lark-shared

lark-cli shared rules

The foundation shared by all lark-* skills: identity, authentication, output contract, and high-risk operations.

General guidelines

1. Confirm usage before invoking: before executing, read the corresponding reference or run --help, don't guess flags and call blindly.

2. Identity determines who you operate on behalf of：--as user represents the user themselves (can view and operate their personal resources such as calendar, cloud space/cloud drive/cloud storage), while--as bot represents the application itself, an application-level operation, and can only access the bot's own resources; when the bot queries user resources it returns empty success rather than an error. Figure out the identity before actingidentity. Identity model and permission management → lark-shared-identity-and-permissions.md。

3. Authorization / configuration URLs must be paired with a QR code: when a command outputs URL fields such as verification_url、verification_uri_complete、console_url , you must use lark-cli auth qrcode to generate and display it in the reply, with the URL first and the QR code after; prefer generating PNG (--output), and only use ASCII (--ascii) when the user explicitly requests it. Forward the URL as-is—do not encode/decode, add punctuation, or reassemble the query; show the QR code and link to the user together.

4. --format json(default), determine success using ok == true(or process exit code 0), do not use code == 0: the success envelope has no top-level code / msg field,code only appears inside the error of the error envelope. Judging by the old OpenAPI format {"code": 0, "msg": "ok"}will misjudge all successful calls as failures—this is especially dangerous when wrapping write-type commands. JSON output contract → lark-shared-output-contract.md。

Security rules

1. Do not output secrets(appSecret, accessToken, etc.) to the terminal in plaintext.

1. Confirm user intent before write/delete operations。

2. When the target command supports --dry-run , use --dry-run to preview the dangerous request.

3. Exit code 10 is a high-risk confirmation gate (risk: "high-risk-write"), not an error: stop → confirm with the user(show action、risk and key parameters) → after obtainingexplicit user consent, append the confirmation flag hint indicated by to the end of your original argvand retry;neversilently add the confirmation flag to bypass → lark-shared-high-risk-approval.md。

4. File paths only accept relative paths：--file、--output、--output-dir、@file and other path parameters only accept relative paths under cwd; passing an absolute path will report unsafe file path. For data input (@file, large JSON) prefer passing via stdin to avoid path and escaping issues.

Reference strong-trigger index

When any trigger condition is hit,you MUST read the corresponding reference before executing the next step. When multiple are hit, read them in the order of the table, and read each reference only once.

Strong trigger conditions (reading is mandatory if any is hit)	Reference
Checking who you are (user/bot), obtaining detailed field information of the current identity, identity diagnosis,--asselection logic, identity continuity, login state, authentication, scope, authorization and permission management,missing_scopes or console_url, the Agent is about to initiate or complete auth login	lark-shared-identity-and-permissions.md
Need to rely on the JSON output contract to determine success/failure, read stdout/stderr, or write scripts and wrappers for commands	lark-shared-output-contract.md
Preparing to execute high-risk-write (high-risk operation), determine the command risk level, encounter exit code 10,confirmation_required, and retry after confirmation	lark-shared-high-risk-approval.md
When using the CLI for the first time, you need to run lark-cli config init to complete the application configuration, or the CLI explicitly prompts config init --new	lark-shared-config-init.md
The user asks about notice, a CLI version update, or the output contains _notice(upgrade / skills out of date / deprecated command prompts)	lark-shared-update-notice.md