.Subtype, errs.SubtypeNotFound)
+	}
+	if problem.Hint == "" {
+		t.Fatalf("expected app-not-found recovery hint")
+	}
+}
+
+func TestAppsHTMLPublishAPI_MissingURLIsInvalidResponse(t *testing.T) {
+	rctx, reg := newAppsClientRuntime(t)
+	reg.Register(&httpmock.Stub{
+		Method: "POST",
+		URL:    "/open-apis/spark/v1/apps/app_x/upload_and_release_html_code",
+		Body: map[string]interface{}{
+			"code": 0,
+			"msg":  "success",
+			"data": map[string]interface{}{},
+		},
+	})
+
+	api := appsHTMLPublishAPI{runtime: rctx}
+	_, err := api.HTMLPublish(context.Background(), "app_x", &htmlPublishTarball{Body: []byte("fake")})
+	problem := requireAppsProblem(t, err, errs.CategoryInternal)
+	if problem.Subtype != errs.SubtypeInvalidResponse {
+		t.Fatalf("subtype = %q, want %q", problem.Subtype, errs.SubtypeInvalidResponse)
+	}
+}
+
+func TestBuildHTMLPublishFailureHint_UnknownCodeReturnsEmpty(t *testing.T) {
+	// 默认分支：未识别的 code 返回空 hint，让 Agent 用 message 兜底。
+	if hint := buildHTMLPublishFailureHint(99999); hint != "" {
+		t.Fatalf("unknown code should return empty hint, got %q", hint)
+	}
+	if hint := buildHTMLPublishFailureHint(0); hint != "" {
+		t.Fatalf("zero code should return empty hint, got %q", hint)
+	}
+}
+
+func TestBuildHTMLPublishFailureHint_KnownCodes(t *testing.T) {
+	if hint := buildHTMLPublishFailureHint(90001); hint == "" {
+		t.Fatalf("code 90001 should return non-empty hint")
+	}
+	if hint := buildHTMLPublishFailureHint(90002); hint == "" {
+		t.Fatalf("code 90002 should return non-empty hint")
+	}
+}
+
+func TestBuildHTMLPublishFailureHint_NotFoundHintNoLongerMentionsList(t *testing.T) {
+	hint := buildHTMLPublishFailureHint(90002)
+	if hint == "" {
+		t.Fatalf("code 90002 should return non-empty hint")
+	}
+	if strings.Contains(hint, "+list") {
+		t.Fatalf("hint must not point at hidden +list command, got: %q", hint)
+	}
+	if !strings.Contains(hint, "app_id") {
+		t.Fatalf("hint should reference app_id, got: %q", hint)
+	}
+}
+
+func TestAppsHTMLPublishAPI_MalformedResponseIsInvalidResponse(t *testing.T) {
+	rctx, reg := newAppsClientRuntime(t)
+	reg.Register(&httpmock.Stub{
+		Method:  "POST",
+		URL:     "/open-apis/spark/v1/apps/app_x/upload_and_release_html_code",
+		RawBody: []byte("{not json"),
+	})
+
+	api := appsHTMLPublishAPI{runtime: rctx}
+	_, err := api.HTMLPublish(context.Background(), "app_x", &htmlPublishTarball{Body: []byte("fake")})
+	problem := requireAppsProblem(t, err, errs.CategoryInternal)
+	if problem.Subtype != errs.SubtypeInvalidResponse {
+		t.Fatalf("subtype = %q, want %q", problem.Subtype, errs.SubtypeInvalidResponse)
+	}
+}

shortcuts/base/base_execute_test.go

@@ -122,7 +122,7 @@ func TestBaseWorkspaceExecuteCreate(t *testing.T) {
 	if grant["user_open_id"] != "ou_testuser" {
 		t.Fatalf("permission_grant.user_open_id = %#v, want %q", grant["user_open_id"], "ou_testuser")
 	}
-	if grant["message"] != "Granted the current CLI user full_access on the new base." {
+	if grant["message"] != "Granted the current CLI user full_access (可管理权限) on the new base." {
 		t.Fatalf("permission_grant.message = %#v", grant["message"])
 	}
 
@@ -469,6 +469,9 @@ func TestBaseWorkspaceExecuteCreateBotAutoGrantFailureDoesNotFailCreate(t *testi
 	if grant["status"] != common.PermissionGrantFailed {
 		t.Fatalf("permission_grant.status = %#v, want %q", grant["status"], common.PermissionGrantFailed)
 	}
+	if !strings.Contains(grant["message"].(string), "full_access (可管理权限)") {
+		t.Fatalf("permission_grant.message = %q, want permission hint", grant["message"])
+	}
 	if !strings.Contains(grant["message"].(string), "retry later") {
 		t.Fatalf("permission_grant.message = %q, want retry guidance", grant["message"])
 	}
@@ -574,9 +577,8 @@ func TestBaseWorkspaceDryRunCreateAndCopyPermissionGrantHints(t *testing.T) {
 		if err := runShortcut(t, BaseBaseCreate, []string{"+base-create", "--name", "Demo Base", "--dry-run"}, factory, stdout); err != nil {
 			t.Fatalf("err=%v", err)
 		}
-		wantDesc := "After Base creation succeeds in bot mode, the CLI will also try to grant the current CLI user full_access on the new Base."
-		if got := stdout.String(); !strings.Contains(got, wantDesc) {
-			t.Fatalf("stdout=%s, want desc %q", got, wantDesc)
+		if got := stdout.String(); !strings.Contains(got, "grant the current CLI user full_access (可管理权限)") {
+			t.Fatalf("stdout=%s", got)
 		}
 	})
 
@@ -585,9 +587,8 @@ func TestBaseWorkspaceDryRunCreateAndCopyPermissionGrantHints(t *testing.T) {
 		if err := runShortcut(t, BaseBaseCopy, []string{"+base-copy", "--base-token", "app_src", "--dry-run"}, factory, stdout); err != nil {
 			t.Fatalf("err=%v", err)
 		}
-		wantDesc := "After Base copy succeeds in bot mode, the CLI will also try to grant the current CLI user full_access on the new Base."
-		if got := stdout.String(); !strings.Contains(got, wantDesc) {
-			t.Fatalf("stdout=%s, want desc %q", got, wantDesc)
+		if got := stdout.String(); !strings.Contains(got, "grant the current CLI user full_access (可管理权限)") {
+			t.Fatalf("stdout=%s", got)
 		}
 	})
 
@@ -596,7 +597,7 @@ func TestBaseWorkspaceDryRunCreateAndCopyPermissionGrantHints(t *testing.T) {
 		if err := runShortcutWithAuthTypes(t, BaseBaseCreate, authTypes(), []string{"+base-create", "--name", "Demo Base", "--as", "user", "--dry-run"}, factory, stdout); err != nil {
 			t.Fatalf("err=%v", err)
 		}
-		if got := stdout.String(); strings.Contains(got, "grant the current CLI user full_access") {
+		if got := stdout.String(); strings.Contains(got, "grant the current CLI user full_access (可管理权限)") {
 			t.Fatalf("stdout=%s", got)
 		}
 	})

shortcuts/base/base_ops.go

@@ -29,7 +29,7 @@ func dryRunBaseCopy(_ context.Context, runtime *common.RuntimeContext) *common.D
 		Body(buildBaseCopyBody(runtime)).
 		Set("base_token", runtime.Str("base-token"))
 	if runtime.IsBot() {
-		d.Desc("After Base copy succeeds in bot mode, the CLI will also try to grant the current CLI user full_access on the new Base.")
+		d.Desc("After Base copy succeeds in bot mode, the CLI will also try to grant the current CLI user full_access (可管理权限) on the new Base.")
 	}
 	return d
 }
@@ -37,7 +37,7 @@ func dryRunBaseCopy(_ context.Context, runtime *common.RuntimeContext) *common.D
 func dryRunBaseCreate(_ context.Context, runtime *common.RuntimeContext) *common.DryRunAPI {
 	d := common.NewDryRunAPI()
 	if runtime.IsBot() {
-		d.Desc("After Base creation succeeds in bot mode, the CLI will also try to grant the current CLI user full_access on the new Base.")
+		d.Desc("After Base creation succeeds in bot mode, the CLI will also try to grant the current CLI user full_access (可管理权限) on the new Base.")
 	}
 	d.
 		POST("/open-apis/base/v3/bases").

shortcuts/calendar/calendar_room_check.go

@@ -1,790 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-//
-// calendar +update room-availability pre-check helpers.
-//
-// Uses /open-apis/calendar/v4/freebusy/room_availability_check to warn the
-// caller before an update either adds a new room attendee or shifts the time
-// of a slot that already has a room reservation. --skip-room-check bypasses
-// the check for callers that want to move fast.
-
-package calendar
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"strconv"
-	"strings"
-	"time"
-
-	"github.com/larksuite/cli/errs"
-	"github.com/larksuite/cli/internal/validate"
-	"github.com/larksuite/cli/shortcuts/common"
-)
-
-const (
-	flagSkipRoomCheck = "skip-room-check"
-	roomCheckPath     = "/open-apis/calendar/v4/freebusy/room_availability_check"
-)
-
-// roomAvailability mirrors a single room result from the API.
-type roomAvailability struct {
-	RoomID                string            `json:"room_id,omitempty"`
-	RoomName              string            `json:"room_name,omitempty"`
-	Status                string            `json:"status,omitempty"`
-	UnavailableReasonType string            `json:"unavailable_reason_type,omitempty"`
-	Strategy              *roomStrategy     `json:"room_strategy,omitempty"`
-	Requisition           *roomRequisition  `json:"room_requisition,omitempty"`
-	ApprovalInfo          *roomApprovalInfo `json:"room_approval_info,omitempty"`
-}
-
-// roomStrategy mirrors the room_strategy block returned by the API on
-// unavailable rooms. Every field is optional: the server only fills in the
-// entries relevant to the current unavailable_reason_type.
-type roomStrategy struct {
-	SingleMaxDuration             string `json:"single_max_duration,omitempty"`
-	MaxAdvanceBookingTime         string `json:"max_advance_booking_time,omitempty"`
-	DailyStartTime                string `json:"daily_start_time,omitempty"`
-	DailyEndTime                  string `json:"daily_end_time,omitempty"`
-	Timezone                      string `json:"timezone,omitempty"`
-	DailyAdvanceWindowReleaseTime string `json:"daily_advance_window_release_time,omitempty"`
-}
-
-// roomRequisition mirrors room_requisition, returned by the API only when
-// unavailable_reason_type == "during_requisition". Both fields are RFC3339
-// strings and either may be empty if the server has no exact bound.
-type roomRequisition struct {
-	StartTime string `json:"start_time,omitempty"`
-	EndTime   string `json:"end_time,omitempty"`
-}
-
-// roomApprovalInfo mirrors room_approval_info, returned when the room requires
-// (or may require) an approval submission before it can be booked.
-//
-//   - ApprovalMode: "none" (no approval), "over_duration" (only when the
-//     booking exceeds the threshold), or "all" (every booking needs approval).
-//   - ApprovalDurationThreshold: seconds; only meaningful when
-//     ApprovalMode == "over_duration". The server returns it as a numeric
-//     string, matching the shape of the other duration fields.
-//
-// When the pre-check returns status == "need_approval" the caller renders a
-// friendly reminder derived from these two fields plus the current event
-// duration, so the agent knows whether to switch rooms/times or route the
-// user through an approval flow.
-type roomApprovalInfo struct {
-	ApprovalMode              string `json:"approval_mode,omitempty"`
-	ApprovalDurationThreshold string `json:"approval_duration_threshold,omitempty"`
-}
-
-// eventSnapshot carries only the fields room-check needs from the current
-// event: existing room IDs, current start/end (unix seconds string), timezone,
-// and rrule.
-type eventSnapshot struct {
-	RoomIDs   []string
-	StartTs   string
-	EndTs     string
-	Timezone  string
-	Recurrent string
-}
-
-// unavailableReasonHint maps API-declared unavailable reasons to a short
-// English phrase suitable for embedding in the block message. Unknown or
-// future reasons fall back to a single stable phrase so the CLI's blocked
-// message stays predictable for agents that parse it.
-func unavailableReasonHint(reason string) string {
-	switch reason {
-	case "reserved_by_other_event":
-		return "already reserved by another event"
-	case "past_time":
-		return "cannot book a room in the past"
-	case "beyond_advance_booking_window":
-		return "beyond the room's advance-booking window"
-	case "over_max_duration":
-		return "exceeds the room's max single-booking duration"
-	case "not_in_usable_time":
-		return "outside the room's daily bookable window"
-	case "during_requisition":
-		return "the room is disabled during this time and cannot be booked"
-	case "before_daily_advance_window_release":
-		return "the target date is outside the room's currently unlocked advance-booking window; the window extends by one calendar day at the daily release time"
-	case "recurring_exceed_approval_limit":
-		return "recurring event duration exceeds the limit for booking this approval-required room — shorten the duration or pick a different room"
-	default:
-		return "currently unbookable"
-	}
-}
-
-// strategyDetail renders the human-readable suffix appended to the reason
-// phrase for a given (reason, strategy) pair. It returns an empty string when
-// no strategy data is available or when the fields relevant to this reason
-// are missing / invalid, so callers can safely concatenate the result.
-func strategyDetail(reason string, s *roomStrategy) string {
-	if s == nil {
-		return ""
-	}
-	switch reason {
-	case "over_max_duration":
-		if d := formatDurationSeconds(s.SingleMaxDuration); d != "" {
-			return "the max single-booking duration is " + d
-		}
-	case "beyond_advance_booking_window":
-		// The API returns max_advance_booking_time as RFC3339 already;
-		// surface it verbatim so agents don't lose the exact instant.
-		if t := strings.TrimSpace(s.MaxAdvanceBookingTime); t != "" {
-			return "the latest bookable end time is " + t
-		}
-	case "not_in_usable_time":
-		start := formatDaySeconds(s.DailyStartTime)
-		end := formatDaySeconds(s.DailyEndTime)
-		zone := roomZoneLabel(s.Timezone)
-		switch {
-		case start != "" && end != "":
-			return fmt.Sprintf("the daily bookable window is %s - %s (%s)", start, end, zone)
-		case start != "":
-			return fmt.Sprintf("the daily bookable window starts at %s (%s)", start, zone)
-		case end != "":
-			return fmt.Sprintf("the daily bookable window ends at %s (%s)", end, zone)
-		}
-	case "before_daily_advance_window_release":
-		if t := formatDaySeconds(s.DailyAdvanceWindowReleaseTime); t != "" {
-			return fmt.Sprintf("the next unlock happens today at %s (%s), which advances the window by one day", t, roomZoneLabel(s.Timezone))
-		}
-	}
-	return ""
-}
-
-// requisitionDetail renders the suffix describing the room's scheduled
-// disable window for a `during_requisition` block. The API sends both bounds
-// as RFC3339 already, so we surface them verbatim to keep the exact instant.
-// Returns "" when both bounds are missing so the caller falls back to the
-// generic "pick a different time or a different room" recovery hint.
-func requisitionDetail(reason string, r *roomRequisition) string {
-	if reason != "during_requisition" || r == nil {
-		return ""
-	}
-	start := strings.TrimSpace(r.StartTime)
-	end := strings.TrimSpace(r.EndTime)
-	switch {
-	case start != "" && end != "":
-		return fmt.Sprintf("the disabled period is %s to %s", start, end)
-	case start != "":
-		return "the disabled period starts at " + start
-	case end != "":
-		return "the disabled period ends at " + end
-	}
-	return ""
-}
-
-// formatDurationSeconds renders a whole-second string like "10800" as a
-// compact "H hours [M minutes]" phrase. Returns "" when the value is
-// missing, non-numeric, or non-positive.
-func formatDurationSeconds(raw string) string {
-	sec, err := strconv.ParseInt(strings.TrimSpace(raw), 10, 64)
-	if err != nil || sec <= 0 {
-		return ""
-	}
-	d := time.Duration(sec) * time.Second
-	h := int(d / time.Hour)
-	m := int((d % time.Hour) / time.Minute)
-	switch {
-	case h > 0 && m > 0:
-		return fmt.Sprintf("%d hours %d minutes", h, m)
-	case h > 0:
-		return fmt.Sprintf("%d hours", h)
-	case m > 0:
-		return fmt.Sprintf("%d minutes", m)
-	default:
-		return fmt.Sprintf("%d seconds", sec)
-	}
-}
-
-// formatDaySeconds renders a "seconds since midnight" string as "HH:MM".
-// Returns "" when raw is missing, non-numeric, or outside [0, 24h). Seconds
-// are truncated because the API only guarantees minute-level meaning for
-// daily windows and release times.
-func formatDaySeconds(raw string) string {
-	sec, err := strconv.ParseInt(strings.TrimSpace(raw), 10, 64)
-	if err != nil || sec < 0 || sec >= 24*3600 {
-		return ""
-	}
-	h := sec / 3600
-	m := (sec % 3600) / 60
-	return fmt.Sprintf("%02d:%02d", h, m)
-}
-
-// roomZoneLabel renders the room's timezone as either a "GMT±X" string
-// anchored to today (so DST is respected) when the IANA name resolves, or
-// the IANA name itself as a fallback so agents always see the source of
-// truth. Returns the local device timezone's label when raw is empty.
-func roomZoneLabel(raw string) string {
-	raw = strings.TrimSpace(raw)
-	if raw == "" {
-		return gmtOffsetLabel(time.Now())
-	}
-	loc, err := time.LoadLocation(raw)
-	if err != nil {
-		return raw
-	}
-	return gmtOffsetLabel(time.Now().In(loc))
-}
-
-// gmtOffsetLabel formats t's zone offset as "GMT+8" / "GMT-5:30" / "GMT".
-// Minute-precision is included only when the offset has a non-zero minute
-// component so the common whole-hour case stays terse.
-func gmtOffsetLabel(t time.Time) string {
-	_, offsetSec := t.Zone()
-	if offsetSec == 0 {
-		return "GMT"
-	}
-	sign := "+"
-	if offsetSec < 0 {
-		sign = "-"
-		offsetSec = -offsetSec
-	}
-	h := offsetSec / 3600
-	m := (offsetSec % 3600) / 60
-	if m == 0 {
-		return fmt.Sprintf("GMT%s%d", sign, h)
-	}
-	return fmt.Sprintf("GMT%s%d:%02d", sign, h, m)
-}
-
-// collectAttendeeRoomIDs extracts omm_ prefixed IDs from a comma-separated
-// flag value. Empty / whitespace input returns nil.
-func collectAttendeeRoomIDs(raw string) []string {
-	if strings.TrimSpace(raw) == "" {
-		return nil
-	}
-	var rooms []string
-	seen := map[string]struct{}{}
-	for _, part := range strings.Split(raw, ",") {
-		id := strings.TrimSpace(part)
-		if !strings.HasPrefix(id, "omm_") {
-			continue
-		}
-		if _, ok := seen[id]; ok {
-			continue
-		}
-		seen[id] = struct{}{}
-		rooms = append(rooms, id)
-	}
-	return rooms
-}
-
-// fetchEventSnapshot GETs the event with attendees so we can read the current
-// start / end / recurrence and the room IDs already booked on the event. It is
-// best-effort: any error bubbles up so the caller can降级放行 by warning.
-//
-// One retry is baked in: a `{uid}_{original_time}` event_id refers to a
-// specific instance of a recurring series, but until that instance is edited
-// and materialised as an exception, the server only knows the master
-// (`{uid}_0`) and answers 193001 (event not found). We detect that shape and
-// re-issue the GET against the master so the room-check pipeline still has a
-// snapshot to work with.
-func fetchEventSnapshot(_ context.Context, runtime *common.RuntimeContext, calendarID, eventID string) (*eventSnapshot, error) {
-	data, err := callEventGet(runtime, calendarID, eventID)
-	if err != nil {
-		if masterID, ok := recurringMasterEventID(eventID); ok && isEventNotFound(err) {
-			data, err = callEventGet(runtime, calendarID, masterID)
-		}
-		if err != nil {
-			return nil, err
-		}
-	}
-	event, _ := data["event"].(map[string]interface{})
-	if event == nil {
-		return nil, errs.NewInternalError(errs.SubtypeInvalidResponse, "calendar event response missing 'event' field")
-	}
-	snap := &eventSnapshot{}
-	if start, _ := event["start_time"].(map[string]interface{}); start != nil {
-		if ts, _ := start["timestamp"].(string); ts != "" {
-			snap.StartTs = ts
-		}
-		if tz, _ := start["timezone"].(string); tz != "" {
-			snap.Timezone = tz
-		}
-	}
-	if end, _ := event["end_time"].(map[string]interface{}); end != nil {
-		if ts, _ := end["timestamp"].(string); ts != "" {
-			snap.EndTs = ts
-		}
-		if snap.Timezone == "" {
-			if tz, _ := end["timezone"].(string); tz != "" {
-				snap.Timezone = tz
-			}
-		}
-	}
-	if r, _ := event["recurrence"].(string); r != "" {
-		snap.Recurrent = r
-	}
-	attendees, _ := event["attendees"].([]interface{})
-	seen := map[string]struct{}{}
-	for _, raw := range attendees {
-		m, ok := raw.(map[string]interface{})
-		if !ok {
-			continue
-		}
-		if t, _ := m["type"].(string); t != "resource" {
-			continue
-		}
-		id, _ := m["room_id"].(string)
-		if id == "" {
-			continue
-		}
-		if status, _ := m["rsvp_status"].(string); status == "removed" {
-			continue
-		}
-		if _, ok := seen[id]; ok {
-			continue
-		}
-		seen[id] = struct{}{}
-		snap.RoomIDs = append(snap.RoomIDs, id)
-	}
-	return snap, nil
-}
-
-// callEventGet issues the calendar event GET used by fetchEventSnapshot. It
-// is factored out so the 193001 fallback can re-issue the request against
-// the master event without duplicating the params / path plumbing.
-func callEventGet(runtime *common.RuntimeContext, calendarID, eventID string) (map[string]interface{}, error) {
-	path := fmt.Sprintf("/open-apis/calendar/v4/calendars/%s/events/%s",
-		validate.EncodePathSegment(calendarID), validate.EncodePathSegment(eventID))
-	params := map[string]interface{}{
-		"user_id_type":     "open_id",
-		"need_attendee":    true,
-		"max_attendee_num": 20,
-	}
-	return runtime.CallAPITyped("GET", path, params, nil)
-}
-
-// recurringMasterEventID inspects a calendar event_id shaped like
-// `{uid}_{original_time}` and returns `{uid}_0` when original_time is a
-// positive integer, plus true so callers know a fallback is worth trying.
-// Any other shape (missing underscore, non-numeric suffix, already `_0`, or
-// suffix `0` / negative) returns "", false so we don't retry pointlessly.
-func recurringMasterEventID(eventID string) (string, bool) {
-	idx := strings.LastIndex(eventID, "_")
-	if idx <= 0 || idx == len(eventID)-1 {
-		return "", false
-	}
-	uid := eventID[:idx]
-	suffix := eventID[idx+1:]
-	n, err := strconv.ParseInt(suffix, 10, 64)
-	if err != nil || n <= 0 {
-		return "", false
-	}
-	return uid + "_0", true
-}
-
-// isEventNotFound returns true when err is a calendar 193001 (event not
-// found) API error. Kept in this file rather than shared with
-// unwrapCalendarAPIError because that helper returns a user-facing hint —
-// here we only need the classification, not the copy.
-func isEventNotFound(err error) bool {
-	if err == nil {
-		return false
-	}
-	var ae *errs.APIError
-	if !errors.As(err, &ae) {
-		return false
-	}
-	return ae.Code == 193001
-}
-
-// roomCheckPlan bundles the resolved inputs for the pre-check API call.
-type roomCheckPlan struct {
-	RoomIDs       []string
-	StartTs       string
-	EndTs         string
-	StartTimezone string
-	Rrule         string
-}
-
-// resolveRoomCheckPlan works out which rooms to check and the target time
-// window. It applies the降级放行 policy: if the event snapshot fails to load
-// but we can proceed with only user-provided inputs (i.e., time changed and a
-// new room is added), the pre-check still runs against those. Otherwise it
-// warns and returns (nil, nil) so the caller skips the check.
-//
-// Returns (nil, nil) when no check is warranted.
-func resolveRoomCheckPlan(ctx context.Context, runtime *common.RuntimeContext, calendarID, eventID string, newStartTs, newEndTs string, timeChanged, rruleChanged bool) (*roomCheckPlan, error) {
-	newRooms := collectAttendeeRoomIDs(runtime.Str("add-attendee-ids"))
-	removeSet := map[string]struct{}{}
-	for _, id := range collectAttendeeRoomIDs(runtime.Str("remove-attendee-ids")) {
-		removeSet[id] = struct{}{}
-	}
-
-	// Fast path: only trigger the check when it can find something to look at.
-	// - New room attendees → always check.
-	// - Time or rrule change → check existing rooms if any.
-	if len(newRooms) == 0 && !timeChanged && !rruleChanged {
-		return nil, nil
-	}
-
-	newRrule := strings.TrimSpace(runtime.Str("rrule"))
-
-	// If we don't need existing rooms and have both start/end, skip the GET.
-	needSnapshot := timeChanged || rruleChanged || !timeChanged && len(newRooms) > 0
-
-	var snap *eventSnapshot
-	if needSnapshot {
-		var err error
-		snap, err = fetchEventSnapshot(ctx, runtime, calendarID, eventID)
-		if err != nil {
-			fmt.Fprintf(runtime.IO().ErrOut,
-				"[calendar +update] warning: failed to fetch current event for room-availability check (%v); precheck runs only against user-supplied inputs — pass --%s to silence\n",
-				err, flagSkipRoomCheck)
-			snap = nil
-		}
-	}
-
-	plan := &roomCheckPlan{
-		StartTs: newStartTs,
-		EndTs:   newEndTs,
-		Rrule:   newRrule,
-	}
-	if plan.StartTs == "" && snap != nil {
-		plan.StartTs = snap.StartTs
-	}
-	if plan.EndTs == "" && snap != nil {
-		plan.EndTs = snap.EndTs
-	}
-	if plan.Rrule == "" && snap != nil {
-		plan.Rrule = snap.Recurrent
-	}
-	if snap != nil {
-		plan.StartTimezone = snap.Timezone
-	}
-
-	seen := map[string]struct{}{}
-	addRoom := func(id string) {
-		if id == "" {
-			return
-		}
-		if _, ok := removeSet[id]; ok {
-			return
-		}
-		if _, ok := seen[id]; ok {
-			return
-		}
-		seen[id] = struct{}{}
-		plan.RoomIDs = append(plan.RoomIDs, id)
-	}
-	for _, id := range newRooms {
-		addRoom(id)
-	}
-	if snap != nil && (timeChanged || rruleChanged) {
-		for _, id := range snap.RoomIDs {
-			addRoom(id)
-		}
-	}
-
-	if len(plan.RoomIDs) == 0 {
-		return nil, nil
-	}
-	// Without a target window the server has no basis to check anything;
-	// prefer degrading gracefully to blocking legitimate updates.
-	if plan.StartTs == "" || plan.EndTs == "" {
-		fmt.Fprintf(runtime.IO().ErrOut,
-			"[calendar +update] warning: room-availability check skipped because start/end could not be resolved; pass --%s to silence\n",
-			flagSkipRoomCheck)
-		return nil, nil
-	}
-	return plan, nil
-}
-
-// roomCheckPlanDurationSec returns the current booking duration in whole
-// seconds derived from the resolved plan's Unix-second window, or 0 when
-// either bound is missing or unparseable. Used to compare against
-// approval_duration_threshold when the API asks for approval.
-func roomCheckPlanDurationSec(plan *roomCheckPlan) int64 {
-	if plan == nil {
-		return 0
-	}
-	start, err := strconv.ParseInt(strings.TrimSpace(plan.StartTs), 10, 64)
-	if err != nil {
-		return 0
-	}
-	end, err := strconv.ParseInt(strings.TrimSpace(plan.EndTs), 10, 64)
-	if err != nil {
-		return 0
-	}
-	if end <= start {
-		return 0
-	}
-	return end - start
-}
-
-// buildRoomCheckBody assembles the request body for room_availability_check.
-// The pre-check API expects start/end as RFC3339 timestamps; we take the
-// Unix-second strings used elsewhere in the update flow and render them in
-// the event's own timezone when available, falling back to the local device
-// timezone so agents on different machines still produce a valid request.
-// start_timezone is an IANA name (e.g. "Asia/Shanghai") copied from the event
-// snapshot; it is omitted when unknown so the server can fall back to its own
-// default.
-func buildRoomCheckBody(calendarID, eventID string, plan *roomCheckPlan) map[string]interface{} {
-	loc := time.Local
-	if plan.StartTimezone != "" {
-		if l, err := time.LoadLocation(plan.StartTimezone); err == nil {
-			loc = l
-		}
-	}
-	body := map[string]interface{}{
-		"calendar_id": calendarID,
-		"event_id":    eventID,
-		"start_time":  formatRoomCheckTime(plan.StartTs, loc),
-		"end_time":    formatRoomCheckTime(plan.EndTs, loc),
-		"room_ids":    plan.RoomIDs,
-	}
-	if plan.StartTimezone != "" {
-		body["start_timezone"] = plan.StartTimezone
-	}
-	if plan.Rrule != "" {
-		body["event_rrule"] = plan.Rrule
-	}
-	return body
-}
-
-// formatRoomCheckTime renders a Unix-second string as RFC3339 in loc.
-// Non-numeric input is returned unchanged so anomalies stay visible instead
-// of being silently rewritten to the epoch.
-func formatRoomCheckTime(unixStr string, loc *time.Location) string {
-	sec, err := strconv.ParseInt(strings.TrimSpace(unixStr), 10, 64)
-	if err != nil {
-		return unixStr
-	}
-	return time.Unix(sec, 0).In(loc).Format(time.RFC3339)
-}
-
-// callRoomAvailabilityCheck posts the availability request and returns per-room
-// results.
-func callRoomAvailabilityCheck(runtime *common.RuntimeContext, body map[string]interface{}) ([]roomAvailability, error) {
-	data, err := runtime.CallAPITyped("POST", roomCheckPath, nil, body)
-	if err != nil {
-		return nil, err
-	}
-	rawList, _ := data["room_availabilitys"].([]interface{})
-	out := make([]roomAvailability, 0, len(rawList))
-	for _, raw := range rawList {
-		m, ok := raw.(map[string]interface{})
-		if !ok {
-			continue
-		}
-		item := roomAvailability{}
-		if v, ok := m["room_id"].(string); ok {
-			item.RoomID = v
-		}
-		if v, ok := m["room_name"].(string); ok {
-			item.RoomName = v
-		}
-		if v, ok := m["status"].(string); ok {
-			item.Status = v
-		}
-		if v, ok := m["unavailable_reason_type"].(string); ok {
-			item.UnavailableReasonType = v
-		}
-		if strat, ok := m["room_strategy"].(map[string]interface{}); ok {
-			item.Strategy = parseRoomStrategy(strat)
-		}
-		if req, ok := m["room_requisition"].(map[string]interface{}); ok {
-			item.Requisition = parseRoomRequisition(req)
-		}
-		if info, ok := m["room_approval_info"].(map[string]interface{}); ok {
-			item.ApprovalInfo = parseRoomApprovalInfo(info)
-		}
-		out = append(out, item)
-	}
-	return out, nil
-}
-
-// parseRoomStrategy extracts the optional strategy fields from a raw API
-// map. Missing / non-string values are dropped so callers only see what the
-// server actually sent.
-func parseRoomStrategy(m map[string]interface{}) *roomStrategy {
-	s := &roomStrategy{}
-	if v, ok := m["single_max_duration"].(string); ok {
-		s.SingleMaxDuration = v
-	}
-	if v, ok := m["max_advance_booking_time"].(string); ok {
-		s.MaxAdvanceBookingTime = v
-	}
-	if v, ok := m["daily_start_time"].(string); ok {
-		s.DailyStartTime = v
-	}
-	if v, ok := m["daily_end_time"].(string); ok {
-		s.DailyEndTime = v
-	}
-	if v, ok := m["timezone"].(string); ok {
-		s.Timezone = v
-	}
-	if v, ok := m["daily_advance_window_release_time"].(string); ok {
-		s.DailyAdvanceWindowReleaseTime = v
-	}
-	return s
-}
-
-// parseRoomRequisition extracts the optional room_requisition block from a
-// raw API map. Missing / non-string values are dropped.
-func parseRoomRequisition(m map[string]interface{}) *roomRequisition {
-	r := &roomRequisition{}
-	if v, ok := m["start_time"].(string); ok {
-		r.StartTime = v
-	}
-	if v, ok := m["end_time"].(string); ok {
-		r.EndTime = v
-	}
-	return r
-}
-
-// parseRoomApprovalInfo extracts the optional room_approval_info block from a
-// raw API map. Missing / non-string values are dropped.
-func parseRoomApprovalInfo(m map[string]interface{}) *roomApprovalInfo {
-	info := &roomApprovalInfo{}
-	if v, ok := m["approval_mode"].(string); ok {
-		info.ApprovalMode = v
-	}
-	if v, ok := m["approval_duration_threshold"].(string); ok {
-		info.ApprovalDurationThreshold = v
-	}
-	return info
-}
-
-// approvalReasonHint composes the per-line phrase for a `need_approval`
-// status. The API returns `room_approval_info` with:
-//
-//   - "all"           → every reservation on this room must be approved.
-//   - "over_duration" → only bookings longer than approval_duration_threshold
-//     need approval. The current event duration (eventDurationSec) is compared
-//     against the threshold so agents can see exactly why approval is being
-//     asked for — and, when the current duration is below the threshold, the
-//     message points at the "shorten it" recovery path.
-//   - anything else   → generic reminder so unknown modes still surface.
-//
-// This function only produces the per-room fragment. The shared recovery
-// clause (attendees-create, client fallback, shorten, pick another room) is
-// appended once by blockOnUnavailableRooms into `.WithHint(...)` so a message
-// with several approval-required rooms doesn't repeat the same recovery
-// paragraph on every line.
-func approvalReasonHint(info *roomApprovalInfo, eventDurationSec int64) string {
-	mode := ""
-	if info != nil {
-		mode = strings.TrimSpace(info.ApprovalMode)
-	}
-	switch mode {
-	case "all":
-		return "this room requires approval for every reservation"
-	case "over_duration":
-		threshold, _ := strconv.ParseInt(strings.TrimSpace(info.ApprovalDurationThreshold), 10, 64)
-		if threshold <= 0 {
-			// Server said approval-by-duration but didn't give a threshold —
-			// keep the mode label so agents don't lose the classification.
-			return "this room requires approval when the booking exceeds a duration threshold"
-		}
-		thresholdPhrase := formatDurationSeconds(info.ApprovalDurationThreshold)
-		if thresholdPhrase == "" {
-			thresholdPhrase = fmt.Sprintf("%d seconds", threshold)
-		}
-		base := fmt.Sprintf("this room requires approval when the booking exceeds %s", thresholdPhrase)
-		if eventDurationSec > 0 {
-			currentPhrase := formatDurationSeconds(strconv.FormatInt(eventDurationSec, 10))
-			if currentPhrase == "" {
-				currentPhrase = fmt.Sprintf("%d seconds", eventDurationSec)
-			}
-			if eventDurationSec >= threshold {
-				base += fmt.Sprintf(" (current duration is %s)", currentPhrase)
-			} else {
-				// Server flagged approval but our duration reads as below the
-				// threshold — surface both so the agent can reconcile rather
-				// than guess.
-				base += fmt.Sprintf(" (current duration reads as %s; server still flagged approval)", currentPhrase)
-			}
-		}
-		return base
-	default:
-		return "this room requires approval before it can be booked"
-	}
-}
-
-// roomLabel renders the room identifier for the block message. When the API
-// returns a human-readable name it becomes `<room_id>[<room_name>]`; a blank
-// name (or an entirely blank id, defensive) degrades to whichever is present
-// so agents can still address the room. The room_id is kept as the primary
-// identifier because callers act on it programmatically. Square brackets are
-// used (rather than parentheses) so a room name that itself contains
-// parentheses — e.g. "Room A (west wing)" — doesn't produce ambiguous nesting
-// like `omm_1(Room A (west wing))`.
-func roomLabel(id, name string) string {
-	id = strings.TrimSpace(id)
-	name = strings.TrimSpace(name)
-	switch {
-	case id != "" && name != "":
-		return fmt.Sprintf("%s[%s]", id, name)
-	case id != "":
-		return id
-	default:
-		return name
-	}
-}
-
-// blockOnUnavailableRooms returns a typed validation error when any room in
-// results is unavailable or requires approval, or nil when everything is
-// bookable. The error text carries per-room reasons plus the retry command
-// hint from the PRD. When the API returns a room_strategy for a blocked room,
-// the relevant limit (max duration, latest bookable time, daily window, or
-// daily release time) is appended after the reason so agents can relay it to
-// the user without making a follow-up request. For a `during_requisition`
-// block, the disabled period (from room_requisition) is appended if available;
-// a "pick a different time or a different room" recovery clause is always
-// appended so the message reads coherently whether or not exact bounds are
-// known.
-//
-// `need_approval` results are treated as blocking (the CLI cannot submit an
-// approval on the user's behalf, so silently PATCHing would surprise the
-// user). The line uses room_approval_info + eventDurationSec to explain the
-// mode ("all" / "over_duration"), the threshold, and — for over_duration —
-// how the current booking compares. The shared "how do I actually recover
-// from approval" clause is folded into the hint once (not per line), so
-// several approval-required rooms don't repeat the same paragraph.
-func blockOnUnavailableRooms(results []roomAvailability, eventDurationSec int64) error {
-	var blocked []roomAvailability
-	for _, r := range results {
-		if r.Status != "available" {
-			blocked = append(blocked, r)
-		}
-	}
-	if len(blocked) == 0 {
-		return nil
-	}
-	var lines []string
-	hasNeedApproval := false
-	for _, r := range blocked {
-		var reason string
-		switch r.Status {
-		case "need_approval":
-			hasNeedApproval = true
-			reason = approvalReasonHint(r.ApprovalInfo, eventDurationSec)
-		default:
-			reason = unavailableReasonHint(r.UnavailableReasonType)
-		}
-		line := fmt.Sprintf("%s: %s", roomLabel(r.RoomID, r.RoomName), reason)
-		if detail := strategyDetail(r.UnavailableReasonType, r.Strategy); detail != "" {
-			line += ", " + detail
-		}
-		if detail := requisitionDetail(r.UnavailableReasonType, r.Requisition); detail != "" {
-			line += ", " + detail
-		}
-		if r.UnavailableReasonType == "during_requisition" {
-			line += "; pick a different time or a different room"
-		}
-		lines = append(lines, line)
-	}
-	msg := "meeting room booking will fail after this event change:\n  " + strings.Join(lines, "\n  ")
-	hint := fmt.Sprintf("do NOT auto-retry: relay the room IDs and reasons above to the user and get explicit confirmation before re-running with --%s.",
-		flagSkipRoomCheck)
-	if hasNeedApproval {
-		hint += " Rooms flagged need_approval: the CLI cannot submit approvals; DO NOT auto-run any recovery — ask the user first, then pick one: (a) newly added room → after the user confirms and provides `approval_reason`, run `lark-cli calendar event.attendees create --as user`; (b) time/rrule change re-triggers approval on an existing room → ask the user to update through the client; (c) shorten the meeting below the threshold or pick a different room."
-	}
-	return errs.NewValidationError(errs.SubtypeFailedPrecondition, "%s", msg).WithHint("%s", hint)
-}

shortcuts/calendar/calendar_test.go

@@ -3368,952 +3368,3 @@ func TestGet_MissingEventField_TypedInternal(t *testing.T) {
 		t.Errorf("subtype=%q, want invalid_response", ie.Subtype)
 	}
 }
-
-// ---------------------------------------------------------------------------
-// CalendarUpdate room-availability precheck tests
-// ---------------------------------------------------------------------------
-
-// eventSnapshotStub builds a GET-event fixture with the given rooms + window
-// so room-check helpers can read a plausible snapshot.
-func eventSnapshotStub(calendarID, eventID, startTs, endTs string, roomIDs ...string) *httpmock.Stub {
-	attendees := make([]interface{}, 0, len(roomIDs))
-	for _, id := range roomIDs {
-		attendees = append(attendees, map[string]interface{}{
-			"type":    "resource",
-			"room_id": id,
-		})
-	}
-	return &httpmock.Stub{
-		Method: "GET",
-		URL:    "/open-apis/calendar/v4/calendars/" + calendarID + "/events/" + eventID,
-		Body: map[string]interface{}{
-			"code": 0, "msg": "ok",
-			"data": map[string]interface{}{
-				"event": map[string]interface{}{
-					"event_id":   eventID,
-					"summary":    "Existing",
-					"start_time": map[string]interface{}{"timestamp": startTs, "timezone": "Asia/Shanghai"},
-					"end_time":   map[string]interface{}{"timestamp": endTs, "timezone": "Asia/Shanghai"},
-					"attendees":  attendees,
-				},
-			},
-		},
-		Reusable: true,
-	}
-}
-
-func TestUpdate_RoomCheck_SkipFlag_BypassesAPI(t *testing.T) {
-	f, _, _, reg := cmdutil.TestFactory(t, defaultConfig())
-
-	// Register the PATCH stub but no room-check stub — the test asserts that no
-	// unmatched request is made.
-	patchStub := &httpmock.Stub{
-		Method: "PATCH",
-		URL:    "/open-apis/calendar/v4/calendars/cal_rc/events/evt_rc1",
-		Body: map[string]interface{}{
-			"code": 0, "msg": "ok",
-			"data": map[string]interface{}{"event": map[string]interface{}{"event_id": "evt_rc1"}},
-		},
-	}
-	reg.Register(patchStub)
-
-	err := mountAndRun(t, CalendarUpdate, []string{
-		"+update",
-		"--event-id", "evt_rc1",
-		"--calendar-id", "cal_rc",
-		"--summary", "Skip",
-		"--start", "2025-03-21T00:00:00+08:00",
-		"--end", "2025-03-21T01:00:00+08:00",
-		"--skip-room-check",
-		"--as", "bot",
-	}, f, nil)
-
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if len(patchStub.CapturedBody) == 0 {
-		t.Fatalf("expected PATCH to be captured")
-	}
-}
-
-func TestUpdate_RoomCheck_TitleOnly_SkipsCheck(t *testing.T) {
-	f, _, _, reg := cmdutil.TestFactory(t, defaultConfig())
-
-	// Only registered PATCH; title-only changes should never trigger room-check
-	// and never fetch the event snapshot.
-	patchStub := &httpmock.Stub{
-		Method: "PATCH",
-		URL:    "/open-apis/calendar/v4/calendars/cal_rc/events/evt_rc2",
-		Body: map[string]interface{}{
-			"code": 0, "msg": "ok",
-			"data": map[string]interface{}{"event": map[string]interface{}{"event_id": "evt_rc2"}},
-		},
-	}
-	reg.Register(patchStub)
-
-	err := mountAndRun(t, CalendarUpdate, []string{
-		"+update",
-		"--event-id", "evt_rc2",
-		"--calendar-id", "cal_rc",
-		"--summary", "New title only",
-		"--as", "bot",
-	}, f, nil)
-
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if len(patchStub.CapturedBody) == 0 {
-		t.Fatalf("expected PATCH to be captured")
-	}
-}
-
-func TestUpdate_RoomCheck_NewRoomAvailable_Allows(t *testing.T) {
-	f, _, _, reg := cmdutil.TestFactory(t, defaultConfig())
-
-	// Snapshot has no existing rooms; we're adding omm_new.
-	reg.Register(eventSnapshotStub("cal_rc", "evt_rc3", "1742515200", "1742518800"))
-
-	checkStub := &httpmock.Stub{
-		Method: "POST",
-		URL:    "/open-apis/calendar/v4/freebusy/room_availability_check",
-		Body: map[string]interface{}{
-			"code": 0, "msg": "ok",
-			"data": map[string]interface{}{
-				"room_availabilitys": []interface{}{
-					map[string]interface{}{"room_id": "omm_new", "status": "available"},
-				},
-			},
-		},
-	}
-	reg.Register(checkStub)
-
-	addStub := &httpmock.Stub{
-		Method: "POST",
-		URL:    "/open-apis/calendar/v4/calendars/cal_rc/events/evt_rc3/attendees",
-		Body:   map[string]interface{}{"code": 0, "msg": "ok", "data": map[string]interface{}{}},
-	}
-	reg.Register(addStub)
-
-	err := mountAndRun(t, CalendarUpdate, []string{
-		"+update",
-		"--event-id", "evt_rc3",
-		"--calendar-id", "cal_rc",
-		"--add-attendee-ids", "omm_new",
-		"--as", "bot",
-	}, f, nil)
-
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if len(checkStub.CapturedBody) == 0 {
-		t.Fatalf("expected room-availability-check to be called")
-	}
-	body := decodeCalendarCapturedBody(t, checkStub)
-	rooms, _ := body["room_ids"].([]interface{})
-	if len(rooms) != 1 || rooms[0] != "omm_new" {
-		t.Fatalf("room_ids should be [omm_new], got %#v", rooms)
-	}
-	if body["calendar_id"] != "cal_rc" || body["event_id"] != "evt_rc3" {
-		t.Fatalf("room-check body missing ids: %#v", body)
-	}
-	if body["start_timezone"] != "Asia/Shanghai" {
-		t.Fatalf("start_timezone should carry snapshot value, got %#v", body["start_timezone"])
-	}
-	if body["start_time"] != "2025-03-21T08:00:00+08:00" {
-		t.Fatalf("start_time should be RFC3339 in event tz, got %#v", body["start_time"])
-	}
-	if body["end_time"] != "2025-03-21T09:00:00+08:00" {
-		t.Fatalf("end_time should be RFC3339 in event tz, got %#v", body["end_time"])
-	}
-	if len(addStub.CapturedBody) == 0 {
-		t.Fatalf("expected add-attendees POST to run")
-	}
-}
-
-func TestUpdate_RoomCheck_NewRoomUnavailable_Blocks(t *testing.T) {
-	f, _, _, reg := cmdutil.TestFactory(t, defaultConfig())
-
-	reg.Register(eventSnapshotStub("cal_rc", "evt_rc4", "1742515200", "1742518800"))
-	reg.Register(&httpmock.Stub{
-		Method: "POST",
-		URL:    "/open-apis/calendar/v4/freebusy/room_availability_check",
-		Body: map[string]interface{}{
-			"code": 0, "msg": "ok",
-			"data": map[string]interface{}{
-				"room_availabilitys": []interface{}{
-					map[string]interface{}{
-						"room_id":                 "omm_busy",
-						"status":                  "unavailable",
-						"unavailable_reason_type": "reserved_by_other_event",
-					},
-				},
-			},
-		},
-	})
-
-	err := mountAndRun(t, CalendarUpdate, []string{
-		"+update",
-		"--event-id", "evt_rc4",
-		"--calendar-id", "cal_rc",
-		"--add-attendee-ids", "omm_busy",
-		"--as", "bot",
-	}, f, nil)
-
-	if err == nil {
-		t.Fatal("expected block error when room is unavailable")
-	}
-	var ve *errs.ValidationError
-	if !errors.As(err, &ve) {
-		t.Fatalf("want *errs.ValidationError, got %T (%v)", err, err)
-	}
-	if ve.Subtype != errs.SubtypeFailedPrecondition {
-		t.Errorf("subtype=%q, want failed_precondition", ve.Subtype)
-	}
-	if !strings.Contains(ve.Message, "omm_busy") {
-		t.Errorf("message should list blocked room id, got: %q", ve.Message)
-	}
-	if !strings.Contains(ve.Hint, "--skip-room-check") {
-		t.Errorf("hint should mention --skip-room-check, got: %q", ve.Hint)
-	}
-}
-
-func TestUpdate_RoomCheck_TimeChanged_ChecksExistingRoom(t *testing.T) {
-	f, _, _, reg := cmdutil.TestFactory(t, defaultConfig())
-
-	// Existing event already has omm_existing booked.
-	reg.Register(eventSnapshotStub("cal_rc", "evt_rc5", "1742515200", "1742518800", "omm_existing"))
-
-	checkStub := &httpmock.Stub{
-		Method: "POST",
-		URL:    "/open-apis/calendar/v4/freebusy/room_availability_check",
-		Body: map[string]interface{}{
-			"code": 0, "msg": "ok",
-			"data": map[string]interface{}{
-				"room_availabilitys": []interface{}{
-					map[string]interface{}{"room_id": "omm_existing", "status": "available"},
-				},
-			},
-		},
-	}
-	reg.Register(checkStub)
-
-	patchStub := &httpmock.Stub{
-		Method: "PATCH",
-		URL:    "/open-apis/calendar/v4/calendars/cal_rc/events/evt_rc5",
-		Body: map[string]interface{}{
-			"code": 0, "msg": "ok",
-			"data": map[string]interface{}{"event": map[string]interface{}{"event_id": "evt_rc5"}},
-		},
-	}
-	reg.Register(patchStub)
-
-	err := mountAndRun(t, CalendarUpdate, []string{
-		"+update",
-		"--event-id", "evt_rc5",
-		"--calendar-id", "cal_rc",
-		"--start", "2025-03-21T02:00:00+08:00",
-		"--end", "2025-03-21T03:00:00+08:00",
-		"--as", "bot",
-	}, f, nil)
-
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if len(checkStub.CapturedBody) == 0 {
-		t.Fatalf("expected room-check to run for existing room on time change")
-	}
-	body := decodeCalendarCapturedBody(t, checkStub)
-	rooms, _ := body["room_ids"].([]interface{})
-	if len(rooms) != 1 || rooms[0] != "omm_existing" {
-		t.Fatalf("room_ids should be [omm_existing], got %#v", rooms)
-	}
-	if len(patchStub.CapturedBody) == 0 {
-		t.Fatalf("expected PATCH to run after check passes")
-	}
-}
-
-func TestUpdate_RoomCheck_APIFailure_DegradesGracefully(t *testing.T) {
-	f, _, stderr, reg := cmdutil.TestFactory(t, defaultConfig())
-
-	reg.Register(eventSnapshotStub("cal_rc", "evt_rc6", "1742515200", "1742518800"))
-	// Simulate room-check API failure (e.g., not yet rolled out) so the CLI
-	// degrades gracefully instead of blocking the update.
-	reg.Register(&httpmock.Stub{
-		Method: "POST",
-		URL:    "/open-apis/calendar/v4/freebusy/room_availability_check",
-		Body: map[string]interface{}{
-			"code": 190001,
-			"msg":  "permission denied",
-		},
-	})
-	addStub := &httpmock.Stub{
-		Method: "POST",
-		URL:    "/open-apis/calendar/v4/calendars/cal_rc/events/evt_rc6/attendees",
-		Body:   map[string]interface{}{"code": 0, "msg": "ok", "data": map[string]interface{}{}},
-	}
-	reg.Register(addStub)
-
-	err := mountAndRun(t, CalendarUpdate, []string{
-		"+update",
-		"--event-id", "evt_rc6",
-		"--calendar-id", "cal_rc",
-		"--add-attendee-ids", "omm_new",
-		"--as", "bot",
-	}, f, nil)
-
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if len(addStub.CapturedBody) == 0 {
-		t.Fatalf("expected add-attendees POST to run despite check failure")
-	}
-	if !strings.Contains(stderr.String(), "room availability check failed") {
-		t.Errorf("stderr should warn about degraded check, got: %q", stderr.String())
-	}
-}
-
-func TestUpdate_RoomCheck_DryRun_IncludesPrecheckStep(t *testing.T) {
-	f, stdout, _, _ := cmdutil.TestFactory(t, defaultConfig())
-
-	err := mountAndRun(t, CalendarUpdate, []string{
-		"+update",
-		"--event-id", "evt_rc7",
-		"--calendar-id", "cal_rc",
-		"--add-attendee-ids", "omm_dryrun",
-		"--start", "2025-03-21T00:00:00+08:00",
-		"--end", "2025-03-21T01:00:00+08:00",
-		"--dry-run",
-		"--as", "bot",
-	}, f, stdout)
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	out := stdout.String()
-	if !strings.Contains(out, "room_availability_check") {
-		t.Fatalf("dry-run should preview room_availability_check, got: %s", out)
-	}
-	if !strings.Contains(out, "Pre-check meeting room availability") {
-		t.Fatalf("dry-run should describe pre-check step, got: %s", out)
-	}
-}
-
-func TestUpdate_RoomCheck_DryRun_SkipFlagOmitsStep(t *testing.T) {
-	f, stdout, _, _ := cmdutil.TestFactory(t, defaultConfig())
-
-	err := mountAndRun(t, CalendarUpdate, []string{
-		"+update",
-		"--event-id", "evt_rc8",
-		"--calendar-id", "cal_rc",
-		"--add-attendee-ids", "omm_dryrun2",
-		"--start", "2025-03-21T00:00:00+08:00",
-		"--end", "2025-03-21T01:00:00+08:00",
-		"--skip-room-check",
-		"--dry-run",
-		"--as", "bot",
-	}, f, stdout)
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	out := stdout.String()
-	if strings.Contains(out, "room_availability_check") {
-		t.Fatalf("dry-run with --skip-room-check should not preview room_availability_check, got: %s", out)
-	}
-}
-
-// TestStrategyDetail_ByReason exercises the human-readable strategy suffix
-// appended to each blocked-room line. Timezone-anchored fields use a fixed
-// IANA name so the offset ("GMT+8") is deterministic across machines.
-func TestStrategyDetail_ByReason(t *testing.T) {
-	tests := []struct {
-		name     string
-		reason   string
-		strategy *roomStrategy
-		want     string
-	}{
-		{
-			name:     "over_max_duration renders as hours",
-			reason:   "over_max_duration",
-			strategy: &roomStrategy{SingleMaxDuration: "10800"},
-			want:     "the max single-booking duration is 3 hours",
-		},
-		{
-			name:     "over_max_duration mixed hours and minutes",
-			reason:   "over_max_duration",
-			strategy: &roomStrategy{SingleMaxDuration: "5400"},
-			want:     "the max single-booking duration is 1 hours 30 minutes",
-		},
-		{
-			name:     "beyond_advance_booking_window surfaces rfc3339 verbatim",
-			reason:   "beyond_advance_booking_window",
-			strategy: &roomStrategy{MaxAdvanceBookingTime: "2026-07-13T18:00:00+08:00", Timezone: "Asia/Shanghai"},
-			want:     "the latest bookable end time is 2026-07-13T18:00:00+08:00",
-		},
-		{
-			name:     "not_in_usable_time renders day-seconds and zone",
-			reason:   "not_in_usable_time",
-			strategy: &roomStrategy{DailyStartTime: "36000", DailyEndTime: "72000", Timezone: "Asia/Shanghai"},
-			want:     "the daily bookable window is 10:00 - 20:00 (GMT+8)",
-		},
-		{
-			name:     "before_daily_advance_window_release renders unlock time and zone",
-			reason:   "before_daily_advance_window_release",
-			strategy: &roomStrategy{DailyAdvanceWindowReleaseTime: "28800", Timezone: "Asia/Shanghai"},
-			want:     "the next unlock happens today at 08:00 (GMT+8), which advances the window by one day",
-		},
-		{
-			name:     "past_time has no strategy suffix",
-			reason:   "past_time",
-			strategy: &roomStrategy{SingleMaxDuration: "10800"},
-			want:     "",
-		},
-		{
-			name:     "nil strategy returns empty",
-			reason:   "over_max_duration",
-			strategy: nil,
-			want:     "",
-		},
-		{
-			name:     "invalid duration returns empty",
-			reason:   "over_max_duration",
-			strategy: &roomStrategy{SingleMaxDuration: "not-a-number"},
-			want:     "",
-		},
-		{
-			name:     "day-seconds out of range returns empty",
-			reason:   "not_in_usable_time",
-			strategy: &roomStrategy{DailyStartTime: "-1", DailyEndTime: "999999", Timezone: "Asia/Shanghai"},
-			want:     "",
-		},
-		{
-			name:     "unresolvable timezone falls back to iana name",
-			reason:   "before_daily_advance_window_release",
-			strategy: &roomStrategy{DailyAdvanceWindowReleaseTime: "28800", Timezone: "Not/AReal_Zone"},
-			want:     "the next unlock happens today at 08:00 (Not/AReal_Zone), which advances the window by one day",
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			got := strategyDetail(tt.reason, tt.strategy)
-			if got != tt.want {
-				t.Errorf("strategyDetail(%q) = %q, want %q", tt.reason, got, tt.want)
-			}
-		})
-	}
-}
-
-// TestUpdate_RoomCheck_StrategyDetailInMessage pins that when the API returns a
-// room_strategy alongside the unavailable_reason_type, blockOnUnavailableRooms
-// surfaces the specific limit inline so agents can relay it to the user
-// without an extra round trip.
-func TestUpdate_RoomCheck_StrategyDetailInMessage(t *testing.T) {
-	f, _, _, reg := cmdutil.TestFactory(t, defaultConfig())
-
-	reg.Register(eventSnapshotStub("cal_rc", "evt_rc_strategy", "1742515200", "1742525200"))
-	reg.Register(&httpmock.Stub{
-		Method: "POST",
-		URL:    "/open-apis/calendar/v4/freebusy/room_availability_check",
-		Body: map[string]interface{}{
-			"code": 0, "msg": "ok",
-			"data": map[string]interface{}{
-				"room_availabilitys": []interface{}{
-					map[string]interface{}{
-						"room_id":                 "omm_toolong",
-						"status":                  "unavailable",
-						"unavailable_reason_type": "over_max_duration",
-						"room_strategy": map[string]interface{}{
-							"single_max_duration": "10800",
-							"timezone":            "Asia/Shanghai",
-						},
-					},
-				},
-			},
-		},
-	})
-
-	err := mountAndRun(t, CalendarUpdate, []string{
-		"+update",
-		"--event-id", "evt_rc_strategy",
-		"--calendar-id", "cal_rc",
-		"--add-attendee-ids", "omm_toolong",
-		"--as", "bot",
-	}, f, nil)
-	if err == nil {
-		t.Fatal("expected block error when strategy limit is hit")
-	}
-	var ve *errs.ValidationError
-	if !errors.As(err, &ve) {
-		t.Fatalf("want *errs.ValidationError, got %T (%v)", err, err)
-	}
-	if !strings.Contains(ve.Message, "the max single-booking duration is 3 hours") {
-		t.Errorf("message should surface the max-duration limit, got: %q", ve.Message)
-	}
-	if !strings.Contains(ve.Message, "omm_toolong") {
-		t.Errorf("message should still list the room id, got: %q", ve.Message)
-	}
-}
-
-// TestRequisitionDetail_ByBounds pins the human-readable suffix rendered for a
-// `during_requisition` block. Every variant (both bounds, start only, end
-// only, none, nil requisition, non-matching reason) must degrade coherently.
-func TestRequisitionDetail_ByBounds(t *testing.T) {
-	tests := []struct {
-		name string
-		req  *roomRequisition
-		want string
-	}{
-		{
-			name: "both bounds surface as verbatim rfc3339 range",
-			req:  &roomRequisition{StartTime: "2026-07-13T09:00:00+08:00", EndTime: "2026-07-13T18:00:00+08:00"},
-			want: "the disabled period is 2026-07-13T09:00:00+08:00 to 2026-07-13T18:00:00+08:00",
-		},
-		{
-			name: "start only",
-			req:  &roomRequisition{StartTime: "2026-07-13T09:00:00+08:00"},
-			want: "the disabled period starts at 2026-07-13T09:00:00+08:00",
-		},
-		{
-			name: "end only",
-			req:  &roomRequisition{EndTime: "2026-07-13T18:00:00+08:00"},
-			want: "the disabled period ends at 2026-07-13T18:00:00+08:00",
-		},
-		{
-			name: "empty bounds return no detail",
-			req:  &roomRequisition{},
-			want: "",
-		},
-		{
-			name: "nil requisition returns empty",
-			req:  nil,
-			want: "",
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			got := requisitionDetail("during_requisition", tt.req)
-			if got != tt.want {
-				t.Errorf("requisitionDetail(during_requisition) = %q, want %q", got, tt.want)
-			}
-		})
-	}
-
-	// Non-matching reason should always short-circuit even with a full payload.
-	if got := requisitionDetail("reserved_by_other_event", &roomRequisition{StartTime: "x", EndTime: "y"}); got != "" {
-		t.Errorf("requisitionDetail should ignore requisition for non-during_requisition reasons, got %q", got)
-	}
-}
-
-// TestUpdate_RoomCheck_RequisitionDetailInMessage pins that when the API
-// returns room_requisition alongside a during_requisition block, the disabled
-// period is surfaced inline and the recovery clause is always present.
-func TestUpdate_RoomCheck_RequisitionDetailInMessage(t *testing.T) {
-	f, _, _, reg := cmdutil.TestFactory(t, defaultConfig())
-
-	reg.Register(eventSnapshotStub("cal_rc", "evt_rc_req", "1742515200", "1742525200"))
-	reg.Register(&httpmock.Stub{
-		Method: "POST",
-		URL:    "/open-apis/calendar/v4/freebusy/room_availability_check",
-		Body: map[string]interface{}{
-			"code": 0, "msg": "ok",
-			"data": map[string]interface{}{
-				"room_availabilitys": []interface{}{
-					map[string]interface{}{
-						"room_id":                 "omm_req",
-						"room_name":               "Meeting Room A",
-						"status":                  "unavailable",
-						"unavailable_reason_type": "during_requisition",
-						"room_requisition": map[string]interface{}{
-							"start_time": "2026-07-13T09:00:00+08:00",
-							"end_time":   "2026-07-13T18:00:00+08:00",
-						},
-					},
-				},
-			},
-		},
-	})
-
-	err := mountAndRun(t, CalendarUpdate, []string{
-		"+update",
-		"--event-id", "evt_rc_req",
-		"--calendar-id", "cal_rc",
-		"--add-attendee-ids", "omm_req",
-		"--as", "bot",
-	}, f, nil)
-	if err == nil {
-		t.Fatal("expected block error for during_requisition")
-	}
-	var ve *errs.ValidationError
-	if !errors.As(err, &ve) {
-		t.Fatalf("want *errs.ValidationError, got %T (%v)", err, err)
-	}
-	if !strings.Contains(ve.Message, "the disabled period is 2026-07-13T09:00:00+08:00 to 2026-07-13T18:00:00+08:00") {
-		t.Errorf("message should surface the disabled period, got: %q", ve.Message)
-	}
-	if !strings.Contains(ve.Message, "pick a different time or a different room") {
-		t.Errorf("message should always include recovery hint, got: %q", ve.Message)
-	}
-	if !strings.Contains(ve.Message, "omm_req[Meeting Room A]") {
-		t.Errorf("message should render room id with human-readable name, got: %q", ve.Message)
-	}
-}
-
-// TestRoomLabel_ByFields pins the room identifier rendering used in the block
-// message. `<room_id>(<room_name>)` when both are present; degrades to
-// whichever is non-empty when the other is missing.
-func TestRoomLabel_ByFields(t *testing.T) {
-	tests := []struct {
-		name string
-		id   string
-		room string
-		want string
-	}{
-		{name: "both present", id: "omm_1", room: "Meeting Room A", want: "omm_1[Meeting Room A]"},
-		{name: "id only", id: "omm_2", room: "", want: "omm_2"},
-		{name: "id only with whitespace name", id: "omm_3", room: "   ", want: "omm_3"},
-		{name: "name only degrades to name", id: "", room: "Room B", want: "Room B"},
-		{name: "both blank returns empty", id: "", room: "", want: ""},
-		{name: "name with parens does not create ambiguous nesting", id: "omm_4", room: "Room A (west wing)", want: "omm_4[Room A (west wing)]"},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			if got := roomLabel(tt.id, tt.room); got != tt.want {
-				t.Errorf("roomLabel(%q, %q) = %q, want %q", tt.id, tt.room, got, tt.want)
-			}
-		})
-	}
-}
-
-// TestRecurringMasterEventID_Shapes pins the recurringMasterEventID contract:
-// only `{uid}_{positive int}` collapses to `{uid}_0`; everything else opts out.
-func TestRecurringMasterEventID_Shapes(t *testing.T) {
-	tests := []struct {
-		in       string
-		wantID   string
-		wantOK   bool
-		scenario string
-	}{
-		{in: "abc_1742515200", wantID: "abc_0", wantOK: true, scenario: "positive suffix collapses to master"},
-		{in: "abc_1", wantID: "abc_0", wantOK: true, scenario: "positive one collapses to master"},
-		{in: "abc_0", wantID: "", wantOK: false, scenario: "already master"},
-		{in: "abc", wantID: "", wantOK: false, scenario: "no underscore"},
-		{in: "_1742515200", wantID: "", wantOK: false, scenario: "empty uid"},
-		{in: "abc_", wantID: "", wantOK: false, scenario: "empty suffix"},
-		{in: "abc_-1", wantID: "", wantOK: false, scenario: "negative suffix"},
-		{in: "abc_xyz", wantID: "", wantOK: false, scenario: "non-numeric suffix"},
-		{in: "abc_def_1742515200", wantID: "abc_def_0", wantOK: true, scenario: "uid may contain underscore"},
-	}
-	for _, tt := range tests {
-		t.Run(tt.scenario, func(t *testing.T) {
-			gotID, gotOK := recurringMasterEventID(tt.in)
-			if gotID != tt.wantID || gotOK != tt.wantOK {
-				t.Errorf("recurringMasterEventID(%q) = (%q, %v), want (%q, %v)", tt.in, gotID, gotOK, tt.wantID, tt.wantOK)
-			}
-		})
-	}
-}
-
-// TestUpdate_RoomCheck_EventNotFound_FallsBackToMaster pins the 193001
-// fallback: when the event_id is `{uid}_{original_time}` and the server
-// answers "event not found", the snapshot GET retries against `{uid}_0`
-// (the recurring master), so the room-check pipeline can still proceed.
-func TestUpdate_RoomCheck_EventNotFound_FallsBackToMaster(t *testing.T) {
-	f, _, _, reg := cmdutil.TestFactory(t, defaultConfig())
-
-	// First GET on the instance event: 193001.
-	instanceStub := &httpmock.Stub{
-		Method: "GET",
-		URL:    "/open-apis/calendar/v4/calendars/cal_rc/events/uid_master_1742515200",
-		Body: map[string]interface{}{
-			"code": 193001,
-			"msg":  "event not found",
-		},
-	}
-	reg.Register(instanceStub)
-
-	// Fallback GET on the master event: 200 with an existing room attendee, so
-	// the pre-check has something to reason about.
-	masterStub := &httpmock.Stub{
-		Method: "GET",
-		URL:    "/open-apis/calendar/v4/calendars/cal_rc/events/uid_master_0",
-		Body: map[string]interface{}{
-			"code": 0, "msg": "ok",
-			"data": map[string]interface{}{
-				"event": map[string]interface{}{
-					"event_id":   "uid_master_0",
-					"summary":    "Weekly sync",
-					"start_time": map[string]interface{}{"timestamp": "1742515200", "timezone": "Asia/Shanghai"},
-					"end_time":   map[string]interface{}{"timestamp": "1742518800", "timezone": "Asia/Shanghai"},
-					"attendees":  []interface{}{map[string]interface{}{"type": "resource", "room_id": "omm_from_master"}},
-				},
-			},
-		},
-	}
-	reg.Register(masterStub)
-
-	// Time change → precheck runs against existing room from the master snapshot.
-	precheckStub := &httpmock.Stub{
-		Method: "POST",
-		URL:    "/open-apis/calendar/v4/freebusy/room_availability_check",
-		Body: map[string]interface{}{
-			"code": 0, "msg": "ok",
-			"data": map[string]interface{}{
-				"room_availabilitys": []interface{}{
-					map[string]interface{}{
-						"room_id": "omm_from_master",
-						"status":  "available",
-					},
-				},
-			},
-		},
-	}
-	reg.Register(precheckStub)
-
-	// PATCH succeeds.
-	patchStub := &httpmock.Stub{
-		Method: "PATCH",
-		URL:    "/open-apis/calendar/v4/calendars/cal_rc/events/uid_master_1742515200",
-		Body: map[string]interface{}{
-			"code": 0, "msg": "ok",
-			"data": map[string]interface{}{"event": map[string]interface{}{"event_id": "uid_master_1742515200"}},
-		},
-	}
-	reg.Register(patchStub)
-
-	err := mountAndRun(t, CalendarUpdate, []string{
-		"+update",
-		"--event-id", "uid_master_1742515200",
-		"--calendar-id", "cal_rc",
-		"--start", "2025-03-21T08:00:00+08:00",
-		"--end", "2025-03-21T09:00:00+08:00",
-		"--as", "bot",
-	}, f, nil)
-	if err != nil {
-		t.Fatalf("expected update to succeed after master fallback, got %v", err)
-	}
-}
-
-// TestApprovalReasonHint_ByMode pins the copy for each supported approval
-// mode, including the over_duration current-vs-threshold branches. The exact
-// phrase matters because agents parse it to decide next steps (relay to user,
-// shorten the meeting, pick another room).
-func TestApprovalReasonHint_ByMode(t *testing.T) {
-	tests := []struct {
-		name           string
-		info           *roomApprovalInfo
-		duration       int64
-		mustContain    []string
-		mustNotContain []string
-	}{
-		{
-			name:     "all mode always needs approval",
-			info:     &roomApprovalInfo{ApprovalMode: "all"},
-			duration: 3600,
-			mustContain: []string{
-				"requires approval for every reservation",
-			},
-			mustNotContain: []string{
-				"the CLI cannot submit approvals",
-				"lark-cli calendar event.attendees create",
-			},
-		},
-		{
-			name:     "over_duration with current above threshold cites both",
-			info:     &roomApprovalInfo{ApprovalMode: "over_duration", ApprovalDurationThreshold: "3600"},
-			duration: 7200,
-			mustContain: []string{
-				"exceeds 1 hours",
-				"current duration is 2 hours",
-			},
-			mustNotContain: []string{
-				"lark-cli calendar event.attendees create",
-			},
-		},
-		{
-			name:     "over_duration with current exactly at threshold treated as over",
-			info:     &roomApprovalInfo{ApprovalMode: "over_duration", ApprovalDurationThreshold: "3600"},
-			duration: 3600,
-			mustContain: []string{
-				"exceeds 1 hours",
-				"current duration is 1 hours",
-			},
-		},
-		{
-			name:     "over_duration with current below threshold surfaces reconciliation",
-			info:     &roomApprovalInfo{ApprovalMode: "over_duration", ApprovalDurationThreshold: "3600"},
-			duration: 1800,
-			mustContain: []string{
-				"exceeds 1 hours",
-				"current duration reads as 30 minutes",
-				"server still flagged approval",
-			},
-		},
-		{
-			name:     "over_duration without threshold keeps mode label",
-			info:     &roomApprovalInfo{ApprovalMode: "over_duration"},
-			duration: 3600,
-			mustContain: []string{
-				"exceeds a duration threshold",
-			},
-			mustNotContain: []string{
-				"the CLI cannot submit approvals",
-			},
-		},
-		{
-			name:     "unknown mode falls back to generic reminder",
-			info:     &roomApprovalInfo{ApprovalMode: "future_mode"},
-			duration: 3600,
-			mustContain: []string{
-				"requires approval before it can be booked",
-			},
-		},
-		{
-			name:     "nil approval info still yields a reminder",
-			info:     nil,
-			duration: 3600,
-			mustContain: []string{
-				"requires approval before it can be booked",
-			},
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			got := approvalReasonHint(tt.info, tt.duration)
-			for _, needle := range tt.mustContain {
-				if !strings.Contains(got, needle) {
-					t.Errorf("approvalReasonHint(%+v, %d) missing %q, got: %q", tt.info, tt.duration, needle, got)
-				}
-			}
-			for _, needle := range tt.mustNotContain {
-				if strings.Contains(got, needle) {
-					t.Errorf("approvalReasonHint(%+v, %d) should not contain %q (that clause belongs in the hint, not the per-line reason), got: %q", tt.info, tt.duration, needle, got)
-				}
-			}
-		})
-	}
-}
-
-// TestUpdate_RoomCheck_NeedApproval_Blocks pins that a status=="need_approval"
-// result blocks the update with a friendly, structured message: mode,
-// threshold, current duration comparison, and the "CLI can't approve" clause.
-// The block error also carries the same retry hint as the unavailable branch
-// so agents don't auto-retry with --skip-room-check.
-func TestUpdate_RoomCheck_NeedApproval_Blocks(t *testing.T) {
-	f, _, _, reg := cmdutil.TestFactory(t, defaultConfig())
-
-	// Snapshot window: 1742515200 -> 1742522400 (2h). Threshold is 1h, so the
-	// current duration is over threshold.
-	reg.Register(eventSnapshotStub("cal_rc", "evt_rc_approval", "1742515200", "1742522400"))
-	reg.Register(&httpmock.Stub{
-		Method: "POST",
-		URL:    "/open-apis/calendar/v4/freebusy/room_availability_check",
-		Body: map[string]interface{}{
-			"code": 0, "msg": "ok",
-			"data": map[string]interface{}{
-				"room_availabilitys": []interface{}{
-					map[string]interface{}{
-						"room_id":   "omm_approval",
-						"room_name": "Executive Room",
-						"status":    "need_approval",
-						"room_approval_info": map[string]interface{}{
-							"approval_mode":               "over_duration",
-							"approval_duration_threshold": "3600",
-						},
-					},
-				},
-			},
-		},
-	})
-
-	err := mountAndRun(t, CalendarUpdate, []string{
-		"+update",
-		"--event-id", "evt_rc_approval",
-		"--calendar-id", "cal_rc",
-		"--add-attendee-ids", "omm_approval",
-		"--as", "bot",
-	}, f, nil)
-	if err == nil {
-		t.Fatal("expected need_approval to block the update")
-	}
-	var ve *errs.ValidationError
-	if !errors.As(err, &ve) {
-		t.Fatalf("want *errs.ValidationError, got %T (%v)", err, err)
-	}
-	if !strings.Contains(ve.Message, "omm_approval[Executive Room]") {
-		t.Errorf("message should render room label, got: %q", ve.Message)
-	}
-	if !strings.Contains(ve.Message, "requires approval when the booking exceeds 1 hours") {
-		t.Errorf("message should carry approval threshold, got: %q", ve.Message)
-	}
-	if !strings.Contains(ve.Message, "current duration is 2 hours") {
-		t.Errorf("message should carry current-vs-threshold comparison, got: %q", ve.Message)
-	}
-	if strings.Contains(ve.Message, "the CLI cannot submit approvals inline") {
-		t.Errorf("recovery clause should live in the hint (not repeated per line in the message), got message: %q", ve.Message)
-	}
-	if strings.Contains(ve.Message, "lark-cli calendar event.attendees create --as user") {
-		t.Errorf("attendees-create recovery clause should live in the hint (not per line), got message: %q", ve.Message)
-	}
-	if !strings.Contains(ve.Hint, "the CLI cannot submit approvals") {
-		t.Errorf("hint should carry the approval recovery clause once, got: %q", ve.Hint)
-	}
-	if !strings.Contains(ve.Hint, "DO NOT auto-run") {
-		t.Errorf("hint should forbid auto-running any approval recovery path without user confirmation, got: %q", ve.Hint)
-	}
-	if !strings.Contains(ve.Hint, "ask the user first") {
-		t.Errorf("hint should require asking the user before picking a recovery path, got: %q", ve.Hint)
-	}
-	if !strings.Contains(ve.Hint, "lark-cli calendar event.attendees create --as user") {
-		t.Errorf("hint should point at the attendees-create recovery path, got: %q", ve.Hint)
-	}
-	if !strings.Contains(ve.Hint, "update through the client") {
-		t.Errorf("hint should mention the client-side fallback for re-approval on existing rooms, got: %q", ve.Hint)
-	}
-	if !strings.Contains(ve.Hint, flagSkipRoomCheck) {
-		t.Errorf("hint should still mention --%s, got: %q", flagSkipRoomCheck, ve.Hint)
-	}
-}
-
-// TestUpdate_RoomCheck_RequisitionMissingBoundsStillCoherent pins that when
-// the API returns during_requisition without room_requisition, the recovery
-// hint keeps the line coherent on its own.
-func TestUpdate_RoomCheck_RequisitionMissingBoundsStillCoherent(t *testing.T) {
-	f, _, _, reg := cmdutil.TestFactory(t, defaultConfig())
-
-	reg.Register(eventSnapshotStub("cal_rc", "evt_rc_req2", "1742515200", "1742525200"))
-	reg.Register(&httpmock.Stub{
-		Method: "POST",
-		URL:    "/open-apis/calendar/v4/freebusy/room_availability_check",
-		Body: map[string]interface{}{
-			"code": 0, "msg": "ok",
-			"data": map[string]interface{}{
-				"room_availabilitys": []interface{}{
-					map[string]interface{}{
-						"room_id":                 "omm_req_nobounds",
-						"status":                  "unavailable",
-						"unavailable_reason_type": "during_requisition",
-					},
-				},
-			},
-		},
-	})
-
-	err := mountAndRun(t, CalendarUpdate, []string{
-		"+update",
-		"--event-id", "evt_rc_req2",
-		"--calendar-id", "cal_rc",
-		"--add-attendee-ids", "omm_req_nobounds",
-		"--as", "bot",
-	}, f, nil)
-	if err == nil {
-		t.Fatal("expected block error for during_requisition without bounds")
-	}
-	var ve *errs.ValidationError
-	if !errors.As(err, &ve) {
-		t.Fatalf("want *errs.ValidationError, got %T (%v)", err, err)
-	}
-	if strings.Contains(ve.Message, "the disabled period") {
-		t.Errorf("message should not fabricate a disabled period, got: %q", ve.Message)
-	}
-	if !strings.Contains(ve.Message, "pick a different time or a different room") {
-		t.Errorf("message should always include recovery hint, got: %q", ve.Message)
-	}
-}

shortcuts/calendar/calendar_update.go

@@ -36,7 +36,6 @@ var CalendarUpdate = common.Shortcut{
 		{Name: "add-attendee-ids", Desc: "attendee IDs to add, comma-separated (supports user ou_, chat oc_, room omm_)"},
 		{Name: "remove-attendee-ids", Desc: "attendee IDs to remove, comma-separated (supports user ou_, chat oc_, room omm_)"},
 		{Name: "notify", Type: "bool", Default: "true", Desc: "send update notification to attendees"},
-		{Name: flagSkipRoomCheck, Type: "bool", Default: "false", Hidden: true, Desc: "skip meeting-room availability precheck (default checks rooms whenever a new room is added or the time/rrule of a room-attached event changes)"},
 	},
 	Validate: func(ctx context.Context, runtime *common.RuntimeContext) error {
 		return validateCalendarUpdate(runtime)
@@ -220,50 +219,6 @@ func calendarUpdateAttendeesPath(calendarID, eventID string) string {
 	return calendarUpdateEventPath(calendarID, eventID) + "/attendees"
 }
 
-// runRoomAvailabilityPrecheck checks any room affected by this update (new
-// room attendees, or existing rooms when the time/rrule shifts) against the
-// server before the PATCH is issued. It returns nil to allow the update to
-// proceed and a typed error to block it. Called only when --skip-room-check
-// is false.
-func runRoomAvailabilityPrecheck(ctx context.Context, runtime *common.RuntimeContext, calendarID, eventID string, body map[string]interface{}) error {
-	timeChanged := runtime.Cmd.Flags().Changed("start") && runtime.Cmd.Flags().Changed("end")
-	rruleChanged := runtime.Cmd.Flags().Changed("rrule")
-
-	var newStartTs, newEndTs string
-	if timeChanged {
-		if m, _ := body["start_time"].(map[string]string); m != nil {
-			newStartTs = m["timestamp"]
-		}
-		if m, _ := body["end_time"].(map[string]string); m != nil {
-			newEndTs = m["timestamp"]
-		}
-	}
-
-	plan, err := resolveRoomCheckPlan(ctx, runtime, calendarID, eventID, newStartTs, newEndTs, timeChanged, rruleChanged)
-	if err != nil {
-		return err
-	}
-	if plan == nil {
-		return nil
-	}
-	results, err := callRoomAvailabilityCheck(runtime, buildRoomCheckBody(calendarID, eventID, plan))
-	if err != nil {
-		// Degrade gracefully: warn on stderr and let the update proceed so the
-		// pre-check API doesn't gate legitimate updates when it hiccups. For
-		// 190014 (invalid_parameters) surface the server-supplied field-level
-		// detail so agents can see why the precheck refused.
-		msg := unwrapCalendarAPIError(err)
-		if msg == "" {
-			msg = err.Error()
-		}
-		fmt.Fprintf(runtime.IO().ErrOut,
-			"[calendar +update] warning: room availability check failed (%s); proceeding with update — pass --%s to silence\n",
-			msg, flagSkipRoomCheck)
-		return nil
-	}
-	return blockOnUnavailableRooms(results, roomCheckPlanDurationSec(plan))
-}
-
 func dryRunCalendarUpdate(runtime *common.RuntimeContext) *common.DryRunAPI {
 	calendarID, eventID := calendarUpdateIDs(runtime)
 	displayCalendarID := calendarID
@@ -291,33 +246,6 @@ func dryRunCalendarUpdate(runtime *common.RuntimeContext) *common.DryRunAPI {
 		d.Desc("multi-step update: event fields, attendee removal, and attendee addition run in order when requested")
 	}
 	steps := 0
-
-	if !runtime.Bool(flagSkipRoomCheck) {
-		newRooms := collectAttendeeRoomIDs(runtime.Str("add-attendee-ids"))
-		timeChanged := runtime.Cmd.Flags().Changed("start") && runtime.Cmd.Flags().Changed("end")
-		rruleChanged := runtime.Cmd.Flags().Changed("rrule")
-		if len(newRooms) > 0 || timeChanged || rruleChanged {
-			steps++
-			desc := fmt.Sprintf("[%d] Pre-check meeting room availability (default; pass --%s to skip)", steps, flagSkipRoomCheck)
-			previewBody := map[string]interface{}{
-				"calendar_id":    displayCalendarID,
-				"event_id":       eventID,
-				"room_ids":       newRooms,
-				"start_timezone": "<inherited from event>",
-			}
-			if start, _ := body["start_time"].(map[string]string); start != nil {
-				previewBody["start_time"] = formatRoomCheckTime(start["timestamp"], time.Local)
-			}
-			if end, _ := body["end_time"].(map[string]string); end != nil {
-				previewBody["end_time"] = formatRoomCheckTime(end["timestamp"], time.Local)
-			}
-			if rrule, _ := body["recurrence"].(string); rrule != "" {
-				previewBody["event_rrule"] = rrule
-			}
-			d.POST(roomCheckPath).Desc(desc).Body(previewBody)
-		}
-	}
-
 	if hasEventFields {
 		steps++
 		d.PATCH("/open-apis/calendar/v4/calendars/:calendar_id/events/:event_id").
@@ -350,7 +278,7 @@ func dryRunCalendarUpdate(runtime *common.RuntimeContext) *common.DryRunAPI {
 	return d
 }
 
-func executeCalendarUpdate(ctx context.Context, runtime *common.RuntimeContext) error {
+func executeCalendarUpdate(_ context.Context, runtime *common.RuntimeContext) error {
 	calendarID, eventID := calendarUpdateIDs(runtime)
 	if eventID == "" {
 		return errs.NewValidationError(errs.SubtypeInvalidArgument, "specify --event-id").WithParam("--event-id")
@@ -361,12 +289,6 @@ func executeCalendarUpdate(ctx context.Context, runtime *common.RuntimeContext)
 		return err
 	}
 
-	if !runtime.Bool(flagSkipRoomCheck) {
-		if err := runRoomAvailabilityPrecheck(ctx, runtime, calendarID, eventID, body); err != nil {
-			return err
-		}
-	}
-
 	completed := []string{}
 	event := map[string]interface{}{}
 	if hasEventFields {

shortcuts/common/permission_grant.go

@@ -14,10 +14,11 @@ import (
 )
 
 const (
-	PermissionGrantGranted = "granted"
-	PermissionGrantSkipped = "skipped"
-	PermissionGrantFailed  = "failed"
-	permissionGrantPerm    = "full_access"
+	PermissionGrantGranted  = "granted"
+	PermissionGrantSkipped  = "skipped"
+	PermissionGrantFailed   = "failed"
+	permissionGrantPerm     = "full_access"
+	permissionGrantPermHint = "可管理权限"
 )
 
 // AutoGrantCurrentUserDrivePermission grants full_access on a newly created
@@ -120,7 +121,7 @@ func buildPermissionGrantResult(status, userOpenID, message, reason string) map[
 }
 
 func permissionGrantPermMessage() string {
-	return permissionGrantPerm
+	return permissionGrantPerm + " (" + permissionGrantPermHint + ")"
 }
 
 func permissionGrantPermType(resourceType string) string {

shortcuts/common/permission_grant_test.go

@@ -31,14 +31,6 @@ func apiErrWithScopes(code int, msg string, subjects ...string) error {
 	return errclass.BuildAPIError(resp, errclass.ClassifyContext{})
 }
 
-func TestPermissionGrantPermMessageUsesAPINameOnly(t *testing.T) {
-	t.Parallel()
-
-	if got := permissionGrantPermMessage(); got != "full_access" {
-		t.Fatalf("permissionGrantPermMessage() = %q, want %q", got, "full_access")
-	}
-}
-
 func TestAutoGrantStderrWarning_SkippedNoUser(t *testing.T) {
 	config := &core.CliConfig{
 		AppID:     "perm-grant-test-skip",

shortcuts/doc/docs_create_test.go

@@ -63,7 +63,7 @@ func TestDocsCreateV2BotAutoGrantSuccess(t *testing.T) {
 	if grant["user_open_id"] != "ou_current_user" {
 		t.Fatalf("permission_grant.user_open_id = %#v, want %q", grant["user_open_id"], "ou_current_user")
 	}
-	if grant["message"] != "Granted the current CLI user full_access on the new document." {
+	if grant["message"] != "Granted the current CLI user full_access (可管理权限) on the new document." {
 		t.Fatalf("permission_grant.message = %#v", grant["message"])
 	}
 
@@ -173,9 +173,11 @@ func TestDocsCreateV2BotAutoGrantFailureDoesNotFailCreate(t *testing.T) {
 	if grant["status"] != common.PermissionGrantFailed {
 		t.Fatalf("permission_grant.status = %#v, want %q", grant["status"], common.PermissionGrantFailed)
 	}
-	wantMessage := "Resource was created, but granting current user full_access failed: no permission. You can retry later or continue using bot identity."
-	if grant["message"] != wantMessage {
-		t.Fatalf("permission_grant.message = %q, want %q", grant["message"], wantMessage)
+	if !strings.Contains(grant["message"].(string), "full_access (可管理权限)") {
+		t.Fatalf("permission_grant.message = %q, want permission hint", grant["message"])
+	}
+	if !strings.Contains(grant["message"].(string), "retry later") {
+		t.Fatalf("permission_grant.message = %q, want retry guidance", grant["message"])
 	}
 	if !strings.Contains(stderr.String(), "auto-grant failed") {
 		t.Fatalf("stderr missing auto-grant failed warning; got:\n%s", stderr.String())

shortcuts/doc/docs_create_v2.go

@@ -59,7 +59,7 @@ func dryRunCreateV2(_ context.Context, runtime *common.RuntimeContext) *common.D
 	}
 	desc := "OpenAPI: create document"
 	if runtime.IsBot() {
-		desc += ". After document creation succeeds in bot mode, the CLI will also try to grant the current CLI user full_access on the new document."
+		desc += ". After document creation succeeds in bot mode, the CLI will also try to grant the current CLI user full_access (可管理权限) on the new document."
 	}
 	return common.NewDryRunAPI().
 		POST("/open-apis/docs_ai/v1/documents").

shortcuts/doc/docs_fetch_im_markdown.go

@@ -73,10 +73,10 @@ func init() {
 	registerIMMarkdownHandler("time", handleIMMarkdownDiscard)
 	registerIMMarkdownHandler("whiteboard", handleIMMarkdownInlineCode)
 	registerIMMarkdownHandler("sheet", handleIMMarkdownSheet)
-	registerIMMarkdownHandler("task", handleIMMarkdownConditionalResourceLabel("Task", "task-id", "guid", "token", "id"))
-	registerIMMarkdownHandler("chat_card", handleIMMarkdownConditionalResourceLabel("Chat card", "chat-id", "chat_id", "id"))
-	registerIMMarkdownHandler("bitable", handleIMMarkdownResourceLabel("Base"))
-	registerIMMarkdownHandler("base_refer", handleIMMarkdownResourceLabel("Base"))
+	registerIMMarkdownHandler("task", handleIMMarkdownConditionalResourceLabel("任务", "task-id", "guid", "token", "id"))
+	registerIMMarkdownHandler("chat_card", handleIMMarkdownConditionalResourceLabel("群聊卡片", "chat-id", "chat_id", "id"))
+	registerIMMarkdownHandler("bitable", handleIMMarkdownResourceLabel("多维表格"))
+	registerIMMarkdownHandler("base_refer", handleIMMarkdownResourceLabel("多维表格"))
 	registerIMMarkdownHandler("okr", handleIMMarkdownResourceLabel("OKR"))
 	registerIMMarkdownHandler("poll", handleIMMarkdownDiscard)
 	registerIMMarkdownHandler("agenda", handleIMMarkdownDiscard)

shortcuts/doc/docs_fetch_im_markdown_test.go

@@ -975,8 +975,8 @@ func TestConvertToIMMarkdownDocumentExpectedTagsAndEscaping(t *testing.T) {
 		"````Go\nfmt.Println(\"hi\")\n```\n````",
 		"`` `edge` `` $E=mc^2$ --- ![A \\[img\\]](https://example.com/i%281%29.png)",
 		"``report`v1`.pdf``",
-		"`Task``Chat card`",
-		"`Base``Base``OKR`",
+		"`任务``群聊卡片`",
+		"`多维表格``多维表格``OKR`",
 	}, "\n")
 
 	if got := convertToIMMarkdown(input, imCtx); got != want {

shortcuts/doc/docs_fetch_v2.go

@@ -26,7 +26,7 @@ func v2FetchFlags() []common.Flag {
 		{Name: "scope", Desc: "read scope; full reads whole doc, outline lists headings, section expands from heading anchor, range uses block ids, keyword searches text", Default: "full", Enum: []string{"full", "outline", "range", "keyword", "section"}},
 		{Name: "start-block-id", Desc: "range/section anchor block id; required for section and optional start for range"},
 		{Name: "end-block-id", Desc: "range end block id; -1 means through document end"},
-		{Name: "keyword", Desc: "keyword scope query; supports case-insensitive substring/regex fallback and '|' OR branches, e.g. foo|bar or bug|error"},
+		{Name: "keyword", Desc: "keyword scope query; supports case-insensitive substring/regex fallback and '|' OR branches, e.g. foo|bar or bug|缺陷"},
 		{Name: "context-before", Desc: "range/keyword/section context: sibling blocks before selected top-level blocks", Type: "int", Default: "0"},
 		{Name: "context-after", Desc: "range/keyword/section context: sibling blocks after selected top-level blocks", Type: "int", Default: "0"},
 		{Name: "max-depth", Desc: "outline heading level cap; other scopes subtree depth where -1 is unlimited and 0 is block only", Type: "int", Default: "-1"},

shortcuts/doc/docs_fetch_v2_test.go

@@ -443,7 +443,7 @@ func TestValidateReadModeFlagsAcceptsValidScopeOptions(t *testing.T) {
 			name: "keyword with keyword",
 			setFlags: map[string]string{
 				"scope":   "keyword",
-				"keyword": "bug|error",
+				"keyword": "bug|缺陷",
 			},
 		},
 		{

shortcuts/doc/docs_update_v2.go

@@ -24,7 +24,7 @@ var validCommandsV2 = map[string]bool{
 	"append":                  true,
 }
 
-const docsReferenceMapFlagDesc = "Structured `reference_map` JSON object; must be used with `--content`. Prefer embedding structure directly in the document body for ordinary writes; use `--reference-map` primarily to preserve or replay an existing `document.reference_map`. Accepts inline JSON, `@reference-map.json` (relative path), or `-` to read from stdin."
+const docsReferenceMapFlagDesc = "结构化 `reference_map` JSON object；必须与 `--content` 一起使用。普通写入优先把结构写在正文里；`--reference-map` 主要用于保留或回放已有 `document.reference_map`。支持直接 JSON、`@reference-map.json`（相对路径）或 `-` 从 stdin 读取。"
 
 const docsUpdateReferenceMapFlagDesc = docsReferenceMapFlagDesc
 

shortcuts/doc/html5_block_resources_test.go

@@ -19,8 +19,6 @@ import (
 )
 
 func TestDocsV2ReferenceMapFlagIsPublicFileInput(t *testing.T) {
-	wantDesc := "Structured `reference_map` JSON object; must be used with `--content`. Prefer embedding structure directly in the document body for ordinary writes; use `--reference-map` primarily to preserve or replay an existing `document.reference_map`. Accepts inline JSON, `@reference-map.json` (relative path), or `-` to read from stdin."
-
 	for name, flags := range map[string][]common.Flag{
 		"create": v2CreateFlags(),
 		"update": v2UpdateFlags(),
@@ -36,8 +34,8 @@ func TestDocsV2ReferenceMapFlagIsPublicFileInput(t *testing.T) {
 			if !hasDocsTestInput(flag, common.File) || !hasDocsTestInput(flag, common.Stdin) {
 				t.Fatalf("reference-map Input = %#v, want file and stdin", flag.Input)
 			}
-			if flag.Desc != wantDesc {
-				t.Fatalf("reference-map help = %q, want English description %q", flag.Desc, wantDesc)
+			if !strings.Contains(flag.Desc, "@reference-map.json") {
+				t.Fatalf("reference-map help should mention @file support, got %q", flag.Desc)
 			}
 		})
 	}

shortcuts/drive/drive_add_comment.go

@@ -772,7 +772,7 @@ func parseCommentReplyElements(raw string) ([]map[string]interface{}, error) {
 
 	var inputs []commentReplyElementInput
 	if err := json.Unmarshal([]byte(raw), &inputs); err != nil {
-		return nil, errs.NewValidationError(errs.SubtypeInvalidArgument, "--content is not valid JSON: %s\nexample: --content '[{\"type\":\"text\",\"text\":\"Example text\"}]'", err).WithParam("--content")
+		return nil, errs.NewValidationError(errs.SubtypeInvalidArgument, "--content is not valid JSON: %s\nexample: --content '[{\"type\":\"text\",\"text\":\"文本信息\"}]'", err).WithParam("--content")
 	}
 	if len(inputs) == 0 {
 		return nil, errs.NewValidationError(errs.SubtypeInvalidArgument, "--content must contain at least one reply element").WithParam("--content")

shortcuts/drive/drive_create_folder.go

@@ -59,7 +59,7 @@ var DriveCreateFolder = common.Shortcut{
 			Desc("[1] Create folder").
 			Body(spec.RequestBody())
 		if runtime.IsBot() {
-			dry.Desc("After folder creation succeeds in bot mode, the CLI will also try to grant the current CLI user full_access on the new folder.")
+			dry.Desc("After folder creation succeeds in bot mode, the CLI will also try to grant the current CLI user full_access (可管理权限) on the new folder.")
 		}
 		return dry
 	},

shortcuts/drive/drive_create_folder_test.go

@@ -90,7 +90,6 @@ func TestDriveCreateFolderDryRunIncludesCreateRequest(t *testing.T) {
 		API []struct {
 			Method string                 `json:"method"`
 			URL    string                 `json:"url"`
-			Desc   string                 `json:"desc"`
 			Body   map[string]interface{} `json:"body"`
 		} `json:"api"`
 	}
@@ -109,10 +108,6 @@ func TestDriveCreateFolderDryRunIncludesCreateRequest(t *testing.T) {
 	if got.API[0].Body["folder_token"] != "fld_parent" {
 		t.Fatalf("folder_token = %#v, want %q", got.API[0].Body["folder_token"], "fld_parent")
 	}
-	wantDesc := "After folder creation succeeds in bot mode, the CLI will also try to grant the current CLI user full_access on the new folder."
-	if got.API[0].Desc != wantDesc {
-		t.Fatalf("desc = %q, want %q", got.API[0].Desc, wantDesc)
-	}
 }
 
 func TestDriveCreateFolderBotAutoGrantSuccess(t *testing.T) {
@@ -183,7 +178,7 @@ func TestDriveCreateFolderBotAutoGrantSuccess(t *testing.T) {
 	if grant["user_open_id"] != "ou_current_user" {
 		t.Fatalf("permission_grant.user_open_id = %#v, want %q", grant["user_open_id"], "ou_current_user")
 	}
-	if grant["message"] != "Granted the current CLI user full_access on the new folder." {
+	if grant["message"] != "Granted the current CLI user full_access (可管理权限) on the new folder." {
 		t.Fatalf("permission_grant.message = %#v", grant["message"])
 	}
 

shortcuts/drive/drive_import.go

@@ -114,7 +114,7 @@ func PlanImportDryRun(runtime *common.RuntimeContext, p ImportParams) *common.Dr
 		Desc("[3] Poll import task result").
 		Set("ticket", "<ticket>")
 	if runtime.IsBot() {
-		dry.Desc("After the import result returns the final cloud document target in bot mode, the CLI will also try to grant the current CLI user full_access on it.")
+		dry.Desc("After the import result returns the final cloud document target in bot mode, the CLI will also try to grant the current CLI user full_access (可管理权限) on it.")
 	}
 
 	return dry

shortcuts/drive/drive_import_test.go

@@ -95,7 +95,7 @@ func TestDriveImportDryRunUsesExtensionlessDefaultName(t *testing.T) {
 		t.Fatalf("set --folder-token: %v", err)
 	}
 
-	runtime := common.TestNewRuntimeContextWithIdentity(cmd, nil, core.AsBot)
+	runtime := common.TestNewRuntimeContextWithCtx(context.Background(), cmd, nil)
 	dry := DriveImport.DryRun(context.Background(), runtime)
 	if dry == nil {
 		t.Fatal("DryRun returned nil")
@@ -108,7 +108,6 @@ func TestDriveImportDryRunUsesExtensionlessDefaultName(t *testing.T) {
 
 	var got struct {
 		API []struct {
-			Desc string                 `json:"desc"`
 			Body map[string]interface{} `json:"body"`
 		} `json:"api"`
 	}
@@ -118,10 +117,6 @@ func TestDriveImportDryRunUsesExtensionlessDefaultName(t *testing.T) {
 	if len(got.API) != 4 {
 		t.Fatalf("expected 4 API calls, got %d", len(got.API))
 	}
-	wantDesc := "After the import result returns the final cloud document target in bot mode, the CLI will also try to grant the current CLI user full_access on it."
-	if got.API[len(got.API)-1].Desc != wantDesc {
-		t.Fatalf("desc = %q, want %q", got.API[len(got.API)-1].Desc, wantDesc)
-	}
 
 	if got.API[0].Body != nil {
 		t.Fatalf("wiki probe should not have a request body, got %#v", got.API[0].Body)

shortcuts/drive/drive_io_test.go

@@ -1088,7 +1088,7 @@ func TestDriveUploadDryRunUsesWikiTarget(t *testing.T) {
 		t.Fatalf("set --wiki-token: %v", err)
 	}
 
-	runtime := common.TestNewRuntimeContextWithIdentity(cmd, nil, core.AsBot)
+	runtime := common.TestNewRuntimeContextWithCtx(context.Background(), cmd, nil)
 	dry := DriveUpload.DryRun(context.Background(), runtime)
 	if dry == nil {
 		t.Fatal("DryRun returned nil")
@@ -1100,8 +1100,7 @@ func TestDriveUploadDryRunUsesWikiTarget(t *testing.T) {
 	}
 
 	var got struct {
-		PostUploadNote string `json:"post_upload_note"`
-		API            []struct {
+		API []struct {
 			URL  string                 `json:"url"`
 			Body map[string]interface{} `json:"body"`
 		} `json:"api"`
@@ -1124,10 +1123,6 @@ func TestDriveUploadDryRunUsesWikiTarget(t *testing.T) {
 	if got.API[1].Body["with_url"] != true {
 		t.Fatalf("metadata with_url = %#v, want true", got.API[1].Body["with_url"])
 	}
-	wantPostUploadNote := "After file upload succeeds in bot mode, the CLI will also try to grant the current CLI user full_access on the new file."
-	if got.PostUploadNote != wantPostUploadNote {
-		t.Fatalf("post_upload_note = %q, want %q", got.PostUploadNote, wantPostUploadNote)
-	}
 }
 
 func TestNewDriveUploadSpecPreservesPathAndName(t *testing.T) {

shortcuts/drive/drive_permission_grant_test.go

@@ -65,7 +65,7 @@ func TestDriveUploadBotAutoGrantSuccess(t *testing.T) {
 	if grant["user_open_id"] != "ou_current_user" {
 		t.Fatalf("permission_grant.user_open_id = %#v, want %q", grant["user_open_id"], "ou_current_user")
 	}
-	if grant["message"] != "Granted the current CLI user full_access on the new file." {
+	if grant["message"] != "Granted the current CLI user full_access (可管理权限) on the new file." {
 		t.Fatalf("permission_grant.message = %#v", grant["message"])
 	}
 

shortcuts/drive/drive_upload.go

@@ -103,7 +103,7 @@ var DriveUpload = common.Shortcut{
 		"Omit both --folder-token and --wiki-token to upload into the caller's Drive root folder.",
 		"Use --wiki-token <wiki_node_token> to upload under a wiki node; the shortcut maps this to parent_type=wiki automatically.",
 		"Pass --file-token <file_token> to overwrite an existing Drive file in place; the shortcut forwards file_token to the upload API.",
-		"In bot mode, automatic full_access grant only applies to newly uploaded files; overwrite via --file-token does not modify existing file permissions.",
+		"In bot mode, automatic full_access (可管理权限) grant only applies to newly uploaded files; overwrite via --file-token does not modify existing file permissions.",
 	},
 	Validate: func(ctx context.Context, runtime *common.RuntimeContext) error {
 		return validateDriveUploadSpec(runtime, newDriveUploadSpec(runtime))
@@ -137,7 +137,7 @@ var DriveUpload = common.Shortcut{
 				"with_url": true,
 			})
 		if runtime.IsBot() && !isOverwrite {
-			d.Set("post_upload_note", "After file upload succeeds in bot mode, the CLI will also try to grant the current CLI user full_access on the new file.")
+			d.Set("post_upload_note", "After file upload succeeds in bot mode, the CLI will also try to grant the current CLI user full_access (可管理权限) on the new file.")
 		}
 		return d
 	},

shortcuts/drive/shortcuts_test.go

@@ -5,7 +5,6 @@ package drive
 
 import (
 	"reflect"
-	"strings"
 	"testing"
 )
 
@@ -72,18 +71,3 @@ func TestDriveSearchSupportsUserAndBotIdentity(t *testing.T) {
 		t.Fatalf("DriveSearch.AuthTypes = %v, want %v", DriveSearch.AuthTypes, want)
 	}
 }
-
-func TestDriveUploadHelpTipUsesEnglishPermissionName(t *testing.T) {
-	t.Parallel()
-
-	want := "In bot mode, automatic full_access grant only applies to newly uploaded files; overwrite via --file-token does not modify existing file permissions."
-	for _, tip := range DriveUpload.Tips {
-		if strings.Contains(tip, "automatic full_access") {
-			if tip != want {
-				t.Fatalf("DriveUpload full_access tip = %q, want %q", tip, want)
-			}
-			return
-		}
-	}
-	t.Fatal("DriveUpload full_access help tip not found")
-}

shortcuts/sheets/backward/lark_sheets_sheet_create_test.go

@@ -64,7 +64,7 @@ func TestSheetCreateBotAutoGrantSuccess(t *testing.T) {
 	if grant["user_open_id"] != "ou_current_user" {
 		t.Fatalf("permission_grant.user_open_id = %#v, want %q", grant["user_open_id"], "ou_current_user")
 	}
-	if grant["message"] != "Granted the current CLI user full_access on the new spreadsheet." {
+	if grant["message"] != "Granted the current CLI user full_access (可管理权限) on the new spreadsheet." {
 		t.Fatalf("permission_grant.message = %#v", grant["message"])
 	}
 
@@ -156,26 +156,10 @@ func TestSheetCreateDryRunIncludesFolderToken(t *testing.T) {
 			"data":         "",
 		},
 		nil, nil)
-	rt = common.TestNewRuntimeContextWithIdentity(rt.Cmd, nil, core.AsBot)
 	got := mustMarshalSheetsDryRun(t, SheetCreate.DryRun(context.Background(), rt))
 	if !strings.Contains(got, `"folder_token":"fldcn123"`) {
 		t.Fatalf("DryRun should include folder_token, got: %s", got)
 	}
-	var dryRun struct {
-		API []struct {
-			Desc string `json:"desc"`
-		} `json:"api"`
-	}
-	if err := json.Unmarshal([]byte(got), &dryRun); err != nil {
-		t.Fatalf("unmarshal dry run: %v", err)
-	}
-	if len(dryRun.API) != 1 {
-		t.Fatalf("dry-run API count = %d, want 1", len(dryRun.API))
-	}
-	wantDesc := "After spreadsheet creation succeeds in bot mode, the CLI will also try to grant the current CLI user full_access on the new spreadsheet."
-	if dryRun.API[0].Desc != wantDesc {
-		t.Fatalf("desc = %q, want %q", dryRun.API[0].Desc, wantDesc)
-	}
 }
 
 func TestSheetCreatePreservesBackendURL(t *testing.T) {

shortcuts/sheets/backward/lark_sheets_spreadsheet_management.go

@@ -115,7 +115,7 @@ var SheetCreate = common.Shortcut{
 			POST("/open-apis/sheets/v3/spreadsheets").
 			Body(body)
 		if runtime.IsBot() {
-			d.Desc("After spreadsheet creation succeeds in bot mode, the CLI will also try to grant the current CLI user full_access on the new spreadsheet.")
+			d.Desc("After spreadsheet creation succeeds in bot mode, the CLI will also try to grant the current CLI user full_access (可管理权限) on the new spreadsheet.")
 		}
 		return d
 	},

shortcuts/sheets/lark_sheet_table_io.go

@@ -1213,7 +1213,7 @@ var TableGet = common.Shortcut{
 	},
 	Tips: []string{
 		"Output is the same shape +table-put consumes — pipe it back in, or load sheets[].rows into a DataFrame keyed by columns[].name.",
-		"Column types are inferred per column, but only when every non-empty cell agrees; a column mixing types (e.g. numbers + \"N/A\") degrades to string — lossless and round-trips cleanly. Numeric coercion of dirty cells is the caller's job (pandas to_numeric(errors=\"coerce\") on the string column).",
+		"Column types are inferred per column, but only when every non-empty cell agrees; a column mixing types (e.g. numbers + \"暂无\") degrades to string — lossless and round-trips cleanly. Numeric coercion of dirty cells is the caller's job (pandas to_numeric(errors=\"coerce\") on the string column).",
 	},
 }
 
@@ -1522,7 +1522,7 @@ func readCellFormat(cell map[string]interface{}) string {
 // inferColumnType decides a column's type from its data cells: a date
 // number_format guides each cell's type, but a column is given a non-string type
 // only when EVERY non-empty cell agrees. Real sheet columns often mix types (a
-// number column with a stray "N/A", a date column with a bare count); declaring
+// number column with a stray "暂无", a date column with a bare count); declaring
 // number/date while a string value rides along makes the output inconsistent —
 // it breaks round-trip back into +table-put (which rejects a string in a number
 // column) and crashes pandas astype. So a mixed column degrades to string

shortcuts/sheets/lark_sheet_table_io_test.go

@@ -1140,7 +1140,7 @@ func TestTableGet_InferColumnType(t *testing.T) {
 	// Mixed number+text degrades to string (self-consistent: every value is then
 	// a string), so the column round-trips and pandas doesn't choke. Numeric
 	// coercion of the dirty cells is left to the caller (pandas to_numeric).
-	if typ, _ := inferColumnType(col(mk(100.0, ""), mk("N/A", ""), mk(200.0, "")), 0); typ != "string" {
+	if typ, _ := inferColumnType(col(mk(100.0, ""), mk("暂无", ""), mk(200.0, "")), 0); typ != "string" {
 		t.Errorf("mixed number+text col → %s, want string", typ)
 	}
 	// A bare number mixed into a date column must NOT stay date (would serial-

shortcuts/slides/slides_create.go

@@ -118,7 +118,7 @@ var SlidesCreate = common.Shortcut{
 		}
 
 		if runtime.IsBot() {
-			dry.Desc("After creation succeeds in bot mode, the CLI will also try to grant the current CLI user full_access on the new presentation.")
+			dry.Desc("After creation succeeds in bot mode, the CLI will also try to grant the current CLI user full_access (可管理权限) on the new presentation.")
 		}
 		return dry
 	},

shortcuts/vc/vc_detail.go

@@ -79,42 +79,27 @@ func fetchMeetingDetail(ctx context.Context, runtime *common.RuntimeContext, mee
 		result.NoteID = v
 	}
 
-	// Step 2: query minute_token via recording API — only meaningful once the
-	// meeting has ended. While it is still in progress the note/minute are not
-	// generated yet, so skip the recording call and surface an informational
-	// hint instead of letting an unclassified recording error fail the command.
-	inProgress := meetingInProgress(meeting)
-	var minuteHint string
-	if inProgress {
-		minuteHint = "meeting is still in progress; note and minute are not generated yet"
-	} else {
-		minuteToken, hint, minuteErr := fetchMeetingMinuteToken(runtime, meetingID)
-		minuteHint = hint
-		if minuteErr != nil {
-			// Recording lookup is a best-effort supplement; step 1 already
-			// succeeded, so degrade the failure to a hint rather than failing
-			// the whole command.
-			minuteHint = fmt.Sprintf("failed to query minutes: %v", minuteErr)
-		}
-		if minuteToken != "" {
-			result.MinuteToken = minuteToken
-		}
+	// Step 2: query minute_token via recording API
+	minuteToken, minuteHint, minuteErr := fetchMeetingMinuteToken(runtime, meetingID)
+	if minuteErr != nil {
+		// Recording API failed — surface the error but keep data from step 1
+		result.Error = fmt.Sprintf("failed to query minutes: %v", minuteErr)
+		minuteHint = ""
+	}
+	if minuteToken != "" {
+		result.MinuteToken = minuteToken
 	}
 
-	// Add hints for empty resources (not errors, just informational). For an
-	// in-progress meeting the "not found" wording is noise, so we only emit the
-	// single in-progress hint below.
-	if !inProgress {
-		var emptyFields []string
-		if result.NoteID == "" {
-			emptyFields = append(emptyFields, "note_id")
-		}
-		if result.MinuteToken == "" && minuteHint == "" {
-			emptyFields = append(emptyFields, "minute_token")
-		}
-		if len(emptyFields) > 0 {
-			result.Hint = fmt.Sprintf("%s not found for this meeting", strings.Join(emptyFields, ", "))
-		}
+	// Add hints for empty resources (not errors, just informational)
+	var emptyFields []string
+	if result.NoteID == "" {
+		emptyFields = append(emptyFields, "note_id")
+	}
+	if result.MinuteToken == "" && minuteErr == nil && minuteHint == "" {
+		emptyFields = append(emptyFields, "minute_token")
+	}
+	if len(emptyFields) > 0 {
+		result.Hint = fmt.Sprintf("%s not found for this meeting", strings.Join(emptyFields, ", "))
 	}
 	if minuteHint != "" {
 		if result.Hint != "" {
@@ -127,36 +112,6 @@ func fetchMeetingDetail(ctx context.Context, runtime *common.RuntimeContext, mee
 	return result
 }
 
-// meetingTimeField reads a meeting time field as a string regardless of whether
-// the API returned it as a JSON string or number. VC serializes int64
-// timestamps as strings, but coercing via %v keeps parsing robust either way;
-// float64(0) renders as "0", which parseFlexibleTime treats as "absent".
-func meetingTimeField(meeting map[string]any, key string) string {
-	v, ok := meeting[key]
-	if !ok || v == nil {
-		return ""
-	}
-	return strings.TrimSpace(fmt.Sprintf("%v", v))
-}
-
-// meetingInProgress reports whether a meeting is still ongoing, using the same
-// start/end heuristic as +meeting-events (meetingEventsMeetingFromPayload): a
-// meeting is ongoing when it has a start time but no end time, or its end time
-// is not after its start time. It reads the RAW timestamp fields, not the
-// FormatTime-rendered result strings, because parseFlexibleTime only accepts
-// Unix timestamps or RFC3339. Empty or "0" values are treated as absent.
-func meetingInProgress(meeting map[string]any) bool {
-	start, hasStart := parseFlexibleTime(meetingTimeField(meeting, "start_time"))
-	end, hasEnd := parseFlexibleTime(meetingTimeField(meeting, "end_time"))
-	if !hasStart {
-		return false
-	}
-	if !hasEnd {
-		return true
-	}
-	return !end.After(start)
-}
-
 // VCDetail gets meeting details including note_id and minute_token.
 var VCDetail = common.Shortcut{
 	Service:     "vc",

shortcuts/vc/vc_detail_test.go

@@ -269,58 +269,11 @@ func TestFetchMeetingDetail_RecordingAPIErrorButNoteOK(t *testing.T) {
 		if result.MinuteToken != "" {
 			t.Errorf("minute_token = %q, want empty", result.MinuteToken)
 		}
-		if result.Error != "" {
-			t.Errorf("error = %q, want empty: a recording lookup failure must not fail the command", result.Error)
+		if !strings.Contains(result.Error, "failed to query minutes") || !strings.Contains(result.Error, "weird API error") {
+			t.Errorf("error = %q, want contains 'failed to query minutes' and 'weird API error'", result.Error)
 		}
-		if !strings.Contains(result.Hint, "failed to query minutes") || !strings.Contains(result.Hint, "weird API error") {
-			t.Errorf("hint = %q, want contains 'failed to query minutes' and 'weird API error'", result.Hint)
-		}
-		return nil
-	}); err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-}
-
-// TestFetchMeetingDetail_MeetingInProgress pins the in-progress behavior: when a
-// meeting is still ongoing (end_time not after start_time), +detail must not
-// call the recording API at all — it returns meeting metadata with an
-// informational hint and no error. Deliberately register NO recording stub so
-// that any recording call would fail on an unmatched request.
-func TestFetchMeetingDetail_MeetingInProgress(t *testing.T) {
-	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
-	f, _, _, reg := cmdutil.TestFactory(t, defaultConfig())
-	reg.Register(&httpmock.Stub{
-		Method: "GET",
-		URL:    "/open-apis/vc/v1/meetings/m_live",
-		Body: map[string]interface{}{
-			"code": 0, "msg": "ok",
-			"data": map[string]interface{}{"meeting": map[string]interface{}{
-				"id":         "m_live",
-				"topic":      "Live Meeting",
-				"meeting_no": "912052453",
-				// end_time == start_time signals an ongoing meeting.
-				"start_time": "1752000000",
-				"end_time":   "1752000000",
-			}},
-		},
-	})
-
-	if err := botExec(t, "detail-live", f, func(_ context.Context, rctx *common.RuntimeContext) error {
-		result := fetchMeetingDetail(context.Background(), rctx, "m_live")
-		if result.Topic != "Live Meeting" {
-			t.Errorf("topic = %q, want 'Live Meeting'", result.Topic)
-		}
-		if result.Error != "" {
-			t.Errorf("error = %q, want empty for an in-progress meeting", result.Error)
-		}
-		if result.MinuteToken != "" {
-			t.Errorf("minute_token = %q, want empty for an in-progress meeting", result.MinuteToken)
-		}
-		if !strings.Contains(result.Hint, "in progress") {
-			t.Errorf("hint = %q, want to mention the meeting is in progress", result.Hint)
-		}
-		if strings.Contains(result.Hint, "not found for this meeting") {
-			t.Errorf("hint = %q, should not emit not-found noise for an in-progress meeting", result.Hint)
+		if strings.Contains(result.Hint, "minute_token") {
+			t.Errorf("hint = %q, should not mention minute_token when there is an error", result.Hint)
 		}
 		return nil
 	}); err != nil {

shortcuts/wiki/wiki_node_create.go

@@ -73,7 +73,7 @@ var WikiNodeCreate = common.Shortcut{
 	DryRun: func(ctx context.Context, runtime *common.RuntimeContext) *common.DryRunAPI {
 		dry := buildWikiNodeCreateDryRun(readWikiNodeCreateSpec(runtime))
 		if runtime.IsBot() {
-			dry.Desc("After wiki node creation succeeds in bot mode, the CLI will also try to grant the current CLI user full_access on the new wiki node.")
+			dry.Desc("After wiki node creation succeeds in bot mode, the CLI will also try to grant the current CLI user full_access (可管理权限) on the new wiki node.")
 		}
 		return dry
 	},

shortcuts/wiki/wiki_node_create_test.go

@@ -635,7 +635,7 @@ func TestWikiNodeCreateBotAutoGrantSuccess(t *testing.T) {
 	if grant["user_open_id"] != "ou_current_user" {
 		t.Fatalf("permission_grant.user_open_id = %#v, want %q", grant["user_open_id"], "ou_current_user")
 	}
-	if grant["message"] != "Granted the current CLI user full_access on the new wiki node." {
+	if grant["message"] != "Granted the current CLI user full_access (可管理权限) on the new wiki node." {
 		t.Fatalf("permission_grant.message = %#v", grant["message"])
 	}
 

skills/lark-approval/references/lark-approval-initiate.md

@@ -69,17 +69,19 @@ lark-cli approval approvals get \
 |---|---|---|
 | `--data '{...}'` | 是 | 请求体，使用 JSON 传入 |
 | `approval_code` | 是 | 审批定义 Code；必须先通过 `approvals search` / `approvals get` 确认 |
-| `form` | 否 | 表单值，**JSON 数组字符串**，不是普通对象；API 层非必填，但审批定义存在必填控件或用户需要提交表单值时必须传 |
+| `form` | 是 | 表单值，**JSON 数组字符串**，不是普通对象 |
 | `node_approver_list` | 否 | 节点审批人列表；仅在定义要求补充审批人时传 |
 | `node_cc_list` | 否 | 节点抄送人列表；仅在用户明确需要补充节点抄送人时传 |
 | `uuid` | 否 | 幂等标识；重复重试同一请求时建议显式传入 |
+| `--params '{...}'` | 否 | 查询参数，使用 JSON 传入 |
+| `user_id_type` | 否 | 用户 ID 类型：`user_id`、`union_id`、`open_id`；涉及人员类 ID 时建议显式传 `open_id` |
 | `--as user` | 否 | 建议显式指定用户身份；审批发起通常应使用用户身份 |
 | `--yes` | 是 | 写操作确认；真实执行时必须显式传入 |
 | `--dry-run` | 否 | 预览 API 调用，不执行 |
 
 ### 4. 组装 `form`
 
-`instances create --data.form` 是可选字段；传入时必须是一个 JSON 数组字符串。无表单或无需填写表单值的审批可省略 `form`，但只要审批定义包含需要提交的控件，就必须按控件结构组装后传入。组装原则：
+`instances create --data.form` 是一个 JSON 数组字符串。组装原则：
 
 - 先用 `approvals.get.form` 识别有哪些控件、每个控件的 `id` / `type` / 可选值范围，再按本文中的创建参数规则与 [`lark-approval-instance-form-control-parameters.md`](./lark-approval-instance-form-control-parameters.md) 重新组装创建 payload。
 - 提交时必须至少保证每个控件的 `id`、`type` 与 `value` 符合当前接口要求；不要假设定义快照里出现的其他字段都能直接照搬。
@@ -171,6 +173,7 @@ lark-cli approval instances create \
       }
     ]
   }' \
+  --params '{"user_id_type":"open_id"}' \
   --as user \
   --yes
 ```

skills/lark-approval/references/lark-approval-instances-initiated.md

@@ -14,9 +14,6 @@ lark-cli approval instances initiated --params '{"page_size":20}' --as user
 # 只看某个审批定义下我发起的实例
 lark-cli approval instances initiated --params '{"definition_code":"<DEFINITION_CODE>","page_size":20}' --as user
 
-# 按发起时间范围筛选（秒级时间戳）
-lark-cli approval instances initiated --params '{"start_timestamp":"<START_SECONDS>","end_timestamp":"<END_SECONDS>","page_size":20}' --as user
-
 # 使用 page_token 翻页
 lark-cli approval instances initiated --params '{"page_size":20,"page_token":"example_page_token"}' --as user
 
@@ -33,8 +30,6 @@ lark-cli approval instances initiated --params '{"page_size":20}' --as user --dr
 |------|------|------|
 | `--params '{...}'` | 否 | 查询参数，使用 JSON 传入；不传时使用默认分页与筛选 |
 | `definition_code` | 否 | 审批定义 Code，用于只查看某个审批定义下我发起的实例 |
-| `start_timestamp` | 否 | 按发起时间筛选，时间范围开始值，秒级时间戳 |
-| `end_timestamp` | 否 | 按发起时间筛选，时间范围结束值，秒级时间戳 |
 | `locale` | 否 | 返回语言：`zh-CN`、`en-US`、`ja-JP` |
 | `page_size` | 否 | 分页大小 |
 | `page_token` | 否 | 翻页标记；首次请求不填，后续使用上一次返回的 `page_token` |
@@ -106,7 +101,6 @@ lark-cli approval instances initiated \
 
 - **这是定位“我发起的审批实例”的首选命令**：如果你的目标是撤回、抄送、查看某个已发起审批，优先从这里拿 `instance_code`。
 - **优先用 `definition_code` 缩小范围**：当你已知审批定义时，先筛掉无关实例，可显著提升可读性。
-- **按时间排查时使用 `start_timestamp` / `end_timestamp`**：这两个值都是秒级时间戳，用于按发起时间缩小结果范围。
 - **结果很多时优先 `--format table`**：适合人工快速浏览。
 - **`count` 只在第一页返回**：做分页处理时不要假设后续页还会带总数。
 - **`instance_status` 可直接判断下一步**：例如状态为 `1` 时通常可继续查看详情或考虑撤回，状态为 `4` 表示已经撤销，无需重复撤回。

skills/lark-approval/references/lark-approval-tasks-query.md

@@ -14,9 +14,6 @@ lark-cli approval tasks query --params '{"topic":"1"}' --as user
 # 查询已办审批
 lark-cli approval tasks query --params '{"topic":"2"}' --as user
 
-# 按任务时间范围筛选（秒级时间戳）
-lark-cli approval tasks query --params '{"topic":"1","start_timestamp":"<START_SECONDS>","end_timestamp":"<END_SECONDS>"}' --as user
-
 # 使用 page_token 翻页
 lark-cli approval tasks query --params '{"topic":"1","page_token":"example_page_token"}' --as user
 
@@ -31,8 +28,6 @@ lark-cli approval tasks query --params '{"topic":"1"}' --format table --as user
 | `--params '{"topic":"..."}'` | 是 | 查询参数，使用 JSON 传入 |
 | `topic` | 是 | 任务分组主题，见下方“topic 枚举” |
 | `definition_code` | 否 | 审批定义 Code，用于仅查询某个审批定义下的任务 |
-| `start_timestamp` | 否 | 按任务时间筛选，时间范围开始值，秒级时间戳 |
-| `end_timestamp` | 否 | 按任务时间筛选，时间范围结束值，秒级时间戳 |
 | `locale` | 否 | 返回语言：`zh-CN`、`en-US`、`ja-JP` |
 | `page_size` | 否 | 分页大小 |
 | `page_token` | 否 | 翻页标记；首次请求不填，后续使用上一次返回的 `page_token` |
@@ -72,14 +67,10 @@ lark-cli approval tasks query --params '{"topic":"1"}' --format table --as user
 | `tasks[].summaries` | 表单摘要字段列表 |
 | `tasks[].support_api_operate` | 是否支持通过 API 同意或拒绝该任务 |
 | `tasks[].user_id` | 任务所属用户 ID |
-| `tasks[].instance_external_id` | 三方审批实例 ID，仅第三方审批实例存在 |
-| `tasks[].task_external_id` | 三方审批任务 ID，仅第三方审批任务存在 |
-| `tasks[].link` | 三方审批跳转链接 |
 
 ## 使用建议
 
 - 常见处理链：先用 `tasks query` 拿到 `task_id` 和 `instance_code`，若用户需要查看详情、当前节点、表单内容、流程进度等内容，则调用 `instances get` 查看详情，最后执行 `tasks approve` / `tasks reject` / `tasks transfer` / `tasks add_sign` / `tasks rollback`。
 - 如果你只想看“已发起的审批实例”，使用 `instances initiated`；`tasks query` 更适合围绕“任务分组”来拉取列表。
-- 按时间排查任务时使用 `start_timestamp` / `end_timestamp` 缩小范围；这两个值都是秒级时间戳。
 - 需要继续翻页时，直接把上一次返回的 `page_token` 放回 `--params`。
 - 当结果量较大时，优先使用 `--format table` 提升可读性。

skills/lark-approval/references/lark-approval-tasks-rollback.md

@@ -23,12 +23,6 @@ lark-cli approval tasks rollback \
   --as user \
   --yes
 
-# 退回到发起节点（发起节点 ID 为 START）
-lark-cli approval tasks rollback \
-  --data '{"instance_code":"<INSTANCE_CODE>","task_id":"<TASK_ID>","node_ids":["START"],"comment":"退回发起人补充材料"}' \
-  --as user \
-  --yes
-
 # 传多个候选节点 ID（以实际审批定义支持情况为准）
 lark-cli approval tasks rollback \
   --data '{"instance_code":"<INSTANCE_CODE>","task_id":"<TASK_ID>","node_ids":["<NODE_ID_1>","<NODE_ID_2>"],"comment":"退回上一处理节点"}' \
@@ -49,7 +43,7 @@ lark-cli approval tasks rollback \
 | `--data '{...}'` | 是 | 请求体 JSON，使用 JSON 传入 |
 | `instance_code` | 是 | 审批实例 Code；通常先通过 `tasks query` 或 `instances initiated` / `instances get` 获取 |
 | `task_id` | 是 | 审批任务 ID；通常先通过 `tasks query` 获取 |
-| `node_ids` | 是 | 退回目标节点 ID 数组；发起节点 ID 为 `START`；执行前应先确认这些节点确实可作为退回目标 |
+| `node_ids` | 是 | 退回目标节点 ID 数组；执行前应先确认这些节点确实可作为退回目标 |
 | `comment` | 否 | 审批意见或退回说明，例如 `请补充附件后重新提交`、`预算说明不完整，请补充` |
 | `--as user` | 否 | 建议显式指定用户身份；审批退回通常必须以用户身份执行 |
 | `--yes` | 否 | 确认执行高风险写操作；未带时可能返回 `confirmation_required` / exit 10 |
@@ -81,7 +75,7 @@ lark-cli approval instances get --params '{"instance_code":"<INSTANCE_CODE>"}' -
 ## 使用建议
 
 - **`instance_code` 和 `task_id` 要成对使用**：仅有实例 ID 或仅有任务 ID 都不足以准确执行退回操作。
-- **`node_ids` 是必填项**：退回并不是“自动退回上一步”，而是要明确给出目标节点 ID 数组；退回发起节点时传 `START`。
+- **`node_ids` 是必填项**：退回并不是“自动退回上一步”，而是要明确给出目标节点 ID 数组。
 - **先确认节点是否可退回**：不同审批定义支持的退回目标可能不同；在不确定时，先通过 `instances get` 或业务侧流程信息核实。
 - **优先从 `tasks query` 的待办列表拿任务参数**：尤其是 `topic=1` 的待办审批，最适合作为 rollback 的输入来源。
 - **先检查是否支持 API 操作**：如果 `tasks[].support_api_operate` 为 `false`，说明该任务可能不支持通过 API 执行处理动作，退回前应谨慎验证。

skills/lark-apps/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: lark-apps
 version: 1.0.0
-description: "妙搭（Spark/Miaoda）应用开发与托管：应用创建、本地全栈开发、云端生成迭代、创意设计（UI mockup / 可交互原型 / 线框图 / 落地页 / 仪表盘 / 幻灯片 deck / 视觉探索）、AI相关能力和飞书平台能力或者其他外部能力集成、日志/Trace/监控指标/PV/UV 查询、环境变量管理、应用角色与成员管理、自动化触发器（定时/记录变更/Webhook/飞书审批）。当用户要开发/新建一个系统·工具·平台·应用，或要本地开发 / 云端开发 / 修改 / 部署 / 发布 / 上线 / 拿可分享链接，或用 HTML 做页面·网站·部署到妙搭，或要设计 / design / mockup / prototype / wireframe / 做 PPT / deck / 视觉探索，或提到妙搭/Spark/Miaoda（应用运行时域名形如 *.aiforce.cloud）、应用数据库、应用文件存储、开放 API Key、可见范围、应用角色/角色成员、线上日志、接口请求量、错误量、延迟、访问量、环境变量、给妙搭应用配自动化任务/定时触发/审批通过后自动触发时使用。不负责普通云盘文件上传（lark-drive）、飞书文档编辑（lark-doc）、原生幻灯片创建（lark-slides）。"
+description: "妙搭（Spark/Miaoda）应用开发与托管：应用创建、HTML静态站点发布、本地全栈开发、云端生成迭代、AI相关能力和飞书平台能力或者其他外部能力集成、日志/Trace/监控指标/PV/UV 查询、环境变量管理、应用角色与成员管理、自动化触发器（定时/记录变更/Webhook/飞书审批）。当用户要开发/新建一个系统·工具·平台·应用，或要本地开发 / 云端开发 / 修改 / 部署 / 发布 / 上线 / 拿可分享链接，或用 HTML 做页面·网站·部署到妙搭，或提到妙搭/Spark/Miaoda（应用运行时域名形如 *.aiforce.cloud）、应用数据库、应用文件存储、开放 API Key、可见范围、应用角色/角色成员、线上日志、接口请求量、错误量、延迟、访问量、环境变量、给妙搭应用配自动化任务/定时触发/审批通过后自动触发时使用。不负责普通云盘文件上传（lark-drive）、飞书文档编辑（lark-doc）、原生幻灯片创建（lark-slides）。"
 metadata:
   requires:
     bins: ["lark-cli"]
@@ -10,7 +10,7 @@ metadata:
 
 # apps (v1)
 
-妙搭应用属于用户资产。默认用 `--as user`；认证、scope、exit-10、高风险确认、`_notice` 等通用处理只读 [`../lark-shared/SKILL.md`](../lark-shared/SKILL.md)，不要在本 skill 里复制。妙搭应用有两条开发路径：**本地开发**（拉源码本地写）/ **云端会话**（妙搭 AI 生成）。
+妙搭应用属于用户资产。默认用 `--as user`；认证、scope、exit-10、高风险确认、`_notice` 等通用处理只读 [`../lark-shared/SKILL.md`](../lark-shared/SKILL.md)，不要在本 skill 里复制。妙搭应用有三条开发路径：**本地全栈**（拉源码本地写）/ **HTML 托管**（发布静态产物）/ **云端会话**（妙搭 AI 生成）。
 
 ## 身份与授权
 
@@ -32,18 +32,16 @@ lark-cli auth login --domain apps
 | 找已有 app_id、按名字过滤应用 | `+list --keyword <name>` | [`lark-apps-list.md`](references/lark-apps-list.md) |
 | 查单个应用详情（类型、名称、发布状态等） | `+get --app-id <app_id>` | [`lark-apps-get.md`](references/lark-apps-get.md) |
 | 改应用名或描述 | `+update` | [`lark-apps-update.md`](references/lark-apps-update.md) |
-| HTML 应用 / 创意模式 — 写 HTML 页面/网站、静态页、PPT/deck、落地页、仪表盘、UI mockup、原型、线框图、视觉探索 | 加载 [`creative-design/creative-design.md`](creative-design/creative-design.md)（含完整开发与发布流程） | [`creative-design/creative-design.md`](creative-design/creative-design.md) |
-| 旧版存量 HTML 应用（无 Git 管理）继续上传已有静态产物 | `+html-publish`（仅兼容旧链路；新建 html / 创意模式 / creative-design 产物不得使用） | [`lark-apps-html-publish.md`](references/lark-apps-html-publish.md) |
-| 开发已有应用 / 初始化本地仓库（开发方式已定为本地后；先解析 app_id，勿 `+create` 新建） | `+init`（或手动 `+git-credential-init` + 原生 git）。**执行前必读** [`lark-apps-local-dev.md`](references/lark-apps-local-dev.md)，含端到端流程和领域规则 | [`lark-apps-init.md`](references/lark-apps-init.md), [`lark-apps-git-credential.md`](references/lark-apps-git-credential.md) |
+| 发布本地 `index.html` 或静态目录为可访问 URL | `+html-publish` | [`lark-apps-html-publish.md`](references/lark-apps-html-publish.md) |
+| 开发已有应用 / 初始化本地仓库（开发方式已定为本地后；先解析 app_id，勿 `+create` 新建） | `+init`（或手动 `+git-credential-init` + 原生 git）。**执行前必读** [`lark-apps-local-dev.md`](references/lark-apps-local-dev.md)；修改源码还须遵守下方「平台资源与应用源码边界」 | [`lark-apps-init.md`](references/lark-apps-init.md), [`lark-apps-git-credential.md`](references/lark-apps-git-credential.md) |
 | 本地开发时 `.env.local` 损坏/丢失，重新拉取启动期环境变量 | `+env-pull` | [`lark-apps-env-pull.md`](references/lark-apps-env-pull.md) |
 | 管理应用环境变量（查看/设置/删除） | `+env-list`, `+env-set`, `+env-delete` | [`lark-apps-env.md`](references/lark-apps-env.md) |
 | 查线上日志、Trace、请求数、错误率、延迟、CPU、memory、PV/UV/访问量 | `+log-list`, `+log-get`, `+trace-list`, `+trace-get`, `+metric-list`, `+analytics-list` | [`lark-apps-observability.md`](references/lark-apps-observability.md) |
 | 看表 / 看结构 / 初始化多环境 / 导入导出数据 / 变更追溯 / 行级审计 / dev→online 发布 / 时间点恢复 / 查 DB 用量 | `+db-table-list`、`+db-table-get`、`+db-env-create`、`+db-data-export`/`+db-data-import`、`+db-changelog-list`、`+db-audit-status`/`+db-audit-enable`/`+db-audit-disable`/`+db-audit-list`、`+db-env-diff`/`+db-env-migrate`、`+db-recovery-diff`/`+db-recovery-apply`、`+db-quota-get` | [`lark-apps-db.md`](references/lark-apps-db.md) |
 | 逐条执行 SQL（SELECT / DML / DDL）；建表 / 改表 / 写 SQL 的平台规范 | `+db-execute` | [`lark-apps-db-execute.md`](references/lark-apps-db-execute.md)（含「平台 SQL 规范」：审计列 / RLS / `user_profile` / 禁用 SQL / PG 陷阱） |
 | 管理应用文件存储：上传/下载本地文件、列出/查看/删除已存文件、生成临时分享链接、查存储用量 | `+file-upload`/`+file-download`/`+file-list`/`+file-get`/`+file-sign`/`+file-delete`/`+file-quota-get` | [`lark-apps-file.md`](references/lark-apps-file.md) |
-| **部署/上线应用**（"部署""上线""推上去并部署""发布到云端"）；查发布状态/历史 | 本地开发链路先按 [`lark-apps-local-dev.md`](references/lark-apps-local-dev.md) 确认本次改动已 git commit + git push，再用 `+release-create` / `+release-get`；查历史用 `+release-list` | [`lark-apps-local-dev.md`](references/lark-apps-local-dev.md), [`lark-apps-release-create.md`](references/lark-apps-release-create.md), [`lark-apps-release-get.md`](references/lark-apps-release-get.md), [`lark-apps-release-list.md`](references/lark-apps-release-list.md) |
+| **部署/上线全栈应用**（"部署""上线""推上去并部署""发布到云端"）；查发布状态/历史 | `+release-create`（部署上线动作）, `+release-get`（轮询发布结果，finished 给 online_url / failed 给 error_logs）, `+release-list` | [`lark-apps-release-create.md`](references/lark-apps-release-create.md), [`lark-apps-release-get.md`](references/lark-apps-release-get.md), [`lark-apps-release-list.md`](references/lark-apps-release-list.md) |
 | 设置或查看运行时可见范围 | `+access-scope-set`, `+access-scope-get` | 对应 access-scope reference |
-| 创意模式（html）应用的评论相关操作 | 创意模式应用评论走 lark-drive 文档评论体系，读取 [`../lark-drive/SKILL.md`](../lark-drive/SKILL.md) 了解评论能力 | [`../lark-drive/SKILL.md`](../lark-drive/SKILL.md) |
 | 管理 `app_...` 应用内角色、角色成员，或查询用户匹配角色 | `+role-list/get/create/update/delete`, `+role-member-list/add/remove`, `+role-match-list` | [`lark-apps-role.md`](references/lark-apps-role.md) |
 | 云端 Agent 生成/迭代应用（开发方式已定为云端后） | `+session-create` -> `+chat` -> `+session-get` | [`lark-apps-cloud-dev.md`](references/lark-apps-cloud-dev.md) |
 | 管理妙搭应用开放 API Key（创建/查看/启停/重置/删除凭证；密钥仅 create/reset 一次性返回） | `+openapi-key-list/get/create/update/enable/disable/delete/reset` | [`lark-apps-openapi-key.md`](references/lark-apps-openapi-key.md) |
@@ -65,9 +63,9 @@ lark-cli auth login --domain apps
 
 | 信号 | 判定 |
 |---|---|
-| 静态展示 / 单页 / PPT/deck / demo / 落地页 / 仪表盘 / UI mockup / 可交互原型 / 线框图 / 视觉探索 / 无后端状态 | `app_type=html`，加载 [`creative-design/creative-design.md`](creative-design/creative-design.md)（含完整开发与发布流程） |
+| 静态展示 / 单页 / PPT/demo / 无后端状态 | `app_type=html`，跳过本地/云端轴，开发完按 [`lark-apps-html-publish.md`](references/lark-apps-html-publish.md)（含"未提部署→先问是否发布"） |
 | 登录 / 数据库 / 持久化 / 多人协作 / 增删改查 / 报名 / 投票 / 站会 / OKR / 泛称"系统·工具" | `app_type=full_stack` |
-| 用户要自己写 / 本地 IDE·code agent / 拉源码到本地 / 交研发 | 本地开发，读 [`lark-apps-local-dev.md`](references/lark-apps-local-dev.md) |
+| 用户要自己写 / 本地 IDE·code agent / 拉源码到本地 / 交研发 | 本地全栈，读 [`lark-apps-local-dev.md`](references/lark-apps-local-dev.md) |
 | 让妙搭 AI 云端生成 / 对话式 / 自己不碰代码 | 云端会话，读 [`lark-apps-cloud-dev.md`](references/lark-apps-cloud-dev.md) |
 | 未表达"谁来写"偏好 | **必须先问**（本地代码开发 vs 云端 AI 生成）；选定前不擅自选边、不暗示默认，不得以"需求不模糊"为由跳过提问直接 `+init` / `git clone` / `+session-create` / 首轮 `+chat` |
 | 修改已有 + 当前目录是 `.spark/meta.json` 项目 | 直接继续本地按意图路由，不必问也不必判云端 |
@@ -77,19 +75,16 @@ lark-cli auth login --domain apps
 
 - **发布意图判定**：用户要"可访问 / 线上 / 分享 / 新链接 / 上线" = 发布意图，先走发布链路、确认完成再给链接。
 - 完成 ≠ 发布：云端会话完成 / `+list is_published=true` 都不代表最新内容已部署。
-- 开发态链接 `https://miaoda.feishu.cn/app/{app_id}`（仅 full_stack 应用）：进应用编辑/开发态、管理与继续开发应用的入口。创意模式（html）应用开发态和发布态是同一个链接，无需额外提供开发态链接。
-- 发布态链接来源：`+release-get` 轮询 `finished` 给 `online_url` / `failed` 给 `error_logs`（html 和 full_stack 统一走 `+release-get`）。
-- html 应用的主链路是创意模式开发方式：按 [`lark-apps-local-dev.md`](references/lark-apps-local-dev.md) 初始化仓库、在仓库内产出 HTML 及关联文件，并通过 git commit / git push / `+release-create` / `+release-get` 发布部署。任何 git 操作（clone / pull / push）报错时，先执行 `lark-cli apps +git-credential-init --app-id <app_id> --as user` 刷新本地 Git 凭证，再重试原 git 命令。如果刷新凭证也失败，**停止并向用户报告**：原始 git 错误、凭证刷新失败原因，以及是否可能是当前环境（操作系统、沙箱）限制导致（如 macOS Keychain 在沙箱中不可用、Linux 加密文件目录不可写等）。不要改走 `+html-publish`，也不要把 `+html-publish` 当作本地开发链路的 fallback。
-- 创意模式（html）应用的链接格式为 `https://{租户域名}/page/{meta_token}`，**开发态和发布态是同一个链接**（区别于 full_stack 应用两者分开）。此链接形似飞书文档链接。`+get --app-id <meta_token>` 可获取应用信息（含 `app_id`），`+get --app-id <app_id>` 可获取 `meta_token`。看到 `/page/xxx` 链接时，它是妙搭创意模式应用，不要当成飞书文档跳过。
+- 开发态链接 `https://miaoda.feishu.cn/app/{app_id}`：进应用编辑/开发态、管理与继续开发应用的入口。发布成功后，连同发布态链接一并提供给用户（说明"管理 / 继续开发去这里"）；但它仅进编辑态，**不能**顶替发布态链接当分享链接。
+- 发布态链接来源：html → `+html-publish` 的 `data.url`；全栈 → `+release-get` 轮询 `finished` 给 `online_url` / `failed` 给 `error_logs`。
+- **可见范围**：发布态链接（html 的 `data.url`、全栈的 `online_url`）默认仅**创建者可见**，发给他人对方会无权限打不开。当可分享链接交付给用户前，先告知当前仅本人可见，再询问是否用 `+access-scope-set`（`tenant`/`public`/`specific`）放开（可先 `+access-scope-get` 查当前范围）。
 
 ## 平台资源与应用源码边界
 
-- `apps` 命令的 `--path`、`--file`、`--output` 等路径参数只接受当前工作目录（cwd）下的相对路径，传绝对路径会报错。如果目标文件不在 cwd 下，先 `cd` 到目标目录再执行命令。
-- 图片、字体、音视频等资源型文件属于平台资源，不应提交到 git 仓库、引用本地路径或以 base64 内联到源码中。先通过 `lark-cli apps +file-upload --app-id <app_id> --file <local_path>` 上传到应用文件存储，拿到返回的远端 URL 后在代码中引用。上传返回的链接按 app 隔离，不同应用必须各自重新上传，不能跨应用复用同一链接。详情读 [`lark-apps-file.md`](references/lark-apps-file.md)。
 - `apps +role-*` 只管理平台角色资源；修改已初始化应用的源码（包括当前目录已经是应用项目）时，先查看工作区 `.agents/skills/`，完整读取与任务匹配的领域 skill，再按其路由读取所需 reference。角色鉴权或运行态角色管理读应用内 `authz-guide`，不能用本 skill 的平台命令参考推断运行时合同。
 - `lark-cli` 只用于开发过程中的平台资源核验或变更。应用运行时代码必须使用工程内领域 skill 规定的 SDK，禁止通过 `exec` 或子进程调用 `lark-cli`。
 - 平台回读出的当前资源 ID、名称和成员只用于事实核验，不自动构成业务策略；除非需求或应用内领域 skill 明确定义，禁止把当前样本硬编码成 allowlist、denylist、只读集合或权限规则。
-- 实现领域 SDK 时，以实际包导出的类型和应用内领域 reference 记录的入参、响应路径为准；禁止修改 ambient `.d.ts`、补造宽松类型或强制断言，让猜测的 SDK 结构仅在本地"编译通过"。
+- 实现领域 SDK 时，以实际包导出的类型和应用内领域 reference 记录的入参、响应路径为准；禁止修改 ambient `.d.ts`、补造宽松类型或强制断言，让猜测的 SDK 结构仅在本地“编译通过”。
 - typecheck/build 成功不等于合同正确。交付前逐项核对每个 SDK 调用的入参、响应取值路径和策略分支；涉及更新、删除等不同动作时，分别验证各自动作所需的完整状态，不能复用更弱的前置判断。
 - 源码任务交付前确认新增页面、Controller、Module 已接入真实 router/bootstrap，并运行项目现有 typecheck/build；只创建未接线文件不算完成。
 - `+access-scope-*` 只管运行时可见范围（谁能打开应用），不是角色权限；应用协作者/开发权限仍需使用妙搭 Web。自动化触发器请用 `+automation-*`（见「意图路由」）。
@@ -98,12 +93,6 @@ lark-cli auth login --domain apps
 
 `app_id` 必须是妙搭应用 ID（`app_` 开头）。`cli_` 开头的是飞书应用 ID（lark-cli 自身鉴权用，如 `auth status` 输出的 `appId`），**绝不能**传给任何 `apps +*` 命令。
 
-如果你拿到的是 `https://{租户域名}/page/<meta_token>` 这类链接里的 meta_token — 这是创意模式应用的 **meta_token**（链接形似飞书文档），先用 `+get` 解析出 `app_id`。如果拿到的不是链接、也不是 `app_` 开头，可能是裸 meta_token，同样先用 `+get --app-id <token>` 尝试获取应用信息，能正常返回则说明是 meta_token：
-
-```bash
-lark-cli apps +get --app-id <meta_token> -q '.data.app.app_id'
-```
-
 按顺序尝试，不要一上来要求用户手填：
 
 1. 用户给出 `app_xxx` 或妙搭链接（如 `/app/app_xxx`）时直接提取。
@@ -118,4 +107,4 @@ lark-cli apps +get --app-id <meta_token> -q '.data.app.app_id'
 ## 高影响动作：确认与预授权
 
 - **预授权判定**：判断用户是否表达了"放手做完、不用中途逐步问我"的意图——明确免确认（如"别问 / 直接做 / 自己定"），或要求一气呵成做到完成（如"做完部署上线给我"）。是 → 整个流程按合理默认往下走、不再逐步确认（含 clone 到派生目录、发布等）；否 → 缺失参数（如目录）该问就问、高影响动作先确认。
-- **禁止预授权判定底线**（即便已预授权也不豁免）：① 会删/丢数据或不可逆的 DB 操作（判据见 [`lark-apps-db-execute.md`](references/lark-apps-db-execute.md)）先 `--dry-run` 确认；② `+role-delete`、`+role-member-remove --all`、批量移除成员必须先确认 app、role、成员范围和后果，不能从泛化"直接做"推导出 `--yes`；命令式"删除/移除某对象"只确定操作目标，不等于用户已确认不可逆后果，未明确确认时应在说明影响后停下请求确认；③ `+html-publish` 体积超限时（判据见 [`lark-apps-html-publish.md`](references/lark-apps-html-publish.md)），立即停止并转述超限项。
+- **禁止预授权判定底线**（即便已预授权也不豁免）：① 会删/丢数据或不可逆的 DB 操作（判据见 [`lark-apps-db-execute.md`](references/lark-apps-db-execute.md)）先 `--dry-run` 确认；② `+role-delete`、`+role-member-remove --all`、批量移除成员必须先确认 app、role、成员范围和后果，不能从泛化"直接做"推导出 `--yes`；命令式“删除/移除某对象”只确定操作目标，不等于用户已确认不可逆后果，未明确确认时应在说明影响后停下请求确认；③ `+html-publish` 体积超限时（判据见 [`lark-apps-html-publish.md`](references/lark-apps-html-publish.md)），立即停止并转述超限项。

skills/lark-apps/creative-design/agents/fork-verifier-agent.md

@@ -1,71 +0,0 @@
-# Fork verifier (read-only)
-
-You are a **read-only** verification subagent spawned to check a design
-deliverable the main agent just built or edited. Your **only** job: load that
-deliverable, verify it, and report a single verdict — `done` or `needs_work` —
-back to the main agent. **You must not modify, create, or delete any file**,
-edit the source, build, or take any other action. You read, probe, and report —
-nothing else. Resolve every tool named below to your harness's equivalent via
-its reference doc (`references/<harness>.md`): a generic action like "show the
-file" or "evaluate JS in-page" maps to your harness's preview / eval tool.
-
-## Input
-
-You are given the **project directory**, the **path(s) of the HTML file(s)** the
-main agent built or edited, and the served
-`http://localhost:<port>/<file>.html` URL to load (always over HTTP —
-never `file://`). The caller may also include an explicit image-input status:
-`image input supported` or `image input unsupported`. You do **not** inherit the
-main agent's transcript; verify only what these inputs point at.
-
-## What to do
-
-1. Show the file the main agent built/edited (your harness's show-file / preview
-   tool — upstream `show_html`).
-2. Read the console / webview logs (upstream `get_webview_logs`) — console
-   errors? failed loads?
-3. Screenshot — layout / spacing / type / content look right? Skip screenshot
-   reads only when the caller explicitly says image input is unsupported; in
-   that case continue with console and JS/DOM checks and state that visual
-   screenshot review was skipped.
-4. Evaluate JS in-page (upstream `eval_js`) to probe if something seems off. For
-   overflow/alignment issues, diagnose the constraint before reporting:
-
-   ```js
-   const el = document.querySelector('...'); const p = el.parentElement;
-   const pick = (e, cs) => ({rect: e.getBoundingClientRect(), boxSizing: cs.boxSizing, display: cs.display, position: cs.position, width: cs.width, height: cs.height, minHeight: cs.minHeight, flexDirection: cs.flexDirection});
-   JSON.stringify({el: pick(el, getComputedStyle(el)), parent: pick(p, getComputedStyle(p))});
-   ```
-
-   Include the result in your `needs_work` description so the main agent fixes
-   the root cause (box-sizing, flex `min-height:auto`, percentage height with no
-   resolved parent height), not the pixel symptom.
-5. If the authored source uses `var(--*)`: evaluate JS to collect every custom
-   property DEFINED in the loaded stylesheets (any selector / `@layer` /
-   `@media`, not just `:root`):
-
-   ```js
-   const defined = new Set();
-   const walk = rs => { for (const r of rs||[]) { if (r.style) for (const p of r.style) if (p.startsWith('--')) defined.add(p); try { walk(r.cssRules || r.styleSheet?.cssRules); } catch {} } };
-   for (const ss of document.styleSheets) try { walk(ss.cssRules); } catch {}
-   JSON.stringify([...defined]);
-   ```
-
-   Then grep the authored file for `var\(--[a-zA-Z0-9_-]+` and report any
-   referenced name not in the defined set as unresolved.
-6. Report your verdict — `done` or `needs_work` with a description — as your
-   **final message** back to the main agent (upstream
-   `verification_feedback({verdict, description})`). The verdict IS the
-   deliverable; do not end on a prose summary with no verdict.
-
-## Rules
-
-- **Read-only, always.** Never write or edit files, build, serve, or run write
-  scripts. The upstream `write_file`, `str_replace_edit`, `show_to_user`,
-  `update_todos`, and `run_script` are all off-limits — if something is wrong you
-  *report* it; the main agent fixes it and re-runs you.
-- **`needs_work` = REAL problems only** — broken layout, console errors, missing
-  content, unresolved `var(--*)` tokens. Not nitpicks.
-- **The verdict is the only exit.** A text-only reply with no `done` /
-  `needs_work` verdict is a dead end — always end with the verdict + description.
-- Always load over the served `http://localhost:…` URL, never `file://`.

skills/lark-apps/creative-design/agents/vision-probe-agent.md

@@ -1,41 +0,0 @@
-# Vision probe (read-only)
-
-You are a **read-only** capability probe spawned before a design task tries to
-read or inspect screenshots. Your only job is to determine whether this Claude
-Code session's current model/provider can accept image input.
-
-## Input
-
-You are given the absolute path to a tiny PNG probe image — the committed asset
-that ships with this skill, usually:
-
-```text
-<skill>/agents/assets/vision-probe.png
-```
-
-## What to do
-
-1. Try to read/view the PNG with the harness's normal image-reading capability.
-   The probe image is a small colorful square with a dark X/border so successful
-   image input should be recognizable without needing any project context.
-2. If the image is visible to you, final-answer exactly:
-
-   ```text
-   VISION_OK
-   ```
-
-3. If the image cannot be read, the provider rejects image input, a tool fails,
-   or you are not sure, final-answer exactly:
-
-   ```text
-   VISION_UNSUPPORTED
-   ```
-
-## Rules
-
-- **Read-only, always.** Do not write, edit, delete, serve, preview, or inspect
-  any project files.
-- Do not read real design screenshots. This probe must touch only the tiny probe
-  image path provided by the main agent.
-- Do not explain your reasoning in the final response. The main agent needs one
-  exact token only: `VISION_OK` or `VISION_UNSUPPORTED`.

skills/lark-apps/creative-design/assets/index.html

@@ -1,27 +0,0 @@
-<!DOCTYPE html>
-<html>
-
-<head>
-  <meta charset="UTF-8">
-  <meta name="viewport" content="width=device-width, initial-scale=1.0">
-  <title></title>
-  <script
-    src="https://sf3-scmcdn-cn.feishucdn.com/obj/feishu-static/miaoda/coding-unpkg-sdk/react@18.3.1/umd/react.development.js"
-    crossorigin="anonymous"></script>
-  <script
-    src="https://sf3-scmcdn-cn.feishucdn.com/obj/feishu-static/miaoda/coding-unpkg-sdk/react-dom@18.3.1/umd/react-dom.development.js"
-    crossorigin="anonymous"></script>
-  <script
-    src="https://sf3-scmcdn-cn.feishucdn.com/obj/feishu-static/miaoda/coding-unpkg-sdk/@babel/standalone@7.29.0/babel.min.js"
-    crossorigin="anonymous"></script>
-  <!-- 其他内容 -->
-</head>
-
-<body>
-  <div id="root">
-    <!-- React 组件将渲染到这里 -->
-  </div>
-  <!-- 其他内容 -->
-</body>
-
-</html>

skills/lark-apps/creative-design/creative-design.md

@@ -1,239 +0,0 @@
----
-name: creative-design
-description: 以自包含 HTML 创建精致的设计产物：UI mockup、可交互原型、线框图（wireframe）、落地页、仪表盘、应用屏幕、移动 App、幻灯片 deck（即 PPT / PowerPoint 演示文稿）、动画视频（motion graphics、产品演示 Demo 动画、数据动画）、可视化报告 / 信息图（infographic）/ 视觉长图与视觉探索。只要用户要求为界面、产品屏幕、用户流程、内容版式、视觉产物或 pitch/deck 概念进行 design、mock up、prototype、wireframe、可视化、动画/动效、探索或制作 PPT/deck——即便他们没有说"设计"二字——就使用本 skill。Harness 无关：适用于 Aily、Claude Code、Codex Agent 及类似的具备文件能力的 agent。
----
-
-## 目录结构与运行环境
-本 skill 附带以下资源，路径均相对于本文件所在目录：
-
-- `references/<name>.md` — 媒介专属技能 prompt（如 `frontend-design.md`、`hi-fi-design.md`、`charts.md` 等；见文末「Skills 元信息」的完整列表）。与下方 harness 工具映射表同在 `references/` 目录。
-- `starter-components/` — 现成的 HTML/JS/JSX 脚手架（`design-canvas.jsx`、`deck-stage.js`、`ios-frame.jsx`、`android-frame.jsx`、`tweaks-panel.jsx`、`macos-window.jsx`、`browser-window.jsx`、`animations.jsx`）。见下文「Starter Components」。
-- `references/<harness>.md` — **harness 专属工具映射表**（`claude.md`、`codex.md`、`aily.md`）。本文行文使用的是 harness 无关的 web 工具名——`ask_user_question`、`copy_starter_component`、`invoke_skill("X")`、`generate_image`、`search_images`、展示文件等——**动手前先读取与你当前运行环境对应的 `references/<harness>.md`，把这些名字映射成你 harness 里的真实工具**。例如在 Claude Code 里 `ask_user_question` → `AskUserQuestion`、`copy_starter_component` → `Bash cp <本 skill 所在目录>/starter-components/<file> .`、`invoke_skill("X")` → `Read references/<file>.md`。
-- `assets/index.html` — React + Babel 的 HTML 起步模板（锁定版本 script 标签 + `#root` 挂载点），见下文「React + Babel」。
-
-## 工作流
-1. 理解用户需求。对全新或含糊的工作，提出澄清性问题。弄清输出物、精细度（fidelity）、选项数量、约束条件，以及涉及的 UI kit 与品牌。
-2. 探索所提供的资源。附件、文档链接、网页 URL 都要在动手前解析完（见「输入资料解析」）。
-3. 列出 todo 清单。
-4. 为本次任务创建独立的任务目录——多个任务会在同一个根目录下执行，直接写根目录会互相覆盖、文件串台；每个任务目录是一个**独立的妙搭应用仓库**——新任务先用 `+create` 建应用、再 `+init --app-id <app_id> --dir <任务目录>` 初始化仓库（会自动 clone 并切到 `sprint/default`，命令见「发布」前提），独立发布互不影响。把资源复制进任务目录，在其中创建交付物。用图片素材提升美观度与丰富度、或需要有依据的内容时，按「图像素材与外部信息」补充。
-5. （如有）自检React + Babel路径是否正确；ReactDOM.createRoot 是否参数正确，对应元素是否存在
-6. 收尾：提交你的改动。
-7. 发布：把产物发布到妙搭拿到可访问链接（见下方「发布」）。写完不发布，用户拿不到线上链接。
-8. 极其简短地总结——只讲注意事项与后续步骤，并给出发布后的可访问链接。
-
-鼓励你并发调用文件探索工具以提升效率。
-
-## 提问
-默认基于用户给的信息、项目上下文和合理假设直接开始，不为收集偏好而打断。只有当一个决策同时满足两条，使用可用的 向用户提问的 工具向用户提问：① 用户没说、且从 prompt / PRD / 截图 / 代码库 / 品牌资料也推不出；② 猜错要推倒重来（承重决策，下游都建在它上面）。两条只要有一条不成立——能合理推断，或猜错只是局部返工——就直接做。
-
-承重、推不出就必须先问的：交付媒介 / 格式（报告 vs deck vs 看板）；视觉 / 美学方向（从零起的项目、且资料里推不出一个有把握不返工的方向时）；大体量交付（整套 deck、多页产物）的受众 / 目的与核心范围。
-局部、给默认直接做的：变体数量与探索维度、界面文案、占位与示例内容、单屏 / 单组件的处理与密度——给合理默认（变体默认摆 2-3 个有清晰差异的方案），让用户在产出上重定向，不为它们提问。
-
-例如：
-
-- "做一份关于 X 的报告／材料"但没说格式 → 媒介推不出且承重，先确认交付格式（幻灯片 vs. 视觉报告 vs. 仪表盘），再问格式相关的问题。
-- 为附带的 PRD 做一套 deck → PRD 能推出受众 / 场景就直接做；只有受众、篇幅推不出且影响全局时才问。
-- 用这份 PRD 为 Eng All Hands 做一套 10 分钟的 deck → 无需提问；信息已足够。
-- 把这张截图变成交互原型 → 只有当图片无法说明预期行为时才提问。
-- 做 6 页关于黄油历史的幻灯片 → 媒介、页数已定，直接开工；风格能从主题推断就定，推不出再问。
-- 为我的外卖 app 的 onboarding 做一套原型 → 按常见 onboarding 流程直接做；只问会阻塞产出的承重问题。
-
-当交付格式本身不明确时——用户只说了一个成果（"一份报告""材料""一份摘要"）却没说媒介——先解决格式，再讨论任何与格式相关的细节。
-
-问出好问题至关重要。技巧：
-
-- 通常一轮聚焦提问就够；把承重的未知一次问齐，不要挤牙膏式多轮打断。
-- 只问推不出的；能从 PRD、截图、代码库、品牌资产、现有页面和用户原话推断的，先推断，并在产出里说明你的假设。
-
-## 输入资料解析
-用户给的附件、文档链接和 URL 是设计的输入，必须在动手前解析完——数据看板、报告和基于文档的 deck 全都建立在源资料之上，跳过这一步产出的内容只能靠编造。按输入形态处理：
-
-- **数据文件（csv / json / xlsx）**——先看结构（列名、字段类型、行数）和样本行，再决定信息层级与图表选型；指标一律用脚本从源数据计算，不要目测。
-- **压缩包（zip）**——先解压到临时目录，逐个查看内容物，再按各自类型处理。
-- **文档（docx / pdf / 论文 / 需求文档）**——用当前 harness 的文档解析能力读取**全文**（映射见 `references/<harness>.md`；Aily 原生支持解析 Word / PDF 等二进制文件），不要只读开头就动手。
-- **飞书云文档 / 多维表格链接**——用 `lark-cli` 读取内容（云文档 / 多维表格相关命令，不确定用法先查 `--help`）；`lark-cli` 不可用时向用户说明并请其导出或粘贴，不要凭标题猜内容。
-- **网页 URL**——用 `web_fetch` 抓取全文后再产出；抓取失败就告知用户，不要凭 URL 和常识编写。
-
-## 如何开展设计工作
-动手前先读取 **`./references/frontend-design.md`** 确立视觉方向——它教你如何果断做出有意图、不落模板俗套的美学抉择：有品牌或既有 UI 时对齐现有视觉语言，从零起步时据主题 / 材料立一个契合的方向。当媒介专属 skill 内的指令与通用设计规则冲突时，以媒介 skill 内的指令为准——这是规则内容的优先级，不改变「该加载 / 调用哪些 skill」。
-
-当用户请你做高保真 UI mockup、界面设计或带多方案的视觉探索时，开始之前先读取 **`./references/hi-fi-design.md`**——它涵盖了设计流程、获取设计上下文、提问以及呈现多个方案。
-
-一次设计探索的输出是单个 HTML 文档。根据你所探索的内容选择呈现格式：
-
-- **静态视觉 / 设计稿 / 多方案探索**（颜色、字体、单个元素、整屏 UI、流程关键帧）→ 通过 `starter-components/design-canvas.jsx` starter component 把各方案铺陈在画布上。除非用户明确要求可点击 / 可交互，否则不要把设计稿升级成点击原型。
-- **用户明确要求可交互的流程或产品 demo** → 将整个产品做成高保真可点击原型，并把关键选项以 Tweak 形式暴露出来。可交互原型禁止使用 `starter-components/design-canvas.jsx`、`<DCArtboard>` 或画布外壳包裹；它应该作为真实应用界面直接运行。
-
-这两者可以组合，但只限静态设计探索。已经做好的**可交互原型**如果用户接着想探索多个方向，用页内开关、路由、Tabs、Tweak 或模式切换承载变体；不要把交互原型放进 design-canvas 画布，也不要用 `<DCArtboard>` 并排包裹。
-
-当用户要求新版本或改动时，把它们作为 TWEAKS 加到原件上；拥有一个可切换不同版本开关的主文件，优于拥有多个文件。
-
-## 默认美学指令
-如果用户没给参考或艺术方向：能从主题、材料或场景推断出一个有把握、不会返工的视觉方向，就主动确定，并在设计中体现假设；如果推不出、又是从零起的项目，先用 `ask_user_question` 问清偏好的调性、受众、颜色、字体、情绪等再动手——不要在推不出方向时硬选，slop 就是这么来的。
-
-定下视觉方向后（无论是推断还是问来的），创建设计时遵循以下指引：
-
-- **字体与排版。** 选择与主题、媒介和场景匹配的少量字体，并通过字号、字重、字宽、行长、语义断行、数字样式和文字位置建立清晰层级与视觉节奏；不依赖增加字体数量制造变化。
-- **背景与色彩体系。** 确定主色调，并建立与主题协调的中性基底、主题色和必要的章节／语义色。背景不局限于纯黑、纯白或单一色调，可以根据内容属性、页面角色和叙事节点使用不同色调、主题色底、局部色域、图片或图形背景。
-- **色彩一致性。** 一致性来自共享色板、字体、栅格、图形语言和明确的颜色关系，不要求所有页面使用相同背景。颜色变化应帮助识别章节、信息层级和重点，避免无语义地逐页随机换色。
-- **强调色。** 使用数量克制、关系协调的强调色，并根据背景、信息层级和色彩语义调整明度与彩度。图表、状态和章节色需要清楚可区分，但应属于同一视觉体系。
-- **中性色。** 黑、白、灰可以带有与主题协调的细微色相，避免把纯黑白或低饱和配色作为所有专业场景的默认答案。
-- **视觉复杂度。** 视觉丰富度应服务内容。不要添加无信息价值的装饰，也不要把"克制"理解为单调、大量留白、缺少图片图表或所有页面使用同一种构图。
-
-关键：如果已给出其他美学指令（如参考图、品牌体系、设计规范或媒介专属 skill），或项目中已有文件，则完全忽略默认美学。
-
-## 图像素材与外部信息
-图片素材能显著提升产物的美观度与丰富度——不要默认只用纯 CSS/SVG 撑起全部视觉。为氛围、质感和视觉节奏而配图是正当用途，不需要等到"内容必须有图"才配图。选择工具的判断规则很简单：**需要真实图片就搜索，需要丰富美观的图片就生成**。当前 harness 若提供以下能力（映射见 `references/<harness>.md`；没有对应工具就跳过，用内联 SVG / CSS 图形兜底），在合适的位置主动使用：
-
-- **`generate_image`（AI 图片生成）**——美化、氛围类配图一律走生成：hero 图、插画、照片质感背景、章节题图、空状态插图、信息图（infographic）、产品/场景示意图等任何能让页面更好看的位置，用文生图直接生成；有品牌参考图或用户素材时用图生图对齐既有视觉语言；多屏 / 多页需要风格统一、角色连贯的插画体系时用组图一次生成整个序列；对已有图片做局部调整用图片编辑。生成 prompt 里写清风格、构图、配色与光线，让产出与已确立的视觉方向一致，而不是各自为政。
-- **`search_images`（图片搜索）**——需要真实图片时走搜索：真实存在的实物、产品、地点、人物、logo、截图等生成会失真或造假的素材，以及确立视觉方向时按关键词找参考图（同类产品界面、风格 moodboard）。直接引用搜索结果时注意来源与版权。
-- **`web_search` / `web_fetch`（联网搜索）**——内容需要真实事实、数据、案例或时效性信息时先搜再写，不要编造（见「内容准则」：涉及新增事实、数据时要有依据）。调研型产出（行业研究、政策梳理、竞争格局类 deck / 报告）要先做多轮搜索，把事实、数字与来源收集齐并标注出处，再进入设计。
-- **视频素材**——需要嵌入公开视频（培训短片、案例视频等）时，用联网搜索找到可公开访问的视频页面或可嵌入链接，以 `<iframe>` / `<video>` 嵌入并注明来源；不要下载搬运版权内容，也绝不虚构视频 URL——找不到合适的就如实告知用户并留占位。
-
-约束：
-
-- 配图要属于同一视觉体系——风格、色调、光线与已确立的视觉方向一致，宁可少而统一，不要多而杂乱；逐张风格漂移比没有图更伤美观度。
-- 用户已提供图片 / 品牌素材时优先使用，不要擅自用生成图替换。
-- 搜索到 / 生成的图片先落到本地，再用 `lark-cli apps +file-upload --app-id <app_id> --file <local_path> --as user` 上传，代码中引用返回的**远端 URL**——不要提交 git、不要引用本地路径、不要 base64 内联，也不要直接热链搜索结果页的原始 URL（可能防盗链或失效）。上传需要 `app_id`，任务尚未初始化时先按「发布」前提完成 `+create` / `+init` 两步。
-
-## 输出创建准则
-- **文件输出路径**：会话根目录下会并存多个任务。**每个任务先创建自己的独立目录**（语义化命名，如 `sales-dashboard/`）——它就是一个独立的妙搭应用仓库，独立初始化、独立发布。所有交付物写进本任务目录，主 HTML 入口是该目录下的 `index.html`。不要把文件写到任务目录之外的共用根目录，也不要改动其他任务的目录；用户要迭代某个已有任务时，进入该任务的目录继续改，不要另起新目录。
-- 对文件做重大修订时，先复制再编辑，以保留旧版本（如 index.html、index v2.html 等）。
-- 始终避免写大文件（>1000 行）。而应把代码拆成若干更小的 JSX 文件，最后在主文件里 import 进来。这让文件更易管理和编辑。
-- 对于视频和其他带时间轴的内容，让播放位置可持久化；每次变化时存入 localStorage，加载时再从 localStorage 读回。这样用户刷新页面时不会丢失当前位置，而刷新在迭代设计中很常见。（使用 `starter-components/deck-stage.js` 的 deck 不需要这么做——宿主会把幻灯片位置保存在 URL 中。）
-- 在既有 UI 上做增补时，先理解该 UI 的视觉语汇并遵循它。对齐文案风格、配色、语气、hover/click 状态、动画风格、阴影＋卡片＋布局模式、密度等。把你观察到的东西"出声想一想"会有帮助。
-- 写规范的 HTML，让编辑器能直接编辑：显式闭合每个非空（non-void）元素（写 `<p>…</p>`，绝不依赖隐式闭合），每个属性值都用双引号，且不要自闭合非空元素（写 `<div></div>`，而非 `<div/>`）。这有助于直接编辑功能正常工作。
-- 绝不使用 `scrollIntoView`——它可能搞乱 web app。如有需要，改用其他 DOM 滚动方法。
-- **颜色使用：** 有品牌色时优先沿用品牌体系；没有品牌或既有配色时，根据主题、受众、内容语义和视觉方向推导协调色板。避免随意加入彼此无关的颜色，不要默认退回纯黑白。对于数据图表和信息图，颜色应承担区分、强调或表达语义的作用，并保证足够对比。
-- **Emoji：** 不要在生成的代码中使用 emoji 字符——不作图标、不作装饰、不放进数据里。例外：仅当用户的品牌资产明确包含 emoji 时。
-- **图标：** 系统图标规则仅适用于需要界面图标体系的 UI 或交互原型。在这类产物中，使用手写内联 SVG（`<svg viewBox="0 0 24 24">`）建立语义贴切、风格连贯的图标语言。
-- **字体加载：** 需要 Google Fonts / web 字体时，一律从自托管镜像 `https://miaoda.feishu.cn/fonts/css2` 加载，不要直连 `fonts.googleapis.com` / `fonts.gstatic.com`——这两个 Google CDN 在部分地区慢、甚至连不上，会导致字体加载失败、页面回退到系统字体。镜像是 Google Fonts `css2` 端点的直接替代：查询语法完全一致（`?family=Inter:wght@400;600&display=swap`，多字族就重复多个 `family=` 参数），只需把域名换成镜像；它返回的 `@font-face` 会把字体文件也指向自托管 CDN，CSS 与字体文件两跳都不经过 Google，字库与字重同 Google Fonts。照常用 `<link rel="stylesheet" href="https://miaoda.feishu.cn/fonts/css2?family=…&display=swap">` 引入即可。
-
-## 内容准则
-
-**内容取舍。** 不添加与用户目标无关或没有依据的内容。在用户明确的范围内，可以重组、解释和补足完成叙事所需的信息；涉及新增事实、数据或任务范围时，再向用户确认或明确为示例。内容不足以独立成页时，应合并、重构或请求材料，不用放大元素和增加留白勉强撑页。
-
-**数据保真。** 用户给了源数据（附件、文档、表格）时，产物中的每个图表数字、指标和结论都必须从源数据实际计算得出（写脚本统计，见「输入资料解析」），并能追溯回源数据——不目测、不凑整、不编造。做数据报表/看板前读 `references/data-report.md`，其中的数据准则同样适用。
-
-**硬性规格是约束，不是建议。** 用户给定的页数/张数范围、画幅比例、结构大纲、预算上限、必须包含的表格或模块，逐条对照满足，交付前自查一遍；幻灯片的页数规划方法见 `references/make-a-deck.md`。
-
-**使用恰当的尺度：** 对于 1920x1080 的幻灯片，文字绝不应小于 24px；理想情况下要大得多。打印文档最小 12pt。移动端 mockup 的点击目标绝不应小于 44px。
-
-**避免 AI slop 套路：** 包括但不限于滥用渐变背景、emoji（见上面的 Emoji 规则）、圆角＋左边框强调色的容器、被用滥的字体族（Inter、Roboto、Arial、Fraunces）。
-
-**CSS**：`text-wrap: pretty`、CSS grid 以及其他高级 CSS 效果都是你的好帮手！
-
-**强烈倾向用带 `gap` 的 flex/grid，而非 inline 流。** 对任何一行或一组兄弟元素（按钮、chips、图标、卡片、导航项、工具栏），用 `display: flex` 或 `display: grid` 配合 `gap:` 来做间距——而不是用靠源码空白或逐元素 margin 分隔的裸 inline/inline-block 兄弟元素。flex/grid 的间距是显式的，能干净地经受直接操作类编辑（拖拽重排、删除、复制）；而 inline 流依赖空白文本节点，在 DOM 编辑下很脆弱。把 inline 流留给句子中偶尔夹带 `<a>`/`<strong>`/`<em>` 的文字段落——不要用它来排布 UI 元素。
-
-## 保留评论锚点
-某些源元素带有 `data-comment-anchor="…"` 属性。它把用户的评审评论钉在该元素上。编辑时，把该属性保留在你输出中语义等价的那个元素上——如果你重构了结构就随元素一起移动它，在文本／样式编辑中保留它，仅当你彻底删除该元素时才丢弃它。绝不发明新值，也不要把它复制到其他元素上。
-
-## 为幻灯片和屏幕打标签以提供评论上下文
-在代表幻灯片和高层级屏幕的元素上加 `[data-screen-label]` 属性；这样你就能分辨用户的评论是针对哪一张幻灯片或哪一屏。
-当用户说"slide 5"或"index 5"时，他们指的是第 5 张幻灯片（标签"05"），而绝非数组下标 `[4]`——人类不按 0 起始计数。
-
-## React + Babel（浏览器内 JSX）
-当用浏览器内 JSX 编写 React 原型（无构建步骤——Babel 在运行时转译）时，你必须使用下面这些锁定版本的确切 script 标签。不要使用未锁定版本（例如 react@18）。要用 React + Babel 时，可直接从本 skill 的 `assets/index.html` 拷贝 HTML 模板起步（`cp <本 skill 所在目录>/assets/index.html <任务目录>/index.html`）——它已带好这三个 script 标签和 `#root` 挂载点，不必手写。
-
-```html
-<script src="https://sf3-scmcdn-cn.feishucdn.com/obj/feishu-static/miaoda/coding-unpkg-sdk/react@18.3.1/umd/react.development.js" crossorigin="anonymous"></script>
-<script src="https://sf3-scmcdn-cn.feishucdn.com/obj/feishu-static/miaoda/coding-unpkg-sdk/react-dom@18.3.1/umd/react-dom.development.js" crossorigin="anonymous"></script>
-<script src="https://sf3-scmcdn-cn.feishucdn.com/obj/feishu-static/miaoda/coding-unpkg-sdk/@babel/standalone@7.29.0/babel.min.js" crossorigin="anonymous"></script>
-```
-
-发布前需要对以上 script 路径进行自检，确保它们路径与上述代码完全一致
-
-### 脚本导入
-用 script 标签导入你写的任何辅助脚本或组件脚本。`.jsx` 文件必须用 `<script type="text/babel" src="xxx.jsx"></script>`——它们含 JSX 语法，需要 Babel 转译；省略 type 属性会让浏览器把 JSX 当作纯 JS 解析，从而抛出语法错误。纯 `.js` 文件可以用普通的 `<script src="xxx.js"></script>`。避免在脚本导入上使用 `type="module"`——它可能会出问题。
-
-**加载顺序**：`@babel/standalone` 用异步 XHR 拉取外部 `<script type="text/babel" src="...">` 文件，但保证按 DOM 顺序执行——靠前的脚本总在靠后的脚本之前运行。然而，内联脚本（无 `src`）会立即就绪，而外部脚本必须等待网络响应。如果一个内联脚本排在前面，它会立即执行，其副作用（例如 React 的 `useEffect`）可能在任何后面的外部脚本加载之前就触发。把外部脚本放在依赖它们的内联脚本之前。
-
-### 跨文件作用域
-每个 `<script type="text/babel">` 在转译后都有自己独立的作用域。要在文件间共享组件，在组件文件末尾把它们导出到 `window`：
-
-```js
-// 在 components.jsx 末尾：
-Object.assign(window, {
-  Terminal, Line, Spacer,
-  Gray, Blue, Green, Bold,
-  // ... 所有需要共享的组件
-});
-```
-
-### 样式对象命名
-定义全局作用域的样式对象时，给它们起具体的名字。如果你导入了 1 个以上带 `styles` 对象的组件，就会出问题。你必须基于组件名给每个 styles 对象起唯一的名字，比如 `const terminalStyles = { ... }`；或者用内联样式。绝不要写 `const styles = { ... }`。
-
-### 动画
-对于视频风格的 HTML 产物，调用 `animated-video` skill 并从 `starter-components/animations.jsx` starter component 起步——不要自己实现时间轴引擎。对于简单的交互原型过渡，CSS transitions 或纯 React state 就够了。
-
-### 原型
-- 克制住加"标题"屏的冲动；让你的原型在视口中居中，或做成响应式尺寸（填满视口并留合理边距）。
-
-## Starter Components（起始组件）
-现成的 HTML/JS/JSX 脚手架（scaffold）就放在本文件旁边的 `starter-components/` 目录里——需要设备外框（device frame）、幻灯片外壳（deck shell）、画布（canvas）或动画时间轴（animation timeline）时，直接用它们，不要手搓。使用方式：把文件拷进当前任务目录（在任务目录下执行 `cp <本 skill 所在目录>/starter-components/<file> .`——注意 cwd 不会是 skill 目录，要用 skill 目录的实际路径），或读过之后照着改；每个文件顶部都带有自己的用法说明。
-
-- `design-canvas.jsx` — 可平移／缩放的画布，artboard 可重排、可全屏聚焦。
-- `deck-stage.js` — 幻灯片 deck 外壳。用于任何幻灯片演示（见「Skills 元信息」中的 Make a deck）。
-- `ios-frame.jsx` / `android-frame.jsx` — 带状态栏和键盘的设备边框。
-- `tweaks-panel.jsx` — 浮动的 Tweaks 面板＋表单控件（`useTweaks`、滑块、开关、单选、颜色 chips 等）。
-- `macos-window.jsx` / `browser-window.jsx` — 桌面窗口外壳（chrome）。
-- `animations.jsx` — 基于时间轴的动画引擎（Stage + Sprite + scrubber + Easing）。
-
-## Tweaks
-用户可以从工具栏开关 **Tweaks**——一个存在于原型内部的页内控件面板（颜色、字体、间距、文案、布局变体）。不要自己实现它：用 `kind: "tweaks-panel.jsx"` 调用 `copy_starter_component` 并阅读复制出来的文件——它接好了宿主协议，并给你 `useTweaks()` 以及现成的控件。这个面板的标题按界面语言来定——英文叫"Tweaks"，中文叫"风格"。把它保持小巧，Tweaks 关闭时完全隐藏，并且即使用户没要求，也默认加上几个有品味的 tweak。你写在面板里的标签和选项是用户会读到的内容，而非配置——用与 app 其余部分相同的语言书写。
-
-**闭环。** 每个 tweak 都需要一个生产者（面板控件）和一个消费者（对该值作出反应的内容）。只存在于 `<TweaksPanel>` 和 `TWEAK_DEFAULTS` 里的值不会改变设计中的任何东西——用户看到控件有反应，但原型纹丝不动。
-
-## 发布
-设计产物写完并提交后，需要发布到妙搭（lark-apps）才能拿到可访问链接。本 skill 产出的是创意模式（html）应用，发布走本地开发链路：改动 git commit 后推到工作分支 `sprint/default`，再用 `lark-cli apps` 命令发起部署并轮询结果。
-
-**前提**：每个任务目录是一个独立的妙搭 html 应用仓库，独立发布、互不影响；发布序列的所有命令都在**当前任务目录**内执行。任务目录还不是应用仓库（没有 `.spark/meta.json`）时，先完成两步初始化：
-
-```bash
-# 1. 创建应用，记下返回的 app_id（app_ 开头）
-lark-cli apps +create --name "<应用名>" --app-type html --as user
-
-# 2. 初始化到任务目录：会自动 clone 远端仓库并 checkout 工作分支 sprint/default，
-#    无需 git init / git checkout（--dir 不传默认 ./<app-id>；
-#    --source-path 可把已写好的产物一并并入，但源码目录不存在时会被静默跳过，用后核对文件确实进了仓库）
-lark-cli apps +init --app-id <app_id> --dir <任务目录> --as user
-```
-
-初始化后在任务目录内创建 / 修改产物（创意模式是 buildless，源码即产物，`index.html` 放仓库根目录），然后走下方发布序列。
-
-`app_id`（`app_` 开头）从任务目录的 `.spark/meta.json` 读取，或来自 `+create` 的返回 / 用户给出——`cli_` 开头的是飞书应用 ID，绝不能传给 `apps +*` 命令。资源型文件（图片、字体、音视频）不要提交 git、不要引用本地路径、也不要 base64 内联；先 `lark-cli apps +file-upload --app-id <app_id> --file <local_path> --as user` 上传拿远端 URL 再在代码里引用（见「图像素材与外部信息」）。
-
-发布序列：
-
-```bash
-# 1. 提交并推到工作分支 sprint/default
-#    遇非 fast-forward：先 git pull --rebase origin sprint/default 解决冲突再推，绝不 force-push
-git add . && git commit -m "feat: ..." && git push origin sprint/default
-
-# 2. 发起部署（记下返回的 release_id），然后轮询状态直到 finished / failed：
-#    publishing → 继续轮询；finished → 输出含可分享的 online_url，直接返回给用户；failed → 按输出中的 error_logs 报告失败原因
-lark-cli apps +release-create --app-id <app_id> --as user
-lark-cli apps +release-get --app-id <app_id> --release-id <release_id> --as user
-```
-
-要点：
-
-- 所有 git 命令必须在**任务仓库根目录**下执行（每条命令先 `cd <任务目录>`，或用 `git -C <任务目录>`）——`git add .` 作用于当前 cwd，在多任务共用的上级根目录里执行会把其他任务的文件也 stage 进来。
-- 推送和部署的分支必须是 `sprint/default`：推到其他分支，`+release-create` 会失败。
-- `+release-create` 部署的是远端 `sprint/default` 上**已 push** 的代码，不是本地工作区——未 commit / 未 push 的改动不会进入这次发布。
-- 完成 ≠ 发布：产物生成完、或 `+list` 显示 `is_published=true`，都不代表最新内容已上线；必须拿到本轮 `+release-get` 返回的 `finished` 才算发布成功。
-- 创意模式（html）应用**开发态与发布态是同一个链接**（形如 `https://{租户域名}/page/{meta_token}`，形似飞书文档链接），`online_url` 即最终可分享链接。
-- 任何 git 操作（push / pull / clone）报认证失败、401/403、credential helper 缺失或 token 过期时，先执行 `lark-cli apps +git-credential-init --app-id <app_id> --as user` 刷新本地 Git 凭证，再重试原 git 命令；刷新凭证也失败就停下向用户报告错误，不要改走其他发布路径（尤其不要用 `+html-publish`）。
-
-## Skills 元信息
-你有以下内置技能 prompt，位于本文件相对路径下的 `references/` 目录中。如果用户的需求与其中某个技能匹配，而对应的 prompt 尚未加载进你的上下文，就去 READ（读取）相应文件，把它的指引加载进来。
-
-- **[Animated video](references/animated-video.md)** — Use when creating animated videos, motion graphics, product walkthroughs, or visual storytelling with timeline-based playback. 触发词：animation, video, motion, 动画, 视频, 动效, 产品演示, 演示动画, walkthrough
-- **[Charts](references/charts.md)** — 基于 ECharts 的数据可视化，用于浏览器直出 HTML。当需要创建图表、仪表盘或数据可视化时使用。触发词：chart, ECharts, 图表, 可视化, visualization, 饼图, 柱状图, 折线图, 数据图表, 甘特图, 热力图, 数据展示, dashboard, 仪表盘, 数据看板
-- **[Data report](references/data-report.md)** — 数据驱动的报表与看板设计。从数据分析到报表规划、信息层级组织，适用于用户有数据文件或明确指标，需要产出结构化数据报表的场景。图表绘制部分由 charts skill 承担。触发词：数据报表, 数据看板, 数据分析报表, BI, 经营报表, 指标看板, 周报, 月报, 数据大盘, KPI, 报表设计, data report, dashboard report, analytics report
-- **[Frontend design](references/frontend-design.md)** — Guidance for distinctive, intentional visual design when building new UI or reshaping an existing one. Helps with aesthetic direction, typography, and making choices that don't read as templated defaults.
-- **[Hi-fi design](references/hi-fi-design.md)** — 用于创建高保真 UI mockup、设计探索，或带多种变体的视觉原型。触发词：mockup, hi-fi, prototype, UI design, 高保真, 设计稿, 原型, 界面设计, 视觉设计, 设计方案
-- **[Interactive prototype](references/interactive-prototype.md)** — 可交互原型：像真实应用一样直接运行的高保真交互 demo。触发词：可交互原型, 交互原型, 点击原型, interactive prototype, working app, 产品 demo, 工单系统, 管理后台, 看板工具, 多页面应用
-- **[Make a deck](references/make-a-deck.md)** — 当用户要求制作幻灯片（slide deck）、演示文稿（presentation）、pitch deck 或 "slides"——即一个供演讲者演示的自包含 HTML 单页（1920×1080，16:9），而非网站时使用。
-- **[Visual exposure](references/visual-exposure.md)** — 用于制作可视化报告、专题视觉页、信息图、视觉长图、概念可视化、产品能力曝光、方案亮点展示等内容型 HTML 视觉作品。适合用户想把材料、数据或观点组织成可阅读、可展示、可传播的视觉化表达，但不希望做成 PPT、传统 dashboard 或纯 ECharts 图表的场景。触发词：可视化报告, 视觉报告, 可视化曝光, 视觉化曝光, 信息图, 长图, infographic, 视觉表达, 概念可视化, 亮点展示, 能力曝光
-- **[Wireframe](references/wireframe.md)** — Explore many ideas with wireframes and storyboards

skills/lark-apps/creative-design/references/aily.md

@@ -1,39 +0,0 @@
-# Aily 工具参考
-
-本文档列出 [`../creative-design.md`](../creative-design.md) 所依赖的 harness 专属工具，供你在 **Aily** 中运行时使用。主提示词只命名能力（"向用户提问"、"展示文件"等）；本文档给出 Aily 的调用方式。通用工具（`Bash`、文件读/写/编辑、grep/glob 搜索）在任何环境都相同，不在此覆盖。
-
-## Web 工具 → Aily 对应项
-
-上游提示词引用了一些在 Aily 中并不存在的 Claude.ai web 工具。无论出现在行文还是代码里，一律按下表替换：
-
-| Web 工具 | Aily 对应项 |
-|---|---|
-| `ask_user_question` | `ask_user`（向用户抛出结构化决策问题；先问，等用户答复后再继续）。 |
-| `done`、`fork_verifier_agent` | 用 `submit` 交付结果并给出文件路径。 |
-| `write_file`（及其 `asset:` 参数） | Aily 的「创建/编辑本地文件」工具。不存在 asset review pane；舍弃这一概念。 |
-| `copy_files` | `Bash cp`。 |
-| `read_file`、`list_files`、`view_image` | 「读取本地文件」；按文件名查找用 glob、搜内容用 grep；图片直接走「解析二进制文件（…图片…）」——Aily 原生支持图像输入。 |
-| `show_to_user` | 用 `submit` 交付并给出绝对本地文件路径。 |
-| `eval_js`、`eval_js_user_view`、`run_script` | 脚本用 `Bash`。 |
-| `web_fetch`、`web_search` | `fetch`、`web_search`。用于时效性事实、内容素材补充或用户要求的查询。 |
-| `generate_image` | `aily-image-generate_workbench`（Seedream V4.5 模型）：支持文生图、图生图（给参考图）、信息图（infographic）、图片编辑、组图（一次生成多张风格统一、角色连贯的图像序列）。 |
-| `search_images` | `doubao_image_search`（按关键词搜索图片，适合找参考图、素材图）。 |
-| `copy_starter_component` | `Bash cp <本 skill 所在目录>/starter-components/<file> .`（cwd 通常是应用项目目录而非 skill 目录，需用 skill 目录实际路径；或读取后改编）。 |
-| 文档解析（docx / pdf） | Aily 原生「解析二进制文件」能力直接读取 Word / PDF / Excel / PPT 全文；PDF 也可用 `aily-pdf` 专用工具。 |
-| `invoke_skill("X")` / `invoke the "X" skill` | 用 `get_skills("X")` 加载对应媒介技能（如 `get_skills("frontend-design")`）。这些技能同时以本地文件形式随本 skill 附带在 `references/<X>.md`，`get_skills` 取不到时直接读该文件。 |
-
-## 提出澄清性问题
-
-用 `ask_user` 提出聚焦的结构化问题——它把用户的决策内联返回，先问、等答复后再继续。它最适合高影响力的承重决策：交付格式、保真度、设计上下文、参考应用、变体数量。一轮提问保持简明、可执行。不要虚构假的工具名。
-
-## 交付与发布
-
-- 用 `submit` 提交交付结果，并给出绝对本地文件路径。
-- 产物完成并提交后，按 [`../creative-design.md`](../creative-design.md)「发布」一节发布到妙搭——交付给用户的可分享链接是 `+release-get` 返回的 `online_url`。
-
-## Aily 专属注意事项
-
-- **优先用专用工具而非手搓。** 除了通用 `Bash`，Aily 还带一批专用工具（`aily-xlsx`、`aily-chart`、`aily-diagram`、`aily-pdf`、`aily-image-generate_workbench` 等）。涉及表格、图表、流程图、PDF、图像生成时，优先用对应专用工具，而不是用 `Bash` 从零脚本化。
-- **图像素材优先走生成 / 搜索。** [`../creative-design.md`](../creative-design.md)「图像素材与外部信息」一节的 `generate_image` / `search_images` 在 Aily 下都有真实对应（见上表），设计产物需要 hero 图、插画、信息图、连贯组图或参考图时应主动使用，而不是默认全部用 CSS/SVG 兜底。搜索到 / 生成的图片先落到本地，再用 `lark-cli apps +file-upload` 上传、在代码中引用返回的远端 URL，不提交 git。
-- `agent` 的 `slide` 子类型用于生成**飞书幻灯片**，与本 skill 产出的自包含 HTML deck（`starter-components/deck-stage.js`）是两条不同路径，不要混用——本 skill 的 deck 始终是 HTML。
-- 交付统一走 `submit`；需要跨轮次保留项目上下文时可用 `aily-work-memory`。

skills/lark-apps/creative-design/references/animated-video.md

@@ -1,34 +0,0 @@
----
-name: animated-video
-metadata:
-  display-names:
-    zh-CN: 动画视频
-    en-US: Animated Video
-description: Use when creating animated videos, motion graphics, product walkthroughs, or visual storytelling with timeline-based playback. 触发词：animation, video, motion, 动画, 视频, 动效, 产品演示, 演示动画, walkthrough
-available-agents:
-  - CreativeDesign
----
-
-# Animated video
-
-Create an animated video or motion design piece rendered as an HTML page. Build a timeline-based animation with smooth transitions. Design frame-by-frame sequences with playback controls (play/pause, scrubber). Focus on visual storytelling; take the palette from the user's brand assets, or derive it from the subject per [`../creative-design.md`](../creative-design.md)「默认美学指令」— never default to any fixed brand palette. Export-ready at a fixed aspect ratio (16:9 or 9:16). If you need to know the position of an element (eg to move a cursor or character between elements) use refs to grab the position.
-
-START by calling `copy_starter_component` with `kind: "animations.jsx"` — it gives you a ready-made timeline engine: `<Stage width height duration>` (auto-scales to viewport, scrubber + play/pause + ←/→ seek + space + 0-to-reset, persists playhead), `<Sprite start end>` to gate children to a time window, `useTime()` / `useSprite()` hooks, an `Easing` library, `interpolate()` / `animate()` tweens, and `TextSprite` / `ImageSprite` / `RectSprite` primitives with built-in entry/exit. Read the file after copying and build YOUR scenes by composing Sprites inside a Stage; only fall back to Popmotion (https://sf3-scmcdn-cn.feishucdn.com/obj/feishu-static/miaoda/coding-unpkg-sdk/popmotion@11.0.5/dist/popmotion.min.js) if the starter genuinely can't do what you need.
-
-Animations are complex code! Make reusable JSX components for each visual element and each scene. Invest in tweaking the timeline iteratively.
-
-Animation tips:
-- Storytelling is KEY! Before you create ANYTHING, identify the story arc, key tensions, characters, etc. Align on the message you want to convey. Run it by the user.
-- Use good animation principles... anticipation, easing, follow-through, exaggeration, all the Disney animator principles.
-- Scenes should have establishing shots setting the scene (use titles or captions if NECESSARY, but prefer to show not tell), followed by heavy zooms on the action. (either hard cuts, or ken-burns-style zooms, or mouse-follows.) Most scenes should exist in a realistic context: they should have a background, or exist in the UI of a computer or phone; etc. Elements should generally not float in the aether.
-- In short animations, most 'scenes' are a single shot, or a sequence of shots in the same setting. Scenes may be slides (e.g. text or graphics onscreen, animating or being emphasized (highlighted etc) in an engaging way that calls attention to the key thing). Decide what the shot is going to be. Maybe it's starting zoomed out, then slowly zooming in on the area of focus or action. Maybe it's rapidly cutting back/forth between two people or graphics in tension. Maybe you're following something, like a cursor or a line on a graph, as it flits around. Be creative!
-- Except for deliberate dramatic effect (a held beat), SOMETHING should always be in motion. The camera, an element, or a transition — slowly panning, zooming, subtly scaling up, drifting, or building. A truly static frame reads as a bug. Images especially: always slowly zoom in/out, pan, have some 'action', have text or graphics appearing or building, or be rapidly cutting in sequence.
-- Whenever you show text or images, remember that you need pauses for it to sink in -- on the order of seconds -- before you can show something else.
-
-If cursor or pointer movement is depicted (eg in a product walkthrough or prototype), you should zoom in on it and follow it with a damped viewport animation, like Screen Studio would. You MUST use HTML refs to locate elements onscreen so the cursor points at the right things.
-
-For product-demo animations (simulated clicks, drags, dialogs, status changes), build a believable product UI and animate its real interface state — do NOT substitute an abstract flowchart or node diagram for the product screen. Reuse the device/window shells from `starter-components/` (`ios-frame.jsx`, `android-frame.jsx`, `macos-window.jsx`, `browser-window.jsx`) instead of hand-rolling frames.
-
-For data-driven animations (annual-review numbers, dashboards coming alive, chart morphing): animate counters by tweening the value with `animate()` / `interpolate()` and rendering the formatted number; morph charts by interpolating the underlying data array each frame and re-rendering the SVG bars/paths (or driving ECharts `setOption` from `useTime()`); chain chapters with scene transitions. Every number shown must come from the user's real data (see [`../creative-design.md`](../creative-design.md)「数据保真」).
-
-For clarity when commenting, update the video root's data-screen-label attr with the current timestamp each second, so you can easily comment on a particular timestamp and know that the agent will be told exactly the timestamp. `<Stage>` does NOT do this for you — wire it up yourself, e.g. inside a component rendered in the Stage: `const t = useTime(); const sec = Math.floor(t); useEffect(() => { document.querySelector('.video-root')?.setAttribute('data-screen-label', sec + 's'); }, [sec]);`

skills/lark-apps/creative-design/references/charts.md

@@ -1,165 +0,0 @@
----
-name: charts
-metadata:
-  display-names:
-    zh-CN: 图表
-    en-US: Charts
-description: "基于 ECharts 的数据可视化，用于浏览器直出 HTML。当需要创建图表、仪表盘或数据可视化时使用。触发词：chart, ECharts, 图表, 可视化, visualization, 饼图, 柱状图, 折线图, 数据图表, 甘特图, 热力图, 数据展示, dashboard, 仪表盘, 数据看板"
-available-agents:
-  - CreativeDesign
----
-
-# 图表
-
-你是用 ECharts 呈现信息的数据叙事设计者。你的图表会出现在创意 HTML 产物中，例如仪表盘、幻灯片、设计探索。ECharts 是你的媒介，不是目标；你的工作是让数据故事一眼可读，而不是堆配置项。一个图表只表达一个主要信息。
-
-## 设计原则
-
-**先编码，再装饰。** 每个视觉通道——位置、长度、颜色、大小——要么在编码一个数据维度，要么就是噪音。先决定每个通道代表什么，再决定它看起来怎样。没有编码含义的颜色应保持统一；读者会尝试解读颜色差异，并从中读出并不存在的意义。
-
-**匹配产品的视觉语言。** 先阅读 UI 的视觉语言，再跟随它。图表颜色从产品现有色板中派生；字体从产品字体体系中派生。一个像从别的产品里掉进来的图表，会削弱用户对数据的信任。
-
-**克制。** 图表靠精确赢得信任，不靠"看起来厉害"。跳过 3D 效果、无意义的渐变，以及不服务于理解的动画。
-
-**平面化。** 出现在报表、看板、报告中的图表默认采用平面风格：细网格线、清晰坐标、纯色或轻微面积填充、必要注释。不要使用 `shadowBlur`、`shadowColor`、发光点、拟物高光或容器阴影来制造层次；层次来自数据权重、线宽、颜色语义和版式面积。
-
-## 流程
-
-按顺序完成这些步骤。不要一上来就写 ECharts options。
-
-1. **审视数据。** 数据有哪些维度？范围是什么？它在讲什么故事——趋势、比较、构成、分布、流向、排名？
-
-2. **选择图表类型。** 根据数据的故事，从下方的映射表中选择。
-
-3. **分配视觉编码。** 对每个视觉通道，明确它代表哪个数据维度：
-   - **位置**（x/y）→ 通常是主维度
-   - **长度/面积** → 通常是度量值
-   - **颜色** → 问自己：这张图中颜色在编码什么？
-
-     | 颜色编码的内容 | 配色方案 |
-     |---|---|
-     | **分类**（无序分组：渠道、部门） | 从产品调色板中为每组取一个不同色相，≤8 个 |
-     | **顺序或强度**（阶段、排名、分桶、单一指标） | 单一色相，纯色或从浅到深渐变 |
-     | **相对中点的偏离**（盈亏、实际 vs 目标） | 两个色相在中性色处交汇 |
-     | **价值判断**（好/坏、通过/失败） | 产品语义 token（success / warning / danger） |
-     | **无编码**（单系列，或形状已经承载了编码） | 一个纯色品牌色，所有元素统一 |
-
-     如果你在给一个**有序**系列中的每个元素分配**不同色相**，停下来——你正在把序列伪装成互不相关的分类。读者会看到 N 个无关的东西，而非一个渐进过程。
-
-4. **一次性定义色板。** 从产品 design tokens 中定义颜色。仪表盘中的每个图表都复用同一套颜色分配——同一个分类在不同图表中使用不同颜色，会迫使读者逐图重新学习编码。
-
-5. **编写 ECharts 代码。** 挂载模式和 API 约束见下方技术参考。
-
-6. **自检。** 截图检查结果。按文末清单验证。然后回到视觉编码步骤：渲染出来的图表是否真的表达了你想表达的信息？颜色编码与仪表盘其他部分是否一致？
-
-## 图表类型映射
-
-按数据故事选择图表，不按"看起来酷不酷"选择。
-
-| 数据故事 | 图表 | 关键约束 |
-|---|---|---|
-| 时间趋势 | Line / Area | ≤5 个系列；数据必须按时间排序 |
-| 分类比较 | Bar | — |
-| 部分与整体 | Pie（≤5 项）、Treemap / Sunburst（>5 项） | Pie >5 项 → 改用横向 Bar |
-| 分布 | Scatter、Heatmap、Boxplot | Heatmap 必须配合 `visualMap` |
-| 多维度画像 | Radar（≤8 维）、Parallel（>8 维） | — |
-| 流转 / 转化 | Funnel | — |
-| 关系 | Sankey、Graph、Tree | Sankey 的链接必须构成 DAG |
-| 日程 / 时间线 | 通过 `custom` series 实现 Gantt | 禁止用 stacked Bar 表示时间线 |
-| 金融 | Candlestick | — |
-| 主题 / 叙事流 | ThemeRiver | — |
-
-## 多图表仪表盘
-
-仪表盘中的多个图表共享上下文。把仪表盘当作一个整体页面，而不是一堆独立组件：
-
-- **共享色板**：只定义一次颜色分配（例如"渠道 A = blue，渠道 B = green"），并在所有图表中复用。
-- **坐标一致**：如果两个图表共享同一维度（时间、分类），对齐它们的坐标范围和刻度，让读者能横向扫描。
-- **视觉层级**：一到两个图表承载核心故事；其余图表提供支撑。尺寸和位置要表达这种主次关系。
-- **表达覆盖**：把用户需求拆成需要被回答的信息关系；每个被承诺的关系都要有对应的图表、表格、矩阵或文字证据承载。不要用少量通用指标和默认图表替代所有分析任务。
-- **小容器防崩**：小尺寸图表优先用 bar / line / number strip。饼图、雷达图、词云和外部标签很容易挤压重叠；空间不足时换图表类型，而不是缩小到不可读。
-
-## 技术参考
-
-### 加载 ECharts
-
-```html
-<script src="https://sf3-scmcdn-cn.feishucdn.com/obj/feishu-static/miaoda/coding-unpkg-sdk/echarts@5.6.0/dist/echarts.min.js" crossorigin="anonymous"></script>
-```
-
-`echarts` 通过 `window.echarts` 全局可用，无需 import。渐变：`new echarts.graphic.LinearGradient(0, 0, 0, 1, [...colorStops])`。
-
-### 挂载——纯 HTML
-
-```html
-<div id="chart" style="width:100%;min-height:300px"></div>
-<script>
-  const chart = echarts.init(document.getElementById('chart'));
-  chart.setOption({ /* ... */ });
-  window.addEventListener('resize', () => chart.resize());
-</script>
-```
-
-### 挂载——React 封装
-
-定义一次，复用。**不要**添加 echarts-for-react。
-
-```jsx
-function EChart({ option, style }) {
-  const ref = React.useRef(null);
-  React.useEffect(() => {
-    const chart = echarts.init(ref.current);
-    chart.setOption(option);
-    const onResize = () => chart.resize();
-    window.addEventListener('resize', onResize);
-    return () => { chart.dispose(); window.removeEventListener('resize', onResize); };
-  }, [option]);
-  return <div ref={ref} style={{ width: '100%', minHeight: 300, ...style }} />;
-}
-Object.assign(window, { EChart });
-```
-
-用法：`<EChart option={option} style={{ height: 400 }} />`
-
-## 自检清单
-
-提交前按下面清单检查生成代码。每一项都对应真实出现过的 ECharts 渲染问题或视觉缺陷。
-
-### 致命问题
-
-| 检查项 | 修复方式 |
-|---|---|
-| 使用了 hsl / hsla / rgb / rgba 颜色 | 只用 Hex（`#1890ff`）——hover 透明度在非 hex 色值下容易出问题 |
-
-### 严重问题
-
-| # | 检查项 | 修复方式 |
-|---|---|---|
-| 1 | Pie 分类 >5 个 | 改用横向 Bar |
-| 2 | Line 系列 >5 条 | 拆分或筛选 |
-| 3 | Radar 给每个 indicator 设置了 `max` | 移除；改为自动计算 |
-| 4 | Radar 多系列、不同量纲 | 先做归一化 |
-| 5 | Bar 缺少 `boundaryGap` | 设置 `boundaryGap: true` |
-| 6 | Funnel label 被隐藏或位置不在内部 | `label: { show: true, position: 'inside' }` |
-| 7 | 容器高度 <300px | `min-height: 300px` |
-| 8 | 单张图表中分类色（每项一个色相）>8 种 | 聚合或分组 |
-| 9 | Pie / 环形图的分类或数值只能靠 tooltip 读到——用了外部引导线标签（`position` 为 `'outside'` 或缺失），或干脆 `label: { show: false }` 且既无图例也无中心标注 | 分类 + 数值必须**静态可读**（tooltip 不算，图表常被导出 / 截图当静态图看）。任选其一：inside 标签标注 `name` + 百分比（扇区够大时）、图例映射色 → 分类、或环形图中心标注关键数值。禁止外部引导线标签（`position: 'outside'` 易重叠 / 裁切），也禁止只靠 tooltip 承载分类 / 数值 |
-| 10 | Pie 设置了 `itemStyle` | 完全移除 |
-| 11 | 任何 series 设置了 `label.color` | 禁止设置；由 theme 控制 |
-| 12 | `label.formatter` 使用字符串模板 | 改用回调：`formatter: (params) => ...` |
-| 13 | legend / visualMap 与图表重叠 | legend: `{ type: 'scroll', bottom: 0 }`；`grid.bottom ≥ '20%'` |
-| 14 | Heatmap 缺少 `visualMap` | 必须添加；当 x 轴标签并存时 `grid.bottom ≥ '25%'` |
-| 15 | Sankey 存在环形链接 | 验证 DAG |
-| 16 | 正负混合 Bar 使用统一 `borderRadius` | 圆角朝向柱体的开口端 |
-| 17 | 双 Y 轴零点未对齐 | 匹配 `\|min\| / max` 比例 |
-| 18 | 图表 series 或容器使用阴影/发光效果 | 移除 `shadowBlur`、`shadowColor`、容器 `box-shadow`，改用线宽、透明度、注释或面积大小表达层级 |
-| 19 | 图表或标签挤压、重叠、被容器裁切 | 增大容器、减少标签、改用 tooltip / inside label，或换成更稳的图表类型 |
-
-### 不建议
-
-| 避免 | 更好的选择 |
-|---|---|
-| Radar >8 个维度 | Parallel coordinate |
-| Line 连接未按时间排序的点 | Bar 或 Scatter |
-| markPoint 重复（统计极值 = 业务事件） | 仅保留业务注释 |
-| 用 Stacked Bar 表示 Gantt | 使用带 `renderItem` 的 `custom` series |

skills/lark-apps/creative-design/references/claude.md

@@ -1,36 +0,0 @@
-# Claude Code 工具参考
-
-本文档列出 [`../creative-design.md`](../creative-design.md) 所依赖的 harness 专属工具，供你在 **Claude Code** 中运行时使用。主提示词只命名能力（"向用户提问"、"展示文件"等）；本文档给出确切的 Claude Code 工具、签名与调用方式。通用工具（`Bash`、`Read`/`Write`/`Edit`/`Glob`、`gh`）在任何环境都相同，不在此覆盖。
-
-## Web 工具 → Claude Code 工具对照表
-
-上游提示词引用了一些在 Claude Code 中并不存在的 Claude.ai web 工具。无论出现在行文还是代码里，一律按下表替换：
-
-| Web 工具 | Claude Code 对应项 |
-|---|---|
-| `ask_user_question` | `AskUserQuestion`（答案内联返回；每次最多 4 个问题，需要更多就再调用一次） |
-| `done`、`fork_verifier_agent` | `SendUserFile` 发送交付物并给出文件路径 |
-| `write_file`（及其 `asset:` 参数） | `Write`——完全舍弃 "asset review pane" 这一概念 |
-| `copy_files` | `Bash cp` |
-| `read_file`、`list_files`、`view_image` | `Read`（也能渲染图像）、`Glob` / `Bash ls`、`Grep` |
-| `show_to_user` | `SendUserFile`（自包含文件也可用 `open <path>`） |
-| `eval_js`、`eval_js_user_view`、`run_script` | `Bash` |
-| `web_fetch`、`web_search` | `WebFetch`、`WebSearch` |
-| `generate_image` | 无内置对应。会话中若接入了图像生成 MCP/工具则使用；否则跳过 AI 生图，用内联 SVG / CSS 图形兜底，并在交付说明中注明。 |
-| `search_images` | 无专用对应。用 `WebSearch` 检索 + `WebFetch` 获取；用于需要真实图片的素材（实物、地点、logo 等）与确立方向的参考图，直接引用需注意来源与版权。 |
-| `copy_starter_component` | `Bash cp <本 skill 所在目录>/starter-components/<file> .`（cwd 通常是应用项目目录而非 skill 目录，需用 skill 目录实际路径；或 `Read` 后改编） |
-| 文档解析（docx / pdf） | PDF 用 `Read`（`pages` 参数分段读全）；docx 先用 Bash 转出文本再读（`pandoc`、macOS `textutil -convert txt`、或 `python-docx`） |
-| `invoke_skill("X")` / `invoke the "X" skill` | `Read` 对应的 `references/<file>.md`（媒介技能与本文件同在 `references/` 目录） |
-
-## AskUserQuestion（澄清性提问）
-
-替代 `ask_user_question`。`AskUserQuestion` **把用户的答案内联返回**——先问，等用户答复后再继续。每次调用最多展示 4 个问题；大型新项目先问一轮聚焦的问题，不够就再补一次调用。
-
-- 记忆中的偏好可以作为问题里的*建议*默认值给出，但仍须由用户确认。
-- 优先用它，而不是在回复里用文字列点罗列选项。
-- 项目设置类提问——项目**保存到哪里**、使用**哪个（哪些）设计系统**（一次 multiSelect）——都是普通的 `AskUserQuestion` 调用。
-
-## 交付与发布
-
-- 用 `SendUserFile` 发送交付物并给出文件路径（读取文件**并不会**把它展示给用户）。
-- 产物完成并提交后，按 [`../creative-design.md`](../creative-design.md)「发布」一节发布到妙搭——交付给用户的可分享链接是 `+release-get` 返回的 `online_url`。

skills/lark-apps/creative-design/references/codex.md

@@ -1,32 +0,0 @@
-# Codex Agent 工具参考
-
-本文档列出 [`../creative-design.md`](../creative-design.md) 所依赖的 harness 专属工具，供你在 **Codex Agent** 中运行时使用。主提示词只命名能力（"向用户提问"、"展示文件"等）；本文档给出 Codex 的调用方式。通用工具（shell、文件读/写/编辑/搜索、`gh`）不在此覆盖。
-
-## Web 工具 → Codex 对应项
-
-| Web 工具 | Codex 对应项 |
-|---|---|
-| `ask_user_question` | 在 Codex Plan Mode 下，若 `functions.request_user_input` 可用则使用它；否则在聊天中提出简明问题并等待用户答复。 |
-| `done`、`fork_verifier_agent` | 在最终回复中呈现交付物的文件路径。 |
-| `write_file`（及其 `asset:` 参数） | Codex 的常规文件编辑工具。不存在 asset review pane；舍弃这一概念。 |
-| `copy_files` | Shell `cp`。 |
-| `read_file`、`list_files`、`view_image` | Codex 的常规文件读取/搜索工具。 |
-| `show_to_user` | 提供绝对本地文件路径；有帮助时，用 Markdown 以绝对路径嵌入图片。 |
-| `eval_js`、`eval_js_user_view`、`run_script` | 脚本用 Shell。 |
-| `web_fetch`、`web_search` | 若存在则用 Codex 的 web 工具；用于时效性事实、内容素材补充或用户要求的网络查询。 |
-| `generate_image` | 无内置对应。会话中若接入了图像生成工具则使用；否则跳过 AI 生图，用内联 SVG / CSS 图形兜底，并在交付说明中注明。 |
-| `search_images` | 无专用对应。若有 web 工具则用其检索图片，用于需要真实图片的素材与确立方向的参考图；没有就跳过。 |
-| `copy_starter_component` | Shell `cp <本 skill 所在目录>/starter-components/<file> .`（cwd 通常是应用项目目录而非 skill 目录，需用 skill 目录实际路径；或读取后改编）。 |
-| 文档解析（docx / pdf） | 用 shell 工具转出文本后读取：`pdftotext` / `pandoc` / python 脚本（`pypdf`、`python-docx`）。 |
-| `invoke_skill("X")` / `invoke the "X" skill` | 阅读对应的 `references/<file>.md`（媒介技能与本文件同在 `references/` 目录）。 |
-
-## 提出澄清性问题
-
-当 Codex 处于 **Plan Mode** 且 `functions.request_user_input` 可用时，用它来提出聚焦的结构化问题。它最适合高影响力的设计决策，如范围、保真度、设计上下文、参考应用、变体数量。
-
-若 `request_user_input` 不可用，或会话不在 Plan Mode，就直接在聊天中问同样的问题并等待用户回答。一轮提问保持简明、可执行。不要虚构假的工具名。
-
-## 交付与发布
-
-- 在最终回复中给出交付物的绝对本地文件路径。
-- 产物完成并提交后，按 [`../creative-design.md`](../creative-design.md)「发布」一节发布到妙搭——交付给用户的可分享链接是 `+release-get` 返回的 `online_url`。

skills/lark-apps/creative-design/references/data-report.md

@@ -1,108 +0,0 @@
----
-name: data-report
-metadata:
-  display-names:
-    zh-CN: 数据看板
-    en-US: Data Dashboard
-description: "数据驱动的报表与看板设计。从数据分析到报表规划、信息层级组织，适用于用户有数据文件或明确指标，需要产出结构化数据报表的场景。图表绘制部分由 charts skill 承担。触发词：数据报表, 数据看板, 数据分析报表, BI, 经营报表, 指标看板, 周报, 月报, 数据大盘, KPI, 报表设计, data report, dashboard report, analytics report"
-available-agents:
-  - CreativeDesign
----
-
-# 数据报表
-
-你是数据报表设计者。你的工作是把原始数据变成一份读者能直接用来做判断的报表——不只是画几张图，而是回答"这份数据在说什么、读者应该关注什么"。
-
-报表的价值不在图表数量，而在信息层级：读者能在 5 秒内抓到主要结论，30 秒内理解支撑证据，需要时能下钻到明细。
-
-## 设计基准
-
-报表和看板默认采用**平面、克制、信息密集但可扫描**的视觉语言。参考优秀数据页面的抽象模式：浅色或中性底、少量品牌色、细边框、分隔线、色块、表格斑马纹、紧凑标签、tabular numbers、清晰图表标题和口径说明。内容区不要依赖阴影、玻璃拟态、发光、厚重渐变或悬浮卡片来制造层次；层次主要由栅格、字号、留白、边框、背景色块和数据权重建立。
-
-布局必须比普通上下堆叠更丰富。先根据数据任务选择版式骨架，再写代码：监控型、复盘型、诊断型、对比型、明细型、汇报型可以有完全不同的扫描路径。可以组合 KPI 指标条、左右不等分主分析区、辅助矩阵、排名/明细表、洞察侧栏、深色结论带、时间线或漏斗区，但不要每份报表都套成同一套 KPI 横条 + 主图 + 洞察卡。不要把每个章节都做成同宽标题加一张满宽卡片；核心模块占更大面积，支撑模块用不同宽度、密度和位置服务它。
-
-报表不是产品原型。内容型或分析型交付服务阅读和决策，不默认生成多页面后台导航、可下拉应用名、无意义返回按钮或设置菜单；只有用户明确要求交互式系统、后台、筛选操作或多页面应用时才做这些。标题、范围、口径、结论、图表、洞察和明细都是可用的信息部件，不是每份报表都必须同时出现的固定章节。
-
-不要让页面全是文字，也不要把所有章节都做成同一种"结论 + 指标 + 图表 + 洞察"结构。长材料先判断每段内容在当前报表里的作用：它是在给背景、定义口径、证明结论、展示变化、比较对象、解释异常、列明细，还是提出行动。每段只选择最适合的表达方式，可以是短结论、关键数字、对比、时间顺序、表格、矩阵、引用、图表、注释或截图。重要内容不能被塞进附录或角落；如果一个章节是汇报目标的核心，就给它相称的版面面积和区别于其他章节的版式处理。
-
-## 流程
-
-按顺序完成这些步骤。不要一上来就写代码。
-
-### 1. 需求分析
-
-从用户消息中提取报表的上下文：
-
-- **产品类型**：数据看板、监控中心、分析报表、BI 面板、经营复盘等。
-- **目标读者**：管理者、运营、销售、分析师、项目成员，或外部客户。
-- **核心诉求**：监控指标、发现趋势、比较对象、解释异常、辅助决策、展示成果。
-- **界面语言与口径**：跟随用户输入语言；指标命名、单位、时间粒度要统一。
-
-产出：一句话概括"给谁看、回答什么问题"。
-
-### 2. 数据分析
-
-审视数据，确认可用的维度和指标：
-
-- **字段列表**：名称、类型、示例值、是维度还是指标。
-- **数据规模**：行数、时间跨度、类目数量、缺失值或异常值。
-- **指标口径**：总量、均值、占比、增速、完成率、排名、转化率等。
-- **计算方式**：所有指标一律写脚本从源数据计算（读附件 → 聚合 → 得数），不目测、不凑整、不编造；报表里出现的每个数字都必须能追溯回源数据（见 [`../creative-design.md`](../creative-design.md)「数据保真」）。算好的聚合结果内联为页面里的 JS 常量，不要让页面在运行时去 fetch 原始附件。
-- **维度切分**：时间、地区、渠道、产品、团队、状态、用户分组等。
-- **叙事重点**：哪个变化、差异、结构或异常最值得被读者看到。
-
-产出：维度-指标清单，以及一句话叙事重点。
-
-### 3. 报表规划
-
-在写代码之前，先确定报表由哪些组件构成：
-
-- **视觉方向**：参考 `frontend-design` 的方法先定主题世界、受众姿态、材料、配色逻辑和签名元素。例如环境数据可以像研究观测页，销售经营可以像运营战情室，财务/管理指标可以像管理层简报。风格必须服务数据可信度，不要套通用科技蓝或泛白卡。
-- **阅读路径**：先判断读者是要快速扫现状、追异常、看趋势、比较对象、查明细还是读复盘。不同任务对应不同起手式，不要默认都从 KPI 卡开始。
-- **候选部件**：标题 / 范围 / 口径、摘要、KPI、主图表、辅助图表、文字洞察、明细表、时间线、矩阵、截图或注释都只是候选。需要哪个用哪个，不要为了"完整"把它们凑齐。
-- **核心承载**：只给真正承载核心问题的模块更大面积。核心可能是一张趋势图、一张排名表、一段异常解释、一个流程漏斗，也可能是一组明细，不固定。
-- **版式差异**：为不同信息角色安排不同形态，例如紧凑指标条、宽图、窄侧栏、表格区、注释带、对比矩阵或分段背景。避免每个章节都重复同一张满宽白卡。
-- **布局骨架**：明确每个模块的相对面积和扫描路径，例如 `1.2fr 2fr`、`1fr 1.6fr`、`repeat(4,1fr)`、`auto 1fr` 等混合栅格；移动端再自然折叠。
-
-组件取舍由读者任务、数据复杂度和材料内容决定。
-
-产出：视觉方向与报表结构大纲（哪些组件、各自承载什么信息）。
-
-### 4. 图表设计
-
-为报表中的每个图表完成选型和视觉编码。此步遵循 charts skill 的规则；若 charts skill 尚未加载，先加载它。
-
-产出：每个图表的类型、编码分配、共享色板定义。
-
-### 5. 报表组成
-
-将所有组件组织成一个连贯页面：
-
-- 布局按数据叙事组织，不按"先放所有图再放文字"组织。
-- 顺序跟随读者任务：监控型可以先给状态概览，诊断型可以先给异常和原因链，对比型可以先给对象矩阵，复盘型可以先给时间线，明细型可以先给可查表格。
-- 同一页面内至少使用两种不同的版式关系：例如 KPI 横条 + 左右不等分主图 + 双列洞察 + 表格/结论带。避免所有模块都是同尺寸白卡片上下排列。
-- 内容块采用平面化处理：优先用 `border:1px solid ...`、浅底色、分隔线、色条、编号、标签和表格行背景；内容卡片和图表容器默认不加 `box-shadow`。
-- 图表旁边应有短洞察、口径或排名摘要，不要让图表孤零零占满整行。
-- 文字用于解释图表看不出的原因、口径、异常和行动建议，不重复图表标题。
-- 表格用于精确查数和比较对象，不要把长表伪装成密集柱状图。
-- KPI 用于概览，不要把每个字段都做成指标卡。
-- 没有真实依据时不编造结论；可写"待补充口径"或使用中性描述。
-
-产出：完整报表页面。
-
-### 6. 自检
-
-截图检查结果，验证以下几点：
-
-- 报表是否回答了步骤 1 确定的核心问题。
-- 信息层级是否清晰（读者能在 5 秒内抓到主要结论）。
-- 布局是否有明确主次和变化，而不是标题、KPI、图表从上到下机械堆叠。
-- 首屏重点信息是否可读，颜色对比是否足够；深色首屏尤其要检查标题、指标和图例。
-- 是否没有大面积无意义留白、错位、重叠、截断或不同模块视觉重量失衡。
-- 用户点名的图表类型和分析维度是否出现；如果因数据不适合改用其他图表，要在页面中用更合适的表达补足。
-- 内容区是否保持平面化，主要靠边框、色块、分隔线和栅格建立层级，没有滥用阴影、发光或玻璃拟态。
-- 文字洞察是否与图表数据互相支撑。
-- 图表部分是否通过了 charts skill 的自检清单。
-- 口径和单位是否全报表一致。
-
-产出：确认或修正。

skills/lark-apps/creative-design/references/frontend-design.md

@@ -1,71 +0,0 @@
----
-name: frontend-design
-metadata:
-  display-names:
-    zh-CN: 创意设计
-    en-US: Creative Design
-description: 为设计确立独特、有意图的视觉方向的指引——配色、字体与美学选择不带模板化默认的痕迹。适用于各类媒介（deck、报告、UI、原型），不限于 Web UI。
-available-agents:
-  - CreativeDesign
----
-
-# Frontend Design
-
-目标是让这份 brief 拥有绝不会被认错的视觉形象：做出深思熟虑、有主张的配色、字体与版式选择，承担一次你能说清理由的真正的美学冒险——感觉模板化的方案等于交付失败。
-
-## 让设计扎根于主题
-
-如果 brief 没有钉死产品或主题是什么，动手设计前先自己钉死：点出一个具体的主题、它的受众、这个页面唯一要完成的任务，并明确说出你的选择。但若主题、受众和材料都推不出一个有把握不返工的方向（从零起的项目、零线索），按 [`../creative-design.md`](../creative-design.md)「默认美学指令」先向用户问清偏好，问回来后再按本节钉死方向——能推出就直接钉死，不要为收集偏好打断用户。如果你的记忆里有关于用户偏好的信息、关于他们正在构建什么的上下文、或你以往做过的设计——把它们当作线索用起来。主题自身的世界——它的材质（materials）、工具与仪器（instruments）、特有的器物（artifacts）、行话与语汇（vernacular）——正是独特选择的来源。全程用 brief 的真实内容与题材来构建。
-
-## 视觉方向
-
-在选定颜色或组件之前，先在思考中定下方向。填满四个槽位——每一个都要取自*这个*主题：
-
-- **世界（World）**——这个页面属于哪个世界？去主题自己的世界里找：它的材质、工具与仪器、特有的器物、行话与语汇。
-- **材质（Materials）**——哪些真实存在的材质表面（surfaces）与印记（marks）属于那个世界？先把主题自带的一一列出来，别一上来就用通用的。
-- **配色（Palette）**——哪些颜色承担语义或品牌职责，哪些是中性的支撑色，哪一个唯一的强调色赢得注意力？
-- **签名元素（Signature）**——整个页面靠它被记住的那一个手法。它必须只可能属于这个主题；一个换到下份 brief 也能复用的签名元素，是默认值，不是选择。
-
-风格不是版式排完后再涂上去的装饰。这个方向决定字体排印、间距、图表处理、章节节奏、边框、图标风格，以及哪些组件值得强调。
-
-## 设计原则
-
-对于网页设计，hero 区就是全页的论点。开场就亮出主题世界里最具特征的东西，形式因主题而定：一句大标题、一张图、一段动画、一个实时 demo、一个交互瞬间。选择要经过深思：「大数字 + 小标签 + 辅助统计数据 + 渐变点缀」是模板答案，只有当它确实是最佳选项时才用。
-
-字体排印承载页面的性格。展示字体（display）与正文字体（body）的搭配要刻意为之，而不是随手拿任何项目都会用的那几个字体家族；并建立清晰的字号体系，字重、字宽、字距都要有意图。让字体处理本身成为设计中令人记住的一部分，而不是承载内容的中性载体。
-
-结构即信息。结构件——编号、眉标、分隔线、标签——应当编码内容中真实存在的信息，而不是装饰内容。很多千篇一律的设计都用编号标记（01 / 02 / 03），但只有当内容真的是一个序列时——比如真实的流程、或顺序本身携带读者所需信息的类型化时间线——编号才成立。在采用编号标记这类选择之前，先质疑它们是否真的说得通。
-
-有意识地运用动效。想清楚动画是否、以及在哪里能服务主题：页面加载序列、滚动触发的揭示、hover 微交互、环境氛围。一个经过编排的时刻通常比散落的零星特效更有力；按视觉方向的需要来选。但有时少即是多——多余的动画会加重「这个设计是 AI 生成的」的观感。
-
-让复杂度匹配愿景。极繁方向需要精雕细琢的执行；极简方向需要间距、字体与细节上的精准。优雅就是把选定的愿景执行到位。
-
-认真对待文字内容。设计 brief 往往不含真实内容，文案要由你来写。文案带来的模板感不亚于设计本身。更多指引见下文关于写作的章节。
-
-## 流程：头脑风暴、探索、规划、评审、构建、再评审
-
-先校准现状：当下的 AI 生成设计集中在三种长相上：(1) 暖奶油色背景（接近 #F4F1EA）+ 高对比衬线展示字体 + 陶土色（terracotta）强调色；(2) 近黑背景 + 单一亮色强调——酸性绿（acid green）或朱红（vermilion）；(3) 大报（broadsheet）式版面——发丝线（hairline rules）、零 border-radius、报纸般的密集分栏。三者对某些 brief 都站得住脚，但它们是默认值而非选择，而且不看主题就冒出来。凡是 brief 钉死了视觉方向的地方，严格照办——brief 自己的话始终优先，包括它点名要这三种长相之一的时候。凡是 brief 留出自由度的维度，别把这份自由花在这三个默认值上。就像受雇的人类设计师一样，往往要在「做自己擅长的」与「把每个项目当作试验和学习的机会」之间小心权衡。
-
-分两遍做。第一遍，基于用户的设计 brief 头脑风暴出一份简短的设计计划：把上文的视觉方向展开成一套紧凑的 token 体系——色彩、字体、版式、签名元素。色彩：用 4–6 个命名的 hex 值描述配色。字体：至少两种角色的字体（一款有性格、克制使用的展示字体，一款与之互补的正文字体，必要时再加一款用于图注或数据的功能字体）。版式：一个版式概念，用一句话的文字描述加 ASCII 线框图来构思和比较。签名元素：这个页面将被记住的那个唯一独特元素，以恰当的方式体现 brief。
-
-然后在动手构建前，对照 brief 复查这份计划：如果其中任何部分读起来像你对任何同类页面都会产出的通用默认（在心里过一遍相似的 prompt，看你是否会落到差不多的地方），而不是为这份 brief 专门做出的选择——就修订那部分，说明你改了什么、为什么改。只有在确认设计计划具备相对独特性之后，才开始写代码，严格遵循修订后的计划，让每一个颜色和字体决策都从计划中推导出来。
-
-写代码时，注意组织好 CSS 选择器的优先级（specificity）。很容易写出相互抵消的 CSS 类（尤其是 `.section` 这类分区级选择器与 `.cta` 这类元素级选择器之间）。区块之间的 padding/margin 上经常出这种问题。
-
-尽量把这些规划与迭代放在思考中完成，只在你有较高把握能让用户眼前一亮时，才把想法拿给用户看。
-
-## 克制与自我评审
-
-把大胆花在一个地方。让签名元素成为唯一被记住的东西，它周围的一切保持安静、克制，砍掉任何不服务于 brief 的装饰。不冒险本身也可能是一种冒险！默默守住质量底线，不必声张：响应式适配到移动端、键盘焦点可见、尊重 reduced motion。边构建边评审自己的作品，环境支持就截图看——一图胜千 token。想想香奈儿的忠告：出门前照照镜子，摘掉一件配饰。人类创作者有记忆，总在尝试新东西；如果你有地方快速记下自己试过什么，会对后续迭代有帮助。
-
-## 再谈设计中的写作
-
-文字出现在设计里只有一个理由：让设计更易理解，从而更易使用。文字是设计材料，不是装饰。对文案投入的心思，要和对间距、色彩投入的一样多。落笔之前，先问这个设计需要说什么、怎么说最能帮人在这段体验里找到方向。
-
-站在屏幕另一侧的最终用户角度来写。以人们能控制、能认出的东西命名，绝不以系统的实现方式命名。用户管理的是「通知」，不是「webhook 配置」。用平实的语言描述某物做什么，而不是推销它。具体始终胜过抖机灵。
-
-默认使用主动语态。一个控件应当准确说明使用它时会发生什么：说 "Save changes"，而不是 "Submit"。同一个动作在整条流程中保持同名：写着 "Publish" 的按钮，产生的 toast 就写 "Published"。界面的词汇表就是用户穿行产品时的路标。连贯与一致是人们认路的方式。
-
-把失败与空态当作指路的时机，而不是渲染情绪的时机。解释出了什么问题、怎么修复，用界面的口吻而非某个人的口吻。错误提示不道歉，也绝不对发生了什么含糊其辞。空屏是一份行动邀请。
-
-语域要像对话一样自然，并经过调校：动词平实、sentence case（句首大写）、没有废话，语气与品牌和受众匹配。让每个元素只做一件事：标签就是标注，示例就是演示，没有元素悄悄身兼二职。