mirror of
https://github.com/larksuite/cli.git
synced 2026-07-15 06:52:07 +08:00
aeaed0884e
Integrators that build their own lark-cli distribution can now ship a package where everything they cut out truly disappears, instead of lingering as half-disabled stubs that mislead users and agents. Commands an integrator plugin restricts no longer show up in help or completion, and invoking one (including asking for its help) answers "command not included in this build" (subtype command_unavailable) with no policy vocabulary and no dead-end recovery steering. Integrators can replace that message with their own product wording via Rule.DeniedMessage. Cutting a whole domain also retires everything that points at it: --profile hides and rejects use when the profile domain goes, the skills-setup footer, update notices, and the auth-login recovery hint stop rendering when their domains go. The policy self-inspection commands (config policy show / plugins show) stay executable by default so operators can still see which rule locked the build, hidden from help but available on request. Fully-managed distributions can retire even those with HideDiagnostics(). Plugins can also trim the embedded skills to match: EmbeddedSkills removes, overlays, or replaces entries over the CLI's built-in set, and skills list/read plus every help pointer serve the same trimmed tree. Users who write their own ~/.lark-cli/policy.yml see no change: their denials stay visible and keep explaining how to adjust the policy they own. Default builds are byte-for-byte unchanged.