fix: normalize batch delete block IDs

.github/workflows/release.yml

@@ -9,40 +9,7 @@ permissions:
   contents: read
 
 jobs:
-  preflight:
-    runs-on: ubuntu-22.04
-    permissions:
-      contents: read
-    steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
-        with:
-          fetch-depth: 0
-
-      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
-        with:
-          node-version: '22.14.0'
-
-      - name: Validate tag and commit
-        env:
-          TAG: ${{ github.ref_name }}
-        run: |
-          set -euo pipefail
-          node scripts/release-preflight.js --tag "$TAG"
-          git fetch origin main
-          HEAD_SHA="$(git rev-parse --verify 'HEAD^{commit}')"
-          MAIN_SHA="$(git rev-parse --verify 'FETCH_HEAD^{commit}')"
-          TAG_SHA="$(git rev-parse --verify "refs/tags/${TAG}^{commit}")"
-          if [[ "$TAG_SHA" != "$HEAD_SHA" ]]; then
-            echo "Tag ${TAG} does not resolve to the checked-out HEAD commit." >&2
-            exit 1
-          fi
-          if ! git merge-base --is-ancestor "$HEAD_SHA" "$MAIN_SHA"; then
-            echo "Tag ${TAG} does not point to a commit contained in origin/main." >&2
-            exit 1
-          fi
-
-  build-release:
-    needs: preflight
+  goreleaser:
     runs-on: ubuntu-22.04
     permissions:
       contents: write
@@ -59,79 +26,35 @@ jobs:
         with:
           python-version: '3.x'
 
-      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
-        with:
-          node-version: '22.14.0'
-          registry-url: 'https://registry.npmjs.org'
-          package-manager-cache: false
-
-      - name: Install pinned npm
-        run: npm install --global npm@11.16.0
-
       - name: Run GoReleaser
         uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6
         with:
           version: '~> v2'
           args: release --clean
         env:
-          GITHUB_TOKEN: ${{ github.token }}
-
-      - name: Include release checksums
-        run: |
-          set -euo pipefail
-          test -s dist/checksums.txt
-          (cd dist && sha256sum --check checksums.txt)
-          cp dist/checksums.txt checksums.txt
-
-      - name: Collect release asset
-        run: |
-          set -euo pipefail
-          mkdir npm-publish-asset
-          cp dist/*.tar.gz dist/*.zip dist/checksums.txt npm-publish-asset/
-
-      - name: Upload release asset
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
-        with:
-          name: npm-publish-asset-${{ github.run_id }}
-          path: npm-publish-asset/
-          if-no-files-found: error
-          overwrite: true
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
   publish-npm:
-    needs: build-release
+    needs: goreleaser
     runs-on: ubuntu-22.04
-    environment: npm-production
-    permissions:
-      contents: read
-      id-token: write
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
-      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
-          node-version: '22.14.0'
+          node-version: '20'
           registry-url: 'https://registry.npmjs.org'
-          package-manager-cache: false
 
-      - name: Install pinned npm
-        run: npm install --global npm@11.16.0
-
-      - name: Download release asset
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
-        with:
-          name: npm-publish-asset-${{ github.run_id }}
-          path: npm-publish-asset
-
-      - name: Verify npm publish asset
+      - name: Download checksums from release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           set -euo pipefail
-          (cd npm-publish-asset && sha256sum --check checksums.txt)
-          cp npm-publish-asset/checksums.txt checksums.txt
-          PACK_JSON="$(npm pack --ignore-scripts --json)"
-          PACK_FILE="$(node -e 'const p=JSON.parse(process.argv[1]); if(p.length!==1 || !p[0].filename) process.exit(1); process.stdout.write(p[0].filename)' "$PACK_JSON")"
-          test -s "$PACK_FILE"
-          tar -tzf "$PACK_FILE" | grep -qx 'package/checksums.txt'
-          rm "$PACK_FILE"
+          TAG="${GITHUB_REF_NAME}"
+          gh release download "${TAG}" --pattern checksums.txt --dir .
+          test -s checksums.txt || { echo "checksums.txt missing or empty for ${TAG}"; exit 1; }
 
       - name: Publish to npm
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
         run: npm publish --access public

CHANGELOG.md

@@ -2,36 +2,6 @@
 
 All notable changes to this project will be documented in this file.
 
-## [v1.0.75] - 2026-07-22
-
-### Features
-
-- add okr single create shortcut & skill text opti (#1941)
-- **calendar**: auto-add bot self as attendee and note user-only search (#1991)
-
-### Bug Fixes
-
-- **base**: improve table shortcut behavior & guidance (#1803)
-- issue#1935 & whiteboard shortcut reformat (#1980)
-- remove legacy shortcut (#1997)
-- **e2e**: inject shared credentials by identity (#1995)
-
-### Documentation
-
-- **skill**: describe html5 block xml usage (#1380)
-- clarify fetch metadata and user cites (#1981)
-- add topic move collector workflow (#1473)
-- update lark doc HTML size limit (#2001)
-- **base**: align record write schema guidance (#2000)
-
-### Tests
-
-- **e2e**: declare request identities explicitly (#2004)
-
-### Misc
-
-- harden npm release publishing (#1918)
-
 ## [v1.0.74] - 2026-07-21
 
 ### Features
@@ -1638,7 +1608,6 @@ Bundled AI agent skills for intelligent assistance:
 - Bilingual documentation (English & Chinese).
 - CI/CD pipelines: linting, testing, coverage reporting, and automated releases.
 
-[v1.0.75]: https://github.com/larksuite/cli/releases/tag/v1.0.75
 [v1.0.74]: https://github.com/larksuite/cli/releases/tag/v1.0.74
 [v1.0.73]: https://github.com/larksuite/cli/releases/tag/v1.0.73
 [v1.0.72]: https://github.com/larksuite/cli/releases/tag/v1.0.72

Makefile

@@ -51,7 +51,7 @@ script-test:
 	bash scripts/resolve-changed-from.test.sh
 	bash scripts/ci-workflow.test.sh
 	bash scripts/semantic-review-workflow.test.sh
-	$(NODE) --test scripts/e2e_domains.test.js scripts/fetch_e2e_tat.test.js scripts/install.test.js scripts/release-preflight.test.js scripts/semantic-review-verify-artifact.test.js scripts/pr-quality-summary.test.js scripts/semantic-review-publish.test.js scripts/ci-quality-summary-publish.test.js
+	$(NODE) --test scripts/e2e_domains.test.js scripts/fetch_e2e_tat.test.js scripts/semantic-review-verify-artifact.test.js scripts/pr-quality-summary.test.js scripts/semantic-review-publish.test.js scripts/ci-quality-summary-publish.test.js
 
 # ./extension/... keeps the public plugin SDK in the default test matrix.
 unit-test: fetch_meta

package-lock.json

@@ -1,16 +1,15 @@
 {
   "name": "@larksuite/cli",
-  "version": "1.0.76",
+  "version": "1.0.11",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@larksuite/cli",
-      "version": "1.0.76",
+      "version": "1.0.11",
       "cpu": [
         "x64",
-        "arm64",
-        "riscv64"
+        "arm64"
       ],
       "hasInstallScript": true,
       "license": "MIT",

package.json

@@ -1,13 +1,12 @@
 {
   "name": "@larksuite/cli",
-  "version": "1.0.76",
+  "version": "1.0.74",
   "description": "The official CLI for Lark/Feishu open platform",
   "bin": {
     "lark-cli": "scripts/run.js"
   },
   "scripts": {
-    "postinstall": "node scripts/install.js",
-    "release:check": "node scripts/release-preflight.js"
+    "postinstall": "node scripts/install.js"
   },
   "os": [
     "darwin",

scripts/install.js

@@ -265,7 +265,10 @@ function getExpectedChecksum(archiveName, checksumsDir) {
   const checksumsPath = path.join(dir, "checksums.txt");
 
   if (!fs.existsSync(checksumsPath)) {
-    throw new Error(`[SECURITY] checksums.txt not found at ${checksumsPath}`);
+    console.error(
+      "[WARN] checksums.txt not found, skipping checksum verification"
+    );
+    return null;
   }
 
   const content = fs.readFileSync(checksumsPath, "utf8");
@@ -283,14 +286,7 @@ function getExpectedChecksum(archiveName, checksumsDir) {
 }
 
 function verifyChecksum(archivePath, expectedHash) {
-  if (typeof expectedHash !== "string" || expectedHash.length === 0) {
-    throw new Error("[SECURITY] Expected checksum is missing or invalid");
-  }
-  if (!/^[0-9a-f]{64}$/i.test(expectedHash)) {
-    throw new Error(
-      "[SECURITY] Expected checksum must be a 64-character hexadecimal SHA-256 digest"
-    );
-  }
+  if (expectedHash === null) return;
 
   // Stream the file to avoid loading the entire archive into memory.
   // Archives can be 10-100MB; streaming keeps RSS constant.

scripts/install.test.js

@@ -52,12 +52,11 @@ describe("getExpectedChecksum", () => {
     );
   });
 
-  it("throws [SECURITY]-prefixed Error when checksums.txt does not exist", () => {
+  it("returns null when checksums.txt does not exist", () => {
     const dir = fs.mkdtempSync(path.join(os.tmpdir(), "checksum-test-"));
-    assert.throws(
-      () => getExpectedChecksum("anything.tar.gz", dir),
-      { message: /^\[SECURITY\] checksums\.txt not found/ }
-    );
+    // No checksums.txt in dir
+    const result = getExpectedChecksum("anything.tar.gz", dir);
+    assert.equal(result, null);
   });
 
   it("skips malformed lines and still finds valid entry", () => {
@@ -107,7 +106,7 @@ describe("verifyChecksum", () => {
     verifyChecksum(filePath, hash);
   });
 
-  it("accepts a valid uppercase 64-character hex hash", () => {
+  it("matches case-insensitively", () => {
     const content = "case test";
     const filePath = makeTmpFile(content);
     const hash = sha256(content).toUpperCase();
@@ -115,40 +114,6 @@ describe("verifyChecksum", () => {
     verifyChecksum(filePath, hash);
   });
 
-  for (const [name, expectedHash] of [
-    ["null", null],
-    ["empty", ""],
-    ["non-string", 123],
-  ]) {
-    it(`throws [SECURITY]-prefixed Error for ${name} expected hash`, () => {
-      const filePath = makeTmpFile("real content");
-      assert.throws(
-        () => verifyChecksum(filePath, expectedHash),
-        (err) => {
-          assert.match(err.message, /^\[SECURITY\]/);
-          assert.match(err.message, /Expected checksum is missing or invalid/);
-          return true;
-        }
-      );
-    });
-  }
-
-  it("throws [SECURITY] format Error for an incorrectly sized hash", () => {
-    const filePath = makeTmpFile("real content");
-    assert.throws(
-      () => verifyChecksum(filePath, "abc123"),
-      { message: /^\[SECURITY\] Expected checksum must be a 64-character hexadecimal SHA-256 digest$/ }
-    );
-  });
-
-  it("throws [SECURITY] format Error for a non-hex hash", () => {
-    const filePath = makeTmpFile("real content");
-    assert.throws(
-      () => verifyChecksum(filePath, "g".repeat(64)),
-      { message: /^\[SECURITY\] Expected checksum must be a 64-character hexadecimal SHA-256 digest$/ }
-    );
-  });
-
   it("throws [SECURITY]-prefixed Error on mismatch", () => {
     const filePath = makeTmpFile("real content");
     assert.throws(

scripts/release-preflight.js

@@ -1,108 +0,0 @@
-#!/usr/bin/env node
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-const fs = require("node:fs");
-const path = require("node:path");
-
-const STABLE_VERSION_PATTERN = /^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$/;
-
-function isStableVersion(value) {
-  return typeof value === "string" && STABLE_VERSION_PATTERN.test(value);
-}
-
-function releaseError(message, observed, hint) {
-  return { ok: false, error: { type: "release_preflight", message, observed, hint } };
-}
-
-function validateReleasePreflight(packageJson, packageLockJson, tag) {
-  const packageVersion = packageJson?.version;
-  const lockVersion = packageLockJson?.version;
-  const lockRootVersion = packageLockJson?.packages?.[""]?.version;
-  const observed = {
-    packageVersion: packageVersion ?? null,
-    lockVersion: lockVersion ?? null,
-    lockRootVersion: lockRootVersion ?? null,
-    tagVersion: null,
-  };
-
-  for (const [field, value] of [
-    ["package.json.version", packageVersion],
-    ["package-lock.json.version", lockVersion],
-    ['package-lock.json.packages[""].version', lockRootVersion],
-  ]) {
-    if (!isStableVersion(value)) {
-      return releaseError(
-        `${field} must be a stable release version in X.Y.Z form`,
-        observed,
-        "Use the same stable X.Y.Z version in all package fields; prerelease and build metadata are not allowed for production releases.",
-      );
-    }
-  }
-
-  if (packageVersion !== lockVersion || packageVersion !== lockRootVersion) {
-    return releaseError(
-      "Package version fields do not match",
-      observed,
-      "Synchronize package.json.version and both package-lock.json version fields.",
-    );
-  }
-
-  if (tag === undefined) {
-    return { ok: true, data: observed };
-  }
-  if (typeof tag !== "string" || !tag.startsWith("v") || !isStableVersion(tag.slice(1))) {
-    return releaseError(
-      "--tag must use the stable release form vX.Y.Z",
-      { ...observed, tag },
-      `Use --tag v${packageVersion}; prerelease and build metadata are not allowed for production releases.`,
-    );
-  }
-
-  const tagVersion = tag.slice(1);
-  if (tagVersion !== packageVersion) {
-    return releaseError(
-      "Tag version does not match the package version",
-      { ...observed, tagVersion, tag },
-      `Use --tag v${packageVersion}.`,
-    );
-  }
-  return { ok: true, data: { ...observed, tagVersion } };
-}
-
-function writeResult(result) {
-  (result.ok ? process.stdout : process.stderr).write(`${JSON.stringify(result)}\n`);
-  if (!result.ok) process.exitCode = 1;
-}
-
-function main() {
-  const args = process.argv.slice(2);
-  let tag;
-  if (args.length === 2 && args[0] === "--tag") {
-    tag = args[1];
-  } else if (args.length !== 0) {
-    writeResult(releaseError(
-      "Expected no arguments or --tag vX.Y.Z",
-      { arguments: args },
-      "Run release:check without arguments or pass exactly one --tag value.",
-    ));
-    return;
-  }
-
-  const repoRoot = path.resolve(__dirname, "..");
-  try {
-    const packageJson = JSON.parse(fs.readFileSync(path.join(repoRoot, "package.json"), "utf8"));
-    const packageLockJson = JSON.parse(fs.readFileSync(path.join(repoRoot, "package-lock.json"), "utf8"));
-    writeResult(validateReleasePreflight(packageJson, packageLockJson, tag));
-  } catch (error) {
-    writeResult(releaseError(
-      "Could not read release package metadata",
-      { reason: error.message },
-      "Ensure package.json and package-lock.json exist and contain valid JSON.",
-    ));
-  }
-}
-
-module.exports = { validateReleasePreflight };
-
-if (require.main === module) main();

scripts/release-preflight.test.js

@@ -1,66 +0,0 @@
-// Copyright (c) 2026 Lark Technologies Pte. Ltd.
-// SPDX-License-Identifier: MIT
-
-const assert = require("node:assert/strict");
-const { describe, it } = require("node:test");
-
-const { validateReleasePreflight } = require("./release-preflight");
-
-function metadata(version = "1.2.3") {
-  return {
-    packageJson: { version },
-    packageLockJson: {
-      version,
-      packages: { "": { version } },
-    },
-  };
-}
-
-function assertRejected(result) {
-  assert.equal(result.ok, false);
-  assert.equal(result.error.type, "release_preflight");
-  assert.equal(typeof result.error.message, "string");
-}
-
-describe("validateReleasePreflight", () => {
-  it("accepts matching stable package, lock, and tag versions", () => {
-    const { packageJson, packageLockJson } = metadata();
-
-    assert.deepEqual(
-      validateReleasePreflight(packageJson, packageLockJson, "v1.2.3"),
-      {
-        ok: true,
-        data: {
-          packageVersion: "1.2.3",
-          lockVersion: "1.2.3",
-          lockRootVersion: "1.2.3",
-          tagVersion: "1.2.3",
-        },
-      },
-    );
-  });
-
-  it("rejects non-stable or inconsistent package metadata", () => {
-    const prerelease = metadata("1.2.3-beta.1");
-    const topLevelMismatch = metadata();
-    topLevelMismatch.packageLockJson.version = "1.2.4";
-    const rootMismatch = metadata();
-    rootMismatch.packageLockJson.packages[""].version = "1.2.4";
-
-    for (const { packageJson, packageLockJson } of [
-      prerelease,
-      topLevelMismatch,
-      rootMismatch,
-    ]) {
-      assertRejected(validateReleasePreflight(packageJson, packageLockJson));
-    }
-  });
-
-  it("rejects an invalid or mismatched release tag", () => {
-    const { packageJson, packageLockJson } = metadata();
-
-    for (const tag of ["1.2.3", "v1.2.3-beta.1", "v1.2.4"]) {
-      assertRejected(validateReleasePreflight(packageJson, packageLockJson, tag));
-    }
-  });
-});

scripts/tag-release.sh

@@ -3,48 +3,49 @@ set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 REPO_ROOT="$(cd "${SCRIPT_DIR}/.." && pwd)"
-cd "${REPO_ROOT}"
 
-VERSION=$(node -p "require('./package.json').version")
+# Read version from package.json
+VERSION=$(node -p "require('${REPO_ROOT}/package.json').version")
+
+if [ -z "$VERSION" ]; then
+  echo "Error: could not read version from package.json" >&2
+  exit 1
+fi
+
 TAG="v${VERSION}"
 
-node "${SCRIPT_DIR}/release-preflight.js" --tag "${TAG}"
-
 echo "Version: ${VERSION}"
 echo "Tag: ${TAG}"
 
-CURRENT_BRANCH=$(git branch --show-current)
-if [ "${CURRENT_BRANCH}" != "main" ]; then
-  echo "Error: releases must be tagged from main; current branch is '${CURRENT_BRANCH}'." >&2
+# Check if tag already exists locally
+if git rev-parse "$TAG" >/dev/null 2>&1; then
+  echo "Tag ${TAG} already exists locally, skipping."
+  exit 0
+fi
+
+# Check if tag already exists on remote
+if git ls-remote --tags origin "$TAG" | grep -q "$TAG"; then
+  echo "Tag ${TAG} already exists on remote, skipping."
+  exit 0
+fi
+
+# Ensure package.json changes are committed before tagging
+if git diff --name-only | grep -q 'package.json' || git diff --cached --name-only | grep -q 'package.json'; then
+  echo "Error: package.json has uncommitted changes. Please commit before tagging." >&2
   exit 1
 fi
 
-if ! git diff --quiet HEAD -- package.json package-lock.json; then
-  echo "Error: package.json or package-lock.json has uncommitted changes. Please commit them before tagging." >&2
+# Ensure current branch is pushed to remote before tagging
+CURRENT_BRANCH=$(git rev-parse --abbrev-ref HEAD)
+LOCAL_SHA=$(git rev-parse HEAD)
+REMOTE_SHA=$(git rev-parse "origin/${CURRENT_BRANCH}" 2>/dev/null || echo "")
+if [ "$LOCAL_SHA" != "$REMOTE_SHA" ]; then
+  echo "Error: local branch '${CURRENT_BRANCH}' is not in sync with remote. Please push your commits first." >&2
   exit 1
 fi
 
-git fetch origin main
+# Create and push tag
+git tag "$TAG"
+git push origin "$TAG"
 
-HEAD_SHA=$(git rev-parse HEAD)
-FETCHED_MAIN_SHA=$(git rev-parse "FETCH_HEAD^{commit}")
-if [ "${HEAD_SHA}" != "${FETCHED_MAIN_SHA}" ]; then
-  echo "Error: HEAD must exactly match origin/main before tagging." >&2
-  exit 1
-fi
-
-if git rev-parse -q --verify "refs/tags/${TAG}" >/dev/null; then
-  echo "Error: local tag ${TAG} already exists." >&2
-  exit 1
-fi
-
-REMOTE_TAG=$(git ls-remote --tags origin "refs/tags/${TAG}")
-if [ -n "${REMOTE_TAG}" ]; then
-  echo "Error: remote tag ${TAG} already exists." >&2
-  exit 1
-fi
-
-git tag "${TAG}" "${HEAD_SHA}"
-git push origin "refs/tags/${TAG}"
-
-echo "Successfully pushed tag ${TAG}"
+echo "Successfully created and pushed tag ${TAG}"

shortcuts/base/base_execute_test.go

@@ -2435,14 +2435,16 @@ func TestBaseRecordExecuteReadCreateDelete(t *testing.T) {
 			Body: map[string]interface{}{
 				"code": 0,
 				"data": map[string]interface{}{
+					"fields":         []interface{}{"Name"},
 					"record_id_list": []interface{}{"rec_1", "rec_2"},
+					"data":           []interface{}{[]interface{}{"Alice"}, []interface{}{"Bob"}},
 				},
 			},
 		})
-		if err := runShortcut(t, BaseRecordBatchCreate, []string{"+record-batch-create", "--base-token", "app_x", "--table-id", "tbl_x", "--json", `{"create_records":[{"Name":"Alice"},{"Name":"Bob"}]}`}, factory, stdout); err != nil {
+		if err := runShortcut(t, BaseRecordBatchCreate, []string{"+record-batch-create", "--base-token", "app_x", "--table-id", "tbl_x", "--json", `{"fields":["Name"],"rows":[["Alice"],["Bob"]]}`}, factory, stdout); err != nil {
 			t.Fatalf("err=%v", err)
 		}
-		if got := stdout.String(); !strings.Contains(got, `"record_id_list"`) || !strings.Contains(got, `"rec_1"`) {
+		if got := stdout.String(); !strings.Contains(got, `"record_id_list"`) || !strings.Contains(got, `"rec_1"`) || !strings.Contains(got, `"Alice"`) {
 			t.Fatalf("stdout=%s", got)
 		}
 	})

shortcuts/base/base_shortcuts_test.go

@@ -801,8 +801,7 @@ func TestBaseJSONExamplesLiveInFlagDescriptions(t *testing.T) {
 			name:     "record batch create json",
 			shortcut: BaseRecordBatchCreate,
 			wantHelp: []string{
-				"create_records contains one field map per record",
-				`{"create_records":[{"Name":"Task A","Status":"Todo"},{"Name":"Task B","Score":20}]}`,
+				`batch create JSON object, e.g. {"fields":["Name","Status"],"rows":[["Task A","Todo"],["Task B",null]]}; rows follow fields order`,
 			},
 		},
 		{
@@ -851,8 +850,8 @@ func TestBaseRecordWriteHelpGuidesAgents(t *testing.T) {
 				`{"Parent Link":[{"id":"rec_xxx"}]}`,
 				"do not look for parent_record_id or a separate child-record API",
 				"CellValue happy path: text/phone/url",
-				"select (multiple=false) -> \"Todo\"",
-				"select (multiple=true) -> [\"Tag A\",\"Tag B\"]",
+				"select -> \"Todo\"",
+				"multi-select -> [\"Tag A\",\"Tag B\"]",
 				"datetime -> \"2026-03-24 10:00:00\"",
 				"checkbox -> true/false",
 				`ID-based CellValue: user/group/link fields use arrays like [{"id":"ou_xxx"}]`,
@@ -866,11 +865,11 @@ func TestBaseRecordWriteHelpGuidesAgents(t *testing.T) {
 			name:     "record batch create",
 			shortcut: BaseRecordBatchCreate,
 			wantTips: []string{
-				"Happy path field: create_records",
-				"create_records is an array of independent record field maps",
-				`{"create_records":[{"Name":"Task A","Status":"Todo"},{"Name":"Task B","Score":20}]}`,
+				"Happy path fields: fields is the column order",
+				"rows is an array of row arrays",
+				"may use null for empty cells",
 				"use +field-list to confirm real writable fields",
-				"Batch create supports max 200 records per call",
+				"Batch create supports max 200 rows per call",
 				"do not immediately +record-list the same table",
 				"CellValue happy path: text/phone/url",
 				`ID-based CellValue: user/group/link fields use arrays like [{"id":"ou_xxx"}]`,

shortcuts/base/field_search_options.go

@@ -27,7 +27,7 @@ var BaseFieldSearchOptions = common.Shortcut{
 	},
 	Tips: []string{
 		`Example: lark-cli base +field-search-options --base-token <base_token> --table-id <table_id> --field-id "Status" --keyword "Do"`,
-		"Use only for select fields, whether multiple is false or true.",
+		"Use only for fields with options, such as select or multi-select fields.",
 	},
 	Validate: func(ctx context.Context, runtime *common.RuntimeContext) error {
 		if err := validateLimitPageSizeAlias(runtime); err != nil {

shortcuts/base/record_batch_create.go

@@ -19,13 +19,12 @@ var BaseRecordBatchCreate = common.Shortcut{
 	Flags: []common.Flag{
 		baseTokenFlag(true),
 		tableRefFlag(true),
-		{Name: "json", Desc: `batch create JSON object; create_records contains one field map per record, e.g. {"create_records":[{"Name":"Task A","Status":"Todo"},{"Name":"Task B","Score":20}]}`, Required: true},
+		{Name: "json", Desc: `batch create JSON object, e.g. {"fields":["Name","Status"],"rows":[["Task A","Todo"],["Task B",null]]}; rows follow fields order`, Required: true},
 	},
 	Tips: append([]string{
-		"Happy path field: create_records is an array of independent record field maps.",
-		`Example: {"create_records":[{"Name":"Task A","Status":"Todo"},{"Name":"Task B","Score":20}]}.`,
+		"Happy path fields: fields is the column order; rows is an array of row arrays; each row must match fields order and may use null for empty cells.",
 		"Before writing, use +field-list to confirm real writable fields; do not write system fields, formula, lookup, or attachment fields as normal CellValue.",
-		"Batch create supports max 200 records per call.",
+		"Batch create supports max 200 rows per call.",
 		"After batch-creating known helper rows, use the returned record IDs and your submitted rows; do not immediately +record-list the same table unless you need server-normalized formula/lookup values or failure diagnosis.",
 		"Use the record-batch-create guide for command limits and edge cases.",
 	}, recordCellValueHappyPathTips...),

shortcuts/base/record_ops.go

@@ -19,7 +19,7 @@ const maxBatchGetSelectFieldCount = 100
 const maxRecordSearchSelectFieldCount = 50
 
 var recordCellValueHappyPathTips = []string{
-	`CellValue happy path: text/phone/url -> "text"; number/currency/percent/rating -> 12.5; select (multiple=false) -> "Todo"; select (multiple=true) -> ["Tag A","Tag B"]; datetime -> "2026-03-24 10:00:00"; checkbox -> true/false.`,
+	`CellValue happy path: text/phone/url -> "text"; number/currency/percent/rating -> 12.5; select -> "Todo"; multi-select -> ["Tag A","Tag B"]; datetime -> "2026-03-24 10:00:00"; checkbox -> true/false.`,
 	`ID-based CellValue: user/group/link fields use arrays like [{"id":"ou_xxx"}], [{"id":"oc_xxx"}], [{"id":"rec_xxx"}]; location uses {"lng":116.397428,"lat":39.90923}; null clears a cell when allowed.`,
 	"Do not guess user/chat/linked-record IDs or location coordinates; resolve them first with the relevant contact/im/record lookup flow.",
 	"Use lark-base-cell-value.md for complex CellValue shapes and special field types; do not invent values for fields not covered by the happy path.",

shortcuts/doc/doc_errors_test.go

@@ -356,11 +356,26 @@ func TestValidateUpdateV2Contract(t *testing.T) {
 			str:       map[string]string{"doc": testDocxToken, "command": "str_replace"},
 			wantParam: "--pattern",
 		},
+		{
+			name:      "XML str_replace rejects multiline pattern",
+			str:       map[string]string{"doc": testDocxToken, "command": "str_replace", "doc-format": "xml", "pattern": "line one\nline two", "content": "replacement"},
+			wantParam: "--pattern",
+		},
 		{
 			name:      "block_delete without block id",
 			str:       map[string]string{"doc": testDocxToken, "command": "block_delete"},
 			wantParam: "--block-id",
 		},
+		{
+			name:      "block_delete rejects empty ID",
+			str:       map[string]string{"doc": testDocxToken, "command": "block_delete", "block-id": "blkA,,blkB"},
+			wantParam: "--block-id",
+		},
+		{
+			name:      "block_delete rejects duplicate ID",
+			str:       map[string]string{"doc": testDocxToken, "command": "block_delete", "block-id": "blkA, blkA"},
+			wantParam: "--block-id",
+		},
 		{
 			name:      "block_insert_after without block id",
 			str:       map[string]string{"doc": testDocxToken, "command": "block_insert_after"},

shortcuts/doc/docs_create_test.go

@@ -17,6 +17,46 @@ import (
 
 // ── V2 (OpenAPI) tests ──
 
+func TestStripTopLevelXMLTitles(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name    string
+		content string
+		want    string
+	}{
+		{
+			name:    "single title",
+			content: "<title>Content title</title><p>body</p>",
+			want:    "<p>body</p>",
+		},
+		{
+			name:    "multiple titles",
+			content: "<title>First</title>\n<p>body</p>\n<title>Second</title>",
+			want:    "<p>body</p>",
+		},
+		{
+			name:    "nested title is preserved",
+			content: "<callout><title>Nested</title></callout><p>body</p>",
+			want:    "<callout><title>Nested</title></callout><p>body</p>",
+		},
+		{
+			name:    "malformed XML is preserved",
+			content: "<title>Content title</title><p>A & B</p>",
+			want:    "<title>Content title</title><p>A & B</p>",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+			if got := stripTopLevelXMLTitles(tt.content); got != tt.want {
+				t.Fatalf("stripTopLevelXMLTitles() = %q, want %q", got, tt.want)
+			}
+		})
+	}
+}
+
 func TestDocsCreateV2BotAutoGrantSuccess(t *testing.T) {
 	t.Parallel()
 

shortcuts/doc/docs_create_v2.go

@@ -7,6 +7,8 @@ import (
 	"bytes"
 	"context"
 	"encoding/xml"
+	"errors"
+	"io"
 	"strings"
 
 	"github.com/larksuite/cli/errs"
@@ -16,7 +18,7 @@ import (
 // v2CreateFlags returns the flag definitions for the v2 (OpenAPI) create path.
 func v2CreateFlags() []common.Flag {
 	return []common.Flag{
-		{Name: "title", Desc: "document title; when provided, the CLI prepends it to --content as <title>...</title> so the title wins over later content titles"},
+		{Name: "title", Desc: "document title; the CLI prepends it to --content as <title>...</title>. In XML mode, top-level <title> elements in --content are removed so this flag wins without duplicate-title warnings"},
 		{Name: "content", Desc: "document body; XML by default or Markdown when --doc-format markdown. " + docsContentSkillHelp + "; use --help for the latest command flags", Input: []string{common.File, common.Stdin}},
 		{Name: "reference-map", Desc: docsReferenceMapFlagDesc, Input: []string{common.File, common.Stdin}},
 		{Name: "doc-format", Desc: "content format; xml is default and supports richer DocxXML blocks, markdown imports plain Markdown", Default: "xml", Enum: []string{"xml", "markdown"}},
@@ -108,6 +110,9 @@ func buildCreateContentWithBody(runtime *common.RuntimeContext, content string)
 	if title == "" {
 		return content
 	}
+	if runtime.Str("doc-format") == "xml" {
+		content = stripTopLevelXMLTitles(content)
+	}
 
 	titleTag := "<title>" + escapeDocTitleText(title) + "</title>"
 	if content == "" {
@@ -116,6 +121,62 @@ func buildCreateContentWithBody(runtime *common.RuntimeContext, content string)
 	return titleTag + "\n" + content
 }
 
+type docContentRange struct {
+	start int64
+	end   int64
+}
+
+// stripTopLevelXMLTitles preserves the established --title-wins contract while
+// avoiding duplicate-title warnings from XML content. If the fragment is not
+// well-formed XML, it is left untouched for the service to diagnose.
+func stripTopLevelXMLTitles(content string) string {
+	const wrapperStart = "<root>"
+	wrapped := wrapperStart + content + "</root>"
+	decoder := xml.NewDecoder(strings.NewReader(wrapped))
+	wrapperLen := int64(len(wrapperStart))
+	depth := 0
+	activeStart := int64(-1)
+	ranges := make([]docContentRange, 0, 1)
+
+	for {
+		tokenStart := decoder.InputOffset()
+		token, err := decoder.Token()
+		if errors.Is(err, io.EOF) {
+			break
+		}
+		if err != nil {
+			return content
+		}
+
+		switch value := token.(type) {
+		case xml.StartElement:
+			if depth == 1 && value.Name.Space == "" && value.Name.Local == "title" {
+				activeStart = tokenStart - wrapperLen
+			}
+			depth++
+		case xml.EndElement:
+			depth--
+			if activeStart >= 0 && depth == 1 && value.Name.Space == "" && value.Name.Local == "title" {
+				ranges = append(ranges, docContentRange{start: activeStart, end: decoder.InputOffset() - wrapperLen})
+				activeStart = -1
+			}
+		}
+	}
+
+	if len(ranges) == 0 {
+		return content
+	}
+
+	var result strings.Builder
+	cursor := int64(0)
+	for _, item := range ranges {
+		result.WriteString(content[int(cursor):int(item.start)])
+		cursor = item.end
+	}
+	result.WriteString(content[int(cursor):])
+	return strings.TrimSpace(result.String())
+}
+
 func escapeDocTitleText(title string) string {
 	var buf bytes.Buffer
 	_ = xml.EscapeText(&buf, []byte(title))

shortcuts/doc/docs_update_v2.go

@@ -35,8 +35,8 @@ func v2UpdateFlags() []common.Flag {
 		{Name: "doc-format", Desc: "content format for --content; xml is default for precise rich edits, markdown for user-provided Markdown or plain append/overwrite", Default: "xml", Enum: []string{"xml", "markdown"}},
 		{Name: "content", Desc: "replacement or inserted content; XML by default or Markdown when --doc-format markdown; empty with str_replace deletes match. " + docsContentSkillHelp + "; use --help for the latest command flags", Input: []string{common.File, common.Stdin}},
 		{Name: "reference-map", Desc: docsUpdateReferenceMapFlagDesc, Input: []string{common.File, common.Stdin}},
-		{Name: "pattern", Desc: "str_replace match pattern; XML mode is inline text, Markdown mode can match multiline text"},
-		{Name: "block-id", Desc: "target block ID(s) for block operations (comma-separated for batch delete); -1 means document end where supported"},
+		{Name: "pattern", Desc: "str_replace match pattern; XML mode accepts inline text only, Markdown mode can match multiline text"},
+		{Name: "block-id", Desc: "target block ID(s) for block operations (comma-separated unique IDs for batch delete); -1 means document end where supported"},
 		{Name: "src-block-ids", Desc: "comma-separated source block ids for block_copy_insert_after and block_move_after"},
 		{Name: "revision-id", Desc: "base revision id; -1 means latest", Type: "int", Default: "-1"},
 	}
@@ -73,10 +73,16 @@ func validateUpdateV2(_ context.Context, runtime *common.RuntimeContext) error {
 		if pattern == "" {
 			return errs.NewValidationError(errs.SubtypeInvalidArgument, "--command str_replace requires --pattern").WithParam("--pattern")
 		}
+		if runtime.Str("doc-format") == "xml" && strings.ContainsAny(pattern, "\r\n") {
+			return errs.NewValidationError(errs.SubtypeInvalidArgument, "XML str_replace --pattern must be inline and cannot contain line breaks; use --doc-format markdown or a block operation for multiline changes").WithParam("--pattern")
+		}
 	case "block_delete":
 		if blockID == "" {
 			return errs.NewValidationError(errs.SubtypeInvalidArgument, "--command block_delete requires --block-id").WithParam("--block-id")
 		}
+		if err := validateBlockDeleteIDs(blockID); err != nil {
+			return err
+		}
 	case "block_insert_after":
 		if blockID == "" {
 			return errs.NewValidationError(errs.SubtypeInvalidArgument, "--command block_insert_after requires --block-id").WithParam("--block-id")
@@ -124,6 +130,29 @@ func validateUpdateV2(_ context.Context, runtime *common.RuntimeContext) error {
 	return nil
 }
 
+func validateBlockDeleteIDs(raw string) error {
+	seen := make(map[string]struct{})
+	for _, part := range strings.Split(raw, ",") {
+		blockID := strings.TrimSpace(part)
+		if blockID == "" {
+			return errs.NewValidationError(errs.SubtypeInvalidArgument, "--block-id contains an empty ID; provide a comma-separated list of non-empty block IDs").WithParam("--block-id")
+		}
+		if _, ok := seen[blockID]; ok {
+			return errs.NewValidationError(errs.SubtypeInvalidArgument, "--block-id contains duplicate ID %q; each block may be deleted only once per request", blockID).WithParam("--block-id")
+		}
+		seen[blockID] = struct{}{}
+	}
+	return nil
+}
+
+func normalizeBlockDeleteIDs(raw string) string {
+	parts := strings.Split(raw, ",")
+	for i := range parts {
+		parts[i] = strings.TrimSpace(parts[i])
+	}
+	return strings.Join(parts, ",")
+}
+
 func dryRunUpdateV2(_ context.Context, runtime *common.RuntimeContext) *common.DryRunAPI {
 	// Validate has already accepted --doc; parseDocumentRef cannot fail here.
 	ref, _ := parseDocumentRef(runtime.Str("doc"))
@@ -199,6 +228,9 @@ func buildUpdateBodyBase(runtime *common.RuntimeContext) map[string]interface{}
 		body["pattern"] = v
 	}
 	if blockID != "" {
+		if cmd == "block_delete" {
+			blockID = normalizeBlockDeleteIDs(blockID)
+		}
 		body["block_id"] = blockID
 	}
 	if v := runtime.Str("src-block-ids"); v != "" {

skills/lark-base/SKILL.md

@@ -112,7 +112,8 @@ metadata:
 - 表名、字段名、视图名、workflow 配置中的名称必须来自真实返回；跨表场景还要读取目标表结构。
 - 删除、角色更新、字段更新等高风险操作遵循 CLI 的 confirmation gate；目标不明确时先用 get/list 消歧。
 - 批量写入单批最多 200 条；连续写同一表时串行执行，遇到 `1254291` 按短暂等待后重试处理。
-- `select` 字段只支持写入字段中已有的选项；构造 CellValue 前先用 `+field-list` 或 `+field-search-options` 确认目标选项存在。
+- `+record-batch-update` 使用 `update_records`，按 `record_id -> fields` 映射逐条提交字段值。
+- select/multiselect 写入未知选项可能触发平台新增选项；不是要新增时，先用 `+field-list` 或 `+field-search-options` 确认可选值。
 
 ## 表单与视图细节
 

skills/lark-base/references/lark-base-cell-value.md

@@ -8,7 +8,7 @@
 
 - `--json` 必须是 JSON 对象。
 - `+record-upsert`：顶层直接传字段映射：`{"字段名或字段ID": CellValue}`。
-- `+record-batch-create`：使用 `create_records`，其每个元素都是 `Map<FieldNameOrID, CellValue>`。
+- `+record-batch-create`：`rows` 是 `CellValue[][]`，列顺序由 `fields` 决定。
 - `+record-batch-update`：使用 `update_records`，其每个 value 都是 `Map<FieldNameOrID, CellValue>`。
 - 一次 payload 里同一字段只用一种 key（字段名或字段 ID），不要重复。
 - 写入前先 `+field-list` 获取字段 `type/style/multiple`，再构造值。
@@ -48,7 +48,7 @@ text 字段的 `style.type` 影响单元格检查逻辑：
 
 ### 2.3 select（单选/多选）
 
-`select` 字段用 `multiple` 区分单选和多选：`multiple=false` 时传选项名字符串，`multiple=true` 时传选项名数组。只支持写入字段中已有的选项；构造 CellValue 前先用 `+field-list` 或 `+field-search-options` 确认目标选项存在。
+单选用选项名字符串；多选用选项名数组。选项名建议与字段配置一致；写入未知选项时平台可能自动新增选项，因此不要把自然语言近义词当成已有选项传入。
 
 ```json
 {

skills/lark-base/references/lark-base-record-batch-create.md

@@ -7,13 +7,13 @@
 ## 适用场景（重点）
 
 - 适合导入 CSV / Excel、外部系统一次性写入新数据。
-- 先把每条输入数据映射为独立的字段对象，再组装到 `create_records`。
+- 先把输入数据映射到合适的字段类型，再组装 `fields + rows`。
 
 ## 推荐命令
 
 ```bash
 lark-cli base +record-batch-create --base-token <base_token> --table-id <table_id> \
-  --json '{"create_records":[{"标题":"任务 A","状态":"Open"},{"标题":"任务 B","状态":"Done"}]}'
+  --json '{"fields":["标题","状态"],"rows":[["任务 A","Open"],["任务 B","Done"]]}'
 
 lark-cli base +record-batch-create --base-token <base_token> --table-id <table_id> --json @batch-create.json
 ```
@@ -34,25 +34,23 @@ lark-cli base +record-batch-create --base-token <base_token> --table-id <table_i
 
 本节只说明 `+record-batch-create` 的外层 JSON 形状；CellValue 统一看 [lark-base-cell-value.md](lark-base-cell-value.md)。
 
-对象形态：
-
-```json
-{"create_records":[{"标题":"任务 A","状态":"Open"},{"标题":"任务 B","状态":"Done"}]}
-```
+对象形态：`{"fields":[...],"rows":[...]}`。
 
 | 字段 | 类型 | 必填 | 说明 |
 |------|------|------|------|
-| `create_records` | `Array<Map<FieldNameOrID, CellValue>>` | 是 | 记录字段对象数组；每条记录可以提交不同字段，单次最多 200 条 |
+| `fields` | `string[]` | 是 | 字段 ID 或字段名数组 |
+| `rows` | `CellValue[][]` | 是 | 二维数组，每一行按 `fields` 同序给 cell；单次最多 200 行 |
 
 ## 返回重点
 
-返回 `record_id_list` 和可选的 `ignored_fields`。
+返回 `fields`、`field_id_list`、`record_id_list`、`data`，其中 `data` 与 `fields` 列顺序对齐。
 
 ## 坑点
 
-- 每个 `create_records` 元素都是独立的记录字段对象，只提交该记录需要写入的字段。
-- 单次最多 200 条，超出需分批写入。
-- `select` 字段只支持写入字段中已有的选项；构造 CellValue 前先用 `+field-list` 或 `+field-search-options` 确认目标选项存在。
+- `fields` 与每行 `rows` 的列顺序必须一一对应。
+- 空单元格必须显式用 `null` 填充。
+- 单次最多 200 行，超出需分批写入。
+- select 写入未知选项时平台可能自动新增选项；如果不是要新增选项，先确认真实选项名。
 
 ## 参考
 

skills/lark-base/references/lark-base-record-upsert.md

@@ -55,7 +55,7 @@ lark-cli base +record-upsert --base-token <base_token> --table-id <table_id> --r
 ## 坑点
 
 - 有 `--record-id` 就一定更新；不传就一定创建，不会自动查重或按业务键 upsert。
-- `select` 字段只支持写入字段中已有的选项；构造 CellValue 前先用 `+field-list` 或 `+field-search-options` 确认目标选项存在。
+- select 写入未知选项时平台可能自动新增选项；如果不是要新增选项，先用 `+field-list` / `+field-search-options` 确认真实选项名。
 - 这是写入操作，执行前必须确认目标表和字段。
 
 ## 参考

tests/cli_e2e/base/base_record_batch_update_workflow_test.go

@@ -15,7 +15,6 @@ import (
 )
 
 func TestBaseRecordBatchUpdatePerRecordWorkflow(t *testing.T) {
-	clie2e.SkipWithoutTenantAccessToken(t)
 	parentT := t
 	ctx, cancel := context.WithTimeout(context.Background(), 4*time.Minute)
 	t.Cleanup(cancel)
@@ -36,7 +35,7 @@ func TestBaseRecordBatchUpdatePerRecordWorkflow(t *testing.T) {
 			"base", "+record-batch-create",
 			"--base-token", baseToken,
 			"--table-id", tableID,
-			"--json", `{"create_records":[{"Name":"alpha","Status":"Open","Score":10},{"Name":"beta","Status":"Open","Score":15}]}`,
+			"--json", `{"fields":["Name","Status","Score"],"rows":[["alpha","Open",10],["beta","Open",15]]}`,
 		},
 		DefaultAs: "bot",
 	})

tests/cli_e2e/base/coverage.md

@@ -56,7 +56,7 @@
 | ✕ | base +form-questions-list | shortcut |  | none | form workflows not covered |
 | ✕ | base +form-questions-update | shortcut |  | none | form workflows not covered |
 | ✕ | base +form-update | shortcut |  | none | form workflows not covered |
-| ✓ | base +record-batch-create | shortcut | base_record_batch_update_workflow_test.go::TestBaseRecordBatchUpdatePerRecordWorkflow | `--base-token`; `--table-id`; `--json.create_records` | seeds heterogeneous live workflow records |
+| ✓ | base +record-batch-create | shortcut | base_record_batch_update_workflow_test.go::TestBaseRecordBatchUpdatePerRecordWorkflow | `--base-token`; `--table-id`; `--json.fields`; `--json.rows` | seeds heterogeneous live workflow records |
 | ✓ | base +record-batch-update | shortcut | base_record_batch_update_dryrun_test.go::TestBaseRecordBatchUpdatePerRecordDryRun; base_record_batch_update_workflow_test.go::TestBaseRecordBatchUpdatePerRecordWorkflow | `--base-token`; `--table-id`; `--json.update_records`; dry-run + live | heterogeneous select/number update with write-back verification |
 | ✕ | base +record-delete | shortcut |  | none | record workflows not covered |
 | ✓ | base +record-get | shortcut | base_record_batch_update_workflow_test.go::TestBaseRecordBatchUpdatePerRecordWorkflow | `--record-id`; repeated `--field-id`; `--format json` | reads back select and number values after batch update |

tests/cli_e2e/docs/docs_create_fetch_test.go

@@ -44,7 +44,6 @@ func TestDocs_CreateAndFetchWorkflowAsBot(t *testing.T) {
 				"--doc", docToken,
 				"--doc-format", "markdown",
 			},
-			DefaultAs: defaultAs,
 		})
 		require.NoError(t, err)
 		result.AssertExitCode(t, 0)

tests/cli_e2e/docs/docs_update_dryrun_test.go

@@ -91,10 +91,11 @@ func TestDocs_DryRunDefaultsToV2OpenAPI(t *testing.T) {
 				"docs", "+update",
 				"--doc", "doxcnDryRunE2E",
 				"--command", "block_delete",
-				"--block-id", "blkA,blkB,blkC",
+				"--block-id", "blkA, blkB,  blkC",
 				"--dry-run",
 			},
 			wantContains: []string{"/open-apis/docs_ai/v1/documents/doxcnDryRunE2E"},
+			wantBody:     map[string]any{"block_id": "blkA,blkB,blkC"},
 		},
 		{
 			name: "history list",
@@ -225,3 +226,60 @@ func TestDocs_CreateTitleDryRunPrependsContent(t *testing.T) {
 	require.Equal(t, "markdown", clie2e.DryRunGet(out, "api.0.body.format").String(), "stdout:\n%s", out)
 	require.Equal(t, "<title>Dry Run &amp; Title</title>\n## Body", clie2e.DryRunGet(out, "api.0.body.content").String(), "stdout:\n%s", out)
 }
+
+func TestDocs_CreateTitleDryRunNormalizesXMLTitle(t *testing.T) {
+	t.Setenv("LARKSUITE_CLI_APP_ID", "app")
+	t.Setenv("LARKSUITE_CLI_APP_SECRET", "secret")
+	t.Setenv("LARKSUITE_CLI_BRAND", "feishu")
+
+	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+	t.Cleanup(cancel)
+
+	result, err := clie2e.RunCmd(ctx, clie2e.Request{
+		Args: []string{
+			"docs", "+create",
+			"--title", "Flag title",
+			"--content", "<title>Content title</title><p>body</p>",
+			"--dry-run",
+		},
+		DefaultAs: "bot",
+	})
+	require.NoError(t, err)
+	result.AssertExitCode(t, 0)
+	require.Equal(t, "<title>Flag title</title>\n<p>body</p>", clie2e.DryRunGet(result.Stdout, "api.0.body.content").String())
+}
+
+func TestDocs_DryRunRejectsUnsafeWriteInputs(t *testing.T) {
+	t.Setenv("LARKSUITE_CLI_APP_ID", "app")
+	t.Setenv("LARKSUITE_CLI_APP_SECRET", "secret")
+	t.Setenv("LARKSUITE_CLI_BRAND", "feishu")
+
+	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+	t.Cleanup(cancel)
+
+	tests := []struct {
+		name string
+		args []string
+		want string
+	}{
+		{
+			name: "multiline XML str_replace",
+			args: []string{"docs", "+update", "--doc", "doxcnDryRunE2E", "--command", "str_replace", "--pattern", "line one\nline two", "--content", "replacement", "--dry-run"},
+			want: "must be inline",
+		},
+		{
+			name: "duplicate block delete ID",
+			args: []string{"docs", "+update", "--doc", "doxcnDryRunE2E", "--command", "block_delete", "--block-id", "blkA,blkA", "--dry-run"},
+			want: "duplicate ID",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result, err := clie2e.RunCmd(ctx, clie2e.Request{Args: tt.args, DefaultAs: "bot"})
+			require.NoError(t, err)
+			result.AssertExitCode(t, 2)
+			require.Contains(t, result.Stdout+"\n"+result.Stderr, tt.want)
+		})
+	}
+}

tests/cli_e2e/okr/okr_shortcuts_test.go

@@ -366,7 +366,6 @@ func createTestObjectives(t *testing.T, ctx context.Context, cycleID string, suf
 			"--cycle-id", cycleID,
 			"--input", string(inputJSON),
 		},
-		DefaultAs: "user",
 	})
 	require.NoError(t, err, "failed to create test objectives")
 	result.AssertExitCode(t, 0)
@@ -412,7 +411,6 @@ func cleanupLiveTest(t *testing.T, created []liveTestCreated) {
 					"--key-result-id", krID,
 					"--yes",
 				},
-				DefaultAs: "user",
 			})
 			clie2e.ReportCleanupFailure(t, fmt.Sprintf("delete KR %s", krID), result, err)
 			select {
@@ -428,7 +426,6 @@ func cleanupLiveTest(t *testing.T, created []liveTestCreated) {
 				"--objective-id", obj.ObjectiveID,
 				"--yes",
 			},
-			DefaultAs: "user",
 		})
 		clie2e.ReportCleanupFailure(t, fmt.Sprintf("delete objective %s", obj.ObjectiveID), result, err)
 		if i > 0 {
@@ -450,7 +447,6 @@ func createLiveObjective(t *testing.T, ctx context.Context, cycleID string, suff
 			"--cycle-id", cycleID,
 			"--content", fmt.Sprintf(`{"text":"E2E Single Objective %s","mention":["ou_test"]}`, suffix),
 		},
-		DefaultAs: "user",
 	})
 	require.NoError(t, err, "failed to create live objective")
 	result.AssertExitCode(t, 0)
@@ -470,7 +466,6 @@ func createLiveKeyResult(t *testing.T, ctx context.Context, objectiveID string,
 			"--objective-id", objectiveID,
 			"--content", fmt.Sprintf(`{"text":"E2E Single KR %s","mention":["ou_test"]}`, suffix),
 		},
-		DefaultAs: "user",
 	})
 	require.NoError(t, err, "failed to create live key result")
 	result.AssertExitCode(t, 0)
@@ -504,7 +499,6 @@ func TestOKR_BatchCreateLive(t *testing.T) {
 			"okr", "+cycle-detail",
 			"--cycle-id", cycleID,
 		},
-		DefaultAs: "user",
 	})
 	require.NoError(t, err)
 	result.AssertExitCode(t, 0)
@@ -550,7 +544,6 @@ func TestOKR_CreateLive_Objective(t *testing.T) {
 			"okr", "+cycle-detail",
 			"--cycle-id", cycleID,
 		},
-		DefaultAs: "user",
 	})
 	require.NoError(t, err)
 	result.AssertExitCode(t, 0)
@@ -588,7 +581,6 @@ func TestOKR_CreateLive_KeyResultUnderExistingObjective(t *testing.T) {
 			"okr", "+cycle-detail",
 			"--cycle-id", cycleID,
 		},
-		DefaultAs: "user",
 	})
 	require.NoError(t, err)
 	result.AssertExitCode(t, 0)
@@ -648,7 +640,6 @@ func TestOKR_ReorderLive(t *testing.T) {
 			"--level", "objective",
 			"--ops", string(opsJSON),
 		},
-		DefaultAs: "user",
 	})
 	require.NoError(t, err)
 	result.AssertExitCode(t, 0)
@@ -659,7 +650,6 @@ func TestOKR_ReorderLive(t *testing.T) {
 			"okr", "+cycle-detail",
 			"--cycle-id", cycleID,
 		},
-		DefaultAs: "user",
 	})
 	require.NoError(t, err)
 	result.AssertExitCode(t, 0)
@@ -712,7 +702,6 @@ func TestOKR_WeightLive(t *testing.T) {
 			"--level", "objective",
 			"--weights", string(weightsJSON),
 		},
-		DefaultAs: "user",
 	})
 	require.NoError(t, err)
 	result.AssertExitCode(t, 0)
@@ -723,7 +712,6 @@ func TestOKR_WeightLive(t *testing.T) {
 			"okr", "+cycle-detail",
 			"--cycle-id", cycleID,
 		},
-		DefaultAs: "user",
 	})
 	require.NoError(t, err)
 	result.AssertExitCode(t, 0)