feat(schema): govern conditional idempotent retries

.changes/954-chat-im-id-flags.md

@@ -1,7 +0,0 @@
----
-category: Changed
----
-
-- **Chat IM ID flags** (#954) — standardizes chat command entry points on `--conversation-id` for conversation IDs and `--message-id` for message IDs, so help, Schema, and Agent recommendations use the same canonical flags.
-- **Legacy chat flag compatibility** (#954) — keeps older chat IM ID flags such as `--group`, `--id`, `--chat`, `--open-conversation-id`, `--msg-id`, and `--open-message-id` working as compatibility aliases where applicable, while hiding migrated aliases from recommended help and Schema surfaces.
-- **Chat group bots target flag** (#954) — keeps `dws chat group bots` on the visible `--group` flag; this command does not register `--group-name`, and `--group` accepts either an openConversationId or a uniquely resolved group name.

.changes/chat-reference-card-verification.md

@@ -1,6 +0,0 @@
----
-category: Fixed
----
-
-- **Chat card update evidence** — distinguishes an accepted update request from an independently verified visible update, preserving the real `bizId` and warning callers not to repeat an unverified write.
-- **Chat command guidance** — splits message and group references by task and explains that `--from` is ambiguous between sender and time-range intent.

.changes/idempotency-retry-governance.md

@@ -0,0 +1,5 @@
+---
+category: Changed
+---
+
+- **Agent retry safety** — adds a conditional idempotency contract and base-owned compatibility governance for deduplication-key-aware retries.

.changes/released/1.0.59-beta.1/899-drive-latest-incomplete-scan.md

@@ -1,20 +0,0 @@
----
-category: Fixed
----
-
-- **Drive `--latest` refuses incomplete Top-N** (#899) — `dws drive list --latest` used to
-  exit 0 with a "Top-N" computed over a partially scanned tree whenever a directory read
-  failed mid-recursion (permission denied, API error), letting an incomplete set pose as the
-  globally newest files. Truncation at the 2000-item scan cap and mid-recursion directory
-  failures now both fail closed (`LATEST_SCAN_TRUNCATED` / `LATEST_SCAN_INCOMPLETE`), report
-  the first failing folder with its depth and reason, and emit a recovery command that
-  reproduces the original candidate set — query domain, `--folder`, `--pattern`, `--type`,
-  `--start` and `--end` are all carried over. On POSIX shells each user-supplied value is
-  quoted so a URL query string or a shell metacharacter cannot change how the copied command
-  parses. On Windows no quoting form is safe for both `cmd.exe` and PowerShell, so values
-  containing metacharacters are not inlined at all: the command carries a placeholder and the
-  original value is shown on a separate line marked as data rather than an executable command.
-  Unrecoverable errors under `--latest` return the root cause instead of a partial result.
-  Remote-controlled folder names and server error text are stripped of ANSI escapes and
-  control characters before they reach the plain-text stderr message. The internal `sortTime`
-  sort key no longer leaks into `drive list --depth` output on any path.

.changes/released/1.0.59-beta.1/942-drive-list-filter.md

@@ -1,12 +0,0 @@
----
-category: Added
----
-
-- **Drive list type/time filtering** (#942) — `dws drive list` gains `--type
-  file|folder`, `--start`, and `--end` for client-side filtering by node type
-  and modification time on both the pan and workspace routes. Filtering runs
-  a bounded full scan of the target directory (2000-entry cap, reported via
-  `truncated=true`), composes with `--latest`/`--pattern`/`--depth`, and is
-  mutually exclusive with `--versions`/`--cursor`/`--order-by`/`--order`/
-  `--limit`. Time values accept relative forms (`24h`/`7d`/`2w`), RFC 3339,
-  zone-less ISO 8601 (Asia/Shanghai), or a plain date.

.changes/released/1.0.59-beta.1/942-drive-list-pattern-fix.md

@@ -1,12 +0,0 @@
----
-category: Fixed
----
-
-- **Drive list pattern filtering** (#942) — `dws drive list --pattern` on the
-  single-layer pan route now filters the returned page by name pattern; the
-  flag was previously accepted but silently ignored.
-
-- **Drive list `--type folder --latest` composition** (#942) — `--latest` now
-  ranks the filtered entries (folders included when `--type folder` is set)
-  instead of unconditionally dropping folders, so the documented combination
-  returns the most recently modified folders rather than an empty list.

.changes/released/1.0.59-beta.1/973-chat-message-time-defaults.md

@@ -1,5 +0,0 @@
----
-category: Fixed
----
-
-- **Chat message time defaults** (#973) — default omitted `chat message list-all` time bounds in `Asia/Shanghai` when emitting timezone-less `yyyy-MM-dd HH:mm:ss` values, matching parsing semantics and rejecting reversed windows.

.changes/released/1.0.59-beta.1/doc-drive-param-aliases.md

@@ -1,5 +0,0 @@
----
-category: Fixed
----
-
-- **Doc and Drive parameter aliases** — normalizes reviewed identifier, pagination, path, version, and role synonyms while blocking ambiguous values before dispatch.

.changes/released/1.0.59-beta.1/drive-folder-sync.md

@@ -1,15 +0,0 @@
----
-category: Added
----
-
-- **Drive folder synchronization** — adds `dws drive status`, `dws drive pull`,
-  `dws drive push`, and `dws drive sync` for file-level comparison and transfer
-  between a local folder and a Drive folder. Differences come from exact MD5 by
-  default or from modification time with `--quick`; `status` is read-only, `pull`
-  and `push` are one-directional with `--if-exists skip|smart|overwrite`, and
-  `sync` is bidirectional with `--on-conflict remote-wins|local-wins|keep-both|ask`.
-  Only regular files are transferred — online documents and shortcuts are skipped,
-  neither side deletes extra files, downloads are staged through a temporary file
-  and committed with an atomic rename, and remote names that would escape
-  `--local-folder` are reported as failures instead of being written. Every command
-  prints a structured summary on stdout and exits non-zero when any item fails.

.changes/released/1.0.59-beta.1/global-dingtalk-region.md

@@ -1,5 +0,0 @@
----
-category: Added
----
-
-- **International DingTalk region support** — adds `.io` login and MCP routing, pre-release endpoint overrides, and profile-aware gateway selection while preserving the existing `.com` flow.

.changes/released/1.0.59-beta.1/open-dingtalk-id-format-routing.md

@@ -1,5 +0,0 @@
----
-category: Changed
----
-
-- **Chat identity routing** — validates explicit `openDingTalkId` inputs and improves name, `userId`, and `openDingTalkId` routing for message shortcuts.

.github/workflows/ci.yml

@@ -24,7 +24,6 @@ jobs:
       pull-requests: read
     outputs:
       changelog_only: ${{ steps.classify.outputs.changelog_only }}
-      release_seal_only: ${{ steps.classify.outputs.release_seal_only }}
       changelog_changed: ${{ steps.classify.outputs.changelog_changed }}
       docs_only: ${{ steps.classify.outputs.docs_only }}
       full_suite: ${{ steps.classify.outputs.full_suite }}
@@ -40,7 +39,6 @@ jobs:
         with:
           script: |
             let changelogOnly = false;
-            let releaseSealOnly = false;
             let changelogChanged = false;
             let docsOnly = false;
             let fullSuite = context.eventName === 'push';
@@ -153,12 +151,6 @@ jobs:
                 filename.startsWith('internal/helpers/') ||
                 filename.startsWith('internal/generator/') ||
                 filename.startsWith('internal/cli/schema') ||
-                // Parameter aliases are reduced against the live command tree.
-                // Their reverse-dependency set is too large for one focused
-                // race job, so use the existing full-suite shards.
-                filename === 'internal/cli/param_concepts.json' ||
-                filename === 'internal/cli/param_concepts.schema.json' ||
-                filename === 'internal/cli/param_aliases_generated.go' ||
                 filename.startsWith('internal/interfacesnapshot/') ||
                 filename.startsWith('internal/app/upgrade') ||
                 filename.startsWith('internal/transport/') ||
@@ -170,43 +162,6 @@ jobs:
                 filename === 'go.mod' ||
                 filename === 'go.sum'
               );
-            const isExactReleaseSeal = (candidates) => {
-              const changelog = candidates.filter(
-                ({ filename, status, previous_filename }) =>
-                  filename === 'CHANGELOG.md' &&
-                  status === 'modified' &&
-                  !previous_filename
-              );
-              if (changelog.length !== 1 || candidates.length < 2) {
-                return false;
-              }
-              let version = '';
-              return candidates.every((file) => {
-                if (file.filename === 'CHANGELOG.md') {
-                  return file.status === 'modified' && !file.previous_filename;
-                }
-                if (
-                  file.status !== 'renamed' ||
-                  typeof file.filename !== 'string' ||
-                  typeof file.previous_filename !== 'string' ||
-                  file.additions !== 0 ||
-                  file.deletions !== 0
-                ) {
-                  return false;
-                }
-                const target = file.filename.match(
-                  /^\.changes\/released\/([0-9]+\.[0-9]+\.[0-9]+(?:-beta\.[1-9][0-9]*)?)\/([a-z0-9][a-z0-9._-]*\.md)$/
-                );
-                if (!target || file.previous_filename !== `.changes/${target[2]}`) {
-                  return false;
-                }
-                if (version && version !== target[1]) {
-                  return false;
-                }
-                version = target[1];
-                return true;
-              });
-            };
             const classifyFiles = (complete) => {
               const paths = files.flatMap(({ filename, previous_filename }) =>
                 [filename, previous_filename].filter(
@@ -293,26 +248,19 @@ jobs:
                 );
               }
 
-              const exactChangelogDiff =
+              changelogOnly =
                 files.length === 1 &&
                 files[0].filename === 'CHANGELOG.md' &&
                 files[0].status === 'modified' &&
                 !files[0].previous_filename;
-              releaseSealOnly = isExactReleaseSeal(files);
-              changelogOnly = exactChangelogDiff || releaseSealOnly;
               changelogChanged = files.some(
                 ({ filename, previous_filename }) =>
                   filename === 'CHANGELOG.md' ||
                   previous_filename === 'CHANGELOG.md'
               );
               classifyFiles(true);
-              if (releaseSealOnly) {
-                fullSuite = false;
-              }
               fastPathTrust = changelogOnly
-                ? releaseSealOnly
-                  ? 'exact release-seal fragment archival and synthetic merge policy'
-                  : 'exact CHANGELOG-only revision and synthetic merge policy'
+                ? 'exact pull-request revision and synthetic merge policy'
                 : docsOnly
                   ? 'documentation-only focused admission'
                   : fullSuite
@@ -347,8 +295,7 @@ jobs:
                     per_page: 100,
                   });
                 files = Array.isArray(comparison.files) ? comparison.files : [];
-                const pushFilesComplete = files.length < 300;
-                classifyFiles(pushFilesComplete);
+                classifyFiles(files.length < 300);
                 const linearFromValidatedTip =
                   comparison.status === 'ahead' &&
                   comparison.merge_base_commit?.sha === expectedBefore &&
@@ -360,10 +307,8 @@ jobs:
                   files[0].filename === 'CHANGELOG.md' &&
                   files[0].status === 'modified' &&
                   !files[0].previous_filename;
-                const exactReleaseSealDiff =
-                  pushFilesComplete && isExactReleaseSeal(files);
 
-                if (linearFromValidatedTip && (exactChangelogDiff || exactReleaseSealDiff)) {
+                if (linearFromValidatedTip && exactChangelogDiff) {
                   const requiredContexts = [
                     'Lint',
                     'Test',
@@ -414,15 +359,9 @@ jobs:
 
                   if (missing.length === 0 && nonSuccess.length === 0) {
                     changelogOnly = true;
-                    releaseSealOnly = exactReleaseSealDiff;
                     changelogChanged = true;
-                    if (releaseSealOnly) {
-                      fullSuite = false;
-                    }
                     fastPathTrust =
-                      releaseSealOnly
-                        ? `exact release-seal successor of validated ${expectedBefore}`
-                        : `exact CHANGELOG-only successor of validated ${expectedBefore}`;
+                      `exact CHANGELOG-only successor of validated ${expectedBefore}`;
                   } else {
                     fastPathTrust =
                       'predecessor Code Admission is not fully successful; ' +
@@ -437,7 +376,6 @@ jobs:
             }
 
             core.setOutput('changelog_only', String(changelogOnly));
-            core.setOutput('release_seal_only', String(releaseSealOnly));
             core.setOutput('changelog_changed', String(changelogChanged));
             core.setOutput('docs_only', String(docsOnly));
             core.setOutput('full_suite', String(fullSuite));
@@ -449,8 +387,7 @@ jobs:
             await core.summary
               .addHeading('Code Admission scope')
               .addRaw(`- Event: \`${context.eventName}\`\n`)
-              .addRaw(`- Metadata-only fast path: \`${changelogOnly}\`\n`)
-              .addRaw(`- Release-seal fragments only: \`${releaseSealOnly}\`\n`)
+              .addRaw(`- Exact modified CHANGELOG only: \`${changelogOnly}\`\n`)
               .addRaw(`- CHANGELOG touched: \`${changelogChanged}\`\n`)
               .addRaw(`- Documentation-only: \`${docsOnly}\`\n`)
               .addRaw(`- Full suite: \`${fullSuite}\`\n`)
@@ -465,14 +402,7 @@ jobs:
 
       - name: Record CHANGELOG-only fast path
         if: steps.classify.outputs.changelog_only == 'true'
-        env:
-          RELEASE_SEAL_ONLY: ${{ steps.classify.outputs.release_seal_only }}
-        run: |
-          if [ "$RELEASE_SEAL_ONLY" = true ]; then
-            echo "Lint is satisfied by the trusted release-seal fragment Policy path." >> "$GITHUB_STEP_SUMMARY"
-          else
-            echo "Lint is satisfied by the trusted CHANGELOG-only Policy path." >> "$GITHUB_STEP_SUMMARY"
-          fi
+        run: echo "Lint is satisfied by the trusted CHANGELOG-only Policy path." >> "$GITHUB_STEP_SUMMARY"
 
       - name: Record documentation-only fast path
         if: steps.classify.outputs.changelog_only != 'true' && steps.classify.outputs.docs_only == 'true'
@@ -565,8 +495,7 @@ jobs:
     needs: lint
     if: ${{ needs.lint.outputs.changelog_only != 'true' && needs.lint.outputs.docs_only != 'true' && needs.lint.outputs.full_suite == 'true' }}
     runs-on: ubuntu-latest
-    # app runs several independently bounded processes; cli/smoke need headroom
-    # beyond go test -timeout for setup + assembly.
+    # cli/smoke shards need headroom beyond go test -timeout for setup + assembly.
     timeout-minutes: 20
     strategy:
       fail-fast: false
@@ -602,19 +531,10 @@ jobs:
           test -n "$package_output"
           mapfile -t packages <<< "$package_output"
           test "${#packages[@]}" -gt 0
-          if [ "$TEST_SHARD" = "app" ]; then
-            # A single long-lived app test process retains every constructed
-            # command tree in framework registries. Isolate Schema assembly and
-            # bounded name ranges so each process releases that state on exit.
-            test "${#packages[@]}" -eq 1
-            ./scripts/ci/run-app-race-tests.sh run "${packages[0]}"
-            exit 0
-          fi
-          # cli/smoke own heavy NewRootCommand / Schema assembly under -race;
-          # give them a dedicated package timeout on slower hosted runners.
+          # cli/smoke own heavy NewRootCommand / Schema assembly under -race; give
+          # them a dedicated budget so remaining is not SIGTERM'd by OOM/timeout.
           timeout_budget=12m
-          if [ "$TEST_SHARD" = "cli" ] ||
-             [ "$TEST_SHARD" = "smoke" ]; then
+          if [ "$TEST_SHARD" = "cli" ] || [ "$TEST_SHARD" = "smoke" ]; then
             timeout_budget=15m
           fi
           go test -v -race -count=1 -timeout="$timeout_budget" "${packages[@]}"
@@ -911,7 +831,7 @@ jobs:
   coverage-current:
     name: Coverage (current)
     needs: lint
-    if: ${{ needs.lint.outputs.changelog_only != 'true' && needs.lint.outputs.docs_only != 'true' && needs.lint.outputs.full_suite != 'true' }}
+    if: ${{ needs.lint.outputs.changelog_only != 'true' && needs.lint.outputs.docs_only != 'true' }}
     runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
@@ -926,6 +846,10 @@ jobs:
         with:
           go-version-file: go.mod
 
+      - name: Install archive tooling
+        if: needs.lint.outputs.full_suite == 'true'
+        run: sudo apt-get update && sudo apt-get install -y zip unzip
+
       - name: Resolve authoritative coverage base
         env:
           PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
@@ -947,33 +871,41 @@ jobs:
       - name: Build
         run: make build
 
-      - name: Run scoped unit tests with coverage
+      - name: Run current unit tests with coverage
         shell: bash
         env:
           DWS_PACKAGE_VERSION: 0.0.0-test
+          FULL_SUITE: ${{ needs.lint.outputs.full_suite }}
         run: |
           set -euo pipefail
-          changed_output="$(
-            ./scripts/ci/changed-test-packages.sh \
-              changed "$COVERAGE_BASE_REF" "$COVERAGE_HEAD_REF"
-          )"
-          impacted_output="$(
-            ./scripts/ci/changed-test-packages.sh \
-              list "$COVERAGE_BASE_REF" "$COVERAGE_HEAD_REF"
-          )"
-          if [ -z "$changed_output" ] || [ -z "$impacted_output" ]; then
-            printf 'mode: atomic\n' > coverage.txt
-            echo "No buildable Go package needs scoped coverage." \
-              >> "$GITHUB_STEP_SUMMARY"
-          else
-            mapfile -t changed_packages <<< "$changed_output"
-            mapfile -t impacted_packages <<< "$impacted_output"
-            coverpkg="$(IFS=,; echo "${changed_packages[*]}")"
+          if [ "$FULL_SUITE" = true ]; then
             go test -count=1 -p 1 \
-              -coverpkg="$coverpkg" \
               -coverprofile=coverage.txt \
               -covermode=atomic \
-              "${impacted_packages[@]}"
+              ./ ./cmd/... ./internal/... ./skills/...
+          else
+            changed_output="$(
+              ./scripts/ci/changed-test-packages.sh \
+                changed "$COVERAGE_BASE_REF" "$COVERAGE_HEAD_REF"
+            )"
+            impacted_output="$(
+              ./scripts/ci/changed-test-packages.sh \
+                list "$COVERAGE_BASE_REF" "$COVERAGE_HEAD_REF"
+            )"
+            if [ -z "$changed_output" ] || [ -z "$impacted_output" ]; then
+              printf 'mode: atomic\n' > coverage.txt
+              echo "No buildable Go package needs scoped coverage." \
+                >> "$GITHUB_STEP_SUMMARY"
+            else
+              mapfile -t changed_packages <<< "$changed_output"
+              mapfile -t impacted_packages <<< "$impacted_output"
+              coverpkg="$(IFS=,; echo "${changed_packages[*]}")"
+              go test -count=1 -p 1 \
+                -coverpkg="$coverpkg" \
+                -coverprofile=coverage.txt \
+                -covermode=atomic \
+                "${impacted_packages[@]}"
+            fi
           fi
           if [ "$(wc -l < coverage.txt)" -gt 1 ]; then
             go tool cover -func=coverage.txt
@@ -986,66 +918,6 @@ jobs:
           path: coverage.txt
           retention-days: 1
 
-  coverage-current-full:
-    name: "Coverage (current: ${{ matrix.shard }})"
-    needs: lint
-    if: ${{ needs.lint.outputs.changelog_only != 'true' && needs.lint.outputs.docs_only != 'true' && needs.lint.outputs.full_suite == 'true' }}
-    runs-on: ubuntu-latest
-    timeout-minutes: 20
-    strategy:
-      fail-fast: false
-      matrix:
-        shard:
-          - app
-          - cli
-          - generators
-          - helpers
-          - remaining
-    steps:
-      - name: Check out repository
-        uses: actions/checkout@v4
-        with:
-          ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
-
-      - name: Set up Go
-        uses: actions/setup-go@v5
-        with:
-          go-version-file: go.mod
-
-      - name: Install archive tooling
-        run: sudo apt-get update && sudo apt-get install -y zip unzip
-
-      - name: Build
-        run: make build
-
-      # Each shard keeps -p 1 so the authoritative measurement stays serial
-      # inside one instrumented process group; shards run on isolated runners,
-      # and scripts/ci/test-packages.sh verify proves the shard union equals
-      # the previous single full-suite package set exactly once.
-      - name: Run current shard tests with coverage
-        shell: bash
-        env:
-          DWS_PACKAGE_VERSION: 0.0.0-test
-          COVERAGE_SHARD: ${{ matrix.shard }}
-        run: |
-          set -euo pipefail
-          package_output="$(./scripts/ci/test-packages.sh list-coverage "$COVERAGE_SHARD")"
-          test -n "$package_output"
-          mapfile -t packages <<< "$package_output"
-          test "${#packages[@]}" -gt 0
-          go test -count=1 -p 1 \
-            -coverprofile="coverage-shard-$COVERAGE_SHARD.txt" \
-            -covermode=atomic \
-            "${packages[@]}"
-          go tool cover -func="coverage-shard-$COVERAGE_SHARD.txt" | tail -n 1
-
-      - name: Upload current shard coverage profile
-        uses: actions/upload-artifact@v4
-        with:
-          name: coverage-current-shard-${{ matrix.shard }}
-          path: coverage-shard-${{ matrix.shard }}.txt
-          retention-days: 1
-
   coverage-supporting:
     name: Coverage (supporting)
     needs: lint
@@ -1099,11 +971,14 @@ jobs:
           ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
 
       - name: Set up Go
-        id: setup-go
         uses: actions/setup-go@v5
         with:
           go-version-file: go.mod
 
+      - name: Install archive tooling
+        if: needs.lint.outputs.full_suite == 'true'
+        run: sudo apt-get update && sudo apt-get install -y zip unzip
+
       - name: Resolve authoritative coverage base
         env:
           PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
@@ -1121,34 +996,7 @@ jobs:
           git rev-parse --verify "${base_ref}^{commit}" >/dev/null
           echo "COVERAGE_BASE_REF=$base_ref" >> "$GITHUB_ENV"
 
-      # The merge-base full-suite profile is a pure function of the base
-      # commit. Reuse the profile published by the last green push run of
-      # exactly that commit instead of re-running the whole suite; any key
-      # mismatch falls back to authoritative recomputation. Exact key only,
-      # never prefix fallback: a near-miss profile would compare the
-      # candidate against the wrong commit.
-      - name: Restore cached merge-base coverage profile
-        id: baseline-cache
-        if: needs.lint.outputs.full_suite == 'true'
-        uses: actions/cache/restore@v4
-        with:
-          path: coverage-cache.txt
-          key: dws-coverage-full-v2-${{ env.COVERAGE_BASE_REF }}-go${{ steps.setup-go.outputs.go-version }}
-
-      - name: Materialize cached merge-base coverage profile
-        if: needs.lint.outputs.full_suite == 'true' && steps.baseline-cache.outputs.cache-hit == 'true'
-        run: |
-          set -eu
-          test -s coverage-cache.txt
-          test "$(head -n 1 coverage-cache.txt)" = "mode: atomic"
-          cp coverage-cache.txt coverage-base.txt
-
-      - name: Install archive tooling
-        if: needs.lint.outputs.full_suite == 'true' && steps.baseline-cache.outputs.cache-hit != 'true'
-        run: sudo apt-get update && sudo apt-get install -y zip unzip
-
       - name: Run baseline unit tests with coverage
-        if: steps.baseline-cache.outputs.cache-hit != 'true'
         shell: bash
         env:
           DWS_PACKAGE_VERSION: 0.0.0-test
@@ -1197,21 +1045,6 @@ jobs:
             fi
           )
 
-      - name: Prepare merge-base coverage profile cache
-        if: needs.lint.outputs.full_suite == 'true' && steps.baseline-cache.outputs.cache-hit != 'true'
-        run: |
-          set -eu
-          test -s coverage-base.txt
-          test "$(head -n 1 coverage-base.txt)" = "mode: atomic"
-          cp coverage-base.txt coverage-cache.txt
-
-      - name: Save merge-base coverage profile cache
-        if: needs.lint.outputs.full_suite == 'true' && steps.baseline-cache.outputs.cache-hit != 'true'
-        uses: actions/cache/save@v4
-        with:
-          path: coverage-cache.txt
-          key: dws-coverage-full-v2-${{ env.COVERAGE_BASE_REF }}-go${{ steps.setup-go.outputs.go-version }}
-
       - name: Upload baseline coverage profile
         uses: actions/upload-artifact@v4
         with:
@@ -1224,7 +1057,6 @@ jobs:
     needs:
       - lint
       - coverage-current
-      - coverage-current-full
       - coverage-supporting
       - coverage-baseline
       - coverage-darwin
@@ -1240,7 +1072,6 @@ jobs:
           FULL_SUITE: ${{ needs.lint.outputs.full_suite }}
           PLATFORM_SENSITIVE: ${{ needs.lint.outputs.platform_sensitive }}
           CURRENT_RESULT: ${{ needs.coverage-current.result }}
-          CURRENT_FULL_RESULT: ${{ needs.coverage-current-full.result }}
           SUPPORTING_RESULT: ${{ needs.coverage-supporting.result }}
           BASELINE_RESULT: ${{ needs.coverage-baseline.result }}
           DARWIN_RESULT: ${{ needs.coverage-darwin.result }}
@@ -1248,7 +1079,6 @@ jobs:
         run: |
           failed=0
           current_expected=success
-          current_full_expected=skipped
           supporting_expected=skipped
           baseline_expected=success
           native_expected=skipped
@@ -1256,8 +1086,6 @@ jobs:
             current_expected=skipped
             baseline_expected=skipped
           elif [ "$FULL_SUITE" = true ]; then
-            current_expected=skipped
-            current_full_expected=success
             supporting_expected=success
           fi
           if [ "$CHANGELOG_ONLY" != true ] &&
@@ -1268,7 +1096,6 @@ jobs:
 
           for profile in \
             "current:$CURRENT_RESULT:$current_expected" \
-            "current shards:$CURRENT_FULL_RESULT:$current_full_expected" \
             "supporting:$SUPPORTING_RESULT:$supporting_expected" \
             "baseline:$BASELINE_RESULT:$baseline_expected"
           do
@@ -1304,7 +1131,6 @@ jobs:
           ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
 
       - name: Set up Go
-        id: setup-go
         if: needs.lint.outputs.changelog_only != 'true' && needs.lint.outputs.docs_only != 'true'
         uses: actions/setup-go@v5
         with:
@@ -1328,12 +1154,11 @@ jobs:
           git rev-parse --verify "${base_ref}^{commit}" >/dev/null
           echo "COVERAGE_BASE_REF=$base_ref" >> "$GITHUB_ENV"
 
-      - name: Download current coverage profiles
+      - name: Download current coverage profile
         if: needs.lint.outputs.changelog_only != 'true' && needs.lint.outputs.docs_only != 'true'
         uses: actions/download-artifact@v4
         with:
-          pattern: coverage-current-*
-          merge-multiple: true
+          name: coverage-current-profile
           path: .
 
       - name: Download supporting coverage profiles
@@ -1350,26 +1175,6 @@ jobs:
           name: coverage-baseline-profile
           path: .
 
-      # Shard profiles cover disjoint package sets, so their block-level
-      # concatenation is the same candidate profile one serial run produced.
-      # Every expected shard must be present; a missing shard would silently
-      # shrink the scope-matched overall comparison.
-      - name: Assemble full-suite coverage profile
-        if: needs.lint.outputs.changelog_only != 'true' && needs.lint.outputs.docs_only != 'true' && needs.lint.outputs.full_suite == 'true'
-        shell: bash
-        run: |
-          set -euo pipefail
-          test ! -f coverage.txt
-          for shard in app cli generators helpers remaining; do
-            profile="coverage-shard-$shard.txt"
-            test -f "$profile"
-            test "$(head -n 1 "$profile")" = "mode: atomic"
-          done
-          printf 'mode: atomic\n' > coverage.txt
-          for shard in app cli generators helpers remaining; do
-            tail -n +2 "coverage-shard-$shard.txt" >> coverage.txt
-          done
-
       - name: Enforce coverage gate
         if: needs.lint.outputs.changelog_only != 'true' && needs.lint.outputs.docs_only != 'true'
         env:
@@ -1390,26 +1195,6 @@ jobs:
           COVERAGE_ADDITIONAL_DIFF_PROFILE="$additional_profile" \
             make coverage-gate BASE_REF="$COVERAGE_BASE_REF"
 
-      # Publish this push's full-suite profile as the merge-base cache for
-      # future PRs whose merge-base is exactly this commit. Saved only after
-      # the gate passed so a broken run never becomes a baseline. Both producer
-      # and consumer use coverage-cache.txt because the cache version includes
-      # the configured path as well as the compression tool.
-      - name: Prepare push coverage profile as merge-base cache
-        if: github.event_name == 'push' && needs.lint.outputs.changelog_only != 'true' && needs.lint.outputs.docs_only != 'true' && needs.lint.outputs.full_suite == 'true'
-        run: |
-          set -eu
-          test -s coverage.txt
-          test "$(head -n 1 coverage.txt)" = "mode: atomic"
-          cp coverage.txt coverage-cache.txt
-
-      - name: Save push coverage profile as merge-base cache
-        if: github.event_name == 'push' && needs.lint.outputs.changelog_only != 'true' && needs.lint.outputs.docs_only != 'true' && needs.lint.outputs.full_suite == 'true'
-        uses: actions/cache/save@v4
-        with:
-          path: coverage-cache.txt
-          key: dws-coverage-full-v2-${{ github.sha }}-go${{ steps.setup-go.outputs.go-version }}
-
       - name: Generate coverage report
         if: needs.lint.outputs.changelog_only != 'true' && needs.lint.outputs.docs_only != 'true'
         run: |
@@ -1471,7 +1256,6 @@ jobs:
         env:
           CLASSIFIED_CHANGELOG_CHANGED: ${{ needs.lint.outputs.changelog_changed }}
           CHANGELOG_ONLY: ${{ needs.lint.outputs.changelog_only }}
-          RELEASE_SEAL_ONLY: ${{ needs.lint.outputs.release_seal_only }}
           PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
         run: |
           set -eu
@@ -1498,7 +1282,7 @@ jobs:
           fi
 
           mode=--content-only
-          if [ "$CHANGELOG_ONLY" = true ] && [ "$RELEASE_SEAL_ONLY" != true ]; then
+          if [ "$CHANGELOG_ONLY" = true ]; then
             mode=--fast-path
           fi
           ./scripts/policy/check-changelog-pr.sh \
@@ -1510,41 +1294,25 @@ jobs:
           PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
         run: ./scripts/policy/check-release-fragments.sh "$PR_BASE_SHA" HEAD
 
-      - name: Validate trusted main metadata-only push
+      - name: Validate trusted main CHANGELOG-only push
         if: github.event_name == 'push' && needs.lint.outputs.changelog_only == 'true'
         env:
           PUSH_BEFORE_SHA: ${{ github.event.before }}
           PUSH_AFTER_SHA: ${{ github.event.after }}
-          RELEASE_SEAL_ONLY: ${{ needs.lint.outputs.release_seal_only }}
         run: |
           set -eu
           test "$(git rev-parse HEAD)" = "$PUSH_AFTER_SHA" || {
             echo "checked-out push revision does not match event after SHA" >&2
             exit 1
           }
-          mode=--fast-path
-          if [ "$RELEASE_SEAL_ONLY" = true ]; then
-            mode=--content-only
-          fi
           ./scripts/policy/check-changelog-pr.sh \
-            "$mode" "$PUSH_BEFORE_SHA" "$PUSH_AFTER_SHA"
-          if [ "$RELEASE_SEAL_ONLY" = true ]; then
-            ./scripts/policy/check-release-fragments.sh \
-              "$PUSH_BEFORE_SHA" "$PUSH_AFTER_SHA"
-          fi
+            --fast-path "$PUSH_BEFORE_SHA" "$PUSH_AFTER_SHA"
 
       - name: Record CHANGELOG-only fast path
         if: needs.lint.outputs.changelog_only == 'true'
-        env:
-          RELEASE_SEAL_ONLY: ${{ needs.lint.outputs.release_seal_only }}
         run: |
-          if [ "$RELEASE_SEAL_ONLY" = true ]; then
-            echo "Only the trusted release-seal and fragment validators ran; executable sources are unchanged." \
-              >> "$GITHUB_STEP_SUMMARY"
-          else
-            echo "Only the trusted base-equivalent CHANGELOG validator ran; executable sources are unchanged." \
-              >> "$GITHUB_STEP_SUMMARY"
-          fi
+          echo "Only the trusted base-equivalent CHANGELOG validator ran; executable sources are unchanged." \
+            >> "$GITHUB_STEP_SUMMARY"
 
       - name: Validate scoped policy
         if: ${{ needs.lint.outputs.changelog_only != 'true' && (needs.lint.outputs.docs_only == 'true' || (needs.lint.outputs.full_suite != 'true' && needs.lint.outputs.interface_sensitive != 'true')) }}
@@ -1646,10 +1414,17 @@ jobs:
       - name: Check complete Schema compatibility
         if: ${{ needs.lint.outputs.changelog_only != 'true' && needs.lint.outputs.docs_only != 'true' && (needs.lint.outputs.full_suite == 'true' || needs.lint.outputs.interface_sensitive == 'true') }}
         run: |
-          make schema-compatibility \
-            BASE_REF="$COMPATIBILITY_BASE_REF" \
-            STABLE_REF="$COMPATIBILITY_STABLE_REF" \
-            CANDIDATE_REF="$COMPATIBILITY_CANDIDATE_REF"
+          set -eu
+          authority_worktree="$RUNNER_TEMP/dws-schema-authority-$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT"
+          cleanup_schema_authority() {
+            git worktree remove --force "$authority_worktree" >/dev/null 2>&1 || true
+          }
+          trap cleanup_schema_authority EXIT HUP INT TERM
+          git worktree add --detach "$authority_worktree" "$COMPATIBILITY_BASE_REF"
+          "$authority_worktree/scripts/policy/check-authoritative-schema-compatibility.sh" \
+            --base-ref "$COMPATIBILITY_BASE_REF" \
+            --stable-ref "$COMPATIBILITY_STABLE_REF" \
+            --candidate-ref "$COMPATIBILITY_CANDIDATE_REF"
 
       - name: Check skill command references
         if: ${{ needs.lint.outputs.changelog_only != 'true' && needs.lint.outputs.docs_only != 'true' && (needs.lint.outputs.full_suite == 'true' || needs.lint.outputs.interface_sensitive == 'true') }}

.github/workflows/release.yml

@@ -2645,40 +2645,6 @@ jobs:
           "$GITHUB_WORKSPACE/tmp/trusted-release-tooling/scripts/release/verify-github-tag-authority.sh" \
             "$RELEASE_VERSION" "$RELEASE_COMMIT" "$RELEASE_TAG_OBJECT"
 
-      # The sealed candidate tag is intentionally visible while its GitHub
-      # authority is checked above. Compatibility must instead discover the
-      # previous delivered stable tag, so hide only this verified candidate
-      # from this isolated runner's local tag namespace.
-      - name: Prepare delivered-stable compatibility ref view
-        if: ${{ matrix.check == 'compatibility' }}
-        env:
-          RELEASE_VERSION: ${{ needs.release-contract.outputs.release_version }}
-          RELEASE_COMMIT: ${{ needs.release-contract.outputs.release_commit }}
-          RELEASE_TAG_OBJECT: ${{ needs.release-contract.outputs.release_tag_object }}
-          PREVIOUS_STABLE: ${{ needs.release-contract.outputs.previous_stable }}
-          PREVIOUS_STABLE_COMMIT: ${{ needs.release-contract.outputs.previous_stable_commit }}
-        run: |
-          set -eu
-          test -n "$RELEASE_VERSION"
-          test -n "$RELEASE_COMMIT"
-          test -n "$RELEASE_TAG_OBJECT"
-          test -n "$PREVIOUS_STABLE"
-          test -n "$PREVIOUS_STABLE_COMMIT"
-          test "$RELEASE_VERSION" != "$PREVIOUS_STABLE"
-          test "$(git rev-parse HEAD)" = "$RELEASE_COMMIT"
-          test "$(git rev-parse --verify "refs/tags/${RELEASE_VERSION}")" = "$RELEASE_TAG_OBJECT"
-          test "$(git rev-parse --verify "refs/tags/${RELEASE_VERSION}^{commit}")" = "$RELEASE_COMMIT"
-          test "$(git rev-parse --verify "${PREVIOUS_STABLE}^{commit}")" = "$PREVIOUS_STABLE_COMMIT"
-
-          git update-ref -d "refs/tags/${RELEASE_VERSION}" "$RELEASE_TAG_OBJECT"
-
-          if git show-ref --verify --quiet "refs/tags/${RELEASE_VERSION}"; then
-            echo "sealed candidate tag is still visible to compatibility baseline discovery" >&2
-            exit 2
-          fi
-          test "$(git rev-parse HEAD)" = "$RELEASE_COMMIT"
-          test "$(git rev-parse --verify "${PREVIOUS_STABLE}^{commit}")" = "$PREVIOUS_STABLE_COMMIT"
-
       - name: Set up Go
         uses: actions/setup-go@v5
         with:

AGENTS.md

@@ -47,7 +47,7 @@ Schema contract) keep separate authorities — do not merge them with
 - Today: `helpers.LeafSpec` / `shortcut.Shortcut` → `corecmd.Spec` (+ optional `Contract`) → `corecmd.New`
 - **Declare = final Schema source**: `Flags` / `Constraints` / `Safety` / `ConstParams` / `Contract` (`corecmd.ContractDecl`; nested fields are `contract.*`)
 - Naming: `ContractDecl` is the authoring leaf declaration. "Schema" means Catalog / `ToolSpec` delivery — do not reintroduce `SchemaDecl`.
-- `Safety` uses `contract.SafetySpec` (`internal/corecmd/contract` only — no `cli.*` type alias). Its `confirmation` drives the runtime gate; `effect` / `risk` / `idempotency` are published unchanged. When `Contract` is set, convert once via `contractfinal.RegisterRuntimeContractFinal` (all callers — `corecmd.New` registers internally); assembly **pass-throughs** Final.
+- `Safety` uses `contract.SafetySpec` (`internal/corecmd/contract` only — no `cli.*` type alias). Its `confirmation` drives the runtime gate; `effect` / `risk` / `idempotency` are published unchanged. `idempotency=conditional` additionally requires `Contract.RetryPolicy`: reference a declared string parameter with an explicit interface property and require the same payload; never infer retry safety from a flag/property name. When `Contract` is set, convert once via `contractfinal.RegisterRuntimeContractFinal` (all callers — `corecmd.New` registers internally); assembly **pass-throughs** Final.
 - Package seam:
   - types / ProductDecl → `corecmd/contract` (DTO only; **no** Cobra-keyed ContractFinal store)
   - AnnotateRuntime* writers → `internal/corecmd/runtimeannotate` (framework-owned)
@@ -423,6 +423,13 @@ lower description, mapping, `effect`, `risk`, `confirmation`, or `idempotency`.
 Preserve all candidates and the selected source in provenance, and fail
 same-precedence conflicts rather than silently merging them.
 
+`conditional` is a static command classification, not an unconditional retry
+grant. It must carry a typed `retry_policy`; runtime computes effective
+idempotency from the actual invocation. A missing/empty/non-string
+deduplication key is `non_idempotent` for that invocation. Only the same key
+and same business payload may be replayed, and the transport/error
+`retryable` signal must fail closed when the invocation is not safe to replay.
+
 `required` is the exception. Cobra `MarkFlagRequired` is a hard floor: the
 final Agent projection must keep `required=true` and cannot be lowered by a
 lower-precedence source. A higher-precedence declaration may still raise an

CHANGELOG.md

@@ -6,128 +6,6 @@ The format is inspired by [Keep a Changelog](https://keepachangelog.com/) and th
 
 ## [Unreleased]
 
-## [1.0.59-beta.1] - 2026-08-14
-
-### Added
-
-- **Drive list type/time filtering** (#942) — `dws drive list` gains `--type
-  file|folder`, `--start`, and `--end` for client-side filtering by node type
-  and modification time on both the pan and workspace routes. Filtering runs
-  a bounded full scan of the target directory (2000-entry cap, reported via
-  `truncated=true`), composes with `--latest`/`--pattern`/`--depth`, and is
-  mutually exclusive with `--versions`/`--cursor`/`--order-by`/`--order`/
-  `--limit`. Time values accept relative forms (`24h`/`7d`/`2w`), RFC 3339,
-  zone-less ISO 8601 (Asia/Shanghai), or a plain date.
-
-- **Drive folder synchronization** — adds `dws drive status`, `dws drive pull`,
-  `dws drive push`, and `dws drive sync` for file-level comparison and transfer
-  between a local folder and a Drive folder. Differences come from exact MD5 by
-  default or from modification time with `--quick`; `status` is read-only, `pull`
-  and `push` are one-directional with `--if-exists skip|smart|overwrite`, and
-  `sync` is bidirectional with `--on-conflict remote-wins|local-wins|keep-both|ask`.
-  Only regular files are transferred — online documents and shortcuts are skipped,
-  neither side deletes extra files, downloads are staged through a temporary file
-  and committed with an atomic rename, and remote names that would escape
-  `--local-folder` are reported as failures instead of being written. Every command
-  prints a structured summary on stdout and exits non-zero when any item fails.
-
-- **International DingTalk region support** — adds `.io` login and MCP routing, pre-release endpoint overrides, and profile-aware gateway selection while preserving the existing `.com` flow.
-
-### Changed
-
-- **Chat identity routing** — validates explicit `openDingTalkId` inputs and improves name, `userId`, and `openDingTalkId` routing for message shortcuts.
-
-### Fixed
-
-- **Drive `--latest` refuses incomplete Top-N** (#899) — `dws drive list --latest` used to
-  exit 0 with a "Top-N" computed over a partially scanned tree whenever a directory read
-  failed mid-recursion (permission denied, API error), letting an incomplete set pose as the
-  globally newest files. Truncation at the 2000-item scan cap and mid-recursion directory
-  failures now both fail closed (`LATEST_SCAN_TRUNCATED` / `LATEST_SCAN_INCOMPLETE`), report
-  the first failing folder with its depth and reason, and emit a recovery command that
-  reproduces the original candidate set — query domain, `--folder`, `--pattern`, `--type`,
-  `--start` and `--end` are all carried over. On POSIX shells each user-supplied value is
-  quoted so a URL query string or a shell metacharacter cannot change how the copied command
-  parses. On Windows no quoting form is safe for both `cmd.exe` and PowerShell, so values
-  containing metacharacters are not inlined at all: the command carries a placeholder and the
-  original value is shown on a separate line marked as data rather than an executable command.
-  Unrecoverable errors under `--latest` return the root cause instead of a partial result.
-  Remote-controlled folder names and server error text are stripped of ANSI escapes and
-  control characters before they reach the plain-text stderr message. The internal `sortTime`
-  sort key no longer leaks into `drive list --depth` output on any path.
-
-- **Drive list pattern filtering** (#942) — `dws drive list --pattern` on the
-  single-layer pan route now filters the returned page by name pattern; the
-  flag was previously accepted but silently ignored.
-
-- **Drive list `--type folder --latest` composition** (#942) — `--latest` now
-  ranks the filtered entries (folders included when `--type folder` is set)
-  instead of unconditionally dropping folders, so the documented combination
-  returns the most recently modified folders rather than an empty list.
-
-- **Chat message time defaults** (#973) — default omitted `chat message list-all` time bounds in `Asia/Shanghai` when emitting timezone-less `yyyy-MM-dd HH:mm:ss` values, matching parsing semantics and rejecting reversed windows.
-
-- **Doc and Drive parameter aliases** — normalizes reviewed identifier, pagination, path, version, and role synonyms while blocking ambiguous values before dispatch.
-
-
-## [1.0.58] - 2026-08-13
-
-This release promotes the sealed `v1.0.58-beta.6` contents to stable.
-
-### Changed
-
-- **Expanded collaborative workflows** — adds full AI Table, Sheet, Minutes,
-  approval-event, Drive-comment, document export, and CSV workflow support,
-  including safer validation, explicit confirmation for writes, and
-  machine-readable completion receipts.
-- **More capable Chat operations** — adds robot image/file messages, toolbar
-  management, streaming-card mentions, automatic pagination controls, and
-  clearer post-send ID, Markdown-image, paging, and result-shape guidance.
-- **Reliable Agent and CLI contracts** — expands Agent-visible Chat and
-  Minutes commands, aligns bundled skills, improves schema/result envelopes,
-  and hardens parameter, pagination, runtime-token, and write-result
-  verification so ambiguous or incomplete operations fail closed.
-- **Multi-skill install and upgrade** — makes the multi-skill layout the
-  default for fresh installs and upgrades while preserving an explicit legacy
-  mono option.
-- **Safer release delivery** — strengthens release-equivalent compatibility,
-  sealing, package verification, and evaluation-dispatch checks for more
-  reliable cross-platform releases.
-
-## [1.0.58-beta.6] - 2026-08-13
-
-### Fixed
-
-- **npm package verification for multi-skill installs** (#991) — aligns the
-  release verifier with the installer’s concrete Agent skill-root selection,
-  preventing valid multi-skill package layouts from failing release delivery.
-
-### Changed
-
-- **Release-seal CI classification** (#987) — recognizes the reviewed
-  CHANGELOG-and-fragment archival shape while retaining release-contract and
-  lifecycle validation, reducing unrelated CI work for release-seal PRs.
-
-## [1.0.58-beta.5] - 2026-08-13
-
-### Added
-
-- **Agent version and extended context passthrough** (Aone 85384225) — adds
-  validated `DWS_AGENT_VER` and sensitive JSON `DWS_AGENT_EXT` metadata to
-  ordinary non-plugin MCP requests without forwarding it to A2A, OAuth,
-  Discovery, or third-party plugins.
-
-- **Drive file comments** (#961) — adds `dws drive comment list` and `dws drive comment create` for comments on ordinary preview files.
-
-- **Chat automatic pagination controls** (#970) — adds bounded `--max-items` and cancellable `--page-delay` support to the core IM list shortcuts, with safe continuation metadata and truncation reporting.
-
-### Changed
-
-- **Chat message send help** - Clarifies Markdown image syntax for inline mixed text and images.
-
-- **Doc/drive/wiki routing descriptions** — clarifies the document-space container-vs-content boundary across the doc, drive, and wiki skill descriptions for more predictable first-round Agent selection, without changing CLI behavior.
-
-
 ## [1.0.58-beta.4] - 2026-08-12
 
 ### Added

Formula/dingtalk-workspace-cli-beta.rb

@@ -1,33 +1,33 @@
 class DingtalkWorkspaceCliBeta < Formula
   desc "Automate DingTalk workspace tasks from the terminal (beta channel)"
   homepage "https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli"
-  version "1.0.59-beta.1"
+  version "1.0.58-beta.4"
   license "Apache-2.0"
   keg_only "it is the beta channel and conflicts with dingtalk-workspace-cli"
 
   on_macos do
     if Hardware::CPU.arm?
-      url "https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli/releases/download/v1.0.59-beta.1/dws-darwin-arm64.tar.gz"
-      sha256 "36a30f3496e0f759c15c0b09f67dbd23b8ecdfff2eebe572f88125b26485830f"
+      url "https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli/releases/download/v1.0.58-beta.4/dws-darwin-arm64.tar.gz"
+      sha256 "5c2ac92e35b1f1dba80234af8b0c9505b2883f4a37c1e73892b8a1c3087b7702"
     else
-      url "https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli/releases/download/v1.0.59-beta.1/dws-darwin-amd64.tar.gz"
-      sha256 "e7a04906380efd8da88cd112e6a512bb6470a3956dc370150037ed6e314db445"
+      url "https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli/releases/download/v1.0.58-beta.4/dws-darwin-amd64.tar.gz"
+      sha256 "93ef787770105fe1f0d27585adcac7b740aa6c37ff490275c4113814541ae095"
     end
   end
 
   on_linux do
     if Hardware::CPU.arm?
-      url "https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli/releases/download/v1.0.59-beta.1/dws-linux-arm64.tar.gz"
-      sha256 "f59ab055f3e841e4cebc964ae3ef969668475548abaaf8bede44afdca9a3e28d"
+      url "https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli/releases/download/v1.0.58-beta.4/dws-linux-arm64.tar.gz"
+      sha256 "011ce16a73d8fd24275e34c3122d3d0832c60cde2480f496018eb654059b5c05"
     else
-      url "https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli/releases/download/v1.0.59-beta.1/dws-linux-amd64.tar.gz"
-      sha256 "2c8f919489d958c7d49262615e81faac70a9fbcae2d589ab54a0bb3c5700a057"
+      url "https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli/releases/download/v1.0.58-beta.4/dws-linux-amd64.tar.gz"
+      sha256 "847b17ff8a8d80dce38f0013eb35c77c102be16c9f98b955a632b983cd5ec104"
     end
   end
 
   resource "skills" do
-    url "https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli/releases/download/v1.0.59-beta.1/dws-skills.zip"
-    sha256 "25f4a7e1d01fa4d771d79201b34b11ee8a24182bdcdc94bfb98d2bd5845bed3b"
+    url "https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli/releases/download/v1.0.58-beta.4/dws-skills.zip"
+    sha256 "f5e0c72cc92cb7e8886409319cf68bbbfc7740e969bd39a389b74af4befdbc66"
   end
 
   def install

Formula/dingtalk-workspace-cli.rb

@@ -1,33 +1,33 @@
 class DingtalkWorkspaceCli < Formula
   desc "Automate DingTalk workspace tasks from the terminal"
   homepage "https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli"
-  version "1.0.58"
+  version "1.0.57"
   license "Apache-2.0"
 
 
   on_macos do
     if Hardware::CPU.arm?
-      url "https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli/releases/download/v1.0.58/dws-darwin-arm64.tar.gz"
-      sha256 "7d98599f90cae9d42b51ff2863efc87dbfb4a3176ff3c84fc2216110c0157a70"
+      url "https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli/releases/download/v1.0.57/dws-darwin-arm64.tar.gz"
+      sha256 "c01c28dc13948a70fca905207073dc8dbd22f7ba7fc90e68b3316eb9a9c98e88"
     else
-      url "https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli/releases/download/v1.0.58/dws-darwin-amd64.tar.gz"
-      sha256 "4c12e35e5bf7e0905812cd42dc94a5345068a2c16e306bb50b13c5c78b5cb95d"
+      url "https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli/releases/download/v1.0.57/dws-darwin-amd64.tar.gz"
+      sha256 "d7baa218beefc851c6a933b456055195f8272984ce008d7e0122bdfc5dad94ea"
     end
   end
 
   on_linux do
     if Hardware::CPU.arm?
-      url "https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli/releases/download/v1.0.58/dws-linux-arm64.tar.gz"
-      sha256 "5ef6bde24bc3db6a11a0f1d0b3343a048956b2cbcf6cd3409a037fb6ba425489"
+      url "https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli/releases/download/v1.0.57/dws-linux-arm64.tar.gz"
+      sha256 "0bbe9c233a3ff585077bae1ac5000937c32d967846d14cc44c46f98d49b95ae2"
     else
-      url "https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli/releases/download/v1.0.58/dws-linux-amd64.tar.gz"
-      sha256 "3ccadcc6f070a39d2b2ba20429a4fcdc2f21639bf79f34361dc7d16f501bfda6"
+      url "https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli/releases/download/v1.0.57/dws-linux-amd64.tar.gz"
+      sha256 "f113ce3654f21d1f9ecc7c196f815aeafbca54d377a347b244a15116c5cba698"
     end
   end
 
   resource "skills" do
-    url "https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli/releases/download/v1.0.58/dws-skills.zip"
-    sha256 "2626debc21c3daadfd155b4c167b2219b97e801398fe4441a8b48138960ab264"
+    url "https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli/releases/download/v1.0.57/dws-skills.zip"
+    sha256 "0c9667209cf30761427a8f9348149cbbf1e397aa3c25587e99f205bc7525e101"
   end
 
   def install

Makefile

@@ -18,7 +18,7 @@ help:
 	@printf "Available targets:\n"
 	@printf "  make build         - Build the dws CLI binary\n"
 	@printf "  make test          - Run the Go test suite\n"
-	@printf "  make test-plan     - Verify CI test and full-suite coverage package plans cover their scopes exactly once\n"
+	@printf "  make test-plan     - Verify every default Go package belongs to one CI test shard\n"
 	@printf "  make test-auth-legacy-compat - Run stable legacy authentication compatibility regressions\n"
 	@printf "  make lint          - Run formatting checks, go vet, and staticcheck\n"
 	@printf "  make format-check  - Check all repository Go source files with gofmt\n"

README.md

@@ -786,7 +786,6 @@ See [`docs/robot-quickstart.md`](./docs/robot-quickstart.md) for the full 4-step
 
 ## Reference & Docs
 
-- [International DingTalk (`.io`) guide](./docs/international-region-guide.md) — international login, domestic/international profile switching, isolated testing, and troubleshooting
 - [Command Index](./docs/command-index.md) — every runtime command with description and when-to-use guidance
 - [Reference](./docs/reference.md) — environment variables, exit codes, output formats, shell completion
 - [Architecture](./docs/architecture.md) — static endpoint pipeline, command surface, transport layer

README_zh.md

@@ -777,7 +777,6 @@ dws dev connect --channel auto --robot-client-id <id> --robot-client-secret <sec
 
 ## 参考与文档
 
-- [国际版（`.io`）使用手册](./docs/international-region-guide.zh-CN.md) — 国际版登录、国内/国际 profile 切换、隔离验证与排障
 - [命令索引](./docs/command-index.md) — 全部运行时命令，带描述与使用场景
 - [参考手册](./docs/reference.md) — 环境变量、退出码、输出格式、Shell 补全
 - [架构设计](./docs/architecture.md) — 静态端点管道、命令面、Transport 层

docs/ci-pr-gates.md

@@ -201,21 +201,8 @@ base_ref=$(git merge-base HEAD origin/main)
 standard PR, CI derives changed packages and their reverse-dependency test
 closure, then generates candidate and merge-base profiles with the same test
 scope and `coverpkg`. High-risk and protected-main runs use the complete
-profiles. The complete candidate profile is produced by disjoint per-shard
-helper jobs (`scripts/ci/test-packages.sh list-coverage`, kept serial with
-`-p 1` inside each shard; `verify` proves the shard union equals the
-full-suite scope exactly once) and concatenated in the aggregate job before
-enforcement. The complete merge-base profile is restored from an exact-key
-cache written by the last green `main` push of that same commit (key:
-merge-base SHA plus resolved Go version); any miss falls back to recomputing
-it in a merge-base worktree. The trusted `main` producer and PR consumer use
-the same dedicated cache profile path because GitHub includes that path in the
-cache version; the runtime-facing candidate and baseline filenames remain
-separate. Near-miss reuse is forbidden — the caches carry no prefix restore
-keys, because a neighbouring commit's profile would compare the candidate
-against the wrong baseline. Supporting and (when
-platform-selected) native profiles are generated before the aggregate
-`Coverage` context evaluates them. The
+profiles. Supporting and (when platform-selected) native profiles are
+generated before the aggregate `Coverage` context evaluates them. The
 aggregate and native gates require 100% coverage for changed executable Go
 statements. Overall coverage remains an unrounded, zero-tolerance,
 scope-matched merge-base non-regression check. Candidate and baseline profiles
@@ -242,6 +229,52 @@ tool、parameter、mapping、positional execution、constraint 与 safety 语义
 等价证明；产品 PR 仍须证明 canonical 与 legacy 的最终运行 payload 等价并在 transport
 前拒绝冲突输入。当前迁移清单为空，不授权 PR #904。
 
+## 条件幂等与重试策略迁移
+
+静态 `idempotency` 描述命令级分类；当它是 `conditional` 时，再由实际调用参数计算
+本次调用的 effective idempotency。不能因为命令“存在一个可选 `--uuid` flag”就把
+整个命令从 `unknown` 改成无条件 `idempotent`。Schema 增加 `conditional` 状态以及
+与它配套的 `retry_policy`：
+
+```json
+{
+  "idempotency": "conditional",
+  "retry_policy": {
+    "mode": "deduplication_key",
+    "key_parameter": "uuid",
+    "same_payload_required": true
+  }
+}
+```
+
+只有调用实际提供 `uuid`，并且框架重用同一个 key 和同一份请求 payload 时，调用级
+有效幂等性才是 `idempotent`；未提供时仍是 `non_idempotent`。本契约没有发布后端
+未证明的去重时间窗。`conditional` 仅允许用于单 RPC 的 `mcp` leaf，key 必须对应
+一个存在且有非空 interface property 的真实参数。其余三种静态状态不得携带
+`retry_policy`。
+
+兼容迁移分三步治理：
+
+1. 独立治理 PR 在 Schema surface 不变时先加入契约、校验器和精确登记。本轮只登记
+   57 个 Chat 写命令：5 个 `unknown -> conditional`，52 个
+   `unknown -> non_idempotent`。
+2. 后续业务 PR 只消费这些已登记转换。5 个条件幂等命令必须逐字发布上面的策略；
+   PR #965 原先的 `unknown -> idempotent` 仍会失败。未登记工具、反向迁移、策略漂移
+   以及同一 PR 夹带的其它历史契约变化也仍会失败。
+3. 当 `main` 与当前 stable baseline 都已经覆盖迁移后，再由独立治理 PR 删除失效的
+   静态登记，避免把一次迁移审批永久留在规则中。
+
+Interface Integrity job 的兼容性 step 在 PR merge-base 建立独立 authority worktree，
+并从该 worktree 启动权威 wrapper；它不经过 candidate checkout 中的
+Makefile 或 wrapper。权威 wrapper 再从 merge-base 构建 `schema-compat` checker，
+分别比较 merge-base 和 stable。因此，在该 step 实际执行时，业务 candidate
+修改 candidate checkout 中的 Makefile、wrapper、checker 或登记表都不能给
+自己授权；只有先合入主干、经过独立评审的登记会被后续 PR 使用。
+
+CLI 评测和 Agent 消费方应把 `conditional` 与 `retry_policy` 作为一个整体读取：静态
+`conditional` 不是扣分意义上的“不知道”，也不是无条件可重试；评测应根据
+`key_parameter` 是否出现在实际调用中计算本次调用的有效幂等性。
+
 ## Required GitHub repository settings
 
 The `main` quality ruleset must enable strict required-status-check policy

docs/flag-help-schema-homology.md

@@ -81,6 +81,7 @@ command/Leaf 不再写 `dws.schema.risk`；SafetySpec 走类型化 Final 载荷
 | `Flags[]`（`FlagSpec` / `LeafFlag`） | 用户可见参数面：名、类型、默认、必填、usage | 注册 cobra flag；装配 toolArgs | `dws.schema.property` / `type` / `required`；`--help` Flags |
 | `Constraints[]` | 跨 flag 关系：`at_least_one` / `exactly_one` / `mutually_exclusive`；`custom` 记录钩子校验 | 通用关系由 `ValidateConstraints` 执行；`custom` 由 `Validate` 执行 | `dws.schema.constraints`；`--help`「参数约束」 |
 | `Safety`（`contract.SafetySpec`） | effect/risk/confirmation/idempotency 四个独立事实 | `confirmation=user_required` 时 `ConfirmSafety`；`--yes` / `--dry-run` 跳过 | 同一个 SafetySpec 原样进入 Contract Final（`HOM-S1`） |
+| `Contract.RetryPolicy` | `idempotency=conditional` 时的调用级重试条件；当前仅支持显式去重 key | 结合实际参数计算 effective idempotency；缺 key 时禁止自动重试 | 与 `conditional` 成组进入 full/compact leaf 和 `ResolveMeta`；禁止按 flag 名推断 |
 | `ConstParams` | 固定载荷（不上 flag 表） | 并入 toolArgs；不满足 Required | **不**投影为用户 parameter |
 | `Use` / `Short` / `Long` / `Example` | 命令身份文案与示例 | cobra 自身 | help；identity 以 collector 收集的 `ContractFinal.Identity` 声明为准（reviewed registry 已退役） |
 
@@ -170,6 +171,7 @@ NewLeafCommand(LeafSpec{
 | Constraints | **声明** | `Constraints` |
 | Positionals | **声明** 或显式 annotate | 目标 `Args`；禁止推断 |
 | Safety.`effect/risk/confirmation/idempotency` | **声明**完整 `Safety`，或迁移期 `runtime_gate` / reviewed Safety | 四字段独立；不得互相推导 |
+| RetryPolicy | **声明**（仅 `idempotency=conditional`） | `ContractDecl.RetryPolicy`；key 必须引用显式映射到 RPC property 的 string `ParamDecl`，并要求相同 payload |
 | DryRun | 评审源 | dry-run capabilities registry |
 | Interface | 评审源 | MCP + 内存 inject 的 Agent metadata |
 | Selection | 声明（ContractFinal / ProductDecl） | `ContractDecl.Selection` / `ProductDecl` |

docs/international-region-guide.md

@@ -1,154 +0,0 @@
-# International DingTalk (`.io`) Guide
-
-This guide explains how to log in to the international DingTalk region and run DWS commands against `*.dingtalk.io` services.
-
-## Region behavior
-
-- `dws auth login --intl` creates or refreshes an international login using the `.io` login, OAuth, and MCP services.
-- Omitting `--intl` keeps the existing domestic `.com` behavior.
-- `--intl` is a login option, not a global option for business commands. After login, commands such as `contact`, `calendar`, and `doc` derive the region from the selected Token/profile.
-- Each new Token records its login region. Switching profiles therefore switches the official DingTalk gateway region automatically.
-- `--international` is a compatibility alias. Prefer `--intl` in new scripts.
-
-For the complete Chinese guide, see [DWS 国际版（DingTalk `.io`）使用手册](./international-region-guide.zh-CN.md).
-
-## Check availability
-
-```bash
-dws auth login --help
-```
-
-The help output must include `--intl` and `--international`.
-
-When validating a source checkout, build it first and use `./dws` so an older binary on `PATH` is not invoked accidentally:
-
-```bash
-make build
-./dws auth login --help
-```
-
-## Log in
-
-Browser login:
-
-```bash
-dws auth login --intl
-```
-
-Device flow for SSH, containers, and headless environments:
-
-```bash
-dws auth login --intl --device
-```
-
-User OAuth with custom application credentials:
-
-```bash
-dws auth login --intl \
-  --client-id <APP_KEY> \
-  --client-secret <APP_SECRET>
-```
-
-This mode still requires the user to complete OAuth authorization in a browser; it is not a userless `client_credentials` login. The application must be configured on the international developer platform with the required callback and permissions. Never commit an AppSecret to source control or include it in logs.
-
-## Verify the login
-
-```bash
-dws auth status --format json
-dws profile list --format json
-dws contact user get-self
-```
-
-The last command is a read-only smoke check. If the organization has not enabled CLI access, an organization administrator must enable it or approve the access request on the international developer platform.
-
-## Use domestic and international profiles together
-
-```bash
-# Domestic (.com)
-dws auth login
-
-# International (.io)
-dws auth login --intl
-
-# Find the stable profile selectors
-dws profile list --format json
-```
-
-Persistently switch profiles:
-
-```bash
-dws profile switch <corpId>:<userId>
-```
-
-Toggle back to the previous profile:
-
-```bash
-dws profile switch -
-```
-
-Select a profile for one command without changing the default:
-
-```bash
-dws --profile <corpId>:<userId> contact user get-self
-```
-
-Do not add `--intl` to business commands. DWS routes official endpoints from the selected profile's Token region.
-
-## Isolated smoke testing
-
-Use a separate configuration directory to avoid changing the normal `~/.dws` login state:
-
-```bash
-DWS_CONFIG_DIR=/tmp/dws-intl-smoke ./dws auth login --intl
-DWS_CONFIG_DIR=/tmp/dws-intl-smoke ./dws auth status --format json
-DWS_CONFIG_DIR=/tmp/dws-intl-smoke ./dws contact user get-self
-```
-
-Use the same `DWS_CONFIG_DIR` for every command. Use `./dws` for a source build and `dws` for an installed release.
-
-## Pre-release overrides (maintainers only)
-
-Normal international users need only `--intl`; they should not set `--pre-url` or `--mcp-url`.
-
-Maintainers can test the pre-release login/MCP pair with:
-
-```bash
-dws auth login --intl --pre-url https://pre-login.dingtalk.io
-```
-
-A corresponding `pre-mcp.*` URL is also accepted, and DWS derives the paired `pre-login.*` / `pre-mcp.*` bases. `--mcp-url` explicitly overrides the MCP base URL for that login.
-
-Pre-release services may require internal network access or allowlisted accounts. `--pre-url` is intended primarily for the MCP-managed credential flow. Do not combine it with direct custom `--client-id/--client-secret` mode unless the pre-release API contract explicitly supports that combination.
-
-## Troubleshooting
-
-### The browser still opens a `.com` page
-
-1. Run `dws auth login --help` and confirm `--intl` is present.
-2. For a source checkout, use `./dws` instead of an older installed binary.
-3. Confirm the executed command is `dws auth login --intl`.
-
-### A business command appears to use the wrong region
-
-Run `dws profile list --format json`, then switch with the exact `<corpId>:<userId>` selector or use the global `--profile` option. For a legacy Token created before region metadata existed, reauthorize it with `dws auth login --intl` for an international account or `dws auth login` for a domestic account.
-
-### Login succeeds but the command reports missing permission
-
-This normally means the organization has not enabled CLI access or the application lacks a required permission. It does not by itself indicate a region-routing failure.
-
-### Should I edit `~/.dws/mcp_url` manually?
-
-No. Normal users should establish the login with `dws auth login` or `dws auth login --intl`. DWS then routes official endpoints from the selected Token/profile. Manual configuration is reserved for maintainers who explicitly control the target environment.
-
-## Command reference
-
-| Scenario | Command |
-|---|---|
-| Domestic browser login | `dws auth login` |
-| International browser login | `dws auth login --intl` |
-| International device login | `dws auth login --intl --device` |
-| Check auth state | `dws auth status --format json` |
-| List profiles | `dws profile list --format json` |
-| Persistently switch profile | `dws profile switch <corpId>:<userId>` |
-| Toggle to previous profile | `dws profile switch -` |
-| Select a profile once | `dws --profile <corpId>:<userId> <command>` |

docs/international-region-guide.zh-CN.md

@@ -1,185 +0,0 @@
-# DWS 国际版（DingTalk `.io`）使用手册
-
-本手册适用于使用钉钉国际版账号登录并调用国际站服务的用户。
-
-## 核心规则
-
-- `dws auth login --intl` 创建或刷新国际版登录，使用 `*.dingtalk.io` 登录、鉴权和 MCP 服务。
-- 不传 `--intl` 时仍使用国内钉钉 `*.dingtalk.com`，原有链路保持不变。
-- `--intl` 只用于登录命令。登录完成后，`contact`、`calendar`、`doc` 等业务命令不需要再传该参数。
-- 每个 Token 会记录登录区域。执行业务命令时，DWS 根据当前或 `--profile` 指定的账号自动选择 `.com` 或 `.io` 网关。
-- `--international` 是 `--intl` 的兼容别名；新脚本推荐使用较短的 `--intl`。
-
-## 确认当前版本支持国际版
-
-运行：
-
-```bash
-dws auth login --help
-```
-
-帮助中应包含：
-
-```text
---intl
---international
-```
-
-从源码分支验证时，先在仓库根目录构建，并始终使用本次构建的 `./dws`，避免误用系统中已安装的旧版本：
-
-```bash
-make build
-./dws auth login --help
-```
-
-## 国际版登录
-
-### 浏览器登录
-
-```bash
-dws auth login --intl
-```
-
-DWS 会打开国际版登录页面。完成扫码或账号授权后，登录结果会保存为本机 profile。
-
-### 设备码登录
-
-适用于 SSH、容器或没有可用浏览器的环境：
-
-```bash
-dws auth login --intl --device
-```
-
-按照终端提示，在另一台可打开浏览器的设备上完成授权。
-
-### 使用自有应用凭证完成用户 OAuth
-
-```bash
-dws auth login --intl \
-  --client-id <APP_KEY> \
-  --client-secret <APP_SECRET>
-```
-
-该模式仍然需要用户在浏览器中完成 OAuth 授权，不是无用户授权的 `client_credentials` 登录。应用必须在国际版开放平台正确配置回调地址和所需权限。不要在命令历史、日志或 PR 中提交真实的 AppSecret。
-
-## 验证登录和业务调用
-
-查看当前登录状态：
-
-```bash
-dws auth status --format json
-```
-
-列出本机全部账号并找到当前 profile：
-
-```bash
-dws profile list --format json
-```
-
-执行一个只读命令验证国际链路，例如：
-
-```bash
-dws contact user get-self
-```
-
-登录状态正常但业务命令提示组织未开通 CLI 时，需要由国际版组织管理员在国际版开发者平台开启 CLI 访问或完成授权审批。
-
-## 国内版和国际版账号并存
-
-可以在同一台机器上分别登录国内版和国际版账号：
-
-```bash
-# 国内版（.com）
-dws auth login
-
-# 国际版（.io）
-dws auth login --intl
-
-# 查看稳定的 profile 选择器
-dws profile list --format json
-```
-
-持久切换账号：
-
-```bash
-dws profile switch <corpId>:<userId>
-```
-
-切回上一个账号：
-
-```bash
-dws profile switch -
-```
-
-只为单次命令指定账号，不修改默认账号：
-
-```bash
-dws --profile <corpId>:<userId> contact user get-self
-```
-
-DWS 会按照选中 profile 的 Token 区域自动选择 `.com` 或 `.io`，不需要在业务命令上追加 `--intl`。
-
-## 使用独立配置目录进行验证
-
-如果不希望测试登录影响日常使用的 `~/.dws`，可以指定独立配置目录：
-
-```bash
-DWS_CONFIG_DIR=/tmp/dws-intl-smoke ./dws auth login --intl
-DWS_CONFIG_DIR=/tmp/dws-intl-smoke ./dws auth status --format json
-DWS_CONFIG_DIR=/tmp/dws-intl-smoke ./dws contact user get-self
-```
-
-请在三条命令中使用同一个 `DWS_CONFIG_DIR`。验证源码分支时使用 `./dws`；验证已安装版本时可改为 `dws`。
-
-## 预发参数（仅维护者）
-
-普通国际版用户只需要 `--intl`，不要配置 `--pre-url` 或 `--mcp-url`。
-
-维护者验证预发登录/MCP 链路时可以使用：
-
-```bash
-dws auth login --intl --pre-url https://pre-login.dingtalk.io
-```
-
-也可以传入对应的 `pre-mcp.*` 地址；DWS 会推导配套的 `pre-login.*` / `pre-mcp.*` 地址。`--mcp-url` 用于显式覆盖本次登录的 MCP base URL。
-
-预发环境可能只对内网或特定测试账号开放。`--pre-url` 主要服务于 MCP 托管凭证登录流程；除非预发 API 契约已经明确支持，否则不要把它与自有 `--client-id/--client-secret` 直连模式组合使用。
-
-## 常见问题
-
-### 仍然打开 `.com` 登录页面
-
-1. 运行 `dws auth login --help`，确认当前二进制包含 `--intl`。
-2. 从源码验证时使用 `./dws`，不要误用 PATH 中的旧版本。
-3. 确认实际执行的是 `dws auth login --intl`，而不是普通 `dws auth login`。
-
-### 业务命令似乎使用了错误区域
-
-先检查当前账号：
-
-```bash
-dws profile list --format json
-```
-
-然后使用精确的 `<corpId>:<userId>` 切换或通过全局 `--profile` 单次指定。对于在区域字段引入前生成的历史 Token，建议使用正确的登录方式重新授权：国际账号执行 `dws auth login --intl`，国内账号执行 `dws auth login`。
-
-### 登录成功但提示没有权限
-
-这通常是组织 CLI 准入或应用授权问题，不代表区域路由失败。请确认目标组织已开启 CLI 访问，并且当前应用拥有命令所需权限。
-
-### 是否需要手工修改 `~/.dws/mcp_url`
-
-不需要。正常使用应通过 `dws auth login` 或 `dws auth login --intl` 建立登录态；业务命令会根据选中的 Token/profile 自动路由。手工修改配置只适用于明确了解目标环境的维护者调试场景。
-
-## 命令速查
-
-| 场景 | 命令 |
-|---|---|
-| 国内版浏览器登录 | `dws auth login` |
-| 国际版浏览器登录 | `dws auth login --intl` |
-| 国际版设备码登录 | `dws auth login --intl --device` |
-| 查看登录状态 | `dws auth status --format json` |
-| 查看所有账号 | `dws profile list --format json` |
-| 持久切换账号 | `dws profile switch <corpId>:<userId>` |
-| 切回上一个账号 | `dws profile switch -` |
-| 单次指定账号 | `dws --profile <corpId>:<userId> <command>` |

docs/rfc-command-framework-convergence.md

@@ -357,7 +357,7 @@ Definition（仅声明；不可编译）
 | **Constraints** | `require_one_of`, `mutually_exclusive`, `require_together` | **声明** | `Constraints` → `AnnotateConstraints` | **是** |
 | **Positionals** | 位置参数名/必填/说明 | **声明** 或显式 annotate | 目标 `Args`/`PositionalSpec`；今日少量 cobra Args + 注解 | 受管命令应声明，禁止推断 |
 | **Safety** | `effect`, `risk`, `confirmation`, `idempotency` | **声明**（完整 `contract.SafetySpec`）**或标注**（`runtime_gate`） | `Safety` / `AnnotateRuntimeGate`（metadata 壳 `tools: {}`，不再承载 reviewed Safety） | 四字段独立；confirmation 单独驱动运行时 |
-| | `idempotency` | 评审源（或未来 Contract） | reviewed metadata | 今日非框架声明；不得推断 |
+| | `retry_policy` | **声明**（仅 `idempotency=conditional`） | `ContractDecl.RetryPolicy` + 显式 `ParamDecl.Property` + MCP `interface_ref` | 从实际调用参数计算 effective idempotency；缺 key 时失败闭合，禁止按参数名推断 |
 | | `effect_source` / provenance | 组装派生物 | resolver 写入 `FieldProvenance` | 派生，不手写 |
 | **DryRun** | `preview_kind`, `remote_reads` | 评审源 | `schema_dry_run_capabilities`（正能力声明） | 否；无条目 ≠ 推断「不支持」之外的假能力 |
 | **Interface** | `interface_mode`, `interface_ref`, `availability`, `reason` | 评审源 | MCP meta + agent metadata 解析 | 否；与 CLI Identity 分离 |
@@ -1167,7 +1167,7 @@ cmd.RunE = func(cmd *cobra.Command, args []string) error {
 | 非 Shortcut 受管定义的 Cobra 命令 Hidden | 可执行 Contract | 挂载的命令可见性与声明匹配 |
 | Shortcut 列表成员资格与语义 disposition | 经评审的 Shortcut 可见性解析器 | public/all 列表成员资格与经评审决策匹配 |
 | Runtime Schema / Agent 暴露 | identity collector 收集结果加精确排除 | 每个暴露叶子解析到活 Contract；排除显式且不重叠 |
-| Safety 与运行时确认 | 可执行 Contract 的完整 `contract.SafetySpec`，或迁移期显式 annotate（如 `runtime_gate`）；见 §5.0 | `confirmation` 单独驱动运行时门，`effect` / `risk` / `idempotency` 原样发布，禁止跨字段机械推导；任一 Safety 字段非空时四字段必须齐全，否则构造期 panic；`ConfirmFirst` 只在 `confirmation=user_required` 时合法 |
+| Safety、条件幂等与运行时确认 | 可执行 Contract 的完整 `contract.SafetySpec`，或迁移期显式 annotate（如 `runtime_gate`）；条件幂等另由 `ContractDecl.RetryPolicy` 声明；见 §5.0 | `confirmation` 单独驱动运行时门，`effect` / `risk` / `idempotency` 原样发布，禁止跨字段机械推导；任一 Safety 字段非空时四字段必须齐全，否则构造期 panic；`conditional` 必须引用显式映射到 RPC property 的 string 参数，并在缺 key 时禁用重试；`ConfirmFirst` 只在 `confirmation=user_required` 时合法 |
 | 后端 product/tool/载荷绑定 | mcpbind + 后端元数据 | 每个绑定引用真实的 flag/属性 |
 | Agent 选择文案（`use_when`、`avoid_when`、摘要） | 声明：`ContractDecl.Selection` / `ProductDecl`（交付 provenance `contract_final`）；`schema_hints/` 已退役，禁止回潮 | 身份解析到活契约；选择文案不得创建 CLI 表面 |
 

internal/app/access_token_manager_test.go

@@ -65,16 +65,12 @@ func TestCrossPlatformCoverageTokenManagerCachesUntilMarkerRevisionChanges(t *te
 	token := "token-a"
 	installTokenManagerFakes(t, func() (*authpkg.TokenData, error) {
 		calls.Add(1)
-		return &authpkg.TokenData{
-			AccessToken: token,
-			ExpiresAt:   time.Now().Add(time.Hour),
-			LoginRegion: string(authpkg.LoginRegionInternational),
-		}, nil
+		return &authpkg.TokenData{AccessToken: token, ExpiresAt: time.Now().Add(time.Hour)}, nil
 	})
 
 	manager := NewTokenManager()
 	first, err := manager.Get(context.Background(), configDir, "")
-	if err != nil || first.AccessToken != "token-a" || first.LoginRegion != authpkg.LoginRegionInternational || !first.LoginRegionKnown {
+	if err != nil || first.AccessToken != "token-a" {
 		t.Fatalf("first token = %#v, %v", first, err)
 	}
 	second, err := manager.Get(context.Background(), configDir, "")

internal/app/access_token_resolve.go

@@ -41,11 +41,9 @@ type accessTokenSnapshotGetter interface {
 // AccessTokenSnapshot is the minimal bearer view needed by the process cache.
 // Refresh-token material never leaves the auth package.
 type AccessTokenSnapshot struct {
-	AccessToken      string
-	ExpiresAt        time.Time
-	Source           string
-	LoginRegion      authpkg.LoginRegion
-	LoginRegionKnown bool
+	AccessToken string
+	ExpiresAt   time.Time
+	Source      string
 }
 
 type tokenManagerKey struct {
@@ -225,11 +223,9 @@ func resolveAccessTokenSnapshotFromDir(ctx context.Context, configDir, profile s
 		data, err := snapshotProvider.GetTokenSnapshot(ctx)
 		if err == nil && data != nil && strings.TrimSpace(data.AccessToken) != "" {
 			return AccessTokenSnapshot{
-				AccessToken:      strings.TrimSpace(data.AccessToken),
-				ExpiresAt:        data.ExpiresAt,
-				Source:           "oauth",
-				LoginRegion:      authpkg.LoginRegion(strings.TrimSpace(data.LoginRegion)),
-				LoginRegionKnown: true,
+				AccessToken: strings.TrimSpace(data.AccessToken),
+				ExpiresAt:   data.ExpiresAt,
+				Source:      "oauth",
 			}, nil
 		}
 		if err != nil && !errors.Is(err, authpkg.ErrTokenDataNotFound) {

internal/app/agent_metadata_test.go

@@ -712,9 +712,9 @@ func TestCrossPlatformCoverageAgentMetadataMCPAndPluginScoping(t *testing.T) {
 	// calls must fail before preflight or transport while anonymous plugins remain
 	// valid above.
 	resolveCalled := false
-	testseam.Swap(t, &runnerResolveAuthSnapshot, func(*runtimeRunner, context.Context) (AccessTokenSnapshot, error) {
+	testseam.Swap(t, &runnerResolveAuthToken, func(*runtimeRunner, context.Context) (string, error) {
 		resolveCalled = true
-		return AccessTokenSnapshot{}, nil
+		return "", nil
 	})
 	callsBefore := len(captured)
 	unauthenticated := &runtimeRunner{

internal/app/auth_command.go

@@ -20,8 +20,6 @@ import (
 	"encoding/json"
 	"fmt"
 	"io"
-	"net"
-	"net/url"
 	"os"
 	"path/filepath"
 	"runtime"
@@ -50,24 +48,8 @@ type authLoginConfig struct {
 	TargetCorpID                   string
 	HistoryProfileSelector         string
 	HistoryProfileSelectorExplicit bool
-	International                  bool
-	PreURL                         string
-	MCPURL                         string
 }
 
-type authLoginEndpointOverrides struct {
-	LoginURL string
-	MCPURL   string
-}
-
-type authLoginMCPPersistence uint8
-
-const (
-	authLoginMCPUseDefault authLoginMCPPersistence = iota
-	authLoginMCPUseManagedRegion
-	authLoginMCPUseExplicitOverride
-)
-
 type authLoginGuideAction string
 
 const (
@@ -121,17 +103,12 @@ func newAuthLoginCommand(patCaller edition.ToolCaller) *cobra.Command {
 支持的登录方式:
   - OAuth Loopback 流 (默认): 本机自动起 127.0.0.1 监听接收回调，浏览器授权后自动完成
   - OAuth 设备流 (--device): 显示 user_code + 短 URL，适合 SSH 远程 / 容器 / 无头环境
-  - 自有应用 OAuth (--client-id/--client-secret): 使用指定应用完成用户授权
   - 直接提供 Token (--token): 跳过授权，使用已有 token
 
 不支持的登录方式:
   - 邮箱/密码登录
   - 手机号/验证码登录
-  - 无用户授权的纯应用凭证 (client_credentials) 登录
-
-区域:
-  - 默认使用国内钉钉 .com 登录与服务端点
-  - --intl（或 --international）使用国际版 .io 登录；后续业务命令按所选 profile 自动路由
+  - 应用凭证 (AppKey/AppSecret) 直接登录
 
 注意: SSH 远程或无头环境（无本地浏览器可访问远端的 127.0.0.1）请使用 --device，
       否则 OAuth 回调会跳到本机不可达的 127.0.0.1 链接，授权完成后无法回写 token。
@@ -139,9 +116,6 @@ func newAuthLoginCommand(patCaller edition.ToolCaller) *cobra.Command {
 示例:
   dws auth login              # 本机登录并新增/刷新一个组织 profile
   dws auth login --profile <corpId>  # 指定本次授权目标组织，不持久切换当前组织
-  dws auth login --intl       # 使用钉钉国际版 .io 登录入口
-  dws auth login --intl --pre-url https://pre-login.dingtalk.io
-  dws auth login --intl --pre-url https://pre-mcp.dingtalk.io
   dws auth login --recommend  # 无交互批量授权服务端推荐权限
   dws auth login --device     # SSH 远程 / 无头环境登录 (设备流)
   dws auth login --force      # 兼容保留；login 默认已忽略缓存并进入授权流程
@@ -152,22 +126,6 @@ func newAuthLoginCommand(patCaller edition.ToolCaller) *cobra.Command {
 			if err != nil {
 				return err
 			}
-			var preOverrides authLoginEndpointOverrides
-			if cfg.PreURL != "" {
-				var err error
-				preOverrides, err = authLoginEndpointOverridesForPreURL(cfg.PreURL)
-				if err != nil {
-					return err
-				}
-				restoreLoginBaseURL := authpkg.PushLoginBaseURLOverride(preOverrides.LoginURL)
-				defer restoreLoginBaseURL()
-			}
-			mcpBaseURL, mcpPersistence, err := authLoginMCPBaseURLForConfig(cfg, preOverrides)
-			if err != nil {
-				return err
-			}
-			restoreMCPBaseURL := authpkg.PushMCPBaseURLOverride(mcpBaseURL)
-			defer restoreMCPBaseURL()
 			configDir := defaultConfigDir()
 			var tokenData *authpkg.TokenData
 			format, _ := cmd.Root().PersistentFlags().GetString("format")
@@ -181,9 +139,6 @@ func newAuthLoginCommand(patCaller edition.ToolCaller) *cobra.Command {
 					AccessToken: cfg.Token,
 					ExpiresAt:   time.Now().Add(config.ManualTokenExpiry),
 				}
-				if cfg.International {
-					tokenData.LoginRegion = string(authpkg.LoginRegionInternational)
-				}
 				if err := authSaveTokenData(configDir, tokenData); err != nil {
 					return apperrors.NewInternal(fmt.Sprintf("failed to persist auth token: %v", err))
 				}
@@ -194,9 +149,6 @@ func newAuthLoginCommand(patCaller edition.ToolCaller) *cobra.Command {
 				provider := authpkg.NewDeviceFlowProvider(configDir, nil)
 				provider.Output = cmd.ErrOrStderr()
 				provider.NoBrowser, _ = cmd.Flags().GetBool("no-browser")
-				if cfg.International {
-					provider.SetLoginRegion(authpkg.LoginRegionInternational)
-				}
 				provider.IdentityEnricher = func(ctx context.Context, data *authpkg.TokenData) error {
 					return enrichAuthLoginProfileFromContact(ctx, configDir, patCaller, data, authLoginHistoryHint{
 						Selector: cfg.HistoryProfileSelector,
@@ -215,9 +167,6 @@ func newAuthLoginCommand(patCaller edition.ToolCaller) *cobra.Command {
 				provider.Output = cmd.ErrOrStderr()
 				provider.NoBrowser, _ = cmd.Flags().GetBool("no-browser")
 				provider.TargetCorpID = cfg.TargetCorpID
-				if cfg.International {
-					provider.LoginRegion = authpkg.LoginRegionInternational
-				}
 				provider.IdentityEnricher = func(ctx context.Context, data *authpkg.TokenData) error {
 					return enrichAuthLoginProfileFromContact(ctx, configDir, patCaller, data, authLoginHistoryHint{
 						Selector: cfg.HistoryProfileSelector,
@@ -231,11 +180,6 @@ func newAuthLoginCommand(patCaller edition.ToolCaller) *cobra.Command {
 				}
 			}
 
-			if tokenData != nil {
-				if err := persistAuthLoginMCPBaseURL(configDir, mcpBaseURL, mcpPersistence); err != nil {
-					return apperrors.NewInternal(fmt.Sprintf("failed to persist MCP URL: %v", err))
-				}
-			}
 			ResetRuntimeTokenCache()
 			clearCompatCache()
 			w := cmd.OutOrStdout()
@@ -334,10 +278,6 @@ func newAuthLoginCommand(patCaller edition.ToolCaller) *cobra.Command {
 	}
 	cmd.Flags().String("token", "", "Access token")
 	cmd.Flags().Bool("device", false, "Use device authorization flow")
-	cmd.Flags().Bool("intl", false, "Use DingTalk international (.io) login and service endpoints")
-	cmd.Flags().Bool("international", false, "Use DingTalk international (.io) login and service endpoints")
-	cmd.Flags().String("pre-url", "", "Override pre-release login/MCP base URL for this login")
-	cmd.Flags().String("mcp-url", "", "Override MCP base URL for this login")
 	cmd.Flags().Bool("force", false, "兼容保留；login 默认已忽略缓存并进入授权流程")
 	cmd.Flags().Bool("recommend", false, "登录成功后无交互批量授权服务端推荐权限")
 	// Hidden compatibility flags
@@ -1027,7 +967,6 @@ func newAuthResetCommand() *cobra.Command {
 				return apperrors.NewInternal(fmt.Sprintf("failed to reset token data: %v", err))
 			}
 			_ = authRemove(filepath.Join(configDir, "mcp_url"))
-			_ = authRemove(filepath.Join(configDir, config.ManagedMCPURLRegionFileName))
 			_ = authRemove(filepath.Join(configDir, "token"))
 			_ = authDeleteAppConfig(configDir)
 			ResetRuntimeTokenCache()
@@ -1286,14 +1225,6 @@ func resolveAuthLoginConfig(cmd *cobra.Command) (authLoginConfig, error) {
 	if err != nil {
 		return authLoginConfig{}, apperrors.NewInternal("failed to read --device")
 	}
-	intl, err := cmd.Flags().GetBool("intl")
-	if err != nil {
-		return authLoginConfig{}, apperrors.NewInternal("failed to read --intl")
-	}
-	international, err := cmd.Flags().GetBool("international")
-	if err != nil {
-		return authLoginConfig{}, apperrors.NewInternal("failed to read --international")
-	}
 	force, err := cmd.Flags().GetBool("force")
 	if err != nil {
 		return authLoginConfig{}, apperrors.NewInternal("failed to read --force")
@@ -1302,14 +1233,6 @@ func resolveAuthLoginConfig(cmd *cobra.Command) (authLoginConfig, error) {
 	if err != nil {
 		return authLoginConfig{}, apperrors.NewInternal("failed to read --recommend")
 	}
-	preURL, err := cmd.Flags().GetString("pre-url")
-	if err != nil {
-		return authLoginConfig{}, apperrors.NewInternal("failed to read --pre-url")
-	}
-	mcpURL, err := cmd.Flags().GetString("mcp-url")
-	if err != nil {
-		return authLoginConfig{}, apperrors.NewInternal("failed to read --mcp-url")
-	}
 	yes := false
 	profileSelector := ""
 	if cmd.Root() != nil {
@@ -1343,172 +1266,9 @@ func resolveAuthLoginConfig(cmd *cobra.Command) (authLoginConfig, error) {
 		TargetCorpID:                   targetCorpID,
 		HistoryProfileSelector:         historyProfileSelector,
 		HistoryProfileSelectorExplicit: historyProfileSelectorExplicit,
-		International:                  intl || international,
-		PreURL:                         strings.TrimSpace(preURL),
-		MCPURL:                         strings.TrimSpace(mcpURL),
 	}, nil
 }
 
-func authLoginEndpointOverridesForPreURL(raw string) (authLoginEndpointOverrides, error) {
-	parsed, normalized, err := normalizeAuthLoginBaseURL(raw, "--pre-url")
-	if err != nil {
-		return authLoginEndpointOverrides{}, err
-	}
-	host := strings.ToLower(parsed.Hostname())
-	switch {
-	case strings.HasPrefix(host, "pre-login."):
-		return authLoginEndpointOverrides{
-			LoginURL: normalized,
-			MCPURL:   authLoginURLWithHost(parsed, "pre-mcp."+strings.TrimPrefix(host, "pre-login.")),
-		}, nil
-	case strings.HasPrefix(host, "pre-mcp."):
-		return authLoginEndpointOverrides{
-			LoginURL: authLoginURLWithHost(parsed, "pre-login."+strings.TrimPrefix(host, "pre-mcp.")),
-			MCPURL:   normalized,
-		}, nil
-	default:
-		return authLoginEndpointOverrides{}, apperrors.NewValidation("--pre-url must be a pre-login.* or pre-mcp.* URL")
-	}
-}
-
-func authLoginMCPBaseURLForConfig(cfg authLoginConfig, preOverrides authLoginEndpointOverrides) (string, authLoginMCPPersistence, error) {
-	if cfg.MCPURL != "" {
-		_, normalized, err := normalizeAuthLoginBaseURL(cfg.MCPURL, "--mcp-url")
-		if err != nil {
-			return "", authLoginMCPUseDefault, err
-		}
-		return normalized, authLoginMCPUseExplicitOverride, nil
-	}
-	if cfg.PreURL != "" {
-		if preOverrides.MCPURL == "" {
-			var err error
-			preOverrides, err = authLoginEndpointOverridesForPreURL(cfg.PreURL)
-			if err != nil {
-				return "", authLoginMCPUseDefault, err
-			}
-		}
-		return preOverrides.MCPURL, authLoginMCPUseExplicitOverride, nil
-	}
-	if cfg.International {
-		return authpkg.InternationalMCPBaseURL, authLoginMCPUseManagedRegion, nil
-	}
-	return authpkg.DefaultMCPBaseURL, authLoginMCPUseDefault, nil
-}
-
-func persistAuthLoginMCPBaseURL(configDir, mcpBaseURL string, persistence authLoginMCPPersistence) error {
-	mcpURLPath := filepath.Join(configDir, "mcp_url")
-	managedRegionPath := filepath.Join(configDir, config.ManagedMCPURLRegionFileName)
-
-	switch persistence {
-	case authLoginMCPUseExplicitOverride:
-		if err := removeAuthLoginManagedMCPRegion(managedRegionPath); err != nil {
-			return fmt.Errorf("clear managed MCP region: %w", err)
-		}
-		if err := authAtomicWrite(mcpURLPath, []byte(mcpBaseURL), config.FilePerm); err != nil {
-			return fmt.Errorf("save explicit MCP URL: %w", err)
-		}
-		return nil
-	case authLoginMCPUseManagedRegion:
-		managedURL, managedErr := authReadFile(managedRegionPath)
-		if managedErr != nil && !os.IsNotExist(managedErr) {
-			return fmt.Errorf("read managed MCP region: %w", managedErr)
-		}
-		currentURL, currentErr := authReadFile(mcpURLPath)
-		switch {
-		case currentErr == nil && os.IsNotExist(managedErr):
-			return nil
-		case currentErr == nil && strings.TrimSpace(string(currentURL)) != strings.TrimSpace(string(managedURL)):
-			return removeAuthLoginManagedMCPRegion(managedRegionPath)
-		case currentErr != nil && !os.IsNotExist(currentErr):
-			return fmt.Errorf("read MCP URL: %w", currentErr)
-		}
-		if err := authAtomicWrite(managedRegionPath, []byte(mcpBaseURL), config.FilePerm); err != nil {
-			return fmt.Errorf("save managed MCP region: %w", err)
-		}
-		if err := authAtomicWrite(mcpURLPath, []byte(mcpBaseURL), config.FilePerm); err != nil {
-			_ = authRemove(managedRegionPath)
-			return fmt.Errorf("save managed MCP URL: %w", err)
-		}
-		return nil
-	case authLoginMCPUseDefault:
-		managedURL, err := authReadFile(managedRegionPath)
-		if os.IsNotExist(err) {
-			return nil
-		}
-		if err != nil {
-			return fmt.Errorf("read managed MCP region: %w", err)
-		}
-		currentURL, err := authReadFile(mcpURLPath)
-		if os.IsNotExist(err) {
-			return removeAuthLoginManagedMCPRegion(managedRegionPath)
-		}
-		if err != nil {
-			return fmt.Errorf("read MCP URL: %w", err)
-		}
-		if strings.TrimSpace(string(currentURL)) != strings.TrimSpace(string(managedURL)) {
-			return removeAuthLoginManagedMCPRegion(managedRegionPath)
-		}
-		if err := authAtomicWrite(mcpURLPath, []byte(mcpBaseURL), config.FilePerm); err != nil {
-			return fmt.Errorf("restore default MCP URL: %w", err)
-		}
-		return removeAuthLoginManagedMCPRegion(managedRegionPath)
-	default:
-		return fmt.Errorf("unsupported MCP persistence mode %d", persistence)
-	}
-}
-
-func removeAuthLoginManagedMCPRegion(path string) error {
-	if err := authRemove(path); err != nil && !os.IsNotExist(err) {
-		return err
-	}
-	return nil
-}
-
-func normalizeAuthLoginBaseURL(raw, flagName string) (*url.URL, string, error) {
-	value := strings.TrimSpace(raw)
-	if value == "" {
-		return nil, "", apperrors.NewValidation(flagName + " cannot be empty")
-	}
-	if !strings.Contains(value, "://") {
-		value = "https://" + value
-	}
-	parsed, err := url.Parse(value)
-	if err != nil {
-		return nil, "", apperrors.NewValidation(fmt.Sprintf("invalid %s: %v", flagName, err))
-	}
-	if parsed.Scheme != "http" && parsed.Scheme != "https" {
-		return nil, "", apperrors.NewValidation(flagName + " must use http or https")
-	}
-	if parsed.Hostname() == "" {
-		return nil, "", apperrors.NewValidation(flagName + " must include a host")
-	}
-	if parsed.Scheme == "http" && !isAuthLoginLoopbackHost(parsed.Hostname()) {
-		return nil, "", apperrors.NewValidation(flagName + " must use HTTPS, except for a loopback HTTP test endpoint")
-	}
-	parsed.RawQuery = ""
-	parsed.Fragment = ""
-	parsed.Path = strings.TrimRight(parsed.Path, "/")
-	return parsed, strings.TrimRight(parsed.String(), "/"), nil
-}
-
-func isAuthLoginLoopbackHost(host string) bool {
-	if strings.EqualFold(strings.TrimSpace(host), "localhost") {
-		return true
-	}
-	ip := net.ParseIP(strings.TrimSpace(host))
-	return ip != nil && ip.IsLoopback()
-}
-
-func authLoginURLWithHost(parsed *url.URL, host string) string {
-	copyURL := *parsed
-	if port := parsed.Port(); port != "" {
-		copyURL.Host = net.JoinHostPort(host, port)
-	} else {
-		copyURL.Host = host
-	}
-	return strings.TrimRight(copyURL.String(), "/")
-}
-
 func authLoginForcesAuthorization(_ authLoginConfig) bool {
 	return true
 }

internal/app/auth_command_full_coverage_test.go

@@ -7,7 +7,6 @@ import (
 	"fmt"
 	"io"
 	"os"
-	"path/filepath"
 	"strings"
 	"testing"
 	"time"
@@ -215,8 +214,7 @@ func TestCrossPlatformCoverageAuthCoverageFormsParentAndTargets(t *testing.T) {
 }
 
 func TestCrossPlatformCoverageAuthCoverageLoginFlows(t *testing.T) {
-	configDir := t.TempDir()
-	t.Setenv("DWS_CONFIG_DIR", configDir)
+	t.Setenv("DWS_CONFIG_DIR", t.TempDir())
 	oldSave := authSaveTokenData
 	oldDevice := authDeviceLogin
 	oldOAuth := authOAuthLogin
@@ -257,15 +255,6 @@ func TestCrossPlatformCoverageAuthCoverageLoginFlows(t *testing.T) {
 	if out, _, err := authCoverageRunLogin(t, nil, "json", true, map[string]string{"token": "token"}); err != nil || !strings.Contains(out, `"token_valid": true`) {
 		t.Fatalf("json token login = %q, %v", out, err)
 	}
-	if _, _, err := authCoverageRunLogin(t, nil, "table", true, map[string]string{"token": "token", "pre-url": "https://example.com"}); err == nil {
-		t.Fatal("invalid pre-release host should fail")
-	}
-	if _, _, err := authCoverageRunLogin(t, nil, "table", true, map[string]string{"token": "token", "mcp-url": "http://remote.example.com"}); err == nil {
-		t.Fatal("remote plaintext MCP URL should fail")
-	}
-	if _, _, err := authCoverageRunLogin(t, nil, "table", true, map[string]string{"token": "token", "pre-url": "https://pre-login.dingtalk.io"}); err != nil {
-		t.Fatalf("pre-release token login = %v", err)
-	}
 
 	authDeviceLogin = func(*authpkg.DeviceFlowProvider, context.Context) (*authpkg.TokenData, error) {
 		return nil, errors.New("device")
@@ -282,15 +271,6 @@ func TestCrossPlatformCoverageAuthCoverageLoginFlows(t *testing.T) {
 	if _, _, err := authCoverageRunLogin(t, nil, "table", true, map[string]string{"device": "true", "no-browser": "true"}); err != nil {
 		t.Fatal(err)
 	}
-	authDeviceLogin = func(provider *authpkg.DeviceFlowProvider, _ context.Context) (*authpkg.TokenData, error) {
-		if provider.LoginRegion != authpkg.LoginRegionInternational {
-			t.Errorf("device login region = %q, want international", provider.LoginRegion)
-		}
-		return &authpkg.TokenData{AccessToken: "a", ExpiresAt: time.Now().Add(time.Hour)}, nil
-	}
-	if _, _, err := authCoverageRunLogin(t, nil, "table", true, map[string]string{"device": "true", "intl": "true"}); err != nil {
-		t.Fatalf("international device login = %v", err)
-	}
 
 	authOAuthLogin = func(*authpkg.OAuthProvider, context.Context, bool) (*authpkg.TokenData, error) {
 		return nil, errors.New("oauth")
@@ -311,25 +291,6 @@ func TestCrossPlatformCoverageAuthCoverageLoginFlows(t *testing.T) {
 	if out, _, err := authCoverageRunLogin(t, caller, "table", true, map[string]string{"no-browser": "true"}); err != nil || !strings.Contains(out, "Corp") {
 		t.Fatalf("oauth success = %q, %v", out, err)
 	}
-	authOAuthLogin = func(provider *authpkg.OAuthProvider, _ context.Context, _ bool) (*authpkg.TokenData, error) {
-		if provider.LoginRegion != authpkg.LoginRegionInternational {
-			t.Errorf("OAuth login region = %q, want international", provider.LoginRegion)
-		}
-		return &authpkg.TokenData{AccessToken: "a", ExpiresAt: time.Now().Add(time.Hour)}, nil
-	}
-	if _, _, err := authCoverageRunLogin(t, nil, "table", true, map[string]string{"intl": "true"}); err != nil {
-		t.Fatalf("international OAuth login = %v", err)
-	}
-
-	blockedConfigDir := t.TempDir()
-	if err := os.Mkdir(filepath.Join(blockedConfigDir, "mcp_url"), 0o700); err != nil {
-		t.Fatal(err)
-	}
-	t.Setenv("DWS_CONFIG_DIR", blockedConfigDir)
-	if _, _, err := authCoverageRunLogin(t, nil, "table", true, map[string]string{"token": "token", "intl": "true"}); err == nil || !strings.Contains(err.Error(), "failed to persist MCP URL") {
-		t.Fatalf("MCP URL persist failure = %v", err)
-	}
-	t.Setenv("DWS_CONFIG_DIR", configDir)
 
 	authRunLoginRecommend = func(context.Context, edition.ToolCaller, io.Writer, pat.LoginRecommendOptions) error {
 		return errors.New("recommend")
@@ -1457,7 +1418,7 @@ func TestCrossPlatformCoverageAuthCoveragePortableExchangeAndReset(t *testing.T)
 	authRemove = func(string) error { removed++; return errors.New("ignored") }
 	authDeleteAppConfig = func(string) error { removed++; return errors.New("ignored") }
 	edition.Override(&edition.Hooks{})
-	if err := reset.RunE(reset, nil); err != nil || removed != 4 || !strings.Contains(out.String(), "重新登录") {
+	if err := reset.RunE(reset, nil); err != nil || removed != 3 || !strings.Contains(out.String(), "重新登录") {
 		t.Fatalf("reset = %q, %v, removed=%d", out.String(), err, removed)
 	}
 	edition.Override(&edition.Hooks{IsEmbedded: true})

internal/app/auth_command_test.go

@@ -33,8 +33,6 @@ import (
 	apperrors "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/errors"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/keychain"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/pat"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/testseam"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/config"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/edition"
 	"github.com/spf13/cobra"
 )
@@ -1035,12 +1033,8 @@ func TestResolveAuthLoginConfigReadsInheritedYes(t *testing.T) {
 	login := &cobra.Command{Use: "login"}
 	login.Flags().String("token", "", "")
 	login.Flags().Bool("device", false, "")
-	login.Flags().Bool("intl", false, "")
-	login.Flags().Bool("international", false, "")
 	login.Flags().Bool("force", false, "")
 	login.Flags().Bool("recommend", false, "")
-	login.Flags().String("pre-url", "", "")
-	login.Flags().String("mcp-url", "", "")
 	root.AddCommand(login)
 
 	if err := root.PersistentFlags().Set("yes", "true"); err != nil {
@@ -1067,560 +1061,6 @@ func TestResolveAuthLoginConfigReadsInheritedYes(t *testing.T) {
 	}
 }
 
-func TestCrossPlatformCoverageResolveAuthLoginConfigReadsInternationalAliases(t *testing.T) {
-	for _, flag := range []string{"intl", "international"} {
-		t.Run(flag, func(t *testing.T) {
-			root := &cobra.Command{Use: "dws"}
-			root.PersistentFlags().Bool("yes", false, "")
-			login := &cobra.Command{Use: "login"}
-			login.Flags().String("token", "", "")
-			login.Flags().Bool("device", false, "")
-			login.Flags().Bool("intl", false, "")
-			login.Flags().Bool("international", false, "")
-			login.Flags().Bool("force", false, "")
-			login.Flags().Bool("recommend", false, "")
-			login.Flags().String("pre-url", "", "")
-			login.Flags().String("mcp-url", "", "")
-			root.AddCommand(login)
-
-			if err := login.Flags().Set(flag, "true"); err != nil {
-				t.Fatalf("set %s: %v", flag, err)
-			}
-
-			cfg, err := resolveAuthLoginConfig(login)
-			if err != nil {
-				t.Fatalf("resolveAuthLoginConfig error = %v", err)
-			}
-			if !cfg.International {
-				t.Fatalf("International = false for --%s, want true", flag)
-			}
-		})
-	}
-
-	for _, tc := range []struct {
-		name  string
-		setup func(*cobra.Command)
-	}{
-		{
-			name: "missing intl",
-			setup: func(cmd *cobra.Command) {
-				cmd.Flags().String("token", "", "")
-				cmd.Flags().Bool("device", false, "")
-			},
-		},
-		{
-			name: "missing international",
-			setup: func(cmd *cobra.Command) {
-				cmd.Flags().String("token", "", "")
-				cmd.Flags().Bool("device", false, "")
-				cmd.Flags().Bool("intl", false, "")
-			},
-		},
-		{
-			name: "missing pre url",
-			setup: func(cmd *cobra.Command) {
-				cmd.Flags().String("token", "", "")
-				cmd.Flags().Bool("device", false, "")
-				cmd.Flags().Bool("intl", false, "")
-				cmd.Flags().Bool("international", false, "")
-				cmd.Flags().Bool("force", false, "")
-				cmd.Flags().Bool("recommend", false, "")
-			},
-		},
-		{
-			name: "missing mcp url",
-			setup: func(cmd *cobra.Command) {
-				cmd.Flags().String("token", "", "")
-				cmd.Flags().Bool("device", false, "")
-				cmd.Flags().Bool("intl", false, "")
-				cmd.Flags().Bool("international", false, "")
-				cmd.Flags().Bool("force", false, "")
-				cmd.Flags().Bool("recommend", false, "")
-				cmd.Flags().String("pre-url", "", "")
-			},
-		},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			cmd := &cobra.Command{Use: "login"}
-			tc.setup(cmd)
-			if _, err := resolveAuthLoginConfig(cmd); err == nil {
-				t.Fatal("resolveAuthLoginConfig succeeded with an incomplete flag set")
-			}
-		})
-	}
-}
-
-func TestCrossPlatformCoverageResolveAuthLoginConfigReadsMCPURL(t *testing.T) {
-	root := &cobra.Command{Use: "dws"}
-	root.PersistentFlags().Bool("yes", false, "")
-	login := &cobra.Command{Use: "login"}
-	login.Flags().String("token", "", "")
-	login.Flags().Bool("device", false, "")
-	login.Flags().Bool("intl", false, "")
-	login.Flags().Bool("international", false, "")
-	login.Flags().Bool("force", false, "")
-	login.Flags().Bool("recommend", false, "")
-	login.Flags().String("pre-url", "", "")
-	login.Flags().String("mcp-url", "", "")
-	root.AddCommand(login)
-
-	if err := login.Flags().Set("mcp-url", " https://pre-mcp.dingtalk.io/ "); err != nil {
-		t.Fatalf("set mcp-url: %v", err)
-	}
-
-	cfg, err := resolveAuthLoginConfig(login)
-	if err != nil {
-		t.Fatalf("resolveAuthLoginConfig error = %v", err)
-	}
-	if cfg.MCPURL != "https://pre-mcp.dingtalk.io/" {
-		t.Fatalf("MCPURL = %q, want trimmed flag value", cfg.MCPURL)
-	}
-}
-
-func TestCrossPlatformCoverageResolveAuthLoginConfigReadsPreURL(t *testing.T) {
-	root := &cobra.Command{Use: "dws"}
-	root.PersistentFlags().Bool("yes", false, "")
-	login := &cobra.Command{Use: "login"}
-	login.Flags().String("token", "", "")
-	login.Flags().Bool("device", false, "")
-	login.Flags().Bool("intl", false, "")
-	login.Flags().Bool("international", false, "")
-	login.Flags().Bool("force", false, "")
-	login.Flags().Bool("recommend", false, "")
-	login.Flags().String("pre-url", "", "")
-	login.Flags().String("mcp-url", "", "")
-	root.AddCommand(login)
-
-	if err := login.Flags().Set("pre-url", " pre-login.dingtalk.io "); err != nil {
-		t.Fatalf("set pre-url: %v", err)
-	}
-
-	cfg, err := resolveAuthLoginConfig(login)
-	if err != nil {
-		t.Fatalf("resolveAuthLoginConfig error = %v", err)
-	}
-	if cfg.PreURL != "pre-login.dingtalk.io" {
-		t.Fatalf("PreURL = %q, want trimmed flag value", cfg.PreURL)
-	}
-}
-
-func TestCrossPlatformCoverageAuthLoginEndpointOverridesForPreURL(t *testing.T) {
-	tests := []struct {
-		name      string
-		raw       string
-		wantLogin string
-		wantMCP   string
-	}{
-		{
-			name:      "pre login",
-			raw:       "https://pre-login.dingtalk.io/",
-			wantLogin: "https://pre-login.dingtalk.io",
-			wantMCP:   "https://pre-mcp.dingtalk.io",
-		},
-		{
-			name:      "pre mcp",
-			raw:       "pre-mcp.dingtalk.io",
-			wantLogin: "https://pre-login.dingtalk.io",
-			wantMCP:   "https://pre-mcp.dingtalk.io",
-		},
-		{
-			name:      "pre login with port",
-			raw:       "https://pre-login.dingtalk.io:8443/path/",
-			wantLogin: "https://pre-login.dingtalk.io:8443/path",
-			wantMCP:   "https://pre-mcp.dingtalk.io:8443/path",
-		},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			got, err := authLoginEndpointOverridesForPreURL(tc.raw)
-			if err != nil {
-				t.Fatalf("authLoginEndpointOverridesForPreURL error = %v", err)
-			}
-			if got.LoginURL != tc.wantLogin || got.MCPURL != tc.wantMCP {
-				t.Fatalf("overrides = %#v, want login %q mcp %q", got, tc.wantLogin, tc.wantMCP)
-			}
-		})
-	}
-
-	for _, raw := range []string{"https://example.com", "http://pre-login.example.com"} {
-		if _, err := authLoginEndpointOverridesForPreURL(raw); err == nil {
-			t.Fatalf("authLoginEndpointOverridesForPreURL(%q) succeeded", raw)
-		}
-	}
-}
-
-func TestCrossPlatformCoverageAuthLoginMCPBaseURLForConfig(t *testing.T) {
-	tests := []struct {
-		name            string
-		cfg             authLoginConfig
-		preOverride     authLoginEndpointOverrides
-		wantURL         string
-		wantPersistence authLoginMCPPersistence
-	}{
-		{
-			name:            "default center login uses com and resets only managed region",
-			cfg:             authLoginConfig{},
-			wantURL:         authpkg.DefaultMCPBaseURL,
-			wantPersistence: authLoginMCPUseDefault,
-		},
-		{
-			name:            "international login persists managed io",
-			cfg:             authLoginConfig{International: true},
-			wantURL:         authpkg.InternationalMCPBaseURL,
-			wantPersistence: authLoginMCPUseManagedRegion,
-		},
-		{
-			name: "pre login persists mapped pre mcp",
-			cfg:  authLoginConfig{PreURL: "pre-login.dingtalk.io"},
-			preOverride: authLoginEndpointOverrides{
-				LoginURL: "https://pre-login.dingtalk.io",
-				MCPURL:   "https://pre-mcp.dingtalk.io",
-			},
-			wantURL:         "https://pre-mcp.dingtalk.io",
-			wantPersistence: authLoginMCPUseExplicitOverride,
-		},
-		{
-			name: "explicit mcp url wins over pre url",
-			cfg: authLoginConfig{
-				PreURL: "pre-login.dingtalk.io",
-				MCPURL: " https://custom-mcp.example.com/ ",
-			},
-			preOverride: authLoginEndpointOverrides{
-				LoginURL: "https://pre-login.dingtalk.io",
-				MCPURL:   "https://pre-mcp.dingtalk.io",
-			},
-			wantURL:         "https://custom-mcp.example.com",
-			wantPersistence: authLoginMCPUseExplicitOverride,
-		},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			gotURL, gotPersistence, err := authLoginMCPBaseURLForConfig(tc.cfg, tc.preOverride)
-			if err != nil {
-				t.Fatalf("authLoginMCPBaseURLForConfig error = %v", err)
-			}
-			if gotURL != tc.wantURL || gotPersistence != tc.wantPersistence {
-				t.Fatalf("got url=%q persistence=%v, want url=%q persistence=%v", gotURL, gotPersistence, tc.wantURL, tc.wantPersistence)
-			}
-		})
-	}
-
-	for _, cfg := range []authLoginConfig{
-		{MCPURL: "http://remote.example.com"},
-		{PreURL: "https://example.com"},
-	} {
-		if _, _, err := authLoginMCPBaseURLForConfig(cfg, authLoginEndpointOverrides{}); err == nil {
-			t.Fatalf("authLoginMCPBaseURLForConfig(%#v) succeeded", cfg)
-		}
-	}
-}
-
-func TestCrossPlatformCoveragePersistAuthLoginMCPBaseURL(t *testing.T) {
-	t.Run("persists selected io mcp url", func(t *testing.T) {
-		configDir := t.TempDir()
-		if err := persistAuthLoginMCPBaseURL(configDir, authpkg.InternationalMCPBaseURL, authLoginMCPUseManagedRegion); err != nil {
-			t.Fatalf("persistAuthLoginMCPBaseURL error = %v", err)
-		}
-		data, err := os.ReadFile(filepath.Join(configDir, "mcp_url"))
-		if err != nil {
-			t.Fatalf("ReadFile(mcp_url) error = %v", err)
-		}
-		if string(data) != authpkg.InternationalMCPBaseURL {
-			t.Fatalf("mcp_url = %q, want %q", string(data), authpkg.InternationalMCPBaseURL)
-		}
-		managed, err := os.ReadFile(filepath.Join(configDir, config.ManagedMCPURLRegionFileName))
-		if err != nil || string(managed) != authpkg.InternationalMCPBaseURL {
-			t.Fatalf("managed MCP region = %q, %v", string(managed), err)
-		}
-	})
-
-	t.Run("center login preserves previous persisted override", func(t *testing.T) {
-		configDir := t.TempDir()
-		mcpURLPath := filepath.Join(configDir, "mcp_url")
-		const customURL = "https://custom-mcp.example.com"
-		if err := os.WriteFile(mcpURLPath, []byte(customURL), 0o600); err != nil {
-			t.Fatalf("WriteFile(mcp_url) error = %v", err)
-		}
-		if err := persistAuthLoginMCPBaseURL(configDir, authpkg.DefaultMCPBaseURL, authLoginMCPUseDefault); err != nil {
-			t.Fatalf("persistAuthLoginMCPBaseURL error = %v", err)
-		}
-		data, err := os.ReadFile(mcpURLPath)
-		if err != nil {
-			t.Fatalf("ReadFile(mcp_url) error = %v", err)
-		}
-		if string(data) != customURL {
-			t.Fatalf("mcp_url = %q, want preserved override %q", string(data), customURL)
-		}
-	})
-
-	t.Run("international login preserves an unmanaged explicit override", func(t *testing.T) {
-		configDir := t.TempDir()
-		mcpURLPath := filepath.Join(configDir, "mcp_url")
-		const customURL = "https://private-mcp.example.com"
-		if err := os.WriteFile(mcpURLPath, []byte(customURL), config.FilePerm); err != nil {
-			t.Fatal(err)
-		}
-		if err := persistAuthLoginMCPBaseURL(configDir, authpkg.InternationalMCPBaseURL, authLoginMCPUseManagedRegion); err != nil {
-			t.Fatal(err)
-		}
-		data, err := os.ReadFile(mcpURLPath)
-		if err != nil || string(data) != customURL {
-			t.Fatalf("explicit mcp_url = %q, %v; want preserved custom URL", string(data), err)
-		}
-		if _, err := os.Stat(filepath.Join(configDir, config.ManagedMCPURLRegionFileName)); !os.IsNotExist(err) {
-			t.Fatalf("unmanaged override acquired a managed marker: %v", err)
-		}
-	})
-
-	t.Run("center login resets a managed international URL", func(t *testing.T) {
-		configDir := t.TempDir()
-		if err := persistAuthLoginMCPBaseURL(configDir, authpkg.InternationalMCPBaseURL, authLoginMCPUseManagedRegion); err != nil {
-			t.Fatal(err)
-		}
-		if err := persistAuthLoginMCPBaseURL(configDir, authpkg.DefaultMCPBaseURL, authLoginMCPUseDefault); err != nil {
-			t.Fatal(err)
-		}
-		data, err := os.ReadFile(filepath.Join(configDir, "mcp_url"))
-		if err != nil || string(data) != authpkg.DefaultMCPBaseURL {
-			t.Fatalf("mcp_url = %q, %v; want domestic default", string(data), err)
-		}
-		if _, err := os.Stat(filepath.Join(configDir, config.ManagedMCPURLRegionFileName)); !os.IsNotExist(err) {
-			t.Fatalf("managed region marker remains after domestic login: %v", err)
-		}
-	})
-
-	t.Run("explicit override clears region ownership", func(t *testing.T) {
-		configDir := t.TempDir()
-		if err := persistAuthLoginMCPBaseURL(configDir, authpkg.InternationalMCPBaseURL, authLoginMCPUseManagedRegion); err != nil {
-			t.Fatal(err)
-		}
-		const customURL = "https://custom-mcp.example.com"
-		if err := persistAuthLoginMCPBaseURL(configDir, customURL, authLoginMCPUseExplicitOverride); err != nil {
-			t.Fatal(err)
-		}
-		if err := persistAuthLoginMCPBaseURL(configDir, authpkg.DefaultMCPBaseURL, authLoginMCPUseDefault); err != nil {
-			t.Fatal(err)
-		}
-		data, err := os.ReadFile(filepath.Join(configDir, "mcp_url"))
-		if err != nil || string(data) != customURL {
-			t.Fatalf("explicit mcp_url = %q, %v; want preserved custom URL", string(data), err)
-		}
-	})
-
-	t.Run("stale marker never deletes a different custom URL", func(t *testing.T) {
-		configDir := t.TempDir()
-		if err := os.WriteFile(filepath.Join(configDir, "mcp_url"), []byte("https://custom.example.com"), config.FilePerm); err != nil {
-			t.Fatal(err)
-		}
-		if err := os.WriteFile(filepath.Join(configDir, config.ManagedMCPURLRegionFileName), []byte(authpkg.InternationalMCPBaseURL), config.FilePerm); err != nil {
-			t.Fatal(err)
-		}
-		if err := persistAuthLoginMCPBaseURL(configDir, authpkg.DefaultMCPBaseURL, authLoginMCPUseDefault); err != nil {
-			t.Fatal(err)
-		}
-		data, err := os.ReadFile(filepath.Join(configDir, "mcp_url"))
-		if err != nil || string(data) != "https://custom.example.com" {
-			t.Fatalf("custom mcp_url = %q, %v", string(data), err)
-		}
-	})
-
-	t.Run("international login clears a stale marker without changing a custom URL", func(t *testing.T) {
-		configDir := t.TempDir()
-		mcpURLPath := filepath.Join(configDir, "mcp_url")
-		managedRegionPath := filepath.Join(configDir, config.ManagedMCPURLRegionFileName)
-		const customURL = "https://private-mcp.example.com"
-		if err := os.WriteFile(mcpURLPath, []byte(customURL), config.FilePerm); err != nil {
-			t.Fatal(err)
-		}
-		if err := os.WriteFile(managedRegionPath, []byte(authpkg.DefaultMCPBaseURL), config.FilePerm); err != nil {
-			t.Fatal(err)
-		}
-		if err := persistAuthLoginMCPBaseURL(configDir, authpkg.InternationalMCPBaseURL, authLoginMCPUseManagedRegion); err != nil {
-			t.Fatal(err)
-		}
-		data, err := os.ReadFile(mcpURLPath)
-		if err != nil || string(data) != customURL {
-			t.Fatalf("custom mcp_url = %q, %v", string(data), err)
-		}
-		if _, err := os.Stat(managedRegionPath); !os.IsNotExist(err) {
-			t.Fatalf("stale managed marker remains: %v", err)
-		}
-	})
-}
-
-func TestCrossPlatformCoveragePersistAuthLoginMCPBaseURLErrors(t *testing.T) {
-	fail := errors.New("persist failure")
-
-	t.Run("explicit marker cleanup", func(t *testing.T) {
-		testseam.Swap(t, &authRemove, func(string) error { return fail })
-		if err := persistAuthLoginMCPBaseURL(t.TempDir(), "https://custom.example.com", authLoginMCPUseExplicitOverride); !errors.Is(err, fail) {
-			t.Fatalf("explicit marker cleanup error = %v", err)
-		}
-	})
-
-	t.Run("explicit URL write", func(t *testing.T) {
-		testseam.Swap(t, &authAtomicWrite, func(string, []byte, os.FileMode) error { return fail })
-		if err := persistAuthLoginMCPBaseURL(t.TempDir(), "https://custom.example.com", authLoginMCPUseExplicitOverride); !errors.Is(err, fail) {
-			t.Fatalf("explicit URL write error = %v", err)
-		}
-	})
-
-	t.Run("managed marker write", func(t *testing.T) {
-		testseam.Swap(t, &authAtomicWrite, func(string, []byte, os.FileMode) error { return fail })
-		if err := persistAuthLoginMCPBaseURL(t.TempDir(), authpkg.InternationalMCPBaseURL, authLoginMCPUseManagedRegion); !errors.Is(err, fail) {
-			t.Fatalf("managed marker write error = %v", err)
-		}
-	})
-
-	t.Run("managed marker read", func(t *testing.T) {
-		testseam.Swap(t, &authReadFile, func(string) ([]byte, error) { return nil, fail })
-		if err := persistAuthLoginMCPBaseURL(t.TempDir(), authpkg.InternationalMCPBaseURL, authLoginMCPUseManagedRegion); !errors.Is(err, fail) {
-			t.Fatalf("managed marker read error = %v", err)
-		}
-	})
-
-	t.Run("managed MCP URL read", func(t *testing.T) {
-		reads := 0
-		testseam.Swap(t, &authReadFile, func(string) ([]byte, error) {
-			reads++
-			if reads == 1 {
-				return nil, os.ErrNotExist
-			}
-			return nil, fail
-		})
-		if err := persistAuthLoginMCPBaseURL(t.TempDir(), authpkg.InternationalMCPBaseURL, authLoginMCPUseManagedRegion); !errors.Is(err, fail) {
-			t.Fatalf("managed MCP URL read error = %v", err)
-		}
-	})
-
-	t.Run("managed stale marker cleanup", func(t *testing.T) {
-		reads := 0
-		testseam.Swap(t, &authReadFile, func(string) ([]byte, error) {
-			reads++
-			if reads == 1 {
-				return []byte(authpkg.DefaultMCPBaseURL), nil
-			}
-			return []byte("https://private-mcp.example.com"), nil
-		})
-		testseam.Swap(t, &authRemove, func(string) error { return fail })
-		if err := persistAuthLoginMCPBaseURL(t.TempDir(), authpkg.InternationalMCPBaseURL, authLoginMCPUseManagedRegion); !errors.Is(err, fail) {
-			t.Fatalf("managed stale marker cleanup error = %v", err)
-		}
-	})
-
-	t.Run("managed URL write cleans marker", func(t *testing.T) {
-		writes := 0
-		removed := false
-		testseam.Swap(t, &authAtomicWrite, func(string, []byte, os.FileMode) error {
-			writes++
-			if writes == 2 {
-				return fail
-			}
-			return nil
-		})
-		testseam.Swap(t, &authRemove, func(string) error { removed = true; return nil })
-		if err := persistAuthLoginMCPBaseURL(t.TempDir(), authpkg.InternationalMCPBaseURL, authLoginMCPUseManagedRegion); !errors.Is(err, fail) || !removed {
-			t.Fatalf("managed URL write error = %v, marker removed=%v", err, removed)
-		}
-	})
-
-	t.Run("default managed marker read", func(t *testing.T) {
-		testseam.Swap(t, &authReadFile, func(string) ([]byte, error) { return nil, fail })
-		if err := persistAuthLoginMCPBaseURL(t.TempDir(), authpkg.DefaultMCPBaseURL, authLoginMCPUseDefault); !errors.Is(err, fail) {
-			t.Fatalf("managed marker read error = %v", err)
-		}
-	})
-
-	t.Run("missing MCP URL cleans marker", func(t *testing.T) {
-		reads := 0
-		testseam.Swap(t, &authReadFile, func(string) ([]byte, error) {
-			reads++
-			if reads == 1 {
-				return []byte(authpkg.InternationalMCPBaseURL), nil
-			}
-			return nil, os.ErrNotExist
-		})
-		testseam.Swap(t, &authRemove, func(string) error { return nil })
-		if err := persistAuthLoginMCPBaseURL(t.TempDir(), authpkg.DefaultMCPBaseURL, authLoginMCPUseDefault); err != nil {
-			t.Fatalf("missing MCP URL cleanup error = %v", err)
-		}
-	})
-
-	t.Run("MCP URL read", func(t *testing.T) {
-		reads := 0
-		testseam.Swap(t, &authReadFile, func(string) ([]byte, error) {
-			reads++
-			if reads == 1 {
-				return []byte(authpkg.InternationalMCPBaseURL), nil
-			}
-			return nil, fail
-		})
-		if err := persistAuthLoginMCPBaseURL(t.TempDir(), authpkg.DefaultMCPBaseURL, authLoginMCPUseDefault); !errors.Is(err, fail) {
-			t.Fatalf("MCP URL read error = %v", err)
-		}
-	})
-
-	t.Run("default URL write", func(t *testing.T) {
-		testseam.Swap(t, &authReadFile, func(string) ([]byte, error) { return []byte(authpkg.InternationalMCPBaseURL), nil })
-		testseam.Swap(t, &authAtomicWrite, func(string, []byte, os.FileMode) error { return fail })
-		if err := persistAuthLoginMCPBaseURL(t.TempDir(), authpkg.DefaultMCPBaseURL, authLoginMCPUseDefault); !errors.Is(err, fail) {
-			t.Fatalf("default URL write error = %v", err)
-		}
-	})
-
-	t.Run("final marker cleanup", func(t *testing.T) {
-		testseam.Swap(t, &authReadFile, func(string) ([]byte, error) { return []byte(authpkg.InternationalMCPBaseURL), nil })
-		testseam.Swap(t, &authAtomicWrite, func(string, []byte, os.FileMode) error { return nil })
-		testseam.Swap(t, &authRemove, func(string) error { return fail })
-		if err := persistAuthLoginMCPBaseURL(t.TempDir(), authpkg.DefaultMCPBaseURL, authLoginMCPUseDefault); !errors.Is(err, fail) {
-			t.Fatalf("final marker cleanup error = %v", err)
-		}
-	})
-
-	if err := persistAuthLoginMCPBaseURL(t.TempDir(), authpkg.DefaultMCPBaseURL, authLoginMCPPersistence(255)); err == nil {
-		t.Fatal("unsupported MCP persistence mode succeeded")
-	}
-}
-
-func TestCrossPlatformCoverageNormalizeAuthLoginBaseURLTransportSecurity(t *testing.T) {
-	tests := []struct {
-		name    string
-		raw     string
-		wantURL string
-		wantErr string
-	}{
-		{name: "https remote", raw: "https://pre-mcp.example.com/path/?secret=drop#fragment", wantURL: "https://pre-mcp.example.com/path"},
-		{name: "http localhost", raw: "http://localhost:8080/", wantURL: "http://localhost:8080"},
-		{name: "http IPv4 loopback", raw: "http://127.0.0.1:8080", wantURL: "http://127.0.0.1:8080"},
-		{name: "http IPv6 loopback", raw: "http://[::1]:8080", wantURL: "http://[::1]:8080"},
-		{name: "http remote", raw: "http://pre-mcp.example.com", wantErr: "must use HTTPS"},
-		{name: "empty", raw: " ", wantErr: "cannot be empty"},
-		{name: "invalid URL", raw: "https://%", wantErr: "invalid --mcp-url"},
-		{name: "invalid scheme", raw: "ftp://pre-mcp.example.com", wantErr: "must use http or https"},
-		{name: "missing host", raw: "https:///path", wantErr: "must include a host"},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			_, got, err := normalizeAuthLoginBaseURL(tc.raw, "--mcp-url")
-			if tc.wantErr != "" {
-				if err == nil || !strings.Contains(err.Error(), tc.wantErr) {
-					t.Fatalf("normalizeAuthLoginBaseURL error = %v, want containing %q", err, tc.wantErr)
-				}
-				return
-			}
-			if err != nil {
-				t.Fatalf("normalizeAuthLoginBaseURL error = %v", err)
-			}
-			if got != tc.wantURL {
-				t.Fatalf("normalized URL = %q, want %q", got, tc.wantURL)
-			}
-		})
-	}
-}
-
 func TestAuthLoginForcesAuthorizationByDefault(t *testing.T) {
 	if !authLoginForcesAuthorization(authLoginConfig{}) {
 		t.Fatal("auth login should force authorization by default so each login can add an organization profile")

internal/app/coverage_edges_test.go

@@ -36,7 +36,6 @@ import (
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/skillstate"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/transport"
 	upgradepkg "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/upgrade"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/config"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/edition"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/mcptypes"
 	tea "github.com/charmbracelet/bubbletea"
@@ -327,29 +326,6 @@ func TestCrossPlatformCoverageSmallAppRegistryAndRootCoverage(t *testing.T) {
 func TestCrossPlatformCoverageDirectRuntimeCoverage(t *testing.T) {
 	oldEdition := edition.Get()
 	t.Cleanup(func() { edition.Override(oldEdition); SetDynamicServers(nil) })
-	for _, tc := range []struct {
-		raw    string
-		region authpkg.LoginRegion
-		want   string
-	}{
-		{raw: "%", want: "%"},
-		{raw: "https://dingtalk.io/path", want: "https://dingtalk.com/path"},
-		{raw: "https://mcp.dingtalk.com:8443/path", region: authpkg.LoginRegionInternational, want: "https://mcp.dingtalk.io:8443/path"},
-	} {
-		if got := mcpBaseURLForLoginRegion(tc.raw, tc.region); got != tc.want {
-			t.Fatalf("mcpBaseURLForLoginRegion(%q, %q) = %q, want %q", tc.raw, tc.region, got, tc.want)
-		}
-	}
-	if hasDirectRuntimeEndpointOverride("") {
-		t.Fatal("blank product unexpectedly has an endpoint override")
-	}
-	t.Setenv("DINGTALK_COVERAGE_PRODUCT_MCP_URL", "https://override.test")
-	if !hasDirectRuntimeEndpointOverride("coverage-product") {
-		t.Fatal("configured product endpoint override was not detected")
-	}
-	if got := activeDingTalkGatewayEndpointWithBase("https://mcp-gw.dingtalk.com/server/contact", "%"); got != "https://mcp-gw.dingtalk.com/server/contact" {
-		t.Fatalf("invalid gateway base rewrote endpoint to %q", got)
-	}
 	server := mcptypes.ServerDescriptor{
 		Endpoint: "https://one.test",
 		CLI: mcptypes.CLIOverlay{
@@ -937,21 +913,12 @@ func TestCrossPlatformCoverageAuthCommandPureCoverage(t *testing.T) {
 }
 
 func TestCrossPlatformCoverageAuthLoginTokenCommandCoverage(t *testing.T) {
-	t.Setenv(keychain.DisableKeychainEnv, "1")
-	t.Setenv(keychain.StorageDirEnv, t.TempDir())
 	oldInteractive := authLoginInteractiveTerminal
 	authLoginInteractiveTerminal = func() bool { return false }
 	t.Cleanup(func() { authLoginInteractiveTerminal = oldInteractive; authpkg.SetRuntimeProfile("") })
-	for _, tc := range []struct {
-		format        string
-		international bool
-	}{
-		{format: "table"},
-		{format: "json", international: true},
-	} {
-		t.Run(tc.format, func(t *testing.T) {
-			configDir := t.TempDir()
-			t.Setenv("DWS_CONFIG_DIR", configDir)
+	for _, format := range []string{"table", "json"} {
+		t.Run(format, func(t *testing.T) {
+			t.Setenv("DWS_CONFIG_DIR", t.TempDir())
 			root := &cobra.Command{Use: "dws"}
 			root.PersistentFlags().String("format", "table", "")
 			root.PersistentFlags().Bool("yes", false, "")
@@ -962,90 +929,16 @@ func TestCrossPlatformCoverageAuthLoginTokenCommandCoverage(t *testing.T) {
 			root.SetOut(&output)
 			root.SetErr(io.Discard)
 			args := []string{"login", "--token", "manual-token", "--yes"}
-			if tc.international {
-				args = append(args, "--intl")
-			}
-			if tc.format == "json" {
+			if format == "json" {
 				args = append(args, "--format", "json")
 			}
 			root.SetArgs(args)
 			if err := root.Execute(); err != nil || output.Len() == 0 {
 				t.Fatalf("token login = %q %v", output.String(), err)
 			}
-			data, err := authpkg.LoadTokenData(configDir)
-			if err != nil {
-				t.Fatalf("LoadTokenData error = %v", err)
-			}
-			wantRegion := ""
-			if tc.international {
-				wantRegion = string(authpkg.LoginRegionInternational)
-			}
-			if data.LoginRegion != wantRegion {
-				t.Fatalf("LoginRegion = %q, want %q", data.LoginRegion, wantRegion)
-			}
-			if tc.international {
-				snapshot, err := resolveAccessTokenSnapshotFromDir(context.Background(), configDir, "")
-				if err != nil {
-					t.Fatalf("resolveAccessTokenSnapshotFromDir error = %v", err)
-				}
-				gotEndpoint := activeDingTalkGatewayEndpointForLoginRegion(
-					"https://mcp-gw.dingtalk.com/server/contact",
-					snapshot.LoginRegion,
-				)
-				if wantEndpoint := "https://mcp-gw.dingtalk.io/server/contact"; gotEndpoint != wantEndpoint {
-					t.Fatalf("international manual-token endpoint = %q, want %q", gotEndpoint, wantEndpoint)
-				}
-			}
 		})
 	}
 
-	t.Run("international then domestic login restores domestic MCP URL", func(t *testing.T) {
-		configDir := t.TempDir()
-		t.Setenv("DWS_CONFIG_DIR", configDir)
-		runLogin := func(international bool) {
-			t.Helper()
-			root := &cobra.Command{Use: "dws"}
-			root.PersistentFlags().String("format", "table", "")
-			root.PersistentFlags().Bool("yes", false, "")
-			root.PersistentFlags().String("profile", "", "")
-			root.AddCommand(newAuthLoginCommand(nil))
-			args := []string{"login", "--token", "manual-token", "--yes"}
-			if international {
-				args = append(args, "--intl")
-			}
-			root.SetArgs(args)
-			root.SetOut(io.Discard)
-			root.SetErr(io.Discard)
-			if err := root.Execute(); err != nil {
-				t.Fatalf("international=%v login error = %v", international, err)
-			}
-		}
-
-		runLogin(true)
-		if data, err := os.ReadFile(filepath.Join(configDir, "mcp_url")); err != nil || string(data) != authpkg.InternationalMCPBaseURL {
-			t.Fatalf("international mcp_url = %q, %v", string(data), err)
-		}
-		runLogin(false)
-		if data, err := os.ReadFile(filepath.Join(configDir, "mcp_url")); err != nil || string(data) != authpkg.DefaultMCPBaseURL {
-			t.Fatalf("domestic mcp_url = %q, %v", string(data), err)
-		}
-		if _, err := os.Stat(filepath.Join(configDir, config.ManagedMCPURLRegionFileName)); !os.IsNotExist(err) {
-			t.Fatalf("managed MCP region marker remains: %v", err)
-		}
-
-		const customURL = "https://private-mcp.example.com"
-		if err := os.WriteFile(filepath.Join(configDir, "mcp_url"), []byte(customURL), config.FilePerm); err != nil {
-			t.Fatal(err)
-		}
-		runLogin(true)
-		if data, err := os.ReadFile(filepath.Join(configDir, "mcp_url")); err != nil || string(data) != customURL {
-			t.Fatalf("explicit mcp_url after international login = %q, %v; want preserved custom URL", string(data), err)
-		}
-		if _, err := os.Stat(filepath.Join(configDir, config.ManagedMCPURLRegionFileName)); !os.IsNotExist(err) {
-			t.Fatalf("explicit mcp_url acquired a managed marker: %v", err)
-		}
-	})
-
 	for _, hidden := range []bool{false, true} {
 		old := edition.Get()
 		edition.Override(&edition.Hooks{HideAuthLogin: hidden})

internal/app/direct_runtime.go

@@ -74,20 +74,6 @@ func defaultPATMCPEndpoint() string {
 
 func defaultPATGatewayBaseURL() string {
 	raw := strings.TrimSpace(authpkg.GetMCPBaseURL())
-	return mcpGatewayBaseURL(raw)
-}
-
-func defaultPATGatewayBaseURLForLoginRegion(region authpkg.LoginRegion) string {
-	raw := strings.TrimSpace(authpkg.GetMCPBaseURL())
-	if override := authpkg.MCPBaseURLOverride(); override != "" {
-		raw = override
-	} else {
-		raw = mcpBaseURLForLoginRegion(raw, region)
-	}
-	return mcpGatewayBaseURL(raw)
-}
-
-func mcpGatewayBaseURL(raw string) string {
 	parsed, err := url.Parse(raw)
 	if err != nil || parsed.Scheme == "" || parsed.Host == "" {
 		return strings.TrimRight(raw, "/")
@@ -114,33 +100,6 @@ func mcpGatewayBaseURL(raw string) string {
 	return strings.TrimRight(parsed.String(), "/")
 }
 
-func mcpBaseURLForLoginRegion(raw string, region authpkg.LoginRegion) string {
-	parsed, err := url.Parse(strings.TrimSpace(raw))
-	if err != nil || parsed.Scheme == "" || parsed.Host == "" {
-		return raw
-	}
-	host := strings.ToLower(parsed.Hostname())
-	fromSuffix, toSuffix := ".dingtalk.io", ".dingtalk.com"
-	if region.IsInternational() {
-		fromSuffix, toSuffix = toSuffix, fromSuffix
-	}
-	bareFrom := strings.TrimPrefix(fromSuffix, ".")
-	if host != bareFrom && !strings.HasSuffix(host, fromSuffix) {
-		return raw
-	}
-	if host == bareFrom {
-		host = strings.TrimPrefix(toSuffix, ".")
-	} else {
-		host = strings.TrimSuffix(host, fromSuffix) + toSuffix
-	}
-	if port := parsed.Port(); port != "" {
-		parsed.Host = net.JoinHostPort(host, port)
-	} else {
-		parsed.Host = host
-	}
-	return parsed.String()
-}
-
 // SetDynamicServers injects server data discovered from servers.json.
 // All product endpoints are resolved dynamically from this data.
 func SetDynamicServers(servers []mcptypes.ServerDescriptor) {
@@ -172,7 +131,7 @@ func registerDynamicServer(server mcptypes.ServerDescriptor, endpoints map[strin
 		return
 	}
 	id := strings.TrimSpace(server.CLI.ID)
-	endpoint := activeDingTalkGatewayEndpoint(server.Endpoint)
+	endpoint := strings.TrimSpace(server.Endpoint)
 	if id != "" && endpoint != "" {
 		endpoints[id] = endpoint
 		products[id] = true
@@ -303,19 +262,6 @@ func directRuntimeEndpoint(productID, toolName string) (string, bool) {
 	return "", false
 }
 
-func hasDirectRuntimeEndpointOverride(productID string) bool {
-	normalized := normalizeDirectRuntimeProductID(productID)
-	for _, candidate := range []string{strings.TrimSpace(productID), normalized} {
-		if candidate == "" {
-			continue
-		}
-		if _, ok := productEndpointOverride(candidate); ok {
-			return true
-		}
-	}
-	return false
-}
-
 func editionServerEndpoint(productID string) (string, bool) {
 	productID = strings.TrimSpace(productID)
 	if productID == "" {
@@ -336,7 +282,7 @@ func endpointFromEditionServers(productID string, fn func() []edition.ServerInfo
 		return "", false
 	}
 	for _, server := range fn() {
-		endpoint := activeDingTalkGatewayEndpoint(server.Endpoint)
+		endpoint := strings.TrimSpace(server.Endpoint)
 		if endpoint == "" {
 			continue
 		}
@@ -352,46 +298,6 @@ func endpointFromEditionServers(productID string, fn func() []edition.ServerInfo
 	return "", false
 }
 
-func activeDingTalkGatewayEndpoint(endpoint string) string {
-	return activeDingTalkGatewayEndpointWithBase(endpoint, defaultPATGatewayBaseURL())
-}
-
-func activeDingTalkGatewayEndpointForLoginRegion(endpoint string, region authpkg.LoginRegion) string {
-	return activeDingTalkGatewayEndpointWithBase(endpoint, defaultPATGatewayBaseURLForLoginRegion(region))
-}
-
-func activeDingTalkGatewayEndpointWithBase(endpoint, gatewayBaseURL string) string {
-	endpoint = strings.TrimSpace(endpoint)
-	parsed, err := url.Parse(endpoint)
-	if err != nil || parsed.Scheme == "" || parsed.Host == "" {
-		return endpoint
-	}
-	if !isDingTalkMCPGatewayHost(parsed.Hostname()) {
-		return endpoint
-	}
-	base, err := url.Parse(gatewayBaseURL)
-	if err != nil || base.Scheme == "" || base.Host == "" {
-		return endpoint
-	}
-	parsed.Scheme = base.Scheme
-	parsed.Host = base.Host
-	return strings.TrimRight(parsed.String(), "/")
-}
-
-func isDingTalkMCPGatewayHost(host string) bool {
-	switch strings.ToLower(strings.TrimSpace(host)) {
-	case "mcp-gw.dingtalk.com", "pre-mcp-gw.dingtalk.com", "mcp-gw.dingtalk.io", "pre-mcp-gw.dingtalk.io":
-		return true
-	default:
-		return false
-	}
-}
-
-func isDingTalkMCPGatewayEndpoint(endpoint string) bool {
-	parsed, err := url.Parse(strings.TrimSpace(endpoint))
-	return err == nil && isDingTalkMCPGatewayHost(parsed.Hostname())
-}
-
 // DirectRuntimeProductIDs returns product IDs that should stay visible for
 // direct runtime execution. Dynamic products come from MCP discovery/plugin
 // registration; built-in helper products such as devapp resolve their endpoint

internal/app/flag_error_test.go

@@ -82,46 +82,6 @@ func TestFlagErrorWithSuggestions_unknownFlagHintAndFlags(t *testing.T) {
 	}
 }
 
-func TestFlagErrorWithSuggestionsChatFromExplainsBothMeanings(t *testing.T) {
-	t.Parallel()
-	root := &cobra.Command{Use: "dws"}
-	chat := &cobra.Command{Use: "chat"}
-	search := &cobra.Command{Use: "+search-msg", Run: func(*cobra.Command, []string) {}}
-	search.Flags().String("sender", "", "sender target")
-	search.Flags().String("start", "", "start time")
-	root.AddCommand(chat)
-	chat.AddCommand(search)
-
-	orig := fmt.Errorf("unknown flag: --from")
-	err := flagErrorWithSuggestions(search, orig)
-	var ae *apperrors.Error
-	if !stderrors.As(err, &ae) {
-		t.Fatalf("want *apperrors.Error, got %T", err)
-	}
-	if ae.Reason != "ambiguous_flag" || !strings.Contains(ae.Hint, "--sender") || !strings.Contains(ae.Hint, "--start") {
-		t.Fatalf("structured error = reason %q hint %q", ae.Reason, ae.Hint)
-	}
-	if !strings.HasSuffix(ae.Message, "See 'dws chat +search-msg --help' for usage.") {
-		t.Fatalf("Message = %q", ae.Message)
-	}
-
-	for _, flag := range []string{"from-file", "from-user"} {
-		t.Run(flag, func(t *testing.T) {
-			err := flagErrorWithSuggestions(search, fmt.Errorf("unknown flag: --%s", flag))
-			var structured *apperrors.Error
-			if stderrors.As(err, &structured) && structured.Reason == "ambiguous_flag" {
-				t.Fatalf("--%s incorrectly used --from ambiguity handling: %#v", flag, structured)
-			}
-			if strings.Contains(err.Error(), "--from 在消息查询中含义不明确") {
-				t.Fatalf("--%s incorrectly received --from ambiguity hint: %v", flag, err)
-			}
-			if !strings.Contains(err.Error(), "unknown flag: --"+flag) {
-				t.Fatalf("error = %q, want original flag --%s", err, flag)
-			}
-		})
-	}
-}
-
 // TestFlagErrorWithSuggestions_fallbackTailHint 验证 fallback 路径（非 unknown flag 类错误，
 // 如 missing required flag / ambiguous shorthand）也带尾部 See '<cmd> --help' for usage.
 // 这是 wukong / docker / kubectl 的通用 UX——任何 flag 解析错误都给用户一条 help 入口。

internal/app/param_alias_e2e_test.go

@@ -68,45 +68,6 @@ func (c *paramAliasCaptureCaller) paramAliasResponseForTool(tool string) string
 		return `{"result":[{"templateId":"fixture-template-id"}]}`
 	case "create_document":
 		return `{"nodeId":"fixture-node"}`
-	case "list_files":
-		return `{"success":true,"result":{"files":[],"hasMore":false}}`
-	case "list_recycle_items":
-		return `{"success":true,"result":{"recycleItems":[{"recycleItemId":"recycle-1","originalName":"Fixture Node"}],"hasMore":false}}`
-	case "get_star_list":
-		return `{"success":true,"result":{"starList":[],"hasMore":false}}`
-	case "list_file_versions":
-		return `{"success":true,"result":{"versions":[{"version":3,"name":"Fixture Version"}],"hasMore":false}}`
-	case "get_file_info":
-		name := "Fixture Node"
-		for index := len(c.calls) - 2; index >= 0; index-- {
-			call := c.calls[index]
-			switch call.tool {
-			case "create_folder":
-				if value, ok := call.args["name"].(string); ok {
-					name = value
-				}
-				index = -1
-			case "rename_document":
-				if value, ok := call.args["newName"].(string); ok {
-					name = value
-				}
-				index = -1
-			}
-		}
-		encoded, _ := json.Marshal(map[string]any{"success": true, "result": map[string]any{"fileId": "node-1", "name": name}})
-		return string(encoded)
-	case "get_cover", "get_node_stats":
-		return `{"success":true,"result":{"nodeId":"node-1"}}`
-	case "get_file_publish_status":
-		return `{"success":true,"result":{"fileId":"node-1","published":false}}`
-	case "create_folder", "create_shortcut":
-		return `{"success":true,"fileId":"node-1"}`
-	case "delete_document", "mark_star", "unmark_star", "restore_recycle_item", "rename_document", "revert_file_version":
-		return `{"success":true,"fileId":"node-1"}`
-	case "set_file_publish":
-		return `{"success":true}`
-	case "download_file", "download_file_version":
-		return `{"success":true,"result":{"downloadUrl":"http://invalid.test/fixture.bin","fileName":"fixture.bin"}}`
 	case "get_document_content":
 		for index := len(c.calls) - 2; index >= 0; index-- {
 			call := c.calls[index]
@@ -361,9 +322,9 @@ func TestCrossPlatformCoverageParamAliasWriteCommandFinalPayload(t *testing.T) {
 	caller := &paramAliasCaptureCaller{}
 	ctx, err := executeParamAliasE2E(t, caller,
 		"chat", "message", "send",
-		"--to-user", appFixtureCurrentDOpenID,
+		"--to-user", "D-recipient",
 		"--text", "hello alias",
-		"--idempotency-key", "alias-e2e",
+		"--uuid", "alias-e2e",
 	)
 	if err != nil {
 		t.Fatalf("chat write alias E2E error = %v", err)
@@ -375,7 +336,7 @@ func TestCrossPlatformCoverageParamAliasWriteCommandFinalPayload(t *testing.T) {
 		t.Fatalf("chat calls = %#v", caller.calls)
 	}
 	payload := caller.calls[0].args
-	if payload["receiverOpenDingTalkId"] != appFixtureCurrentDOpenID || payload["uuid"] != "alias-e2e" || payload["msgType"] != "markdown" {
+	if payload["receiverOpenDingTalkId"] != "D-recipient" || payload["uuid"] != "alias-e2e" || payload["msgType"] != "markdown" {
 		t.Fatalf("chat payload identity fields = %#v", payload)
 	}
 	content, _ := payload["content"].(string)
@@ -389,29 +350,6 @@ func TestCrossPlatformCoverageParamAliasWriteCommandFinalPayload(t *testing.T) {
 	}
 }
 
-func TestCrossPlatformCoverageChatMessageSendLegacyUUIDAliasFinalPayload(t *testing.T) {
-	caller := &paramAliasCaptureCaller{}
-	_, err := executeParamAliasE2E(t, caller,
-		"chat", "message", "send",
-		"--group", "fixture-conversation",
-		"--text", "hello legacy uuid",
-		"--uuid", "legacy-alias-e2e",
-	)
-	if err != nil {
-		t.Fatalf("chat message send legacy uuid error = %v", err)
-	}
-	if len(caller.calls) != 1 || caller.calls[0].tool != "send_personal_message" {
-		t.Fatalf("chat calls = %#v", caller.calls)
-	}
-	payload := caller.calls[0].args
-	if payload["uuid"] != "legacy-alias-e2e" || payload["openConversationId"] != "fixture-conversation" {
-		t.Fatalf("chat legacy uuid payload = %#v", payload)
-	}
-	if _, exists := payload["idempotency-key"]; exists {
-		t.Fatalf("chat payload leaked CLI-only idempotency-key: %#v", payload)
-	}
-}
-
 func TestCrossPlatformCoverageChatReactionConversationAliasesReachCanonicalPayload(t *testing.T) {
 	tests := []struct {
 		name     string
@@ -479,11 +417,7 @@ func TestCrossPlatformCoverageChatReactionConversationAliasesReachCanonicalPaylo
 					if err != nil {
 						t.Fatalf("alias execution failed: %v", err)
 					}
-					if alias == "open-conversation-id" {
-						if ctx == nil || len(ctx.Corrections) != 0 {
-							t.Fatalf("alias corrections = %#v", ctx)
-						}
-					} else if ctx == nil || len(ctx.Corrections) != 1 || ctx.Corrections[0].Original != "--"+alias || ctx.Corrections[0].Corrected != "--conversation-id" {
+					if ctx == nil || len(ctx.Corrections) != 1 || ctx.Corrections[0].Original != "--"+alias || ctx.Corrections[0].Corrected != "--conversation-id" {
 						t.Fatalf("alias corrections = %#v", ctx)
 					}
 					if !reflect.DeepEqual(aliasCaller.calls, canonicalCaller.calls) {
@@ -693,11 +627,11 @@ func TestCrossPlatformCoverageSelectedParamAliasesProduceCanonicalEquivalentDryR
 			tool: "send_personal_message",
 			canonicalArgs: []string{
 				"--dry-run", "chat", "message", "send",
-				"--user", appFixtureCurrentDOpenID, "--text", "hello dry-run", "--uuid", "alias-dry-run",
+				"--user", "D-recipient", "--text", "hello dry-run", "--uuid", "alias-dry-run",
 			},
 			aliasArgs: []string{
 				"--dry-run", "chat", "message", "send",
-				"--to-user", appFixtureCurrentDOpenID, "--text", "hello dry-run", "--uuid", "alias-dry-run",
+				"--to-user", "D-recipient", "--text", "hello dry-run", "--uuid", "alias-dry-run",
 			},
 			wantCorrections: 1,
 			wantArgKeys:     []string{"clawType", "content", "msgType", "receiverOpenDingTalkId", "uuid"},

internal/app/param_alias_payload_equivalence_test.go

@@ -4,21 +4,14 @@
 package app
 
 import (
-	"errors"
 	"reflect"
 	"strings"
 	"testing"
 
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/cli"
-	apperrors "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/errors"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/pipeline"
 )
 
-const (
-	appFixtureCurrentDOpenID  = "DAAAAAAAAAAAiE"
-	appFixtureCurrentDOpenID2 = "DAQEBAQEBAQEiE"
-)
-
 // paramAliasCompleteCommands is deliberately keyed by the exact reviewed
 // fixture command path. Every argv is a complete, business-valid invocation:
 // required companion flags are present, time and enum values are valid, and
@@ -39,12 +32,12 @@ var paramAliasCompleteCommands = map[string][]string{
 	"chat +chat-messages":                      {"chat", "+chat-messages", "--group", "fixture-conversation"},
 	"chat +chat-add-bot":                       {"chat", "+chat-add-bot", "--id", "fixture-conversation", "--robot-code", "robot-1", "--yes"},
 	"chat +chat-audit-join":                    {"chat", "+chat-audit-join", "--group", "fixture-conversation", "--record-id", "7", "--applicant", "user-1", "--inviter", "user-2", "--status", "AuditApprove", "--yes"},
-	"chat +chat-members-get":                   {"chat", "+chat-members-get", "--id", "fixture-conversation", "--users", appFixtureCurrentDOpenID + "," + appFixtureCurrentDOpenID2},
+	"chat +chat-members-get":                   {"chat", "+chat-members-get", "--id", "fixture-conversation", "--users", "D-user-1,D-user-2"},
 	"chat +chat-members-list":                  {"chat", "+chat-members-list", "--conversation-id", "fixture-conversation", "--member-types", "user,bot"},
-	"chat +chat-mute-member":                   {"chat", "+chat-mute-member", "--group", "fixture-conversation", "--users", appFixtureCurrentDOpenID + "," + appFixtureCurrentDOpenID2, "--mute-time", "3600000", "--yes"},
+	"chat +chat-mute-member":                   {"chat", "+chat-mute-member", "--group", "fixture-conversation", "--users", "D-user-1,D-user-2", "--mute-time", "3600000", "--yes"},
 	"chat +chat-remove-bot":                    {"chat", "+chat-remove-bot", "--id", "fixture-conversation", "--bot-id", "bot-1", "--yes"},
-	"chat +chat-role-remove-user":              {"chat", "+chat-role-remove-user", "--group", "fixture-conversation", "--user", appFixtureCurrentDOpenID, "--role-ids", "role-1", "--yes"},
-	"chat +chat-transfer-owner":                {"chat", "+chat-transfer-owner", "--group", "fixture-conversation", "--new-owner", appFixtureCurrentDOpenID, "--yes"},
+	"chat +chat-role-remove-user":              {"chat", "+chat-role-remove-user", "--group", "fixture-conversation", "--user", "D-user-1", "--role-ids", "role-1", "--yes"},
+	"chat +chat-transfer-owner":                {"chat", "+chat-transfer-owner", "--group", "fixture-conversation", "--new-owner", "D-user-1", "--yes"},
 	"chat +chat-update":                        {"chat", "+chat-update", "--group", "fixture-conversation", "--name", "Fixture Renamed Group", "--yes"},
 	"chat +bot-find":                           {"chat", "+bot-find", "--query", "fixture", "--limit", "7"},
 	"chat +bot-search":                         {"chat", "+bot-search", "--name", "Fixture Bot", "--page", "2", "--size", "7"},
@@ -62,7 +55,7 @@ var paramAliasCompleteCommands = map[string][]string{
 	"chat +messages-list":                      {"chat", "+messages-list", "--group", "fixture-conversation", "--time", "2026-03-10 00:00:00", "--limit", "7"},
 	"chat +messages-list-direct":               {"chat", "+messages-list-direct", "--user", "user-1", "--time", "2026-03-10 00:00:00", "--limit", "7"},
 	"chat +messages-list-unread-conversations": {"chat", "+messages-list-unread-conversations", "--count", "7", "--exclude-muted"},
-	"chat +messages-reply":                     {"chat", "+messages-reply", "--conversation-id", "fixture-conversation", "--ref-msg-id", "message-1", "--ref-sender", appFixtureCurrentDOpenID, "--text", "hello fixture", "--yes"},
+	"chat +messages-reply":                     {"chat", "+messages-reply", "--conversation-id", "fixture-conversation", "--ref-msg-id", "message-1", "--ref-sender", "D-sender", "--text", "hello fixture", "--yes"},
 	"chat +messages-resource-download":         {"chat", "+messages-resource-download", "--resource-id", "resource-1", "--message-id", "message-1", "--open-conversation-id", "fixture-conversation", "--output", "downloads/fixture.bin"},
 	"chat +messages-set-pin":                   {"chat", "+messages-set-pin", "--open-conversation-id", "fixture-conversation", "--msg-id", "message-1", "--yes"},
 	"chat +messages-send-by-webhook":           {"chat", "+messages-send-by-webhook", "--token", "fixture-token", "--title", "Fixture Alert", "--text", "fixture", "--at-users", "user-1,user-2", "--yes"},
@@ -75,10 +68,10 @@ var paramAliasCompleteCommands = map[string][]string{
 	"chat category create-smart":               {"chat", "category", "create-smart", "--name", "Fixture Smart Category", "--keywords", "fixture,priority", "--yes"},
 	"chat category rename":                     {"chat", "category", "rename", "--category-id", "7", "--title", "Renamed Cat", "--yes"},
 	"chat group members":                       {"chat", "group", "members", "--id", "fixture-conversation"},
-	"chat group members add":                   {"chat", "group", "members", "add", "--id", "fixture-conversation", "--users", appFixtureCurrentDOpenID},
+	"chat group members add":                   {"chat", "group", "members", "add", "--id", "fixture-conversation", "--users", "D-user-1"},
 	"chat group members add-bot":               {"chat", "group", "members", "add-bot", "--id", "fixture-conversation", "--robot-code", "robot-1", "--yes"},
-	"chat group members list-by-ids":           {"chat", "group", "members", "list-by-ids", "--id", "fixture-conversation", "--users", appFixtureCurrentDOpenID + "," + appFixtureCurrentDOpenID2},
-	"chat group members remove":                {"chat", "group", "members", "remove", "--id", "fixture-conversation", "--users", appFixtureCurrentDOpenID, "--yes"},
+	"chat group members list-by-ids":           {"chat", "group", "members", "list-by-ids", "--id", "fixture-conversation", "--users", "D-user-1,D-user-2"},
+	"chat group members remove":                {"chat", "group", "members", "remove", "--id", "fixture-conversation", "--users", "D-user-1", "--yes"},
 	"chat group members remove-bot":            {"chat", "group", "members", "remove-bot", "--id", "fixture-conversation", "--bot-id", "bot-1", "--yes"},
 	"chat group rename":                        {"chat", "group", "rename", "--id", "fixture-conversation", "--name", "Fixture Renamed Group", "--yes"},
 	"chat group set-admin":                     {"chat", "group", "set-admin", "--group", "fixture-conversation", "--user", "user-1", "--yes"},
@@ -93,9 +86,9 @@ var paramAliasCompleteCommands = map[string][]string{
 	"chat message list-by-ids":                 {"chat", "message", "list-by-ids", "--msg-ids", "message-1,message-2"},
 	"chat message list-unread-conversations":   {"chat", "message", "list-unread-conversations", "--count", "7", "--exclude-muted"},
 	"chat message recall":                      {"chat", "message", "recall", "--conversation-id", "fixture-conversation", "--msg-id", "message-1", "--yes"},
-	"chat message reply":                       {"chat", "message", "reply", "--conversation-id", "fixture-conversation", "--ref-msg-id", "message-1", "--ref-sender", appFixtureCurrentDOpenID, "--text", "hello fixture", "--yes"},
+	"chat message reply":                       {"chat", "message", "reply", "--conversation-id", "fixture-conversation", "--ref-msg-id", "message-1", "--ref-sender", "D-sender", "--text", "hello fixture", "--yes"},
 	"chat message search-advanced":             {"chat", "message", "search-advanced", "--conversation-ids", "fixture-conversation", "--query", "fixture"},
-	"chat message send":                        {"chat", "message", "send", "--user", appFixtureCurrentDOpenID, "--text", "hello fixture", "--idempotency-key", "param-alias-equivalence", "--yes"},
+	"chat message send":                        {"chat", "message", "send", "--user", "D-recipient", "--text", "hello fixture", "--uuid", "param-alias-equivalence", "--yes"},
 	"chat message send-by-bot":                 {"chat", "message", "send-by-bot", "--robot-code", "robot-1", "--group", "fixture-conversation", "--title", "Fixture Alert", "--text", "@user-1 @user-2 fixture", "--at-user-ids", "user-1,user-2", "--yes"},
 	"chat message send-by-webhook":             {"chat", "message", "send-by-webhook", "--token", "fixture-token", "--title", "Fixture Alert", "--text", "fixture", "--at-users", "user-1,user-2", "--yes"},
 	"contact +dept-members":                    {"contact", "+dept-members", "--dept", "Fixture Dept"},
@@ -131,7 +124,6 @@ var paramAliasCompleteCommands = map[string][]string{
 	"doc +version-revert":                      {"doc", "+version-revert", "--node", "node-1", "--version", "3", "--yes"},
 	"doc +version-save":                        {"doc", "+version-save", "--node", "node-1", "--yes"},
 	"doc +update":                              {"doc", "+update", "--node", "node-1", "--command", "overwrite", "--content", `["root",{}]`, "--doc-format", "jsonml", "--expected-revision", "1", "--yes"},
-	"doc +export":                              {"doc", "+export", "--node", "node-1", "--export-format", "docx", "--output", "exports/fixture.docx"},
 	"doc block insert":                         {"doc", "block", "insert", "--node", "node-1", "--text", "fixture paragraph", "--yes"},
 	"doc block update":                         {"doc", "block", "update", "--node", "node-1", "--block-id", "block-1", "--text", "fixture paragraph", "--yes"},
 	"doc comment create":                       {"doc", "comment", "create", "--node", "node-1", "--content", "fixture comment", "--yes"},
@@ -139,43 +131,9 @@ var paramAliasCompleteCommands = map[string][]string{
 	"doc comment delete":                       {"doc", "comment", "delete", "--node", "node-1", "--comment-key", "comment-1", "--yes"},
 	"doc comment reply":                        {"doc", "comment", "reply", "--node", "node-1", "--comment-key", "comment-1", "--content", "fixture reply", "--mentioned-open-conversation-id", "cid-1,cid-2", "--yes"},
 	"doc comment update":                       {"doc", "comment", "update", "--node", "node-1", "--comment-key", "comment-1", "--content", "fixture update", "--yes"},
-	"doc create":                               {"doc", "create", "--name", "Fixture Document", "--workspace", "workspace-1"},
 	"doc version revert":                       {"doc", "version", "revert", "--node", "node-1", "--version", "3", "--yes"},
-	"drive +cover":                             {"drive", "+cover", "--node", "node-1"},
-	"drive +create-folder":                     {"drive", "+create-folder", "--name", "Fixture Folder", "--space-id", "space-1", "--folder", "folder-1"},
-	"drive +create-shortcut":                   {"drive", "+create-shortcut", "--node", "node-1", "--folder", "folder-1", "--workspace", "workspace-1"},
-	"drive +delete":                            {"drive", "+delete", "--node", "node-1", "--yes"},
-	"drive +download":                          {"drive", "+download", "--node", "node-1", "--space-id", "space-1", "--output", "downloads/fixture.bin"},
-	"drive +info":                              {"drive", "+info", "--node", "node-1", "--space-id", "space-1"},
-	"drive +inspect":                           {"drive", "+inspect", "--node", "node-1", "--space-id", "space-1", "--include-stats"},
-	"drive +list":                              {"drive", "+list", "--space-id", "space-1", "--folder", "folder-1", "--limit", "7", "--cursor", "cursor-1", "--order-by", "name", "--order", "asc"},
-	"drive +publish-get":                       {"drive", "+publish-get", "--node", "node-1"},
-	"drive +publish-unset":                     {"drive", "+publish-unset", "--node", "node-1", "--yes"},
-	"drive +recycle-list":                      {"drive", "+recycle-list", "--space-id", "space-1", "--limit", "7", "--cursor", "cursor-1"},
-	"drive +recycle-restore":                   {"drive", "+recycle-restore", "--id", "recycle-1", "--yes"},
-	"drive +rename":                            {"drive", "+rename", "--node", "node-1", "--name", "Fixture Renamed", "--yes"},
-	"drive +search":                            {"drive", "+search", "--query", "fixture"},
-	"drive +star-add":                          {"drive", "+star-add", "--node", "node-1"},
-	"drive +star-list":                         {"drive", "+star-list", "--limit", "7", "--cursor", "cursor-1"},
-	"drive +star-remove":                       {"drive", "+star-remove", "--node", "node-1"},
-	"drive +stats":                             {"drive", "+stats", "--node", "node-1"},
-	"drive +upload":                            {"drive", "+upload", "--file", "param_alias_payload_equivalence_test.go", "--file-name", "fixture.txt", "--mime-type", "text/plain", "--space-id", "space-1", "--node", "node-1", "--yes"},
-	"drive +version-download":                  {"drive", "+version-download", "--node", "node-1", "--version", "3", "--output", "downloads/fixture-v3.bin"},
-	"drive +version-get":                       {"drive", "+version-get", "--node", "node-1", "--version", "3"},
-	"drive +version-history":                   {"drive", "+version-history", "--node", "node-1", "--limit", "7", "--cursor", "cursor-1"},
-	"drive +version-revert":                    {"drive", "+version-revert", "--node", "node-1", "--version", "3", "--yes"},
-	"drive commit":                             {"drive", "commit", "--file-name", "fixture.txt", "--file-size", "7", "--upload-id", "upload-1", "--space-id", "space-1"},
-	"drive copy":                               {"drive", "copy", "--node", "node-1", "--folder", "folder-1"},
-	"drive download":                           {"drive", "download", "--node", "node-1", "--output", "downloads/fixture.bin", "--version", "3", "--space-id", "space-1"},
 	"drive info":                               {"drive", "info", "--node", "node-1", "--space-id", "space-1"},
 	"drive list":                               {"drive", "list", "--folder", "folder-1", "--limit", "7"},
-	"drive mkdir":                              {"drive", "mkdir", "--name", "Fixture Folder", "--space-id", "space-1"},
-	"drive permission add":                     {"drive", "permission", "add", "--node", "node-1", "--users", "user-1,user-2", "--role", "READER"},
-	"drive recycle list":                       {"drive", "recycle", "list", "--space-id", "space-1", "--limit", "7"},
-	"drive recycle restore":                    {"drive", "recycle", "restore", "--id", "recycle-1"},
-	"drive search":                             {"drive", "search", "--query", "fixture", "--created-from", "1", "--created-to", "2", "--modified-from", "3", "--modified-to", "4", "--creator-uids", "user-1,user-2"},
-	"drive upload":                             {"drive", "upload", "--file", "../../go.mod", "--space-id", "space-1"},
-	"drive upload-info":                        {"drive", "upload-info", "--file-name", "fixture.txt", "--file-size", "7", "--space-id", "space-1"},
 	"mail +find-mail-user":                     {"mail", "+find-mail-user", "--query", "fixture", "--limit", "7"},
 	"mail folder update":                       {"mail", "folder", "update", "--email", "fixture@example.com", "--id", "folder-1", "--name", "Fixture Folder", "--yes"},
 	"mail message search":                      {"mail", "message", "search", "--email", "fixture@example.com", "--query", "subject:fixture"},
@@ -198,29 +156,15 @@ var paramAliasCompleteCommandVariants = map[string]map[string][]string{
 	"doc block insert": {
 		"parent-block": {"doc", "block", "insert", "--node", "node-1", "--parent-block", "parent-block-1", "--index", "0", "--text", "fixture paragraph", "--yes"},
 	},
-	"doc +inspect": {
-		"include-permissions": {"doc", "+inspect", "--node", "node-1", "--include-permissions"},
-	},
-	"doc +search": {
-		"created-from": {"doc", "+search", "--query", "fixture", "--created-from", "1"},
-		"created-to":   {"doc", "+search", "--query", "fixture", "--created-to", "2"},
-		"creator-uids": {"doc", "+search", "--query", "fixture", "--creator-uids", "user-1,user-2"},
-	},
-	"drive list": {
-		"workspace": {"drive", "list", "--workspace", "workspace-1", "--limit", "7"},
-		"order-by":  {"drive", "list", "--folder", "folder-1", "--order-by", "name", "--limit", "7"},
-		"space-id":  {"drive", "list", "--space-id", "space-1", "--limit", "7"},
-		"order":     {"drive", "list", "--folder", "folder-1", "--order", "asc", "--limit", "7"},
-	},
 	"chat message list": {
 		"user": {"chat", "message", "list", "--user", "user-1", "--time", "2026-03-10 00:00:00", "--limit", "7"},
 	},
 	"chat message list-by-sender": {
-		"sender-open-dingtalk-id": {"chat", "message", "list-by-sender", "--sender-open-dingtalk-id", appFixtureCurrentDOpenID, "--start", "2026-03-10T00:00:00+08:00", "--end", "2026-03-11T00:00:00+08:00", "--limit", "7", "--cursor", "0"},
+		"sender-open-dingtalk-id": {"chat", "message", "list-by-sender", "--sender-open-dingtalk-id", "D-sender", "--start", "2026-03-10T00:00:00+08:00", "--end", "2026-03-11T00:00:00+08:00", "--limit", "7", "--cursor", "0"},
 	},
 	"chat message send": {
-		"group":     {"chat", "message", "send", "--group", "fixture-conversation", "--text", "hello fixture", "--idempotency-key", "param-alias-equivalence-group", "--yes"},
-		"file-path": {"chat", "message", "send", "--group", "fixture-conversation", "--msg-type", "file", "--file-path", "../../go.mod", "--dentry-id", "1", "--space-id", "2", "--idempotency-key", "param-alias-equivalence-file", "--yes"},
+		"group":     {"chat", "message", "send", "--group", "fixture-conversation", "--text", "hello fixture", "--uuid", "param-alias-equivalence-group", "--yes"},
+		"file-path": {"chat", "message", "send", "--group", "fixture-conversation", "--msg-type", "file", "--file-path", "../../go.mod", "--dentry-id", "1", "--space-id", "2", "--uuid", "param-alias-equivalence-file", "--yes"},
 	},
 	"chat +conversation-set-top": {
 		"conversation-ids": {"chat", "+conversation-set-top", "--conversation-ids", "fixture-conversation-1,fixture-conversation-2", "--yes"},
@@ -297,105 +241,12 @@ var paramAliasNewIMCases = []struct {
 	{command: "chat +messages-set-pin", emitted: "conversation-id", canonical: "open-conversation-id"},
 }
 
-// paramAliasNewDriveCases is the exact executable-alias set introduced by the
-// reviewed Drive expansion. Guard fixtures are covered separately by the
-// exhaustive runtime-contract tests; every entry here must preserve the final
-// transport payload of its canonical spelling.
-var paramAliasNewDriveCases = []struct {
-	command   string
-	emitted   string
-	canonical string
-}{
-	{command: "drive +cover", emitted: "dentry-uuid", canonical: "node"},
-	{command: "drive +create-folder", emitted: "folder-name", canonical: "name"},
-	{command: "drive +create-folder", emitted: "storage-space-id", canonical: "space-id"},
-	{command: "drive +create-shortcut", emitted: "source-file-id", canonical: "node"},
-	{command: "drive +create-shortcut", emitted: "target-folder-id", canonical: "folder"},
-	{command: "drive +create-shortcut", emitted: "target-workspace-id", canonical: "workspace"},
-	{command: "drive +delete", emitted: "file-id", canonical: "node"},
-	{command: "drive +download", emitted: "dentry-uuid", canonical: "node"},
-	{command: "drive +download", emitted: "destination-path", canonical: "output"},
-	{command: "drive +inspect", emitted: "include-statistics", canonical: "include-stats"},
-	{command: "drive +list", emitted: "folder-id", canonical: "folder"},
-	{command: "drive +list", emitted: "page-size", canonical: "limit"},
-	{command: "drive +list", emitted: "next-token", canonical: "cursor"},
-	{command: "drive +list", emitted: "sort-direction", canonical: "order"},
-	{command: "drive +list", emitted: "sort-by", canonical: "order-by"},
-	{command: "drive +publish-get", emitted: "dentry-uuid", canonical: "node"},
-	{command: "drive +publish-unset", emitted: "file-id", canonical: "node"},
-	{command: "drive +recycle-list", emitted: "storage-space-id", canonical: "space-id"},
-	{command: "drive +recycle-list", emitted: "page-token", canonical: "cursor"},
-	{command: "drive +recycle-restore", emitted: "recycle-item-id", canonical: "id"},
-	{command: "drive +rename", emitted: "file-id", canonical: "node"},
-	{command: "drive +rename", emitted: "new-name", canonical: "name"},
-	{command: "drive +star-add", emitted: "dentry-uuid", canonical: "node"},
-	{command: "drive +star-list", emitted: "max-results", canonical: "limit"},
-	{command: "drive +star-remove", emitted: "file-id", canonical: "node"},
-	{command: "drive +stats", emitted: "dentry-uuid", canonical: "node"},
-	{command: "drive +upload", emitted: "source-file", canonical: "file"},
-	{command: "drive +upload", emitted: "name", canonical: "file-name"},
-	{command: "drive +upload", emitted: "overwrite-node-id", canonical: "node"},
-	{command: "drive +version-download", emitted: "version-number", canonical: "version"},
-	{command: "drive +version-download", emitted: "save-path", canonical: "output"},
-	{command: "drive +version-get", emitted: "version-no", canonical: "version"},
-	{command: "drive +version-history", emitted: "next-cursor", canonical: "cursor"},
-	{command: "drive +version-history", emitted: "page-size", canonical: "limit"},
-	{command: "drive +version-revert", emitted: "version-number", canonical: "version"},
-	{command: "drive +cover", emitted: "node-id", canonical: "node"},
-	{command: "drive +create-shortcut", emitted: "node-id", canonical: "node"},
-	{command: "drive +delete", emitted: "node-id", canonical: "node"},
-	{command: "drive +download", emitted: "node-id", canonical: "node"},
-	{command: "drive +inspect", emitted: "node-id", canonical: "node"},
-	{command: "drive +publish-get", emitted: "node-id", canonical: "node"},
-	{command: "drive +publish-unset", emitted: "node-id", canonical: "node"},
-	{command: "drive +rename", emitted: "node-id", canonical: "node"},
-	{command: "drive +star-add", emitted: "node-id", canonical: "node"},
-	{command: "drive +star-remove", emitted: "node-id", canonical: "node"},
-	{command: "drive +stats", emitted: "node-id", canonical: "node"},
-	{command: "drive +upload", emitted: "node-id", canonical: "node"},
-	{command: "drive +version-download", emitted: "node-id", canonical: "node"},
-	{command: "drive +version-get", emitted: "node-id", canonical: "node"},
-	{command: "drive +version-history", emitted: "node-id", canonical: "node"},
-	{command: "drive +version-revert", emitted: "node-id", canonical: "node"},
-	{command: "drive +cover", emitted: "url", canonical: "node"},
-	{command: "drive +create-shortcut", emitted: "document-id", canonical: "node"},
-	{command: "drive +delete", emitted: "folder-id", canonical: "node"},
-	{command: "drive +inspect", emitted: "document-id", canonical: "node"},
-	{command: "drive +inspect", emitted: "folder-id", canonical: "node"},
-	{command: "drive +publish-get", emitted: "url", canonical: "node"},
-	{command: "drive +publish-unset", emitted: "document-url", canonical: "node"},
-	{command: "drive +rename", emitted: "document-id", canonical: "node"},
-	{command: "drive +rename", emitted: "folder-id", canonical: "node"},
-	{command: "drive +star-add", emitted: "url", canonical: "node"},
-	{command: "drive +star-remove", emitted: "doc-id", canonical: "node"},
-	{command: "drive +stats", emitted: "document-url", canonical: "node"},
-	{command: "drive +upload", emitted: "file-id", canonical: "node"},
-}
-
-// paramAliasNewDriveConfirmationCases selects one newly reviewed alias for
-// every Drive command in the expansion whose declared runtime safety requires
-// confirmation. The full matrix below proves all spellings preserve the
-// confirmed payload; this smaller matrix proves aliases cannot cross the
-// confirmation boundary before any transport call is made.
-var paramAliasNewDriveConfirmationCases = []struct {
-	command   string
-	emitted   string
-	canonical string
-}{
-	{command: "drive +delete", emitted: "file-id", canonical: "node"},
-	{command: "drive +publish-unset", emitted: "document-url", canonical: "node"},
-	{command: "drive +recycle-restore", emitted: "recycle-item-id", canonical: "id"},
-	{command: "drive +rename", emitted: "new-name", canonical: "name"},
-	{command: "drive +upload", emitted: "source-file", canonical: "file"},
-	{command: "drive +version-revert", emitted: "version-number", canonical: "version"},
-}
-
 // paramAliasRepresentativePayloadCases keeps final transport coverage across
 // old concept aliases, command overrides, native compatibility flags, read and
 // write commands, and different products. Every reviewed alias is still
 // checked through the embedded PreParse delivery path and against a complete
-// business-valid command template. The dedicated product gates below continue
-// to execute every alias introduced by the reviewed IM and Drive expansions.
+// business-valid command template. The separate IM gate below continues to
+// execute every alias introduced by the current IM optimization.
 //
 // Keeping the older 100+ aliases at the contract layer avoids rebuilding and
 // executing the complete 800+ command Root twice per spelling under -race.
@@ -410,7 +261,6 @@ var paramAliasRepresentativePayloadCases = map[string]bool{
 	paramAliasPayloadCaseKey("devdoc article search", "current-page"):                true, // command override
 	paramAliasPayloadCaseKey("doc +comment-create", "body"):                          true, // write shortcut content alias
 	paramAliasPayloadCaseKey("doc +copy", "parent-folder-id"):                        true, // Doc folder role on a write shortcut
-	paramAliasPayloadCaseKey("doc create", "space-id"):                               true, // published Doc workspace compatibility remains payload-equivalent
 	paramAliasPayloadCaseKey("doc +create", "content-format"):                        true, // shortcut format alias preserves markdown/jsonml enum
 	paramAliasPayloadCaseKey("doc +create-from-template", "keyword"):                 true, // template search alias composes with a write workflow
 	paramAliasPayloadCaseKey("doc +create-from-template", "workspace-id"):            true, // template target workspace identifier
@@ -419,8 +269,6 @@ var paramAliasRepresentativePayloadCases = map[string]bool{
 	paramAliasPayloadCaseKey("doc +fetch", "start-block"):                            true, // section boundary role remains exact
 	paramAliasPayloadCaseKey("doc +history-revert", "version-number"):                true, // destructive history version alias keeps confirmation
 	paramAliasPayloadCaseKey("doc +inspect", "include-versions"):                     true, // boolean section alias preserves value
-	paramAliasPayloadCaseKey("doc +search", "create-time-start"):                     true, // observed lower-bound spelling preserves milliseconds
-	paramAliasPayloadCaseKey("doc +search", "create-time-end"):                       true, // observed upper-bound spelling preserves milliseconds
 	paramAliasPayloadCaseKey("doc +template-list", "next-token"):                     true, // Doc cursor alias on a read shortcut
 	paramAliasPayloadCaseKey("doc +update", "mode"):                                  true, // write operation selector alias
 	paramAliasPayloadCaseKey("doc +update", "revision"):                              true, // optimistic edit revision alias
@@ -430,7 +278,6 @@ var paramAliasRepresentativePayloadCases = map[string]bool{
 	paramAliasPayloadCaseKey("doc block insert", "parent-block-id"):                  true, // scoped block-role alias
 	paramAliasPayloadCaseKey("doc comment delete", "comment-id"):                     true, // destructive comment-key alias
 	paramAliasPayloadCaseKey("doc comment reply", "mentioned-open-conversation-ids"): true, // list-valued group mention role
-	paramAliasPayloadCaseKey("drive info", "workspace"):                              true, // published numeric storage-space compatibility remains payload-equivalent
 	paramAliasPayloadCaseKey("mail folder update", "folder-id"):                      true, // write-command identifier alias
 	paramAliasPayloadCaseKey("report list", "from-date"):                             true, // date-range concept alias
 }
@@ -574,118 +421,14 @@ func TestCrossPlatformCoverageNewIMParamAliasesReachCanonicalEquivalentFinalPayl
 	}
 }
 
-func TestCrossPlatformCoverageNewDriveParamAliasesReachCanonicalEquivalentFinalPayloads(t *testing.T) {
-	activeAliases := 0
-	for _, test := range paramAliasNewDriveCases {
-		test := test
-		t.Run(test.command+"/"+test.emitted, func(t *testing.T) {
-			complete, ok := paramAliasCompleteCommand(test.command, test.canonical)
-			if !ok {
-				t.Fatal("reviewed Drive alias has no complete-command E2E template")
-			}
-			canonicalArgs := append([]string(nil), complete...)
-			aliasArgs, replacements := replaceLongFlag(canonicalArgs, test.canonical, test.emitted)
-			if replacements != 1 {
-				t.Fatalf("complete command must contain canonical --%s exactly once; replacements=%d args=%v", test.canonical, replacements, canonicalArgs)
-			}
-
-			canonicalCaller := &paramAliasCaptureCaller{}
-			_, canonicalErr := executeParamAliasPayloadE2E(t, canonicalCaller, canonicalArgs...)
-			if canonicalErr != nil && !paramAliasExpectedCaptureBoundaryError(test.command, canonicalErr) {
-				t.Fatalf("complete canonical command failed: %v\nargs=%v\ncalls=%#v", canonicalErr, canonicalArgs, canonicalCaller.calls)
-			}
-			if len(canonicalCaller.calls) == 0 {
-				t.Fatalf("complete canonical command reached no final transport payload: args=%v", canonicalArgs)
-			}
-
-			entry, exists := cli.LookupParamAlias(test.command)
-			target, active := entry.ResolveAlias(test.emitted)
-			if !exists || !active {
-				return
-			}
-			if target != test.canonical {
-				t.Fatalf("active reviewed Drive alias --%s resolves to --%s, want --%s", test.emitted, target, test.canonical)
-			}
-			activeAliases++
-
-			aliasCaller := &paramAliasCaptureCaller{}
-			ctx, aliasErr := executeParamAliasPayloadE2E(t, aliasCaller, aliasArgs...)
-			if aliasErr != nil && !paramAliasExpectedCaptureBoundaryError(test.command, aliasErr) {
-				t.Fatalf("complete alias command failed: %v\nargs=%v\ncalls=%#v", aliasErr, aliasArgs, aliasCaller.calls)
-			}
-			if ctx == nil {
-				t.Fatal("complete alias command skipped PreParse")
-			}
-			if (canonicalErr == nil) != (aliasErr == nil) || (canonicalErr != nil && canonicalErr.Error() != aliasErr.Error()) {
-				t.Fatalf("canonical and alias completion errors differ: canonical=%v alias=%v", canonicalErr, aliasErr)
-			}
-			if !reflect.DeepEqual(aliasCaller.calls, canonicalCaller.calls) {
-				t.Fatalf("final transport calls differ\ncanonical args: %v\nalias args: %v\ncanonical calls: %#v\nalias calls: %#v", canonicalArgs, aliasArgs, canonicalCaller.calls, aliasCaller.calls)
-			}
-		})
-	}
-	if activeAliases != len(paramAliasNewDriveCases) {
-		t.Fatalf("new Drive aliases active in embedded table = %d, want %d", activeAliases, len(paramAliasNewDriveCases))
-	}
-}
-
-func TestCrossPlatformCoverageNewDriveParamAliasesCannotBypassConfirmation(t *testing.T) {
-	for _, test := range paramAliasNewDriveConfirmationCases {
-		test := test
-		t.Run(test.command+"/"+test.emitted, func(t *testing.T) {
-			complete, ok := paramAliasCompleteCommand(test.command, test.canonical)
-			if !ok {
-				t.Fatal("reviewed Drive confirmation alias has no complete-command E2E template")
-			}
-			aliasArgs, replacements := replaceLongFlag(complete, test.canonical, test.emitted)
-			if replacements != 1 {
-				t.Fatalf("complete command must contain canonical --%s exactly once; replacements=%d args=%v", test.canonical, replacements, complete)
-			}
-			unconfirmedArgs, removals := removeExactArg(aliasArgs, "--yes")
-			if removals != 1 {
-				t.Fatalf("confirmation template must contain --yes exactly once; removals=%d args=%v", removals, aliasArgs)
-			}
-
-			entry, exists := cli.LookupParamAlias(test.command)
-			target, active := entry.ResolveAlias(test.emitted)
-			if !exists || !active || target != test.canonical {
-				t.Fatalf("reviewed Drive alias --%s resolution = exists:%v active:%v target:%q, want --%s", test.emitted, exists, active, target, test.canonical)
-			}
-
-			caller := &paramAliasCaptureCaller{}
-			ctx, err := executeParamAliasPayloadE2E(t, caller, unconfirmedArgs...)
-			if ctx == nil {
-				t.Fatal("unconfirmed alias command skipped PreParse")
-			}
-			var appErr *apperrors.Error
-			if !errors.As(err, &appErr) || appErr.Reason != "confirmation_required" {
-				t.Fatalf("unconfirmed alias command error = %#v, want confirmation_required\nargs=%v", err, unconfirmedArgs)
-			}
-			if len(caller.calls) != 0 {
-				t.Fatalf("unconfirmed alias command crossed the transport boundary: args=%v calls=%#v", unconfirmedArgs, caller.calls)
-			}
-		})
-	}
-}
-
-// Some artifact commands deliberately continue past the final captured
-// transport call into local download/upload handling. Deterministic invalid
-// resource responses form their expected post-transport test boundary;
-// canonical and alias calls must still produce the same request and error.
+// Resource download deliberately continues from the transport call into a
+// local HTTPS download. The generic capture caller returns an empty object, so
+// this command's stable post-transport validation error is the expected test
+// boundary; canonical and alias calls must still produce the same request and
+// the same error.
 func paramAliasExpectedCaptureBoundaryError(command string, err error) bool {
-	if err == nil {
-		return false
-	}
-	switch command {
-	case "chat +messages-resource-download":
-		return strings.Contains(err.Error(), "资源下载接口未返回合法的 HTTPS 下载地址")
-	case "drive +download", "drive +version-download":
-		return strings.Contains(err.Error(), "下载地址必须是受信任域名上的 HTTPS URL")
-	case "drive +upload":
-		return strings.Contains(err.Error(), "incomplete drive upload credentials")
-	default:
-		return false
-	}
+	return command == "chat +messages-resource-download" && err != nil &&
+		strings.Contains(err.Error(), "资源下载接口未返回合法的 HTTPS 下载地址")
 }
 
 // +chat-messages supplies the current wall-clock time when callers omit
@@ -740,16 +483,3 @@ func replaceLongFlag(args []string, canonical, emitted string) ([]string, int) {
 	}
 	return out, replacements
 }
-
-func removeExactArg(args []string, target string) ([]string, int) {
-	out := make([]string, 0, len(args))
-	removals := 0
-	for _, arg := range args {
-		if arg == target {
-			removals++
-			continue
-		}
-		out = append(out, arg)
-	}
-	return out, removals
-}

internal/app/pat_auth_retry_test.go

@@ -30,7 +30,6 @@ import (
 	apperrors "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/errors"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/executor"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/pat"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/testseam"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/agentproduct"
 )
 
@@ -219,16 +218,8 @@ func TestPatScopeError_Error(t *testing.T) {
 // /cli/oauth/device/poll?flowId=<fid> with the given status sequence.
 // It also writes the server URL into a temp DWS_CONFIG_DIR/mcp_url so that
 // GetMCPBaseURL() returns the test server address.
-func stubPATPollAccessToken(t *testing.T) {
-	t.Helper()
-	testseam.Swap(t, &patResolveAccessToken, func(context.Context, string, string) (string, error) {
-		return "", authpkg.ErrTokenDataNotFound
-	})
-}
-
 func setupPollServer(t *testing.T, statuses []authpkg.DevicePollResponse) (*httptest.Server, string) {
 	t.Helper()
-	stubPATPollAccessToken(t)
 	var callCount atomic.Int32
 
 	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -390,7 +381,6 @@ func TestPollPatDeviceFlow_ServerErrorFallback(t *testing.T) {
 }
 
 func TestPollPatDeviceFlow_RedirectSkipped(t *testing.T) {
-	stubPATPollAccessToken(t)
 	// When server returns 302 (SSO redirect), poll should continue until real response.
 	var callCount int32
 	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -550,7 +540,6 @@ func (m *mockRunner) Run(ctx context.Context, inv executor.Invocation) (executor
 // It responds to device poll requests with the given status after the first poll.
 func setupHandlePATServer(t *testing.T, terminalStatus string, authCode string) (*httptest.Server, string) {
 	t.Helper()
-	stubPATPollAccessToken(t)
 	var pollCount atomic.Int32
 
 	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

internal/app/retry_gate_test.go

@@ -0,0 +1,308 @@
+// Copyright 2026 Alibaba Group
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package app
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"sync"
+	"testing"
+
+	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/audit"
+	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/corecmd/contract"
+	apperrors "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/errors"
+	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/executor"
+	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/testseam"
+	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/transport"
+)
+
+func retryGateTestRunner() *runtimeRunner {
+	client := transport.NewClient(nil)
+	return &runtimeRunner{
+		transport:   client,
+		globalFlags: &GlobalFlags{Token: "test-token"},
+		auditSink:   audit.NopSink{},
+	}
+}
+
+func TestCrossPlatformCoverageRuntimeRetryGateControlsTransportAndAPIHint(t *testing.T) {
+	testseam.Swap(t, &runnerPreflightDocDownload, func(*runtimeRunner, context.Context, *transport.Client, string, executor.Invocation) error {
+		return nil
+	})
+	testseam.Swap(t, &runnerCaptureRuntimeFailure, func(executor.Invocation, error, error) {})
+
+	tests := []struct {
+		name          string
+		decision      *contract.RetryDecision
+		wantRetries   int
+		wantRetryable bool
+	}{
+		{name: "missing contract fails closed", wantRetries: 0, wantRetryable: false},
+		{
+			name: "conditional contract without key fails closed",
+			decision: &contract.RetryDecision{
+				EffectiveIdempotency: "non_idempotent",
+				SafeToRetry:          false,
+				Reason:               "deduplication_key_missing",
+			},
+			wantRetries:   0,
+			wantRetryable: false,
+		},
+		{
+			name: "resolved idempotent contract preserves retry",
+			decision: &contract.RetryDecision{
+				EffectiveIdempotency: "idempotent",
+				SafeToRetry:          true,
+				Reason:               "deduplication_key_present",
+			},
+			wantRetries:   1,
+			wantRetryable: true,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			gotRetries := -1
+			testseam.Swap(t, &runnerCallTool, func(client *transport.Client, _ context.Context, _, _ string, _ map[string]any) (transport.ToolCallResult, error) {
+				gotRetries = client.MaxRetries
+				return transport.ToolCallResult{}, apperrors.NewAPI(
+					"server unavailable",
+					apperrors.WithReason("http_503"),
+					apperrors.WithRetryable(true),
+					apperrors.WithRetryAfterSeconds(3),
+				)
+			})
+
+			runner := retryGateTestRunner()
+			_, err := runner.executeInvocation(context.Background(), "https://example.test", executor.Invocation{
+				CanonicalProduct: "chat",
+				Tool:             "send_message",
+				Params:           map[string]any{"uuid": "stable-key"},
+				Retry:            tt.decision,
+			})
+			if gotRetries != tt.wantRetries {
+				t.Fatalf("transport MaxRetries = %d, want %d", gotRetries, tt.wantRetries)
+			}
+			var typed *apperrors.Error
+			if !errors.As(err, &typed) {
+				t.Fatalf("error = %T %v, want typed API error", err, err)
+			}
+			if !typed.RetryableSet || typed.Retryable != tt.wantRetryable {
+				t.Fatalf("retryable = (%v, %v), want (true, %v)", typed.RetryableSet, typed.Retryable, tt.wantRetryable)
+			}
+			if tt.wantRetryable {
+				if typed.RetryAfterSeconds == nil || *typed.RetryAfterSeconds != 3 {
+					t.Fatalf("safe retry_after_seconds = %v, want 3", typed.RetryAfterSeconds)
+				}
+			} else if typed.RetryAfterSeconds != nil || typed.NextRetryAt != nil {
+				t.Fatalf("unsafe retry kept backoff hints: after=%v at=%v", typed.RetryAfterSeconds, typed.NextRetryAt)
+			}
+			if runner.transport.MaxRetries != 1 {
+				t.Fatalf("shared transport MaxRetries = %d, want unchanged 1", runner.transport.MaxRetries)
+			}
+		})
+	}
+}
+
+func TestCrossPlatformCoverageRuntimeRetryGateDoesNotClampAuthErrors(t *testing.T) {
+	testseam.Swap(t, &runnerPreflightDocDownload, func(*runtimeRunner, context.Context, *transport.Client, string, executor.Invocation) error {
+		return nil
+	})
+	testseam.Swap(t, &runnerCaptureRuntimeFailure, func(executor.Invocation, error, error) {})
+	authErr := apperrors.NewAuth("expired", apperrors.WithRetryable(true))
+	testseam.Swap(t, &runnerCallTool, func(*transport.Client, context.Context, string, string, map[string]any) (transport.ToolCallResult, error) {
+		return transport.ToolCallResult{}, authErr
+	})
+
+	_, err := retryGateTestRunner().executeInvocation(context.Background(), "https://example.test", executor.Invocation{
+		CanonicalProduct: "chat",
+		Tool:             "send_message",
+		Params:           map[string]any{},
+	})
+	var typed *apperrors.Error
+	if !errors.As(err, &typed) {
+		t.Fatalf("error = %T %v, want typed auth error", err, err)
+	}
+	if typed.Category != apperrors.CategoryAuth || !typed.RetryableSet || !typed.Retryable {
+		t.Fatalf("auth retryability was changed: %#v", typed)
+	}
+}
+
+func TestCrossPlatformCoverageRuntimeRetryDecisionPrecedesDryRun(t *testing.T) {
+	resolverCalls := 0
+	runner := retryGateTestRunner()
+	runner.globalFlags.DryRun = true
+	runner.resolveToolCallRetry = func(productID, rpcName string, args map[string]any) contract.RetryDecision {
+		resolverCalls++
+		if productID != "chat" || rpcName != "send_message" || args["uuid"] != "stable-key" {
+			t.Fatalf("resolver input = %q/%q %#v", productID, rpcName, args)
+		}
+		return contract.RetryDecision{
+			EffectiveIdempotency: "idempotent",
+			SafeToRetry:          true,
+			Reason:               "deduplication_key_present",
+		}
+	}
+
+	result, err := runner.Run(context.Background(), executor.NewHelperInvocation(
+		"chat send",
+		"chat",
+		"send_message",
+		map[string]any{"uuid": "stable-key"},
+	))
+	if err != nil {
+		t.Fatalf("Run() error = %v", err)
+	}
+	if resolverCalls != 1 || result.Invocation.Retry == nil || !result.Invocation.Retry.SafeToRetry {
+		t.Fatalf("dry-run retry decision = %#v, resolver calls = %d", result.Invocation.Retry, resolverCalls)
+	}
+	if got, ok := result.Response["retry"].(*contract.RetryDecision); !ok || !got.SafeToRetry || got.EffectiveIdempotency != "idempotent" {
+		t.Fatalf("dry-run response retry = %#v", result.Response["retry"])
+	}
+
+	explicit := contract.RetryDecision{EffectiveIdempotency: "unknown", SafeToRetry: false, Reason: "explicit"}
+	invocation := executor.NewHelperInvocation("chat send", "chat", "send_message", nil)
+	invocation.Retry = &explicit
+	result, err = runner.Run(context.Background(), invocation)
+	if err != nil {
+		t.Fatalf("Run(explicit) error = %v", err)
+	}
+	if resolverCalls != 1 || result.Invocation.Retry == nil || result.Invocation.Retry.Reason != "explicit" {
+		t.Fatalf("explicit retry decision was overwritten: %#v, resolver calls = %d", result.Invocation.Retry, resolverCalls)
+	}
+}
+
+func TestCrossPlatformCoverageExecuteInvocationDryRunIncludesRetryDecision(t *testing.T) {
+	decision := contract.RetryDecision{
+		EffectiveIdempotency: "idempotent",
+		SafeToRetry:          true,
+		Reason:               "deduplication_key_present",
+	}
+	result, err := retryGateTestRunner().executeInvocation(context.Background(), "https://example.test", executor.Invocation{
+		CanonicalProduct: "chat",
+		Tool:             "send_message",
+		DryRun:           true,
+		Retry:            &decision,
+	})
+	if err != nil {
+		t.Fatalf("executeInvocation() error = %v", err)
+	}
+	got, ok := result.Response["retry"].(*contract.RetryDecision)
+	if !ok || got != &decision || !got.SafeToRetry {
+		t.Fatalf("dry-run response retry = %#v, want original decision", result.Response["retry"])
+	}
+}
+
+func TestCrossPlatformCoverageToolCallerDryRunIncludesRetryDecision(t *testing.T) {
+	runner := retryGateTestRunner()
+	runner.resolveToolCallRetry = func(_ string, _ string, args map[string]any) contract.RetryDecision {
+		if key, _ := args["uuid"].(string); key == "" {
+			return contract.RetryDecision{
+				EffectiveIdempotency: "non_idempotent",
+				Reason:               "deduplication_key_missing",
+			}
+		}
+		return contract.RetryDecision{
+			EffectiveIdempotency: "idempotent",
+			SafeToRetry:          true,
+			Reason:               "deduplication_key_present",
+		}
+	}
+	var captured executor.Invocation
+	testseam.Swap(t, &toolCallerDryRun, func(ctx context.Context, invocation executor.Invocation) (executor.Result, error) {
+		captured = invocation
+		return (executor.EchoRunner{}).Run(ctx, invocation)
+	})
+
+	caller := newToolCallerAdapter(runner, &GlobalFlags{DryRun: true})
+	result, err := caller.CallTool(context.Background(), "chat", "send_message", map[string]any{"uuid": "stable-key"})
+	if err != nil {
+		t.Fatalf("CallTool() error = %v", err)
+	}
+	if captured.Retry == nil || !captured.Retry.SafeToRetry || captured.Retry.EffectiveIdempotency != "idempotent" {
+		t.Fatalf("captured retry decision = %#v", captured.Retry)
+	}
+	if len(result.Content) != 1 || !bytes.Contains([]byte(result.Content[0].Text), []byte(`"effective_idempotency":"idempotent"`)) {
+		t.Fatalf("ToolResult does not expose effective idempotency: %#v", result)
+	}
+
+	result, err = caller.CallTool(context.Background(), "chat", "send_message", map[string]any{"content": "hello"})
+	if err != nil {
+		t.Fatalf("CallTool(without uuid) error = %v", err)
+	}
+	if captured.Retry == nil || captured.Retry.SafeToRetry || captured.Retry.EffectiveIdempotency != "non_idempotent" {
+		t.Fatalf("missing-key retry decision = %#v", captured.Retry)
+	}
+	if len(result.Content) != 1 || !bytes.Contains([]byte(result.Content[0].Text), []byte(`"effective_idempotency":"non_idempotent"`)) {
+		t.Fatalf("ToolResult does not expose missing-key idempotency: %#v", result)
+	}
+}
+
+func TestCrossPlatformCoverageRuntimeSafeRetryReusesRequestBody(t *testing.T) {
+	var mu sync.Mutex
+	var bodies [][]byte
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		body, err := io.ReadAll(r.Body)
+		if err != nil {
+			t.Errorf("ReadAll(request) error = %v", err)
+			w.WriteHeader(http.StatusInternalServerError)
+			return
+		}
+		mu.Lock()
+		bodies = append(bodies, append([]byte(nil), body...))
+		attempt := len(bodies)
+		mu.Unlock()
+		w.Header().Set("Content-Type", "application/json")
+		if attempt == 1 {
+			w.WriteHeader(http.StatusServiceUnavailable)
+			return
+		}
+		_, _ = io.WriteString(w, `{"jsonrpc":"2.0","id":3,"result":{"content":{"messageId":"m1"}}}`)
+	}))
+	defer server.Close()
+
+	runner := retryGateTestRunner()
+	runner.transport = transport.NewClient(server.Client())
+	runner.transport.RetryDelay = 0
+	runner.transport.RetryMaxDelay = 0
+	runner.auditSink = audit.NopSink{}
+	decision := contract.RetryDecision{
+		EffectiveIdempotency: "idempotent",
+		SafeToRetry:          true,
+		Reason:               "deduplication_key_present",
+	}
+	result, err := runner.executeInvocation(context.Background(), server.URL, executor.Invocation{
+		CanonicalProduct: "chat",
+		Tool:             "send_message",
+		Params:           map[string]any{"uuid": "stable-key", "content": "hello"},
+		Retry:            &decision,
+	})
+	if err != nil {
+		t.Fatalf("executeInvocation() error = %v", err)
+	}
+	if !result.Invocation.Implemented {
+		t.Fatal("successful retry was not marked implemented")
+	}
+	mu.Lock()
+	defer mu.Unlock()
+	if len(bodies) != 2 {
+		t.Fatalf("request attempts = %d, want 2", len(bodies))
+	}
+	if !bytes.Equal(bodies[0], bodies[1]) {
+		t.Fatalf("retry body changed:\nfirst:  %s\nsecond: %s", bodies[0], bodies[1])
+	}
+}

internal/app/root.go

@@ -511,22 +511,6 @@ func flagErrorWithSuggestions(cmd *cobra.Command, err error) error {
 	// 无论哪种格式，子串 "--help' for usage." 都可被检索到。
 	tail := fmt.Sprintf("\nSee '%s --help' for usage.", cmd.CommandPath())
 	msgWithTail := errMsg + tail
-	if flag, ok := unknownFlagName(errMsg); ok && flag == "from" {
-		switch cmd.CommandPath() {
-		case "dws chat +search-msg", "dws chat +chat-messages":
-			return apperrors.NewValidation(
-				msgWithTail,
-				apperrors.WithHint("--from 在消息查询中含义不明确：按发送者过滤请使用 --sender <姓名|userId|openDingTalkId>；指定时间起点请使用 --start <RFC3339>"),
-				apperrors.WithReason("ambiguous_flag"),
-				apperrors.WithCause(err),
-				apperrors.WithActions(
-					"Use --sender <姓名|userId|openDingTalkId> to filter by sender",
-					"Use --start <RFC3339> together with --end <RFC3339> to set a time range",
-				),
-				apperrors.WithAvailableFlags(cmdutil.VisibleFlagNames(cmd)...),
-			)
-		}
-	}
 	if flag, protection, ok := reviewedFlagProtection(cmd, errMsg); ok {
 		hint := fmt.Sprintf("Parameter --%s is blocked from automatic normalization on %q; choose an explicit flag from --help.", flag, cmd.CommandPath())
 		reason := "blocked_flag"
@@ -595,10 +579,15 @@ func reviewedFlagProtection(cmd *cobra.Command, errMsg string) (string, pipeline
 	if cmd == nil {
 		return "", "", false
 	}
-	flag, ok := unknownFlagName(errMsg)
-	if !ok {
+	const prefix = "unknown flag: --"
+	idx := strings.Index(errMsg, prefix)
+	if idx < 0 {
 		return "", "", false
 	}
+	flag := strings.TrimSpace(errMsg[idx+len(prefix):])
+	if i := strings.IndexAny(flag, " =\n\t"); i >= 0 {
+		flag = flag[:i]
+	}
 	entry, ok := cli.LookupParamAlias(cmd.CommandPath())
 	if !ok {
 		return "", "", false
@@ -613,19 +602,6 @@ func reviewedFlagProtection(cmd *cobra.Command, errMsg string) (string, pipeline
 	return "", "", false
 }
 
-func unknownFlagName(errMsg string) (string, bool) {
-	const prefix = "unknown flag: --"
-	idx := strings.Index(errMsg, prefix)
-	if idx < 0 {
-		return "", false
-	}
-	flag := strings.TrimSpace(errMsg[idx+len(prefix):])
-	if i := strings.IndexAny(flag, " =\n\t"); i >= 0 {
-		flag = flag[:i]
-	}
-	return flag, flag != ""
-}
-
 func printExecutionError(root *cobra.Command, stdout, stderr io.Writer, err error) error {
 	var raw apperrors.RawStderrError
 	if stderrors.As(err, &raw) {

internal/app/root_help_test.go

@@ -22,8 +22,6 @@ import (
 	"strings"
 	"testing"
 
-	authpkg "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/auth"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/corecmd/runtimeannotate"
 	apperrors "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/errors"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/testseam"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/edition"
@@ -94,8 +92,8 @@ func TestRootKeepsMainBranchChatCompatibilityCommands(t *testing.T) {
 	}{
 		{args: []string{"chat", "send", "--group", "cid-stable", "--text", "hello"}, hint: "dws chat message send"},
 		{args: []string{"im", "send", "--group", "cid-stable", "--text", "hello"}, hint: "dws chat message send"},
-		{args: []string{"chat", "history", "--group", "cid-stable", "--limit", "20"}, hint: "dws chat message list --conversation-id <GROUP_OPEN_CONVERSATION_ID>"},
-		{args: []string{"im", "history", "--group", "cid-stable", "--limit", "20"}, hint: "dws chat message list --conversation-id <GROUP_OPEN_CONVERSATION_ID>"},
+		{args: []string{"chat", "history", "--group", "cid-stable", "--limit", "20"}, hint: "dws chat message list --group <GROUP_OPEN_CONVERSATION_ID>"},
+		{args: []string{"im", "history", "--group", "cid-stable", "--limit", "20"}, hint: "dws chat message list --group <GROUP_OPEN_CONVERSATION_ID>"},
 	} {
 		command := NewRootCommand()
 		command.SilenceErrors = true
@@ -371,20 +369,6 @@ func TestChatFileUploadDownlinedButMessageFileSendStays(t *testing.T) {
 			t.Fatalf("chat message send missing --%s", flag)
 		}
 	}
-	idempotencyKey := send.Flags().Lookup("idempotency-key")
-	if idempotencyKey == nil {
-		t.Fatal("chat message send missing --idempotency-key")
-	}
-	legacyUUID := send.Flags().Lookup("uuid")
-	if legacyUUID == nil || !legacyUUID.Hidden {
-		t.Fatalf("chat message send --uuid hidden = %#v, want hidden compatibility flag", legacyUUID)
-	}
-	if got := legacyUUID.Annotations[runtimeannotate.AnnotationFlagAliasOf]; len(got) != 1 || got[0] != "idempotency-key" {
-		t.Fatalf("chat message send --uuid alias_of = %#v, want idempotency-key", got)
-	}
-	if got := legacyUUID.Annotations[runtimeannotate.AnnotationFlagAliasOrigin]; len(got) != 1 || got[0] != runtimeannotate.FlagAliasOriginCorecmdV1 {
-		t.Fatalf("chat message send --uuid alias_origin = %#v, want %s", got, runtimeannotate.FlagAliasOriginCorecmdV1)
-	}
 
 	got, err := executeRootCaptureStdout(t, []string{
 		"chat", "file", "upload",
@@ -489,80 +473,6 @@ func TestInjectStaticServersMergesStaticAndSupplementServers(t *testing.T) {
 	}
 }
 
-func TestCrossPlatformCoverageStaticDingTalkEndpointsFollowConfiguredMCPBaseURL(t *testing.T) {
-	previous := edition.Get()
-	defer edition.Override(previous)
-	defer SetDynamicServers(nil)
-
-	configDir := t.TempDir()
-	t.Setenv("DWS_CONFIG_DIR", configDir)
-	if err := os.WriteFile(filepath.Join(configDir, "mcp_url"), []byte("https://pre-mcp.dingtalk.io\n"), 0o600); err != nil {
-		t.Fatalf("WriteFile(mcp_url) error = %v", err)
-	}
-
-	edition.Override(&edition.Hooks{
-		Name: "test",
-		StaticServers: func() []edition.ServerInfo {
-			return []edition.ServerInfo{{
-				ID:       "contact",
-				Name:     "Contact",
-				Endpoint: "https://mcp-gw.dingtalk.com/server/contact?key=abc",
-				Prefixes: []string{"user"},
-			}}
-		},
-	})
-
-	injectStaticServers()
-
-	for _, productID := range []string{"contact", "user"} {
-		got, ok := directRuntimeEndpoint(productID, "")
-		want := "https://pre-mcp-gw.dingtalk.io/server/contact?key=abc"
-		if !ok || got != want {
-			t.Fatalf("directRuntimeEndpoint(%q) = %q, %v; want %q, true", productID, got, ok, want)
-		}
-	}
-}
-
-func TestCrossPlatformCoverageDingTalkEndpointsFollowSelectedTokenRegion(t *testing.T) {
-	configDir := t.TempDir()
-	t.Setenv("DWS_CONFIG_DIR", configDir)
-	mcpURLPath := filepath.Join(configDir, "mcp_url")
-
-	if err := os.WriteFile(mcpURLPath, []byte("https://pre-mcp.dingtalk.io\n"), 0o600); err != nil {
-		t.Fatalf("WriteFile(mcp_url) error = %v", err)
-	}
-	endpoint := "https://pre-mcp-gw.dingtalk.io/server/contact?key=abc"
-	if got, want := activeDingTalkGatewayEndpointForLoginRegion(endpoint, authpkg.LoginRegionDefault), "https://pre-mcp-gw.dingtalk.com/server/contact?key=abc"; got != want {
-		t.Fatalf("domestic profile endpoint = %q, want %q", got, want)
-	}
-	if got := activeDingTalkGatewayEndpointForLoginRegion(endpoint, authpkg.LoginRegionInternational); got != endpoint {
-		t.Fatalf("international profile endpoint = %q, want %q", got, endpoint)
-	}
-
-	if err := os.WriteFile(mcpURLPath, []byte("https://mcp.dingtalk.com\n"), 0o600); err != nil {
-		t.Fatalf("WriteFile(mcp_url) error = %v", err)
-	}
-	if got, want := activeDingTalkGatewayEndpointForLoginRegion("https://mcp-gw.dingtalk.com/server/contact", authpkg.LoginRegionInternational), "https://mcp-gw.dingtalk.io/server/contact"; got != want {
-		t.Fatalf("international profile endpoint from domestic config = %q, want %q", got, want)
-	}
-}
-
-func TestCrossPlatformCoverageDingTalkEndpointUsesLoginScopedMCPOverride(t *testing.T) {
-	configDir := t.TempDir()
-	t.Setenv("DWS_CONFIG_DIR", configDir)
-	restore := authpkg.PushMCPBaseURLOverride("https://pre-mcp.dingtalk.io")
-	defer restore()
-
-	got := activeDingTalkGatewayEndpointForLoginRegion(
-		"https://mcp-gw.dingtalk.com/server/contact",
-		authpkg.LoginRegionDefault,
-	)
-	want := "https://pre-mcp-gw.dingtalk.io/server/contact"
-	if got != want {
-		t.Fatalf("login-scoped endpoint = %q, want %q", got, want)
-	}
-}
-
 func mustFindCommand(t *testing.T, root *cobra.Command, path ...string) *cobra.Command {
 	t.Helper()
 	cmd := root

internal/app/runner.go

@@ -30,6 +30,8 @@ import (
 
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/audit"
 	authpkg "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/auth"
+	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/cli"
+	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/corecmd/contract"
 	apperrors "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/errors"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/executor"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/logging"
@@ -139,30 +141,32 @@ func newCommandRunnerWithFlags(flags *GlobalFlags) executor.Runner {
 	transportClient := transport.NewClient(httpClient)
 	transportClient.FileLogger = FileLoggerInstance()
 	return &runtimeRunner{
-		transport:          transportClient,
-		globalFlags:        flags,
-		scanner:            newRuntimeContentScanner(),
-		enforceContentScan: runtimeFlagEnabled(os.Getenv(runtimeContentScanEnforceEnv), false),
-		includeScanReport:  runtimeFlagEnabled(os.Getenv(runtimeContentScanReportOutputEnv), false),
+		transport:            transportClient,
+		globalFlags:          flags,
+		resolveToolCallRetry: cli.ResolveToolCallRetry,
+		scanner:              newRuntimeContentScanner(),
+		enforceContentScan:   runtimeFlagEnabled(os.Getenv(runtimeContentScanEnforceEnv), false),
+		includeScanReport:    runtimeFlagEnabled(os.Getenv(runtimeContentScanReportOutputEnv), false),
 	}
 }
 
 type runtimeRunner struct {
-	transport          *transport.Client
-	globalFlags        *GlobalFlags
-	fallback           executor.Runner
-	scanner            safety.Scanner
-	enforceContentScan bool
-	includeScanReport  bool
-	auditSink          audit.Sink
-	agentMetadata      *agentMetadataSnapshot
+	transport            *transport.Client
+	globalFlags          *GlobalFlags
+	fallback             executor.Runner
+	scanner              safety.Scanner
+	enforceContentScan   bool
+	includeScanReport    bool
+	auditSink            audit.Sink
+	agentMetadata        *agentMetadataSnapshot
+	resolveToolCallRetry func(productID, rpcName string, args map[string]any) contract.RetryDecision
 }
 
 var (
 	runnerResolveMultiProfileSelections = resolveMultiProfileSelections
 	runnerResolveProfile                = authpkg.ResolveProfile
 	runnerGetCachedRuntimeToken         = getCachedRuntimeToken
-	runnerResolveAuthSnapshot           = (*runtimeRunner).resolveAuthSnapshot
+	runnerResolveAuthToken              = (*runtimeRunner).resolveAuthToken
 	runnerPreflightDocDownload          = (*runtimeRunner).preflightDocDownload
 	runnerCallTool                      = (*transport.Client).CallTool
 	runnerStdioEnsureInitialized        = (*transport.StdioClient).EnsureInitialized
@@ -174,6 +178,7 @@ var (
 )
 
 func (r *runtimeRunner) Run(ctx context.Context, invocation executor.Invocation) (executor.Result, error) {
+	r.resolveInvocationRetry(&invocation)
 	// Global dry-run is an execution barrier, not merely a transport option.
 	// Return a deterministic local preview before profile resolution, catalog
 	// discovery, Keychain/token prefetch, auth, stateful preflight or transport.
@@ -216,6 +221,14 @@ func (r *runtimeRunner) Run(ctx context.Context, invocation executor.Invocation)
 	return r.runSingle(ctx, invocation, true)
 }
 
+func (r *runtimeRunner) resolveInvocationRetry(invocation *executor.Invocation) {
+	if invocation == nil || invocation.Retry != nil || r == nil || r.resolveToolCallRetry == nil {
+		return
+	}
+	decision := r.resolveToolCallRetry(invocation.CanonicalProduct, invocation.Tool, invocation.Params)
+	invocation.Retry = &decision
+}
+
 // RunReadOnly executes one already-classified read lookup for a semantic
 // Shortcut that is building a dry-run plan. It clones the runtime flags and
 // clears DryRun only on that clone: the process-wide caller and every ordinary
@@ -500,6 +513,7 @@ func endpointNotResolvedError(productID, toolName, detail string) error {
 func (r *runtimeRunner) executeInvocation(ctx context.Context, endpoint string, invocation executor.Invocation) (result executor.Result, retErr error) {
 	// Route stdio:// endpoints to the local StdioClient — no HTTP, no auth.
 	if IsStdioEndpoint(endpoint) {
+		defer func() { enforceInvocationRetrySafety(invocation, retErr) }()
 		return r.executeStdioInvocationAtEndpoint(ctx, endpoint, invocation)
 	}
 
@@ -542,6 +556,9 @@ func (r *runtimeRunner) executeInvocation(ctx context.Context, endpoint string,
 			retErr == nil, time.Since(invokeStart), errCat, errReason)
 		emitAudit(auditSink, execID, invokeStart, invocation, endpoint, retErr, version)
 	}()
+	// Register this defer after the audit defer so the fail-closed safety value
+	// is what logging and audit observers see as well as what the caller gets.
+	defer func() { enforceInvocationRetrySafety(invocation, retErr) }()
 
 	// Check whether this product belongs to an HTTP plugin. Every accepted
 	// plugin has an ownership record; credentials within that record are
@@ -552,16 +569,11 @@ func (r *runtimeRunner) executeInvocation(ctx context.Context, endpoint string,
 	if hasPluginAuth {
 		authToken = pluginAuth.Token
 	} else if !invocation.DryRun && (r.globalFlags == nil || !r.globalFlags.Mock) {
-		snapshot, tokenErr := runnerResolveAuthSnapshot(r, ctx)
+		var tokenErr error
+		authToken, tokenErr = runnerResolveAuthToken(r, ctx)
 		if tokenErr != nil {
 			return executor.Result{}, tokenResolutionError(tokenErr)
 		}
-		authToken = snapshot.AccessToken
-		if !hasDirectRuntimeEndpointOverride(invocation.CanonicalProduct) &&
-			isDingTalkMCPGatewayEndpoint(endpoint) &&
-			(snapshot.LoginRegionKnown || authpkg.MCPBaseURLOverride() != "") {
-			endpoint = activeDingTalkGatewayEndpointForLoginRegion(endpoint, snapshot.LoginRegion)
-		}
 	}
 
 	var timeoutSec int
@@ -580,14 +592,18 @@ func (r *runtimeRunner) executeInvocation(ctx context.Context, endpoint string,
 		if argsJSON, err := json.Marshal(invocation.Params); err == nil {
 			fmt.Fprintf(os.Stderr, "DRY-RUN Arguments: %s\n", argsJSON)
 		}
+		response := map[string]any{
+			"dry_run":  true,
+			"endpoint": transport.RedactURL(endpoint),
+			"request":  executor.ToolCallRequest(invocation.Tool, invocation.Params),
+			"note":     "execution skipped by --dry-run",
+		}
+		if invocation.Retry != nil {
+			response["retry"] = invocation.Retry
+		}
 		return executor.Result{
 			Invocation: invocation,
-			Response: map[string]any{
-				"dry_run":  true,
-				"endpoint": transport.RedactURL(endpoint),
-				"request":  executor.ToolCallRequest(invocation.Tool, invocation.Params),
-				"note":     "execution skipped by --dry-run",
-			},
+			Response:   response,
 		}, nil
 	}
 
@@ -637,6 +653,9 @@ func (r *runtimeRunner) executeInvocation(ctx context.Context, endpoint string,
 			tc = r.transport.WithAuth(authToken, resolveMCPRequestHeadersForInvocation(invocation))
 		}
 	}
+	if invocation.Retry == nil || !invocation.Retry.SafeToRetry {
+		tc.MaxRetries = 0
+	}
 
 	callCtx := ctx
 	if r.globalFlags != nil && r.globalFlags.Timeout > 0 {
@@ -791,6 +810,24 @@ func (r *runtimeRunner) executeInvocation(ctx context.Context, endpoint string,
 	return executor.Result{Invocation: invocation, Response: response}, nil
 }
 
+// enforceInvocationRetrySafety intersects server/API retry hints with the
+// invocation's reviewed idempotency decision. Auth and PAT recovery have
+// independent one-shot retry protocols and are deliberately left untouched.
+func enforceInvocationRetrySafety(invocation executor.Invocation, err error) {
+	if invocation.Retry != nil && invocation.Retry.SafeToRetry {
+		return
+	}
+	var typed *apperrors.Error
+	if errors.As(err, &typed) && typed.Category == apperrors.CategoryAPI {
+		typed.Retryable = false
+		typed.RetryableSet = true
+		// Server backoff hints describe transience, not replay safety. Keeping
+		// them next to retryable=false invites an Agent to bypass the contract.
+		typed.RetryAfterSeconds = nil
+		typed.NextRetryAt = nil
+	}
+}
+
 func (r *runtimeRunner) executeStdioInvocationAtEndpoint(
 	ctx context.Context,
 	endpoint string,
@@ -882,33 +919,21 @@ func (r *runtimeRunner) executeStdioInvocationAtEndpoint(
 }
 
 func (r *runtimeRunner) resolveAuthToken(ctx context.Context) (string, error) {
-	snapshot, err := r.resolveAuthSnapshot(ctx)
-	if err != nil {
-		return "", err
-	}
-	return snapshot.AccessToken, nil
-}
-
-func (r *runtimeRunner) resolveAuthSnapshot(ctx context.Context) (AccessTokenSnapshot, error) {
 	explicitToken := ""
 	if r != nil && r.globalFlags != nil {
 		explicitToken = r.globalFlags.Token
 	}
-	return resolveRuntimeAuthSnapshot(ctx, explicitToken)
+	return resolveRuntimeAuthToken(ctx, explicitToken)
 }
 
 func resolveRuntimeAuthToken(ctx context.Context, explicitToken string) (string, error) {
-	snapshot, err := resolveRuntimeAuthSnapshot(ctx, explicitToken)
+	snapshot, err := runtimeTokenManager.Get(ctx, defaultConfigDir(), explicitToken)
 	if err != nil {
 		return "", err
 	}
 	return snapshot.AccessToken, nil
 }
 
-func resolveRuntimeAuthSnapshot(ctx context.Context, explicitToken string) (AccessTokenSnapshot, error) {
-	return runtimeTokenManager.Get(ctx, defaultConfigDir(), explicitToken)
-}
-
 // getCachedRuntimeToken is kept as the prefetch seam used by runner tests. The
 // cache itself lives exclusively in TokenManager.
 func getCachedRuntimeToken(ctx context.Context) (string, error) {

internal/app/runner_full_coverage_test.go

@@ -127,14 +127,12 @@ func TestCrossPlatformCoverageRunnerRemainingRoutingCoverage(t *testing.T) {
 }
 
 func TestCrossPlatformCoverageRunnerRemainingExecutionCoverage(t *testing.T) {
-	t.Setenv("DWS_CONFIG_DIR", t.TempDir())
 	oldEdition := edition.Get()
 	oldPreflight := runnerPreflightDocDownload
 	oldCall := runnerCallTool
 	oldHandle := runnerHandlePatAuthCheck
 	oldRetry := runnerRetryWithPatAuthRetry
 	oldCapture := runnerCaptureRuntimeFailure
-	oldResolveSnapshot := runnerResolveAuthSnapshot
 	t.Cleanup(func() {
 		edition.Override(oldEdition)
 		runnerPreflightDocDownload = oldPreflight
@@ -142,7 +140,6 @@ func TestCrossPlatformCoverageRunnerRemainingExecutionCoverage(t *testing.T) {
 		runnerHandlePatAuthCheck = oldHandle
 		runnerRetryWithPatAuthRetry = oldRetry
 		runnerCaptureRuntimeFailure = oldCapture
-		runnerResolveAuthSnapshot = oldResolveSnapshot
 	})
 
 	pluginAuthMu.Lock()
@@ -171,27 +168,6 @@ func TestCrossPlatformCoverageRunnerRemainingExecutionCoverage(t *testing.T) {
 	if got, err := r.executeInvocation(context.Background(), "https://example.test", inv); err != nil || !got.Invocation.Implemented {
 		t.Fatalf("default auth execution = %#v, %v", got, err)
 	}
-	runnerResolveAuthSnapshot = func(*runtimeRunner, context.Context) (AccessTokenSnapshot, error) {
-		return AccessTokenSnapshot{
-			AccessToken:      "international-token",
-			LoginRegion:      authpkg.LoginRegionInternational,
-			LoginRegionKnown: true,
-		}, nil
-	}
-	successfulCall := runnerCallTool
-	routedEndpoint := ""
-	runnerCallTool = func(_ *transport.Client, _ context.Context, endpoint, _ string, _ map[string]any) (transport.ToolCallResult, error) {
-		routedEndpoint = endpoint
-		return transport.ToolCallResult{Content: map[string]any{"value": 1}}, nil
-	}
-	if _, err := r.executeInvocation(context.Background(), "https://mcp-gw.dingtalk.com/server/contact", inv); err != nil {
-		t.Fatalf("international auth execution = %v", err)
-	}
-	if routedEndpoint != "https://mcp-gw.dingtalk.io/server/contact" {
-		t.Fatalf("international routed endpoint = %q", routedEndpoint)
-	}
-	runnerResolveAuthSnapshot = oldResolveSnapshot
-	runnerCallTool = successfulCall
 
 	wantErr := errors.New("preflight")
 	runnerPreflightDocDownload = func(*runtimeRunner, context.Context, *transport.Client, string, executor.Invocation) error {
@@ -386,12 +362,6 @@ func TestCrossPlatformCoverageRunnerRemainingStdioAuthAndHeadersCoverage(t *test
 	if got, err := resolveRuntimeAuthToken(context.Background(), " runtime "); err != nil || got != "runtime" {
 		t.Fatalf("runtime explicit token = %q, %v", got, err)
 	}
-	edition.Override(&edition.Hooks{TokenProvider: func(context.Context, func() (string, error)) (string, error) {
-		return "", errors.New("snapshot failed")
-	}})
-	if _, err := r.resolveAuthToken(context.Background()); err == nil || !strings.Contains(err.Error(), "snapshot failed") {
-		t.Fatalf("resolveAuthToken error = %v", err)
-	}
 
 	t.Setenv(envDWSChannel, "channel")
 	edition.Override(&edition.Hooks{

internal/app/schema_shortcut_contract_test.go

@@ -207,11 +207,7 @@ func assertChatCatalogCompleteLeafContracts(t testing.TB) {
 	})
 
 	auditJoin := executeShortcutSchemaQuery(t, "--cli-path", "chat group audit-join-validation")
-	assertSchemaLeafParameterRequired(t, auditJoin, "chat group audit-join-validation", "conversation-id", true)
 	assertSchemaLeafParameterEnum(t, auditJoin, "chat group audit-join-validation", "status", []string{"AuditApprove", "AuditDelete"})
-	if parameters := schemaContractMap(auditJoin["parameters"]); parameters["group"] != nil {
-		t.Fatalf("chat group audit-join-validation publishes hidden --group alias: %#v", parameters["group"])
-	}
 }
 
 func assertSchemaLeafParameterRequired(t testing.TB, leaf map[string]any, cliPath, name string, want bool) {

internal/app/server_failure_classifier_test.go

@@ -22,6 +22,7 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/corecmd/contract"
 	apperrors "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/errors"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/executor"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/transport"
@@ -205,10 +206,16 @@ func TestCrossPlatformCoverageExecuteInvocationClassifiesObservedMCPMetadataFail
 		transport:   client,
 		globalFlags: &GlobalFlags{Token: "local-test-token"},
 	}
+	retry := contract.RetryDecision{
+		EffectiveIdempotency: "idempotent",
+		SafeToRetry:          true,
+		Reason:               "static_idempotent",
+	}
 	_, err := runner.executeInvocation(context.Background(), server.URL, executor.Invocation{
 		CanonicalProduct: "im",
 		Tool:             "list_conversations",
 		Params:           map[string]any{"pageSize": 100},
+		Retry:            &retry,
 	})
 	var typed *apperrors.Error
 	if !errors.As(err, &typed) {

internal/app/testmain_test.go

@@ -83,10 +83,6 @@ func TestMain(m *testing.M) {
 	// remove a TempDir while the audit lock is still open.
 	setupAuditSink()
 	openBrowserFunc = func(string) error { return nil }
-	// App tests may run in filtered CI processes. Install the same lazy Schema
-	// source factory as NewRootCommand without constructing a root so ResolveMeta
-	// tests never depend on an earlier test having initialized process state.
-	registerSchemaRuntimeDelivery()
 	code := m.Run()
 	StopAllStdioClients()
 	CloseAuditSink()

internal/app/tool_caller_adapter.go

@@ -44,6 +44,11 @@ func newToolCallerAdapter(runner executor.Runner, flags *GlobalFlags) edition.To
 
 func (a *toolCallerAdapter) CallTool(ctx context.Context, productID, toolName string, args map[string]any) (*edition.ToolResult, error) {
 	inv := executor.NewHelperInvocation("overlay."+productID+"."+toolName, productID, toolName, args)
+	if a != nil {
+		if runtime, ok := a.runner.(*runtimeRunner); ok {
+			runtime.resolveInvocationRetry(&inv)
+		}
+	}
 	// Defense in depth for direct helper callers: global dry-run must never
 	// reach an injected/real Runner, even if a command bypasses the normal
 	// Schema leaf wrapper. EchoRunner produces the same stable dry_run envelope

internal/auth/auth_extra_test.go

@@ -424,87 +424,6 @@ func TestBuildAuthURLIncludesTargetCorpID(t *testing.T) {
 	}
 }
 
-func TestCrossPlatformCoverageBuildAuthURLForInternationalRegion(t *testing.T) {
-	authURL := buildAuthURLForRegion("client-id", "http://127.0.0.1:1234/callback", "", LoginRegionInternational)
-	if !strings.HasPrefix(authURL, InternationalAuthorizeURL+"?") {
-		t.Fatalf("auth URL = %s, want international authorize host", authURL)
-	}
-}
-
-func TestCrossPlatformCoverageNotEnabledHTMLUsesRegionAwareAuthorizeURL(t *testing.T) {
-	if !strings.Contains(notEnabledHTML, "status.authorizeUrl") {
-		t.Fatal("not-enabled page must read the authorize URL from the regional login status")
-	}
-	if strings.Contains(notEnabledHTML, `"https://login.dingtalk.com/oauth2/auth?client_id="`) {
-		t.Fatal("not-enabled page must not hard-code the domestic authorize URL")
-	}
-}
-
-func TestCrossPlatformCoverageLoginRegionEndpointDefaults(t *testing.T) {
-	if got := AuthorizeURLForLoginRegion(LoginRegionDefault); got != AuthorizeURL {
-		t.Fatalf("default authorize URL = %q, want %q", got, AuthorizeURL)
-	}
-	if got := DeviceBaseURLForLoginRegion(LoginRegionDefault); got != DefaultDeviceBaseURL {
-		t.Fatalf("default device base URL = %q, want %q", got, DefaultDeviceBaseURL)
-	}
-	if got := UserAccessTokenURLForLoginRegion(LoginRegionInternational); got != InternationalUserAccessTokenURL {
-		t.Fatalf("international user access token URL = %q, want %q", got, InternationalUserAccessTokenURL)
-	}
-	if got := MCPBaseURLForLoginRegion(LoginRegionInternational); got != InternationalMCPBaseURL {
-		t.Fatalf("international MCP base URL = %q, want %q", got, InternationalMCPBaseURL)
-	}
-	if got := DeviceBaseURLForLoginRegion(LoginRegionInternational); got != InternationalDeviceBaseURL {
-		t.Fatalf("international device base URL = %q, want %q", got, InternationalDeviceBaseURL)
-	}
-}
-
-func TestCrossPlatformCoverageOAuthProviderLoginRegionHelpers(t *testing.T) {
-	var nilProvider *OAuthProvider
-	if got := nilProvider.loginRegion(); got != LoginRegionDefault {
-		t.Fatalf("nil provider login region = %q", got)
-	}
-	nilProvider.useTokenLoginRegion(&TokenData{LoginRegion: string(LoginRegionInternational)})
-	nilProvider.applyLoginRegionToToken(&TokenData{})
-
-	provider := &OAuthProvider{}
-	provider.useTokenLoginRegion(nil)
-	provider.useTokenLoginRegion(&TokenData{LoginRegion: string(LoginRegionInternational)})
-	if provider.LoginRegion != LoginRegionInternational {
-		t.Fatalf("provider login region = %q, want international", provider.LoginRegion)
-	}
-	provider.useTokenLoginRegion(&TokenData{LoginRegion: string(LoginRegionDefault)})
-	provider.applyLoginRegionToToken(nil)
-	token := &TokenData{}
-	provider.applyLoginRegionToToken(token)
-	if token.LoginRegion != string(LoginRegionInternational) {
-		t.Fatalf("token login region = %q, want international", token.LoginRegion)
-	}
-}
-
-func TestCrossPlatformCoverageMCPBaseURLOverrideAffectsInternationalRegion(t *testing.T) {
-	restore := PushMCPBaseURLOverride("https://pre-mcp.dingtalk.io/")
-	defer restore()
-
-	if got := MCPBaseURLForLoginRegion(LoginRegionInternational); got != "https://pre-mcp.dingtalk.io" {
-		t.Fatalf("international MCP base URL = %q, want override", got)
-	}
-}
-
-func TestCrossPlatformCoverageLoginBaseURLOverrideAffectsInternationalRegion(t *testing.T) {
-	restore := PushLoginBaseURLOverride("https://pre-login.dingtalk.io/")
-	defer restore()
-
-	if got := DeviceBaseURLForLoginRegion(LoginRegionInternational); got != "https://pre-login.dingtalk.io" {
-		t.Fatalf("international device base URL = %q, want override", got)
-	}
-	if got := AuthorizeURLForLoginRegion(LoginRegionInternational); got != "https://pre-login.dingtalk.io/oauth2/auth" {
-		t.Fatalf("international authorize URL = %q, want override", got)
-	}
-	if got := UserAccessTokenURLForLoginRegion(LoginRegionInternational); got != "https://pre-login.dingtalk.io/v1.0/oauth2/userAccessToken" {
-		t.Fatalf("international user access token URL = %q, want override", got)
-	}
-}
-
 func buildTokenDataFromResponse(resp tokenResponse) *TokenData {
 	if resp.AccessToken == "" {
 		return nil

internal/auth/cli_auth_check_test.go

@@ -14,12 +14,10 @@
 package auth
 
 import (
-	"bytes"
 	"context"
 	"encoding/json"
 	"fmt"
 	"io"
-	"log/slog"
 	"net/http"
 	"net/http/httptest"
 	"os"
@@ -208,105 +206,6 @@ func TestCheckCLIAuthEnabled_Enabled(t *testing.T) {
 	t.Logf("✅ Normal enabled response: success=%v, enabled=%v", status.Success, status.Result.CLIAuthEnabled)
 }
 
-func TestCrossPlatformCoverageCheckCLIAuthEnabledTraceHeadersAndDebugLog(t *testing.T) {
-	t.Setenv("DINGTALK_TRACE_ID", "trace-for-cli-auth-test")
-	applyCLIAuthTraceHeaders(nil, "trace-for-cli-auth-test")
-	applyCLIAuthTraceHeaders(httptest.NewRequest(http.MethodGet, "https://example.com", nil), "")
-
-	var logBuf bytes.Buffer
-	previousLogger := slog.Default()
-	slog.SetDefault(slog.New(slog.NewTextHandler(&logBuf, &slog.HandlerOptions{Level: slog.LevelDebug})))
-	defer slog.SetDefault(previousLogger)
-
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if got := r.Header.Get("EagleEye-TraceId"); got != "trace-for-cli-auth-test" {
-			t.Errorf("EagleEye-TraceId = %q, want trace-for-cli-auth-test", got)
-		}
-		if got := r.Header.Get("X-Dingtalk-Trace-Id"); got != "trace-for-cli-auth-test" {
-			t.Errorf("X-Dingtalk-Trace-Id = %q, want trace-for-cli-auth-test", got)
-		}
-		w.Header().Set("EagleEye-TraceId", "server-trace-001")
-		w.Header().Set("EagleEye-RpcId", "rpc-001")
-		w.Header().Set("Content-Type", "application/json")
-		json.NewEncoder(w).Encode(CLIAuthStatus{
-			Success: true,
-			Result:  &CLIAuthResult{CLIAuthEnabled: true},
-		})
-	}))
-	defer srv.Close()
-
-	configDir := setupMCPConfigDir(t, srv.URL)
-	p := &OAuthProvider{configDir: configDir, httpClient: srv.Client()}
-
-	status, err := p.CheckCLIAuthEnabled(context.Background(), "sensitive-token")
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if status.Result == nil || !status.Result.CLIAuthEnabled {
-		t.Fatal("expected CLIAuthEnabled=true")
-	}
-
-	logs := logBuf.String()
-	for _, want := range []string{
-		"auth.cli_auth_enabled.request",
-		"auth.cli_auth_enabled.response",
-		"trace-for-cli-auth-test",
-		"server-trace-001",
-		"rpc-001",
-	} {
-		if !strings.Contains(logs, want) {
-			t.Fatalf("debug logs missing %q, got: %s", want, logs)
-		}
-	}
-	if strings.Contains(logs, "sensitive-token") {
-		t.Fatalf("debug logs leaked access token: %s", logs)
-	}
-}
-
-func TestCrossPlatformCoverageInternationalLoginRegionRequestWrappers(t *testing.T) {
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set("Content-Type", "application/json")
-		switch r.URL.Path {
-		case ClientIDPath:
-			_ = json.NewEncoder(w).Encode(ClientIDResponse{Success: true, Result: "international-client"})
-		case SuperAdminPath:
-			_ = json.NewEncoder(w).Encode(SuperAdminResponse{Success: true, Result: []SuperAdmin{{StaffID: "admin"}}})
-		case SendCliAuthApplyPath:
-			_ = json.NewEncoder(w).Encode(SendApplyResponse{Success: true, Result: true})
-		default:
-			http.NotFound(w, r)
-		}
-	}))
-	defer server.Close()
-
-	oldClient := oauthHTTPClient
-	oauthHTTPClient = server.Client()
-	restoreBaseURL := PushMCPBaseURLOverride(server.URL)
-	t.Cleanup(func() {
-		restoreBaseURL()
-		oauthHTTPClient = oldClient
-	})
-
-	ctx := context.Background()
-	for name, fetch := range map[string]func() (string, error){
-		"device": func() (string, error) { return deviceFetchClientIDForLoginRegion(ctx, LoginRegionInternational) },
-		"oauth":  func() (string, error) { return oauthFetchClientIDForLoginRegion(ctx, LoginRegionInternational) },
-	} {
-		if got, err := fetch(); err != nil || got != "international-client" {
-			t.Fatalf("%s client ID = %q, %v", name, got, err)
-		}
-	}
-	if got, err := deviceGetAdminsForLoginRegion(ctx, "token", LoginRegionInternational); err != nil || !got.Success {
-		t.Fatalf("device admins = %#v, %v", got, err)
-	}
-	if got, err := oauthGetAdminsForLoginRegion(ctx, "token", LoginRegionInternational); err != nil || !got.Success {
-		t.Fatalf("OAuth admins = %#v, %v", got, err)
-	}
-	if got, err := oauthSendApplyForLoginRegion(ctx, "token", "admin", LoginRegionInternational); err != nil || !got.Success {
-		t.Fatalf("OAuth apply = %#v, %v", got, err)
-	}
-}
-
 func TestCheckCLIAuthEnabled_Disabled(t *testing.T) {
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		w.Header().Set("Content-Type", "application/json")

internal/auth/coverage_edges_test.go

@@ -22,7 +22,6 @@ import (
 	"time"
 
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/keychain"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/config"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/edition"
 )
 
@@ -1212,13 +1211,7 @@ func TestCrossPlatformCoveragePortableAuthBundleCoverageEdges(t *testing.T) {
 		if err := os.Symlink(filepath.Join(keyDir, "dek"), filepath.Join(keyDir, "link")); err != nil {
 			t.Fatal(err)
 		}
-		for name, value := range map[string]string{
-			"app.json":                         "{}",
-			profilesJSONFile:                   "{}",
-			"mcp_url":                          "https://mcp.test",
-			config.ManagedMCPURLRegionFileName: "https://mcp.test",
-			"terminal_url":                     "https://terminal.test",
-		} {
+		for name, value := range map[string]string{"app.json": "{}", profilesJSONFile: "{}", "mcp_url": "https://mcp.test", "terminal_url": "https://terminal.test"} {
 			if err := os.WriteFile(filepath.Join(configDir, name), []byte(value), 0o600); err != nil {
 				t.Fatal(err)
 			}
@@ -1241,9 +1234,6 @@ func TestCrossPlatformCoveragePortableAuthBundleCoverageEdges(t *testing.T) {
 		if _, err := os.Stat(filepath.Join(importDir, "app.json")); err != nil {
 			t.Fatal("config file was not imported")
 		}
-		if _, err := os.Stat(filepath.Join(importDir, config.ManagedMCPURLRegionFileName)); err != nil {
-			t.Fatal("managed MCP region marker was not imported")
-		}
 		if _, err := os.Stat(filepath.Join(keychain.StorageDir(keychain.Service), keychain.AccountToken+".enc")); err != nil {
 			t.Fatal("encrypted token was not imported")
 		}

internal/auth/device_flow.go

@@ -74,20 +74,6 @@ var (
 	}
 )
 
-func deviceFetchClientIDForLoginRegion(ctx context.Context, region LoginRegion) (string, error) {
-	if region.IsInternational() {
-		return FetchClientIDFromMCPForLoginRegion(ctx, region)
-	}
-	return deviceFetchClientID(ctx)
-}
-
-func deviceGetAdminsForLoginRegion(ctx context.Context, accessToken string, region LoginRegion) (*SuperAdminResponse, error) {
-	if region.IsInternational() {
-		return GetSuperAdminsForLoginRegion(ctx, accessToken, region)
-	}
-	return deviceGetAdmins(ctx, accessToken)
-}
-
 type DeviceFlowProvider struct {
 	configDir        string
 	clientID         string
@@ -99,7 +85,6 @@ type DeviceFlowProvider struct {
 	httpClient       *http.Client
 	NoBrowser        bool
 	IdentityEnricher func(context.Context, *TokenData) error
-	LoginRegion      LoginRegion
 }
 
 func NewDeviceFlowProvider(configDir string, logger *slog.Logger) *DeviceFlowProvider {
@@ -119,12 +104,6 @@ func (p *DeviceFlowProvider) SetBaseURL(baseURL string) {
 	p.baseURL = strings.TrimRight(baseURL, "/")
 }
 
-func (p *DeviceFlowProvider) SetLoginRegion(region LoginRegion) {
-	p.LoginRegion = region
-	p.baseURL = DeviceBaseURLForLoginRegion(region)
-	p.terminalBaseURL = MCPBaseURLForLoginRegion(region)
-}
-
 // SetTerminalBaseURL sets the terminal API base URL for device flow polling.
 func (p *DeviceFlowProvider) SetTerminalBaseURL(baseURL string) {
 	p.terminalBaseURL = strings.TrimRight(baseURL, "/")
@@ -234,7 +213,7 @@ func (p *DeviceFlowProvider) Login(ctx context.Context) (*TokenData, error) {
 		if p.logger != nil {
 			p.logger.Debug("fetching client ID from MCP server (device flow always re-fetches)")
 		}
-		mcpClientID, mcpErr := deviceFetchClientIDForLoginRegion(ctx, p.LoginRegion)
+		mcpClientID, mcpErr := deviceFetchClientID(ctx)
 		if mcpErr != nil {
 			return nil, fmt.Errorf("%s: %w", i18n.T("获取 Client ID 失败"), mcpErr)
 		}
@@ -293,7 +272,6 @@ func (p *DeviceFlowProvider) loginOnce(ctx context.Context, attempt int) (*Token
 		clientID:         p.clientID,
 		logger:           p.logger,
 		IdentityEnricher: p.IdentityEnricher,
-		LoginRegion:      p.LoginRegion,
 	}
 	tokenData, err := deviceExchangeCode(oauthProvider, ctx, tokenResult.AuthCode)
 	if err != nil {
@@ -353,7 +331,7 @@ func (p *DeviceFlowProvider) loginOnce(ctx context.Context, attempt int) (*Token
 			_, _ = fmt.Fprintln(p.output(), i18n.T("   你所选择的组织管理员尚未开启「允许成员通过 CLI 访问其个人数据」的权限。"))
 			_, _ = fmt.Fprintln(p.output(), "")
 
-			admins, adminErr := deviceGetAdminsForLoginRegion(ctx, tokenData.AccessToken, p.LoginRegion)
+			admins, adminErr := deviceGetAdmins(ctx, tokenData.AccessToken)
 			if adminErr == nil && admins.Success && len(admins.Result) > 0 {
 				maxAdmins := 3
 				if len(admins.Result) < maxAdmins {

internal/auth/device_flow_test.go

@@ -90,17 +90,6 @@ func TestRequestDeviceCodeSuccess(t *testing.T) {
 	}
 }
 
-func TestCrossPlatformCoverageDeviceFlowSetLoginRegionUsesInternationalBaseURL(t *testing.T) {
-	provider := NewDeviceFlowProvider(t.TempDir(), newDeviceFlowTestLogger())
-	provider.SetLoginRegion(LoginRegionInternational)
-	if provider.baseURL != InternationalDeviceBaseURL {
-		t.Fatalf("baseURL = %q, want %q", provider.baseURL, InternationalDeviceBaseURL)
-	}
-	if provider.terminalBaseURL != InternationalMCPBaseURL {
-		t.Fatalf("terminalBaseURL = %q, want %q", provider.terminalBaseURL, InternationalMCPBaseURL)
-	}
-}
-
 func TestWaitForAuthorizationSucceedsAfterPending(t *testing.T) {
 	t.Parallel()
 

internal/auth/endpoints.go

@@ -50,15 +50,9 @@ const (
 	// AuthorizeURL is the DingTalk OAuth authorization page.
 	AuthorizeURL = "https://login.dingtalk.com/oauth2/auth"
 
-	// InternationalAuthorizeURL is the DingTalk international OAuth authorization page.
-	InternationalAuthorizeURL = "https://login.dingtalk.io/oauth2/auth"
-
 	// UserAccessTokenURL exchanges an authorization code for user tokens.
 	UserAccessTokenURL = "https://api.dingtalk.com/v1.0/oauth2/userAccessToken"
 
-	// InternationalUserAccessTokenURL exchanges authorization codes for international user tokens.
-	InternationalUserAccessTokenURL = "https://api.dingtalk.io/v1.0/oauth2/userAccessToken"
-
 	// UserInfoURL fetches the authenticated user's profile.
 	UserInfoURL = "https://api.dingtalk.com/v1.0/contact/users/me"
 
@@ -81,9 +75,6 @@ const (
 	// DefaultDeviceBaseURL is the login server base URL for device flow.
 	DefaultDeviceBaseURL = "https://login.dingtalk.com"
 
-	// InternationalDeviceBaseURL is the international login server base URL for device flow.
-	InternationalDeviceBaseURL = "https://login.dingtalk.io"
-
 	// DeviceCodePath requests a device_code and user_code.
 	DeviceCodePath = "/oauth2/device/code.json"
 
@@ -105,12 +96,11 @@ const (
 	LogoutContinueURL = "https://login.dingtalk.com"
 
 	// MCP API endpoints for CLI authorization management.
-	DefaultMCPBaseURL       = config.DefaultMCPBaseURL
-	InternationalMCPBaseURL = "https://mcp.dingtalk.io"
-	CLIAuthEnabledPath      = "/cli/cliAuthEnabled"
-	SuperAdminPath          = "/cli/superAdmin"
-	SendCliAuthApplyPath    = "/cli/sendCliAuthApply"
-	ClientIDPath            = "/cli/clientId"
+	DefaultMCPBaseURL    = config.DefaultMCPBaseURL
+	CLIAuthEnabledPath   = "/cli/cliAuthEnabled"
+	SuperAdminPath       = "/cli/superAdmin"
+	SendCliAuthApplyPath = "/cli/sendCliAuthApply"
+	ClientIDPath         = "/cli/clientId"
 
 	// MCP OAuth endpoints (used when clientId is fetched from MCP).
 	MCPOAuthTokenPath   = "/oauth2/getToken"
@@ -124,57 +114,6 @@ const (
 	AppAccessTokenURL = "https://api.dingtalk.com/v1.0/oauth2/accessToken"
 )
 
-type LoginRegion string
-
-const (
-	LoginRegionDefault       LoginRegion = ""
-	LoginRegionInternational LoginRegion = "international"
-)
-
-func (r LoginRegion) IsInternational() bool {
-	return r == LoginRegionInternational
-}
-
-func AuthorizeURLForLoginRegion(region LoginRegion) string {
-	if override := LoginBaseURLOverride(); override != "" {
-		return override + "/oauth2/auth"
-	}
-	if region.IsInternational() {
-		return InternationalAuthorizeURL
-	}
-	return AuthorizeURL
-}
-
-func DeviceBaseURLForLoginRegion(region LoginRegion) string {
-	if override := LoginBaseURLOverride(); override != "" {
-		return override
-	}
-	if region.IsInternational() {
-		return InternationalDeviceBaseURL
-	}
-	return DefaultDeviceBaseURL
-}
-
-func MCPBaseURLForLoginRegion(region LoginRegion) string {
-	if override := MCPBaseURLOverride(); override != "" {
-		return override
-	}
-	if region.IsInternational() {
-		return InternationalMCPBaseURL
-	}
-	return GetMCPBaseURL()
-}
-
-func UserAccessTokenURLForLoginRegion(region LoginRegion) string {
-	if override := LoginBaseURLOverride(); override != "" {
-		return override + "/v1.0/oauth2/userAccessToken"
-	}
-	if region.IsInternational() {
-		return InternationalUserAccessTokenURL
-	}
-	return UserAccessTokenURL
-}
-
 // GetTerminalBaseURL returns the terminal base URL with priority:
 // 1. ~/.dws/terminal_url file content (for pre-release environment)
 // 2. Default value (https://open-dev.dingtalk.com)
@@ -207,54 +146,8 @@ var (
 	// clientIDFromMCP indicates whether the clientID was fetched from MCP server.
 	// When true, MCP OAuth endpoints should be used instead of direct DingTalk API.
 	clientIDFromMCP bool
-
-	loginBaseURLMu       sync.RWMutex
-	loginBaseURLOverride string
-	mcpBaseURLMu         sync.RWMutex
-	mcpBaseURLOverride   string
 )
 
-// PushLoginBaseURLOverride sets a process-local DingTalk login base URL
-// override and returns a restore function.
-func PushLoginBaseURLOverride(baseURL string) func() {
-	loginBaseURLMu.Lock()
-	previous := loginBaseURLOverride
-	loginBaseURLOverride = strings.TrimRight(strings.TrimSpace(baseURL), "/")
-	loginBaseURLMu.Unlock()
-	return func() {
-		loginBaseURLMu.Lock()
-		loginBaseURLOverride = previous
-		loginBaseURLMu.Unlock()
-	}
-}
-
-func LoginBaseURLOverride() string {
-	loginBaseURLMu.RLock()
-	defer loginBaseURLMu.RUnlock()
-	return loginBaseURLOverride
-}
-
-// PushMCPBaseURLOverride sets a process-local MCP base URL override and returns
-// a restore function. It is intended for one command invocation, such as
-// pre-release smoke testing.
-func PushMCPBaseURLOverride(baseURL string) func() {
-	mcpBaseURLMu.Lock()
-	previous := mcpBaseURLOverride
-	mcpBaseURLOverride = strings.TrimRight(strings.TrimSpace(baseURL), "/")
-	mcpBaseURLMu.Unlock()
-	return func() {
-		mcpBaseURLMu.Lock()
-		mcpBaseURLOverride = previous
-		mcpBaseURLMu.Unlock()
-	}
-}
-
-func MCPBaseURLOverride() string {
-	mcpBaseURLMu.RLock()
-	defer mcpBaseURLMu.RUnlock()
-	return mcpBaseURLOverride
-}
-
 // SetClientIDFromMCP sets the clientID fetched from MCP server and marks it as MCP-sourced.
 func SetClientIDFromMCP(id string) {
 	clientMu.Lock()

internal/auth/oauth_helpers.go

@@ -20,7 +20,6 @@ import (
 	"fmt"
 	"html"
 	"io"
-	"log/slog"
 	"net/http"
 	"net/url"
 	"os"
@@ -29,7 +28,6 @@ import (
 	"time"
 
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/config"
-	"github.com/google/uuid"
 )
 
 var (
@@ -53,7 +51,7 @@ func (p *OAuthProvider) exchangeCode(ctx context.Context, code string) (*TokenDa
 		"code":         code,
 		"grantType":    "authorization_code",
 	}
-	resp, err := p.postJSON(ctx, UserAccessTokenURLForLoginRegion(p.loginRegion()), body)
+	resp, err := p.postJSON(ctx, UserAccessTokenURL, body)
 	if err != nil {
 		return nil, err
 	}
@@ -64,7 +62,6 @@ func (p *OAuthProvider) exchangeCode(ctx context.Context, code string) (*TokenDa
 	// Snapshot credentials used for this token (for refresh)
 	data.ClientID = clientID
 	data.Source = resolveCredentialSource()
-	p.applyLoginRegionToToken(data)
 	// Save clientSecret for future refresh (even if env changes)
 	if err := oauthSaveClientSecret(clientID, clientSecret); err != nil {
 		// Log warning but don't fail login
@@ -94,36 +91,11 @@ func ExchangeCodeForToken(ctx context.Context, configDir, code string) (*TokenDa
 	return data, nil
 }
 
-func (p *OAuthProvider) loginRegion() LoginRegion {
-	if p == nil {
-		return LoginRegionDefault
-	}
-	return p.LoginRegion
-}
-
-func (p *OAuthProvider) useTokenLoginRegion(data *TokenData) {
-	if p == nil || p.LoginRegion != LoginRegionDefault || data == nil {
-		return
-	}
-	if region := LoginRegion(strings.TrimSpace(data.LoginRegion)); region != LoginRegionDefault {
-		p.LoginRegion = region
-	}
-}
-
-func (p *OAuthProvider) applyLoginRegionToToken(data *TokenData) {
-	if data == nil {
-		return
-	}
-	if region := p.loginRegion(); region != LoginRegionDefault {
-		data.LoginRegion = string(region)
-	}
-}
-
 // exchangeCodeViaMCP exchanges auth code for token via MCP proxy.
 // This is used when client secret is not available (server-side secret management).
 func (p *OAuthProvider) exchangeCodeViaMCP(ctx context.Context, code string) (*TokenData, error) {
 	clientID := ClientID()
-	url := MCPBaseURLForLoginRegion(p.loginRegion()) + MCPOAuthTokenPath
+	url := GetMCPBaseURL() + MCPOAuthTokenPath
 	body := map[string]string{
 		"clientId":  clientID,
 		"authCode":  code,
@@ -140,7 +112,6 @@ func (p *OAuthProvider) exchangeCodeViaMCP(ctx context.Context, code string) (*T
 	// Snapshot credentials used for this token (for refresh)
 	data.ClientID = clientID
 	data.Source = "mcp"
-	p.applyLoginRegionToToken(data)
 	// MCP mode doesn't need to save clientSecret (server-side managed)
 	return data, nil
 }
@@ -149,10 +120,8 @@ func (p *OAuthProvider) refreshWithRefreshToken(ctx context.Context, data *Token
 	// Use stored Source to determine refresh path (not current runtime state)
 	// This ensures refresh works even if environment variables changed since login
 	if data.Source == "mcp" {
-		p.useTokenLoginRegion(data)
 		return p.refreshViaMCP(ctx, data)
 	}
-	p.useTokenLoginRegion(data)
 
 	// Direct mode: use stored clientId and load saved clientSecret
 	clientID := data.ClientID
@@ -176,7 +145,7 @@ func (p *OAuthProvider) refreshWithRefreshToken(ctx context.Context, data *Token
 		"refreshToken": data.RefreshToken,
 		"grantType":    "refresh_token",
 	}
-	resp, err := p.postJSON(ctx, UserAccessTokenURLForLoginRegion(p.loginRegion()), body)
+	resp, err := p.postJSON(ctx, UserAccessTokenURL, body)
 	if err != nil {
 		return nil, err
 	}
@@ -187,7 +156,6 @@ func (p *OAuthProvider) refreshWithRefreshToken(ctx context.Context, data *Token
 	// Preserve original credentials info
 	updated.ClientID = data.ClientID
 	updated.Source = data.Source
-	updated.LoginRegion = data.LoginRegion
 	updated.PersistentCode = data.PersistentCode
 	updated.CorpID = data.CorpID
 	updated.UserID = data.UserID
@@ -217,7 +185,7 @@ func (p *OAuthProvider) refreshViaMCP(ctx context.Context, data *TokenData) (*To
 		return nil, fmt.Errorf("无法刷新 token: 缺少 clientId，请重新登录")
 	}
 
-	url := MCPBaseURLForLoginRegion(p.loginRegion()) + MCPRefreshTokenPath
+	url := GetMCPBaseURL() + MCPRefreshTokenPath
 	body := map[string]string{
 		"clientId":     clientID,
 		"refreshToken": data.RefreshToken,
@@ -234,7 +202,6 @@ func (p *OAuthProvider) refreshViaMCP(ctx context.Context, data *TokenData) (*To
 	// Preserve original credentials info
 	updated.ClientID = data.ClientID
 	updated.Source = data.Source
-	updated.LoginRegion = data.LoginRegion
 	updated.PersistentCode = data.PersistentCode
 	updated.CorpID = data.CorpID
 	updated.UserID = data.UserID
@@ -404,10 +371,6 @@ func firstNonEmpty(values ...string) string {
 }
 
 func buildAuthURL(clientID, redirectURI, targetCorpID string) string {
-	return buildAuthURLForRegion(clientID, redirectURI, targetCorpID, LoginRegionDefault)
-}
-
-func buildAuthURLForRegion(clientID, redirectURI, targetCorpID string, region LoginRegion) string {
 	params := url.Values{
 		"client_id":     {clientID},
 		"redirect_uri":  {redirectURI},
@@ -418,7 +381,7 @@ func buildAuthURLForRegion(clientID, redirectURI, targetCorpID string, region Lo
 	if targetCorpID = strings.TrimSpace(targetCorpID); targetCorpID != "" {
 		params.Set("corpId", targetCorpID)
 	}
-	return AuthorizeURLForLoginRegion(region) + "?" + params.Encode()
+	return AuthorizeURL + "?" + params.Encode()
 }
 
 const successHTML = `<!doctype html>
@@ -974,15 +937,14 @@ const notEnabledHTML = `<!doctype html>
           clientId = status.clientId || "";
           applySent = status.applySent || false;
           selectedAdminId = status.selectedAdminId || "";
-          const authorizeUrl = status.authorizeUrl || "";
 
-          if (clientId && authorizeUrl) {
+          if (clientId) {
             const port = location.port;
             const redirectUri = encodeURIComponent(
               "http://127.0.0.1:" + port + "/callback"
             );
             backLink.href =
-              authorizeUrl + "?client_id=" +
+              "https://login.dingtalk.com/oauth2/auth?client_id=" +
               clientId +
               "&prompt=consent&redirect_uri=" +
               redirectUri +
@@ -1436,7 +1398,6 @@ const mcpRequestMaxRetries = 3
 // false negatives caused by momentary network issues.
 func (p *OAuthProvider) CheckCLIAuthEnabled(ctx context.Context, accessToken string) (*CLIAuthStatus, error) {
 	var lastErr error
-	traceID := cliAuthTraceID()
 	for attempt := 0; attempt < mcpRequestMaxRetries; attempt++ {
 		if attempt > 0 {
 			select {
@@ -1445,7 +1406,7 @@ func (p *OAuthProvider) CheckCLIAuthEnabled(ctx context.Context, accessToken str
 			case <-oauthRetryAfter(time.Duration(attempt) * time.Second):
 			}
 		}
-		status, err := p.doCheckCLIAuthEnabledAttempt(ctx, accessToken, attempt+1, traceID)
+		status, err := p.doCheckCLIAuthEnabled(ctx, accessToken)
 		if err == nil {
 			return status, nil
 		}
@@ -1455,27 +1416,16 @@ func (p *OAuthProvider) CheckCLIAuthEnabled(ctx context.Context, accessToken str
 }
 
 func (p *OAuthProvider) doCheckCLIAuthEnabled(ctx context.Context, accessToken string) (*CLIAuthStatus, error) {
-	return p.doCheckCLIAuthEnabledAttempt(ctx, accessToken, 1, cliAuthTraceID())
-}
-
-func (p *OAuthProvider) doCheckCLIAuthEnabledAttempt(ctx context.Context, accessToken string, attempt int, traceID string) (*CLIAuthStatus, error) {
-	url := MCPBaseURLForLoginRegion(p.loginRegion()) + CLIAuthEnabledPath
+	url := GetMCPBaseURL() + CLIAuthEnabledPath
 	req, err := oauthNewRequest(ctx, http.MethodGet, url, nil)
 	if err != nil {
 		return nil, fmt.Errorf("creating request: %w", err)
 	}
 	req.Header.Set("x-user-access-token", accessToken)
-	applyCLIAuthTraceHeaders(req, traceID)
 	if ch := os.Getenv("DWS_CHANNEL"); ch != "" {
 		req.Header.Set("x-dws-channel", ch)
 	}
 	applyEditionEnterpriseCredentialHeaders(req)
-	slog.Debug("auth.cli_auth_enabled.request",
-		"attempt", attempt,
-		"url", url,
-		"trace_id", traceID,
-		"channel", os.Getenv("DWS_CHANNEL"),
-	)
 
 	client := p.httpClient
 	if client == nil {
@@ -1483,23 +1433,9 @@ func (p *OAuthProvider) doCheckCLIAuthEnabledAttempt(ctx context.Context, access
 	}
 	resp, err := client.Do(req)
 	if err != nil {
-		slog.Debug("auth.cli_auth_enabled.error",
-			"attempt", attempt,
-			"url", url,
-			"trace_id", traceID,
-			"error", err,
-		)
 		return nil, fmt.Errorf("sending request: %w", err)
 	}
 	defer resp.Body.Close()
-	slog.Debug("auth.cli_auth_enabled.response",
-		"attempt", attempt,
-		"url", url,
-		"status", resp.StatusCode,
-		"trace_id", traceID,
-		"response_trace_id", cliAuthResponseTraceID(resp.Header),
-		"eagleeye_rpc_id", resp.Header.Get("EagleEye-RpcId"),
-	)
 
 	data, err := io.ReadAll(io.LimitReader(resp.Body, config.MaxResponseBodySize))
 	if err != nil {
@@ -1513,42 +1449,9 @@ func (p *OAuthProvider) doCheckCLIAuthEnabledAttempt(ctx context.Context, access
 	return &status, nil
 }
 
-func cliAuthTraceID() string {
-	if traceID := strings.TrimSpace(os.Getenv("DINGTALK_TRACE_ID")); traceID != "" {
-		return traceID
-	}
-	return strings.ReplaceAll(uuid.NewString(), "-", "")
-}
-
-func applyCLIAuthTraceHeaders(req *http.Request, traceID string) {
-	if req == nil || traceID == "" {
-		return
-	}
-	req.Header.Set("EagleEye-TraceId", traceID)
-	req.Header.Set("X-Dingtalk-Trace-Id", traceID)
-}
-
-func cliAuthResponseTraceID(headers http.Header) string {
-	for _, key := range []string{
-		"EagleEye-TraceId",
-		"X-Trace-Id",
-		"X-Request-Id",
-		"X-Dingtalk-Trace-Id",
-	} {
-		if value := strings.TrimSpace(headers.Get(key)); value != "" {
-			return value
-		}
-	}
-	return ""
-}
-
 // GetSuperAdmins fetches the list of corp super admins.
 // It retries up to mcpRequestMaxRetries times on transient errors.
 func GetSuperAdmins(ctx context.Context, accessToken string) (*SuperAdminResponse, error) {
-	return GetSuperAdminsForLoginRegion(ctx, accessToken, LoginRegionDefault)
-}
-
-func GetSuperAdminsForLoginRegion(ctx context.Context, accessToken string, region LoginRegion) (*SuperAdminResponse, error) {
 	var lastErr error
 	for attempt := 0; attempt < mcpRequestMaxRetries; attempt++ {
 		if attempt > 0 {
@@ -1558,7 +1461,7 @@ func GetSuperAdminsForLoginRegion(ctx context.Context, accessToken string, regio
 			case <-oauthRetryAfter(time.Duration(attempt) * time.Second):
 			}
 		}
-		result, err := doGetSuperAdminsForLoginRegion(ctx, accessToken, region)
+		result, err := doGetSuperAdmins(ctx, accessToken)
 		if err == nil {
 			return result, nil
 		}
@@ -1568,11 +1471,7 @@ func GetSuperAdminsForLoginRegion(ctx context.Context, accessToken string, regio
 }
 
 func doGetSuperAdmins(ctx context.Context, accessToken string) (*SuperAdminResponse, error) {
-	return doGetSuperAdminsForLoginRegion(ctx, accessToken, LoginRegionDefault)
-}
-
-func doGetSuperAdminsForLoginRegion(ctx context.Context, accessToken string, region LoginRegion) (*SuperAdminResponse, error) {
-	url := MCPBaseURLForLoginRegion(region) + SuperAdminPath
+	url := GetMCPBaseURL() + SuperAdminPath
 	req, err := oauthNewRequest(ctx, http.MethodGet, url, nil)
 	if err != nil {
 		return nil, fmt.Errorf("creating request: %w", err)
@@ -1601,10 +1500,6 @@ func doGetSuperAdminsForLoginRegion(ctx context.Context, accessToken string, reg
 // SendCliAuthApply sends a CLI auth apply request to the specified admin.
 // It retries up to mcpRequestMaxRetries times on transient errors.
 func SendCliAuthApply(ctx context.Context, accessToken, adminStaffID string) (*SendApplyResponse, error) {
-	return SendCliAuthApplyForLoginRegion(ctx, accessToken, adminStaffID, LoginRegionDefault)
-}
-
-func SendCliAuthApplyForLoginRegion(ctx context.Context, accessToken, adminStaffID string, region LoginRegion) (*SendApplyResponse, error) {
 	var lastErr error
 	for attempt := 0; attempt < mcpRequestMaxRetries; attempt++ {
 		if attempt > 0 {
@@ -1614,7 +1509,7 @@ func SendCliAuthApplyForLoginRegion(ctx context.Context, accessToken, adminStaff
 			case <-oauthRetryAfter(time.Duration(attempt) * time.Second):
 			}
 		}
-		result, err := doSendCliAuthApplyForLoginRegion(ctx, accessToken, adminStaffID, region)
+		result, err := doSendCliAuthApply(ctx, accessToken, adminStaffID)
 		if err == nil {
 			return result, nil
 		}
@@ -1624,11 +1519,7 @@ func SendCliAuthApplyForLoginRegion(ctx context.Context, accessToken, adminStaff
 }
 
 func doSendCliAuthApply(ctx context.Context, accessToken, adminStaffID string) (*SendApplyResponse, error) {
-	return doSendCliAuthApplyForLoginRegion(ctx, accessToken, adminStaffID, LoginRegionDefault)
-}
-
-func doSendCliAuthApplyForLoginRegion(ctx context.Context, accessToken, adminStaffID string, region LoginRegion) (*SendApplyResponse, error) {
-	url := MCPBaseURLForLoginRegion(region) + SendCliAuthApplyPath + "?adminStaffId=" + adminStaffID
+	url := GetMCPBaseURL() + SendCliAuthApplyPath + "?adminStaffId=" + adminStaffID
 	req, err := oauthNewRequest(ctx, http.MethodGet, url, nil)
 	if err != nil {
 		return nil, fmt.Errorf("creating request: %w", err)
@@ -1666,10 +1557,6 @@ type ClientIDResponse struct {
 // This is used when no client ID is provided via flags, config, or env vars.
 // It retries up to mcpRequestMaxRetries times on transient errors.
 func FetchClientIDFromMCP(ctx context.Context) (string, error) {
-	return FetchClientIDFromMCPForLoginRegion(ctx, LoginRegionDefault)
-}
-
-func FetchClientIDFromMCPForLoginRegion(ctx context.Context, region LoginRegion) (string, error) {
 	var lastErr error
 	for attempt := 0; attempt < mcpRequestMaxRetries; attempt++ {
 		if attempt > 0 {
@@ -1679,7 +1566,7 @@ func FetchClientIDFromMCPForLoginRegion(ctx context.Context, region LoginRegion)
 			case <-oauthRetryAfter(time.Duration(attempt) * time.Second):
 			}
 		}
-		id, err := doFetchClientIDFromMCPForLoginRegion(ctx, region)
+		id, err := doFetchClientIDFromMCP(ctx)
 		if err == nil {
 			return id, nil
 		}
@@ -1689,11 +1576,7 @@ func FetchClientIDFromMCPForLoginRegion(ctx context.Context, region LoginRegion)
 }
 
 func doFetchClientIDFromMCP(ctx context.Context) (string, error) {
-	return doFetchClientIDFromMCPForLoginRegion(ctx, LoginRegionDefault)
-}
-
-func doFetchClientIDFromMCPForLoginRegion(ctx context.Context, region LoginRegion) (string, error) {
-	url := MCPBaseURLForLoginRegion(region) + ClientIDPath
+	url := GetMCPBaseURL() + ClientIDPath
 	req, err := oauthNewRequest(ctx, http.MethodGet, url, nil)
 	if err != nil {
 		return "", fmt.Errorf("creating request: %w", err)

internal/auth/oauth_provider.go

@@ -68,27 +68,6 @@ var (
 	oauthSleep = time.Sleep
 )
 
-func oauthFetchClientIDForLoginRegion(ctx context.Context, region LoginRegion) (string, error) {
-	if region.IsInternational() {
-		return FetchClientIDFromMCPForLoginRegion(ctx, region)
-	}
-	return oauthFetchClientID(ctx)
-}
-
-func oauthGetAdminsForLoginRegion(ctx context.Context, accessToken string, region LoginRegion) (*SuperAdminResponse, error) {
-	if region.IsInternational() {
-		return GetSuperAdminsForLoginRegion(ctx, accessToken, region)
-	}
-	return oauthGetAdmins(ctx, accessToken)
-}
-
-func oauthSendApplyForLoginRegion(ctx context.Context, accessToken, adminStaffID string, region LoginRegion) (*SendApplyResponse, error) {
-	if region.IsInternational() {
-		return SendCliAuthApplyForLoginRegion(ctx, accessToken, adminStaffID, region)
-	}
-	return oauthSendApply(ctx, accessToken, adminStaffID)
-}
-
 // OAuthProvider handles the DingTalk OAuth 2.0 authorization code flow.
 type OAuthProvider struct {
 	configDir    string
@@ -101,7 +80,6 @@ type OAuthProvider struct {
 	// IdentityEnricher resolves userId/userName/corpName while the freshly
 	// exchanged access token is still only in memory.
 	IdentityEnricher func(context.Context, *TokenData) error
-	LoginRegion      LoginRegion
 }
 
 // NewOAuthProvider creates a new OAuth provider.
@@ -195,7 +173,7 @@ func (p *OAuthProvider) Login(ctx context.Context, force bool) (*TokenData, erro
 		if p.logger != nil {
 			p.logger.Debug("fetching client ID from MCP server (OAuth flow always re-fetches)")
 		}
-		mcpClientID, mcpErr := oauthFetchClientIDForLoginRegion(ctx, p.LoginRegion)
+		mcpClientID, mcpErr := oauthFetchClientID(ctx)
 		if mcpErr != nil {
 			return nil, fmt.Errorf("%s: %w", i18n.T("获取 Client ID 失败"), mcpErr)
 		}
@@ -423,7 +401,7 @@ func (p *OAuthProvider) Login(ctx context.Context, force bool) (*TokenData, erro
 			_, _ = w.Write([]byte(`{"success":false,"errorMsg":"授权尚未完成"}`))
 			return
 		}
-		result, err := oauthGetAdminsForLoginRegion(ctx, token.AccessToken, p.LoginRegion)
+		result, err := oauthGetAdmins(ctx, token.AccessToken)
 		if err != nil {
 			_, _ = fmt.Fprintf(w, `{"success":false,"errorMsg":"%s"}`, err.Error())
 			return
@@ -447,7 +425,7 @@ func (p *OAuthProvider) Login(ctx context.Context, force bool) (*TokenData, erro
 			_, _ = w.Write([]byte(`{"success":false,"errorMsg":"授权尚未完成"}`))
 			return
 		}
-		result, err := oauthSendApplyForLoginRegion(ctx, token.AccessToken, adminStaffID, p.LoginRegion)
+		result, err := oauthSendApply(ctx, token.AccessToken, adminStaffID)
 		if err != nil {
 			_, _ = fmt.Fprintf(w, `{"success":false,"errorMsg":"%s"}`, err.Error())
 			return
@@ -470,13 +448,7 @@ func (p *OAuthProvider) Login(ctx context.Context, force bool) (*TokenData, erro
 		applySent := callbackApplySent
 		selectedAdminId := callbackSelectedAdminId
 		callbackTokenMu.Unlock()
-		data, _ := json.Marshal(map[string]any{
-			"clientId":        p.clientID,
-			"authorizeUrl":    AuthorizeURLForLoginRegion(p.LoginRegion),
-			"applySent":       applySent,
-			"selectedAdminId": selectedAdminId,
-		})
-		_, _ = w.Write(data)
+		_, _ = fmt.Fprintf(w, `{"clientId":"%s","applySent":%t,"selectedAdminId":"%s"}`, p.clientID, applySent, selectedAdminId)
 	})
 
 	// API endpoint: check CLI auth enabled status
@@ -519,7 +491,7 @@ func (p *OAuthProvider) Login(ctx context.Context, force bool) (*TokenData, erro
 		_ = server.Shutdown(shutCtx)
 	}()
 
-	authURL := buildAuthURLForRegion(p.clientID, redirectURI, p.TargetCorpID, p.LoginRegion)
+	authURL := buildAuthURL(p.clientID, redirectURI, p.TargetCorpID)
 	if p.logger != nil {
 		p.logger.Debug("authorization URL", "url", authURL)
 	}

internal/auth/portable_store.go

@@ -272,7 +272,7 @@ func ImportPortableAuthBundle(configDir string, r io.Reader) (PortableImportRepo
 
 func portableConfigFiles(configDir string) ([]string, error) {
 	var files []string
-	patterns := []string{"app*.json", profilesJSONFile, "mcp_url", config.ManagedMCPURLRegionFileName, "terminal_url"}
+	patterns := []string{"app*.json", profilesJSONFile, "mcp_url", "terminal_url"}
 	for _, pattern := range patterns {
 		matches, err := portableGlob(filepath.Join(configDir, pattern))
 		if err != nil {

internal/auth/token.go

@@ -97,7 +97,6 @@ type TokenData struct {
 	ClientID       string    `json:"client_id,omitempty"` // Associated app client ID for refresh
 	UpdatedAt      string    `json:"updated_at,omitempty"`
 	Source         string    `json:"source,omitempty"`
-	LoginRegion    string    `json:"login_region,omitempty"`
 	// LegacyOrgScopedProfile is an in-memory destination for an explicitly
 	// matched historical profile whose userId was never resolved. It is never
 	// persisted as token material.

internal/cli/command_meta.go

@@ -28,6 +28,8 @@ import (
 	"strings"
 	"sync"
 	"sync/atomic"
+
+	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/corecmd/contract"
 )
 
 // CommandMeta is the complete runtime metadata view for a single command.
@@ -56,8 +58,9 @@ type CommandSelection struct {
 }
 
 var (
-	metaByCLIPathOnce sync.Once
-	metaByCLIPath     map[string]CommandMeta
+	metaByCLIPathOnce        sync.Once
+	metaByCLIPath            map[string]CommandMeta
+	toolCallRetryByInterface map[InterfaceRefKey]toolCallRetryResolution
 )
 
 // Counter names retain "MetaIndex" for RuntimeSchemaMetadataLoadCounts
@@ -75,10 +78,12 @@ func installDeliveryCommandMeta(loaded loadedSchemaCatalog, err error) {
 	if err != nil {
 		runtimeDeliverySchemaMetaIndexErr = err
 		metaByCLIPath = nil
+		toolCallRetryByInterface = nil
 		metaByCLIPathOnce.Do(func() {})
 		return
 	}
 	metaByCLIPath = buildMetaByCLIPath(loaded)
+	toolCallRetryByInterface = buildToolCallRetryLookup(loaded)
 	runtimeDeliverySchemaMetaIndexErr = nil
 	metaByCLIPathOnce.Do(func() {})
 }
@@ -124,6 +129,7 @@ func buildMetaByCLIPathFromRegistry(registry SchemaRegistry) map[string]CommandM
 					Risk:         tool.Safety.Risk,
 					Confirmation: tool.Safety.Confirmation,
 					Idempotency:  tool.Safety.Idempotency,
+					RetryPolicy:  cloneRetryPolicy(tool.RetryPolicy),
 				},
 				Selection: CommandSelection{
 					AgentSummary: tool.Selection.AgentSummary,
@@ -163,6 +169,7 @@ func buildMetaByCLIPathFromSnapshotTools(tools map[string]map[string]any) map[st
 				Risk:         schemaString(tool["risk"]),
 				Confirmation: schemaString(tool["confirmation"]),
 				Idempotency:  schemaString(tool["idempotency"]),
+				RetryPolicy:  retryPolicyFromSchemaValue(tool["retry_policy"]),
 			},
 			Selection: CommandSelection{
 				AgentSummary: schemaString(tool["agent_summary"]),
@@ -212,3 +219,13 @@ func ResolveMeta(cliPath string) (CommandMeta, bool) {
 	m, ok := metaByCLIPath[cliPath]
 	return m, ok
 }
+
+// ResolveInvocationSafety returns the effective retry decision for one CLI
+// invocation. The arguments map is keyed by declared CLI parameter names.
+func ResolveInvocationSafety(cliPath string, arguments map[string]any) (contract.RetryDecision, bool) {
+	meta, ok := ResolveMeta(cliPath)
+	if !ok {
+		return contract.RetryDecision{}, false
+	}
+	return meta.Safety.Resolve(arguments), true
+}

internal/cli/command_safety.go

@@ -17,6 +17,7 @@ import (
 	"fmt"
 	"strings"
 
+	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/corecmd/contract"
 	"github.com/spf13/cobra"
 )
 
@@ -30,7 +31,18 @@ type CommandSafety struct {
 	Effect       string // read / write / destructive
 	Risk         string // low / medium / high
 	Confirmation string // not_required / user_required
-	Idempotency  string // idempotent / non_idempotent
+	Idempotency  string // idempotent / non_idempotent / unknown / conditional
+	RetryPolicy  *contract.RetryPolicySpec
+}
+
+// Resolve derives invocation-scoped retry safety from reviewed metadata and
+// actual CLI arguments. It never changes the static Schema contract.
+func (s CommandSafety) Resolve(arguments map[string]any) contract.RetryDecision {
+	key := ""
+	if s.RetryPolicy != nil {
+		key = s.RetryPolicy.KeyParameter
+	}
+	return contract.ResolveRetryDecision(s.Idempotency, s.RetryPolicy, arguments, key)
 }
 
 // ShouldRender returns true when the safety metadata warrants a visible

internal/cli/command_safety_test.go

@@ -15,6 +15,7 @@ package cli
 
 import (
 	"fmt"
+	"reflect"
 	"strings"
 	"testing"
 )
@@ -79,7 +80,7 @@ func TestSafetyForCLIPathTrimsWhitespace(t *testing.T) {
 	if !ok2 {
 		t.Fatal("trimmed lookup failed; whitespace not trimmed")
 	}
-	if s1 != s2 {
+	if !reflect.DeepEqual(s1, s2) {
 		t.Errorf("whitespace-trimmed result differs: %+v vs %+v", s1, s2)
 	}
 }
@@ -161,7 +162,7 @@ func TestResolveMetaAliasLookup(t *testing.T) {
 	if aliased.Identity.CLIPath != primary.Identity.CLIPath || aliased.Identity.Canonical != primary.Identity.Canonical {
 		t.Fatalf("alias metadata = %+v, want same identity as primary %+v", aliased.Identity, primary.Identity)
 	}
-	if aliased.Safety != primary.Safety {
+	if !reflect.DeepEqual(aliased.Safety, primary.Safety) {
 		t.Fatalf("alias safety = %+v, want %+v", aliased.Safety, primary.Safety)
 	}
 }

internal/cli/contract_final_assembly_test.go

@@ -35,7 +35,13 @@ func TestCrossPlatformCoverageRuntimeToolSpecFromContractFinalPassThrough(t *tes
 	contractfinal.RegisterRuntimeContractFinal(cmd, contract.ContractFinalPayload{
 		Title: "Final Title",
 		Safety: &contract.SafetySpec{
-			Effect: "write", Confirmation: "user_required", Idempotency: "none",
+			Effect: "write", Confirmation: "user_required", Idempotency: "conditional",
+		},
+		RetryPolicy: &contract.RetryPolicySpec{Mode: contract.RetryModeDeduplicationKey, KeyParameter: "mode", SamePayloadRequired: true},
+		Parameters:  []contract.ParamDecl{{Name: "mode", Property: "mode"}},
+		Interface: &contract.InterfaceSpec{
+			Mode: contract.InterfaceModeMCP, Availability: contract.InterfaceAvailable,
+			Ref: &contract.InterfaceRefSpec{ProductID: "dev", RPCName: "create_thing"},
 		},
 		DryRun: &contract.DryRunSpec{PreviewKind: contract.DryRunPreviewInvocation},
 		Result: &contract.ResultSpec{
@@ -69,9 +75,12 @@ func TestCrossPlatformCoverageRuntimeToolSpecFromContractFinalPassThrough(t *tes
 	if spec.Title != "Final Title" {
 		t.Fatalf("title = %q", spec.Title)
 	}
-	if spec.Safety.Confirmation != "user_required" || spec.Safety.Idempotency != "none" {
+	if spec.Safety.Confirmation != "user_required" || spec.Safety.Idempotency != "conditional" {
 		t.Fatalf("safety = %#v", spec.Safety)
 	}
+	if spec.RetryPolicy == nil || spec.RetryPolicy.KeyParameter != "mode" {
+		t.Fatalf("retry_policy = %#v", spec.RetryPolicy)
+	}
 	if spec.DryRun == nil || spec.DryRun.PreviewKind != contract.DryRunPreviewInvocation {
 		t.Fatalf("dry_run = %#v", spec.DryRun)
 	}
@@ -89,6 +98,21 @@ func TestCrossPlatformCoverageRuntimeToolSpecFromContractFinalPassThrough(t *tes
 	}
 }
 
+func TestCrossPlatformCoverageRuntimeToolSpecRejectsInvalidRetryPolicy(t *testing.T) {
+	cmd := &cobra.Command{Use: "send"}
+	entry := runtimeSchemaEntry{
+		ProductID: "chat", ToolName: "send", CLIName: "send",
+		CLIPath: "chat send", PrimaryCLIPath: "chat send", ProductName: "Chat", Command: cmd,
+	}
+	_, err := runtimeToolSpecFromContractFinal(entry, contract.ContractFinalPayload{
+		Safety:      &contract.SafetySpec{Idempotency: "conditional"},
+		RetryPolicy: &contract.RetryPolicySpec{Mode: "inferred", KeyParameter: "uuid", SamePayloadRequired: true},
+	}, runtimeSchemaMetadataSources{})
+	if err == nil || !strings.Contains(err.Error(), "unsupported mode") {
+		t.Fatalf("invalid retry policy error = %v", err)
+	}
+}
+
 func TestRuntimeToolSpecHidesUnifiedResultForInactiveRollout(t *testing.T) {
 	for _, state := range []output.RolloutState{output.RolloutLegacyOnly, output.RolloutDualValidate} {
 		t.Run(string(state), func(t *testing.T) {

internal/cli/param_aliases.go

@@ -177,7 +177,6 @@ func reduceLeafParamAliases(path string, realByMorph map[string][]realFlag, conc
 	aliasMap := make(map[string]string)
 	blockedSet := make(map[string]bool)
 	excludedSet := make(map[string]bool)
-	claimedRealSet := make(map[string]bool)
 	pendingReview := ov.Confirm || ov.Investigate
 
 	for boundFlag, conceptID := range ov.Bind {
@@ -219,14 +218,6 @@ func reduceLeafParamAliases(path string, realByMorph map[string][]realFlag, conc
 		if len(candidates) == 0 {
 			continue
 		}
-		for m := range eff {
-			if _, isReal := realByMorph[m]; isReal {
-				claimedRealSet[m] = true
-			}
-		}
-		for _, exclude := range concept.Excludes {
-			excludedSet[cmdutil.Morph(exclude)] = true
-		}
 		visible := distinctRealNames(candidates, true)
 		var canon string
 		switch len(visible) {
@@ -276,18 +267,21 @@ func reduceLeafParamAliases(path string, realByMorph map[string][]realFlag, conc
 			}
 			aliasMap[m] = canon
 		}
+		// Excludes are not passive prose: once this concept is active on a
+		// reviewed command, a non-real excluded spelling is protected from
+		// downstream fuzzy correction. A real flag is left alone because it
+		// already has an independently valid command-local meaning.
+		for _, exclude := range concept.Excludes {
+			morphed := cmdutil.Morph(exclude)
+			if _, isReal := realByMorph[morphed]; !isReal {
+				excludedSet[morphed] = true
+			}
+		}
 	}
 	for excluded := range excludedSet {
-		if _, isAlias := aliasMap[excluded]; isAlias {
-			continue
+		if _, isAlias := aliasMap[excluded]; !isAlias {
+			blockedSet[excluded] = true
 		}
-		if claimedRealSet[excluded] {
-			continue
-		}
-		if _, isReal := realByMorph[excluded]; isReal {
-			continue
-		}
-		blockedSet[excluded] = true
 	}
 
 	// (b) Command scoped aliases override concept reductions.

internal/cli/param_aliases_test.go

@@ -237,42 +237,6 @@ func TestReduceLeafParamAliasesRemainingEdges(t *testing.T) {
 	})
 }
 
-func TestCrossPlatformCoverageReduceLeafParamAliasesBindExcludesRealFlags(t *testing.T) {
-	entry, problems := reduceLeafParamAliases(
-		"demo cmd",
-		realMap(realFlag{name: "id"}, realFlag{name: "name"}, realFlag{name: "query"}),
-		[]Concept{
-			{ID: "base_id", Members: []string{"base-id", "base-token"}, Excludes: []string{"keyword", "name", "query", "unsafe"}},
-			{ID: "query", Members: []string{"query", "keyword"}},
-		},
-		CommandOverride{Bind: map[string]string{"id": "base_id"}},
-	)
-	if len(problems) != 0 {
-		t.Fatalf("reduceLeafParamAliases() problems = %v", problems)
-	}
-	if entry == nil {
-		t.Fatal("reduceLeafParamAliases() entry = nil")
-	}
-	if entry.Aliases["base-id"] != "id" || entry.Aliases["base-token"] != "id" {
-		t.Fatalf("bound aliases = %#v, want base-id/base-token -> id", entry.Aliases)
-	}
-	if entry.Aliases["keyword"] != "query" {
-		t.Fatalf("query alias = %#v, want keyword -> query", entry.Aliases)
-	}
-	if containsParamAlias(entry.Blocked, "keyword") {
-		t.Fatalf("excluded alias entered blocked list: %#v", entry.Blocked)
-	}
-	if containsParamAlias(entry.Blocked, "name") {
-		t.Fatalf("real excluded flag entered blocked list: %#v", entry.Blocked)
-	}
-	if containsParamAlias(entry.Blocked, "query") {
-		t.Fatalf("claimed real excluded flag entered blocked list: %#v", entry.Blocked)
-	}
-	if !containsParamAlias(entry.Blocked, "unsafe") {
-		t.Fatalf("non-real excluded flag was not blocked: %#v", entry.Blocked)
-	}
-}
-
 func TestParamAliasEntryLookupMethods(t *testing.T) {
 	entry := ParamAliasEntry{
 		Aliases:   map[string]string{"uid": "user"},
@@ -493,22 +457,6 @@ func TestReduceLeafParamAliasesExcludesProtectFuzzyButDoNotOverrideAnotherConcep
 	}
 }
 
-func TestReduceLeafParamAliasesExcludesDoNotBlockRealFlag(t *testing.T) {
-	concepts := []Concept{
-		{ID: "single_id", Members: []string{"id", "item-id"}, Excludes: []string{"item-ids"}},
-	}
-	entry, problems := reduceLeafParamAliases("demo cmd", realMap(realFlag{name: "id"}, realFlag{name: "item-ids"}), concepts, CommandOverride{})
-	if len(problems) != 0 {
-		t.Fatalf("unexpected problems: %v", problems)
-	}
-	if entry == nil {
-		t.Fatal("expected a reduced entry")
-	}
-	if containsParamAlias(entry.Blocked, "item-ids") {
-		t.Fatalf("real exclude was blocked: %#v", entry)
-	}
-}
-
 func TestReduceLeafParamAliasesRejectsProtectionOrScopedAliasOnRealFlag(t *testing.T) {
 	real := realMap(realFlag{name: "user-id"}, realFlag{name: "user"})
 	for name, override := range map[string]CommandOverride{
@@ -524,58 +472,6 @@ func TestReduceLeafParamAliasesRejectsProtectionOrScopedAliasOnRealFlag(t *testi
 	}
 }
 
-func TestGeneratedParamAliasesBlockPluralListSpellingsOnSingleIDCommands(t *testing.T) {
-	entries := make(map[string]ParamAliasEntry, len(generatedParamAliases))
-	for _, entry := range generatedParamAliases {
-		entries[entry.CLIPath] = entry
-	}
-	assertBlocked := func(path string, names ...string) {
-		t.Helper()
-		entry, ok := entries[path]
-		if !ok {
-			t.Fatalf("missing generated alias entry for %q", path)
-		}
-		for _, name := range names {
-			if !entry.IsBlocked(cmdutil.Morph(name)) {
-				t.Fatalf("%s: %q not blocked; entry = %#v", path, name, entry)
-			}
-		}
-	}
-
-	for _, path := range []string{
-		"chat message add-emoji",
-		"chat message remove-emoji",
-		"chat message add-text-emotion",
-		"chat message remove-text-emotion",
-	} {
-		assertBlocked(path, "msg-ids", "message-ids")
-	}
-	for _, path := range []string{
-		"chat message send",
-		"chat conversation-info",
-		"chat category add-conv",
-		"chat category remove-conv",
-		"chat message list",
-		"chat message list-mentions",
-		"chat message recall-by-bot",
-		"chat message search",
-	} {
-		assertBlocked(path, "conversation-ids")
-	}
-}
-
-func TestGeneratedParamAliasesKeepAuditJoinUserRoleAmbiguous(t *testing.T) {
-	entry, ok := LookupParamAlias("chat group audit-join-validation")
-	if !ok {
-		t.Fatal("missing generated alias entry for chat group audit-join-validation")
-	}
-	for _, name := range []string{"user", "user-id", "userid", "uid", "staff-id"} {
-		if !entry.IsAmbiguous(cmdutil.Morph(name)) {
-			t.Fatalf("%q not ambiguous; entry = %#v", name, entry)
-		}
-	}
-}
-
 // TestGeneratedParamAliasesAreWellFormed guards the committed generated table
 // at the Go level, complementing the byte-identity drift gate.
 func TestGeneratedParamAliasesAreWellFormed(t *testing.T) {
@@ -619,68 +515,3 @@ func TestGeneratedParamAliasesAreWellFormed(t *testing.T) {
 		}
 	}
 }
-
-func TestCrossPlatformCoveragePublishedSpaceWorkspaceAliasesRemainExecutable(t *testing.T) {
-	docCommands := []string{
-		"doc +access-change",
-		"doc +access-grant",
-		"doc +access-revoke",
-		"doc +copy",
-		"doc +create",
-		"doc +create-from-template",
-		"doc +grant-and-share",
-		"doc +import",
-		"doc +list",
-		"doc +move",
-		"doc create",
-		"doc file create",
-		"doc import",
-		"doc template apply",
-	}
-	for _, command := range docCommands {
-		entry, ok := LookupParamAlias(command)
-		if !ok {
-			t.Errorf("published Doc command %q has no generated parameter-alias entry", command)
-			continue
-		}
-		for _, emitted := range []string{"space", "space-id"} {
-			target, active := entry.ResolveAlias(emitted)
-			if !active || target != "workspace" {
-				t.Errorf("%s --%s resolution = active:%v target:%q, want --workspace", command, emitted, active, target)
-			}
-			if entry.IsBlocked(emitted) || entry.IsAmbiguous(emitted) {
-				t.Errorf("%s --%s remains protected after restoring its published alias", command, emitted)
-			}
-		}
-	}
-
-	driveInfo, ok := LookupParamAlias("drive info")
-	if !ok {
-		t.Fatal("published drive info command has no generated parameter-alias entry")
-	}
-	for _, emitted := range []string{"space", "workspace", "workspace-id"} {
-		target, active := driveInfo.ResolveAlias(emitted)
-		if !active || target != "space-id" {
-			t.Errorf("drive info --%s resolution = active:%v target:%q, want --space-id", emitted, active, target)
-		}
-		if driveInfo.IsBlocked(emitted) || driveInfo.IsAmbiguous(emitted) {
-			t.Errorf("drive info --%s remains protected after restoring its published alias", emitted)
-		}
-	}
-
-	// Compatibility remains exact-path scoped. Strong type spellings introduced
-	// after the split continue to guard the two value domains elsewhere.
-	for _, test := range []struct {
-		command string
-		emitted string
-	}{
-		{command: "doc create", emitted: "storage-space-id"},
-		{command: "drive +upload", emitted: "workspace-id"},
-		{command: "drive info", emitted: "knowledge-base-id"},
-	} {
-		entry, ok := LookupParamAlias(test.command)
-		if !ok || !entry.IsBlocked(test.emitted) {
-			t.Errorf("%s --%s must remain blocked outside the published compatibility set", test.command, test.emitted)
-		}
-	}
-}

internal/cli/param_concepts.json

@@ -10,10 +10,10 @@
   },
 
   "concepts": {
-    "search_query": {"denotes": "search keyword string", "canonical_hint": "query", "members": ["query", "keyword", "keywords", "q", "search-word"], "excludes": ["name", "subject", "text", "title"], "commands": ["aitable +base-search", "contact +dept-members", "contact +resolve-dept", "contact +search-user", "doc +create-from-template", "doc +find-doc", "doc +search", "doc +template-search", "doc template search", "drive +find-file", "drive +search", "drive +search-docs", "drive search", "mail +find-mail-user", "mail user search", "oa +search-forms", "oa approval search-forms"], "risk": "green"},
-    "pagination_size": {"denotes": "returned item count upper bound", "canonical_hint": "limit", "members": ["limit", "size", "page-size", "max-results", "max-result", "take", "top", "per-page"], "excludes": ["count", "page", "cursor"], "commands": ["aitable record query", "calendar event list", "chat message list", "devdoc article search", "doc +comment-list", "doc +find-doc", "doc +list", "doc +search", "doc +template-list", "doc +template-search", "doc +version-list", "doc comment list", "doc template list", "doc template search", "doc version list", "drive +list", "drive +recent", "drive +recycle-list", "drive +search", "drive +search-docs", "drive +star-list", "drive +version-history", "drive list", "drive list-spaces", "drive permission list", "drive recent", "drive recycle list", "drive search", "drive star list", "mail thread list", "oa +list-executed"], "risk": "green"},
+    "search_query": {"denotes": "search keyword string", "canonical_hint": "query", "members": ["query", "keyword", "keywords", "q", "search-word"], "excludes": ["name", "subject", "text", "title"], "commands": ["aitable +base-search", "contact +dept-members", "contact +resolve-dept", "contact +search-user", "doc +create-from-template", "doc +find-doc", "doc +search", "doc +template-search", "doc template search", "mail +find-mail-user", "mail user search", "oa +search-forms", "oa approval search-forms"], "risk": "green"},
+    "pagination_size": {"denotes": "returned item count upper bound", "canonical_hint": "limit", "members": ["limit", "size", "page-size", "max-results", "max-result", "take", "top", "per-page"], "excludes": ["count", "page", "cursor"], "commands": ["aitable record query", "calendar event list", "chat message list", "devdoc article search", "doc +comment-list", "doc +find-doc", "doc +list", "doc +search", "doc +template-list", "doc +template-search", "doc +version-list", "doc comment list", "doc template list", "doc template search", "doc version list", "mail thread list", "oa +list-executed"], "risk": "green"},
     "page_number": {"denotes": "one-based page number", "canonical_hint": "page", "members": ["page", "page-no", "current-page", "page-num"], "excludes": ["cursor", "page-index", "page-size", "page-token"], "commands": ["devdoc article search"], "risk": "green"},
-    "page_cursor": {"denotes": "pagination cursor/token", "canonical_hint": "cursor", "members": ["cursor", "next-cursor", "page-token", "next-token", "next-page-token"], "excludes": ["page", "offset"], "commands": ["calendar event list", "doc +comment-list", "doc +list", "doc +search", "doc +template-list", "doc +template-search", "doc +version-list", "doc comment list", "doc template list", "doc template search", "doc version list", "drive +list", "drive +recent", "drive +recycle-list", "drive +search", "drive +star-list", "drive +version-history", "drive list", "drive list-spaces", "drive recent", "drive recycle list", "drive search", "drive star list"], "risk": "green"},
+    "page_cursor": {"denotes": "pagination cursor/token", "canonical_hint": "cursor", "members": ["cursor", "next-cursor", "page-token", "next-token", "next-page-token"], "excludes": ["page", "offset"], "commands": ["calendar event list", "doc +comment-list", "doc +list", "doc +search", "doc +template-list", "doc +template-search", "doc +version-list", "doc comment list", "doc template list", "doc template search", "doc version list"], "risk": "green"},
     "content_text": {"denotes": "text body content", "canonical_hint": "text", "members": ["text", "content", "body"], "excludes": ["title", "name"], "commands": ["doc +checkpoint-update", "doc +comment-create", "doc +comment-reply", "doc +comment-update", "doc +create", "doc +doc-append", "doc block insert", "doc block update", "doc comment create", "doc comment create-inline", "doc comment reply", "doc comment update", "doc create"], "risk": "green"},
     "time_start": {"denotes": "start time point with unchanged value format and unit", "canonical_hint": "start", "members": ["start", "start-time", "start-date", "from", "from-date", "begin", "since", "time-min", "min-time"], "excludes": ["date", "time", "end"], "commands": ["calendar event list", "chat message list-all", "report list"], "risk": "yellow"},
     "time_end": {"denotes": "end time point with unchanged value format and unit", "canonical_hint": "end", "members": ["end", "end-time", "end-date", "time-max", "max-time"], "excludes": ["date", "time", "start"], "commands": ["calendar event list"], "risk": "yellow"},
@@ -31,48 +31,31 @@
     "user_ids": {"denotes": "user id list", "canonical_hint": "user-ids", "members": ["users", "user-ids"], "excludes": ["user", "user-id", "userid", "uid", "staff-id", "at-user-ids"], "commands": ["attendance +check-result", "attendance check result", "chat +messages-batch-send-by-bot", "chat group members remove", "chat group set-admin", "chat group-mute-member", "chat message read-status", "chat message search-advanced", "chat message send-by-bot"], "risk": "yellow"},
     "open_dingtalk_ids": {"denotes": "DingTalk openDingTalkId list with unchanged element values", "canonical_hint": "open-dingtalk-ids", "members": ["open-dingtalk-ids"], "excludes": ["user", "user-id", "user-ids", "staff-id", "users"], "commands": ["chat +chat-members-get", "chat category create-smart", "chat group members list-by-ids", "chat message send-by-bot"], "risk": "yellow"},
     "ding_id": {"denotes": "DING id", "canonical_hint": "ding-id", "members": ["ding-id", "open-ding-id"], "excludes": ["id"], "commands": ["ding message receiver-status"], "risk": "yellow"},
-    "folder_id": {"denotes": "drive folder id", "canonical_hint": "folder", "members": ["folder", "folder-id"], "excludes": ["space-id"], "commands": ["drive +copy", "drive +create-folder", "drive +create-shortcut", "drive +list", "drive +move", "drive +upload", "drive commit", "drive copy", "drive list", "drive mkdir", "drive move", "drive shortcut", "drive upload", "drive upload-info", "mail folder update"], "risk": "green"},
-    "drive_storage_space_id": {"denotes": "single numeric DingDrive storage space ID with unchanged value", "canonical_hint": "space-id", "members": ["space-id", "drive-space-id", "storage-space-id", "dingdrive-space-id"], "excludes": ["space", "workspace", "workspace-id", "knowledge-base-id", "wiki-workspace-id"], "commands": ["drive +create-folder", "drive +download", "drive +info", "drive +inspect", "drive +list", "drive +recycle-list", "drive +upload", "drive commit", "drive download", "drive info", "drive list", "drive mkdir", "drive recycle list", "drive upload", "drive upload-info"], "risk": "yellow"},
+    "folder_id": {"denotes": "drive folder id", "canonical_hint": "folder", "members": ["folder", "folder-id"], "excludes": ["space-id"], "commands": ["drive list", "mail folder update"], "risk": "green"},
+    "space_id": {"denotes": "drive/wiki/Doc workspace id with unchanged value", "canonical_hint": "space-id", "members": ["space-id", "space", "workspace", "workspace-id"], "excludes": ["folder", "node"], "commands": ["doc +access-change", "doc +access-grant", "doc +access-revoke", "doc +copy", "doc +create", "doc +create-from-template", "doc +grant-and-share", "doc +import", "doc +list", "doc +move", "doc create", "doc file create", "doc import", "doc template apply", "drive info"], "risk": "yellow"},
     "app_id": {"denotes": "application id", "canonical_hint": "unified-app-id", "members": ["app-id", "unified-app-id", "application-id"], "excludes": ["app-key", "app-secret", "agent-id"], "commands": ["dev app get"], "risk": "yellow"},
     "robot_code": {"denotes": "robot code", "canonical_hint": "robot-code", "members": ["robot-code", "robot"], "excludes": ["robot-id", "bot-id", "open-bot-id", "bot-code"], "commands": ["chat +chat-add-bot", "chat +messages-batch-recall-by-bot", "chat +messages-batch-send-by-bot", "chat +messages-recall-by-bot", "chat +messages-send-by-bot", "chat group members add-bot", "chat message recall-by-bot", "chat message send-by-bot", "ding message send"], "risk": "yellow"},
     "open_bot_id": {"denotes": "single DingTalk openBotId with unchanged value", "canonical_hint": "bot-id", "members": ["bot-id", "open-bot-id"], "excludes": ["robot-code", "robot", "robot-id", "bot-code"], "commands": ["chat +chat-remove-bot", "chat group members remove-bot"], "risk": "yellow"},
-    "doc_node_id": {"denotes": "single DingTalk document nodeId or accepted document URL/token with unchanged value", "canonical_hint": "node", "members": ["node", "node-id", "doc", "doc-id", "file-id", "document-id", "url", "dentry-uuid"], "excludes": ["id", "folder", "folder-id", "parent-id", "workspace", "workspace-id", "block-id", "comment-id", "comment-key", "job-id", "task-id", "template-id", "version", "revision", "dentry-id", "space-id", "name", "role"], "commands": ["doc +access-change", "doc +access-grant", "doc +access-revoke", "doc +background-delete", "doc +background-update", "doc +checkpoint-update", "doc +comment-create", "doc +comment-delete", "doc +comment-list", "doc +comment-reply", "doc +comment-update", "doc +copy", "doc +doc-append", "doc +export", "doc +export-submit", "doc +fetch", "doc +history-list", "doc +history-revert", "doc +history-save", "doc +inspect", "doc +move", "doc +review", "doc +version-list", "doc +version-revert", "doc +version-save", "doc block delete", "doc block insert", "doc block list", "doc block update", "doc comment create", "doc comment create-inline", "doc comment delete", "doc comment list", "doc comment reply", "doc comment update", "doc export", "doc info", "doc media download", "doc media insert", "doc media upload", "doc read", "doc style background clear", "doc style background set", "doc style cover clear", "doc style cover set", "doc style get", "doc update", "doc version list", "doc version revert", "doc version save", "doc whiteboard insert"], "risk": "yellow"},
+    "doc_node_id": {"denotes": "single DingTalk document nodeId or accepted document URL/token with unchanged value", "canonical_hint": "node", "members": ["node", "node-id", "doc", "doc-id", "file-id", "document-id", "url"], "excludes": ["id", "folder", "folder-id", "parent-id", "workspace", "workspace-id", "block-id", "comment-id", "comment-key", "job-id", "task-id", "template-id", "version", "revision"], "commands": ["doc +access-change", "doc +access-grant", "doc +access-revoke", "doc +background-delete", "doc +background-update", "doc +checkpoint-update", "doc +comment-create", "doc +comment-delete", "doc +comment-list", "doc +comment-reply", "doc +comment-update", "doc +copy", "doc +doc-append", "doc +export", "doc +export-submit", "doc +fetch", "doc +history-list", "doc +history-revert", "doc +history-save", "doc +inspect", "doc +move", "doc +review", "doc +version-list", "doc +version-revert", "doc +version-save", "doc block delete", "doc block insert", "doc block list", "doc block update", "doc comment create", "doc comment create-inline", "doc comment delete", "doc comment list", "doc comment reply", "doc comment update", "doc export", "doc info", "doc media download", "doc media insert", "doc media upload", "doc read", "doc style background clear", "doc style background set", "doc style cover clear", "doc style cover set", "doc style get", "doc update", "doc version list", "doc version revert", "doc version save", "doc whiteboard insert"], "risk": "yellow"},
     "doc_comment_key": {"denotes": "single DingTalk document commentKey with unchanged value", "canonical_hint": "comment-key", "members": ["comment-key", "comment-id"], "excludes": ["id", "node", "node-id", "doc-id", "block-id"], "commands": ["doc +comment-delete", "doc +comment-reply", "doc +comment-update", "doc comment delete", "doc comment reply", "doc comment update"], "risk": "yellow"},
-    "doc_version_number": {"denotes": "single document or Drive ordinary-file historical version number with unchanged positive integer value", "canonical_hint": "version", "members": ["version", "version-number", "version-no"], "excludes": ["revision", "id", "node", "node-id", "doc-id"], "commands": ["doc +history-revert", "doc +version-revert", "doc version revert", "drive +version-download", "drive +version-get", "drive +version-revert", "drive download", "drive download-version", "drive revert"], "risk": "yellow"},
+    "doc_version_number": {"denotes": "single DingTalk document historical version number with unchanged integer value", "canonical_hint": "version", "members": ["version", "version-number", "version-no"], "excludes": ["revision", "id", "node", "node-id", "doc-id"], "commands": ["doc +history-revert", "doc +version-revert", "doc version revert"], "risk": "yellow"},
     "doc_content_format": {"denotes": "DingTalk document body format with unchanged markdown/jsonml value", "canonical_hint": "content-format", "members": ["content-format", "doc-format"], "excludes": ["format", "export-format", "mime-type"], "commands": ["doc +create", "doc +update", "doc create", "doc update"], "risk": "green"},
-    "doc_edit_revision": {"denotes": "single optimistic-concurrency revision for a document edit", "canonical_hint": "revision", "members": ["revision", "expected-revision"], "excludes": ["version", "version-number", "version-no"], "commands": ["doc +update", "doc update"], "risk": "yellow"},
-    "drive_recycle_item_id": {"denotes": "single Drive recycle-bin item ID returned by recycle list", "canonical_hint": "id", "members": ["id", "recycle-item-id", "trash-item-id", "deleted-item-id"], "excludes": ["node", "node-id", "file-id", "folder-id", "space-id", "workspace-id"], "commands": ["drive +recycle-restore", "drive recycle restore"], "risk": "yellow"},
-    "drive_modified_time_start": {"denotes": "Drive search modified-time lower bound in unchanged millisecond timestamp unit", "canonical_hint": "modified-from", "members": ["modified-from", "modified-after", "modify-time-from", "modified-time-start"], "excludes": ["modified-to", "created-from", "created-to", "start", "from"], "commands": ["drive +search", "drive search"], "risk": "yellow"},
-    "drive_modified_time_end": {"denotes": "Drive search modified-time upper bound in unchanged millisecond timestamp unit", "canonical_hint": "modified-to", "members": ["modified-to", "modified-before", "modify-time-to", "modified-time-end"], "excludes": ["modified-from", "created-from", "created-to", "end", "to"], "commands": ["drive +search", "drive search"], "risk": "yellow"},
-    "drive_file_size_bytes": {"denotes": "file size in bytes passed unchanged", "canonical_hint": "file-size", "members": ["file-size", "file-size-bytes", "size-bytes", "content-length"], "excludes": ["part-size", "page-size", "limit", "size"], "commands": ["drive commit", "drive upload-info"], "risk": "yellow"},
-    "drive_sort_direction": {"denotes": "Drive result sort direction with unchanged asc/desc enum", "canonical_hint": "order", "members": ["order", "sort", "sort-direction", "order-direction"], "excludes": ["order-by", "sort-by", "order-field"], "commands": ["drive +list", "drive list", "drive star list"], "risk": "green"},
-    "workspace_id": {"denotes": "single knowledge-base or document-space workspace ID/URL passed unchanged; never a numeric DingDrive storage space ID", "canonical_hint": "workspace", "members": ["workspace", "workspace-id", "knowledge-base-id", "wiki-workspace-id"], "excludes": ["space", "space-id", "drive-space-id", "storage-space-id", "dingdrive-space-id", "folder", "folder-id", "node", "node-id", "dentry-id"], "commands": ["doc +access-change", "doc +access-grant", "doc +access-revoke", "doc +copy", "doc +create", "doc +create-from-template", "doc +grant-and-share", "doc +import", "doc +list", "doc +move", "doc create", "doc file create", "doc import", "doc template apply", "drive +copy", "drive +create-shortcut", "drive +move", "drive copy", "drive list", "drive move", "drive permission add", "drive permission list", "drive permission remove", "drive permission transfer-owner", "drive permission update", "drive shortcut", "drive upload"], "risk": "yellow"},
-    "created_time_start": {"denotes": "Doc/Drive search created-time lower bound in unchanged millisecond timestamp unit", "canonical_hint": "created-from", "members": ["created-from", "created-after", "create-time-from", "created-time-start", "create-time-start"], "excludes": ["created-to", "modified-from", "modified-to", "start", "from"], "commands": ["doc +search", "drive +search", "drive search"], "risk": "yellow"},
-    "created_time_end": {"denotes": "Doc/Drive search created-time upper bound in unchanged millisecond timestamp unit", "canonical_hint": "created-to", "members": ["created-to", "created-before", "create-time-to", "created-time-end", "create-time-end"], "excludes": ["created-from", "modified-from", "modified-to", "end", "to"], "commands": ["doc +search", "drive +search", "drive search"], "risk": "yellow"},
-    "document_permission_role": {"denotes": "direct document-space permission role on grant/apply/update, passed unchanged", "canonical_hint": "role", "members": ["role", "permission-role", "access-role", "member-role"], "excludes": ["filter-role", "reserve-role", "permission", "public-permission"], "commands": ["doc +access-change", "doc +access-grant", "doc +grant-and-share", "drive permission add", "drive permission apply", "drive permission update"], "risk": "yellow"},
-    "creator_user_ids": {"denotes": "creator userId list used to filter Doc/Drive search results, passed unchanged", "canonical_hint": "creator-uids", "members": ["creator-uids", "creator-user-ids", "creator-ids", "created-by-user-ids"], "excludes": ["user", "user-id", "user-ids", "users", "owner-id", "modifier-uids"], "commands": ["doc +search", "drive +search", "drive search"], "risk": "yellow"},
-    "local_output_path": {"denotes": "local destination file or directory path for a download/export result, passed unchanged", "canonical_hint": "output", "members": ["output", "output-path", "destination-path", "save-path"], "excludes": ["file", "file-path", "folder", "folder-id", "content-file"], "commands": ["doc +export", "doc +export-get", "doc +media-download", "doc +resource-download", "doc read", "drive +download", "drive +version-download", "drive download", "drive download-version"], "risk": "green"}
+    "doc_edit_revision": {"denotes": "single optimistic-concurrency revision for a document edit", "canonical_hint": "revision", "members": ["revision", "expected-revision"], "excludes": ["version", "version-number", "version-no"], "commands": ["doc +update", "doc update"], "risk": "yellow"}
   },
 
   "command_overrides": {
-    "doc +version-list": {"ambiguous": ["size", "max-results", "max-result", "take", "top", "per-page", "next-cursor", "next-token", "next-page-token"], "note": "--limit/--cursor and the shipped visible compatibility flags --page-size/--page-token remain native. Other pagination spellings cannot choose between two visible real flags and must stop before execution."},
+	"doc +version-list": {"ambiguous": ["size", "max-results", "max-result", "take", "top", "per-page", "next-cursor", "next-token", "next-page-token"], "note": "--limit/--cursor and the shipped visible compatibility flags --page-size/--page-token remain native. Other pagination spellings cannot choose between two visible real flags and must stop before execution."},
     "chat group rename": {"bind": {"id": "open_conversation_id"}, "note": "This command's real --id carries one openConversationId; aliases reduce to --id without changing the value."},
     "chat group members": {"bind": {"id": "open_conversation_id"}},
     "chat group members add": {"bind": {"id": "open_conversation_id"}, "block": ["user-id", "open-dingtalk-id"], "note": "The real --users is a list and may contain mixed userId/openDingTalkId values; singular inputs are not promoted automatically."},
     "chat group members remove": {"bind": {"id": "open_conversation_id"}},
-    "chat conversation-info": {"ambiguous": ["chat-id", "open-conversation-id"], "note": "Visible --conversation-id and legacy --group both remain executable outside the approved hidden-alias migration set."},
-    "chat group-mute": {"ambiguous": ["chat-id", "open-conversation-id"], "note": "Visible --conversation-id and legacy --group both remain executable outside the approved hidden-alias migration set."},
-    "chat group-mute-member": {"ambiguous": ["chat-id", "open-conversation-id"], "note": "Visible --conversation-id and legacy --group both remain executable outside the approved hidden-alias migration set."},
-    "chat message add-emoji": {"scoped_aliases": {"chat-id": "conversation-id"}, "block": ["group-id", "group-ids", "conversation-ids", "open-conversation-ids"], "ambiguous": ["open-message-id"], "note": "Native --chat/--group/--id/--conversation-id/--open-conversation-id and visible --message-id/--msg-id stay executable; numeric/list spellings are rejected."},
-    "chat message add-text-emotion": {"scoped_aliases": {"chat-id": "conversation-id"}, "block": ["group-id", "group-ids", "conversation-ids", "open-conversation-ids"], "ambiguous": ["open-message-id"], "note": "Native --chat/--group/--id/--conversation-id/--open-conversation-id and visible --message-id/--msg-id stay executable; numeric/list spellings are rejected."},
-    "chat message list-mentions": {"ambiguous": ["chat-id", "open-conversation-id"], "note": "Visible --conversation-id and legacy --group both remain executable outside the approved hidden-alias migration set."},
-    "chat message recall-by-bot": {"ambiguous": ["chat-id", "open-conversation-id"], "note": "Visible --conversation-id and legacy --group both remain executable outside the approved hidden-alias migration set."},
-    "chat message remove-emoji": {"scoped_aliases": {"chat-id": "conversation-id"}, "block": ["group-id", "group-ids", "conversation-ids", "open-conversation-ids"], "ambiguous": ["open-message-id"], "note": "Native --chat/--group/--id/--conversation-id/--open-conversation-id and visible --message-id/--msg-id stay executable; numeric/list spellings are rejected."},
-    "chat message remove-text-emotion": {"scoped_aliases": {"chat-id": "conversation-id"}, "block": ["group-id", "group-ids", "conversation-ids", "open-conversation-ids"], "ambiguous": ["open-message-id"], "note": "Native --chat/--group/--id/--conversation-id/--open-conversation-id and visible --message-id/--msg-id stay executable; numeric/list spellings are rejected."},
-    "chat message search": {"ambiguous": ["chat-id", "open-conversation-id"], "note": "Visible --conversation-id and legacy --group both remain executable outside the approved hidden-alias migration set."},
-    "chat mute": {"scoped_aliases": {"chat-id": "conversation-id"}, "block": ["group-id", "group-ids", "conversation-ids", "open-conversation-ids"], "note": "Native --conversation-id and hidden compatibility --group/--id/--chat/--open-conversation-id remain unchanged; reviewed chat-id reduces to --conversation-id."},
-    "drive list": {"ambiguous": ["root-id", "space"], "note": "Numeric --space-id and knowledge-base --workspace are distinct routes; bare --space/--root-id cannot select a domain or folder.", "scoped_aliases": {"document-id": "node", "dentry-uuid": "node", "directory-id": "folder", "order-field": "order-by", "sort-by": "order-by", "sort-field": "order-by"}, "scope_strict": true, "block": ["dentry-id"]},
-    "drive upload": {"ambiguous": ["destination-id", "space", "target-id"], "note": "Local file, display name, MIME, overwrite node, folder, storage space, and knowledge-base workspace remain distinct roles.", "scoped_aliases": {"dentry-uuid": "node", "directory-id": "folder", "overwrite-node-id": "node", "target-folder-id": "folder", "target-workspace-id": "workspace", "source-file": "file", "content-type": "mime-type", "filename": "file-name", "name": "file-name", "display-name": "file-name", "upload-name": "file-name"}, "block": ["dentry-id", "document-url", "output-path"], "scope_strict": true},
+    "chat message add-emoji": {"scoped_aliases": {"chat-id": "conversation-id", "open-conversation-id": "conversation-id"}, "block": ["group-id", "group-ids", "conversation-ids", "open-conversation-ids"], "note": "Native --chat/--group/--id/--conversation-id stay native; numeric groupId and list spellings are rejected."},
+    "chat message add-text-emotion": {"scoped_aliases": {"chat-id": "conversation-id", "open-conversation-id": "conversation-id"}, "block": ["group-id", "group-ids", "conversation-ids", "open-conversation-ids"], "note": "Native --chat/--group/--id/--conversation-id stay native; numeric groupId and list spellings are rejected."},
+    "chat message remove-emoji": {"scoped_aliases": {"chat-id": "conversation-id", "open-conversation-id": "conversation-id"}, "block": ["group-id", "group-ids", "conversation-ids", "open-conversation-ids"], "note": "Native --chat/--group/--id/--conversation-id stay native; numeric groupId and list spellings are rejected."},
+    "chat message remove-text-emotion": {"scoped_aliases": {"chat-id": "conversation-id", "open-conversation-id": "conversation-id"}, "block": ["group-id", "group-ids", "conversation-ids", "open-conversation-ids"], "note": "Native --chat/--group/--id/--conversation-id stay native; numeric groupId and list spellings are rejected."},
+    "chat mute": {"scoped_aliases": {"group": "conversation-id", "chat-id": "conversation-id", "open-conversation-id": "conversation-id"}, "block": ["group-id", "group-ids", "conversation-ids", "open-conversation-ids"], "note": "Native --conversation-id/--id/--chat remain unchanged; other reviewed openConversationId spellings reduce to --conversation-id."},
+    "drive list": {"ambiguous": ["space"], "note": "both --space-id and native compatibility --workspace-id/--workspace exist; bare --space cannot choose one"},
+    "drive upload": {"ambiguous": ["space"], "note": "both --space-id and native compatibility --workspace-id/--workspace exist; bare --space cannot choose one"},
     "ding +receiver-status": {"scoped_aliases": {"id": "ding-id"}, "note": "generic id reduces to ding-id"},
     "ding message receiver-status": {"scoped_aliases": {"id": "ding-id"}},
     "contact user profile get": {"scoped_aliases": {"id": "staff-id", "ids": "staff-id"}, "note": "user-id is reduced by the user_id concept; generic id/ids bound explicitly"},
@@ -90,12 +73,12 @@
     "chat +unread-chats": {"scoped_aliases": {"limit": "count", "size": "count"}, "scope_strict": true, "note": "On this exact command, limit and size both denote the returned unread-conversation count."},
     "chat message list-unread-conversations": {"scoped_aliases": {"limit": "count", "size": "count"}, "scope_strict": true, "note": "On this exact command, limit and size both denote the returned unread-conversation count."},
     "chat +messages-list-direct": {"scoped_aliases": {"start": "time"}, "block": ["end"], "scope_strict": true, "note": "This exact command accepts one start boundary in yyyy-MM-dd HH:mm:ss; an end-only input cannot be represented."},
-    "chat message list": {"scoped_aliases": {"start": "time"}, "block": ["end"], "ambiguous": ["chat-id", "open-conversation-id"], "scope_strict": true, "note": "This exact command accepts one start boundary in yyyy-MM-dd HH:mm:ss; an end-only input cannot be represented. Visible --conversation-id and legacy --group both remain executable outside the approved hidden-alias migration set."},
+    "chat message list": {"scoped_aliases": {"start": "time"}, "block": ["end"], "scope_strict": true, "note": "This exact command accepts one start boundary in yyyy-MM-dd HH:mm:ss; an end-only input cannot be represented."},
     "chat message list-by-sender": {"scoped_aliases": {"user-id": "sender-user-id", "open-dingtalk-id": "sender-open-dingtalk-id"}, "block": ["time"], "scope_strict": true, "note": "Only same-role sender identifiers are mapped; --time cannot supply the required RFC3339 start/end range."},
     "contact +resolve-dept": {"bind": {"name": "search_query"}, "note": "The real --name is a department-name search keyword and carries the search_query concept on this shortcut."},
     "contact +list-sub-depts": {"block": ["name", "query"], "note": "--dept is an integer department id; names and search queries require a separate resolution command"},
     "contact +dept-members": {"bind": {"dept": "search_query"}, "scoped_aliases": {"name": "dept"}, "note": "The real --dept is a department-name search keyword; search spellings come from search_query, while --name remains command-scoped."},
-    "chat message send": {"scoped_aliases": {"to-user": "user", "file": "file-path"}, "ambiguous": ["chat-id", "open-conversation-id"], "note": "Recipient and local-file-path aliases are exact to this command; obsolete file metadata flags remain unsupported. Visible --conversation-id and legacy --group both remain executable outside the approved hidden-alias migration set."},
+    "chat message send": {"scoped_aliases": {"to-user": "user", "file": "file-path"}, "note": "Recipient and local-file-path aliases are exact to this command; obsolete file metadata flags remain unsupported."},
     "chat +group-members": {"bind": {"group": "group_name"}, "note": "The real --group is a group-name search keyword on this shortcut, not an identifier."},
     "chat +category-create": {"scoped_aliases": {"name": "title"}, "scope_strict": true, "note": "The reviewed name/title mapping preserves the category display-name value on this exact shortcut."},
     "chat category create": {"scoped_aliases": {"name": "title"}, "scope_strict": true, "note": "The reviewed name/title mapping preserves the category display-name value on this exact command."},
@@ -104,8 +87,8 @@
     "chat +category-delete": {"block": ["category-ids"], "note": "This command requires one category id; list cardinality is not reduced automatically."},
     "chat category delete": {"block": ["category-ids"], "note": "This command requires one category id; list cardinality is not reduced automatically."},
     "chat category list-conversations": {"block": ["category-ids"], "note": "This command requires one category id; list cardinality is not reduced automatically."},
-    "chat category add-conv": {"block": ["category-id"], "ambiguous": ["chat", "chat-id", "open-conversation-id"], "note": "This command requires a category-id list; one id is not promoted into a batch input. Visible --conversation-id and legacy --group both remain executable outside the approved hidden-alias migration set."},
-    "chat category remove-conv": {"block": ["category-id"], "ambiguous": ["chat", "chat-id", "open-conversation-id"], "note": "This command requires a category-id list; one id is not promoted into a batch input. Visible --conversation-id and legacy --group both remain executable outside the approved hidden-alias migration set."},
+    "chat category add-conv": {"block": ["category-id"], "note": "This command requires a category-id list; one id is not promoted into a batch input."},
+    "chat category remove-conv": {"block": ["category-id"], "note": "This command requires a category-id list; one id is not promoted into a batch input."},
     "chat +chat-role-update": {"block": ["role-ids"], "note": "This command requires one role id; list cardinality is not reduced automatically."},
     "chat group-role remove": {"block": ["role-ids"], "note": "This command requires one role id; list cardinality is not reduced automatically."},
     "chat group-role update": {"block": ["role-ids"], "note": "This command requires one role id; list cardinality is not reduced automatically."},
@@ -115,12 +98,12 @@
     "chat +messages-send-by-webhook": {"scoped_aliases": {"at-user-ids": "at-users"}, "scope_strict": true, "note": "Both names denote the same userId list used for @ mentions on this exact shortcut."},
     "chat message send-by-webhook": {"scoped_aliases": {"at-user-ids": "at-users"}, "scope_strict": true, "note": "Both names denote the same userId list used for @ mentions on this exact command."},
     "doc block insert": {"block": ["before-block-id"], "note": "Parent and reference roles remain distinct. --before-block-id needs both --ref-block and --where before, while role-free --block-id cannot choose parent versus reference.", "scoped_aliases": {"parent-block-id": "parent-block", "ref-block-id": "ref-block", "reference-block-id": "ref-block"}, "ambiguous": ["block-id"], "scope_strict": true},
-    "chat message send-by-bot": {"scoped_aliases": {"at-users": "at-user-ids"}, "block": ["user-id", "to-user-id"], "ambiguous": ["at-ids", "chat-id", "open-conversation-id"], "note": "The reviewed @ userId-list alias is exact; singular recipients are not promoted, and bare --at-ids cannot choose an identifier domain. Visible --conversation-id and legacy --group both remain executable outside the approved hidden-alias migration set."},
+    "chat message send-by-bot": {"scoped_aliases": {"at-users": "at-user-ids"}, "block": ["user-id", "to-user-id"], "ambiguous": ["at-ids"], "note": "The reviewed @ userId-list alias is exact; singular recipients are not promoted, and bare --at-ids cannot choose an identifier domain."},
     "doc +export-get": {"block": ["doc-id", "document-id", "file-id", "node", "node-id", "task-id", "url"], "note": "This command queries one export jobId. Document node identifiers and import taskId spellings are different entities and are rejected.", "scoped_aliases": {"export-job-id": "job-id"}, "scope_strict": true},
     "doc block delete": {"block": ["index"], "note": "index (position) vs node (node id) are different"},
-    "doc +copy": {"scoped_aliases": {"folder-id": "folder", "parent-folder": "folder", "parent-folder-id": "folder", "parent-node-id": "folder", "space": "workspace", "space-id": "workspace"}, "block": ["parent-id"], "scope_strict": true, "note": "This exact Doc command expects a Doc folder nodeId/dentryUuid/URL. Reviewed folder spellings preserve that value; generic --parent-id stays blocked because it may carry a numeric Drive dentryId. The command-scoped --space/--space-id aliases preserve the compatibility published before workspace and numeric DingDrive storage-space concepts were split; they do not make those value domains globally equivalent."},
-    "doc +list": {"scoped_aliases": {"folder-id": "folder", "parent-folder": "folder", "parent-folder-id": "folder", "parent-node-id": "folder", "space": "workspace", "space-id": "workspace"}, "block": ["parent-id"], "scope_strict": true, "note": "This exact Doc command expects a Doc folder nodeId/dentryUuid/URL. Reviewed folder spellings preserve that value; generic --parent-id stays blocked because it may carry a numeric Drive dentryId. The command-scoped --space/--space-id aliases preserve the compatibility published before workspace and numeric DingDrive storage-space concepts were split; they do not make those value domains globally equivalent."},
-    "doc +move": {"scoped_aliases": {"folder-id": "folder", "parent-folder": "folder", "parent-folder-id": "folder", "parent-node-id": "folder", "space": "workspace", "space-id": "workspace"}, "block": ["parent-id"], "scope_strict": true, "note": "This exact Doc command expects a Doc folder nodeId/dentryUuid/URL. Reviewed folder spellings preserve that value; generic --parent-id stays blocked because it may carry a numeric Drive dentryId. The command-scoped --space/--space-id aliases preserve the compatibility published before workspace and numeric DingDrive storage-space concepts were split; they do not make those value domains globally equivalent."},
+    "doc +copy": {"scoped_aliases": {"folder-id": "folder", "parent-folder": "folder", "parent-folder-id": "folder", "parent-node-id": "folder"}, "block": ["parent-id"], "scope_strict": true, "note": "This exact Doc command expects a Doc folder nodeId/dentryUuid/URL. Reviewed folder spellings preserve that value; generic --parent-id stays blocked because it may carry a numeric Drive dentryId."},
+    "doc +list": {"scoped_aliases": {"folder-id": "folder", "parent-folder": "folder", "parent-folder-id": "folder", "parent-node-id": "folder"}, "block": ["parent-id"], "scope_strict": true, "note": "This exact Doc command expects a Doc folder nodeId/dentryUuid/URL. Reviewed folder spellings preserve that value; generic --parent-id stays blocked because it may carry a numeric Drive dentryId."},
+    "doc +move": {"scoped_aliases": {"folder-id": "folder", "parent-folder": "folder", "parent-folder-id": "folder", "parent-node-id": "folder"}, "block": ["parent-id"], "scope_strict": true, "note": "This exact Doc command expects a Doc folder nodeId/dentryUuid/URL. Reviewed folder spellings preserve that value; generic --parent-id stays blocked because it may carry a numeric Drive dentryId."},
     "doc comment create": {"scoped_aliases": {"mentioned-open-conversation-ids": "mentioned-open-conversation-id", "open-conversation-id": "mentioned-open-conversation-id", "open-conversation-ids": "mentioned-open-conversation-id"}, "block": ["chat-id", "chat-ids", "conversation-id", "conversation-ids", "group-id", "group-ids"], "scope_strict": true, "note": "The target is a list of mentioned openConversationIds. Explicit open-conversation spellings preserve the list value; numeric groupId and role-free conversation spellings are rejected."},
     "doc comment reply": {"scoped_aliases": {"mentioned-open-conversation-ids": "mentioned-open-conversation-id", "open-conversation-id": "mentioned-open-conversation-id", "open-conversation-ids": "mentioned-open-conversation-id"}, "block": ["chat-id", "chat-ids", "conversation-id", "conversation-ids", "group-id", "group-ids"], "scope_strict": true, "note": "The target is a list of mentioned openConversationIds. Explicit open-conversation spellings preserve the list value; numeric groupId and role-free conversation spellings are rejected."},
     "doc comment update": {"scoped_aliases": {"mentioned-open-conversation-ids": "mentioned-open-conversation-id", "open-conversation-id": "mentioned-open-conversation-id", "open-conversation-ids": "mentioned-open-conversation-id"}, "block": ["chat-id", "chat-ids", "conversation-id", "conversation-ids", "group-id", "group-ids"], "scope_strict": true, "note": "The target is a list of mentioned openConversationIds. Explicit open-conversation spellings preserve the list value; numeric groupId and role-free conversation spellings are rejected."},
@@ -131,7 +114,7 @@
     "doc export get": {"scoped_aliases": {"export-job-id": "job-id"}, "block": ["doc-id", "document-id", "file-id", "node", "node-id", "url"], "scope_strict": true, "note": "This command queries one export jobId. Document node identifiers are rejected; native hidden --task-id remains the command's reviewed add-only compatibility alias for --job-id."},
     "doc import get": {"scoped_aliases": {"import-task-id": "task-id"}, "block": ["doc-id", "document-id", "file-id", "job-id", "node", "node-id", "url"], "scope_strict": true, "note": "This command queries one import taskId. Document node identifiers and export jobId spellings are different entities and are rejected."},
     "doc +share-doc": {"block": ["doc", "doc-id", "document-id", "file-id", "id", "node", "node-id"], "note": "The real --url requires a shareable document link. Name-only normalization cannot turn a document nodeId into a URL, so identifier spellings are rejected with guidance to provide --url."},
-    "doc update": {"block": ["stdin", "version", "version-no", "version-number"], "note": "--revision is an optimistic-concurrency revision, not a historical document version number. Version spellings must not reduce to --revision. --stdin is not a real switch: stdin input is expressed as --content -, which requires a value-form transformation outside central name aliases."},
+    "doc update": {"block": ["version", "version-no", "version-number"], "note": "--revision is an optimistic-concurrency revision, not a historical document version number. Version spellings must not reduce to --revision."},
     "report outbox list": {"block": ["template-type"], "note": "type vs name are different fields"},
     "chat group members add-bot": {"bind": {"id": "open_conversation_id"}},
     "chat group members list-by-ids": {"bind": {"id": "open_conversation_id", "users": "open_dingtalk_ids"}, "block": ["user-id", "user-ids"], "note": "This command's --id carries openConversationId, while --users carries an openDingTalkId list."},
@@ -148,7 +131,7 @@
     "chat category create-smart": {"bind": {"members": "open_dingtalk_ids"}, "scoped_aliases": {"title": "name"}, "note": "The real --members is an openDingTalkId list; the reviewed title/name alias is exact to the category display name."},
     "chat group audit-join-validation": {"ambiguous": ["user", "user-id", "userid", "uid", "staff-id"], "note": "A role-free user identifier cannot choose between the required --applicant and --inviter roles."},
     "chat message reply": {"block": ["user", "user-id", "userid", "uid", "staff-id"], "note": "The required --ref-sender is a role-specific openDingTalkId and must not accept generic userId spellings."},
-    "chat message send-card": {"block": ["user", "user-id", "userid", "uid", "staff-id"], "ambiguous": ["chat", "chat-id", "open-conversation-id"], "note": "The real --receiver is a role-specific openDingTalkId and must not accept generic userId spellings. Visible --conversation-id and legacy --group both remain executable outside the approved hidden-alias migration set."},
+    "chat message send-card": {"block": ["user", "user-id", "userid", "uid", "staff-id"], "note": "The real --receiver is a role-specific openDingTalkId and must not accept generic userId spellings."},
     "chat +category-add-conversation": {"block": ["category-id"], "note": "The real --category-ids is a list; a singular category ID is not promoted automatically."},
     "chat +category-list-conversations": {"block": ["category-ids"], "note": "The real --category-id is singular; list cardinality is not reduced automatically."},
     "chat +category-remove-conversation": {"block": ["category-id"], "note": "The real --category-ids is a list; a singular category ID is not promoted automatically."},
@@ -175,86 +158,21 @@
     "chat +messages-recall-by-bot": {"block": ["msg-id", "message-id", "open-message-id", "msg-ids", "message-ids", "open-message-ids"], "note": "--keys carries processQueryKey values, not openMessageId values."},
     "chat +messages-reply": {"scoped_aliases": {"msg-id": "ref-msg-id", "open-message-id": "ref-msg-id"}, "block": ["group", "msg-ids", "message-ids", "open-message-ids"], "scope_strict": true, "note": "The observed --group spelling carried a natural group name and is blocked. The only message role is the referenced message; plural IDs are not accepted, while --chat remains a CID alias and native --message-id stays native."},
     "chat +messages-resource-download": {"block": ["download-dir"], "note": "--output may be a file or directory under workspace safety rules; a download directory cannot be assumed equivalent."},
-    "doc +access-change": {"scoped_aliases": {"space": "workspace", "space-id": "workspace"}, "scope_strict": true, "note": "Command-scoped compatibility published before the workspace/storage-space concept split: these spellings keep passing their value unchanged to this Doc command's --workspace flag and do not establish global equivalence with a numeric DingDrive storage space."},
-    "doc +access-grant": {"scoped_aliases": {"space": "workspace", "space-id": "workspace"}, "block": ["target-user-id", "target-user-ids", "user-id", "user-ids"], "ambiguous": ["target-user", "user", "users"], "scope_strict": true, "note": "The real --to accepts collaborator names and resolves them before granting access. Explicit ID spellings cannot be passed through unchanged, while role-free user spellings do not prove whether their values are names or IDs. The command-scoped --space/--space-id aliases preserve previously published Doc workspace compatibility without making workspace and numeric DingDrive storage-space values globally equivalent."},
-    "doc +access-revoke": {"scoped_aliases": {"space": "workspace", "space-id": "workspace"}, "scope_strict": true, "note": "Command-scoped compatibility published before the workspace/storage-space concept split: these spellings keep passing their value unchanged to this Doc command's --workspace flag and do not establish global equivalence with a numeric DingDrive storage space."},
-    "doc +create": {"scoped_aliases": {"folder-id": "folder", "parent-folder": "folder", "parent-folder-id": "folder", "parent-node-id": "folder", "space": "workspace", "space-id": "workspace"}, "block": ["content-file", "parent-id"], "scope_strict": true, "note": "--content-format is value-preservingly normalized to --doc-format. A raw --content-file path cannot become --content without adding the required @file transform, so it is blocked with guidance to use @relative-path or stable doc create. The command-scoped --space/--space-id aliases preserve previously published Doc workspace compatibility without making workspace and numeric DingDrive storage-space values globally equivalent."},
-    "doc +create-from-template": {"scoped_aliases": {"folder-id": "folder", "parent-folder": "folder", "parent-folder-id": "folder", "parent-node-id": "folder", "space": "workspace", "space-id": "workspace"}, "block": ["parent-id"], "scope_strict": true, "note": "This exact Doc command expects a Doc folder nodeId/dentryUuid/URL. Reviewed folder spellings preserve that value; generic --parent-id stays blocked because it may carry a numeric Drive dentryId. The command-scoped --space/--space-id aliases preserve previously published Doc workspace compatibility without making workspace and numeric DingDrive storage-space values globally equivalent."},
-    "doc +import": {"scoped_aliases": {"folder-id": "folder", "parent-folder": "folder", "parent-folder-id": "folder", "parent-node-id": "folder", "space": "workspace", "space-id": "workspace"}, "block": ["parent-id"], "scope_strict": true, "note": "This exact Doc command expects a Doc folder nodeId/dentryUuid/URL. Reviewed folder spellings preserve that value; generic --parent-id stays blocked because it may carry a numeric Drive dentryId. The command-scoped --space/--space-id aliases preserve previously published Doc workspace compatibility without making workspace and numeric DingDrive storage-space values globally equivalent."},
-    "doc create": {"scoped_aliases": {"space": "workspace", "space-id": "workspace"}, "scope_strict": true, "note": "Command-scoped compatibility published before the workspace/storage-space concept split: these spellings keep passing their value unchanged to this Doc command's --workspace flag and do not establish global equivalence with a numeric DingDrive storage space."},
-    "doc file create": {"scoped_aliases": {"space": "workspace", "space-id": "workspace"}, "scope_strict": true, "note": "Command-scoped compatibility published before the workspace/storage-space concept split: these spellings keep passing their value unchanged to this Doc command's --workspace flag and do not establish global equivalence with a numeric DingDrive storage space."},
-    "doc import": {"scoped_aliases": {"space": "workspace", "space-id": "workspace"}, "scope_strict": true, "note": "Command-scoped compatibility published before the workspace/storage-space concept split: these spellings keep passing their value unchanged to this Doc command's --workspace flag and do not establish global equivalence with a numeric DingDrive storage space."},
-    "doc template apply": {"scoped_aliases": {"space": "workspace", "space-id": "workspace"}, "scope_strict": true, "note": "Command-scoped compatibility published before the workspace/storage-space concept split: these spellings keep passing their value unchanged to this Doc command's --workspace flag and do not establish global equivalence with a numeric DingDrive storage space."},
-    "doc +update": {"scoped_aliases": {"mode": "command", "doc-id": "node", "document-id": "node", "file-id": "node", "node-id": "node", "url": "node"}, "block": ["content-file"], "ambiguous": ["element"], "scope_strict": true, "note": "--mode append/overwrite is the same operation selector subset as --command and preserves its value. --content-file is blocked because +update requires @relative-path or stdin and central aliases cannot read/transform a file value. --element cannot choose between document content, a block target, or an insertion reference."},
-    "doc +inspect": {"scoped_aliases": {"include-access": "include-permissions", "include-member": "include-permissions", "include-members": "include-permissions", "include-versions": "include-history"}, "block": ["include", "include-blocks", "include-content", "include-info", "include-meta", "include-metadata"], "scope_strict": true, "note": "Access/member spellings denote the same optional permission list, and versions/history denote the same history section. Generic --include needs value-dependent expansion; base metadata is already returned; block/content reads belong to +fetch, so those spellings stop before fuzzy correction or dispatch."},
-    "doc +fetch": {"scoped_aliases": {"start-block": "start-block-id", "end-block": "end-block-id"}, "block": ["content-format", "doc-format", "range"], "ambiguous": ["block-id"], "scope_strict": true, "note": "Start/end block roles are preserved. A role-free --block-id cannot choose a range/section boundary. --range is an invented composite argument observed alongside --scope range and cannot be split into block IDs by name-only normalization; content-format spellings do not map to the independent --detail contract."},
-    "doc +export": {"block": ["wait"], "scope_strict": true, "note": "The shortcut already submits, polls, and downloads in one workflow. A generic --wait value cannot be converted into the distinct integer --max-polls contract by parameter-name normalization."},
+    "doc +create": {"scoped_aliases": {"folder-id": "folder", "parent-folder": "folder", "parent-folder-id": "folder", "parent-node-id": "folder"}, "block": ["content-file", "parent-id"], "scope_strict": true, "note": "--content-format is value-preservingly normalized to --doc-format. A raw --content-file path cannot become --content without adding the required @file transform, so it is blocked with guidance to use @relative-path or stable doc create."},
+    "doc +create-from-template": {"scoped_aliases": {"folder-id": "folder", "parent-folder": "folder", "parent-folder-id": "folder", "parent-node-id": "folder"}, "block": ["parent-id"], "scope_strict": true, "note": "This exact Doc command expects a Doc folder nodeId/dentryUuid/URL. Reviewed folder spellings preserve that value; generic --parent-id stays blocked because it may carry a numeric Drive dentryId."},
+    "doc +import": {"scoped_aliases": {"folder-id": "folder", "parent-folder": "folder", "parent-folder-id": "folder", "parent-node-id": "folder"}, "block": ["parent-id"], "scope_strict": true, "note": "This exact Doc command expects a Doc folder nodeId/dentryUuid/URL. Reviewed folder spellings preserve that value; generic --parent-id stays blocked because it may carry a numeric Drive dentryId."},
+    "doc +update": {"scoped_aliases": {"mode": "command", "doc-id": "node", "document-id": "node", "file-id": "node", "node-id": "node", "url": "node"}, "block": ["content-file"], "scope_strict": true, "note": "--mode append/overwrite is the same operation selector subset as --command and preserves its value. --content-file is blocked because +update requires @relative-path or stdin and central aliases cannot read/transform a file value."},
+    "doc +inspect": {"scoped_aliases": {"include-versions": "include-history"}, "block": ["include", "include-info"], "scope_strict": true, "note": "Historical versions and history are the same optional section on this exact shortcut. Generic --include needs value-dependent flag expansion, while base document info is always returned, so those spellings are rejected with precise guidance."},
+    "doc +fetch": {"scoped_aliases": {"start-block": "start-block-id", "end-block": "end-block-id"}, "ambiguous": ["block-id"], "scope_strict": true, "note": "Start/end block roles are preserved. A role-free --block-id cannot choose a range/section boundary and must stop before execution."},
     "doc +media-download": {"scoped_aliases": {"doc": "node", "doc-id": "node", "document-id": "node", "node-id": "node"}, "ambiguous": ["file-id", "url"], "scope_strict": true, "note": "This command has both document-node and attachment-resource roles. Strong document spellings map to --node; --file-id and --url cannot safely choose between document and media identities."},
-    "doc +media-insert": {"scoped_aliases": {"doc": "node", "doc-id": "node", "document-id": "node", "node-id": "node"}, "block": ["after-block-id", "before-block-id"], "ambiguous": ["file-id", "url"], "scope_strict": true, "note": "This command has both document-node and local-media roles. Strong document spellings map to --node; --file-id and --url cannot safely choose a role. Before/after block spellings each require expansion into both --ref-block and --where, which name-only normalization cannot perform."},
+    "doc +media-insert": {"scoped_aliases": {"doc": "node", "doc-id": "node", "document-id": "node", "node-id": "node"}, "ambiguous": ["file-id", "url"], "scope_strict": true, "note": "This command has both document-node and local-media roles. Strong document spellings map to --node; --file-id and --url cannot safely choose a role."},
     "doc +media-list": {"scoped_aliases": {"doc": "node", "doc-id": "node", "document-id": "node", "node-id": "node"}, "ambiguous": ["file-id", "url"], "scope_strict": true, "note": "The command lists media inside one document, so only strong document spellings map to --node. File and URL spellings remain role-ambiguous."},
     "doc +media-preview": {"scoped_aliases": {"doc": "node", "doc-id": "node", "document-id": "node", "node-id": "node"}, "ambiguous": ["file-id", "url"], "scope_strict": true, "note": "This command has both document-node and attachment-resource roles. Strong document spellings map to --node; --file-id and --url cannot safely choose a role."},
     "doc +resource-delete": {"scoped_aliases": {"doc": "node", "doc-id": "node", "document-id": "node", "node-id": "node"}, "ambiguous": ["file-id", "url"], "scope_strict": true, "note": "This command removes a document resource while targeting the document by --node. File and URL spellings do not uniquely identify that document role."},
     "doc +resource-download": {"scoped_aliases": {"doc": "node", "doc-id": "node", "document-id": "node", "node-id": "node"}, "ambiguous": ["file-id", "url"], "scope_strict": true, "note": "This command downloads a document resource while targeting the document by --node. File and URL spellings do not uniquely identify that document role."},
     "doc +resource-update": {"scoped_aliases": {"doc": "node", "doc-id": "node", "document-id": "node", "node-id": "node"}, "ambiguous": ["file-id", "url"], "scope_strict": true, "note": "This command has document-node, local-file, and HTTPS image URL roles. Only strong document spellings map to --node; --file-id and --url must stop as ambiguous."},
     "doc +share": {"block": ["doc", "doc-id", "document-id", "file-id", "id", "node", "node-id"], "note": "The real --url requires a shareable document link. Name-only normalization cannot turn a node identifier into a URL, so identifier spellings are rejected with guidance to provide --url."},
-    "doc +grant-and-share": {"scoped_aliases": {"doc": "node", "doc-id": "node", "document-id": "node", "file-id": "node", "node-id": "node", "space": "workspace", "space-id": "workspace"}, "scope_strict": true, "note": "This workflow has two different real URL roles: --node selects the document for access control and --url is the shareable link sent to recipients. Explicit document-ID spellings map only to --node; --url remains native. The command-scoped --space/--space-id aliases preserve previously published Doc workspace compatibility without making workspace and numeric DingDrive storage-space values globally equivalent."},
-    "doc +version-save": {"block": ["message", "title"], "scope_strict": true, "note": "The current snapshot API accepts only the document target. Version title/message metadata are unsupported and cannot be represented by another existing flag."},
-    "drive copy": {"scoped_aliases": {"document-id": "node", "dentry-uuid": "node", "directory-id": "folder", "source-node-id": "node", "source-file-id": "node", "target-folder-id": "folder", "destination-folder-id": "folder", "target-workspace-id": "workspace", "destination-workspace-id": "workspace"}, "scope_strict": true, "note": "Source node and destination folder/workspace are different roles; role-free target IDs stop before write dispatch. --name is not a rename field on this command and must not be fuzzy-corrected to --node.", "block": ["dentry-id", "destination-node-id", "dingdrive-space-id", "drive-space-id", "name", "source-folder-id", "space-id", "storage-space-id"], "ambiguous": ["destination-id", "target-id"]},
-    "drive cover": {"scoped_aliases": {"document-id": "node", "dentry-uuid": "node"}, "scope_strict": true, "note": "The command accepts a Drive node ID or URL; native file-id/node-id/doc-id/url aliases stay native and are not duplicated centrally.", "block": ["dentry-id"]},
-    "drive download-version": {"scoped_aliases": {"document-id": "node", "dentry-uuid": "node", "chunk-size": "part-size", "concurrency": "parallel", "parallelism": "parallel"}, "scope_strict": true, "note": "Output path, chunk size, and concurrency names preserve values; local input and remote folder roles remain blocked.", "block": ["dentry-id", "file", "file-path", "folder", "folder-id"]},
-    "drive move": {"scoped_aliases": {"document-id": "node", "dentry-uuid": "node", "directory-id": "folder", "source-node-id": "node", "source-file-id": "node", "target-folder-id": "folder", "destination-folder-id": "folder", "target-workspace-id": "workspace", "destination-workspace-id": "workspace"}, "scope_strict": true, "note": "Source node and destination folder/workspace are different roles; role-free target IDs stop before write dispatch. --name is not a rename field on this command and must not be fuzzy-corrected to --node.", "block": ["dentry-id", "destination-node-id", "dingdrive-space-id", "drive-space-id", "name", "source-folder-id", "space-id", "storage-space-id"], "ambiguous": ["destination-id", "target-id"]},
-    "drive permission add": {"scoped_aliases": {"document-id": "node", "dentry-uuid": "node", "member-user-ids": "users", "collaborator-ids": "users", "target-user-ids": "users", "target-node-id": "node"}, "scope_strict": true, "note": "The user list denotes target collaborators on this exact node permission command; the native singular compatibility spellings remain native.", "block": ["dentry-id", "dingdrive-space-id", "drive-space-id", "space-id", "storage-space-id"]},
-    "drive permission apply": {"scoped_aliases": {"document-id": "node", "dentry-uuid": "node", "approver-user-ids": "users", "approver-ids": "users", "target-node-id": "node", "apply-reason": "reason", "notification-mode": "notify-mode"}, "scope_strict": true, "note": "The user list denotes approvers, not target collaborators; values and notification enum are passed unchanged.", "block": ["dentry-id"]},
-    "drive permission apply-info": {"scoped_aliases": {"document-id": "node", "dentry-uuid": "node"}, "scope_strict": true, "note": "The command accepts a Drive node ID or URL; native file-id/node-id/doc-id/url aliases stay native and are not duplicated centrally.", "block": ["dentry-id"]},
-    "drive permission list": {"scoped_aliases": {"document-id": "node", "dentry-uuid": "node", "role-filter": "filter-role", "permission-role-filter": "filter-role", "target-node-id": "node"}, "scope_strict": true, "note": "Filtering by a role is not the same as granting/updating a role.", "block": ["dentry-id", "dingdrive-space-id", "drive-space-id", "permission", "role", "space-id", "storage-space-id"]},
-    "drive permission remove": {"scoped_aliases": {"document-id": "node", "dentry-uuid": "node", "member-user-ids": "users", "collaborator-ids": "users", "target-user-ids": "users", "target-node-id": "node"}, "scope_strict": true, "note": "The user list denotes target collaborators on this exact node permission command; the native singular compatibility spellings remain native.", "block": ["dentry-id", "dingdrive-space-id", "drive-space-id", "space-id", "storage-space-id"]},
-    "drive permission transfer-owner": {"scoped_aliases": {"document-id": "node", "dentry-uuid": "node", "target-node-id": "node", "target-workspace-id": "workspace", "old-owner-role": "reserve-role", "keep-role": "reserve-role", "new-owner-id": "new-owner", "new-owner-user-id": "new-owner"}, "scope_strict": true, "note": "Node/workspace target and new/old owner roles are distinct on this irreversible command; role-free names stop before dispatch.", "block": ["current-owner", "dentry-id", "dingdrive-space-id", "drive-space-id", "space-id", "storage-space-id", "user-ids", "users"], "ambiguous": ["owner", "owner-user-id", "target-id", "user-id"]},
-    "drive permission update": {"scoped_aliases": {"document-id": "node", "dentry-uuid": "node", "member-user-ids": "users", "collaborator-ids": "users", "target-user-ids": "users", "target-node-id": "node"}, "scope_strict": true, "note": "The user list denotes target collaborators on this exact node permission command; the native singular compatibility spellings remain native.", "block": ["dentry-id", "dingdrive-space-id", "drive-space-id", "space-id", "storage-space-id"]},
-    "drive publish get": {"scoped_aliases": {"document-id": "node", "dentry-uuid": "node"}, "scope_strict": true, "note": "The command accepts a Drive node ID or URL; native file-id/node-id/doc-id/url aliases stay native and are not duplicated centrally.", "block": ["dentry-id"]},
-    "drive publish set": {"scoped_aliases": {"document-id": "node", "dentry-uuid": "node", "public-permission": "permission", "public-role": "permission"}, "scope_strict": true, "note": "Internet-public permission is not the same as a direct collaborator role.", "block": ["access-role", "dentry-id", "permission-role", "role"]},
-    "drive publish unset": {"scoped_aliases": {"document-id": "node", "dentry-uuid": "node"}, "scope_strict": true, "note": "The command accepts a Drive node ID or URL; native file-id/node-id/doc-id/url aliases stay native and are not duplicated centrally.", "block": ["dentry-id"]},
-    "drive rename": {"scoped_aliases": {"document-id": "node", "dentry-uuid": "node", "file-name": "name", "display-name": "name", "new-name": "name"}, "scope_strict": true, "note": "The name is this exact folder/node display name; search query and local path are different roles.", "block": ["dentry-id"]},
-    "drive revert": {"scoped_aliases": {"document-id": "node", "dentry-uuid": "node"}, "scope_strict": true, "note": "The command accepts a Drive node ID or URL; native file-id/node-id/doc-id/url aliases stay native and are not duplicated centrally.", "block": ["dentry-id"]},
-    "drive shortcut": {"scoped_aliases": {"document-id": "node", "dentry-uuid": "node", "directory-id": "folder", "source-node-id": "node", "source-file-id": "node", "target-folder-id": "folder", "destination-folder-id": "folder", "target-workspace-id": "workspace", "destination-workspace-id": "workspace"}, "scope_strict": true, "note": "Source node and destination folder/workspace are different roles; role-free target IDs stop before write dispatch. --name is not a rename field on this command and must not be fuzzy-corrected to --node.", "block": ["dentry-id", "destination-node-id", "dingdrive-space-id", "drive-space-id", "name", "source-folder-id", "space-id", "storage-space-id"], "ambiguous": ["destination-id", "target-id"]},
-    "drive star add": {"scoped_aliases": {"document-id": "node", "dentry-uuid": "node"}, "scope_strict": true, "note": "The command accepts a Drive node ID or URL; native file-id/node-id/doc-id/url aliases stay native and are not duplicated centrally.", "block": ["dentry-id"]},
-    "drive star remove": {"scoped_aliases": {"document-id": "node", "dentry-uuid": "node"}, "scope_strict": true, "note": "The command accepts a Drive node ID or URL; native file-id/node-id/doc-id/url aliases stay native and are not duplicated centrally.", "block": ["dentry-id"]},
-    "drive stats": {"scoped_aliases": {"document-id": "node", "dentry-uuid": "node"}, "scope_strict": true, "note": "The command accepts a Drive node ID or URL; native file-id/node-id/doc-id/url aliases stay native and are not duplicated centrally.", "block": ["dentry-id"]},
-    "drive +cover": {"scoped_aliases": {"dentry-uuid": "node", "file-id": "node", "node-id": "node", "doc-id": "node", "document-id": "node", "url": "node", "document-url": "node", "id": "node"}, "block": ["dentry-id", "doc", "folder", "folder-id", "name"], "scope_strict": true, "note": "This shortcut calls the same get_cover nodeId interface as drive cover, so its reviewed ID/URL aliases are preserved unchanged. Numeric dentryId, folder-role spellings and --name remain protected."},
-    "drive +copy": {"scoped_aliases": {"dentry-uuid": "node", "directory-id": "folder", "source-node-id": "node", "source-file-id": "node", "target-folder-id": "folder", "destination-folder-id": "folder", "target-workspace-id": "workspace", "destination-workspace-id": "workspace"}, "block": ["dentry-id", "destination-node-id", "dingdrive-space-id", "document-url", "drive-space-id", "name", "source-folder-id", "space-id", "storage-space-id"], "scope_strict": true, "note": "Source node and destination folder/workspace are different roles; role-free target IDs stop before write dispatch. --name is not a rename field on this command and must not be fuzzy-corrected to --node.", "ambiguous": ["destination-id", "target-id"]},
-    "drive +create-folder": {"scoped_aliases": {"directory-id": "folder", "parent-directory-id": "folder", "parent-folder-id": "folder", "folder-name": "name", "display-name": "name", "new-name": "name"}, "block": ["dentry-id", "parent-id", "knowledge-base-id", "wiki-workspace-id", "workspace", "workspace-id"], "scope_strict": true, "note": "The new shortcut creates a numeric DingDrive-space folder. Folder display name, parent dentryUuid and numeric storage space are separate roles; knowledge-base workspace spellings are not accepted."},
-    "drive +create-shortcut": {"scoped_aliases": {"dentry-uuid": "node", "file-id": "node", "node-id": "node", "doc-id": "node", "document-id": "node", "url": "node", "document-url": "node", "directory-id": "folder", "source-node-id": "node", "source-file-id": "node", "target-folder-id": "folder", "destination-folder-id": "folder", "target-workspace-id": "workspace", "destination-workspace-id": "workspace"}, "block": ["dentry-id", "destination-node-id", "dingdrive-space-id", "doc", "drive-space-id", "name", "source-folder-id", "space-id", "storage-space-id"], "scope_strict": true, "note": "Source node and destination folder/workspace are different roles. The source ID/URL aliases match drive shortcut and pass through unchanged; generic target/id spellings remain ambiguous, and storage-space IDs are not knowledge-base workspace IDs.", "ambiguous": ["destination-id", "id", "target-id"]},
-    "drive +delete": {"scoped_aliases": {"dentry-uuid": "node", "file-id": "node", "node-id": "node", "folder": "node", "folder-id": "node"}, "block": ["dentry-id", "doc", "doc-id", "document-id", "document-url", "id", "name", "url"], "scope_strict": true, "note": "Delete targets one already confirmed Drive file or folder dentryUuid. Folder spellings are the same single target role; numeric dentryId, unreviewed Doc URL spellings and --name stop before confirmation or write dispatch."},
-    "drive +download": {"scoped_aliases": {"dentry-uuid": "node", "file-id": "node", "node-id": "node"}, "block": ["dentry-id", "doc", "doc-id", "document-id", "document-url", "file", "file-path", "folder", "folder-id", "id", "knowledge-base-id", "name", "url", "wiki-workspace-id", "workspace", "workspace-id"], "scope_strict": true, "note": "The remote ordinary-file node and local output path are different roles. Node-ID spelling is accepted, while Doc URLs, local input paths, folders, knowledge-base workspaces and numeric dentryId values are not interchangeable."},
-    "drive +info": {"scoped_aliases": {"dentry-uuid": "node"}, "block": ["dentry-id", "document-url", "knowledge-base-id", "wiki-workspace-id", "workspace", "workspace-id"], "scope_strict": true, "note": "This command has only a numeric DingDrive space target; knowledge-base workspace spellings are a different value domain."},
-    "drive +inspect": {"scoped_aliases": {"dentry-uuid": "node", "file-id": "node", "node-id": "node", "doc-id": "node", "document-id": "node", "folder": "node", "folder-id": "node", "include-statistics": "include-stats", "include-publish-status": "include-publish", "include-public-status": "include-publish", "include-thumbnail": "include-cover"}, "block": ["dentry-id", "doc", "document-url", "id", "include", "include-content", "include-history", "include-permissions", "name", "url"], "scope_strict": true, "note": "Drive inspect accepts one file, folder or document node ID and can aggregate only stats, public-publish status and cover. URL spellings, Doc inspect section names and a generic --include remain protected because this shortcut does not declare URL input or value splitting."},
-    "drive +list": {"ambiguous": ["root-id", "space"], "scoped_aliases": {"directory-id": "folder", "parent-folder-id": "folder", "order-field": "order-by", "sort-by": "order-by", "sort-field": "order-by"}, "block": ["dentry-id", "knowledge-base-id", "wiki-workspace-id", "workspace", "workspace-id"], "scope_strict": true, "note": "This shortcut accepts one numeric DingDrive space and an optional parent dentryUuid; it does not accept a knowledge-base workspace. Sort field and direction remain separate roles."},
-    "drive +move": {"scoped_aliases": {"dentry-uuid": "node", "directory-id": "folder", "source-node-id": "node", "source-file-id": "node", "target-folder-id": "folder", "destination-folder-id": "folder", "target-workspace-id": "workspace", "destination-workspace-id": "workspace"}, "block": ["dentry-id", "destination-node-id", "dingdrive-space-id", "document-url", "drive-space-id", "name", "source-folder-id", "space-id", "storage-space-id"], "scope_strict": true, "note": "Source node and destination folder/workspace are different roles; role-free target IDs stop before write dispatch. --name is not a rename field on this command and must not be fuzzy-corrected to --node.", "ambiguous": ["destination-id", "target-id"]},
-    "drive +publish-get": {"scoped_aliases": {"dentry-uuid": "node", "file-id": "node", "node-id": "node", "doc-id": "node", "document-id": "node", "url": "node", "document-url": "node", "id": "node"}, "block": ["dentry-id", "doc", "folder", "folder-id", "name"], "scope_strict": true, "note": "The shortcut calls the same publication-status fileId interface as drive publish get, so its reviewed ID/URL aliases are preserved unchanged. Numeric dentryId and folder/name roles remain protected."},
-    "drive +publish-unset": {"scoped_aliases": {"dentry-uuid": "node", "file-id": "node", "node-id": "node", "doc-id": "node", "document-id": "node", "url": "node", "document-url": "node", "id": "node"}, "block": ["dentry-id", "doc", "folder", "folder-id", "name"], "scope_strict": true, "note": "The shortcut calls the same set_file_publish fileId interface as drive publish unset, so its reviewed ID/URL aliases are preserved unchanged. Numeric dentryId and folder/name roles remain protected before confirmation."},
-    "drive +recycle-restore": {"bind": {"id": "drive_recycle_item_id"}, "block": ["file-id", "folder-id", "node", "node-id", "space-id", "workspace-id"], "scope_strict": true, "note": "The real --id is a recycleItemId returned by drive +recycle-list, not a normal Drive node ID."},
-    "drive +rename": {"scoped_aliases": {"dentry-uuid": "node", "file-id": "node", "node-id": "node", "doc-id": "node", "document-id": "node", "url": "node", "document-url": "node", "id": "node", "folder": "node", "folder-id": "node", "file-name": "name", "display-name": "name", "new-name": "name"}, "block": ["dentry-id"], "scope_strict": true, "note": "The existing document, file or folder node and the requested new display name are separate required roles. Node ID/URL aliases match drive rename and pass through unchanged; numeric dentryId remains protected."},
-    "drive delete": {"scoped_aliases": {"dentry-uuid": "node"}, "block": ["dentry-id", "document-url"], "scope_strict": true, "note": "This command publicly accepts an ID-only Drive node; dentry spellings preserve the value and URL-specific spellings remain protected."},
-    "drive download": {"scoped_aliases": {"dentry-uuid": "node", "chunk-size": "part-size", "concurrency": "parallel", "parallelism": "parallel"}, "block": ["dentry-id", "document-url", "file", "file-path", "folder", "folder-id", "knowledge-base-id", "wiki-workspace-id", "workspace", "workspace-id"], "scope_strict": true, "note": "Output path, chunk size, and concurrency names preserve values; local input and remote folder roles remain blocked."},
-    "drive info": {"scoped_aliases": {"dentry-uuid": "node", "space": "space-id", "workspace": "space-id", "workspace-id": "space-id"}, "block": ["dentry-id", "document-url", "knowledge-base-id", "wiki-workspace-id"], "scope_strict": true, "note": "This command has only a numeric DingDrive space target. Its command-scoped --space/--workspace/--workspace-id aliases preserve compatibility published before the workspace/storage-space concept split and pass the value unchanged to --space-id; new commands must not infer that knowledge-base workspace IDs and numeric storage-space IDs are globally interchangeable."},
-    "drive commit": {"scoped_aliases": {"directory-id": "folder", "parent-directory-id": "folder", "upload-session-id": "upload-id", "size-bytes": "file-size", "name": "file-name", "display-name": "file-name", "filename": "file-name", "upload-name": "file-name"}, "scope_strict": true, "note": "Upload session, file name, file size in bytes, parent folder, and storage space remain separate roles.", "block": ["knowledge-base-id", "wiki-workspace-id", "workspace", "workspace-id"]},
-    "drive mkdir": {"scoped_aliases": {"directory-id": "folder", "parent-directory-id": "folder", "folder-name": "name", "display-name": "name", "new-name": "name"}, "scope_strict": true, "note": "The name is this exact folder/node display name; search query and local path are different roles.", "block": ["knowledge-base-id", "wiki-workspace-id", "workspace", "workspace-id"]},
-    "drive upload-info": {"scoped_aliases": {"directory-id": "folder", "parent-directory-id": "folder", "content-type": "mime-type", "size-bytes": "file-size", "name": "file-name", "display-name": "file-name", "filename": "file-name", "upload-name": "file-name"}, "scope_strict": true, "note": "File metadata aliases preserve MIME and byte units; file path and upload session are different stages.", "block": ["knowledge-base-id", "wiki-workspace-id", "workspace", "workspace-id"]},
-    "drive recycle list": {"block": ["knowledge-base-id", "wiki-workspace-id", "workspace", "workspace-id"], "scope_strict": true, "note": "This command has only a numeric DingDrive space target; knowledge-base workspace spellings are a different value domain."},
-    "drive search": {"ambiguous": ["end", "from", "start", "time-from", "time-to", "to", "types"], "block": ["offset", "page"], "scope_strict": true, "note": "Created/modified ranges and file/content type arrays are separate roles; generic time/type names are not guessed."},
-    "drive +search": {"ambiguous": ["end", "from", "start", "time-from", "time-to", "to", "types"], "block": ["offset", "page"], "scope_strict": true, "note": "Created/modified ranges and file/content type arrays are separate roles; generic time/type names are not guessed."},
-    "drive +star-add": {"scoped_aliases": {"dentry-uuid": "node", "file-id": "node", "node-id": "node", "doc-id": "node", "document-id": "node", "url": "node", "document-url": "node", "id": "node"}, "block": ["dentry-id", "doc", "folder", "folder-id", "name"], "scope_strict": true, "note": "The shortcut calls the same mark_star nodeId interface as drive star add, so its reviewed document/node ID and URL aliases are preserved unchanged. Numeric dentryId and folder/name roles remain protected."},
-    "drive +star-remove": {"scoped_aliases": {"dentry-uuid": "node", "file-id": "node", "node-id": "node", "doc-id": "node", "document-id": "node", "url": "node", "document-url": "node", "id": "node"}, "block": ["dentry-id", "doc", "folder", "folder-id", "name"], "scope_strict": true, "note": "The shortcut calls the same unmark_star nodeId interface as drive star remove, so its reviewed document/node ID and URL aliases are preserved unchanged. Numeric dentryId and folder/name roles remain protected."},
-    "drive +stats": {"scoped_aliases": {"dentry-uuid": "node", "file-id": "node", "node-id": "node", "doc-id": "node", "document-id": "node", "url": "node", "document-url": "node", "id": "node"}, "block": ["dentry-id", "doc", "folder", "folder-id", "name"], "scope_strict": true, "note": "The shortcut calls the same get_node_stats nodeId interface as drive stats, so its reviewed ID/URL aliases are preserved unchanged. Numeric dentryId and folder/name roles remain protected."},
-    "drive +version-download": {"scoped_aliases": {"dentry-uuid": "node", "file-id": "node", "node-id": "node"}, "block": ["dentry-id", "doc", "doc-id", "document-id", "document-url", "file", "file-path", "folder", "folder-id", "id", "name", "url"], "scope_strict": true, "note": "Ordinary-file node, positive historical version number and local output path are three distinct roles; revision and Doc URL spellings must not be guessed."},
-    "drive +version-get": {"scoped_aliases": {"dentry-uuid": "node", "file-id": "node", "node-id": "node"}, "block": ["dentry-id", "doc", "doc-id", "document-id", "document-url", "folder", "folder-id", "id", "name", "url"], "scope_strict": true, "note": "This command reads one ordinary-file historical version by node ID and positive version number; document revision and URL roles are different."},
-    "drive +version-history": {"scoped_aliases": {"dentry-uuid": "node", "file-id": "node", "node-id": "node"}, "block": ["dentry-id", "doc", "doc-id", "document-id", "document-url", "folder", "folder-id", "id", "name", "url"], "scope_strict": true, "note": "This command pages versions for one ordinary-file Drive node; document URLs and numeric dentryId are not accepted."},
-    "drive +version-revert": {"scoped_aliases": {"dentry-uuid": "node", "file-id": "node", "node-id": "node"}, "block": ["dentry-id", "doc", "doc-id", "document-id", "document-url", "folder", "folder-id", "id", "name", "url"], "scope_strict": true, "note": "The high-risk revert targets one ordinary-file Drive node and a positive historical version number. Doc revisions and URLs must stop before confirmation or write dispatch."},
-    "drive recycle restore": {"bind": {"id": "drive_recycle_item_id"}, "block": ["file-id", "folder-id", "node", "node-id", "space-id", "workspace-id"], "scope_strict": true, "note": "The real --id is a recycle-item ID from recycle list, not a normal Drive node ID."},
-    "drive star list": {"ambiguous": ["type", "types"], "scope_strict": true, "note": "Content types and resource types are separate arrays; a generic type list cannot choose one.", "scoped_aliases": {"order-field": "order-by", "sort-by": "order-by", "sort-field": "order-by"}},
-    "drive recent": {"ambiguous": ["type", "types"], "scope_strict": true, "note": "Creator type, operation type, and file type filters are distinct and keep their enum/list forms."},
-    "drive +recent": {"ambiguous": ["type", "types"], "scope_strict": true, "note": "Creator type, operation type, and file type filters are distinct and keep their enum/list forms."},
-    "drive +star-list": {"ambiguous": ["type", "types"], "scope_strict": true, "note": "The shortcut exposes only the API contentTypes filter. Generic type spellings may denote file extensions or node/resource types, so the current name-only layer must not guess the value domain."},
-    "drive +upload": {"ambiguous": ["destination-id", "space", "target-id"], "scoped_aliases": {"dentry-uuid": "node", "file-id": "node", "node-id": "node", "overwrite-node-id": "node", "directory-id": "folder", "parent-directory-id": "folder", "parent-folder-id": "folder", "target-folder-id": "folder", "source-file": "file", "local-file": "file", "file-path": "file", "content-type": "mime-type", "filename": "file-name", "name": "file-name", "display-name": "file-name", "upload-name": "file-name"}, "block": ["dentry-id", "document-url", "knowledge-base-id", "wiki-workspace-id", "workspace", "workspace-id", "output-path"], "scope_strict": true, "note": "Local source path, remote display name, MIME type, parent folder, numeric storage space and optional overwrite node are distinct roles. ID-suffixed file/node spellings denote the overwrite target; the shortcut does not expose a knowledge-base workspace route."}
+    "doc +grant-and-share": {"scoped_aliases": {"doc": "node", "doc-id": "node", "document-id": "node", "file-id": "node", "node-id": "node"}, "scope_strict": true, "note": "This workflow has two different real URL roles: --node selects the document for access control and --url is the shareable link sent to recipients. Explicit document-ID spellings map only to --node; --url remains native."}
   },
 
   "validation_fixture": {
@@ -325,7 +243,7 @@
       {"command": "doc +export-get", "emitted": "node", "expect": "did-you-mean:blocked", "via": "override:block", "occ": 2},
       {"command": "doc block delete", "emitted": "index", "expect": "did-you-mean:blocked", "via": "override:block", "occ": 2},
       {"command": "doc block insert", "emitted": "before-block-id", "expect": "did-you-mean:blocked", "via": "guard:requires-multi-parameter-transform", "occ": 2},
-      {"command": "drive info", "emitted": "workspace", "expect": "space-id", "via": "override:published-storage-space-compatibility", "occ": 2},
+      {"command": "drive info", "emitted": "workspace", "expect": "space-id", "via": "concept:space_id", "occ": 2},
       {"command": "mail folder update", "emitted": "folder-id", "expect": "id", "via": "override:bind(folder_id)", "occ": 2},
       {"command": "report outbox list", "emitted": "template-type", "expect": "did-you-mean:blocked", "via": "override:block", "occ": 2},
       {"command": "chat +group-members", "emitted": "group-name", "expect": "group", "via": "concept:group_name+bind"},
@@ -334,7 +252,7 @@
       {"command": "chat group rename", "emitted": "conversation-id", "expect": "id", "via": "concept:open_conversation_id+bind"},
       {"command": "chat group rename", "emitted": "group-id", "expect": "did-you-mean:blocked", "via": "guard:group-id-vs-open-conversation-id"},
       {"command": "chat message send", "emitted": "conversation-id", "expect": "group", "via": "concept:open_conversation_id"},
-      {"command": "chat message add-emoji", "emitted": "open-conversation-id", "expect": "conversation-id", "via": "concept:open_conversation_id"},
+      {"command": "chat message add-emoji", "emitted": "open-conversation-id", "expect": "conversation-id", "via": "override:scoped"},
       {"command": "chat message add-emoji", "emitted": "group-id", "expect": "did-you-mean:blocked", "via": "guard:group-id-vs-open-conversation-id"},
       {"command": "chat +group-members", "emitted": "conversation-id", "expect": "did-you-mean:blocked", "via": "guard:group-name-vs-open-conversation-id"},
       {"command": "chat +send-to-group", "emitted": "group-name", "expect": "group", "via": "concept:group_name+bind"},
@@ -407,7 +325,7 @@
       {"command": "doc +search", "emitted": "q", "expect": "query", "via": "concept:search_query"},
       {"command": "doc +comment-list", "emitted": "max-results", "expect": "limit", "via": "concept:pagination_size"},
       {"command": "doc +list", "emitted": "page-token", "expect": "cursor", "via": "concept:page_cursor"},
-      {"command": "doc +copy", "emitted": "workspace-id", "expect": "workspace", "via": "concept:workspace_id"},
+      {"command": "doc +copy", "emitted": "workspace-id", "expect": "workspace", "via": "concept:space_id"},
       {"command": "doc +copy", "emitted": "parent-folder-id", "expect": "folder", "via": "override:scoped-doc-folder"},
       {"command": "doc +copy", "emitted": "parent-id", "expect": "did-you-mean:blocked", "via": "guard:doc-folder-value-domain"},
       {"command": "doc +comment-reply", "emitted": "comment-id", "expect": "comment-key", "via": "concept:doc_comment_key"},
@@ -472,7 +390,6 @@
       {"command": "chat +flag-create", "emitted": "group", "expect": "conversation-id", "via": "concept:open_conversation_id"},
       {"command": "chat +chat-add-bot", "emitted": "conversation-id", "expect": "id", "via": "concept:open_conversation_id+bind"},
       {"command": "chat +chat-add-bot", "emitted": "robot", "expect": "robot-code", "via": "concept:robot_code"},
-      {"command": "chat group audit-join-validation", "emitted": "user", "expect": "did-you-mean:ambiguous", "via": "guard:applicant-vs-inviter-role"},
       {"command": "chat +chat-audit-join", "emitted": "applicant-user-id", "expect": "applicant", "via": "override:scoped-user-role"},
       {"command": "chat +chat-audit-join", "emitted": "user-id", "expect": "did-you-mean:ambiguous", "via": "guard:applicant-vs-inviter-role"},
       {"command": "chat +chat-create", "emitted": "user-id", "expect": "did-you-mean:blocked", "via": "guard:single-vs-list"},
@@ -498,9 +415,9 @@
       {"command": "doc +create", "emitted": "content-format", "expect": "doc-format", "via": "concept:doc_content_format"},
       {"command": "doc +create", "emitted": "content-file", "expect": "did-you-mean:blocked", "via": "guard:requires-file-read-transform"},
       {"command": "doc +inspect", "emitted": "include-versions", "expect": "include-history", "via": "override:scoped-section"},
-      {"command": "doc +inspect", "emitted": "include", "expect": "did-you-mean:blocked", "via": "guard:requires-value-dependent-flag-expansion", "occ": 1},
-      {"command": "doc +inspect", "emitted": "include-info", "expect": "did-you-mean:blocked", "via": "guard:base-info-always-returned", "occ": 1},
-      {"command": "doc +update", "emitted": "mode", "expect": "command", "via": "override:scoped-operation", "occ": 5},
+      {"command": "doc +inspect", "emitted": "include", "expect": "did-you-mean:blocked", "via": "guard:requires-value-dependent-flag-expansion"},
+      {"command": "doc +inspect", "emitted": "include-info", "expect": "did-you-mean:blocked", "via": "guard:base-info-always-returned"},
+      {"command": "doc +update", "emitted": "mode", "expect": "command", "via": "override:scoped-operation"},
       {"command": "doc +update", "emitted": "revision", "expect": "expected-revision", "via": "concept:doc_edit_revision"},
       {"command": "doc +update", "emitted": "version", "expect": "did-you-mean:blocked", "via": "guard:historical-version-vs-edit-revision"},
       {"command": "doc +fetch", "emitted": "start-block", "expect": "start-block-id", "via": "override:scoped-boundary-role"},
@@ -508,154 +425,11 @@
       {"command": "doc +access-grant", "emitted": "doc-id", "expect": "node", "via": "concept:doc_node_id"},
       {"command": "doc +history-revert", "emitted": "version-number", "expect": "version", "via": "concept:doc_version_number"},
       {"command": "doc +create-from-template", "emitted": "keyword", "expect": "query", "via": "concept:search_query"},
-      {"command": "doc +create-from-template", "emitted": "workspace-id", "expect": "workspace", "via": "concept:workspace_id"},
+      {"command": "doc +create-from-template", "emitted": "workspace-id", "expect": "workspace", "via": "concept:space_id"},
       {"command": "doc +create-from-template", "emitted": "parent-folder-id", "expect": "folder", "via": "override:scoped-doc-folder"},
       {"command": "doc +media-download", "emitted": "file-id", "expect": "did-you-mean:ambiguous", "via": "guard:document-node-vs-attachment-resource-role"},
       {"command": "doc +resource-update", "emitted": "url", "expect": "did-you-mean:ambiguous", "via": "guard:document-url-vs-image-url-role"},
-      {"command": "doc +share", "emitted": "node-id", "expect": "did-you-mean:blocked", "via": "guard:node-id-needs-url-conversion"},
-      {"command": "doc +copy", "emitted": "dentry-uuid", "expect": "node", "via": "concept:doc_node_id"},
-      {"command": "doc info", "emitted": "dentry-id", "expect": "did-you-mean:blocked", "via": "guard:dentry-id-vs-dentry-uuid"},
-      {"command": "doc create", "emitted": "knowledge-base-id", "expect": "workspace", "via": "concept:workspace_id"},
-      {"command": "doc create", "emitted": "space-id", "expect": "workspace", "via": "override:published-workspace-compatibility"},
-      {"command": "drive list", "emitted": "knowledge-base-id", "expect": "workspace", "via": "concept:workspace_id"},
-      {"command": "drive list", "emitted": "order-field", "expect": "order-by", "via": "override:scoped-sort-field"},
-      {"command": "drive info", "emitted": "dentry-uuid", "expect": "node", "via": "override:scoped-node-id"},
-      {"command": "drive info", "emitted": "dentry-id", "expect": "did-you-mean:blocked", "via": "guard:dentry-id-vs-dentry-uuid"},
-      {"command": "drive copy", "emitted": "target-folder-id", "expect": "folder", "via": "override:scoped-destination-folder"},
-      {"command": "drive copy", "emitted": "target-id", "expect": "did-you-mean:ambiguous", "via": "guard:destination-role-required"},
-      {"command": "drive search", "emitted": "created-after", "expect": "created-from", "via": "concept:created_time_start"},
-      {"command": "drive search", "emitted": "created-before", "expect": "created-to", "via": "concept:created_time_end"},
-      {"command": "drive search", "emitted": "modified-after", "expect": "modified-from", "via": "concept:drive_modified_time_start"},
-      {"command": "drive search", "emitted": "modified-before", "expect": "modified-to", "via": "concept:drive_modified_time_end"},
-      {"command": "drive search", "emitted": "creator-user-ids", "expect": "creator-uids", "via": "concept:creator_user_ids"},
-      {"command": "drive permission add", "emitted": "permission-role", "expect": "role", "via": "concept:document_permission_role"},
-      {"command": "drive permission list", "emitted": "role", "expect": "did-you-mean:blocked", "via": "guard:permission-role-vs-filter-role"},
-      {"command": "drive upload", "emitted": "source-file", "expect": "file", "via": "override:scoped-local-file"},
-      {"command": "doc +search", "emitted": "created-after", "expect": "created-from", "via": "concept:created_time_start"},
-      {"command": "doc +search", "emitted": "create-time-start", "expect": "created-from", "via": "concept:created_time_start", "occ": 1},
-      {"command": "doc +search", "emitted": "create-time-end", "expect": "created-to", "via": "concept:created_time_end", "occ": 1},
-      {"command": "doc +search", "emitted": "creator-user-ids", "expect": "creator-uids", "via": "concept:creator_user_ids"},
-      {"command": "doc +access-grant", "emitted": "permission-role", "expect": "role", "via": "concept:document_permission_role"},
-      {"command": "doc +export", "emitted": "output-path", "expect": "output", "via": "concept:local_output_path"},
-      {"command": "drive download", "emitted": "destination-path", "expect": "output", "via": "concept:local_output_path"},
-      {"command": "drive download", "emitted": "version-number", "expect": "version", "via": "concept:doc_version_number"},
-      {"command": "drive recycle restore", "emitted": "recycle-item-id", "expect": "id", "via": "concept:drive_recycle_item_id"},
-      {"command": "drive upload-info", "emitted": "size-bytes", "expect": "file-size", "via": "concept:drive_file_size_bytes"},
-      {"command": "drive +info", "emitted": "drive-space-id", "expect": "space-id", "via": "concept:drive_storage_space_id"},
-      {"command": "drive commit", "emitted": "storage-space-id", "expect": "space-id", "via": "concept:drive_storage_space_id"},
-      {"command": "drive download", "emitted": "dingdrive-space-id", "expect": "space-id", "via": "concept:drive_storage_space_id"},
-      {"command": "drive info", "emitted": "drive-space-id", "expect": "space-id", "via": "concept:drive_storage_space_id"},
-      {"command": "drive list", "emitted": "storage-space-id", "expect": "space-id", "via": "concept:drive_storage_space_id"},
-      {"command": "drive list", "emitted": "sort-direction", "expect": "order", "via": "concept:drive_sort_direction"},
-      {"command": "drive mkdir", "emitted": "dingdrive-space-id", "expect": "space-id", "via": "concept:drive_storage_space_id"},
-      {"command": "drive recycle list", "emitted": "drive-space-id", "expect": "space-id", "via": "concept:drive_storage_space_id"},
-      {"command": "drive upload", "emitted": "storage-space-id", "expect": "space-id", "via": "concept:drive_storage_space_id"},
-      {"command": "drive upload-info", "emitted": "dingdrive-space-id", "expect": "space-id", "via": "concept:drive_storage_space_id"},
-      {"command": "doc +access-grant", "emitted": "user", "expect": "did-you-mean:ambiguous", "via": "guard:collaborator-name-vs-id-value-domain", "occ": 6},
-      {"command": "doc +access-grant", "emitted": "target-user", "expect": "did-you-mean:ambiguous", "via": "guard:collaborator-name-vs-id-value-domain", "occ": 1},
-      {"command": "doc +access-grant", "emitted": "user-id", "expect": "did-you-mean:blocked", "via": "guard:user-id-cannot-feed-name-resolver", "occ": 1},
-      {"command": "doc +access-grant", "emitted": "user-ids", "expect": "did-you-mean:blocked", "via": "guard:user-id-cannot-feed-name-resolver", "occ": 1},
-      {"command": "doc +access-grant", "emitted": "target-user-id", "expect": "did-you-mean:blocked", "via": "guard:user-id-cannot-feed-name-resolver"},
-      {"command": "doc +access-grant", "emitted": "target-user-ids", "expect": "did-you-mean:blocked", "via": "guard:user-id-cannot-feed-name-resolver"},
-      {"command": "doc +fetch", "emitted": "content-format", "expect": "did-you-mean:blocked", "via": "guard:content-format-vs-detail-contract", "occ": 3},
-      {"command": "doc +fetch", "emitted": "doc-format", "expect": "did-you-mean:blocked", "via": "guard:content-format-vs-detail-contract", "occ": 1},
-      {"command": "doc +fetch", "emitted": "range", "expect": "did-you-mean:blocked", "via": "guard:composite-range-needs-block-ids", "occ": 1},
-      {"command": "doc +inspect", "emitted": "include-access", "expect": "include-permissions", "via": "override:scoped-permission-section", "occ": 3},
-      {"command": "doc +inspect", "emitted": "include-member", "expect": "include-permissions", "via": "override:scoped-permission-section", "occ": 1},
-      {"command": "doc +inspect", "emitted": "include-members", "expect": "include-permissions", "via": "override:scoped-permission-section", "occ": 2},
-      {"command": "doc +inspect", "emitted": "include-meta", "expect": "did-you-mean:blocked", "via": "guard:base-metadata-already-returned", "occ": 2},
-      {"command": "doc +inspect", "emitted": "include-metadata", "expect": "did-you-mean:blocked", "via": "guard:base-metadata-already-returned", "occ": 1},
-      {"command": "doc +inspect", "emitted": "include-blocks", "expect": "did-you-mean:blocked", "via": "guard:content-read-belongs-to-fetch", "occ": 1},
-      {"command": "doc +inspect", "emitted": "include-content", "expect": "did-you-mean:blocked", "via": "guard:content-read-belongs-to-fetch", "occ": 1},
-      {"command": "doc +inspect", "emitted": "role", "expect": "did-you-mean:blocked", "via": "guard:permission-role-vs-document-node", "occ": 1},
-      {"command": "doc +copy", "emitted": "name", "expect": "did-you-mean:blocked", "via": "guard:fuzzy-name-vs-node-role", "occ": 2},
-      {"command": "doc +export", "emitted": "wait", "expect": "did-you-mean:blocked", "via": "guard:workflow-wait-vs-max-polls", "occ": 1},
-      {"command": "doc +media-insert", "emitted": "after-block-id", "expect": "did-you-mean:blocked", "via": "guard:requires-ref-block-and-where-expansion", "occ": 1},
-      {"command": "doc +media-insert", "emitted": "before-block-id", "expect": "did-you-mean:blocked", "via": "guard:requires-ref-block-and-where-expansion"},
-      {"command": "doc +update", "emitted": "content-file", "expect": "did-you-mean:blocked", "via": "guard:requires-file-read-transform", "occ": 1},
-      {"command": "doc +update", "emitted": "element", "expect": "did-you-mean:ambiguous", "via": "guard:content-vs-block-vs-reference-role", "occ": 1},
-      {"command": "doc update", "emitted": "stdin", "expect": "did-you-mean:blocked", "via": "guard:stdin-requires-content-dash-transform", "occ": 1},
-      {"command": "doc +version-save", "emitted": "title", "expect": "did-you-mean:blocked", "via": "guard:unsupported-version-metadata", "occ": 1},
-      {"command": "doc +version-save", "emitted": "message", "expect": "did-you-mean:blocked", "via": "guard:unsupported-version-metadata", "occ": 1},
-      {"command": "drive +search", "emitted": "keyword", "expect": "query", "via": "concept:search_query", "occ": 1},
-      {"command": "contact +search-user", "emitted": "name", "expect": "did-you-mean:blocked", "via": "guard:person-name-vs-search-query", "occ": 1},
-      {"command": "drive copy", "emitted": "name", "expect": "did-you-mean:blocked", "via": "guard:fuzzy-name-vs-node-role"},
-      {"command": "drive +copy", "emitted": "name", "expect": "did-you-mean:blocked", "via": "guard:fuzzy-name-vs-node-role"},
-      {"command": "drive move", "emitted": "name", "expect": "did-you-mean:blocked", "via": "guard:fuzzy-name-vs-node-role"},
-      {"command": "drive +move", "emitted": "name", "expect": "did-you-mean:blocked", "via": "guard:fuzzy-name-vs-node-role"},
-      {"command": "drive shortcut", "emitted": "name", "expect": "did-you-mean:blocked", "via": "guard:fuzzy-name-vs-node-role"},
-      {"command": "drive +cover", "emitted": "dentry-uuid", "expect": "node", "via": "override:scoped-drive-node"},
-      {"command": "drive +cover", "emitted": "name", "expect": "did-you-mean:blocked", "via": "guard:fuzzy-name-vs-drive-node"},
-      {"command": "drive +create-folder", "emitted": "folder-name", "expect": "name", "via": "override:scoped-folder-name"},
-      {"command": "drive +create-folder", "emitted": "storage-space-id", "expect": "space-id", "via": "concept:drive_storage_space_id"},
-      {"command": "drive +create-shortcut", "emitted": "source-file-id", "expect": "node", "via": "override:scoped-source-node"},
-      {"command": "drive +create-shortcut", "emitted": "target-folder-id", "expect": "folder", "via": "override:scoped-target-folder"},
-      {"command": "drive +create-shortcut", "emitted": "target-workspace-id", "expect": "workspace", "via": "override:scoped-target-workspace"},
-      {"command": "drive +create-shortcut", "emitted": "name", "expect": "did-you-mean:blocked", "via": "guard:fuzzy-name-vs-drive-node"},
-      {"command": "drive +delete", "emitted": "file-id", "expect": "node", "via": "override:scoped-drive-node"},
-      {"command": "drive +delete", "emitted": "dentry-id", "expect": "did-you-mean:blocked", "via": "guard:dentry-id-vs-node-id"},
-      {"command": "drive +download", "emitted": "dentry-uuid", "expect": "node", "via": "override:scoped-drive-node"},
-      {"command": "drive +download", "emitted": "destination-path", "expect": "output", "via": "concept:local_output_path"},
-      {"command": "drive +inspect", "emitted": "include-statistics", "expect": "include-stats", "via": "override:scoped-inspect-section"},
-      {"command": "drive +inspect", "emitted": "include-history", "expect": "did-you-mean:blocked", "via": "guard:doc-inspect-section"},
-      {"command": "drive +list", "emitted": "folder-id", "expect": "folder", "via": "concept:folder_id"},
-      {"command": "drive +list", "emitted": "page-size", "expect": "limit", "via": "concept:pagination_size"},
-      {"command": "drive +list", "emitted": "next-token", "expect": "cursor", "via": "concept:page_cursor"},
-      {"command": "drive +list", "emitted": "sort-direction", "expect": "order", "via": "concept:drive_sort_direction"},
-      {"command": "drive +list", "emitted": "sort-by", "expect": "order-by", "via": "override:scoped-sort-field"},
-      {"command": "drive +publish-get", "emitted": "dentry-uuid", "expect": "node", "via": "override:scoped-drive-node"},
-      {"command": "drive +publish-unset", "emitted": "file-id", "expect": "node", "via": "override:scoped-drive-node"},
-      {"command": "drive +recycle-list", "emitted": "storage-space-id", "expect": "space-id", "via": "concept:drive_storage_space_id"},
-      {"command": "drive +recycle-list", "emitted": "page-token", "expect": "cursor", "via": "concept:page_cursor"},
-      {"command": "drive +recycle-restore", "emitted": "recycle-item-id", "expect": "id", "via": "override:bind(drive_recycle_item_id)"},
-      {"command": "drive +recycle-restore", "emitted": "node-id", "expect": "did-you-mean:blocked", "via": "guard:recycle-item-vs-node-id"},
-      {"command": "drive +rename", "emitted": "file-id", "expect": "node", "via": "override:scoped-drive-node"},
-      {"command": "drive +rename", "emitted": "new-name", "expect": "name", "via": "override:scoped-display-name"},
-      {"command": "drive +star-add", "emitted": "dentry-uuid", "expect": "node", "via": "override:scoped-drive-node"},
-      {"command": "drive +star-list", "emitted": "max-results", "expect": "limit", "via": "concept:pagination_size"},
-      {"command": "drive +star-list", "emitted": "types", "expect": "did-you-mean:ambiguous", "via": "guard:content-type-value-domain"},
-      {"command": "drive +star-remove", "emitted": "file-id", "expect": "node", "via": "override:scoped-drive-node"},
-      {"command": "drive +stats", "emitted": "dentry-uuid", "expect": "node", "via": "override:scoped-drive-node"},
-      {"command": "drive +upload", "emitted": "source-file", "expect": "file", "via": "override:scoped-local-file"},
-      {"command": "drive +upload", "emitted": "name", "expect": "file-name", "via": "override:scoped-remote-name"},
-      {"command": "drive +upload", "emitted": "overwrite-node-id", "expect": "node", "via": "override:scoped-overwrite-node"},
-      {"command": "drive +upload", "emitted": "workspace-id", "expect": "did-you-mean:blocked", "via": "guard:unsupported-workspace-route"},
-      {"command": "drive +version-download", "emitted": "version-number", "expect": "version", "via": "concept:doc_version_number"},
-      {"command": "drive +version-download", "emitted": "save-path", "expect": "output", "via": "concept:local_output_path"},
-      {"command": "drive +version-get", "emitted": "version-no", "expect": "version", "via": "concept:doc_version_number"},
-      {"command": "drive +version-history", "emitted": "next-cursor", "expect": "cursor", "via": "concept:page_cursor"},
-      {"command": "drive +version-history", "emitted": "page-size", "expect": "limit", "via": "concept:pagination_size"},
-      {"command": "drive +version-revert", "emitted": "version-number", "expect": "version", "via": "concept:doc_version_number"},
-      {"command": "drive +version-revert", "emitted": "revision", "expect": "did-you-mean:blocked", "via": "guard:document-revision-vs-file-version"},
-      {"command": "drive +cover", "emitted": "node-id", "expect": "node", "via": "override:node-id-parity"},
-      {"command": "drive +create-shortcut", "emitted": "node-id", "expect": "node", "via": "override:node-id-parity"},
-      {"command": "drive +delete", "emitted": "node-id", "expect": "node", "via": "override:node-id-parity"},
-      {"command": "drive +download", "emitted": "node-id", "expect": "node", "via": "override:node-id-parity"},
-      {"command": "drive +inspect", "emitted": "node-id", "expect": "node", "via": "override:node-id-parity"},
-      {"command": "drive +publish-get", "emitted": "node-id", "expect": "node", "via": "override:node-id-parity"},
-      {"command": "drive +publish-unset", "emitted": "node-id", "expect": "node", "via": "override:node-id-parity"},
-      {"command": "drive +rename", "emitted": "node-id", "expect": "node", "via": "override:node-id-parity"},
-      {"command": "drive +star-add", "emitted": "node-id", "expect": "node", "via": "override:node-id-parity"},
-      {"command": "drive +star-remove", "emitted": "node-id", "expect": "node", "via": "override:node-id-parity"},
-      {"command": "drive +stats", "emitted": "node-id", "expect": "node", "via": "override:node-id-parity"},
-      {"command": "drive +upload", "emitted": "node-id", "expect": "node", "via": "override:node-id-parity"},
-      {"command": "drive +version-download", "emitted": "node-id", "expect": "node", "via": "override:node-id-parity"},
-      {"command": "drive +version-get", "emitted": "node-id", "expect": "node", "via": "override:node-id-parity"},
-      {"command": "drive +version-history", "emitted": "node-id", "expect": "node", "via": "override:node-id-parity"},
-      {"command": "drive +version-revert", "emitted": "node-id", "expect": "node", "via": "override:node-id-parity"},
-      {"command": "drive +cover", "emitted": "url", "expect": "node", "via": "override:existing-command-parity"},
-      {"command": "drive +create-shortcut", "emitted": "document-id", "expect": "node", "via": "override:existing-command-parity"},
-      {"command": "drive +delete", "emitted": "folder-id", "expect": "node", "via": "override:single-folder-node-role"},
-      {"command": "drive +inspect", "emitted": "document-id", "expect": "node", "via": "override:document-node-id"},
-      {"command": "drive +inspect", "emitted": "folder-id", "expect": "node", "via": "override:single-folder-node-role"},
-      {"command": "drive +publish-get", "emitted": "url", "expect": "node", "via": "override:existing-command-parity"},
-      {"command": "drive +publish-unset", "emitted": "document-url", "expect": "node", "via": "override:existing-command-parity"},
-      {"command": "drive +rename", "emitted": "document-id", "expect": "node", "via": "override:existing-command-parity"},
-      {"command": "drive +rename", "emitted": "folder-id", "expect": "node", "via": "override:single-folder-node-role"},
-      {"command": "drive +star-add", "emitted": "url", "expect": "node", "via": "override:existing-command-parity"},
-      {"command": "drive +star-remove", "emitted": "doc-id", "expect": "node", "via": "override:existing-command-parity"},
-      {"command": "drive +stats", "emitted": "document-url", "expect": "node", "via": "override:existing-command-parity"},
-      {"command": "drive +upload", "emitted": "file-id", "expect": "node", "via": "override:overwrite-node-id-role"}
+      {"command": "doc +share", "emitted": "node-id", "expect": "did-you-mean:blocked", "via": "guard:node-id-needs-url-conversion"}
     ]
   }
 }

internal/cli/retry_policy_contract_test.go

@@ -0,0 +1,261 @@
+// Copyright 2026 Alibaba Group
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package cli
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/corecmd/contract"
+	"github.com/spf13/cobra"
+)
+
+func conditionalRetryTool() RuntimeToolSpecInput {
+	return RuntimeToolSpecInput{
+		Identity: contract.ToolIdentitySpec{ProductID: "chat", Name: "send", CLIPath: "chat send"},
+		Parameters: []ParameterSpec{{
+			Name: "uuid", Type: "string", Property: "requestUuid",
+			FieldProvenance: map[string]contract.FieldProvenance{
+				"property": resolvedFieldProvenance(
+					"requestUuid", "native_annotation", "contract.ParamDecl", "native_annotation",
+					"contract_pass_through", "explicit retry key property",
+				),
+			},
+		}},
+		Safety: contract.SafetySpec{Effect: "write", Risk: "medium", Confirmation: "not_required", Idempotency: "conditional"},
+		RetryPolicy: &contract.RetryPolicySpec{
+			Mode:                contract.RetryModeDeduplicationKey,
+			KeyParameter:        "uuid",
+			SamePayloadRequired: true,
+		},
+		Interface: contract.InterfaceSpec{
+			Mode:         contract.InterfaceModeMCP,
+			Availability: contract.InterfaceAvailable,
+			Ref:          &contract.InterfaceRefSpec{ProductID: "chat", RPCName: "send"},
+		},
+		FieldProvenance: map[string]contract.FieldProvenance{
+			"retry_policy": resolvedFieldProvenance(
+				contract.RetryPolicySpec{Mode: contract.RetryModeDeduplicationKey, KeyParameter: "uuid", SamePayloadRequired: true},
+				"corecmd.contract", "corecmd.ContractDecl", "contract_final", "contract_pass_through", "reviewed retry policy",
+			),
+		},
+	}
+}
+
+func TestCrossPlatformCoverageConditionalRetryPolicyValidatesAndProjects(t *testing.T) {
+	spec, err := ToolSpecFromRuntime(conditionalRetryTool())
+	if err != nil {
+		t.Fatalf("ToolSpecFromRuntime() error = %v", err)
+	}
+	full, err := spec.ToPayload()
+	if err != nil {
+		t.Fatalf("ToPayload() error = %v", err)
+	}
+	policy, ok := full["retry_policy"].(map[string]any)
+	if !ok || policy["mode"] != contract.RetryModeDeduplicationKey || policy["key_parameter"] != "uuid" || policy["same_payload_required"] != true {
+		t.Fatalf("retry_policy = %#v", full["retry_policy"])
+	}
+	compact := stripSchemaPayloadCompact(full)
+	if !schemaJSONEqual(compact["retry_policy"], full["retry_policy"]) {
+		t.Fatalf("compact retry_policy = %#v, want %#v", compact["retry_policy"], full["retry_policy"])
+	}
+	summary, err := spec.ToSummaryPayload()
+	if err != nil {
+		t.Fatalf("ToSummaryPayload() error = %v", err)
+	}
+	if _, exists := summary["retry_policy"]; exists {
+		t.Fatalf("navigation summary must omit retry_policy: %#v", summary)
+	}
+	wire, err := schemaToolWireFromPayload(full)
+	if err != nil {
+		t.Fatalf("schemaToolWireFromPayload() error = %v", err)
+	}
+	roundTrip, err := schemaToolSpecFromWire(wire)
+	if err != nil || roundTrip.RetryPolicy == nil || roundTrip.RetryPolicy.KeyParameter != "uuid" {
+		t.Fatalf("snapshot retry_policy = %#v, error = %v", roundTrip.RetryPolicy, err)
+	}
+
+	registry := SchemaRegistry{Products: []ProductSpec{{ID: "chat", Tools: []ToolSpec{spec}}}}
+	meta := buildMetaByCLIPathFromRegistry(registry)["chat send"]
+	if meta.Safety.RetryPolicy == nil || meta.Safety.RetryPolicy.KeyParameter != "uuid" {
+		t.Fatalf("ResolveMeta projection lost retry_policy: %#v", meta.Safety)
+	}
+	if decision := meta.Safety.Resolve(map[string]any{"uuid": "request-1"}); !decision.SafeToRetry || decision.EffectiveIdempotency != "idempotent" {
+		t.Fatalf("invocation decision = %#v", decision)
+	}
+	if decision := meta.Safety.Resolve(nil); decision.SafeToRetry || decision.EffectiveIdempotency != "non_idempotent" {
+		t.Fatalf("missing-key invocation decision = %#v", decision)
+	}
+	t.Cleanup(restorePackageCLISchemaDeliveryForTest)
+	storeSchemaSourceRootFn(func() *cobra.Command { return &cobra.Command{Use: "dws"} })
+	assembleDeliverySchemaCatalogFn = func(*cobra.Command) (loadedSchemaCatalog, error) {
+		return loadedSchemaCatalog{Registry: registry}, nil
+	}
+	resetSchemaDeliveryState()
+	decision, ok := ResolveInvocationSafety("chat send", map[string]any{"uuid": "request-1"})
+	if !ok || !decision.SafeToRetry || decision.EffectiveIdempotency != "idempotent" {
+		t.Fatalf("ResolveInvocationSafety() = %#v, ok=%v", decision, ok)
+	}
+	if _, ok := ResolveInvocationSafety("chat missing", nil); ok {
+		t.Fatal("ResolveInvocationSafety() must not invent missing commands")
+	}
+	transportDecision := ResolveToolCallRetry("chat", "send", map[string]any{"requestUuid": "request-1"})
+	if !transportDecision.SafeToRetry || transportDecision.EffectiveIdempotency != "idempotent" {
+		t.Fatalf("ResolveToolCallRetry() = %#v", transportDecision)
+	}
+	if missing := ResolveToolCallRetry("chat", "missing", nil); missing.SafeToRetry || missing.Reason != "interface_not_declared" {
+		t.Fatalf("missing interface decision = %#v", missing)
+	}
+	lookup := buildToolCallRetryLookup(loadedSchemaCatalog{Registry: registry})
+	resolution := lookup[retryInterfaceRefKey("chat", "send")]
+	resolvedDecision := contract.ResolveRetryDecision(resolution.idempotency, resolution.policy, map[string]any{"requestUuid": "request-1"}, resolution.argumentKey)
+	if !resolvedDecision.SafeToRetry {
+		t.Fatalf("interface retry decision = %#v", resolvedDecision)
+	}
+	fullTool, _ := spec.ToPayload()
+	metaSnapshot := SchemaCatalogSnapshot{Version: SchemaCatalogSnapshotVersion, SourceHash: "retry-source", Tools: map[string]map[string]any{"chat.send": fullTool}}
+	metaIndex, err := BuildSchemaMetaIndex(metaSnapshot)
+	if err != nil || len(metaIndex.Entries) != 1 || metaIndex.Entries[0].RetryPolicy == nil {
+		t.Fatalf("BuildSchemaMetaIndex() = %#v, error = %v", metaIndex, err)
+	}
+	encodedIndex, err := EncodeSchemaMetaIndex(metaIndex)
+	if err != nil {
+		t.Fatalf("EncodeSchemaMetaIndex() error = %v", err)
+	}
+	decodedIndex, err := DecodeSchemaMetaIndex(encodedIndex)
+	if err != nil || decodedIndex.Entries[0].RetryPolicy == nil || decodedIndex.Entries[0].RetryPolicy.KeyParameter != "uuid" {
+		t.Fatalf("DecodeSchemaMetaIndex() = %#v, error = %v", decodedIndex, err)
+	}
+	if err := ValidateSchemaMetaIndexAgainstSnapshot(metaIndex, metaSnapshot); err != nil {
+		t.Fatalf("ValidateSchemaMetaIndexAgainstSnapshot() error = %v", err)
+	}
+	snapshotLookup := buildToolCallRetryLookup(loadedSchemaCatalog{Snapshot: SchemaCatalogSnapshot{Tools: map[string]map[string]any{
+		"chat.send":  fullTool,
+		"chat.local": {"interface_mode": contract.InterfaceModeLocal},
+	}}})
+	snapshotResolution := snapshotLookup[retryInterfaceRefKey("chat", "send")]
+	if snapshotResolution.argumentKey != "requestUuid" || snapshotResolution.policy == nil {
+		t.Fatalf("snapshot retry resolution = %#v", snapshotResolution)
+	}
+	invalidSnapshot := map[string]any{
+		"interface_mode": contract.InterfaceModeMCP,
+		"interface_ref":  map[string]any{"product_id": "chat", "rpc_name": "invalid"},
+		"idempotency":    "conditional",
+		"retry_policy":   map[string]any{"mode": "inferred", "key_parameter": "uuid", "same_payload_required": true},
+	}
+	invalidLookup := buildToolCallRetryLookup(loadedSchemaCatalog{Snapshot: SchemaCatalogSnapshot{Tools: map[string]map[string]any{"chat.invalid": invalidSnapshot}}})
+	invalidResolution := invalidLookup[retryInterfaceRefKey("chat", "invalid")]
+	if invalidResolution.policy != nil || contract.ResolveRetryDecision(invalidResolution.idempotency, nil, nil, "").Reason != "invalid_retry_policy" {
+		t.Fatalf("invalid snapshot retry resolution = %#v", invalidResolution)
+	}
+	missingBindingSnapshot := map[string]any{
+		"interface_mode": contract.InterfaceModeMCP,
+		"interface_ref":  map[string]any{"product_id": "chat", "rpc_name": "missing_binding"},
+		"idempotency":    "conditional",
+		"retry_policy":   map[string]any{"mode": contract.RetryModeDeduplicationKey, "key_parameter": "uuid", "same_payload_required": true},
+		"parameters":     map[string]any{"uuid": map[string]any{"type": "string"}},
+	}
+	missingBindingLookup := buildToolCallRetryLookup(loadedSchemaCatalog{Snapshot: SchemaCatalogSnapshot{Tools: map[string]map[string]any{
+		"chat.missing_binding": missingBindingSnapshot,
+	}}})
+	missingBindingResolution := missingBindingLookup[retryInterfaceRefKey("chat", "missing_binding")]
+	missingBindingDecision := contract.ResolveRetryDecision(
+		missingBindingResolution.idempotency,
+		missingBindingResolution.policy,
+		map[string]any{"uuid": "request-1"},
+		missingBindingResolution.argumentKey,
+	)
+	if missingBindingDecision.SafeToRetry || missingBindingDecision.Reason != "deduplication_key_binding_missing" {
+		t.Fatalf("snapshot missing property inferred a key binding: %#v", missingBindingDecision)
+	}
+	if retryPolicyFromSchemaValue(func() {}) != nil || retryPolicyFromSchemaValue("invalid") != nil || retryPolicyFromSchemaValue(nil) != nil {
+		t.Fatal("invalid snapshot policy values must fail closed")
+	}
+
+	conflict := spec
+	conflict.Identity.Name = "reply"
+	conflict.Identity.CanonicalPath = "chat.reply"
+	conflict.Identity.CLIPath = "chat reply"
+	conflict.Identity.PrimaryCLIPath = "chat reply"
+	conflict.Safety.Idempotency = "unknown"
+	conflict.RetryPolicy = nil
+	conflict.FieldProvenance = nil
+	conflictRegistry := SchemaRegistry{Products: []ProductSpec{{ID: "chat", Tools: []ToolSpec{spec, conflict}}}}
+	assembleDeliverySchemaCatalogFn = func(*cobra.Command) (loadedSchemaCatalog, error) {
+		return loadedSchemaCatalog{Registry: conflictRegistry}, nil
+	}
+	resetSchemaDeliveryState()
+	conflictDecision := ResolveToolCallRetry("chat", "send", map[string]any{"requestUuid": "request-1"})
+	if conflictDecision.SafeToRetry || conflictDecision.Reason != "interface_retry_policy_conflict" {
+		t.Fatalf("conflicting interface decision = %#v", conflictDecision)
+	}
+}
+
+func TestCrossPlatformCoverageConditionalRetryPolicyFailsClosed(t *testing.T) {
+	for name, mutate := range map[string]func(*RuntimeToolSpecInput){
+		"missing policy":       func(in *RuntimeToolSpecInput) { in.RetryPolicy = nil },
+		"missing parameter":    func(in *RuntimeToolSpecInput) { in.Parameters = nil },
+		"missing property":     func(in *RuntimeToolSpecInput) { in.Parameters[0].Property = "" },
+		"non string parameter": func(in *RuntimeToolSpecInput) { in.Parameters[0].Type = "integer" },
+		"inferred property": func(in *RuntimeToolSpecInput) {
+			in.Parameters[0].FieldProvenance["property"] = resolvedFieldProvenance(
+				"requestUuid", "flag_name_inference", "cobra.flag", "inference", "fallback", "inferred",
+			)
+		},
+		"non MCP interface": func(in *RuntimeToolSpecInput) {
+			in.Interface = contract.InterfaceSpec{Mode: contract.InterfaceModeLocal, Availability: contract.InterfaceAvailable, Reason: "local"}
+		},
+		"policy on static idempotent": func(in *RuntimeToolSpecInput) { in.Safety.Idempotency = "idempotent" },
+		"invalid policy mode":         func(in *RuntimeToolSpecInput) { in.RetryPolicy.Mode = "inferred" },
+	} {
+		t.Run(name, func(t *testing.T) {
+			input := conditionalRetryTool()
+			mutate(&input)
+			if _, err := ToolSpecFromRuntime(input); err == nil {
+				t.Fatal("invalid retry contract must fail closed")
+			}
+		})
+	}
+}
+
+func TestCrossPlatformCoverageConditionalRetryPolicyRequiresFinalProvenance(t *testing.T) {
+	spec, err := ToolSpecFromRuntime(conditionalRetryTool())
+	if err != nil {
+		t.Fatalf("ToolSpecFromRuntime() error = %v", err)
+	}
+	delete(spec.FieldProvenance, "retry_policy")
+	err = validateFinalSchemaProvenanceCoverage(SchemaRegistry{Products: []ProductSpec{{
+		ID: "chat", Tools: []ToolSpec{spec},
+	}}})
+	if err == nil || !strings.Contains(err.Error(), "has no provenance for retry_policy") {
+		t.Fatalf("validateFinalSchemaProvenanceCoverage() error = %v", err)
+	}
+}
+
+func TestCrossPlatformCoverageInterfaceRetryPolicyConflictFailsClosed(t *testing.T) {
+	lookup := map[InterfaceRefKey]toolCallRetryResolution{}
+	key := retryInterfaceRefKey("chat", "send")
+	idempotent := toolCallRetryResolution{idempotency: "idempotent"}
+	mergeToolCallRetryResolution(lookup, key, idempotent)
+	mergeToolCallRetryResolution(lookup, key, idempotent)
+	mergeToolCallRetryResolution(lookup, key, toolCallRetryResolution{idempotency: "unknown"})
+	mergeToolCallRetryResolution(lookup, key, idempotent)
+	if got := lookup[key]; !got.conflict {
+		t.Fatalf("conflicting interface retry semantics = %#v", got)
+	}
+	decision := contract.RetryDecision{EffectiveIdempotency: "unknown", Reason: "interface_retry_policy_conflict"}
+	if decision.SafeToRetry || !strings.Contains(decision.Reason, "conflict") {
+		t.Fatalf("conflict decision = %#v", decision)
+	}
+}

internal/cli/retry_resolution.go

@@ -0,0 +1,135 @@
+// Copyright 2026 Alibaba Group
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package cli
+
+import (
+	"encoding/json"
+	"reflect"
+	"strings"
+
+	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/corecmd/contract"
+)
+
+type toolCallRetryResolution struct {
+	idempotency string
+	policy      *contract.RetryPolicySpec
+	argumentKey string
+	conflict    bool
+}
+
+func retryInterfaceRefKey(productID, rpcName string) InterfaceRefKey {
+	return InterfaceRefKey{
+		ProductID: strings.TrimSpace(productID),
+		RPCName:   strings.TrimSpace(rpcName),
+	}
+}
+
+func buildToolCallRetryLookup(loaded loadedSchemaCatalog) map[InterfaceRefKey]toolCallRetryResolution {
+	if len(loaded.Registry.Products) == 0 {
+		return buildToolCallRetryLookupFromSnapshot(loaded.Snapshot.Tools)
+	}
+	lookup := make(map[InterfaceRefKey]toolCallRetryResolution)
+	for _, product := range loaded.Registry.Products {
+		for _, tool := range product.Tools {
+			if tool.Interface.Mode != contract.InterfaceModeMCP || tool.Interface.Ref == nil {
+				continue
+			}
+			resolution := toolCallRetryResolution{idempotency: tool.Safety.Idempotency, policy: cloneRetryPolicy(tool.RetryPolicy)}
+			if tool.RetryPolicy != nil {
+				for _, parameter := range tool.Parameters {
+					if parameter.Name == tool.RetryPolicy.KeyParameter {
+						resolution.argumentKey = parameter.Property
+						break
+					}
+				}
+			}
+			mergeToolCallRetryResolution(lookup, retryInterfaceRefKey(tool.Interface.Ref.ProductID, tool.Interface.Ref.RPCName), resolution)
+		}
+	}
+	return lookup
+}
+
+func buildToolCallRetryLookupFromSnapshot(tools map[string]map[string]any) map[InterfaceRefKey]toolCallRetryResolution {
+	lookup := make(map[InterfaceRefKey]toolCallRetryResolution)
+	for _, tool := range tools {
+		ref, _ := tool["interface_ref"].(map[string]any)
+		productID, rpcName := schemaString(ref["product_id"]), schemaString(ref["rpc_name"])
+		if schemaString(tool["interface_mode"]) != contract.InterfaceModeMCP || productID == "" || rpcName == "" {
+			continue
+		}
+		policy := retryPolicyFromSchemaValue(tool["retry_policy"])
+		resolution := toolCallRetryResolution{idempotency: schemaString(tool["idempotency"]), policy: policy}
+		if policy != nil {
+			parameters, _ := tool["parameters"].(map[string]any)
+			parameter, _ := parameters[policy.KeyParameter].(map[string]any)
+			resolution.argumentKey = schemaString(parameter["property"])
+		}
+		mergeToolCallRetryResolution(lookup, retryInterfaceRefKey(productID, rpcName), resolution)
+	}
+	return lookup
+}
+
+func mergeToolCallRetryResolution(lookup map[InterfaceRefKey]toolCallRetryResolution, key InterfaceRefKey, candidate toolCallRetryResolution) {
+	current, exists := lookup[key]
+	if !exists {
+		lookup[key] = candidate
+		return
+	}
+	if current.conflict || current.idempotency != candidate.idempotency || current.argumentKey != candidate.argumentKey || !reflect.DeepEqual(current.policy, candidate.policy) {
+		lookup[key] = toolCallRetryResolution{conflict: true}
+	}
+}
+
+func cloneRetryPolicy(in *contract.RetryPolicySpec) *contract.RetryPolicySpec {
+	if in == nil {
+		return nil
+	}
+	out := *in
+	return &out
+}
+
+func retryPolicyFromSchemaValue(value any) *contract.RetryPolicySpec {
+	if value == nil {
+		return nil
+	}
+	data, err := json.Marshal(value)
+	if err != nil {
+		return nil
+	}
+	var policy contract.RetryPolicySpec
+	if err := json.Unmarshal(data, &policy); err != nil {
+		return nil
+	}
+	normalized, err := contract.NormalizeRetryPolicySpec(&policy, "<snapshot>")
+	if err != nil {
+		return nil
+	}
+	return normalized
+}
+
+// ResolveToolCallRetry resolves transport retry safety from an exact reviewed
+// MCP interface identity and actual RPC arguments. Missing or conflicting
+// interface mappings fail closed; no command, flag, or property name is inferred.
+func ResolveToolCallRetry(productID, rpcName string, arguments map[string]any) contract.RetryDecision {
+	_ = deliverySchemaCatalog()
+	panicIfMetaIndexUnusable(runtimeDeliverySchemaMetaIndexErr)
+	resolution, ok := toolCallRetryByInterface[retryInterfaceRefKey(productID, rpcName)]
+	if !ok {
+		return contract.RetryDecision{EffectiveIdempotency: "unknown", Reason: "interface_not_declared"}
+	}
+	if resolution.conflict {
+		return contract.RetryDecision{EffectiveIdempotency: "unknown", Reason: "interface_retry_policy_conflict"}
+	}
+	return contract.ResolveRetryDecision(resolution.idempotency, resolution.policy, arguments, resolution.argumentKey)
+}

internal/cli/runtime_schema.go

@@ -1057,6 +1057,7 @@ var schemaCompactPayloadKeys = map[string]bool{
 	"canonical_path": true, "cli_path": true,
 	"agent_summary": true, "description": true,
 	"effect": true, "risk": true, "confirmation": true, "idempotency": true,
+	"retry_policy":   true,
 	"interface_mode": true, "availability": true, "interface_reason": true,
 	"parameters": true, "constraints": true, "positionals": true, "dry_run": true,
 	"result": true, "pagination": true,

internal/cli/schema_catalog_structure.go

@@ -81,6 +81,7 @@ var schemaCatalogToolOptionalKeys = []string{
 	"pagination",
 	"positionals",
 	"result",
+	"retry_policy",
 }
 
 var schemaCatalogToolEnums = map[string][]string{
@@ -89,6 +90,7 @@ var schemaCatalogToolEnums = map[string][]string{
 	"confirmation":   {"not_required", "user_required"},
 	"interface_mode": {contract.InterfaceModeMCP, contract.InterfaceModeComposite, contract.InterfaceModeLocal},
 	"availability":   {contract.InterfaceAvailable, contract.InterfaceUnavailable},
+	"idempotency":    {"idempotent", "non_idempotent", "unknown", "conditional"},
 }
 
 // schemaCatalogParamRequiredKeys is the required core of every parameter.
@@ -239,6 +241,7 @@ func validateCatalogToolEntry(toolID string, entry map[string]any, violations *[
 	}
 
 	validateCatalogInterface(toolID, entry, violations)
+	validateCatalogRetryPolicy(toolID, entry, parameters, paramsOK, violations)
 	if result, exists := entry["result"]; exists {
 		if _, ok := result.(map[string]any); !ok {
 			report("field %q must be an object", "result")
@@ -280,6 +283,66 @@ func validateCatalogToolEntry(toolID string, entry map[string]any, violations *[
 	}
 }
 
+func validateCatalogRetryPolicy(toolID string, entry, parameters map[string]any, paramsOK bool, violations *[]schemaCatalogStructureViolation) {
+	report := func(format string, args ...any) {
+		*violations = append(*violations, schemaCatalogStructureViolation{tool: toolID, message: fmt.Sprintf(format, args...)})
+	}
+	idempotency, _ := entry["idempotency"].(string)
+	raw, hasPolicy := entry["retry_policy"]
+	if idempotency == "conditional" && !hasPolicy {
+		report("idempotency=conditional requires retry_policy")
+		return
+	}
+	if idempotency != "conditional" && hasPolicy {
+		report("retry_policy requires idempotency=conditional")
+	}
+	if !hasPolicy {
+		return
+	}
+	policy, ok := raw.(map[string]any)
+	if !ok {
+		report("retry_policy must be an object")
+		return
+	}
+	for key := range policy {
+		if key != "mode" && key != "key_parameter" && key != "same_payload_required" {
+			report("retry_policy has unknown field %q", key)
+		}
+	}
+	if mode, _ := policy["mode"].(string); mode != contract.RetryModeDeduplicationKey {
+		report("retry_policy.mode = %q, want %q", mode, contract.RetryModeDeduplicationKey)
+	}
+	keyParameter, _ := policy["key_parameter"].(string)
+	if strings.TrimSpace(keyParameter) == "" {
+		report("retry_policy.key_parameter must be a non-empty string")
+	} else if paramsOK {
+		rawParameter, exists := parameters[keyParameter]
+		parameter, parameterOK := rawParameter.(map[string]any)
+		if !exists || !parameterOK {
+			report("retry_policy.key_parameter references missing parameter %q", keyParameter)
+		} else {
+			if property, _ := parameter["property"].(string); strings.TrimSpace(property) == "" {
+				report("retry_policy key parameter %q must have a non-empty property", keyParameter)
+			}
+			if parameterType, _ := parameter["type"].(string); parameterType != "string" {
+				report("retry_policy key parameter %q must have type string", keyParameter)
+			}
+			fieldProvenance, _ := parameter["field_provenance"].(map[string]any)
+			propertyProvenance, _ := fieldProvenance["property"].(map[string]any)
+			if source, _ := propertyProvenance["source"].(string); source != "native_annotation" {
+				report("retry_policy key parameter %q property must come from an explicit ParamDecl", keyParameter)
+			}
+		}
+	}
+	if required, ok := policy["same_payload_required"].(bool); !ok || !required {
+		report("retry_policy.same_payload_required must be true")
+	}
+	mode, _ := entry["interface_mode"].(string)
+	if mode != contract.InterfaceModeMCP || entry["interface_ref"] == nil {
+		report("retry_policy requires interface_mode=mcp with interface_ref")
+	}
+}
+
 func validateCatalogInterface(toolID string, entry map[string]any, violations *[]schemaCatalogStructureViolation) {
 	report := func(format string, args ...any) {
 		*violations = append(*violations, schemaCatalogStructureViolation{

internal/cli/schema_catalog_structure_test.go

@@ -102,6 +102,63 @@ func TestValidateCatalogStructureAcceptsValidEntry(t *testing.T) {
 	}
 }
 
+func TestCrossPlatformCoverageValidateCatalogStructureConditionalRetryPolicy(t *testing.T) {
+	valid := func() map[string]any {
+		entry := validCatalogToolEntry()
+		entry["idempotency"] = "conditional"
+		parameter := entry["parameters"].(map[string]any)["base-id"].(map[string]any)
+		parameter["property"] = "baseId"
+		parameter["field_provenance"].(map[string]any)["property"] = map[string]any{"source": "native_annotation"}
+		entry["retry_policy"] = map[string]any{
+			"mode":                  contract.RetryModeDeduplicationKey,
+			"key_parameter":         "base-id",
+			"same_payload_required": true,
+		}
+		return entry
+	}
+	entry := valid()
+	if err := ValidateCatalogStructure(catalogPayload(t, entry)); err != nil {
+		t.Fatalf("ValidateCatalogStructure() error = %v", err)
+	}
+	for _, test := range []struct {
+		name   string
+		mutate func(map[string]any)
+		want   string
+	}{
+		{name: "missing policy", mutate: func(entry map[string]any) { delete(entry, "retry_policy") }, want: "requires retry_policy"},
+		{name: "policy on non conditional", mutate: func(entry map[string]any) { entry["idempotency"] = "unknown" }, want: "retry_policy requires idempotency=conditional"},
+		{name: "non object", mutate: func(entry map[string]any) { entry["retry_policy"] = "invalid" }, want: "retry_policy must be an object"},
+		{name: "unknown field", mutate: func(entry map[string]any) { entry["retry_policy"].(map[string]any)["inferred"] = true }, want: "unknown field"},
+		{name: "bad mode", mutate: func(entry map[string]any) { entry["retry_policy"].(map[string]any)["mode"] = "always" }, want: "retry_policy.mode"},
+		{name: "empty key", mutate: func(entry map[string]any) { entry["retry_policy"].(map[string]any)["key_parameter"] = " " }, want: "key_parameter must be a non-empty string"},
+		{name: "missing key parameter", mutate: func(entry map[string]any) { entry["retry_policy"].(map[string]any)["key_parameter"] = "uuid" }, want: "references missing parameter"},
+		{name: "missing property", mutate: func(entry map[string]any) {
+			delete(entry["parameters"].(map[string]any)["base-id"].(map[string]any), "property")
+		}, want: "non-empty property"},
+		{name: "non string key", mutate: func(entry map[string]any) {
+			entry["parameters"].(map[string]any)["base-id"].(map[string]any)["type"] = "integer"
+		}, want: "must have type string"},
+		{name: "inferred property", mutate: func(entry map[string]any) {
+			entry["parameters"].(map[string]any)["base-id"].(map[string]any)["field_provenance"].(map[string]any)["property"].(map[string]any)["source"] = "flag_name_inference"
+		}, want: "must come from an explicit ParamDecl"},
+		{name: "same payload false", mutate: func(entry map[string]any) { entry["retry_policy"].(map[string]any)["same_payload_required"] = false }, want: "same_payload_required must be true"},
+		{name: "non MCP", mutate: func(entry map[string]any) {
+			entry["interface_mode"] = contract.InterfaceModeLocal
+			delete(entry, "interface_ref")
+			entry["interface_reason"] = "local"
+		}, want: "requires interface_mode=mcp"},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			entry := valid()
+			test.mutate(entry)
+			err := ValidateCatalogStructure(catalogPayload(t, entry))
+			if err == nil || !strings.Contains(err.Error(), test.want) {
+				t.Fatalf("ValidateCatalogStructure() error = %v, want %q", err, test.want)
+			}
+		})
+	}
+}
+
 func TestValidateCatalogStructureAcceptsOptionalResultObject(t *testing.T) {
 	entry := validCatalogToolEntry()
 	entry["result"] = map[string]any{

internal/cli/schema_catalog_test.go

@@ -1354,16 +1354,15 @@ func TestDeliveryCatalogChatParamDeclsFrom87910880Reviewed(t *testing.T) {
 		interfaceType string
 	}{
 		{"chat message edit", "conversation-id", "openConversationId", true, ""},
-		{"chat message edit", "message-id", "openMessageId", true, ""},
+		{"chat message edit", "msg-id", "openMessageId", true, ""},
 		{"chat message edit", "at-open-dingtalk-ids", "atOpenDingTalkIds", false, "array"},
-		{"chat message update-text-emotion", "message-id", "openMsgId", true, ""},
-		{"chat message send", "idempotency-key", "uuid", false, ""},
 		{"chat message send-card", "at-all", "atAll", false, ""},
 		{"chat message send-card", "at-open-dingtalk-ids", "atOpenDingTalkIds", false, "array"},
+		{"chat message update-text-emotion", "msg-id", "openMsgId", true, ""},
 		{"chat message update-text-emotion", "old-emotion-id", "oldEmotionId", true, ""},
 		{"chat category batch-info", "category-ids", "categoryIds", true, "array"},
-		{"chat category list-by-conv", "conversation-id", "openConversationId", true, ""},
-		{"chat group update-nick", "conversation-id", "", true, ""},
+		{"chat category list-by-conv", "group", "openConversationId", true, ""},
+		{"chat group update-nick", "group", "openConversationId", true, ""},
 		{"chat group upgrade-to-external", "extension", "extension", false, "object"},
 		{"chat +messages-send-card", "receiver-open-dingtalk-id", "receiverOpenDingTalkId", false, ""},
 		{"chat message list-favorites", "size", "", false, "string"},
@@ -1397,8 +1396,7 @@ func TestDeliveryCatalogChatParamDeclsFrom87910880Reviewed(t *testing.T) {
 		}
 	}
 
-	// Manifest-covered migrations hide legacy aliases; manifest-external
-	// commands keep their existing visible flags for compatibility.
+	// Hidden conversation aliases must stay unpublished (merge-base parity).
 	editLeaf, err := queryDeliverySchemaPayload([]string{"chat message edit"})
 	if err != nil {
 		t.Fatal(err)
@@ -1409,65 +1407,14 @@ func TestDeliveryCatalogChatParamDeclsFrom87910880Reviewed(t *testing.T) {
 			t.Fatalf("chat message edit unexpectedly publishes hidden alias --%s", hidden)
 		}
 	}
-	sendLeaf, err = queryDeliverySchemaPayload([]string{"chat message send"})
-	if err != nil {
-		t.Fatal(err)
-	}
-	sendParams = schemaMap(sendLeaf["parameters"])
-	if _, ok := sendParams["uuid"]; ok {
-		t.Fatal("chat message send unexpectedly publishes hidden alias --uuid")
-	}
 	listByConv, err := queryDeliverySchemaPayload([]string{"chat category list-by-conv"})
 	if err != nil {
 		t.Fatal(err)
 	}
 	listParams := schemaMap(listByConv["parameters"])
-	if _, ok := listParams["conversation-id"]; !ok {
-		t.Fatalf("chat category list-by-conv missing public canonical --conversation-id")
-	}
-	if _, ok := listParams["group"]; !ok {
-		t.Fatalf("chat category list-by-conv unexpectedly hides manifest-external --group")
-	}
-	if _, ok := listParams["id"]; ok {
-		t.Fatalf("chat category list-by-conv unexpectedly publishes hidden alias --id")
-	}
-
-	for _, path := range []string{
-		"chat message add-emoji",
-		"chat message remove-emoji",
-		"chat message add-text-emotion",
-		"chat message remove-text-emotion",
-	} {
-		leaf, err := queryDeliverySchemaPayload([]string{path})
-		if err != nil {
-			t.Fatal(err)
-		}
-		params := schemaMap(leaf["parameters"])
-		if _, ok := params["conversation-id"]; !ok {
-			t.Fatalf("%s missing public canonical --conversation-id", path)
-		}
-		for _, visible := range []string{"group", "id", "chat"} {
-			if _, ok := params[visible]; !ok {
-				t.Fatalf("%s unexpectedly hides manifest-external --%s", path, visible)
-			}
-		}
-	}
-
-	groupBots, err := queryDeliverySchemaPayload([]string{"chat group bots"})
-	if err != nil {
-		t.Fatal(err)
-	}
-	groupBotsParams := schemaMap(groupBots["parameters"])
-	group := groupBotsParams["group"]
-	if group == nil {
-		t.Fatal("chat group bots missing public legacy --group")
-	}
-	if group["property"] != "openConversationId" {
-		t.Fatalf("chat group bots --group property = %#v, want openConversationId", group["property"])
-	}
-	for _, migrated := range []string{"conversation-id", "group-name"} {
-		if _, ok := groupBotsParams[migrated]; ok {
-			t.Fatalf("chat group bots unexpectedly publishes migrated --%s", migrated)
+	for _, hidden := range []string{"conversation-id", "id"} {
+		if _, ok := listParams[hidden]; ok {
+			t.Fatalf("chat category list-by-conv unexpectedly publishes hidden alias --%s", hidden)
 		}
 	}
 }

internal/cli/schema_constraints_runtime.go

@@ -43,14 +43,19 @@ func init() {
 		RequireOneOf:      [][]string{{"conversation-id", "open-dingtalk-id", "user", "permParam"}},
 	})
 	registerExclusiveOneOf("chat.chat_permission_grant_cross_org_data", "target-org-id", "all")
+	registerRequireOneOf("chat.add_emoji_reaction", "conversation-id", "group", "id", "chat")
+	registerRequireOneOf("chat.add_text_emotion", "conversation-id", "group", "id", "chat")
 	registerExclusiveOneOf("chat.clear_conversation_messages", "conversation-id", "id", "chat")
 	registerExclusiveOneOf("chat.clear_conversation_red_point", "conversation-id", "id", "chat")
+	registerRequireOneOf("chat.update_text_emotion", "conversation-id", "group", "id", "chat")
 	registerExclusiveOneOf("chat.get_conversation_info", "group", "user", "open-dingtalk-id")
 	registerExclusiveOneOf("chat.hide_conversation", "conversation-id", "id", "chat")
 	registerExclusiveOneOf("chat.list_conversation_message_v2", "group", "user", "open-dingtalk-id")
 	registerExclusiveOneOf("chat.list_individual_chat_message", "user", "open-dingtalk-id")
 	registerExclusiveOneOf("chat.mark_conversation_unread", "conversation-id", "id", "chat")
 	registerExclusiveOneOf("chat.mark_message_read", "conversation-id", "id", "chat")
+	registerRequireOneOf("chat.remove_emoji_reaction", "conversation-id", "group", "id", "chat")
+	registerRequireOneOf("chat.remove_text_emotion", "conversation-id", "group", "id", "chat")
 	registerRequireOneOf("chat.send_personal_message", "text", "content", "msg-type")
 	registerExclusiveOneOf("chat.send_robot_message", "group", "users")
 	registerRequireOneOf("chat.set_group_member_mute_list", "users", "user")

internal/cli/schema_contract_model.go

@@ -62,6 +62,7 @@ type ToolSpec struct {
 	DryRun          *contract.DryRunSpec
 	Result          *contract.ResultSpec
 	Pagination      *contract.PaginationSpec
+	RetryPolicy     *contract.RetryPolicySpec
 	Safety          contract.SafetySpec
 	Interface       contract.InterfaceSpec
 	Selection       contract.SelectionSpec
@@ -137,6 +138,7 @@ type RuntimeToolSpecInput struct {
 	DryRun          *contract.DryRunSpec
 	Result          *contract.ResultSpec
 	Pagination      *contract.PaginationSpec
+	RetryPolicy     *contract.RetryPolicySpec
 	Safety          contract.SafetySpec
 	Interface       contract.InterfaceSpec
 	Selection       contract.SelectionSpec
@@ -224,6 +226,8 @@ func (t ToolSpec) provenanceValue(field string) (any, bool) {
 		return t.Safety.Confirmation, true
 	case "idempotency":
 		return t.Safety.Idempotency, true
+	case "retry_policy":
+		return t.RetryPolicy, true
 	case "interface_ref":
 		return t.Interface.Ref, true
 	case "interface_mode":
@@ -556,6 +560,42 @@ func (t ToolSpec) Validate() error {
 			return fmt.Errorf("tool %s pagination cursor_parameter %q is not a declared parameter", id.CanonicalPath, pagination.CursorParameter)
 		}
 	}
+	retryPolicy, err := contract.NormalizeRetryPolicySpec(t.RetryPolicy, id.CanonicalPath)
+	if err != nil {
+		return err
+	}
+	if t.Safety.Idempotency == "conditional" {
+		if retryPolicy == nil {
+			return fmt.Errorf("tool %s idempotency=conditional requires retry_policy", id.CanonicalPath)
+		}
+	} else if retryPolicy != nil {
+		return fmt.Errorf("tool %s retry_policy requires idempotency=conditional", id.CanonicalPath)
+	}
+	if retryPolicy != nil {
+		if t.Interface.Mode != contract.InterfaceModeMCP || t.Interface.Ref == nil {
+			return fmt.Errorf("tool %s retry_policy requires an MCP interface_ref", id.CanonicalPath)
+		}
+		var keyProperty, keyType string
+		var keyPropertyProvenance contract.FieldProvenance
+		for _, parameter := range t.Parameters {
+			if parameter.Name == retryPolicy.KeyParameter {
+				keyProperty = strings.TrimSpace(parameter.Property)
+				keyType = strings.TrimSpace(parameter.Type)
+				keyPropertyProvenance = parameter.FieldProvenance["property"]
+				break
+			}
+		}
+		if keyProperty == "" {
+			return fmt.Errorf("tool %s retry_policy key_parameter %q must name a declared parameter with a non-empty interface property", id.CanonicalPath, retryPolicy.KeyParameter)
+		}
+		if keyType != "string" {
+			return fmt.Errorf("tool %s retry_policy key_parameter %q must be a string parameter", id.CanonicalPath, retryPolicy.KeyParameter)
+		}
+		if strings.TrimSpace(keyPropertyProvenance.Source) != "native_annotation" ||
+			strings.TrimSpace(keyPropertyProvenance.Precedence) != "native_annotation" {
+			return fmt.Errorf("tool %s retry_policy key_parameter %q property must come from an explicit ParamDecl", id.CanonicalPath, retryPolicy.KeyParameter)
+		}
+	}
 	if t.Interface.Mode != "" || t.Interface.Availability != "" || t.Interface.Reason != "" || t.Interface.Ref != nil {
 		if err := t.Interface.Validate(id.CanonicalPath); err != nil {
 			return err
@@ -756,6 +796,12 @@ func (t ToolSpec) normalized() ToolSpec {
 			out.Pagination = pagination
 		}
 	}
+	if t.RetryPolicy != nil {
+		retryPolicy := *t.RetryPolicy
+		retryPolicy.Mode = strings.TrimSpace(retryPolicy.Mode)
+		retryPolicy.KeyParameter = strings.TrimSpace(retryPolicy.KeyParameter)
+		out.RetryPolicy = &retryPolicy
+	}
 	out.Positionals = append([]contract.RuntimeSchemaPositional(nil), t.Positionals...)
 	sort.Slice(out.Positionals, func(i, j int) bool {
 		if out.Positionals[i].Index != out.Positionals[j].Index {
@@ -990,6 +1036,10 @@ func (t ToolSpec) ToPayload() (map[string]any, error) {
 		value, _ := typedJSONValue(t.Pagination)
 		payload["pagination"] = value
 	}
+	if t.RetryPolicy != nil {
+		value, _ := typedJSONValue(t.RetryPolicy)
+		payload["retry_policy"] = value
+	}
 	applySafetyPayload(payload, t.Safety)
 	applyInterfacePayload(payload, t.Interface)
 	applySelectionPayload(payload, t.Selection, true)
@@ -1013,7 +1063,7 @@ func (t ToolSpec) ToSummaryPayload() (map[string]any, error) {
 	}
 	for _, key := range []string{
 		"parameters", "has_parameters", "parameter_count", "constraints",
-		"positionals", "result", "examples", "effect_source", "agent_source_refs",
+		"positionals", "result", "retry_policy", "examples", "effect_source", "agent_source_refs",
 		"field_provenance", "path", "source", "product_id", "display", "is_alias",
 	} {
 		delete(payload, key)

internal/cli/schema_meta_index.go

@@ -21,6 +21,8 @@ import (
 	"reflect"
 	"sort"
 	"strings"
+
+	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/corecmd/contract"
 )
 
 // SchemaMetaIndexVersion is the CommandMeta summary index format used by CI
@@ -42,19 +44,20 @@ type SchemaMetaIndexSnapshot struct {
 // SchemaMetaIndexEntry is one primary-path CommandMeta record. Aliases are
 // expanded into the ResolveMeta lookup at decode time.
 type SchemaMetaIndexEntry struct {
-	CLIPath      string   `json:"cli_path"`
-	Canonical    string   `json:"canonical_path"`
-	Aliases      []string `json:"aliases,omitempty"`
-	ProductID    string   `json:"product_id,omitempty"`
-	Title        string   `json:"title,omitempty"`
-	Effect       string   `json:"effect,omitempty"`
-	Risk         string   `json:"risk,omitempty"`
-	Confirmation string   `json:"confirmation,omitempty"`
-	Idempotency  string   `json:"idempotency,omitempty"`
-	AgentSummary string   `json:"agent_summary,omitempty"`
-	UseWhen      []string `json:"use_when,omitempty"`
-	AvoidWhen    []string `json:"avoid_when,omitempty"`
-	Examples     []string `json:"examples,omitempty"`
+	CLIPath      string                    `json:"cli_path"`
+	Canonical    string                    `json:"canonical_path"`
+	Aliases      []string                  `json:"aliases,omitempty"`
+	ProductID    string                    `json:"product_id,omitempty"`
+	Title        string                    `json:"title,omitempty"`
+	Effect       string                    `json:"effect,omitempty"`
+	Risk         string                    `json:"risk,omitempty"`
+	Confirmation string                    `json:"confirmation,omitempty"`
+	Idempotency  string                    `json:"idempotency,omitempty"`
+	RetryPolicy  *contract.RetryPolicySpec `json:"retry_policy,omitempty"`
+	AgentSummary string                    `json:"agent_summary,omitempty"`
+	UseWhen      []string                  `json:"use_when,omitempty"`
+	AvoidWhen    []string                  `json:"avoid_when,omitempty"`
+	Examples     []string                  `json:"examples,omitempty"`
 }
 
 // BuildSchemaMetaIndex extracts the ResolveMeta summary from a full Catalog
@@ -91,6 +94,7 @@ func BuildSchemaMetaIndex(snapshot SchemaCatalogSnapshot) (SchemaMetaIndexSnapsh
 			Risk:         schemaString(tool["risk"]),
 			Confirmation: schemaString(tool["confirmation"]),
 			Idempotency:  schemaString(tool["idempotency"]),
+			RetryPolicy:  retryPolicyFromSchemaValue(tool["retry_policy"]),
 			AgentSummary: schemaString(tool["agent_summary"]),
 			UseWhen:      schemaStringSlice(tool["use_when"]),
 			AvoidWhen:    schemaStringSlice(tool["avoid_when"]),
@@ -203,6 +207,7 @@ func commandMetaLookupFromIndex(index SchemaMetaIndexSnapshot) (map[string]Comma
 				Risk:         entry.Risk,
 				Confirmation: entry.Confirmation,
 				Idempotency:  entry.Idempotency,
+				RetryPolicy:  cloneRetryPolicy(entry.RetryPolicy),
 			},
 			Selection: CommandSelection{
 				AgentSummary: entry.AgentSummary,
@@ -294,7 +299,7 @@ func commandMetaEqual(got, want CommandMeta) error {
 		!metaStringSlicesEqual(got.Identity.Aliases, want.Identity.Aliases) {
 		return fmt.Errorf("identity mismatch: got %+v want %+v", got.Identity, want.Identity)
 	}
-	if got.Safety != want.Safety {
+	if !reflect.DeepEqual(got.Safety, want.Safety) {
 		return fmt.Errorf("safety mismatch: got %+v want %+v", got.Safety, want.Safety)
 	}
 	if got.Selection.AgentSummary != want.Selection.AgentSummary ||

internal/cli/schema_parameter_mapping_ledger.go

@@ -252,8 +252,7 @@ var reviewedSchemaParameterMappingExclusions = map[string]string{
 	"chat.batch_query_group_chat_settings --groups":                      "Reviewed unpinned adapter: chat.batch_query_group_chat_settings has no singular pinned interface_ref; --groups is a CLI wrapper input and does not publish a direct interface property.",
 	"chat.batch_update_group_chat_settings --items":                      "Reviewed unpinned adapter: chat.batch_update_group_chat_settings has no singular pinned interface_ref; --items is a CLI wrapper input and does not publish a direct interface property.",
 	"chat.create_text_emotion --background-id":                           "Runtime extension: the executable helper forwards backgroundId to im/create_text_emotion, but the pinned source-revision metadata does not declare that optional property; preserve the compatibility flag without advertising it as a pinned RPC field.",
-	"chat.get_group_mute_config --conversation-id":                       "Reviewed unpinned adapter: chat.get_group_mute_config has no singular pinned interface_ref; --conversation-id is a CLI wrapper input and does not publish a direct interface property.",
-	"chat.get_group_mute_config --group":                                 "Reviewed legacy Schema compatibility: the historical visible --group wrapper input was required but did not publish a direct interface property.",
+	"chat.get_group_mute_config --group":                                 "Reviewed unpinned adapter: chat.get_group_mute_config has no singular pinned interface_ref; --group is a CLI wrapper input and does not publish a direct interface property.",
 	"chat.list_conversation_message_v2 --open-dingtalk-id":               "selects the alternate list_individual_chat_message branch",
 	"chat.list_conversation_message_v2 --user":                           "selects the alternate list_individual_chat_message branch",
 	"chat.list_message_favorites --cursor":                               "Reviewed unpinned adapter: chat.list_message_favorites has no singular pinned interface_ref; --cursor is a CLI wrapper input and does not publish a direct interface property.",
@@ -266,7 +265,6 @@ var reviewedSchemaParameterMappingExclusions = map[string]string{
 	"chat.query_msg_read_status --users":                                 "conditional wrapper/alias of --user: parseCSVValues + appendChatIDArgs routes each supplied identifier to targetUserIds or targetOpenDingTalkIds according to its runtime ID shape; there is no single RPC property for this flag",
 	"chat.remove_message_favorite --open-conversation-id":                "Reviewed unpinned adapter: chat.remove_message_favorite has no singular pinned interface_ref; --open-conversation-id is a CLI wrapper input and does not publish a direct interface property.",
 	"chat.remove_message_favorite --open-message-id":                     "Reviewed unpinned adapter: chat.remove_message_favorite has no singular pinned interface_ref; --open-message-id is a CLI wrapper input and does not publish a direct interface property.",
-	"chat.update_text_emotion --conversation-id":                         "Reviewed unpinned adapter: chat.update_text_emotion has no singular pinned interface_ref; --conversation-id is a CLI wrapper input and does not publish a direct interface property.",
 	"chat.reply_personal_message --ref-msg-id":                           "serialized into the aggregate content JSON string",
 	"chat.reply_personal_message --ref-sender":                           "resolved then serialized into the aggregate content JSON string",
 	"chat.reply_personal_message --text":                                 "serialized into the aggregate content JSON string",

internal/cli/schema_runtime_registry.go

@@ -294,6 +294,10 @@ func runtimeToolSpecFromContractFinal(entry runtimeSchemaEntry, final contract.C
 	} else if gate, ok := RuntimeContractGate(entry.Command); ok {
 		safety = applyContractGateToSafety(safety, gate)
 	}
+	retryPolicy, err := contract.NormalizeRetryPolicySpec(final.RetryPolicy, canonicalPath)
+	if err != nil {
+		return ToolSpec{}, err
+	}
 
 	positionals := final.Positionals
 	if len(positionals) == 0 {
@@ -333,7 +337,7 @@ func runtimeToolSpecFromContractFinal(entry runtimeSchemaEntry, final contract.C
 	// part of the public ToolSpec / Schema wire contract.
 	selection.ExampleDispositions = nil
 
-	provenance := contractFinalProvenance(identity, title, description, titleProv, descriptionProv, safety, interfaceSpec, selection, final.DryRun)
+	provenance := contractFinalProvenance(identity, title, description, titleProv, descriptionProv, safety, retryPolicy, interfaceSpec, selection, final.DryRun)
 
 	result, pagination := final.Result, final.Pagination
 	if !output.UsesUnifiedResult(entry.Command) {
@@ -356,6 +360,7 @@ func runtimeToolSpecFromContractFinal(entry runtimeSchemaEntry, final contract.C
 		DryRun:          final.DryRun,
 		Result:          result,
 		Pagination:      pagination,
+		RetryPolicy:     retryPolicy,
 		Safety:          safety,
 		Interface:       interfaceSpec,
 		Selection:       selection,
@@ -402,7 +407,7 @@ func contractFinalTextProvenance(declared, cobra string, preferCobra bool) (stri
 // dry_run when present), so declared leaves must emit the full set, not only
 // the fields they happened to author. Title/description provenance must match
 // the real text winner (cobra_help vs contract_final).
-func contractFinalProvenance(identity contract.ToolIdentitySpec, title, description string, titleProv, descriptionProv contract.FieldProvenance, safety contract.SafetySpec, iface contract.InterfaceSpec, selection contract.SelectionSpec, dryRun *contract.DryRunSpec) map[string]contract.FieldProvenance {
+func contractFinalProvenance(identity contract.ToolIdentitySpec, title, description string, titleProv, descriptionProv contract.FieldProvenance, safety contract.SafetySpec, retryPolicy *contract.RetryPolicySpec, iface contract.InterfaceSpec, selection contract.SelectionSpec, dryRun *contract.DryRunSpec) map[string]contract.FieldProvenance {
 	prov := func(value any, sourceRef string) contract.FieldProvenance {
 		return resolvedFieldProvenance(
 			value,
@@ -454,6 +459,9 @@ func contractFinalProvenance(identity contract.ToolIdentitySpec, title, descript
 	if dryRun != nil {
 		out["dry_run"] = prov(*dryRun, "corecmd.ContractDecl")
 	}
+	if retryPolicy != nil {
+		out["retry_policy"] = prov(*retryPolicy, "corecmd.ContractDecl")
+	}
 	return out
 }
 
@@ -693,6 +701,9 @@ func validateFinalSchemaProvenanceCoverage(registry SchemaRegistry) error {
 			if tool.DryRun != nil {
 				require("tool "+canonical, "dry_run", tool.FieldProvenance)
 			}
+			if tool.RetryPolicy != nil {
+				require("tool "+canonical, "retry_policy", tool.FieldProvenance)
+			}
 			// interface_reason is part of the final interface contract only when
 			// the disposition requires or actually delivers a reason. An MCP or
 			// local available command with no reason has no resolver winner to

internal/cli/schema_snapshot_adapter.go

@@ -67,6 +67,7 @@ type schemaToolWire struct {
 	DryRun              *contract.DryRunSpec                `json:"dry_run"`
 	Result              *contract.ResultSpec                `json:"result"`
 	Pagination          *contract.PaginationSpec            `json:"pagination"`
+	RetryPolicy         *contract.RetryPolicySpec           `json:"retry_policy"`
 	Effect              string                              `json:"effect"`
 	EffectSource        string                              `json:"effect_source"`
 	Risk                string                              `json:"risk"`
@@ -271,6 +272,7 @@ func schemaToolSpecFromWire(wire schemaToolWire) (ToolSpec, error) {
 		DryRun:         wire.DryRun,
 		Result:         wire.Result,
 		Pagination:     wire.Pagination,
+		RetryPolicy:    wire.RetryPolicy,
 		Safety: contract.SafetySpec{
 			Effect:       wire.Effect,
 			EffectSource: wire.EffectSource,

internal/cli/schema_source_root.go

@@ -77,6 +77,7 @@ func resetDeliverySchemaCatalogState() {
 func resetSchemaDeliveryState() {
 	metaByCLIPathOnce = sync.Once{}
 	metaByCLIPath = nil
+	toolCallRetryByInterface = nil
 	runtimeDeliverySchemaMetaIndexErr = nil
 	runtimeDeliverySchemaMetaIndexLazyCount.Store(0)
 	resetDeliverySchemaCatalogState()

internal/corecmd/contract/final.go

@@ -32,6 +32,7 @@ type ContractFinalPayload struct {
 	DryRun      *DryRunSpec
 	Result      *ResultSpec
 	Pagination  *PaginationSpec
+	RetryPolicy *RetryPolicySpec
 	Interface   *InterfaceSpec
 	Selection   *SelectionSpec
 	Identity    *ToolIdentitySpec

internal/corecmd/contract/retry_policy.go

@@ -0,0 +1,93 @@
+// Copyright 2026 Alibaba Group
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package contract
+
+import (
+	"fmt"
+	"strings"
+)
+
+const RetryModeDeduplicationKey = "deduplication_key"
+
+// RetryPolicySpec declares the reviewed condition that makes an otherwise
+// non-idempotent operation safe to retry. KeyParameter names the CLI parameter;
+// Schema assembly binds it to one explicit interface property before runtime.
+// No flag-name or request-property inference is permitted.
+type RetryPolicySpec struct {
+	Mode                string `json:"mode"`
+	KeyParameter        string `json:"key_parameter"`
+	SamePayloadRequired bool   `json:"same_payload_required"`
+}
+
+// RetryDecision is the invocation-scoped safety result consumed by Agent and
+// transport code. Static metadata remains unchanged; EffectiveIdempotency is
+// derived only from the reviewed policy and the actual invocation arguments.
+type RetryDecision struct {
+	EffectiveIdempotency string `json:"effective_idempotency"`
+	SafeToRetry          bool   `json:"safe_to_retry"`
+	Reason               string `json:"reason"`
+}
+
+// NormalizeRetryPolicySpec validates and defensively copies a retry policy.
+func NormalizeRetryPolicySpec(in *RetryPolicySpec, canonical string) (*RetryPolicySpec, error) {
+	if in == nil {
+		return nil, nil
+	}
+	canonical = defaultString(strings.TrimSpace(canonical), "<unknown>")
+	out := &RetryPolicySpec{
+		Mode:                strings.TrimSpace(in.Mode),
+		KeyParameter:        strings.TrimSpace(in.KeyParameter),
+		SamePayloadRequired: in.SamePayloadRequired,
+	}
+	if out.Mode != RetryModeDeduplicationKey {
+		return nil, fmt.Errorf("schema tool %s retry_policy has unsupported mode %q", canonical, out.Mode)
+	}
+	if out.KeyParameter == "" {
+		return nil, fmt.Errorf("schema tool %s retry_policy has no key_parameter", canonical)
+	}
+	if !out.SamePayloadRequired {
+		return nil, fmt.Errorf("schema tool %s retry_policy must require the same payload", canonical)
+	}
+	return out, nil
+}
+
+// ResolveRetryDecision derives invocation safety without mutating the static
+// command contract. argumentKey is the CLI parameter name for Agent calls or
+// the explicitly declared interface property for transport calls.
+func ResolveRetryDecision(idempotency string, policy *RetryPolicySpec, arguments map[string]any, argumentKey string) RetryDecision {
+	switch strings.TrimSpace(idempotency) {
+	case "idempotent":
+		return RetryDecision{EffectiveIdempotency: "idempotent", SafeToRetry: true, Reason: "static_idempotent"}
+	case "non_idempotent":
+		return RetryDecision{EffectiveIdempotency: "non_idempotent", Reason: "static_non_idempotent"}
+	case "unknown":
+		return RetryDecision{EffectiveIdempotency: "unknown", Reason: "idempotency_unknown"}
+	case "conditional":
+		normalized, err := NormalizeRetryPolicySpec(policy, "<invocation>")
+		if err != nil || normalized == nil {
+			return RetryDecision{EffectiveIdempotency: "unknown", Reason: "invalid_retry_policy"}
+		}
+		argumentKey = strings.TrimSpace(argumentKey)
+		if argumentKey == "" {
+			return RetryDecision{EffectiveIdempotency: "unknown", Reason: "deduplication_key_binding_missing"}
+		}
+		value, ok := arguments[argumentKey].(string)
+		if !ok || strings.TrimSpace(value) == "" {
+			return RetryDecision{EffectiveIdempotency: "non_idempotent", Reason: "deduplication_key_missing"}
+		}
+		return RetryDecision{EffectiveIdempotency: "idempotent", SafeToRetry: true, Reason: "deduplication_key_present"}
+	default:
+		return RetryDecision{EffectiveIdempotency: "unknown", Reason: "idempotency_unknown"}
+	}
+}

internal/corecmd/contract/retry_policy_test.go

@@ -0,0 +1,79 @@
+// Copyright 2026 Alibaba Group
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package contract
+
+import "testing"
+
+func TestCrossPlatformCoverageNormalizeRetryPolicySpec(t *testing.T) {
+	if got, err := NormalizeRetryPolicySpec(nil, "chat.send"); err != nil || got != nil {
+		t.Fatalf("nil NormalizeRetryPolicySpec() = %#v, %v", got, err)
+	}
+	got, err := NormalizeRetryPolicySpec(&RetryPolicySpec{
+		Mode:                " deduplication_key ",
+		KeyParameter:        " uuid ",
+		SamePayloadRequired: true,
+	}, "chat.send")
+	if err != nil {
+		t.Fatalf("NormalizeRetryPolicySpec() error = %v", err)
+	}
+	if got.Mode != RetryModeDeduplicationKey || got.KeyParameter != "uuid" || !got.SamePayloadRequired {
+		t.Fatalf("NormalizeRetryPolicySpec() = %#v", got)
+	}
+	if _, err := NormalizeRetryPolicySpec(&RetryPolicySpec{Mode: RetryModeDeduplicationKey, SamePayloadRequired: true}, "chat.send"); err == nil {
+		t.Fatal("empty key_parameter must fail closed")
+	}
+	if _, err := NormalizeRetryPolicySpec(&RetryPolicySpec{Mode: RetryModeDeduplicationKey, KeyParameter: "uuid"}, "chat.send"); err == nil {
+		t.Fatal("same_payload_required=false must fail closed")
+	}
+	if _, err := NormalizeRetryPolicySpec(&RetryPolicySpec{Mode: "inferred", KeyParameter: "uuid", SamePayloadRequired: true}, "chat.send"); err == nil {
+		t.Fatal("unsupported retry mode must fail closed")
+	}
+}
+
+func TestCrossPlatformCoverageResolveRetryDecision(t *testing.T) {
+	policy := &RetryPolicySpec{Mode: RetryModeDeduplicationKey, KeyParameter: "uuid", SamePayloadRequired: true}
+	if got := ResolveRetryDecision("conditional", policy, map[string]any{"uuid": "request-1"}, "uuid"); !got.SafeToRetry || got.EffectiveIdempotency != "idempotent" {
+		t.Fatalf("conditional with key = %#v", got)
+	}
+	for name, args := range map[string]map[string]any{
+		"missing":    {},
+		"empty":      {"uuid": "  "},
+		"non-string": {"uuid": 123},
+	} {
+		t.Run(name, func(t *testing.T) {
+			got := ResolveRetryDecision("conditional", policy, args, "uuid")
+			if got.SafeToRetry || got.EffectiveIdempotency != "non_idempotent" {
+				t.Fatalf("decision = %#v", got)
+			}
+		})
+	}
+	if got := ResolveRetryDecision("idempotent", nil, nil, ""); !got.SafeToRetry || got.EffectiveIdempotency != "idempotent" {
+		t.Fatalf("static idempotent = %#v", got)
+	}
+	if got := ResolveRetryDecision("non_idempotent", nil, nil, ""); got.SafeToRetry || got.EffectiveIdempotency != "non_idempotent" {
+		t.Fatalf("static non-idempotent = %#v", got)
+	}
+	if got := ResolveRetryDecision("unknown", nil, nil, ""); got.SafeToRetry || got.EffectiveIdempotency != "unknown" {
+		t.Fatalf("unknown = %#v", got)
+	}
+	if got := ResolveRetryDecision("conditional", policy, map[string]any{"uuid": "request-1"}, ""); got.SafeToRetry || got.EffectiveIdempotency != "unknown" || got.Reason != "deduplication_key_binding_missing" {
+		t.Fatalf("missing key binding = %#v", got)
+	}
+	if got := ResolveRetryDecision("conditional", nil, nil, ""); got.SafeToRetry || got.Reason != "invalid_retry_policy" {
+		t.Fatalf("invalid conditional policy = %#v", got)
+	}
+	if got := ResolveRetryDecision("retryable", nil, nil, ""); got.SafeToRetry || got.EffectiveIdempotency != "unknown" {
+		t.Fatalf("unknown legacy value = %#v", got)
+	}
+}

internal/corecmd/contract_decl.go

@@ -44,12 +44,14 @@ type ContractDecl struct {
 	DryRun      *contract.DryRunSpec
 	Result      *contract.ResultSpec
 	Pagination  *contract.PaginationSpec
+	RetryPolicy *contract.RetryPolicySpec
 	Interface   *contract.InterfaceSpec
 	Selection   contract.SelectionSpec
 	Identity    contract.ToolIdentitySpec
 }
 
-// validateContractDecl enforces authoring-time homology for declared commands.
+// validateContractDecl enforces authoring-time homology for declared commands
+// and returns the normalized retry policy for the ContractFinal projection.
 // A declared Contract is the sole final source for its fields: downstream
 // catalog/Agent gates hard-require description and the selection prose for
 // every effective tool — so a declaration missing any of these fields could
@@ -61,9 +63,34 @@ type ContractDecl struct {
 // self-description: identity is collected from ContractFinal on the live
 // leaves, so an incomplete or inconsistent declared Identity fails collection,
 // binding, and policy downstream.
-func validateContractDecl(spec Spec) {
+func validateContractDecl(spec Spec) *contract.RetryPolicySpec {
+	idempotency := strings.TrimSpace(spec.Safety.Idempotency)
+	if idempotency == "conditional" && spec.Contract.RetryPolicy == nil {
+		panic(fmt.Sprintf("command %q Safety.Idempotency=conditional requires Contract.RetryPolicy", spec.Use))
+	}
+	if spec.Contract.RetryPolicy != nil && idempotency != "conditional" {
+		panic(fmt.Sprintf("command %q Contract.RetryPolicy requires Safety.Idempotency=conditional", spec.Use))
+	}
+	retryPolicy, err := contract.NormalizeRetryPolicySpec(spec.Contract.RetryPolicy, spec.Contract.Identity.CanonicalPath)
+	if err != nil {
+		panic(fmt.Sprintf("command %q has invalid Contract.RetryPolicy: %v", spec.Use, err))
+	}
+	if retryPolicy != nil {
+		declared := false
+		for _, parameter := range spec.Contract.Parameters {
+			if strings.TrimSpace(parameter.Name) == retryPolicy.KeyParameter && strings.TrimSpace(parameter.Property) != "" {
+				declared = true
+				break
+			}
+		}
+		if !declared {
+			panic(fmt.Sprintf(
+				"command %q Contract.RetryPolicy key_parameter %q requires Contract.Parameters with an explicit ParamDecl.Property",
+				spec.Use, retryPolicy.KeyParameter))
+		}
+	}
 	if spec.Contract.empty() {
-		return
+		return retryPolicy
 	}
 	missing := make([]string, 0, 8)
 	if strings.TrimSpace(spec.Contract.Description) == "" {
@@ -125,6 +152,7 @@ func validateContractDecl(spec Spec) {
 			"command %q Contract.Identity.CLIPath %q and PrimaryCLIPath %q must agree on the primary leaf path",
 			spec.Use, cliPath, primary))
 	}
+	return retryPolicy
 }
 
 // Empty reports whether no ContractDecl field was authored.
@@ -152,6 +180,9 @@ func (s ContractDecl) empty() bool {
 	if s.Pagination != nil {
 		return false
 	}
+	if s.RetryPolicy != nil {
+		return false
+	}
 	if s.Interface != nil {
 		iface := s.Interface
 		if strings.TrimSpace(iface.Mode) != "" || strings.TrimSpace(iface.Availability) != "" ||

internal/corecmd/contract_decl_test.go

@@ -14,6 +14,7 @@
 package corecmd
 
 import (
+	"fmt"
 	"strings"
 	"testing"
 
@@ -21,6 +22,43 @@ import (
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/corecmd/contractfinal"
 )
 
+func TestCrossPlatformCoverageContractRetryPolicyFailsFast(t *testing.T) {
+	if (ContractDecl{RetryPolicy: &contract.RetryPolicySpec{}}).Empty() {
+		t.Fatal("RetryPolicy-only ContractDecl must not be empty")
+	}
+	assertPanic := func(name, want string, spec Spec) {
+		t.Helper()
+		t.Run(name, func(t *testing.T) {
+			defer func() {
+				recovered := recover()
+				if recovered == nil || !strings.Contains(fmt.Sprint(recovered), want) {
+					t.Fatalf("panic = %v, want %q", recovered, want)
+				}
+			}()
+			validateContractDecl(spec)
+		})
+	}
+	assertPanic("conditional without contract", "requires Contract.RetryPolicy", Spec{
+		Use: "send", Safety: contract.SafetySpec{Idempotency: "conditional"},
+	})
+	minimal := ContractDecl{Description: "description"}
+	assertPanic("conditional without policy", "requires Contract.RetryPolicy", Spec{
+		Use: "send", Safety: contract.SafetySpec{Idempotency: "conditional"}, Contract: minimal,
+	})
+	minimal.RetryPolicy = &contract.RetryPolicySpec{Mode: contract.RetryModeDeduplicationKey, KeyParameter: "uuid", SamePayloadRequired: true}
+	assertPanic("policy without explicit ParamDecl property", "requires Contract.Parameters with an explicit ParamDecl.Property", Spec{
+		Use: "send", Safety: contract.SafetySpec{Idempotency: "conditional"}, Contract: minimal,
+	})
+	minimal.Parameters = []contract.ParamDecl{{Name: "uuid", Property: "requestUuid"}}
+	assertPanic("policy without conditional", "requires Safety.Idempotency=conditional", Spec{
+		Use: "send", Safety: contract.SafetySpec{Idempotency: "unknown"}, Contract: minimal,
+	})
+	minimal.RetryPolicy.SamePayloadRequired = false
+	assertPanic("invalid policy", "invalid Contract.RetryPolicy", Spec{
+		Use: "send", Safety: contract.SafetySpec{Idempotency: "conditional"}, Contract: minimal,
+	})
+}
+
 func TestCrossPlatformCoverageNewCommandEmbedsFullContractDeclAsFinalSource(t *testing.T) {
 	cmd := New(Spec{
 		Use:   "create",
@@ -35,11 +73,12 @@ func TestCrossPlatformCoverageNewCommandEmbedsFullContractDeclAsFinalSource(t *t
 		},
 		Safety: contract.SafetySpec{
 			Effect: "write", Risk: "medium",
-			Confirmation: "user_required", Idempotency: "retryable",
+			Confirmation: "user_required", Idempotency: "conditional",
 		},
 		Contract: ContractDecl{
 			Title:       "Create Title",
 			Description: "Create Desc",
+			Parameters:  []contract.ParamDecl{{Name: "mode", Property: "mode"}},
 			Positionals: []contract.RuntimeSchemaPositional{{Name: "id", Required: true, Index: 0}},
 			DryRun:      &contract.DryRunSpec{PreviewKind: "invocation", RemoteReads: true},
 			Result: &contract.ResultSpec{
@@ -47,6 +86,11 @@ func TestCrossPlatformCoverageNewCommandEmbedsFullContractDeclAsFinalSource(t *t
 				DataSchema: []byte(`{"type":"object"}`),
 			},
 			Pagination: &contract.PaginationSpec{Kind: contract.PaginationKindCursor, CursorParameter: "cursor"},
+			RetryPolicy: &contract.RetryPolicySpec{
+				Mode:                contract.RetryModeDeduplicationKey,
+				KeyParameter:        "mode",
+				SamePayloadRequired: true,
+			},
 			Interface: &contract.InterfaceSpec{
 				Mode:         "mcp",
 				Availability: "available",
@@ -78,7 +122,7 @@ func TestCrossPlatformCoverageNewCommandEmbedsFullContractDeclAsFinalSource(t *t
 	if final.Title != "Create Title" || final.Description != "Create Desc" {
 		t.Fatalf("title/desc = %q %q (payload stores declared Contract text; Catalog may prefer Cobra Long)", final.Title, final.Description)
 	}
-	if final.Safety == nil || final.Safety.Confirmation != "user_required" || final.Safety.Idempotency != "retryable" {
+	if final.Safety == nil || final.Safety.Confirmation != "user_required" || final.Safety.Idempotency != "conditional" {
 		t.Fatalf("safety = %#v", final.Safety)
 	}
 	if final.DryRun == nil || final.DryRun.PreviewKind != "invocation" || !final.DryRun.RemoteReads {
@@ -90,6 +134,14 @@ func TestCrossPlatformCoverageNewCommandEmbedsFullContractDeclAsFinalSource(t *t
 	if final.Pagination == nil || final.Pagination.CursorParameter != "cursor" || final.Pagination.MetaPath != contract.PaginationMetaPath {
 		t.Fatalf("pagination = %#v", final.Pagination)
 	}
+	if final.RetryPolicy == nil || final.RetryPolicy.KeyParameter != "mode" || !final.RetryPolicy.SamePayloadRequired {
+		t.Fatalf("retry_policy = %#v", final.RetryPolicy)
+	}
+	final.RetryPolicy.KeyParameter = "mutated"
+	again, ok := contractfinal.RuntimeContractFinal(cmd)
+	if !ok || again.RetryPolicy == nil || again.RetryPolicy.KeyParameter != "mode" {
+		t.Fatalf("stored retry_policy was not defensively copied: %#v", again.RetryPolicy)
+	}
 	if final.Interface == nil || final.Interface.Mode != "mcp" || final.Interface.Ref == nil || final.Interface.Ref.RPCName != "create_thing" {
 		t.Fatalf("interface = %#v", final.Interface)
 	}

internal/corecmd/contractfinal/store.go

@@ -85,6 +85,10 @@ func cloneContractFinalPayload(in contract.ContractFinalPayload) contract.Contra
 		value := *in.Pagination
 		out.Pagination = &value
 	}
+	if in.RetryPolicy != nil {
+		value := *in.RetryPolicy
+		out.RetryPolicy = &value
+	}
 	if in.Interface != nil {
 		value := *in.Interface
 		if in.Interface.Ref != nil {

internal/corecmd/corecmd.go

@@ -578,7 +578,18 @@ func RegisterFlags(cmd *cobra.Command, flags []FlagSpec) {
 		for _, alias := range flag.Aliases {
 			RegisterFlag(cmd, flag.Kind, alias, "", flag.Usage+" (alias)")
 			_ = cmd.Flags().MarkHidden(alias)
-			AnnotateFlagAlias(cmd, alias, flag.Name)
+			if registered := cmd.Flags().Lookup(alias); registered != nil {
+				runtimeannotate.SetFlagAnnotation(
+					registered,
+					runtimeannotate.AnnotationFlagAliasOf,
+					flag.Name,
+				)
+				runtimeannotate.SetFlagAnnotation(
+					registered,
+					runtimeannotate.AnnotationFlagAliasOrigin,
+					runtimeannotate.FlagAliasOriginCorecmdV1,
+				)
+			}
 		}
 		if flag.MarkRequired {
 			_ = cmd.MarkFlagRequired(flag.Name)
@@ -589,30 +600,6 @@ func RegisterFlags(cmd *cobra.Command, flags []FlagSpec) {
 	}
 }
 
-// AnnotateFlagAlias records framework-owned evidence that aliasName is a hidden
-// compatibility alias for canonicalName. It is for commands that already own
-// their Cobra flag registration outside FlagSpec but still need the same
-// interface-snapshot alias contract as FlagSpec.Aliases.
-func AnnotateFlagAlias(cmd *cobra.Command, aliasName, canonicalName string) {
-	if cmd == nil {
-		return
-	}
-	registered := cmd.Flags().Lookup(aliasName)
-	if registered == nil {
-		return
-	}
-	runtimeannotate.SetFlagAnnotation(
-		registered,
-		runtimeannotate.AnnotationFlagAliasOf,
-		canonicalName,
-	)
-	runtimeannotate.SetFlagAnnotation(
-		registered,
-		runtimeannotate.AnnotationFlagAliasOrigin,
-		runtimeannotate.FlagAliasOriginCorecmdV1,
-	)
-}
-
 // RegisterFlag registers one flag by Kind. Default is applied at registration
 // for every kind so --help DefValue matches the declared fallback.
 // Malformed KindInt / KindBool Default values panic at registration (fail-closed)
@@ -1377,7 +1364,7 @@ func AttachContract(cmd *cobra.Command, safety contract.SafetySpec, decl Contrac
 	_, _ = short, long
 	// Reuse NewCommand's completeness rules so bind-time attaches cannot ship
 	// a partial declaration that would only fail in generated artifacts.
-	validateContractDecl(Spec{Use: cmd.Name(), Safety: safety, Contract: decl})
+	retryPolicy := validateContractDecl(Spec{Use: cmd.Name(), Safety: safety, Contract: decl})
 	validateSafetySpec(Spec{Use: cmd.Name(), Safety: safety})
 
 	payload := contract.ContractFinalPayload{
@@ -1407,6 +1394,9 @@ func AttachContract(cmd *cobra.Command, safety contract.SafetySpec, decl Contrac
 		}
 		payload.Pagination = pagination
 	}
+	if retryPolicy != nil {
+		payload.RetryPolicy = retryPolicy
+	}
 	if decl.Interface != nil {
 		iface := &contract.InterfaceSpec{
 			Mode:         strings.TrimSpace(decl.Interface.Mode),

internal/corecmd/corecmd_test.go

@@ -116,16 +116,6 @@ func TestCrossPlatformCoverageRegisterFlagsAllKinds(t *testing.T) {
 	}
 }
 
-func TestCrossPlatformCoverageAnnotateFlagAliasIgnoresMissingInputs(t *testing.T) {
-	AnnotateFlagAlias(nil, "alias", "canonical")
-
-	cmd := newTestCommand()
-	AnnotateFlagAlias(cmd, "missing", "canonical")
-	if flag := cmd.Flags().Lookup("missing"); flag != nil {
-		t.Fatalf("unexpected missing flag registered: %#v", flag)
-	}
-}
-
 // ── effective value fallback chain ─────────────────────────────────
 
 func TestCrossPlatformCoverageEffectiveValueFallbackChain(t *testing.T) {

internal/errors/errors_test.go

@@ -15,13 +15,9 @@ package errors
 
 import (
 	stderrors "errors"
-	"os"
-	"path/filepath"
 	"strings"
 	"testing"
 	"time"
-
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/config"
 )
 
 func TestCrossPlatformCoverageExitCodeByCategory(t *testing.T) {
@@ -386,27 +382,6 @@ func TestCrossPlatformCoverageServerGuidanceSuppressesUnsafeActionURL(t *testing
 	}
 }
 
-func TestCrossPlatformCoveragePrintJSONCLIOrgNotAuthorizedUsesInternationalActionURL(t *testing.T) {
-	dir := t.TempDir()
-	t.Setenv("DWS_CONFIG_DIR", dir)
-	if err := os.WriteFile(filepath.Join(dir, "mcp_url"), []byte("https://mcp.dingtalk.io\n"), config.FilePerm); err != nil {
-		t.Fatalf("WriteFile(mcp_url) error = %v", err)
-	}
-
-	var b strings.Builder
-	if err := PrintJSON(&b, NewAPI(
-		"business error",
-		WithServerDiag(ServerDiagnostics{ServerErrorCode: "CLI_ORG_NOT_AUTHORIZED"}),
-	)); err != nil {
-		t.Fatalf("PrintJSON() error = %v", err)
-	}
-
-	want := `"action_url": "https://open-dev.dingtalk.io/fe/old#/developerSettings"`
-	if got := b.String(); !strings.Contains(got, want) {
-		t.Fatalf("expected international action_url %q, got %q", want, got)
-	}
-}
-
 func TestCrossPlatformCoveragePrintJSONIncludesRPCCodeAndData(t *testing.T) {
 	t.Parallel()
 

internal/executor/invocation.go

@@ -19,19 +19,21 @@ import (
 	"fmt"
 	"strings"
 
+	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/corecmd/contract"
 	apperrors "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/errors"
 )
 
 type Invocation struct {
-	Kind             string         `json:"kind"`
-	Stage            string         `json:"stage"`
-	Implemented      bool           `json:"implemented"`
-	DryRun           bool           `json:"dry_run,omitempty"`
-	CanonicalProduct string         `json:"canonical_product"`
-	Tool             string         `json:"tool"`
-	CanonicalPath    string         `json:"canonical_path"`
-	LegacyPath       string         `json:"legacy_path,omitempty"`
-	Params           map[string]any `json:"params"`
+	Kind             string                  `json:"kind"`
+	Stage            string                  `json:"stage"`
+	Implemented      bool                    `json:"implemented"`
+	DryRun           bool                    `json:"dry_run,omitempty"`
+	CanonicalProduct string                  `json:"canonical_product"`
+	Tool             string                  `json:"tool"`
+	CanonicalPath    string                  `json:"canonical_path"`
+	LegacyPath       string                  `json:"legacy_path,omitempty"`
+	Params           map[string]any          `json:"params"`
+	Retry            *contract.RetryDecision `json:"retry,omitempty"`
 }
 
 type Result struct {
@@ -47,13 +49,17 @@ type EchoRunner struct{}
 
 func (EchoRunner) Run(_ context.Context, invocation Invocation) (Result, error) {
 	if invocation.DryRun {
+		response := map[string]any{
+			"dry_run": true,
+			"request": ToolCallRequest(invocation.Tool, invocation.Params),
+			"note":    "execution skipped by --dry-run",
+		}
+		if invocation.Retry != nil {
+			response["retry"] = invocation.Retry
+		}
 		return Result{
 			Invocation: invocation,
-			Response: map[string]any{
-				"dry_run": true,
-				"request": ToolCallRequest(invocation.Tool, invocation.Params),
-				"note":    "execution skipped by --dry-run",
-			},
+			Response:   response,
 		}, nil
 	}
 	return Result{Invocation: invocation}, nil

internal/executor/invocation_test.go

@@ -4,19 +4,21 @@ import (
 	"context"
 	"reflect"
 	"testing"
+
+	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/corecmd/contract"
 )
 
 func TestCrossPlatformCoverageInvocationBuildersAndEchoRunner(t *testing.T) {
 	params := map[string]any{"name": "value"}
 	compat := NewCompatibilityInvocation("old path", "doc", "read", params)
-	if compat.Kind != "compat_invocation" || compat.CanonicalPath != "doc.read" || !reflect.DeepEqual(compat.Params, params) {
+	if compat.Kind != "compat_invocation" || compat.CanonicalPath != "doc.read" || compat.Retry != nil || !reflect.DeepEqual(compat.Params, params) {
 		t.Fatalf("unexpected compatibility invocation: %#v", compat)
 	}
 	if got := NewCompatibilityInvocation("old", "doc", "read", nil).Params; got == nil {
 		t.Fatal("nil compatibility params were not normalized")
 	}
 	help := NewHelperInvocation("old path", "chat", "send", params)
-	if help.Kind != "helper_invocation" || help.Stage != "helper_override" {
+	if help.Kind != "helper_invocation" || help.Stage != "helper_override" || help.Retry != nil {
 		t.Fatalf("unexpected helper invocation: %#v", help)
 	}
 	if got := NewHelperInvocation("old", "chat", "send", nil).Params; got == nil {
@@ -29,8 +31,10 @@ func TestCrossPlatformCoverageInvocationBuildersAndEchoRunner(t *testing.T) {
 		t.Fatalf("EchoRunner normal result = %#v, %v", result, err)
 	}
 	compat.DryRun = true
+	retry := contract.RetryDecision{EffectiveIdempotency: "idempotent", SafeToRetry: true, Reason: "static_idempotent"}
+	compat.Retry = &retry
 	result, err = runner.Run(context.Background(), compat)
-	if err != nil || result.Response["dry_run"] != true {
+	if err != nil || result.Response["dry_run"] != true || result.Response["retry"] != &retry {
 		t.Fatalf("EchoRunner dry-run result = %#v, %v", result, err)
 	}
 }

internal/helpers/chat_command_edges_test.go

@@ -3,7 +3,6 @@ package helpers
 import (
 	"context"
 	"errors"
-	"fmt"
 	"io"
 	"os"
 	"path/filepath"
@@ -12,7 +11,6 @@ import (
 	"testing"
 
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/edition"
-	"github.com/spf13/cobra"
 )
 
 func runChatCoverageCommand(t *testing.T, caller edition.ToolCaller, args ...string) error {
@@ -34,26 +32,14 @@ func runChatCoverageCommand(t *testing.T, caller edition.ToolCaller, args ...str
 
 func runChatCoverageDirect(t *testing.T, path []string, flags map[string]string) error {
 	t.Helper()
-	InitDeps(&scriptedToolCaller{})
-	deps.Out.w = io.Discard
-	deps.Out.errW = io.Discard
-	root := newChatCommand()
-	installExampleGlobalFlags(root)
-	root.PersistentFlags().Bool("debug", false, "")
-	root.PersistentFlags().Bool("verbose", false, "")
-	command, _, err := root.Find(path)
+	command, _, err := newChatCommand().Find(path)
 	if err != nil {
 		return err
 	}
 	for name, value := range flags {
-		flag := command.Flag(name)
-		if flag == nil {
-			return fmt.Errorf("no such flag -%s", name)
-		}
-		if err := flag.Value.Set(value); err != nil {
+		if err := command.Flags().Set(name, value); err != nil {
 			return err
 		}
-		flag.Changed = true
 	}
 	return command.RunE(command, nil)
 }
@@ -107,7 +93,7 @@ func TestCrossPlatformCoverageChatStableCompatibilityHintsRemainAvailable(t *tes
 		hint string
 	}{
 		{path: "send", args: []string{"send", "--group", "cid-stable", "--text", "hello"}, hint: "dws chat message send"},
-		{path: "history", args: []string{"history", "--group", "cid-stable", "--limit", "20"}, hint: "dws chat message list --conversation-id <GROUP_OPEN_CONVERSATION_ID>"},
+		{path: "history", args: []string{"history", "--group", "cid-stable", "--limit", "20"}, hint: "dws chat message list --group <GROUP_OPEN_CONVERSATION_ID>"},
 	} {
 		command, remaining, err := root.Find([]string{tc.path})
 		if err != nil {
@@ -127,80 +113,6 @@ func TestCrossPlatformCoverageChatStableCompatibilityHintsRemainAvailable(t *tes
 	}
 }
 
-func TestCrossPlatformCoverageChatAliasInstallerRemainingEdges(t *testing.T) {
-	restoreChatManifestExternalVisibleFlags(nil)
-
-	mismatchedRoot := &cobra.Command{Use: "chat"}
-	mismatchedRoot.AddCommand(&cobra.Command{Use: "other"})
-	restoreChatManifestExternalVisibleFlags(mismatchedRoot)
-
-	missingPrimary := &cobra.Command{Use: "leaf"}
-	installChatFlagAliases(missingPrimary, "conversation-id", []string{"group"}, requireChatConversationID)
-	if flag := missingPrimary.Flags().Lookup("group"); flag != nil {
-		t.Fatalf("alias registered without canonical flag: %#v", flag)
-	}
-
-	skipGroup := &cobra.Command{Use: "leaf", RunE: func(cmd *cobra.Command, args []string) error { return nil }}
-	skipGroup.Flags().String("conversation-id", "", "")
-	skipGroup.Flags().String("group-name", "", "")
-	installChatFlagAliases(skipGroup, "conversation-id", []string{"group", "chat"}, requireChatConversationID)
-	if flag := skipGroup.Flags().Lookup("group"); flag != nil {
-		t.Fatalf("group alias registered beside group-name: %#v", flag)
-	}
-	if flag := skipGroup.Flags().Lookup("chat"); flag == nil {
-		t.Fatal("non-group alias was not registered")
-	}
-
-	preRunCalled := false
-	withPreRun := &cobra.Command{
-		Use: "leaf",
-		PreRunE: func(cmd *cobra.Command, args []string) error {
-			preRunCalled = true
-			return nil
-		},
-		RunE: func(cmd *cobra.Command, args []string) error { return nil },
-	}
-	withPreRun.Flags().String("conversation-id", "", "")
-	installChatFlagAliases(withPreRun, "conversation-id", []string{"group"}, requireChatConversationID)
-	withPreRun.SetArgs([]string{"--group", "cid"})
-	if err := withPreRun.ExecuteContext(context.Background()); err != nil {
-		t.Fatalf("execute with alias and previous PreRunE: %v", err)
-	}
-	if !preRunCalled {
-		t.Fatal("previous PreRunE was not called")
-	}
-}
-
-func TestCrossPlatformCoverageChatMessageForwardRequiresMessageID(t *testing.T) {
-	caller := &productExampleCaller{}
-	InitDeps(caller)
-	deps.Out.w = io.Discard
-	deps.Out.errW = io.Discard
-	root := newChatCommand()
-	command, _, err := root.Find([]string{"message", "forward"})
-	if err != nil {
-		t.Fatal(err)
-	}
-	for _, name := range []string{"message-id", "msg-id"} {
-		if flag := command.Flags().Lookup(name); flag != nil && flag.Annotations != nil {
-			delete(flag.Annotations, cobra.BashCompOneRequiredFlag)
-		}
-	}
-	if err := command.Flags().Set("src-conversation-id", "src"); err != nil {
-		t.Fatal(err)
-	}
-	if err := command.Flags().Set("dest-conversation-id", "dest"); err != nil {
-		t.Fatal(err)
-	}
-	err = command.RunE(command, nil)
-	if err == nil || !strings.Contains(err.Error(), "missing required flag: --message-id") {
-		t.Fatalf("forward missing message id error = %v", err)
-	}
-	if caller.calls != 0 {
-		t.Fatalf("tool calls = %d, want 0", caller.calls)
-	}
-}
-
 func TestCrossPlatformCoverageChatGroupUpdateIconAcceptsUploadedMediaIDPrefixes(t *testing.T) {
 	previousDeps, previousArgs := deps, os.Args
 	os.Args = []string{"dws", "chat"}
@@ -248,9 +160,6 @@ func TestCrossPlatformCoverageChatCommandValidationAndSuccessEdges(t *testing.T)
 	os.Args = []string{"dws", "chat"}
 	t.Cleanup(func() { deps, os.Args = previousDeps, previousArgs })
 	caller := &productExampleCaller{}
-	if got := formatChatMessageListAllTime(0); got == "" {
-		t.Fatal("formatChatMessageListAllTime returned empty string")
-	}
 
 	commands := [][]string{
 		{"chmod", "chat.read", "--ttl="},
@@ -259,17 +168,9 @@ func TestCrossPlatformCoverageChatCommandValidationAndSuccessEdges(t *testing.T)
 		{"message", "list", "--user=D-user", "--time=2026-01-01", "--limit=1"},
 		{"message", "list", "--open-dingtalk-id=D-user", "--time=2026-01-01", "--direction=sideways"},
 		{"message", "list-direct", "--user=D-user", "--limit=1"},
-		{"message", "list-all"},
-		{"message", "list-all", "--end=2026-01-02T00:00:00Z"},
-		{"message", "list-all", "--end=bad"},
-		{"message", "list-all", "--start=not-a-time", "--end=2026-01-02T00:00:00Z"},
-		{"message", "list-all", "--start=2026-01-01 00:00:00", "--end=bad"},
-		{"message", "list-all", "--start=2026-01-02 00:00:00", "--end=2026-01-01 00:00:00"},
-		{"message", "list-all", "--start=2027-01-01 00:00:00"},
 		{"message", "list-by-sender", "--sender-user-id=u1", "--start=bad"},
 		{"message", "list-by-sender", "--sender-user-id=u1", "--start=2026-01-01T00:00:00Z", "--end=bad"},
 		{"message", "list-by-sender", "--sender-user-id=u1", "--start=2026-01-02T00:00:00Z", "--end=2026-01-01T00:00:00Z"},
-		{"message", "list-by-sender", "--sender-user-id=u1", "--end=2026-01-02T00:00:00Z"},
 		{"message", "list-by-sender", "--sender-user-id=u1", "--start=2026-01-01T00:00:00Z", "--end=2026-01-02T00:00:00Z"},
 		{"message", "list-by-sender", "--sender-open-dingtalk-id=D1", "--start=2026-01-01T00:00:00Z"},
 		{"message", "list-mentions", "--start=bad", "--end=2026-01-02T00:00:00Z"},
@@ -287,10 +188,9 @@ func TestCrossPlatformCoverageChatCommandValidationAndSuccessEdges(t *testing.T)
 		{"category", "remove-conv", "--group=cid", "--category-ids=1,2"},
 		{"message", "list-by-ids", "--msg-ids=" + strings.Repeat("id,", 51) + "last"},
 		{"group", "transfer-owner", "--group=cid", "--new-owner=D-owner"},
-		{"group", "transfer-owner", "--group=cid", "--new-owner=DAAAAAAAAAAAiE"},
 		{"group", "update-icon", "--group=cid", "--icon-media-id=@valid"},
 		{"group", "set-history", "--group=cid", "--option=ALL"},
-		{"group", "audit-join-validation", "--conversation-id=cid", "--record-id=1", "--applicant=D1", "--inviter=D2", "--status=AuditApprove", "--description=ok"},
+		{"group", "audit-join-validation", "--group=cid", "--record-id=1", "--applicant=D1", "--inviter=D2", "--status=AuditApprove", "--description=ok"},
 		{"mark-read", "--conversation-id=cid", "--message-id=mid"},
 		{"text", "translate", "--query=hello", "--to=zh_CN"},
 		{"group-role", "set-user", "--group=cid", "--user=D1", "--role-ids=r1"},
@@ -382,7 +282,7 @@ func TestCrossPlatformCoverageChatNativeSendCardMentions(t *testing.T) {
 		caller := &scriptedToolCaller{}
 		err := runChatCoverageCommand(t, caller,
 			"message", "send-card",
-			"--conversation-id=cid",
+			"--group=cid",
 			"--at-open-dingtalk-ids=D1,D2,D1",
 			"--at-all",
 		)
@@ -403,13 +303,13 @@ func TestCrossPlatformCoverageChatNativeSendCardMentions(t *testing.T) {
 		name string
 		args []string
 	}{
-		{name: "member mention rejects direct message", args: []string{"--open-dingtalk-id=D1", "--at-open-dingtalk-ids=D2"}},
-		{name: "at all rejects direct message", args: []string{"--open-dingtalk-id=D1", "--at-all"}},
+		{name: "member mention rejects direct message", args: []string{"--receiver=D1", "--at-open-dingtalk-ids=D2"}},
+		{name: "at all rejects direct message", args: []string{"--receiver=D1", "--at-all"}},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			caller := &scriptedToolCaller{}
 			err := runChatCoverageCommand(t, caller, append([]string{"message", "send-card"}, tc.args...)...)
-			if err == nil || !strings.Contains(err.Error(), "only supported with --conversation-id") {
+			if err == nil || !strings.Contains(err.Error(), "only supported with --group") {
 				t.Fatalf("error = %v, want group-only mention validation", err)
 			}
 			if caller.calls != 0 {
@@ -419,168 +319,6 @@ func TestCrossPlatformCoverageChatNativeSendCardMentions(t *testing.T) {
 	}
 }
 
-func TestCrossPlatformCoverageChatSendCardHiddenAliasesMapToCanonicalPayload(t *testing.T) {
-	previousDeps, previousArgs := deps, os.Args
-	os.Args = []string{"dws", "chat"}
-	t.Cleanup(func() { deps, os.Args = previousDeps, previousArgs })
-
-	for _, tc := range []struct {
-		name string
-		args []string
-		want map[string]any
-	}{
-		{
-			name: "group alias",
-			args: []string{"--group=cid"},
-			want: map[string]any{"openConversationId": "cid"},
-		},
-		{
-			name: "receiver alias",
-			args: []string{"--receiver=DAAAAAAAAAAAiE"},
-			want: map[string]any{"receiverOpenDingTalkId": "DAAAAAAAAAAAiE"},
-		},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			caller := &scriptedToolCaller{}
-			err := runChatCoverageCommand(t, caller, append([]string{"message", "send-card"}, tc.args...)...)
-			if err != nil {
-				t.Fatal(err)
-			}
-			if caller.calls != 1 || caller.server != "im" || caller.tool != "create_and_send_card" || !reflect.DeepEqual(caller.args, tc.want) {
-				t.Fatalf("call = count:%d server:%q tool:%q args:%#v, want %#v", caller.calls, caller.server, caller.tool, caller.args, tc.want)
-			}
-		})
-	}
-}
-
-func TestCrossPlatformCoverageChatGroupAuditJoinValidationUsesCanonicalAndAliasPayload(t *testing.T) {
-	previousDeps, previousArgs := deps, os.Args
-	os.Args = []string{"dws", "chat"}
-	t.Cleanup(func() { deps, os.Args = previousDeps, previousArgs })
-
-	for _, tc := range []struct {
-		name string
-		flag string
-	}{
-		{name: "canonical conversation-id", flag: "--conversation-id=cid"},
-		{name: "hidden group alias", flag: "--group=cid"},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			caller := &scriptedToolCaller{}
-			err := runChatCoverageCommand(t, caller,
-				"group", "audit-join-validation",
-				tc.flag,
-				"--record-id=123",
-				"--applicant=D-applicant",
-				"--inviter=D-inviter",
-				"--status=AuditDelete",
-				"--description=deny",
-			)
-			if err != nil {
-				t.Fatal(err)
-			}
-			want := map[string]any{
-				"openConversationId": "cid",
-				"applyRecordId":      int64(123),
-				"applicantUid":       "D-applicant",
-				"inviterUid":         "D-inviter",
-				"status":             "AuditDelete",
-				"auditDescription":   "deny",
-			}
-			if caller.calls != 1 || caller.server != "im" || caller.tool != "audit_join_group" || !reflect.DeepEqual(caller.args, want) {
-				t.Fatalf("call = count:%d server:%q tool:%q args:%#v, want %#v", caller.calls, caller.server, caller.tool, caller.args, want)
-			}
-		})
-	}
-}
-
-func TestCrossPlatformCoverageChatIMIDMigrationRequiredFlagErrors(t *testing.T) {
-	previousDeps, previousArgs := deps, os.Args
-	os.Args = []string{"dws", "chat"}
-	t.Cleanup(func() { deps, os.Args = previousDeps, previousArgs })
-
-	tests := []struct {
-		name string
-		path []string
-		flag map[string]string
-		want string
-	}{
-		{name: "message list mutually exclusive targets", path: []string{"message", "list"}, flag: map[string]string{"conversation-id": "cid", "user": "u1", "time": "2026-01-01"}, want: "mutually exclusive"},
-		{name: "message list missing target", path: []string{"message", "list"}, flag: map[string]string{"time": "2026-01-01"}, want: "--conversation-id, --user or --open-dingtalk-id is required"},
-		{name: "topic replies missing conversation", path: []string{"message", "list-topic-replies"}, flag: map[string]string{"topic-id": "t1"}, want: "conversation-id"},
-		{name: "read status missing conversation", path: []string{"message", "read-status"}, flag: map[string]string{"message-id": "m1"}, want: "conversation-id"},
-		{name: "read status conflicting aliases", path: []string{"message", "read-status"}, flag: map[string]string{"conversation-id": "cid1", "group": "cid2", "message-id": "m1"}, want: "conflicts"},
-		{name: "read status missing message", path: []string{"message", "read-status"}, flag: map[string]string{"conversation-id": "cid"}, want: "message-id"},
-		{name: "update text emotion missing message", path: []string{"message", "update-text-emotion"}, flag: map[string]string{"conversation-id": "cid", "old-emotion-id": "e1", "emotion-id": "e2", "emotion-name": "n", "text": "t", "background-id": "b"}, want: "message-id"},
-		{name: "update text emotion missing detail flag", path: []string{"message", "update-text-emotion"}, flag: map[string]string{"conversation-id": "cid", "message-id": "m1", "old-emotion-id": "e1", "emotion-id": "e2", "emotion-name": "n", "text": "t"}, want: "background-id"},
-		{name: "transfer owner missing conversation", path: []string{"group", "transfer-owner"}, flag: map[string]string{"new-owner": "D1"}, want: "conversation-id"},
-		{name: "invite url missing conversation", path: []string{"group", "invite-url"}, want: "conversation-id"},
-		{name: "quit missing conversation", path: []string{"group", "quit"}, want: "conversation-id"},
-		{name: "update icon missing conversation", path: []string{"group", "update-icon"}, flag: map[string]string{"icon-media-id": "@media"}, want: "conversation-id"},
-		{name: "update settings missing conversation", path: []string{"group", "update-settings"}, flag: map[string]string{"setting-key": "searchable"}, want: "conversation-id"},
-		{name: "set admin missing conversation", path: []string{"group", "set-admin"}, flag: map[string]string{"users": "D1"}, want: "conversation-id"},
-		{name: "role list missing conversation", path: []string{"group-role", "list"}, want: "group"},
-		{name: "role add missing conversation", path: []string{"group-role", "add"}, flag: map[string]string{"name": "role"}, want: "conversation-id"},
-		{name: "role update missing conversation", path: []string{"group-role", "update"}, flag: map[string]string{"role-id": "r1", "name": "role"}, want: "conversation-id"},
-		{name: "role remove missing conversation", path: []string{"group-role", "remove"}, flag: map[string]string{"role-id": "r1"}, want: "conversation-id"},
-		{name: "role set user missing conversation", path: []string{"group-role", "set-user"}, flag: map[string]string{"user": "D1", "role-ids": "r1"}, want: "conversation-id"},
-		{name: "role remove user missing conversation", path: []string{"group-role", "remove-user"}, flag: map[string]string{"user": "D1", "role-ids": "r1"}, want: "conversation-id"},
-		{name: "role query user missing conversation", path: []string{"group-role", "query-user"}, flag: map[string]string{"user": "D1"}, want: "conversation-id"},
-		{name: "bots missing legacy group", path: []string{"group", "bots"}, want: "group"},
-		{name: "bots rejects migrated conversation id", path: []string{"group", "bots"}, flag: map[string]string{"conversation-id": "cid"}, want: "no such flag"},
-		{name: "dismiss missing conversation", path: []string{"group", "dismiss"}, flag: map[string]string{"yes": "true"}, want: "conversation-id"},
-		{name: "set history missing conversation", path: []string{"group", "set-history"}, flag: map[string]string{"option": "ALL"}, want: "conversation-id"},
-		{name: "set pin missing message", path: []string{"message", "set-pin-msg"}, flag: map[string]string{"open-conversation-id": "cid"}, want: "message-id"},
-		{name: "unset pin missing message", path: []string{"message", "unset-pin-msg"}, flag: map[string]string{"open-conversation-id": "cid"}, want: "message-id"},
-		{name: "audit join missing conversation", path: []string{"group", "audit-join-validation"}, flag: map[string]string{"record-id": "1", "applicant": "D1", "inviter": "D2", "status": "AuditApprove"}, want: "conversation-id"},
-		{name: "set top missing message", path: []string{"message", "set-top-msg"}, flag: map[string]string{"open-conversation-id": "cid"}, want: "message-id"},
-		{name: "unset top missing message", path: []string{"message", "unset-top-msg"}, flag: map[string]string{"open-conversation-id": "cid"}, want: "message-id"},
-		{name: "update alias missing conversation", path: []string{"group", "update-alias"}, flag: map[string]string{"alias-title": "alias"}, want: "conversation-id"},
-		{name: "notice create missing conversation", path: []string{"group", "notice", "create"}, flag: map[string]string{"content": "hello"}, want: "conversation-id"},
-		{name: "notice edit missing conversation", path: []string{"group", "notice", "edit"}, flag: map[string]string{"notice-id": "n1", "content": "hello"}, want: "conversation-id"},
-		{name: "notice get missing conversation", path: []string{"group", "notice", "get"}, flag: map[string]string{"notice-id": "n1"}, want: "conversation-id"},
-		{name: "notice list missing conversation", path: []string{"group", "notice", "list"}, want: "conversation-id"},
-	}
-
-	probe := newChatCommand()
-	messageList, _, err := probe.Find([]string{"message", "list"})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if got, err := chatConversationID(messageList); err != nil || got != "" {
-		t.Fatalf("empty chatConversationID = %q, %v", got, err)
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			err := runChatCoverageDirect(t, tc.path, tc.flag)
-			if err == nil || !strings.Contains(err.Error(), tc.want) {
-				t.Fatalf("error = %v, want containing %q", err, tc.want)
-			}
-		})
-	}
-}
-
-func TestCrossPlatformCoverageChatMessageReadStatusConversationAliasesExecute(t *testing.T) {
-	for _, alias := range []string{"group", "id", "chat", "open-conversation-id"} {
-		t.Run(alias, func(t *testing.T) {
-			caller := &scriptedToolCaller{}
-			if err := runChatCoverageCommand(t, caller, "message", "read-status", "--"+alias, "cid-1", "--message-id", "msg-1"); err != nil {
-				t.Fatal(err)
-			}
-			if caller.server != "im" || caller.tool != "query_msg_read_status" {
-				t.Fatalf("call = %s/%s, want im/query_msg_read_status", caller.server, caller.tool)
-			}
-			if got := caller.args["openConversationId"]; got != "cid-1" {
-				t.Fatalf("openConversationId = %#v, want cid-1", got)
-			}
-			if got := caller.args["openMessageId"]; got != "msg-1" {
-				t.Fatalf("openMessageId = %#v, want msg-1", got)
-			}
-		})
-	}
-}
-
 func TestCrossPlatformCoverageChatWebhookReplyConversationAndDownloadEdges(t *testing.T) {
 	previousDeps, previousArgs := deps, os.Args
 	os.Args = []string{"dws", "chat"}
@@ -594,7 +332,6 @@ func TestCrossPlatformCoverageChatWebhookReplyConversationAndDownloadEdges(t *te
 	_ = runChatCoverageCommand(t, &scriptedToolCaller{}, "conversation-info", "--open-dingtalk-id=D1")
 	_ = runChatCoverageCommand(t, &scriptedToolCaller{}, "conversation-info", "--user=D1")
 	_ = runChatCoverageCommand(t, &scriptedToolCaller{steps: []scriptedToolStep{{text: `{"result":[{"userId":"u1","openDingTalkId":"D1"}]}`}, {text: `{}`}}}, "conversation-info", "--user=u1")
-	_ = runChatCoverageCommand(t, &scriptedToolCaller{}, "message", "send-card", "--open-dingtalk-id=D1")
 	_ = runChatCoverageCommand(t, &scriptedToolCaller{}, "message", "send-card", "--receiver=D1")
 
 	oldGet := httpGetFile

internal/helpers/chat_coverage_more_test.go

@@ -14,11 +14,6 @@ import (
 	"github.com/spf13/cobra"
 )
 
-const (
-	helperCurrentDOpenID  = "DAAAAAAAAAAAiE"
-	helperCurrentDOpenID2 = "DAQEBAQEBAQEiE"
-)
-
 func newChatFlagTestCommand() *cobra.Command {
 	cmd := &cobra.Command{Use: "chat"}
 	cmd.Flags().String("forward", "", "")
@@ -42,22 +37,6 @@ func newChatFlagTestCommand() *cobra.Command {
 	return cmd
 }
 
-func TestNativeChatIDSplitUsesCurrentDFormat(t *testing.T) {
-	userIDs, openIDs := splitChatIDValues([]string{
-		helperCurrentDOpenID,
-		"D-prefix-fixture-user",
-		"d-prefix-fixture-user",
-		"D-invalid",
-		"fixture-user-id",
-	})
-	if len(openIDs) != 1 || openIDs[0] != helperCurrentDOpenID {
-		t.Fatalf("open IDs=%#v", openIDs)
-	}
-	if got := strings.Join(userIDs, ","); got != "D-prefix-fixture-user,d-prefix-fixture-user,D-invalid,fixture-user-id" {
-		t.Fatalf("user IDs=%#v", userIDs)
-	}
-}
-
 func TestCrossPlatformCoverageChatDirectionAndScalarCoverage(t *testing.T) {
 	search := &cobra.Command{Use: "search"}
 	search.Flags().String("nicks", "", "")
@@ -172,18 +151,18 @@ func TestCrossPlatformCoverageChatContactMappingCoverage(t *testing.T) {
 }
 
 func TestCrossPlatformCoverageResolveOpenDingTalkIDsCoverage(t *testing.T) {
-	if id, err := resolveOpenDingTalkID(context.Background(), helperCurrentDOpenID); err != nil || id != helperCurrentDOpenID {
+	if id, err := resolveOpenDingTalkID(context.Background(), "D-direct"); err != nil || id != "D-direct" {
 		t.Fatalf("direct ID = %q, %v", id, err)
 	}
 	if _, err := resolveOpenDingTalkID(context.Background(), ""); err == nil {
 		t.Fatal("empty ID unexpectedly resolved")
 	}
-	if ids, err := resolveOpenDingTalkIDs(context.Background(), []string{" " + helperCurrentDOpenID + " ", ""}); err != nil || ids[0] != helperCurrentDOpenID {
+	if ids, err := resolveOpenDingTalkIDs(context.Background(), []string{" D1 ", ""}); err != nil || ids[0] != "D1" {
 		t.Fatalf("direct IDs = %#v, %v", ids, err)
 	}
-	caller := &scriptedToolCaller{steps: []scriptedToolStep{{text: `{"result":[{"userId":"u1","openDingTalkId":"` + helperCurrentDOpenID2 + `"}]}`}}}
+	caller := &scriptedToolCaller{steps: []scriptedToolStep{{text: `{"result":[{"userId":"u1","openDingTalkId":"D1"}]}`}}}
 	installScriptedCaller(t, caller)
-	if ids, err := resolveOpenDingTalkIDs(context.Background(), []string{"u1", "u1"}); err != nil || ids[1] != helperCurrentDOpenID2 {
+	if ids, err := resolveOpenDingTalkIDs(context.Background(), []string{"u1", "u1"}); err != nil || ids[1] != "D1" {
 		t.Fatalf("resolved IDs = %#v, %v", ids, err)
 	}
 	caller.steps = []scriptedToolStep{{text: `{}`}, {text: `{}`}}

internal/helpers/chat_file_path_send_test.go

@@ -178,7 +178,7 @@ func TestChatMessageSendFilePathUsesOpenDingTalkIDTarget(t *testing.T) {
 	caller := &chatFilePathCaller{}
 	commandArgs := []string{
 		"message", "send",
-		"--open-dingtalk-id=" + helperCurrentDOpenID,
+		"--open-dingtalk-id=D-target",
 		"--msg-type=file",
 		"--file-path=" + filePath,
 	}
@@ -203,7 +203,7 @@ func TestChatMessageSendFilePathUsesOpenDingTalkIDTarget(t *testing.T) {
 		server: "im",
 		tool:   "init_conversation_file_upload",
 		args: map[string]any{
-			"openDingTalkId": helperCurrentDOpenID,
+			"openDingTalkId": "D-target",
 			"fileName":       "report.pdf",
 			"fileSize":       int64(len(payload)),
 			"md5":            fileMD5,
@@ -216,7 +216,7 @@ func TestChatMessageSendFilePathUsesOpenDingTalkIDTarget(t *testing.T) {
 		server: "im",
 		tool:   "commit_conversation_file_upload",
 		args: map[string]any{
-			"openDingTalkId": helperCurrentDOpenID,
+			"openDingTalkId": "D-target",
 			"uploadKey":      "upload-key",
 			"fileName":       "report.pdf",
 			"fileSize":       int64(len(payload)),
@@ -231,7 +231,7 @@ func TestChatMessageSendFilePathUsesOpenDingTalkIDTarget(t *testing.T) {
 	if send.server != "chat" || send.tool != "send_personal_message" || send.args["msgType"] != "file" {
 		t.Fatalf("send direct target call = %#v", send)
 	}
-	if send.args["receiverOpenDingTalkId"] != helperCurrentDOpenID {
+	if send.args["receiverOpenDingTalkId"] != "D-target" {
 		t.Fatalf("send direct target = %#v", send.args)
 	}
 	if _, ok := send.args["openDingTalkId"]; ok {

internal/helpers/chat_message_help_test.go

@@ -17,88 +17,8 @@ import (
 	"bytes"
 	"strings"
 	"testing"
-
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/corecmd/runtimeannotate"
-	"github.com/spf13/cobra"
 )
 
-func TestCrossPlatformCoverageChatGroupAuditJoinValidationAliasContract(t *testing.T) {
-	cmd := newChatCommand()
-	leaf, _, err := cmd.Find([]string{"group", "audit-join-validation"})
-	if err != nil {
-		t.Fatal(err)
-	}
-	canonical := leaf.Flags().Lookup("conversation-id")
-	if canonical == nil || canonical.Hidden {
-		t.Fatalf("conversation-id flag = %#v, want visible canonical", canonical)
-	}
-	legacy := leaf.Flags().Lookup("group")
-	if legacy == nil || !legacy.Hidden {
-		t.Fatalf("group flag = %#v, want hidden compatibility alias", legacy)
-	}
-	if got := legacy.Annotations[runtimeannotate.AnnotationFlagAliasOf]; len(got) != 1 || got[0] != "conversation-id" {
-		t.Fatalf("group alias_of annotation = %#v", got)
-	}
-	if got := legacy.Annotations[runtimeannotate.AnnotationFlagAliasOrigin]; len(got) != 1 || got[0] != runtimeannotate.FlagAliasOriginCorecmdV1 {
-		t.Fatalf("group alias_origin annotation = %#v", got)
-	}
-	if got := legacy.Annotations[cobra.BashCompOneRequiredFlag]; len(got) != 0 {
-		t.Fatalf("hidden group alias kept required annotation: %#v", got)
-	}
-}
-
-func TestCrossPlatformCoverageChatGroupAuditJoinValidationRestoreRequiredNoop(t *testing.T) {
-	restoreChatGroupBotsLegacyRequired(nil)
-	restoreChatPendingMigrationCanonicalRequired(nil)
-	root := &cobra.Command{Use: "chat"}
-	root.AddCommand(&cobra.Command{Use: "other"})
-	restoreChatGroupBotsLegacyRequired(root)
-	restoreChatPendingMigrationCanonicalRequired(root)
-}
-
-func TestCrossPlatformCoverageChatGroupBotsKeepsLegacyGroupFlag(t *testing.T) {
-	cmd := newChatCommand()
-	leaf, _, err := cmd.Find([]string{"group", "bots"})
-	if err != nil {
-		t.Fatal(err)
-	}
-	group := leaf.Flags().Lookup("group")
-	if group == nil || group.Hidden {
-		t.Fatalf("group flag = %#v, want visible legacy flag", group)
-	}
-	if got := group.Annotations[cobra.BashCompOneRequiredFlag]; len(got) == 0 || got[0] != "true" {
-		t.Fatalf("group required annotation = %#v, want true", got)
-	}
-	if leaf.Flags().Lookup("conversation-id") != nil {
-		t.Fatalf("chat group bots still exposes migrated --conversation-id")
-	}
-	if leaf.Flags().Lookup("group-name") != nil {
-		t.Fatalf("chat group bots still exposes migrated --group-name")
-	}
-}
-
-func TestCrossPlatformCoverageChatPendingMigrationAliasesMatchManifest(t *testing.T) {
-	cmd := newChatCommand()
-	leaf, _, err := cmd.Find([]string{"group", "dismiss"})
-	if err != nil {
-		t.Fatal(err)
-	}
-	canonical := leaf.Flags().Lookup("conversation-id")
-	if canonical == nil {
-		t.Fatal("missing conversation-id flag")
-	}
-	if got := canonical.Annotations[cobra.BashCompOneRequiredFlag]; len(got) == 0 || got[0] != "true" {
-		t.Fatalf("conversation-id required annotation = %#v, want true", got)
-	}
-	legacy := leaf.Flags().Lookup("group")
-	if legacy == nil || !legacy.Hidden {
-		t.Fatalf("group flag = %#v, want hidden legacy alias", legacy)
-	}
-	if got := legacy.Annotations[runtimeannotate.AnnotationFlagAliasOf]; len(got) != 1 || got[0] != "conversation-id" {
-		t.Fatalf("group alias_of annotation = %#v", got)
-	}
-}
-
 func TestCrossPlatformCoverageChatMessageHelpDocumentsPostSendIDChain(t *testing.T) {
 	tests := []struct {
 		name       string
@@ -131,7 +51,7 @@ func TestCrossPlatformCoverageChatMessageHelpDocumentsPostSendIDChain(t *testing
 			contains: []string{
 				"send -> query-send-status -> edit",
 				"query-send-status --open-task-id <上一步返回的openTaskId>",
-				"edit --conversation-id <上一步返回的openConversationId> --message-id <上一步返回的openMessageId>",
+				"edit --conversation-id <上一步返回的openConversationId> --msg-id <上一步返回的openMessageId>",
 			},
 			notContain: "chat message list",
 		},
@@ -141,7 +61,7 @@ func TestCrossPlatformCoverageChatMessageHelpDocumentsPostSendIDChain(t *testing
 			contains: []string{
 				"send -> query-send-status -> recall",
 				"query-send-status --open-task-id <上一步返回的openTaskId>",
-				"recall --conversation-id <上一步返回的openConversationId> --message-id <上一步返回的openMessageId>",
+				"recall --conversation-id <上一步返回的openConversationId> --msg-id <上一步返回的openMessageId>",
 			},
 			notContain: "chat message list",
 		},
@@ -170,184 +90,3 @@ func TestCrossPlatformCoverageChatMessageHelpDocumentsPostSendIDChain(t *testing
 		})
 	}
 }
-
-func TestCrossPlatformCoverageChatMessageHelpDocumentsOptionalTimeDefaults(t *testing.T) {
-	tests := []struct {
-		name     string
-		args     []string
-		contains []string
-		absent   []string
-	}{
-		{
-			name: "list",
-			args: []string{"message", "list", "--help"},
-			contains: []string{
-				"--time 可选，不传时默认上海时间当前时间并向旧消息拉取",
-				"默认上海时间当前时间",
-				"未传 --time 时默认 older",
-			},
-			absent: []string{"开始时间，格式: yyyy-MM-dd HH:mm:ss (必填)"},
-		},
-		{
-			name: "search",
-			args: []string{"message", "search", "--help"},
-			contains: []string{
-				"可选，不传时默认最近 7 天到当前时间",
-				"默认当前时间前 7 天",
-				"默认当前时间",
-			},
-			absent: []string{"开始时间，ISO-8601 格式 (必填)", "结束时间，ISO-8601 格式 (必填)"},
-		},
-		{
-			name: "list-by-sender",
-			args: []string{"message", "list-by-sender", "--help"},
-			contains: []string{
-				"--start 和 --end 可选，不传时默认最近 7 天到当前时间",
-				"默认当前时间前 7 天",
-				"默认当前时间",
-			},
-			absent: []string{"开始时间，ISO-8601 格式 (必填)", "结束时间，ISO-8601 格式 (必填)"},
-		},
-		{
-			name: "list-mentions",
-			args: []string{"message", "list-mentions", "--help"},
-			contains: []string{
-				"--start 和 --end 可选，不传时默认最近 7 天到当前时间",
-				"默认当前时间前 7 天",
-				"默认当前时间",
-			},
-			absent: []string{"开始时间，ISO-8601 格式 (必填)", "结束时间，ISO-8601 格式 (必填)"},
-		},
-		{
-			name: "list-all",
-			args: []string{"message", "list-all", "--help"},
-			contains: []string{
-				"--start 和 --end 可选，不传时默认最近 1 天到当前时间",
-				"默认当前时间前 1 天",
-				"默认当前时间",
-			},
-			absent: []string{"起始时间，格式: yyyy-MM-dd HH:mm:ss (必填)", "结束时间，格式: yyyy-MM-dd HH:mm:ss (必填)"},
-		},
-		{
-			name: "download-media",
-			args: []string{"message", "download-media", "--help"},
-			contains: []string{
-				"只支持聊天消息 mediaId 下载，不支持钉盘 fileId",
-				"fileId 下载请使用钉盘/drive 下载命令",
-				"仅支持聊天消息 mediaId，不支持钉盘 fileId",
-			},
-		},
-	}
-
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			cmd := newChatCommand()
-			var output bytes.Buffer
-			cmd.SetOut(&output)
-			cmd.SetErr(&output)
-			cmd.SetArgs(test.args)
-			if err := cmd.Execute(); err != nil {
-				t.Fatalf("dws chat %s: %v\n%s", strings.Join(test.args, " "), err, output.String())
-			}
-			help := output.String()
-			for _, want := range test.contains {
-				if !strings.Contains(help, want) {
-					t.Errorf("chat message %s help missing %q:\n%s", test.name, want, help)
-				}
-			}
-			for _, unwanted := range test.absent {
-				if strings.Contains(help, unwanted) {
-					t.Errorf("chat message %s help still contains %q:\n%s", test.name, unwanted, help)
-				}
-			}
-		})
-	}
-}
-
-func TestCrossPlatformCoverageChatReactionHelpKeepsManifestExternalAliasesVisible(t *testing.T) {
-	for _, command := range []string{"add-emoji", "remove-emoji", "add-text-emotion", "remove-text-emotion"} {
-		t.Run(command, func(t *testing.T) {
-			cmd := newChatCommand()
-			var output bytes.Buffer
-			cmd.SetOut(&output)
-			cmd.SetErr(&output)
-			cmd.SetArgs([]string{"message", command, "--help"})
-			if err := cmd.Execute(); err != nil {
-				t.Fatalf("chat message %s --help: %v\n%s", command, err, output.String())
-			}
-
-			help := output.String()
-			if !strings.Contains(help, "--conversation-id") {
-				t.Fatalf("chat message %s help missing --conversation-id:\n%s", command, help)
-			}
-			for _, visible := range []string{"--group", "--id", "--chat"} {
-				if !strings.Contains(help, visible+" string") {
-					t.Fatalf("chat message %s help hides manifest-external alias %s:\n%s", command, visible, help)
-				}
-			}
-		})
-	}
-}
-
-func TestCrossPlatformCoverageChatGroupBotsHelpKeepsLegacyGroup(t *testing.T) {
-	cmd := newChatCommand()
-	var output bytes.Buffer
-	cmd.SetOut(&output)
-	cmd.SetErr(&output)
-	cmd.SetArgs([]string{"group", "bots", "--help"})
-	if err := cmd.Execute(); err != nil {
-		t.Fatalf("chat group bots --help: %v\n%s", err, output.String())
-	}
-
-	help := output.String()
-	if !strings.Contains(help, "--group string") {
-		t.Fatalf("chat group bots help missing visible --group:\n%s", help)
-	}
-	for _, hidden := range []string{"--conversation-id", "--group-name"} {
-		if strings.Contains(help, hidden) {
-			t.Fatalf("chat group bots help exposes migrated flag %s:\n%s", hidden, help)
-		}
-	}
-}
-
-func TestCrossPlatformCoverageChatSendCardHelpUsesCanonicalIDFlags(t *testing.T) {
-	cmd := newChatCommand()
-	var output bytes.Buffer
-	cmd.SetOut(&output)
-	cmd.SetErr(&output)
-	cmd.SetArgs([]string{"message", "send-card", "--help"})
-	if err := cmd.Execute(); err != nil {
-		t.Fatalf("chat message send-card --help: %v\n%s", err, output.String())
-	}
-
-	help := output.String()
-	for _, visible := range []string{"--conversation-id", "--open-dingtalk-id"} {
-		if !strings.Contains(help, visible) {
-			t.Fatalf("send-card help missing %s:\n%s", visible, help)
-		}
-	}
-	for _, visible := range []string{"--group", "--receiver"} {
-		if !strings.Contains(help, visible+" string") {
-			t.Fatalf("send-card help hides manifest-external alias %s:\n%s", visible, help)
-		}
-	}
-}
-
-func TestCrossPlatformCoverageChatGroupAuditJoinValidationHelpUsesCanonicalConversationID(t *testing.T) {
-	cmd := newChatCommand()
-	var output bytes.Buffer
-	cmd.SetOut(&output)
-	cmd.SetErr(&output)
-	cmd.SetArgs([]string{"group", "audit-join-validation", "--help"})
-	if err := cmd.Execute(); err != nil {
-		t.Fatalf("chat group audit-join-validation --help: %v\n%s", err, output.String())
-	}
-
-	help := output.String()
-	if !strings.Contains(help, "--conversation-id") {
-		t.Fatalf("audit-join-validation help missing --conversation-id:\n%s", help)
-	}
-	if strings.Contains(help, "--group string") {
-		t.Fatalf("audit-join-validation help exposes hidden --group alias:\n%s", help)
-	}
-}

internal/helpers/chat_message_pagination_test.go

@@ -6,7 +6,6 @@ import (
 	"encoding/json"
 	"io"
 	"reflect"
-	"strings"
 	"testing"
 	"time"
 
@@ -149,356 +148,6 @@ func TestChatMessagePaginationDefaultSinglePageUnchanged(t *testing.T) {
 	}
 }
 
-func TestChatMessagePaginationUsesDefaultTimeWindows(t *testing.T) {
-	tests := []struct {
-		name         string
-		args         []string
-		wantTool     string
-		wantLookback time.Duration
-	}{
-		{
-			name:         "list-all defaults to one day",
-			args:         []string{"message", "list-all"},
-			wantTool:     "search_messages_by_time_range",
-			wantLookback: 24 * time.Hour,
-		},
-		{
-			name:         "list-by-sender defaults to seven days",
-			args:         []string{"message", "list-by-sender", "--sender-user-id", "u1"},
-			wantTool:     "search_messages_by_sender",
-			wantLookback: 7 * 24 * time.Hour,
-		},
-		{
-			name:         "list-mentions defaults to seven days",
-			args:         []string{"message", "list-mentions"},
-			wantTool:     "search_at_me_message",
-			wantLookback: 7 * 24 * time.Hour,
-		},
-		{
-			name:         "search defaults to seven days",
-			args:         []string{"message", "search", "--query", "发布"},
-			wantTool:     "search_messages_by_keyword",
-			wantLookback: 7 * 24 * time.Hour,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			caller := &chatMessagePaginationCaller{}
-			before := time.Now()
-			_, err := executeChatMessagePaginationCommand(t, caller, tt.args...)
-			after := time.Now()
-			if err != nil {
-				t.Fatal(err)
-			}
-			if len(caller.calls) != 1 {
-				t.Fatalf("calls = %#v, want one call", caller.calls)
-			}
-			got := caller.calls[0]
-			if got.tool != tt.wantTool {
-				t.Fatalf("tool = %q, want %q", got.tool, tt.wantTool)
-			}
-			startMs := chatMessageTimeArgAsMillis(t, got.args["startTime"], tt.wantTool)
-			endMs := chatMessageTimeArgAsMillis(t, got.args["endTime"], tt.wantTool)
-			wantEndMin := before.Truncate(time.Second).UnixMilli()
-			wantEndMax := after.Add(time.Second).UnixMilli()
-			if endMs < wantEndMin || endMs > wantEndMax {
-				t.Fatalf("endTime = %d, want between %d and %d", endMs, wantEndMin, wantEndMax)
-			}
-			wantStartMin := before.Add(-tt.wantLookback).Truncate(time.Second).UnixMilli()
-			wantStartMax := after.Add(-tt.wantLookback).Add(time.Second).UnixMilli()
-			if startMs < wantStartMin || startMs > wantStartMax {
-				t.Fatalf("startTime = %d, want between %d and %d", startMs, wantStartMin, wantStartMax)
-			}
-			if tt.wantTool == "search_messages_by_time_range" {
-				assertChatMessageListAllTimeFormat(t, got.args["startTime"])
-				assertChatMessageListAllTimeFormat(t, got.args["endTime"])
-			}
-		})
-	}
-}
-
-func TestChatMessagePaginationDefaultsStartFromExplicitEnd(t *testing.T) {
-	endRaw := "2026-01-01T00:00:00+08:00"
-	endMs, err := parseISOTimeToMillis("end", endRaw)
-	if err != nil {
-		t.Fatal(err)
-	}
-	tests := []struct {
-		name         string
-		args         []string
-		wantTool     string
-		wantLookback time.Duration
-	}{
-		{
-			name:         "list-all defaults start one day before explicit end",
-			args:         []string{"message", "list-all", "--end", endRaw},
-			wantTool:     "search_messages_by_time_range",
-			wantLookback: 24 * time.Hour,
-		},
-		{
-			name:         "list-by-sender defaults start seven days before explicit end",
-			args:         []string{"message", "list-by-sender", "--sender-user-id", "u1", "--end", endRaw},
-			wantTool:     "search_messages_by_sender",
-			wantLookback: 7 * 24 * time.Hour,
-		},
-		{
-			name:         "list-mentions defaults start seven days before explicit end",
-			args:         []string{"message", "list-mentions", "--end", endRaw},
-			wantTool:     "search_at_me_message",
-			wantLookback: 7 * 24 * time.Hour,
-		},
-		{
-			name:         "search defaults start seven days before explicit end",
-			args:         []string{"message", "search", "--query", "发布", "--end", endRaw},
-			wantTool:     "search_messages_by_keyword",
-			wantLookback: 7 * 24 * time.Hour,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			caller := &chatMessagePaginationCaller{}
-			_, err := executeChatMessagePaginationCommand(t, caller, tt.args...)
-			if err != nil {
-				t.Fatal(err)
-			}
-			if len(caller.calls) != 1 {
-				t.Fatalf("calls = %#v, want one call", caller.calls)
-			}
-			got := caller.calls[0]
-			if got.tool != tt.wantTool {
-				t.Fatalf("tool = %q, want %q", got.tool, tt.wantTool)
-			}
-			startMs := chatMessageTimeArgAsMillis(t, got.args["startTime"], tt.wantTool)
-			gotEndMs := chatMessageTimeArgAsMillis(t, got.args["endTime"], tt.wantTool)
-			if gotEndMs != endMs {
-				t.Fatalf("endTime = %d, want %d", gotEndMs, endMs)
-			}
-			wantStartMs := time.UnixMilli(endMs).Add(-tt.wantLookback).UnixMilli()
-			if startMs != wantStartMs {
-				t.Fatalf("startTime = %d, want %d", startMs, wantStartMs)
-			}
-			if tt.wantTool == "search_messages_by_time_range" {
-				assertStringArg(t, got.args["startTime"], formatChatMessageListAllTime(wantStartMs))
-				assertStringArg(t, got.args["endTime"], endRaw)
-			}
-		})
-	}
-}
-
-func TestChatMessageListAllDefaultStartFromTimezoneLessEndUsesShanghai(t *testing.T) {
-	previousLocal := time.Local
-	t.Cleanup(func() { time.Local = previousLocal })
-
-	for _, loc := range []*time.Location{time.UTC, time.FixedZone("EST", -5*3600)} {
-		t.Run(loc.String(), func(t *testing.T) {
-			time.Local = loc
-			caller := &chatMessagePaginationCaller{}
-			_, err := executeChatMessagePaginationCommand(t, caller, "message", "list-all", "--end", "2026-03-01 00:00:00")
-			if err != nil {
-				t.Fatal(err)
-			}
-			if len(caller.calls) != 1 {
-				t.Fatalf("calls = %#v, want one call", caller.calls)
-			}
-			got := caller.calls[0]
-			assertStringArg(t, got.args["endTime"], "2026-03-01 00:00:00")
-			assertStringArg(t, got.args["startTime"], "2026-02-28 00:00:00")
-
-			startMs, err := parseISOTimeToMillis("start", got.args["startTime"].(string))
-			if err != nil {
-				t.Fatal(err)
-			}
-			endMs, err := parseISOTimeToMillis("end", got.args["endTime"].(string))
-			if err != nil {
-				t.Fatal(err)
-			}
-			if gotWindow := time.Duration(endMs-startMs) * time.Millisecond; gotWindow != 24*time.Hour {
-				t.Fatalf("window = %v, want 24h", gotWindow)
-			}
-		})
-	}
-}
-
-func TestChatMessagePaginationDefaultsEndFromNowWhenOnlyStartProvided(t *testing.T) {
-	startRaw := "2026-01-01T00:00:00+08:00"
-	startMs, err := parseISOTimeToMillis("start", startRaw)
-	if err != nil {
-		t.Fatal(err)
-	}
-	tests := []struct {
-		name     string
-		args     []string
-		wantTool string
-	}{
-		{
-			name:     "list-all defaults end to now",
-			args:     []string{"message", "list-all", "--start", startRaw},
-			wantTool: "search_messages_by_time_range",
-		},
-		{
-			name:     "list-by-sender defaults end to now",
-			args:     []string{"message", "list-by-sender", "--sender-user-id", "u1", "--start", startRaw},
-			wantTool: "search_messages_by_sender",
-		},
-		{
-			name:     "list-mentions defaults end to now",
-			args:     []string{"message", "list-mentions", "--start", startRaw},
-			wantTool: "search_at_me_message",
-		},
-		{
-			name:     "search defaults end to now",
-			args:     []string{"message", "search", "--query", "发布", "--start", startRaw},
-			wantTool: "search_messages_by_keyword",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			caller := &chatMessagePaginationCaller{}
-			before := time.Now()
-			_, err := executeChatMessagePaginationCommand(t, caller, tt.args...)
-			after := time.Now()
-			if err != nil {
-				t.Fatal(err)
-			}
-			if len(caller.calls) != 1 {
-				t.Fatalf("calls = %#v, want one call", caller.calls)
-			}
-			got := caller.calls[0]
-			if got.tool != tt.wantTool {
-				t.Fatalf("tool = %q, want %q", got.tool, tt.wantTool)
-			}
-			gotStartMs := chatMessageTimeArgAsMillis(t, got.args["startTime"], tt.wantTool)
-			if gotStartMs != startMs {
-				t.Fatalf("startTime = %d, want %d", gotStartMs, startMs)
-			}
-			endMs := chatMessageTimeArgAsMillis(t, got.args["endTime"], tt.wantTool)
-			wantEndMin := before.Truncate(time.Second).UnixMilli()
-			wantEndMax := after.Add(time.Second).UnixMilli()
-			if endMs < wantEndMin || endMs > wantEndMax {
-				t.Fatalf("endTime = %d, want between %d and %d", endMs, wantEndMin, wantEndMax)
-			}
-			if tt.wantTool == "search_messages_by_time_range" {
-				assertStringArg(t, got.args["startTime"], startRaw)
-				assertChatMessageListAllTimeFormat(t, got.args["endTime"])
-			}
-		})
-	}
-}
-
-func TestChatMessageListAllRejectsInvalidTimeBounds(t *testing.T) {
-	tests := []struct {
-		name    string
-		args    []string
-		wantErr string
-	}{
-		{
-			name:    "invalid start",
-			args:    []string{"message", "list-all", "--start", "not-a-time", "--end", "2020-01-01T00:00:00+08:00"},
-			wantErr: "cannot parse time for --start",
-		},
-		{
-			name:    "end before start",
-			args:    []string{"message", "list-all", "--start", "2021-01-01T00:00:00+08:00", "--end", "2020-01-01T00:00:00+08:00"},
-			wantErr: "--end must be after --start",
-		},
-		{
-			name:    "default end before future start",
-			args:    []string{"message", "list-all", "--start", "2027-01-01 00:00:00"},
-			wantErr: "--end must be after --start",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			caller := &chatMessagePaginationCaller{}
-			_, err := executeChatMessagePaginationCommand(t, caller, tt.args...)
-			if err == nil {
-				t.Fatal("expected validation error, got nil")
-			}
-			if !strings.Contains(err.Error(), tt.wantErr) {
-				t.Fatalf("error = %q, want contains %q", err.Error(), tt.wantErr)
-			}
-			if len(caller.calls) != 0 {
-				t.Fatalf("calls = %#v, want no MCP call", caller.calls)
-			}
-		})
-	}
-}
-
-func numericArgAsInt64(t *testing.T, value any) int64 {
-	t.Helper()
-	switch v := value.(type) {
-	case int64:
-		return v
-	case int:
-		return int64(v)
-	case float64:
-		return int64(v)
-	case string:
-		parsed, err := parseISOTimeToMillis("time", v)
-		if err != nil {
-			t.Fatalf("parse time arg %q: %v", v, err)
-		}
-		return parsed
-	default:
-		t.Fatalf("unsupported numeric arg type %T (%#v)", value, value)
-		return 0
-	}
-}
-
-func chatMessageTimeArgAsMillis(t *testing.T, value any, tool string) int64 {
-	t.Helper()
-	if tool == "search_messages_by_time_range" {
-		return parseChatMessageListAllTimeArg(t, value).UnixMilli()
-	}
-	return numericArgAsInt64(t, value)
-}
-
-func parseChatMessageListAllTimeArg(t *testing.T, value any) time.Time {
-	t.Helper()
-	raw, ok := value.(string)
-	if !ok {
-		t.Fatalf("time arg = %#v, want time string", value)
-	}
-	if strings.Contains(raw, "T") {
-		parsedMs, err := parseISOTimeToMillis("time", raw)
-		if err != nil {
-			t.Fatalf("time arg = %q, parse err = %v", raw, err)
-		}
-		return time.UnixMilli(parsedMs)
-	}
-	parsedMs, err := parseISOTimeToMillis("time", raw)
-	if err != nil {
-		t.Fatalf("time arg = %q, parse err = %v", raw, err)
-	}
-	return time.UnixMilli(parsedMs)
-}
-
-func assertChatMessageListAllTimeFormat(t *testing.T, value any) {
-	t.Helper()
-	raw, ok := value.(string)
-	if !ok {
-		t.Fatalf("time arg = %#v, want time string", value)
-	}
-	if strings.Contains(raw, "T") {
-		t.Fatalf("time arg = %q, want yyyy-MM-dd HH:mm:ss without RFC3339 separator", raw)
-	}
-	if _, err := parseISOTimeToMillis("time", raw); err != nil {
-		t.Fatalf("time arg = %q, parse err = %v", raw, err)
-	}
-}
-
-func assertStringArg(t *testing.T, value any, want string) {
-	t.Helper()
-	got, ok := value.(string)
-	if !ok || got != want {
-		t.Fatalf("arg = %#v, want %q", value, want)
-	}
-}
-
 func TestChatMessagePaginationPageAllAggregatesSevenCommands(t *testing.T) {
 	tests := []struct {
 		name      string

internal/helpers/chat_message_search_test.go

@@ -724,99 +724,6 @@ func TestCrossPlatformCoverageChatMessageListUsesMCPMetadataGroupKey(t *testing.
 	}
 }
 
-func TestCrossPlatformCoverageChatMessageListDefaultTimeUsesShanghaiLocation(t *testing.T) {
-	previousLocal := time.Local
-	t.Cleanup(func() { time.Local = previousLocal })
-
-	tests := []struct {
-		name       string
-		args       []string
-		wantTool   string
-		wantTarget map[string]any
-	}{
-		{
-			name:       "group",
-			args:       []string{"message", "list", "--group", "cid-1", "--limit", "50"},
-			wantTool:   "list_conversation_message_v2",
-			wantTarget: map[string]any{"openconversation_id": "cid-1"},
-		},
-		{
-			name:       "user",
-			args:       []string{"message", "list", "--user", "user-1", "--limit", "50"},
-			wantTool:   "list_individual_chat_message",
-			wantTarget: map[string]any{"userId": "user-1"},
-		},
-		{
-			name:       "user open DingTalk ID fallback",
-			args:       []string{"message", "list", "--user", helperCurrentDOpenID, "--limit", "50"},
-			wantTool:   "list_individual_chat_message",
-			wantTarget: map[string]any{"openDingTalkId": helperCurrentDOpenID},
-		},
-		{
-			name:       "open DingTalk ID",
-			args:       []string{"message", "list", "--open-dingtalk-id", helperCurrentDOpenID, "--limit", "50"},
-			wantTool:   "list_individual_chat_message",
-			wantTarget: map[string]any{"openDingTalkId": helperCurrentDOpenID},
-		},
-		{
-			name:       "direct user",
-			args:       []string{"message", "list-direct", "--user", "user-1", "--limit", "50"},
-			wantTool:   "list_individual_chat_message",
-			wantTarget: map[string]any{"userId": "user-1"},
-		},
-		{
-			name:       "direct open DingTalk ID",
-			args:       []string{"message", "list-direct", "--open-dingtalk-id", helperCurrentDOpenID, "--limit", "50"},
-			wantTool:   "list_individual_chat_message",
-			wantTarget: map[string]any{"openDingTalkId": helperCurrentDOpenID},
-		},
-	}
-
-	for _, loc := range []*time.Location{time.UTC, time.FixedZone("EST", -5*3600)} {
-		t.Run(loc.String(), func(t *testing.T) {
-			time.Local = loc
-			for _, tt := range tests {
-				t.Run(tt.name, func(t *testing.T) {
-					caller := &chatChangedContractCaller{}
-					before := time.Now()
-					err := executeChatChangedContract(t, caller, tt.args...)
-					after := time.Now()
-					if err != nil {
-						t.Fatal(err)
-					}
-					if len(caller.calls) != 1 {
-						t.Fatalf("calls = %#v, want one MCP call", caller.calls)
-					}
-					if caller.calls[0].toolName != tt.wantTool {
-						t.Fatalf("tool = %q, want %q", caller.calls[0].toolName, tt.wantTool)
-					}
-					for key, want := range tt.wantTarget {
-						if got := caller.calls[0].args[key]; got != want {
-							t.Fatalf("arg %s = %#v, want %#v", key, got, want)
-						}
-					}
-					raw, ok := caller.calls[0].args["time"].(string)
-					if !ok || raw == "" {
-						t.Fatalf("time arg = %#v, want non-empty string", caller.calls[0].args["time"])
-					}
-					gotMs, err := parseISOTimeToMillis("time", raw)
-					if err != nil {
-						t.Fatalf("time arg = %q, parse err = %v", raw, err)
-					}
-					wantMin := before.Add(-time.Second).UnixMilli()
-					wantMax := after.Add(time.Second).UnixMilli()
-					if gotMs < wantMin || gotMs > wantMax {
-						t.Fatalf("time arg = %q (%d), want between %d and %d", raw, gotMs, wantMin, wantMax)
-					}
-					if caller.calls[0].args["forward"] != false {
-						t.Fatalf("forward = %#v, want false when --time is omitted", caller.calls[0].args["forward"])
-					}
-				})
-			}
-		})
-	}
-}
-
 func TestCrossPlatformCoverageChatAuditUsesUserIDs(t *testing.T) {
 	caller := &chatChangedContractCaller{}
 	err := executeChatChangedContract(t, caller,
@@ -879,11 +786,11 @@ func TestChatSendAndReplyDefaultToAgentProductForIMClawType(t *testing.T) {
 	}{
 		{
 			name: "send",
-			args: []string{"message", "send", "--open-dingtalk-id", helperCurrentDOpenID, "--text", "hello"},
+			args: []string{"message", "send", "--open-dingtalk-id", "D1", "--text", "hello"},
 		},
 		{
 			name: "reply",
-			args: []string{"message", "reply", "--conversation-id", "cid", "--ref-msg-id", "mid", "--ref-sender", helperCurrentDOpenID, "--text", "hello"},
+			args: []string{"message", "reply", "--conversation-id", "cid", "--ref-msg-id", "mid", "--ref-sender", "D1", "--text", "hello"},
 		},
 	}
 
@@ -912,11 +819,11 @@ func TestChatSendAndReplyDisableAITagWithEmptyClawType(t *testing.T) {
 	}{
 		{
 			name: "send",
-			args: []string{"message", "send", "--open-dingtalk-id", helperCurrentDOpenID, "--text", "hello", "--ai-tag=false"},
+			args: []string{"message", "send", "--open-dingtalk-id", "D1", "--text", "hello", "--ai-tag=false"},
 		},
 		{
 			name: "reply",
-			args: []string{"message", "reply", "--conversation-id", "cid", "--ref-msg-id", "mid", "--ref-sender", helperCurrentDOpenID, "--text", "hello", "--ai-tag=false"},
+			args: []string{"message", "reply", "--conversation-id", "cid", "--ref-msg-id", "mid", "--ref-sender", "D1", "--text", "hello", "--ai-tag=false"},
 		},
 	}
 
@@ -950,25 +857,25 @@ func TestCrossPlatformCoverageChatCurrentUserSendAndReplyMentions(t *testing.T)
 			name: "send",
 			args: []string{
 				"message", "send", "--group", "cid",
-				"--text", "收到 @" + helperCurrentDOpenID + " 和 <@" + helperCurrentDOpenID2 + ">",
-				"--at-open-dingtalk-ids", helperCurrentDOpenID + "," + helperCurrentDOpenID2,
+				"--text", "收到 @D-target 和 <@D-second>",
+				"--at-open-dingtalk-ids", "D-target,D-second",
 				"--at-all",
 			},
 			contentField: "text",
-			wantContent:  "<@all> 收到 <@" + helperCurrentDOpenID + "> 和 <@" + helperCurrentDOpenID2 + ">",
+			wantContent:  "<@all> 收到 <@D-target> 和 <@D-second>",
 			wantAtAll:    true,
-			wantOpenIDs:  []string{helperCurrentDOpenID, helperCurrentDOpenID2},
+			wantOpenIDs:  []string{"D-target", "D-second"},
 		},
 		{
 			name: "send keeps missing member placeholders unchanged",
 			args: []string{
 				"message", "send", "--group", "cid",
 				"--text", "DWS 发消息自测",
-				"--at-open-dingtalk-ids", helperCurrentDOpenID,
+				"--at-open-dingtalk-ids", "D-target",
 			},
 			contentField: "text",
 			wantContent:  "DWS 发消息自测",
-			wantOpenIDs:  []string{helperCurrentDOpenID},
+			wantOpenIDs:  []string{"D-target"},
 		},
 		{
 			name: "reply",
@@ -976,15 +883,15 @@ func TestCrossPlatformCoverageChatCurrentUserSendAndReplyMentions(t *testing.T)
 				"message", "reply",
 				"--conversation-id", "cid",
 				"--ref-msg-id", "mid",
-				"--ref-sender", helperCurrentDOpenID,
-				"--text", "收到 @" + helperCurrentDOpenID + " 和 <@" + helperCurrentDOpenID2 + ">",
-				"--at-open-dingtalk-ids", helperCurrentDOpenID + "," + helperCurrentDOpenID2,
+				"--ref-sender", "D-sender",
+				"--text", "收到 @D-target 和 <@D-second>",
+				"--at-open-dingtalk-ids", "D-target,D-second",
 				"--at-all",
 			},
 			contentField: "content",
-			wantContent:  "<@all> 收到 <@" + helperCurrentDOpenID + "> 和 <@" + helperCurrentDOpenID2 + ">",
+			wantContent:  "<@all> 收到 <@D-target> 和 <@D-second>",
 			wantAtAll:    true,
-			wantOpenIDs:  []string{helperCurrentDOpenID, helperCurrentDOpenID2},
+			wantOpenIDs:  []string{"D-target", "D-second"},
 		},
 		{
 			name: "reply adds missing member placeholders",
@@ -992,13 +899,13 @@ func TestCrossPlatformCoverageChatCurrentUserSendAndReplyMentions(t *testing.T)
 				"message", "reply",
 				"--conversation-id", "cid",
 				"--ref-msg-id", "mid",
-				"--ref-sender", helperCurrentDOpenID,
-				"--text", "DWS synthetic reply mention test",
-				"--at-open-dingtalk-ids", helperCurrentDOpenID + "," + helperCurrentDOpenID2 + "," + helperCurrentDOpenID,
+				"--ref-sender", "D-sender",
+				"--text", "DWS 回复艾特前津（非主用）自测",
+				"--at-open-dingtalk-ids", "D-target,D-second,D-target",
 			},
 			contentField: "content",
-			wantContent:  "<@" + helperCurrentDOpenID + "> <@" + helperCurrentDOpenID2 + "> DWS synthetic reply mention test",
-			wantOpenIDs:  []string{helperCurrentDOpenID, helperCurrentDOpenID2, helperCurrentDOpenID},
+			wantContent:  "<@D-target> <@D-second> DWS 回复艾特前津（非主用）自测",
+			wantOpenIDs:  []string{"D-target", "D-second", "D-target"},
 		},
 		{
 			name: "reply adds missing member placeholders after at-all",
@@ -1006,15 +913,15 @@ func TestCrossPlatformCoverageChatCurrentUserSendAndReplyMentions(t *testing.T)
 				"message", "reply",
 				"--conversation-id", "cid",
 				"--ref-msg-id", "mid",
-				"--ref-sender", helperCurrentDOpenID,
+				"--ref-sender", "D-sender",
 				"--text", "请大家确认",
-				"--at-open-dingtalk-ids", helperCurrentDOpenID,
+				"--at-open-dingtalk-ids", "D-target",
 				"--at-all",
 			},
 			contentField: "content",
-			wantContent:  "<@all> <@" + helperCurrentDOpenID + "> 请大家确认",
+			wantContent:  "<@all> <@D-target> 请大家确认",
 			wantAtAll:    true,
-			wantOpenIDs:  []string{helperCurrentDOpenID},
+			wantOpenIDs:  []string{"D-target"},
 		},
 		{
 			name: "reply at-all preserves alliance word",
@@ -1022,7 +929,7 @@ func TestCrossPlatformCoverageChatCurrentUserSendAndReplyMentions(t *testing.T)
 				"message", "reply",
 				"--conversation-id", "cid",
 				"--ref-msg-id", "mid",
-				"--ref-sender", helperCurrentDOpenID,
+				"--ref-sender", "D-sender",
 				"--text", "联系 @alliance",
 				"--at-all",
 			},
@@ -1036,7 +943,7 @@ func TestCrossPlatformCoverageChatCurrentUserSendAndReplyMentions(t *testing.T)
 				"message", "reply",
 				"--conversation-id", "cid",
 				"--ref-msg-id", "mid",
-				"--ref-sender", helperCurrentDOpenID,
+				"--ref-sender", "D-sender",
 				"--text", "联系 @alliance",
 			},
 			contentField: "content",