chore: prepare release v1.0.5

2026-04-01 10:48:04 +08:00
183 changed files with 1090 additions and 26269 deletions
@@ -1 +1 @@
-<svg xmlns="http://www.w3.org/2000/svg" width="108" height="20" role="img" aria-label="coverage: 49.8%"><title>coverage: 49.8%</title><linearGradient id="s" x2="0" y2="100%"><stop offset="0" stop-color="#bbb" stop-opacity=".1"/><stop offset="1" stop-opacity=".1"/></linearGradient><clipPath id="r"><rect width="108" height="20" rx="3" fill="#fff"/></clipPath><g clip-path="url(#r)"><rect width="61" height="20" fill="#555"/><rect x="61" width="47" height="20" fill="#e05d44"/><rect width="108" height="20" fill="url(#s)"/></g><g fill="#fff" text-anchor="middle" font-family="Verdana,Geneva,DejaVu Sans,sans-serif" text-rendering="geometricPrecision" font-size="110"><text aria-hidden="true" x="315" y="150" fill="#010101" fill-opacity=".3" transform="scale(.1)" textLength="510">coverage</text><text x="315" y="140" transform="scale(.1)" fill="#fff" textLength="510">coverage</text><text aria-hidden="true" x="835" y="150" fill="#010101" fill-opacity=".3" transform="scale(.1)" textLength="370">49.8%</text><text x="835" y="140" transform="scale(.1)" fill="#fff" textLength="370">49.8%</text></g></svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="108" height="20" role="img" aria-label="coverage: 52.8%"><title>coverage: 52.8%</title><linearGradient id="s" x2="0" y2="100%"><stop offset="0" stop-color="#bbb" stop-opacity=".1"/><stop offset="1" stop-opacity=".1"/></linearGradient><clipPath id="r"><rect width="108" height="20" rx="3" fill="#fff"/></clipPath><g clip-path="url(#r)"><rect width="61" height="20" fill="#555"/><rect x="61" width="47" height="20" fill="#e05d44"/><rect width="108" height="20" fill="url(#s)"/></g><g fill="#fff" text-anchor="middle" font-family="Verdana,Geneva,DejaVu Sans,sans-serif" text-rendering="geometricPrecision" font-size="110"><text aria-hidden="true" x="315" y="150" fill="#010101" fill-opacity=".3" transform="scale(.1)" textLength="510">coverage</text><text x="315" y="140" transform="scale(.1)" fill="#fff" textLength="510">coverage</text><text aria-hidden="true" x="835" y="150" fill="#010101" fill-opacity=".3" transform="scale(.1)" textLength="370">52.8%</text><text x="835" y="140" transform="scale(.1)" fill="#fff" textLength="370">52.8%</text></g></svg>
@@ -141,41 +141,3 @@ jobs:

      - name: Generated Drift
        run: ./scripts/policy/check-generated-drift.sh
-
-  edition-tests:
-    name: Edition Contract Tests
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    steps:
-      - name: Check out repository
-        uses: actions/checkout@v4
-
-      - name: Set up Go
-        uses: actions/setup-go@v5
-        with:
-          go-version-file: go.mod
-
-      - name: Run edition contract tests
-        run: go test -v -count=1 ./pkg/editiontest/...
-
-  notify-downstream:
-    name: Notify Wukong Overlay
-    needs: [test, policy, edition-tests]
-    runs-on: ubuntu-latest
-    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
-    steps:
-      - name: Trigger downstream CI
-        run: |
-          # Trigger internal GitLab CI pipeline via webhook.
-          # WUKONG_TRIGGER_TOKEN is a repository secret.
-          if [ -n "${{ secrets.WUKONG_TRIGGER_TOKEN }}" ]; then
-            curl --fail --silent --show-error \
-              -X POST \
-              -F "token=${{ secrets.WUKONG_TRIGGER_TOKEN }}" \
-              -F "ref=main" \
-              -F "variables[UPSTREAM_SHA]=${{ github.sha }}" \
-              "${{ secrets.WUKONG_TRIGGER_URL }}"
-            echo "Downstream CI triggered."
-          else
-            echo "No WUKONG_TRIGGER_TOKEN configured, skipping downstream notification."
-          fi
@@ -33,8 +33,7 @@ jobs:
                title: issue.title,
                body: issue.body,
                state: issue.state,
-                html_url: issue.html_url,
-                labels: (issue.labels || []).map(label => label.name).join(', ') || '无标签'
+                html_url: issue.html_url
              }
            };
            
@@ -28,14 +28,13 @@ jobs:
            const title = `[${action.toUpperCase()}] Issue #${issue.number}: ${issue.title}`;
            const content = issue.body?.substring(0, 500) || 'No description';
            const url = issue.html_url;
-            const labelsText = (issue.labels || []).map(label => label.name).join(', ') || '无标签';
            
            // 消息内容必须包含关键字（如 "issue"）以支持 Custom Keywords 安全模式
            const message = {
              msgtype: 'markdown',
              markdown: {
                title: 'GitHub Issue 通知',
-                text: `## 🔔 GitHub Issue 通知\n\n**${title}**\n\n🏷️ **Labels**: ${labelsText}\n\n${content}${content.length >= 500 ? '...' : ''}\n\n[点击查看详情](${url})\n\n---\n📦 ${context.repo.owner}/${context.repo.repo}\n\n**关键词**: issue`
+                text: `## 🔔 GitHub Issue 通知\n\n**${title}**\n\n${content}${content.length >= 500 ? '...' : ''}\n\n[点击查看详情](${url})\n\n---\n📦 ${context.repo.owner}/${context.repo.repo}\n\n**关键词**: issue`
              }
            };
            
@@ -37,14 +37,12 @@ jobs:

      - name: Post-release packaging
        run: ./scripts/release/post-goreleaser.sh
-        env:
-          DWS_PACKAGE_VERSION: ${{ github.ref_name }}

-      - name: Upload dws-skills.zip to release
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - name: Upload skills package to release
        run: |
          gh release upload "${{ github.ref_name }}" dist/dws-skills.zip --clobber
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Setup Node.js
        uses: actions/setup-node@v4
@@ -27,6 +27,3 @@ test/cli_compat/testdata/
 credentials*
 plans
 _docs
-dws.zip
-*.code-workspace
-/dingtalk-workspace.zip
@@ -4,341 +4,6 @@ All notable changes to this project will be documented in this file.

 The format is inspired by [Keep a Changelog](https://keepachangelog.com/) and this project follows [Semantic Versioning](https://semver.org/).

-## [1.0.15] - 2026-04-23
-
-Compat layer gains **subcommand merging** under shared parents so multiple server entries can contribute into the same `dws <parent> <branch>` subtree without producing duplicate `--help` rows. Ships with a fresh auto-generated command index doc, a README sync to **159 commands across 13 products**, and a wide-ranging flag-naming cleanup that standardises CLI flags across chat, calendar, drive, minutes, contact, and devdoc commands.
-
-### Added
-
- **`internal/compat` subcommand merging via `attachOrMerge`** — when two or more server entries attach to the same parent (e.g. `parent: "chat"`) and their `cli.command` collides with an existing subcommand in the parent's tree, the new subcommand's children are merged recursively into the existing one instead of creating a duplicate sibling. Leaf-name collisions resolve first-wins. Fixes the "double `group` / `message` rows in `dws chat --help`" symptom when bot capabilities are distributed across `chat.group.members` and `chat.message`.
- **`docs/command-index.md`** — a single, English, auto-generated listing of every runtime command the `dws` CLI exposes under the pre environment (159 total). Each entry carries a description and a "when to use" column aimed at AI agents. Replaces the earlier `command-index.pre.*` / `command-index.full.*` ad-hoc snapshots.
-
-### Changed
-
- **README Key Services table** (`README.md` + `README_zh.md`) fully synced to the shipped command surface:
-  - `Chat`: 20 → **23** (bot capabilities merged in; new `list-all` / `list-focused` / `list-unread-conversations` / `conversation-info` exposed)
-  - `Calendar`: 13 → **14**
-  - `AI Tables`: 37 → **41** (chart / dashboard public-share config rows)
-  - `Doc`: 16 → **21** (comment subtree + `file create`)
-  - `Minutes`: 22 → **19** (single-tool `record`, `list query`, `list-by-keyword-range` pruned)
-  - New `Drive` row (6 commands) — promoted out of "Coming soon"
-  - `Workbench` row and standalone `Bot` row removed
-  - Total revised to **159 commands across 13 products**
- **Quick Start** expanded to 7 examples covering `doc`, `minutes`, `drive` in addition to `contact`, `calendar`, `todo`
- **Coming soon** trimmed to 5: `mail`, `conference`, `aiapp`, `live`, `wiki`
- **Reference & Docs** section now leads with a pointer to the new `docs/command-index.md`
- **Flag naming cleanup** — CLI flags across chat, calendar, drive, minutes, contact, and devdoc have been standardised so the names users type match the product-skill documentation. Notable flags:
-  - `dws contact user search` / `dws contact dept search` / `dws devdoc article search` now take `--query` (previously `--keyword`)
-  - `dws chat message list` / `dws chat message search` / `dws chat message list-mentions` / `dws chat conversation-info` / `dws chat message send` now take `--group` for the target conversation (previously `--id`) and `--open-dingtalk-id` (previously `--open-id`)
-  - `dws chat message list-by-sender` now takes `--sender-user-id` / `--sender-open-dingtalk-id` (previously `--user` / `--open-id`)
-  - `dws chat message list-topic-replies` now takes `--group` / `--topic-id` / `--limit` / `--time` (previously `--id` / `--topic` / `--size` / `--start`)
-  - `dws chat search-common` now takes `--match-mode` (previously `--mode`)
-  - `dws drive list` now takes `--max` / `--thumbnail` (previously `--max-results` / `--with-thumbnail`)
-  - `dws calendar event suggest` now takes `--users` / `--duration` / `--timezone` (previously `--attendee-user-ids` / `--duration-minutes` / `--time-zone`)
-  - `dws minutes list mine` / `dws minutes list shared` now take `--max` (previously `--max-results`) and gain `--query` / `--start` / `--end`
-  - `dws minutes list all` no longer exposes the legacy `--__scope__` internal alias
- **Flag coverage additions** — `dws calendar event create` / `update` gain `--attendees`, `--open-dingtalk-ids`, `--timezone`; `dws chat message send` gains file-message flags (`--dentry-id`, `--file-name`, `--file-size`, `--file-type`, `--media-id`, `--msg-type`, `--space-id`) plus `--open-dingtalk-id` / `--user`; `dws chat message list` gains `--open-dingtalk-id` / `--user`; `dws aitable table delete` gains `--reason`; `dws calendar participant add` gains `--optional`; `dws todo task create` gains `--recurrence`.
-
-### Tests
-
- 3 new unit tests in `internal/compat/dynamic_commands_test.go`:
-  - `TestBuildDynamicCommands_ParentMergeSameName` — two servers with identical `command` + `parent` collapse into a single merged subcommand
-  - `TestBuildDynamicCommands_ParentMergeRecursive` — recursive merge through nested groups (e.g. `chat.group.members`)
-  - `TestBuildDynamicCommands_ParentMergeLeafCollision` — identical leaf paths resolve first-wins without producing duplicates
-
-## [1.0.13] - 2026-04-22
-
-IM / Messaging capability expansion: the `chat` (aka `im`) product surface grows from "group + bot messaging" into a full conversational layer — user-identity messaging, message reading & search, personal messages, topic replies, mentions, focused contacts, unread/top/common conversations, org-wide group creation, and first-class bot lifecycle.
-
-### Added
-
- **`dws im` alias** — `dws im` is now registered as an alias of `dws chat` for intent clarity
- **User-identity messaging** (`chat message send`) — send group or 1-on-1 messages as the current user
-  - Recipient selection is mutually exclusive: `--group <openConversationId>` / `--user <userId>` / `--open-dingtalk-id <openDingTalkId>`
-  - Markdown text via `--text` (or positional arg), optional `--title`
-  - Group-only: `--at-all` to @everyone, `--at-users` for per-member @mentions
-  - Image messages via `--media-id` (obtained from `dt_media_upload`)
- **Personal messages** (`chat message send-personal`) — sensitive personal-channel send (⚠️ destructive/dangerous op, requires confirmation)
- **Conversation read paths**:
-  - `chat message list` — pull group / 1-on-1 conversation messages
-  - `chat message list-all` — pull all conversations for the current user in a time range
-  - `chat message list-topic-replies` — pull group topic reply threads
-  - `chat message list-by-sender` — messages by a specific sender
-  - `chat message list-mentions` — messages where the current user was @-mentioned
-  - `chat message list-focused` — messages from focused / starred contacts
-  - `chat message list-unread-conversations` — unread conversation list
-  - `chat message search` — keyword search across conversations
-  - `chat message info` — conversation metadata
-  - `chat list-top-conversations` — pinned conversation list
- **Group creation & discovery**:
-  - `chat group create-org` — create an organization-wide group
-  - `chat search-common` — search groups shared with a nickname list (`--nicks`, `--match-mode AND|OR`, cursor-based pagination)
- **Bot lifecycle**:
-  - `chat bot create` — create an enterprise bot
-  - `chat bot search-groups` — search the groups a bot is present in
-
-### Changed
-
- **`chat` skill reference** (`skills/references/products/chat.md`, #148) restructured into three sub-groups — `group` (9) / `message` (15) / `bot` (3) — with refreshed intent-routing table, workflow examples, and context-passing rules aligned with `dws-service-endpoints.json` (16 new group-chat tool overrides + 2 new bot tool overrides)
- **README Key Services** sync:
-  - `Chat` row: 10 → 20 commands; subcommand tags expanded to `message` `group` `search` `list-top-conversations`
-  - `Bot` row: 6 → 7 commands; subcommand tags expanded with `create` `search-groups`
-  - Total raised to **152 commands across 14 products**
-
-## [1.0.12] - 2026-04-21
-
-Product-surface expansion: first-class `doc` (DingTalk Docs) and `minutes` (AI Minutes) skill references, refreshed `aitable` guide aligned with the shipped binary (including dashboard / chart / export), and a README sync that brings the full command catalog to **141 commands across 14 products**.
-
-### Added
-
- **`doc` skill reference** (`skills/references/products/doc.md`) — 16-command coverage of DingTalk Docs:
-  - Discovery: `search`, `list`, `info`, `read`
-  - Authoring: `create`, `update`, `folder create`
-  - Files: `upload`, `download`
-  - Block-level editing: block `query`, `insert`, `update`, `delete`
-  - Comments: `comment list`, `create`, `reply`
-  - URL → `doc_id` extraction rules and nodeId dual-format notes
- **`minutes` skill reference** (`skills/references/products/minutes.md`) — coverage of AI Minutes:
-  - Lists: personal / shared-with-me / all-accessible
-  - Content: basic info, AI summary, keywords, transcription, extracted todos, batch detail
-  - Editing: title update
-  - Recording control: start, pause, resume, stop
- **SKILL.md routing**:
-  - Product overview table rows for `doc` and `minutes`
-  - Intent decision tree routes — `钉钉文档/云文档/知识库/块级编辑/文档评论` → `doc`; `听记/AI听记/会议纪要/转写/摘要/思维导图/发言人/热词` → `minutes`
-  - Danger-op table entries: `doc delete`, `doc block delete`
-  - `aitable` description completed with the `附件` (attachment) group
- **`aitable` skill enhancements**:
-  - `field create` single-field mode (`--name` / `--type` / `--config`) with examples
-  - `base get` URL → `baseId` quick-tip
-  - Dedicated "URL → baseId 提取" chapter
-  - "`--filters` 筛选语法排错与使用规范" chapter
-  - "相关产品" cross-link section pointing to `doc`
-  - **"复杂操作" chapter** (#141) — dashboard / chart workflow (with two-call sequencing and `chart share get` vs `dashboard share get` error semantics) and two-stage `export data` polling (`scope=all/table/view` parameter constraints)
- **README Key Services sync** (#140):
-  - New rows: `doc` (16 commands), `minutes` (22 commands — adds `hot-word`, `mind-graph`, `replace-text`, `speaker`, `upload` subgroups)
-  - `aitable` expanded from 20 → 37 commands; surfaces `chart`, `dashboard`, `export`, `import`, `view` subgroups
-  - Total command count updated from **86 → 141 across 14 products**
-  - "Coming soon" list drops `doc` and `minutes`
-
-### Changed
-
- `aitable record query` docs rename `--keyword` → `--query` to match the shipped binary
- `aitable record query` docs clarify `--sort` direction semantics (avoids misuse of `order`)
- `aitable base list` guidance strengthened — "only for recent browsing; use `base search` for lookups"; intent decision prioritizes `base search` for base discovery
-
-## [1.0.11] - 2026-04-20
-
-Plugin subsystem hardening: faster cold startup, cleaner lifecycle, stricter isolation, and polished UX for PAT / i18n / error routing.
-
-### Added
-
- `feat: supports claw-like products` — overlay path for Claw-style embedded editions
- `feat(plugin): inject user identity (UserID, CorpID) into stdio plugin subprocesses`
- `feat(auth): improve login UX for terminal auth denial cases` — clearer messaging + retry affordance
- `feat: PAT scope error visualization and auto-retry with authorization polling` (#113)
-  - Human-readable error output (lark-cli style) with type/message/hint/authorization command
-  - JSON payload also available via `--format json`
-  - Auto-retry once the user completes scope authorization
-
-### Changed
-
- `perf(plugin): serve plugin MCP tool list from disk cache on startup` — hot path skips Initialize+ListTools when snapshot exists
- `perf(plugin): parallelize all plugin discovery and tighten cold timeouts` — HTTP cold budget 4s → 700ms (auth) / 500ms (plain); stdio and HTTP fan out concurrently
- `perf(plugin): share cache.Store across discovery` — single `*cache.Store` above the fan-out instead of per-goroutine instances
- `refactor(plugin): remove default/managed plugin privileged mechanism` (#124) — third-party plugins install on an equal footing via `dws plugin install`
- `refactor(plugin): purge removed plugin settings instead of merely disabling` — `RemovePlugin` now deletes `EnabledPlugins` and `PluginConfigs` entries
-
-### Fixed
-
- `fix(transport): cap plugin MCP startup at ~4s when endpoints are unreachable` (#119) — eliminates the 10s `dws --help` stall caused by compounding transport timeouts
- `fix(plugin): stop stdio child processes on exit and before removal` — no more orphaned plugin subprocesses
- `fix(pat): avoid shared PAT command state in root registration` (#129)
- `fix: -f json 模式下错误 JSON 从 stdout 改为输出到 stderr` (#133) — restores CI stderr-based failure assertions
- `fix(cli): localize plugin/help command strings via i18n` (#118, #134) — zh locale now shows consistent Chinese `--help`; wraps plugin module, help command, and OAuth client-id/secret flag descriptions
- `chore: remove workspace and bundled artifacts` (#127) — clean local-only repository leftovers
-
-## [1.0.9] - 2026-04-16
-
-Plugin system launch + execution-pipeline overhaul. This is the largest release since 1.0.0: third-party MCP servers become first-class commands, the command pipeline grows to five stages, and the edition overlay gains the hooks needed for embedded hosts.
-
-### Added
-
-#### Plugin system (new)
-
- `plugin` command family: `install`, `list`, `info`, `enable`, `disable`, `remove`, `create`, `dev`, `config set/get/list/unset`
- Plugin manifest parsing/validation, managed/user directory-based identity
- MCP server conversion and injection into the dynamic routing registry
- Pipeline hook adapter for shell-based hooks
- Stdio transport: subprocess lifecycle, `DWS_PLUGIN_ROOT` / `DWS_PLUGIN_DATA` variable expansion
- Stdio server tools automatically registered as CLI subcommands (e.g. `dws hello greet --name Peter`)
- Streamable-HTTP MCP tool discovery via `registerHTTPServer`
- Updater: managed plugin update check on CLI startup (10 s timeout, best-effort)
- `dws plugin create` scaffold (plugin.json, SKILL.md, hooks.json); `dws plugin dev` source-dir registration without copy
- `SyncSkills` — copies plugin skills to agent directories on startup
- **Auth Token Registry**: per-server HTTP headers declared in `plugin.json` for third-party MCP servers (e.g. Alibaba Cloud Bailian) independent from DingTalk OAuth
- **Persistent plugin config** (`dws plugin config ...`): values persisted to `~/.dws/settings.json`, auto-injected as env vars; `${KEY}` in `plugin.json` resolves without manual `export`
- **Build lifecycle**: `build` field compiles stdio servers to native binaries at install time
- **Command-name conflict protection**: reserved built-in names (`auth`, `plugin`, `cache`, …) and plugin-vs-plugin duplicate detection
- Parallel service discovery (`sync.WaitGroup`) — startup reduced from sequential `N*10s` to parallel `max(10s)`
-
-#### Core commands & diagnostics
-
- `dws doctor` — one-stop environment/auth/network diagnostics
- `dws config list` — centralized view of scattered configuration
- Structured perf tracing (upgraded from debug tool to diagnostics output)
- `feat(skill): restore find/get for legacy skill market API` — `skill find`, `skill get`; `skill add` still uses aihub download
-
-#### Edition / overlay hooks
-
- `edition.Hooks.SaveToken` / `LoadToken` / `DeleteToken` — delegate token persistence with keychain fallback
- `edition.Hooks.AuthClientID` / `AuthClientFromMCP` — overlay can override the OAuth client ID and route auth through MCP endpoints
- `edition.Hooks.AfterPersistentPreRun` — wire non-MCP clients (e.g. A2A gateway) after root setup
- `edition.Hooks.ClassifyToolResult` — custom MCP result classification before the default business-error detection
- Token marker file (`token.json`) for embedded hosts to detect auth state without keychain access
- `pkg/runtimetoken.ResolveAccessToken` mirroring MCP auth resolution; MCP identity headers exported via `pkg/cli` for auxiliary HTTP transports
- `ExitCoder` interface — edition-specific errors carry custom exit codes
- `RawStderrError` interface — errors that bypass CLI formatting and emit raw stderr (for desktop runtimes)
-
-### Changed
-
- **Command execution pipeline: 3 → 5 stages** (`Register → PreParse → PostParse → PreRequest → PostResponse`)
- `feat(schema): return structured degraded errors instead of silent empty catalog` — new `CatalogDegraded` error with reasons `unauthenticated` / `market_unreachable` / `runtime_all_failed`; auth pre-check short-circuits doomed MCP connections
- `refactor(auth): unify auxiliary token resolution with MCP cached path` — shared `resolveAccessTokenFromDir`; overlays reuse the process-level token cache
- `feat(plugin): improve CLI overlay resolution and plugin install robustness`
-  - `plugin.json` `cli` field now accepts a file path (e.g. `"cli": "overlay.json"`) in addition to inline JSON
-  - `description` field on `CLIToolOverride` for static fallback when MCP `tools/list` is unavailable
-  - Windows install uses `cmd /C` instead of `sh -c` for build commands
-
-### Fixed
-
- `fix(plugin): harden plugin system security boundaries`
-  - Reject `file://` / local paths in git URLs; allow only `https` / `ssh`
-  - Reject symlink entries during ZIP extraction (path-traversal defense)
-  - `build.output` must be a relative path within the plugin directory
-  - Reject absolute paths in stdio command declarations
-  - Block dangerous env var names (`PATH`, `LD_PRELOAD`, …) from plugin config injection
- `fix(plugin): schema flag params, HTTP tool discovery, and integration tests`
- `fix(plugin): skip min version check in dev mode`
-
-## [1.0.8] - 2026-04-07
-
-AITable command surface expansion, installer alignment with npm conventions, and execution-timeout hardening.
-
-### Added
-
- **AITable static helper commands** (20 commands in total) replacing dynamic routing:
-  - `base`: `list`, `search`, `get`, `create`, `update`
-  - `table`: `get`, `create`, `update`
-  - `field`: `get`, `create`, `update`
-  - `record`: `query`, `create`, `update`
-  - `template`: `search`
-  - `attachment`: `upload`
- `feat(install): align skill dirs with npm and add OpenClaw` — skill install paths follow npm conventions; OpenClaw added to supported agents
- Label rendering optimization for AITable records (`to #73551688`)
- README: npm install method documented
- README: note that `dws upgrade` requires v1.0.7+
-
-### Changed
-
- `perf: optimize command timeout handling, instrumentation, and diagnostics`
-
-## [1.0.7] - 2026-04-02
-
-Self-upgrade, edition overlay foundation, and fail-closed auth enforcement.
-
-### Added
-
- **`dws upgrade`** — self-upgrade via GitHub Releases; atomic replace; cross-platform (macOS/Linux/Windows)
- `feat: edition layer for Wukong overlay` — build-time edition hook lets downstream overlays customize auth UX, config dir, static server list, visible products, and extra root commands
-  - `pkg/edition` defaults + `pkg/editiontest` contract tests
-  - `Makefile` target `edition-test`; CI job `edition-tests`
-  - Static server injection skips market discovery when configured
-  - Deduplicates top-level commands so overlay wins
-  - `hideNonDirectRuntimeCommands` respects edition `VisibleProducts`
-  - Gated `auth login` subcommand + hints for embedded editions
-  - Optional token auto-purge; edition `ConfigDir` override
- `dws version` — human-readable multi-line output plus JSON with edition, architecture, build, commit
- Tag reporting for case suites (`to #73551688`)
- `feat(auth): unify MCP retry constant and add retry to remaining endpoints`
-
-### Changed
-
- `style(auth): redesign OAuth authorization pages UI`
-
-### Fixed
-
- `fix(auth): switch CLI auth check from fail-open to fail-closed`
-  - When `/cli/cliAuthEnabled` is unreachable (network error/timeout/5xx), OAuth callback now routes to the permission request page instead of silently marking "enabled"
-  - Device Flow blocks login and asks the user to verify network connectivity
-  - `CheckCLIAuthEnabled` retries with backoff (3 attempts, 0s/1s/2s) to tolerate transient issues
-
-## [1.0.6] - 2026-04-01
-
-Error diagnostics overhaul, destructive-command confirmation, and credential auto-persistence.
-
-### Added
-
- **Interactive confirmation for destructive dynamic commands** — prompts before delete/remove operations unless `--yes` is set
- **Enhanced error diagnostics**
-  - `ServerDiagnostics` struct extracts `trace_id`, `server_error_code`, `technical_detail`, `server_retryable` from MCP responses
-  - Pulls diagnostics from JSON-RPC `error.data`, tool call result content, and HTTP headers (`X-Trace-Id`, `X-Request-Id`, `x-dingtalk-trace-id`)
-  - Three verbosity levels for `PrintHuman`: Normal (trace ID + server code), Verbose (+ technical detail), Debug (+ RPC code / operation / reason)
-  - Local logging now includes sanitized request body, response body on error, retry attempts, and classification events
-  - `TruncateBody` / `SanitizeArguments` / `RedactHeaders` helpers with sensitive-key substring detection
- **Auth credential persistence**
-  - `feat(auth): enhance device flow with CLI auth check and admin guidance`
-  - `feat(auth): persist OAuth credentials for reliable token refresh`
-  - `feat(auth): persist client credentials and optimize keychain access` — auto-persist `--client-id` / `--client-secret`; keychain credential cache to avoid repeated reads; enhanced logout cleans `app.json` + keychain secrets + `token.json`
- `add report helper with flexible date parsing and defaults`
- `feat: to #73551688 支持消息通知`
- README: Official App mode (recommended, direct login without creating an app) + Custom App mode; admin guide for enabling CLI access
-
-### Changed
-
- Getting Started simplified with inline login commands; whitelist references removed from the IMPORTANT banner
- Version bump documentation updated to v1.0.5 internal; co-creation group QR code refreshed
-
-### Fixed
-
- `fix: resolve verbosity flag lookup, FileLogger lazy binding, and business error logging`
-  - `resolveVerbosity` uses `cmd.Flags()` instead of `PersistentFlags()` so subcommands inherit `--verbose` / `--debug`
-  - `FileLogger` lazy-binds in `executeInvocation` (after `configureLogLevel` init)
-  - Business errors (HTTP 200 + `success=false`) now written to the file logger for offline diagnosis
- OAuth callback race condition (write response before sending code)
- `import path for errors package in skill_command.go`
-
-## [1.0.4] - 2026-03-30
-
-Token-refresh reliability and onboarding clarity.
-
-### Added
-
- `feat(auth): persist client credentials for token refresh` — `--client-id` / `--client-secret` are stored for automatic refresh after expiration; client secret lives in the system Keychain with a file reference
- README onboarding flow rewrite with step-by-step first-time setup and more realistic examples
- Agent skill reference polish: clearer examples, updated intent routing patterns, expanded `simple.md` onboarding, cross-skill reference fixes
-
-## [1.0.3] - 2026-03-29
-
-Filtering power, schema rendering, and a native `todo` command family.
-
-### Added
-
- **Nested / array-indexed output filtering**
-  - `--fields` now accepts dot-notation (e.g. `--fields response.content`) and array index access (e.g. `response.items[0]`)
-  - New field-path parser with recursive extraction logic
- **`schema` command enhancements**
-  - Table format output for human consumption
-  - Product-level endpoint loading in the CLI loader
-  - Schema-text rendering wired into the runner output pipeline
- **`todo` task helper family** — static `create` / `update` / `done` / `get` / `delete` with `preferLegacyLeaf` replacing dynamic commands
-  - MCP tool alignment: `create_personal_todo`, `update_todo_task`, `update_todo_done_status`, `query_todo_detail`, `delete_todo`
-  - ISO-8601 due-time parsing
-  - Hidden title aliases and delete confirmation
-  - Priority field on `todo` helper
-  - Expanded zh / en i18n coverage (fixes `en.json` spacing/wording issues)
- README restructured with collapsible feature sections
-
 ## [1.0.2] - 2026-03-29

 Deep workspace tooling upgrade: pipeline-based input correction, output filtering, enhanced stdin handling, and multi-endpoint routing.
@@ -1,6 +1,6 @@
 GO ?= go

-.PHONY: all help build rebuild test lint fmt policy edition-test package release publish-homebrew-formula setup-hooks
+.PHONY: all help build rebuild test lint fmt policy package release publish-homebrew-formula setup-hooks

 all: setup-hooks fmt lint build test rebuild

@@ -34,9 +34,6 @@ policy:
 	@./scripts/policy/check-open-source-assets.sh
 	@./scripts/policy/check-command-surface.sh --strict

-edition-test:
-	$(GO) test -v -count=1 ./pkg/editiontest/...
-
 package:
 	@./scripts/dev/build-all.sh
 	@./scripts/release/post-goreleaser.sh
@@ -9,7 +9,7 @@
 <p align="center">
  <img src="https://img.shields.io/badge/Go-1.25+-green?logo=go&logoColor=white" alt="Go 1.25+">
  <a href="https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli/blob/main/LICENSE"><img src="https://img.shields.io/badge/License-Apache_2.0-blue" alt="License Apache-2.0"></a>
-  <a href="https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli/releases"><img src="https://img.shields.io/github/v/release/DingTalk-Real-AI/dingtalk-workspace-cli?color=red&label=release" alt="Latest Release"></a>
+  <a href="https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli/releases"><img src="https://img.shields.io/badge/release-v1.0.5-red" alt="v1.0.5"></a>
  <a href="https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli/actions/workflows/ci.yml"><img src="https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli/actions/workflows/ci.yml/badge.svg" alt="CI"></a>
  <img src=".github/badges/coverage.svg" alt="Coverage">
 </p>
@@ -19,7 +19,7 @@
 </p>

 > [!IMPORTANT]
-> **Co-creation Phase**: This project accesses DingTalk enterprise data and requires enterprise admin authorization. Join the DingTalk DWS co-creation group for support and updates. See [Getting Started](#getting-started) below.
+> **Co-creation Phase**: This project accesses DingTalk enterprise data and requires enterprise admin authorization. Please join the DingTalk DWS co-creation group to complete whitelist configuration. See [Getting Started](#getting-started) below.
 >
 > <a href="https://qr.dingtalk.com/action/joingroup?code=v1,k1,v9/YMJG9qXhvFk5juktYnQziN70rF7QHebC/JLztTVRuRVJIwrSsXmL8oFqU5ajJ&_dt_no_comment=1&origin=11"><img src="https://img.alicdn.com/imgextra/i4/O1CN01Rijgk81gKqVSKMzdx_!!6000000004124-2-tps-654-644.png" alt="DingTalk Group QR Code" width="150"></a>

@@ -28,7 +28,6 @@

 - [Why dws?](#why-dws)
 - [Installation](#installation)
- [Upgrade](#upgrade)
 - [Getting Started](#getting-started)
 - [Quick Start](#quick-start)
 - [Using with Agents](#using-with-agents)
@@ -66,12 +65,6 @@ irm https://raw.githubusercontent.com/DingTalk-Real-AI/dingtalk-workspace-cli/ma
 <details>
 <summary>Other install methods</summary>

-**npm** (requires Node.js (npm/npx)):
-
-```bash
-npm install -g dingtalk-workspace-cli
-```
-
 **Pre-built binary**: download from [GitHub Releases](https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli/releases).

 > **macOS users**: If you see "cannot be opened because Apple cannot check it for malicious software", run:
@@ -92,114 +85,103 @@ cp dws ~/.local/bin/         # install to PATH

 </details>

-## Upgrade
-
-> Requires **v1.0.7** or later. For earlier versions, please re-run the [install script](#installation) to upgrade.
-
-dws has built-in self-upgrade capability. Updates are pulled directly from [GitHub Releases](https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli/releases) with SHA256 integrity verification and automatic backup.
-
-```bash
-dws upgrade                    # interactive upgrade to latest version
-dws upgrade --check            # check for new versions without installing
-dws upgrade --list             # list all available versions
-dws upgrade --version v1.0.7   # upgrade to a specific version
-dws upgrade --rollback         # rollback to the previous version
-dws upgrade -y                 # skip confirmation prompt
-```
-
-<details>
-<summary><strong>How it works</strong></summary>
-
-The upgrade process follows a two-phase atomic flow to ensure consistency:
-
-1. **Prepare** — downloads the platform-specific binary and skill packages to a temporary directory, verifies SHA256 checksums, and extracts/validates all files. If any step fails, the upgrade aborts without modifying the existing installation.
-2. **Apply** — only after all preparations succeed, the binary is replaced and skill packages are installed to all detected agent directories (`~/.agents/skills/dws`, `~/.claude/skills/dws`, `~/.cursor/skills/dws`, etc.).
-
-A backup of the current version is automatically created before each upgrade. Use `dws upgrade --rollback` to restore the previous version if needed.
-
-| Flag | Description |
-|------|-------------|
-| `--check` | Check for updates without installing |
-| `--list` | List all available versions with changelogs |
-| `--version` | Upgrade to a specific version (e.g. `v1.0.7`) |
-| `--rollback` | Rollback to the previous backed-up version |
-| `--force` | Force reinstall even if already on the latest version |
-| `--skip-skills` | Skip skill package update |
-| `-y` | Skip confirmation prompt |
-
-</details>
-
 ## Getting Started

-```bash
-dws auth login            # browser opens automatically
-dws auth login --device   # for headless environments (Docker, SSH, CI)
+### Step 1: Create a DingTalk Application
+
+Go to the [Open Platform Console](https://open-dev.dingtalk.com/fe/app?hash=%23%2Fcorp%2Fapp#/corp/app). Under "Internal Enterprise Apps - DingTalk Apps", click **Create App**.
+
+<details>
+<summary>View screenshot</summary>
+<p align="center">
+  <img src="https://img.alicdn.com/imgextra/i4/O1CN01VIkwvV1a5NQzCIFO0_!!6000000003278-2-tps-2690-1462.png" alt="Create Application" width="600">
+</p>
+</details>
+
+### Step 2: Configure Redirect URL
+
+Go to app settings → **Security Settings**. Add the following redirect URLs and save:
+
+```
+http://127.0.0.1,https://login.dingtalk.com
 ```

-Select your organization and authorize. That's it.
-
-> If your organization hasn't enabled CLI access, you'll be prompted to send an access request to your admin. Once approved, re-run `dws auth login`.
+> `http://127.0.0.1` is for local browser login; `https://login.dingtalk.com` is for `--device` device-flow login (Docker containers, remote servers, and other headless environments). We recommend configuring both.

 <details>
-<summary><strong>Organization hasn't enabled CLI access?</strong></summary>
-
-1. After selecting your organization, click "Apply Now" to notify the admin
-2. The admin receives a request card and can approve with one click
-3. Once approved, re-run `dws auth login`
-
+<summary>View screenshot</summary>
 <p align="center">
-  <img src="https://img.alicdn.com/imgextra/i2/O1CN01wtsYuQ1CTbboVTlsD_!!6000000000082-2-tps-2696-1544.png" alt="Apply for Access" width="600">
+  <img src="https://img.alicdn.com/imgextra/i4/O1CN017xQGWb1ycrAG0uxBO_!!6000000006600-2-tps-2000-1032.png" alt="Configure Redirect URL" width="600">
 </p>
-
 </details>

+### Step 3: Publish the Application
+
+Click "App Release - Version Management & Release" to publish and go live.
+
 <details>
-<summary><strong>Admin: Enable CLI access for your organization</strong></summary>
-
-Go to [Developer Platform](https://open-dev.dingtalk.com) → "CLI Access Management" → Enable.
-
+<summary>View screenshot</summary>
 <p align="center">
-  <img src="https://img.alicdn.com/imgextra/i4/O1CN01M8K7Wj1rZ0WikrZby_!!6000000005644-2-tps-2940-1596.png" alt="CLI Access Management" width="600">
+  <img src="https://img.alicdn.com/imgextra/i4/O1CN01WOLZFz244P46B3FPu_!!6000000007337-2-tps-2000-1100.png" alt="Publish Application" width="600">
 </p>
-
 </details>

-<details>
-<summary><strong>Custom App mode (CI/CD, ISV integration)</strong></summary>
+### Step 4: Request Whitelist Access

-For enterprise-managed scenarios, create your own DingTalk app:
+Join the DingTalk DWS co-creation group and provide your **Client ID** and **admin confirmation** to complete whitelist setup.

-1. [Open Platform Console](https://open-dev.dingtalk.com/fe/app#/corp/app) → Create App
-2. Security Settings → Add redirect URLs: `http://127.0.0.1,https://login.dingtalk.com`
-3. Publish the app
-4. Login:
+### Step 5: Authenticate

 ```bash
 dws auth login --client-id <your-app-key> --client-secret <your-app-secret>
 ```

-Credentials are securely persisted after first login (Keychain). Subsequent runs auto-refresh tokens.
+Or via environment variables:
+
+```bash
+export DWS_CLIENT_ID=<your-app-key>
+export DWS_CLIENT_SECRET=<your-app-secret>
+dws auth login
+```
+
+<details>
+<summary><strong>Credential Configuration Priority</strong></summary>
+
+`client-id` and `client-secret` support multiple configuration methods with the following priority (highest to lowest):
+
+| Priority | Method | Description |
+|----------|--------|-------------|
+| 1 | CLI flags / Persisted config | `--client-id` / `--client-secret` command-line arguments; auto-saved after first successful login with `client-secret` stored in system Keychain |
+| 2 | Environment variables | `DWS_CLIENT_ID` / `DWS_CLIENT_SECRET` |
+| 3 | Default values | Hardcoded defaults (for development only) |
+
+**Recommended usage**:
+- **First login**: Use `--client-id` and `--client-secret` flags; credentials are securely persisted after successful login
+- **Subsequent use**: Run `dws` commands directly; token refresh automatically reads saved credentials from Keychain
+- **CI/CD environments**: Use environment variables

 </details>

 ## Quick Start

 ```bash
-dws contact user search --query "engineering"      # search contacts
-dws calendar event list                            # list today's calendar events
-dws doc search --query "quarterly"                 # search DingTalk Docs
-dws minutes list mine                              # list AI meeting notes I created
-dws drive list                                     # list DingTalk drive files
+dws contact user search --keyword "engineering"     # search contacts
+dws calendar event list                            # list calendar events
 dws todo task create --title "Quarterly report" --executors "<your-userId>"   # create a todo (replace <your-userId>)
 dws todo task list --dry-run                       # preview without executing
 ```

-> **Full command list**: [`docs/command-index.md`](./docs/command-index.md) — all 159 commands with descriptions and when-to-use guidance.
-
 ## Using with Agents

 dws is designed as an AI-native CLI. Complete [Installation](#installation) and [Getting Started](#getting-started) first, then configure your agent:

+```bash
+# Configure auth via environment variables (recommended for agents, no interactive login)
+export DWS_CLIENT_ID=<your-app-key>
+export DWS_CLIENT_SECRET=<your-app-secret>
+dws auth login
+```
+
 ### Agent Invocation Patterns

 ```bash
@@ -352,30 +334,27 @@ dws chat message send-by-bot --robot-code BOT_CODE --group GROUP_ID \

 ## Key Services

-| Service | Command | Commands | Subcommands | Description |
-|---------|---------|:--------:|-------------|-------------|
-| Contact | `contact` | 6 | `user` `dept` | Search users by name/mobile, batch query, departments, current user profile |
-| Chat / IM | `chat` (alias `im`) | 23 | `message` `group` `bot` `conversation-info` `search` `search-common` `list-top-conversations` | Messages (send / list / list-all / by-sender / mentions / focused / unread / topic replies / search), group CRUD + member management (incl. `add-bot`), bot-identity messaging (`send-by-bot` / `recall-by-bot` / `send-by-webhook`), conversation info, common groups lookup |
-| Calendar | `calendar` | 14 | `event` `room` `participant` `busy` | Events CRUD + suggested times + attachments, meeting room booking, free-busy query, participant management |
+| Service | Command | Tools | Subcommands | Description |
+|---------|---------|:-----:|-------------|-------------|
+| Contact | `contact` | 8 | `user` `dept` | Search users by name/mobile, batch query, departments, current user profile |
+| Chat | `chat` | 14 | `message` `group` `bot` `search` | Group CRUD, member management, topic replies, send as user |
+| Bot | `chat bot` | 9 | — | Robot creation, group/single messaging, webhook, message recall |
+| Calendar | `calendar` | 13 | `event` `room` `participant` `busy` | Events CRUD, meeting room booking, free-busy query, participant management |
 | Todo | `todo` | 6 | `task` | Create, list, update, done, get detail, delete |
-| Approval | `oa` | 9 | `approval` | Approve / reject / revoke, pending / initiated instances, process list, operation records |
+| Approval | `oa` | 9 | `approval` | Approve/reject/revoke, pending tasks, initiated instances, process list |
 | Attendance | `attendance` | 4 | `record` `shift` `summary` `rules` | Clock-in records, shift schedules, attendance summary, group rules |
-| Ding | `ding` | 2 | `message` | Send / recall DING messages |
+| Ding | `ding` | 3 | `message` | Send/recall DING messages |
 | Report | `report` | 7 | `create` `list` `detail` `template` `stats` `sent` | Create reports, sent/received list, templates, statistics |
-| AI Tables | `aitable` | 41 | `base` `table` `record` `field` `view` `dashboard` `chart` `import` `export` `attachment` `template` | Full CRUD for Bases / datasheets / records / fields / views; charts & dashboards with public-share configs; data import/export; attachments; templates |
-| Doc | `doc` | 21 | `search` `list` `info` `read` `create` `update` `upload` `download` `copy` `move` `rename` `file` `folder` `block` `comment` | Search / read / write docs, file & folder create, block-level editing, comments (list / create / reply / create-inline), upload / download |
-| Drive | `drive` | 6 | `list` `info` `download` `mkdir` `upload-info` `commit` | DingTalk drive file ops: list, info, download, create folders, two-phase upload |
-| Minutes | `minutes` | 19 | `list` `get` `update` `mind-graph` `speaker` `hot-word` `upload` | List AI meeting notes (mine / shared), details (info / summary / keywords / transcription / todos / batch), title/summary updates, mind map, speaker replace, hot-word, upload session |
-| DevDoc | `devdoc` | 1 | `article` | Search the DingTalk Open Platform documentation |
+| AITable | `aitable` | 27 | `base` `table` `record` `field` `attachment` `template` | Full CRUD for bases/tables/records/fields, views, import/export, templates |
+| Workbench | `workbench` | 2 | `app` | Batch query app details |
+| DevDoc | `devdoc` | 2 | `article` | Search platform docs and error codes |

-> **159 commands across 13 products.** Full listing with descriptions and usage scenarios: [`docs/command-index.md`](./docs/command-index.md). Run `dws --help` for the top-level tree, or `dws <service> --help` for subcommands.
-
-> **Note on `chat bot`**: bot capabilities (`send-by-bot` / `recall-by-bot` / `add-bot` / `send-by-webhook` / bot search) are merged into the relevant `chat` subtrees (e.g. `dws chat message send-by-bot`, `dws chat group members add-bot`) so the agent-facing command surface stays flat and discoverable. There is no longer a separate top-level `bot` product.
+> 104 tools across 12 products. Run `dws --help` for the full list, or `dws <service> --help` for subcommands.

 <details>
 <summary>Coming soon</summary>

-`mail` (email) · `conference` (video) · `aiapp` (AI apps) · `live` (streaming) · `wiki` (knowledge base)
+`doc` (documents) · `mail` (email) · `minutes` (AI transcription) · `drive` (cloud drive) · `conference` (video) · `tb` (Teambition) · `aiapp` (AI apps) · `live` (streaming) · `skill` (marketplace)

 </details>

@@ -424,7 +403,6 @@ dws chat message send-by-bot --robot-code BOT_CODE --group GROUP_ID \

 ## Reference & Docs

- [Command Index](./docs/command-index.md) — every runtime command (159 total) with description and when-to-use guidance
 - [Reference](./docs/reference.md) — environment variables, exit codes, output formats, shell completion
 - [Architecture](./docs/architecture.md) — discovery-driven pipeline, IR, transport layer
 - [Changelog](./CHANGELOG.md) — release history and migration notes
@@ -9,7 +9,7 @@
 <p align="center">
  <img src="https://img.shields.io/badge/Go-1.25+-green?logo=go&logoColor=white" alt="Go 1.25+">
  <a href="https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli/blob/main/LICENSE"><img src="https://img.shields.io/badge/License-Apache_2.0-blue" alt="License Apache-2.0"></a>
-  <a href="https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli/releases"><img src="https://img.shields.io/github/v/release/DingTalk-Real-AI/dingtalk-workspace-cli?color=red&label=release" alt="Latest Release"></a>
+  <a href="https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli/releases"><img src="https://img.shields.io/badge/release-v1.0.5-red" alt="v1.0.5"></a>
  <a href="https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli/actions/workflows/ci.yml"><img src="https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli/actions/workflows/ci.yml/badge.svg" alt="CI"></a>
  <img src=".github/badges/coverage.svg" alt="Coverage">
 </p>
@@ -19,7 +19,7 @@
 </p>

 > [!IMPORTANT]
-> **共创阶段**：本项目涉及钉钉企业数据访问，需企业管理员授权后方可使用。欢迎加入钉钉 DWS 共创群获取支持与最新动态。详见下方 [开始使用](#开始使用)。
+> **共创阶段**：本项目涉及钉钉企业数据访问，需企业管理员授权后方可使用。当前为灰度共创阶段，请加入钉钉 DWS 共创群完成白名单配置。详见下方 [开始使用](#开始使用)。
 >
 > <a href="https://qr.dingtalk.com/action/joingroup?code=v1,k1,v9/YMJG9qXhvFk5juktYnQziN70rF7QHebC/JLztTVRuRVJIwrSsXmL8oFqU5ajJ&_dt_no_comment=1&origin=11"><img src="https://img.alicdn.com/imgextra/i4/O1CN01Rijgk81gKqVSKMzdx_!!6000000004124-2-tps-654-644.png" alt="DingTalk Group QR Code" width="150"></a>

@@ -28,7 +28,6 @@

 - [为什么选择 dws？](#why-dws)
 - [安装](#安装)
- [升级](#升级)
 - [开始使用](#开始使用)
 - [快速开始](#快速开始)
 - [在 Agent 中使用](#在-agent-中使用)
@@ -66,12 +65,6 @@ irm https://raw.githubusercontent.com/DingTalk-Real-AI/dingtalk-workspace-cli/ma
 <details>
 <summary>其他安装方式</summary>

-**npm**（需要 Node.js（npm/npx））：
-
-```bash
-npm install -g dingtalk-workspace-cli
-```
-
 **预编译二进制文件**：从 [GitHub Releases](https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli/releases) 下载。

 > **macOS 用户注意**：如果提示“无法打开，因为 Apple 无法检查其是否包含恶意软件”，请执行：
@@ -92,114 +85,103 @@ cp dws ~/.local/bin/         # 安装到 PATH

 </details>

-## 升级
-
-> 需要 **v1.0.7** 及以上版本。更早版本请重新执行[安装脚本](#安装)进行升级。
-
-dws 内置自升级能力，直接从 [GitHub Releases](https://github.com/DingTalk-Real-AI/dingtalk-workspace-cli/releases) 拉取更新，支持 SHA256 完整性校验和自动备份。
-
-```bash
-dws upgrade                    # 交互式升级到最新版本
-dws upgrade --check            # 仅检查是否有新版本
-dws upgrade --list             # 列出所有可用版本
-dws upgrade --version v1.0.7   # 升级到指定版本
-dws upgrade --rollback         # 回滚到上一版本
-dws upgrade -y                 # 跳过确认直接升级
-```
-
-<details>
-<summary><strong>工作原理</strong></summary>
-
-升级过程采用两阶段原子流程，确保一致性：
-
-1. **准备阶段** — 将平台对应的二进制文件和技能包下载到临时目录，校验 SHA256 校验和，解压并验证所有文件。任何步骤失败则立即中止，不会修改现有安装。
-2. **执行阶段** — 仅在所有准备工作成功后，替换二进制文件并将技能包安装到所有已检测到的 Agent 目录（`~/.agents/skills/dws`、`~/.claude/skills/dws`、`~/.cursor/skills/dws` 等）。
-
-每次升级前自动备份当前版本，可通过 `dws upgrade --rollback` 随时回滚。
-
-| Flag | 说明 |
-|------|------|
-| `--check` | 仅检查更新，不安装 |
-| `--list` | 列出所有可用版本及更新日志 |
-| `--version` | 升级到指定版本（如 `v1.0.7`） |
-| `--rollback` | 回滚到上一个备份版本 |
-| `--force` | 强制重新安装，即使已是最新版本 |
-| `--skip-skills` | 跳过技能包更新 |
-| `-y` | 跳过确认提示 |
-
-</details>
-
 ## 开始使用

-```bash
-dws auth login            # 自动唤起浏览器
-dws auth login --device   # 无浏览器环境（Docker、SSH、CI）
+### 步骤 1：创建钉钉应用
+
+进入 [开放平台应用开发后台](https://open-dev.dingtalk.com/fe/app?hash=%23%2Fcorp%2Fapp#/corp/app)，在「企业内部应用 - 钉钉应用」点击**创建应用**。
+
+<details>
+<summary>查看截图</summary>
+<p align="center">
+  <img src="https://img.alicdn.com/imgextra/i4/O1CN01VIkwvV1a5NQzCIFO0_!!6000000003278-2-tps-2690-1462.png" alt="创建应用" width="600">
+</p>
+</details>
+
+### 步骤 2：配置重定向 URL
+
+进入应用 → **安全设置**，在「重定向 URL」中添加以下地址并保存：
+
+```
+http://127.0.0.1,https://login.dingtalk.com
 ```

-选择组织并授权即可。
-
-> 如果组织尚未开启 CLI 访问权限，系统会引导你向管理员发送申请。审批通过后重新执行 `dws auth login` 即可。
+> `http://127.0.0.1` 用于本地浏览器登录；`https://login.dingtalk.com` 用于 `--device` 设备流登录（Docker 容器、远程服务器等无浏览器环境）。建议两个都配置。

 <details>
-<summary><strong>组织未开启 CLI 访问权限？</strong></summary>
-
-1. 选择组织后，点击「立即申请」通知管理员
-2. 管理员收到申请卡片，一键审批
-3. 审批通过后，重新执行 `dws auth login`
-
+<summary>查看截图</summary>
 <p align="center">
-  <img src="https://img.alicdn.com/imgextra/i2/O1CN01wtsYuQ1CTbboVTlsD_!!6000000000082-2-tps-2696-1544.png" alt="申请权限" width="600">
+  <img src="https://img.alicdn.com/imgextra/i4/O1CN017xQGWb1ycrAG0uxBO_!!6000000006600-2-tps-2000-1032.png" alt="配置重定向URL" width="600">
 </p>
-
 </details>

+### 步骤 3：发布应用
+
+点击「应用发布 - 版本管理与发布」，发布版本使应用上线。
+
 <details>
-<summary><strong>管理员：为组织开启 CLI 访问权限</strong></summary>
-
-进入 [开发者平台](https://open-dev.dingtalk.com) →「CLI 访问管理」→ 开启。
-
+<summary>查看截图</summary>
 <p align="center">
-  <img src="https://img.alicdn.com/imgextra/i4/O1CN01M8K7Wj1rZ0WikrZby_!!6000000005644-2-tps-2940-1596.png" alt="CLI访问管理" width="600">
+  <img src="https://img.alicdn.com/imgextra/i4/O1CN01WOLZFz244P46B3FPu_!!6000000007337-2-tps-2000-1100.png" alt="发布应用" width="600">
 </p>
-
 </details>

-<details>
-<summary><strong>自建应用模式（CI/CD、ISV 集成）</strong></summary>
+### 步骤 4：申请白名单

-企业自主管控场景，可创建自有钉钉应用：
+加入钉钉 DWS 共创群，提供 **Client ID** 和**管理员确认凭证**完成白名单配置。

-1. [开放平台应用开发后台](https://open-dev.dingtalk.com/fe/app#/corp/app) → 创建应用
-2. 安全设置 → 添加重定向 URL：`http://127.0.0.1,https://login.dingtalk.com`
-3. 发布应用
-4. 登录：
+### 步骤 5：登录认证

 ```bash
 dws auth login --client-id <your-app-key> --client-secret <your-app-secret>
 ```

-首次登录后凭证安全存储（Keychain），后续自动刷新 Token。
+或通过环境变量：
+
+```bash
+export DWS_CLIENT_ID=<your-app-key>
+export DWS_CLIENT_SECRET=<your-app-secret>
+dws auth login
+```
+
+<details>
+<summary><strong>凭证配置优先级</strong></summary>
+
+`client-id` 和 `client-secret` 支持多种配置方式，按以下优先级生效（从高到低）：
+
+| 优先级 | 配置方式 | 说明 |
+|------|----------|------|
+| 1 | CLI 参数 / 持久化配置 | `--client-id` / `--client-secret` 命令行参数；首次登录成功后自动保存，`client-secret` 存储在系统 Keychain 中 |
+| 2 | 环境变量 | `DWS_CLIENT_ID` / `DWS_CLIENT_SECRET` |
+| 3 | 默认值 | 代码中的预设值（仅开发时使用） |
+
+**推荐用法**：
+- **首次登录**：使用 `--client-id` 和 `--client-secret` 参数，登录成功后凭证会自动安全存储
+- **后续使用**：直接运行 `dws` 命令，Token 自动刷新时会从 Keychain 读取已保存的凭证
+- **CI/CD 环境**：建议使用环境变量配置

 </details>

 ## 快速开始

 ```bash
-dws contact user search --query "悟空"             # 搜索联系人
-dws calendar event list                            # 查看今天的日程
-dws doc search --query "季度"                      # 搜索钉钉文档
-dws minutes list mine                              # 列出我创建的 AI 听记
-dws drive list                                     # 列出钉盘文件
+dws contact user search --keyword "悟空"           # 搜索联系人
+dws calendar event list                            # 查看日历日程
 dws todo task create --title "季度汇报" --executors "<your-userId>"   # 创建待办（请替换为真实 userId）
 dws todo task list --dry-run                       # 预览操作但不执行
 ```

-> **完整命令列表**：[`docs/command-index.md`](./docs/command-index.md) — 全部 159 条命令，带描述和使用场景。
-
 ## 在 Agent 中使用

 dws 是为 AI Agent 设计的 CLI 工具。请先完成[安装](#安装)和[开始使用](#开始使用)，然后配置 Agent 环境：

+```bash
+# 通过环境变量配置认证（Agent 推荐方式，无需交互式登录）
+export DWS_CLIENT_ID=<your-app-key>
+export DWS_CLIENT_SECRET=<your-app-secret>
+dws auth login
+```
+
 ### Agent 调用模式

 ```bash
@@ -352,30 +334,27 @@ dws chat message send-by-bot --robot-code BOT_CODE --group GROUP_ID \

 ## 核心服务

-| 服务 | 命令 | 命令数 | 子命令 | 描述 |
+| 服务 | 命令 | 工具数 | 子命令 | 描述 |
 |------|------|:------:|--------|------|
-| 通讯录 | `contact` | 6 | `user` `dept` | 按姓名/手机号搜索、批量查询、部门树、当前用户信息 |
-| 群聊 | `chat`（别名 `im`）| 23 | `message` `group` `bot` `conversation-info` `search` `search-common` `list-top-conversations` | 消息（发送 / 列表 / list-all / 按发送者 / @我 / 关注 / 未读 / 话题回复 / 搜索）、群增删改 + 成员管理（含 `add-bot`）、机器人身份消息（`send-by-bot` / `recall-by-bot` / `send-by-webhook`）、会话信息查询、共同群聊 |
-| 日历 | `calendar` | 14 | `event` `room` `participant` `busy` | 日程 CRUD + 建议时间 + 附件、会议室预订、闲忙查询、参与者管理 |
+| 通讯录 | `contact` | 8 | `user` `dept` | 按姓名/手机号搜索、批量查询、部门树、当前用户信息 |
+| 群聊 | `chat` | 14 | `message` `group` `bot` `search` | 群增删改查、成员管理、话题回复、以用户身份发消息 |
+| 机器人 | `chat bot` | 9 | — | 机器人创建、群聊/单聊消息、Webhook、消息撤回 |
+| 日历 | `calendar` | 13 | `event` `room` `participant` `busy` | 日程增删改查、会议室预订、闲忙查询、参与者管理 |
 | 待办 | `todo` | 6 | `task` | 创建、列表、修改、完成、详情、删除 |
-| 审批 | `oa` | 9 | `approval` | 同意 / 拒绝 / 撤销、待我审批 / 我发起的、流程列表、操作记录 |
+| 审批 | `oa` | 9 | `approval` | 同意/拒绝/撤销、待我审批、我发起的、流程列表 |
 | 考勤 | `attendance` | 4 | `record` `shift` `summary` `rules` | 打卡记录、排班查询、考勤摘要、考勤组规则 |
-| DING | `ding` | 2 | `message` | 发送 / 撤回 DING 消息 |
-| 日志 | `report` | 7 | `create` `list` `detail` `template` `stats` `sent` | 创建日志、收发列表、模版、详情、统计 |
-| AI 表格 | `aitable` | 41 | `base` `table` `record` `field` `view` `dashboard` `chart` `import` `export` `attachment` `template` | Base / 数据表 / 记录 / 字段 / 视图 全量 CRUD；图表 + 仪表盘（含分享配置）；数据导入导出；附件；模板 |
-| 文档 | `doc` | 21 | `search` `list` `info` `read` `create` `update` `upload` `download` `copy` `move` `rename` `file` `folder` `block` `comment` | 搜索 / 读写文档、文件与文件夹创建、块级编辑、评论（list / create / reply / create-inline）、上传 / 下载 |
-| 钉盘 | `drive` | 6 | `list` `info` `download` `mkdir` `upload-info` `commit` | 钉盘文件操作：列表、详情、下载、创建文件夹、两阶段上传 |
-| AI 听记 | `minutes` | 19 | `list` `get` `update` `mind-graph` `speaker` `hot-word` `upload` | 听记列表（我创建 / 共享给我）、详情（info / summary / keywords / transcription / todos / batch）、标题/摘要更新、思维导图、发言人替换、热词、上传会话 |
-| 开发者文档 | `devdoc` | 1 | `article` | 搜索钉钉开放平台文档 |
+| DING | `ding` | 3 | `message` | 发送/撤回 DING 消息 |
+| 日志 | `report` | 7 | `create` `list` `detail` `template` `stats` `sent` | 创建日志、收发列表、模版、统计 |
+| 智能表格 | `aitable` | 27 | `base` `table` `record` `field` `attachment` `template` | 多维表/数据表/记录/字段全量 CRUD、视图、导入导出、模板 |
+| 工作台 | `workbench` | 2 | `app` | 批量查询应用详情 |
+| 开发者文档 | `devdoc` | 2 | `article` | 搜索开放平台文档与错误码 |

-> **13 个产品，159 条命令。** 完整命令清单（带描述与使用场景）：[`docs/command-index.md`](./docs/command-index.md)。运行 `dws --help` 查看顶层命令树，或 `dws <service> --help` 查看子命令。
-
-> **关于 `chat bot`**：机器人能力（`send-by-bot` / `recall-by-bot` / `add-bot` / `send-by-webhook` / bot 搜索）已合并到对应的 `chat` 子树下（例如 `dws chat message send-by-bot`、`dws chat group members add-bot`），保持 agent 视角下的命令面扁平易发现。不再有独立的顶层 `bot` 产品。
+> 12 个产品，104 个工具。运行 `dws --help` 查看完整列表，或 `dws <service> --help` 查看子命令。

 <details>
 <summary>即将推出</summary>

-`mail`（邮箱）· `conference`（视频会议）· `aiapp`（AI 应用）· `live`（直播）· `wiki`（知识库）
+`doc`（文档）· `mail`（邮箱）· `minutes`（AI 听记）· `drive`（钉盘）· `conference`（视频会议）· `tb`（Teambition）· `aiapp`（AI 应用）· `live`（直播）· `skill`（技能市场）

 </details>

@@ -426,7 +405,6 @@ dws chat message send-by-bot --robot-code BOT_CODE --group GROUP_ID \

 ## 参考与文档

- [命令索引](./docs/command-index.md) — 159 条运行时命令，带描述与使用场景
 - [参考手册](./docs/reference.md) — 环境变量、退出码、输出格式、Shell 补全
 - [架构设计](./docs/architecture.md) — 发现驱动管道、IR、Transport 层
 - [更新日志](./CHANGELOG.md) — 版本历史与迁移说明
@@ -52,7 +52,6 @@ __KEG_ONLY_LINE__
      Pathname.new(File.join(Dir.home, ".amp/skills/dws")),
      Pathname.new(File.join(Dir.home, ".kiro/skills/dws")),
      Pathname.new(File.join(Dir.home, ".trae/skills/dws")),
-      Pathname.new(File.join(Dir.home, ".openclaw/skills/dws")),
    ]

    targets.each_with_index do |dest, index|
@@ -7,7 +7,6 @@ const os = require("os");
 const path = require("path");
 const childProcess = require("child_process");

-// Canonical list: keep scripts/install.sh, scripts/install.ps1, scripts/install-skills.sh in sync.
 const AGENT_DIRS = [
  ".agents/skills",
  ".claude/skills",
@@ -21,7 +20,6 @@ const AGENT_DIRS = [
  ".amp/skills",
  ".kiro/skills",
  ".trae/skills",
-  ".openclaw/skills",
 ];

 const PLATFORM_MAP = {
@@ -1,323 +0,0 @@
-# dws Command Index
-
-Every runtime command the `dws` CLI exposes when loaded with the **pre** environment configuration.
-
- **Source**: `dws-wukong/envelope/channel/open/pre/config.json`
- **Products**: 13
- **Total commands**: 159
- **Generated from**: `internal/compat.BuildDynamicCommands` rendering of the pre config — the same code path the CLI uses at runtime.
-
-> Auto-generated. Edit `pre/config.json`, not this file.
-
-## Global flags
-
-Every command inherits these flags (documented here once, not repeated per command):
-
-| Flag | Purpose |
-|---|---|
-| `--client-id` | Override OAuth client ID (DingTalk AppKey) |
-| `--client-secret` | Override OAuth client secret (DingTalk AppSecret) |
-| `--debug` | Enable debug logging |
-| `--dry-run` | Preview the request without executing |
-| `--fields` | Comma-separated output field projection |
-| `-f, --format` | Output format: `json` \| `table` \| `raw` (default `json`) |
-| `--jq` | jq expression applied to JSON output |
-| `--mock` | Return mock data (developer aid) |
-| `-o, --output` | Write output to a file |
-| `--timeout` | HTTP request timeout in seconds (default 30) |
-| `--token` | Override the configured API token |
-| `-v, --verbose` | Verbose logging |
-| `-y, --yes` | Skip confirmation prompts (AI-agent mode) |
-
-## Contents
-
- [`dws aitable` — AI Tables](#dws-aitable) · 41 commands
- [`dws attendance` — Attendance](#dws-attendance) · 4 commands
- [`dws calendar` — Calendar](#dws-calendar) · 14 commands
- [`dws chat` — Group Chat / IM](#dws-chat) · 23 commands
- [`dws contact` — Contact Directory](#dws-contact) · 6 commands
- [`dws devdoc` — Open Platform Docs](#dws-devdoc) · 1 commands
- [`dws ding` — DING Messages](#dws-ding) · 2 commands
- [`dws doc` — DingTalk Doc](#dws-doc) · 21 commands
- [`dws drive` — DingTalk Drive](#dws-drive) · 6 commands
- [`dws minutes` — AI Minutes](#dws-minutes) · 19 commands
- [`dws oa` — OA Approval](#dws-oa) · 9 commands
- [`dws report` — Reports](#dws-report) · 7 commands
- [`dws todo` — Todo Tasks](#dws-todo) · 6 commands
-
-## `dws aitable` — AI Tables
-
-_AI-powered spreadsheet (Base) with datasheets, fields, records, views, dashboards, charts, import/export, attachments, and templates._
-
-**41 commands**
-
-| Command | Description | When to use |
-|---|---|---|
-| `dws aitable attachment upload` | Request an upload ticket for attaching a file to an AI table attachment-type field. Returns an upload URL and token the caller uses to stream the file. | When the agent needs to attach binary assets (images, PDFs, etc.) to records before creating or updating an attachment field value. |
-| `dws aitable base create` | Create a new AI table (Base) under the current user's workspace. Returns the newly-created Base ID. | When an agent needs to provision a fresh Base before populating datasheets, fields, and records. |
-| `dws aitable base delete` | Permanently delete an existing AI table (Base) by ID, removing all its datasheets, views, and records. | When the agent is cleaning up a Base that is no longer needed or was created for a one-off task. |
-| `dws aitable base get` | Retrieve metadata for a single AI table (Base), including name, owner, and structural summary. | When the agent needs to inspect a specific Base before performing further operations on it. |
-| `dws aitable base list` | List AI tables (Bases) accessible to the current user, paginated. | When the agent needs to enumerate the user's Bases to pick one by name or index. |
-| `dws aitable base search` | Search AI tables (Bases) the current user can access by keyword against the Base name. | When the agent knows a partial Base name and needs to resolve it to a Base ID. |
-| `dws aitable base update` | Update mutable properties of an AI table (Base), such as its name or icon. | When the agent needs to rename or rebrand an existing Base without touching its data. |
-| `dws aitable chart create` | Create a new chart inside a Base, bound to a datasheet and view with a given configuration. | When the agent is building analytics on top of a datasheet and needs to materialize a chart visualization. |
-| `dws aitable chart delete` | Delete a chart from a Base by chart ID. | When the agent needs to remove an obsolete or mistakenly-created chart. |
-| `dws aitable chart get` | Retrieve a chart's full configuration and metadata. | When the agent needs to inspect an existing chart to clone it or adjust its configuration. |
-| `dws aitable chart share get` | Retrieve the current public-sharing configuration of a chart, including share link and permissions. | When the agent needs to check whether a chart is already shared externally before issuing a link. |
-| `dws aitable chart share update` | Enable, disable, or update the public-sharing configuration of a chart. | When the agent needs to generate or revoke an external share link for a chart. |
-| `dws aitable chart update` | Update an existing chart's configuration (type, dimensions, metrics, style). | When the agent iterates on a chart's visualization after reviewing the initial result. |
-| `dws aitable chart widgets-example` | Return a reference JSON example of chart widget configuration accepted by chart create/update. | When the agent needs a schema template before composing chart configuration payloads. |
-| `dws aitable dashboard config-example` | Return a reference JSON example of dashboard configuration accepted by dashboard create/update. | When the agent needs a schema template before composing dashboard layout payloads. |
-| `dws aitable dashboard create` | Create a new dashboard inside a Base with a layout of chart widgets. | When the agent wants to group multiple charts into a single dashboard view for a report or overview page. |
-| `dws aitable dashboard delete` | Delete a dashboard from a Base by dashboard ID. | When the agent is removing an outdated dashboard. |
-| `dws aitable dashboard get` | Retrieve a dashboard's layout, widget list, and metadata. | When the agent needs to inspect a dashboard before updating it or cloning it. |
-| `dws aitable dashboard share get` | Retrieve the current public-sharing configuration of a dashboard. | When the agent needs to verify whether a dashboard has an active external share link. |
-| `dws aitable dashboard share update` | Enable, disable, or update the public-sharing configuration of a dashboard. | When the agent needs to generate or revoke an external share link for a dashboard. |
-| `dws aitable dashboard update` | Update an existing dashboard's layout, widgets, or metadata. | When the agent adds, removes, or rearranges charts on an existing dashboard. |
-| `dws aitable export data` | Export data from a datasheet (optionally scoped to a view) to a downloadable file such as Excel or CSV. | When the agent needs to hand off Base data to an external system or deliver it as an attachment. |
-| `dws aitable field create` | Create one or more fields in a datasheet with specified types and options. | When the agent is extending a datasheet's schema to capture new attributes. |
-| `dws aitable field delete` | Delete a field from a datasheet by field ID; all values in that column are removed. | When the agent is cleaning up unused or deprecated columns in a datasheet. |
-| `dws aitable field get` | Retrieve field definitions for a datasheet, including type, options, and order. | When the agent needs the field schema before constructing record payloads or queries. |
-| `dws aitable field update` | Update a field's name, type, or options in a datasheet. | When the agent needs to rename a column or change its type/options without recreating it. |
-| `dws aitable import data` | Import previously-uploaded data (e.g. Excel) into a datasheet as records, optionally creating fields. | When the agent is bulk-loading external data into a Base after a successful import upload. |
-| `dws aitable import upload` | Request an upload ticket for an import file (Excel/CSV) to be staged before calling import data. | When the agent needs to push a local dataset into a Base and must first stage the file. |
-| `dws aitable record create` | Insert one or more records into a datasheet with given field values. | When the agent needs to add new rows to a datasheet, individually or in batches. |
-| `dws aitable record delete` | Delete one or more records from a datasheet by record ID. | When the agent removes rows that are obsolete or were created in error. |
-| `dws aitable record query` | Query records from a datasheet with optional filters, sort, view scoping, and pagination. | When the agent needs to read row data to reason about it, render it, or feed it into downstream logic. |
-| `dws aitable record update` | Update field values on one or more existing records by record ID. | When the agent modifies specific row values after reading or computing new data. |
-| `dws aitable table create` | Create a new datasheet (table) inside a Base. | When the agent needs another table alongside existing ones in the same Base. |
-| `dws aitable table delete` | Delete a datasheet from a Base by table ID, removing all its records, views, and fields. | When the agent is disposing of a datasheet that is no longer needed. |
-| `dws aitable table get` | List datasheets within a Base, returning table IDs and names. | When the agent needs to resolve a table name to an ID inside a known Base. |
-| `dws aitable table update` | Update a datasheet's name or other metadata. | When the agent needs to rename a datasheet without altering its contents. |
-| `dws aitable template search` | Search the AI table template gallery by keyword. | When the agent needs to suggest or bootstrap from an existing Base template rather than building from scratch. |
-| `dws aitable view create` | Create a new view (grid, gallery, kanban, etc.) on a datasheet. | When the agent needs an alternate filtered/sorted presentation of the same datasheet data. |
-| `dws aitable view delete` | Delete a view from a datasheet by view ID. | When the agent is cleaning up unused views. |
-| `dws aitable view get` | Retrieve view definitions for a datasheet, including filter, sort, and visible-field configuration. | When the agent needs to understand or reuse a view's configuration before querying records through it. |
-| `dws aitable view update` | Update a view's name, filter, sort, grouping, or visible fields. | When the agent refines an existing view's configuration after inspection. |
-
-## `dws attendance` — Attendance
-
-_Attendance check-in records, shifts, and aggregate statistics._
-
-**4 commands**
-
-| Command | Description | When to use |
-|---|---|---|
-| `dws attendance record get` | Query a user's detailed clock-in/clock-out attendance records for a given time range. | When the agent needs to verify punctuality, pull attendance evidence, or build an attendance report for an individual. |
-| `dws attendance rules` | Query the attendance group the user belongs to along with its attendance rules (schedule, locations, shifts). | When the agent needs to know the user's expected work schedule or attendance policies before interpreting records. |
-| `dws attendance shift list` | Batch-query the assigned shifts for a set of employees over a date range. | When the agent needs to plan around team shifts or compile a shift-based roster. |
-| `dws attendance summary` | Retrieve an aggregated attendance summary for a single user (totals of late, early-leave, absence, overtime). | When the agent needs a quick attendance health check without pulling raw records. |
-
-## `dws calendar` — Calendar
-
-_Calendar events, participants, meeting rooms, and busy-status queries._
-
-**14 commands**
-
-| Command | Description | When to use |
-|---|---|---|
-| `dws calendar busy search` | Query the busy/free time windows of one or more users over a given range. | When the agent is scheduling a meeting and needs to find a slot where all attendees are free. |
-| `dws calendar event create` | Create a new calendar event on the user's calendar with title, time, attendees, and optional meeting room. | When the agent schedules a meeting or reminder on behalf of the user. |
-| `dws calendar event delete` | Delete an existing calendar event by event ID. | When the agent cancels a previously scheduled event. |
-| `dws calendar event get` | Retrieve the full details of a calendar event, including participants, location, and body. | When the agent needs to inspect an event before updating or referencing it. |
-| `dws calendar event list` | List calendar events on the user's calendar within a given time range. | When the agent needs an overview of the user's upcoming schedule or a day's agenda. |
-| `dws calendar event suggest` | Suggest candidate meeting time slots based on participants' busy/free data and constraints. | When the agent is coordinating a meeting and wants ranked time suggestions rather than raw busy data. |
-| `dws calendar event update` | Update an existing calendar event's fields such as time, title, participants, or location. | When the agent needs to reschedule or amend a previously created event. |
-| `dws calendar participant add` | Add one or more participants to an existing calendar event. | When the agent invites additional attendees after the event has been created. |
-| `dws calendar participant delete` | Remove one or more participants from an existing calendar event. | When the agent drops attendees who no longer need to join the event. |
-| `dws calendar participant list` | List current participants of a calendar event along with their response status. | When the agent needs to check who is attending before sending follow-up reminders. |
-| `dws calendar room add` | Book a specific meeting room onto an existing calendar event. | When the agent needs to attach a physical meeting room to an already-scheduled event. |
-| `dws calendar room delete` | Release a previously booked meeting room from a calendar event. | When the agent cancels or changes the room on an existing event. |
-| `dws calendar room list-groups` | List meeting room groups (usually by building or floor) available to the user. | When the agent is narrowing down rooms by location before running an availability search. |
-| `dws calendar room search` | Search meeting rooms by keyword within a group, optionally filtering to rooms free during a given window via `--available`. | When the agent needs to find a suitable room, typically free at a specific time, prior to booking. |
-
-## `dws chat` — Group Chat / IM
-
-_Group chats, conversations, messages, and robot/webhook integrations._
-
-**23 commands**
-
-| Command | Description | When to use |
-|---|---|---|
-| `dws chat bot search` | Search robots (bots) created by the current user by keyword. | When the agent needs to resolve one of its own bots by name to a robot code before sending bot messages. |
-| `dws chat conversation-info` | Retrieve basic metadata for a conversation (single chat or group chat) by conversation ID. | When the agent needs context about a conversation (name, type, member count) before operating on it. |
-| `dws chat group create` | Create a new internal group chat with a set of initial members. | When the agent needs to spin up a dedicated group for a new project, incident, or discussion thread. |
-| `dws chat group members` | List members of a group chat; can also be used against the current user to enumerate their groups' members. | When the agent needs the roster of a group before mentioning, removing, or auditing members. |
-| `dws chat group members add` | Add one or more users to an existing group chat. | When the agent expands a group to include additional participants. |
-| `dws chat group members add-bot` | Add a robot (bot) to an existing group chat so the bot can post messages there. | When the agent needs to enable bot-driven notifications in a group that does not yet contain the bot. |
-| `dws chat group members remove` | Remove one or more members from a group chat. | When the agent kicks users who should no longer have access to the group. |
-| `dws chat group rename` | Update the display name of a group chat. | When the agent is rebranding or clarifying the purpose of an existing group. |
-| `dws chat list-top-conversations` | Fetch the list of conversations the current user has pinned to the top of their chat list. | When the agent needs to prioritize the user's most important conversations in a summary or dashboard. |
-| `dws chat message list` | Pull the recent message history of a specific conversation (v2), paginated. | When the agent needs to read what has recently been said in a conversation to summarize or reason about it. |
-| `dws chat message list-all` | Search all messages across the current user's conversations within a time range. | When the agent needs to audit or summarize everything the user saw across chats in a window. |
-| `dws chat message list-by-sender` | Fetch messages authored by a specific sender across both single and group chats. | When the agent needs to pull everything a particular colleague said recently. |
-| `dws chat message list-focused` | Fetch messages from users the current user has marked as "special focus" (starred contacts). | When the agent builds a priority-inbox view highlighting messages from important people. |
-| `dws chat message list-mentions` | Fetch messages where the current user was @-mentioned. | When the agent wants to surface items that explicitly require the user's attention. |
-| `dws chat message list-topic-replies` | Pull replies under a specific group topic thread. | When the agent needs the conversation tree of a threaded discussion rather than the flat message list. |
-| `dws chat message list-unread-conversations` | Fetch the list of conversations that currently have unread messages for the user. | When the agent builds a "catch me up" triage view of what still needs reading. |
-| `dws chat message recall-by-bot` | Recall (retract) a message previously sent by a robot in a group chat. | When the agent sent a bot message in error or with incorrect content and needs to withdraw it. |
-| `dws chat message search` | Search messages by keyword across the user's conversations. | When the agent needs to locate a specific statement or link the user remembers from chat history. |
-| `dws chat message send` | Send a message into a group chat or single chat as the authenticated user. | When the agent needs to relay a response to a user or notify a group on behalf of the human operator. |
-| `dws chat message send-by-bot` | Send a group message as a specific robot (bot) the user owns. | When the agent posts automated notifications under a bot identity rather than as the user. |
-| `dws chat message send-by-webhook` | Send a group message via a custom-robot incoming webhook URL. | When the agent needs to post to a group using a webhook without requiring full bot-permission setup. |
-| `dws chat search` | Search group conversations the user belongs to by group name keyword. | When the agent needs to resolve a group name to a conversation ID. |
-| `dws chat search-common` | Find group chats the current user and a specified other user both belong to. | When the agent needs an existing shared channel to contact another user without creating a new group. |
-
-## `dws contact` — Contact Directory
-
-_Users, departments, and directory lookups._
-
-**6 commands**
-
-| Command | Description | When to use |
-|---|---|---|
-| `dws contact dept list-members` | List members of a specific department by department ID. | When the agent needs the roster of a department to target communication or build a team overview. |
-| `dws contact dept search` | Search departments in the organization's contact directory by keyword. | When the agent needs to resolve a department name to a department ID. |
-| `dws contact user get` | Batch-fetch detailed profile information for one or more users by user ID. | When the agent needs names, titles, emails, or departments for a known set of user IDs. |
-| `dws contact user get-self` | Retrieve the profile of the currently authenticated user. | When the agent needs to identify who it is acting on behalf of (user ID, name, org). |
-| `dws contact user search` | Search users in the contact directory by keyword (name, title, etc.). | When the agent needs to resolve a person's display name to a user ID. |
-| `dws contact user search-mobile` | Look up a user by mobile phone number. | When the agent has only a phone number and needs to find the corresponding DingTalk user. |
-
-## `dws devdoc` — Open Platform Docs
-
-_Search the DingTalk Open Platform documentation._
-
-**1 commands**
-
-| Command | Description | When to use |
-|---|---|---|
-| `dws devdoc article search` | Search the DingTalk Open Platform documentation by keyword. | When the agent needs authoritative API reference or guides to answer a developer question. |
-
-## `dws ding` — DING Messages
-
-_Send and recall DING messages (priority notifications)._
-
-**2 commands**
-
-| Command | Description | When to use |
-|---|---|---|
-| `dws ding message recall` | Recall (retract) a previously sent DING message. | When the agent sent a DING in error and must withdraw it before recipients act on it. |
-| `dws ding message send` | Send a DING message (high-priority notification) to one or more recipients via app/SMS/phone. | When the agent needs to page recipients with urgency beyond a normal chat message. |
-
-## `dws doc` — DingTalk Doc
-
-_DingTalk Doc: search, browse, read/write, upload/download, files, folders, blocks, comments._
-
-**21 commands**
-
-| Command | Description | When to use |
-|---|---|---|
-| `dws doc block delete` | Delete a block from a DingTalk Doc by block ID. | When the agent is editing a document and needs to remove a specific paragraph, table, or other block. |
-| `dws doc block insert` | Insert a new block (paragraph, table, image, etc.) into a DingTalk Doc at a given position. | When the agent is programmatically assembling or editing a document's content. |
-| `dws doc block list` | List the blocks of a DingTalk Doc with their IDs, types, and content. | When the agent needs the structured block tree of a doc before modifying specific blocks. |
-| `dws doc block update` | Update the content or properties of an existing block in a DingTalk Doc. | When the agent amends a specific paragraph or element without rewriting the whole document. |
-| `dws doc comment create` | Create a document-level comment on a DingTalk Doc. | When the agent leaves feedback or follow-up notes that apply to the entire document. |
-| `dws doc comment create-inline` | Create an inline (anchored) comment on a specific text range within a DingTalk Doc. | When the agent needs to attach feedback to a particular passage rather than the whole doc. |
-| `dws doc comment list` | List comments on a DingTalk Doc, including replies. | When the agent is reviewing outstanding feedback or summarizing comment threads. |
-| `dws doc comment reply` | Reply to an existing comment on a DingTalk Doc. | When the agent responds to a reviewer's comment inline rather than starting a new thread. |
-| `dws doc copy` | Copy an existing DingTalk Doc or file to a specified destination folder. | When the agent needs to duplicate a template document into a new location for reuse. |
-| `dws doc create` | Create a new DingTalk Doc (document type) in a target folder or knowledge base. | When the agent needs a fresh DingTalk Doc to write into. |
-| `dws doc download` | Download a DingTalk Doc or file to a local path. | When the agent needs the raw file locally for processing or attachment. |
-| `dws doc file create` | Create a new file node of a given type (doc, sheet, mind map, whiteboard, AI table, etc.) in a target folder. | When the agent provisions any non-plain-document file type inside DingTalk Docs. |
-| `dws doc folder create` | Create a new folder inside a DingTalk Docs knowledge base or drive location. | When the agent organizes output into a fresh folder before writing files into it. |
-| `dws doc info` | Retrieve metadata for a document or file (title, type, owner, path, permissions). | When the agent needs descriptive info about a node without fetching its full content. |
-| `dws doc list` | List the child nodes (files and subfolders) of a folder or knowledge base. | When the agent traverses the document hierarchy to find or enumerate items. |
-| `dws doc move` | Move a DingTalk Doc or file to a different folder location. | When the agent reorganizes document structure. |
-| `dws doc read` | Read the content of a DingTalk Doc as Markdown. | When the agent needs the document body as text for summarization, Q&A, or further editing. |
-| `dws doc rename` | Rename a DingTalk Doc or file. | When the agent needs to change a document's title without altering its contents or location. |
-| `dws doc search` | Search DingTalk Docs the user can access by keyword. | When the agent needs to locate a document by title or content before reading or editing it. |
-| `dws doc update` | Update the content of a DingTalk Doc (bulk content rewrite rather than block-level edit). | When the agent has freshly generated content and needs to overwrite a doc's body. |
-| `dws doc upload` | Obtain upload credentials and URL for uploading a local file as an attachment into DingTalk Docs or a knowledge base. | When the agent needs to stage a local file for attachment into the DingTalk Docs system. |
-
-## `dws drive` — DingTalk Drive
-
-_DingTalk Drive file and folder management._
-
-**6 commands**
-
-| Command | Description | When to use |
-|---|---|---|
-| `dws drive commit` | Commit a file upload to DingTalk Drive after the binary has been pushed to the presigned URL. | When the agent finalizes a Drive upload step; pairs with `drive upload-info`. |
-| `dws drive download` | Fetch a temporary download URL for a file stored in DingTalk Drive. | When the agent needs to retrieve a Drive-hosted file for local use or for handing to another service. |
-| `dws drive info` | Retrieve metadata for a file or folder in DingTalk Drive. | When the agent inspects a Drive node before downloading, moving, or listing around it. |
-| `dws drive list` | List the files and subfolders of a DingTalk Drive folder. | When the agent needs to enumerate Drive contents to find or pick items. |
-| `dws drive mkdir` | Create a new folder in DingTalk Drive. | When the agent organizes Drive output into a fresh folder before uploading files. |
-| `dws drive upload-info` | Obtain a presigned upload URL and token for pushing a local file into DingTalk Drive. | When the agent starts a Drive upload; pairs with `drive commit` to finalize. |
-
-## `dws minutes` — AI Minutes
-
-_AI meeting notes: listing, summary, todos, transcription, recording control, mind maps, speakers, hot words, uploads._
-
-**19 commands**
-
-| Command | Description | When to use |
-|---|---|---|
-| `dws minutes get batch` | Batch-fetch detailed metadata for multiple meeting notes (AI minutes) by ID. | When the agent needs to enrich a list of minutes IDs with titles, durations, and participants in one call. |
-| `dws minutes get info` | Retrieve basic metadata for a single meeting note (title, owner, time, duration, participants). | When the agent needs a header view of a specific meeting note. |
-| `dws minutes get keywords` | Retrieve the extracted keywords of a meeting note. | When the agent needs topical tags for a meeting without pulling the full transcript or summary. |
-| `dws minutes get summary` | Retrieve the AI-generated summary of a meeting note. | When the agent needs a concise recap of a meeting for reporting or follow-up. |
-| `dws minutes get todos` | Retrieve the action items (todos) extracted from a meeting note. | When the agent needs to convert meeting action items into tasks or follow up on commitments. |
-| `dws minutes get transcription` | Retrieve the raw speech-to-text transcription of a meeting note. | When the agent needs the full verbatim transcript for deep analysis or quoting. |
-| `dws minutes hot-word add` | Add a custom personal hot word to improve future speech-recognition accuracy on the user's minutes. | When the user has domain-specific jargon or proper nouns that the ASR model mistranscribes. |
-| `dws minutes list all` | List all meeting notes the user has access to, filterable by keyword and time range. | When the agent needs a broad search across the user's full minutes library. |
-| `dws minutes list mine` | List only the meeting notes the current user created. | When the agent scopes results to the user's own recordings rather than shared ones. |
-| `dws minutes list shared` | List meeting notes that have been shared with the current user by others. | When the agent wants to surface meetings the user is an invited viewer of. |
-| `dws minutes mind-graph create` | Generate a mind map from a meeting note asynchronously. | When the agent wants a structured mind-map visualization of a meeting's content. |
-| `dws minutes mind-graph status` | Query the generation status of a mind-map job and fetch the result when ready. | When the agent polls after `mind-graph create` to retrieve the finished mind map. |
-| `dws minutes replace-text` | Find and replace matching text across a meeting note's transcript paragraphs and summary. | When the agent corrects a systemic transcription mistake (e.g. wrong product name) throughout a note. |
-| `dws minutes speaker replace` | Reassign speaker labels in a meeting note (e.g. map "Speaker 1" to a specific user). | When the agent cleans up speaker diarization after automatic labels came out wrong. |
-| `dws minutes update summary` | Overwrite the summary content of a meeting note. | When the agent refines or replaces the AI-generated summary with a corrected or customized version. |
-| `dws minutes update title` | Update the title of a meeting note. | When the agent renames a meeting note for clarity before sharing or archiving. |
-| `dws minutes upload cancel` | Cancel an in-progress meeting-note file upload session. | When the agent aborts a multi-step upload due to user cancellation or upstream error. |
-| `dws minutes upload complete` | Complete an upload session and create a meeting note from the uploaded audio/video. | When the agent finalizes a minutes upload, triggering transcription and AI processing. |
-| `dws minutes upload create` | Create a file upload session for producing a meeting note from a local audio/video file. | When the agent begins uploading a recording to be turned into a meeting note. |
-
-## `dws oa` — OA Approval
-
-_OA approval workflows: list, approve, reject, revoke, records._
-
-**9 commands**
-
-| Command | Description | When to use |
-|---|---|---|
-| `dws oa approval approve` | Approve a pending approval process instance (task) as the current user. | When the agent acts on a pending approval the user has delegated it to handle. |
-| `dws oa approval detail` | Retrieve full details of an approval process instance, including form fields, attachments, and state. | When the agent needs to read the content of an approval ticket before deciding on it or summarizing it. |
-| `dws oa approval list-forms` | List approval process templates (forms) the current user is allowed to initiate. | When the agent needs to pick the right approval form before submitting a new request. |
-| `dws oa approval list-initiated` | List approval process instances the current user has initiated. | When the agent reviews the status of approvals the user submitted. |
-| `dws oa approval list-pending` | List approval process instances currently awaiting action from the current user. | When the agent surfaces "needs your approval" items in the user's inbox. |
-| `dws oa approval records` | Retrieve the operation history (who approved/commented/transferred, when) of an approval instance. | When the agent explains an approval's progression or audits who handled it. |
-| `dws oa approval reject` | Reject a pending approval process instance as the current user. | When the agent declines an approval on behalf of the user, optionally with a reason. |
-| `dws oa approval revoke` | Revoke an approval process instance previously initiated by the current user. | When the agent withdraws an approval request the user no longer wants to pursue. |
-| `dws oa approval tasks` | List pending approval task IDs assigned to the current user, used to drive approve/reject actions. | When the agent needs task IDs (not just instance IDs) before calling approve/reject. |
-
-## `dws report` — Reports
-
-_DingTalk Report feature: templates, entries, and statistics._
-
-**7 commands**
-
-| Command | Description | When to use |
-|---|---|---|
-| `dws report create` | Create a new report (DingTalk "Report" entry) based on a report template with filled-in content. | When the agent submits a daily/weekly report on behalf of the user. |
-| `dws report detail` | Retrieve the full details of a specific report entry, including fields and recipients. | When the agent needs to read a report's content for summarization or follow-up. |
-| `dws report list` | List reports the current user has received from others. | When the agent digests the user's incoming reports (e.g. team members' weeklies). |
-| `dws report sent` | List reports the current user has created and sent out. | When the agent reviews the user's own reporting history. |
-| `dws report stats` | Retrieve aggregated statistics for a report entry by ID (views, likes, comments, etc.). | When the agent measures engagement or reach of a report the user sent. |
-| `dws report template detail` | Retrieve the detailed schema of a report template by name, including required fields. | When the agent needs to know a template's field structure before calling `report create`. |
-| `dws report template list` | List the report templates the current user is allowed to use. | When the agent picks the correct report template (e.g. "weekly", "daily") before creating a report. |
-
-## `dws todo` — Todo Tasks
-
-_Personal todo task management._
-
-**6 commands**
-
-| Command | Description | When to use |
-|---|---|---|
-| `dws todo task create` | Create a personal todo item for the current user with title, due time, and optional executors. | When the agent captures an action item as a tracked todo in the user's DingTalk todo list. |
-| `dws todo task delete` | Delete a todo item by ID. | When the agent removes a todo that is no longer relevant. |
-| `dws todo task done` | Update the completion status of a todo's executor (mark done or undone). | When the agent marks an action item as completed after confirming the work is finished. |
-| `dws todo task get` | Retrieve the full details of a todo item by ID. | When the agent inspects a specific todo's content, due date, and executors. |
-| `dws todo task list` | List todos for the current user within the current organization. | When the agent surfaces the user's outstanding tasks or builds a daily focus list. |
-| `dws todo task update` | Update a todo's title, description, due time, or executors. | When the agent edits an existing todo after new information comes in. |
-
@@ -32,7 +32,6 @@ With `-f json`, error responses include structured payloads: `category`, `reason
 dws contact user search --keyword "Alice" -f table   # Table (default, human-friendly / 表格，默认)
 dws contact user search --keyword "Alice" -f json    # JSON (for agents and piping / 适合 agent)
 dws contact user search --keyword "Alice" -f raw     # Raw API response / 原始响应
-dws schema -f pretty ding.send_ding_message          # Pretty (ANSI-colored, schema-aware / 彩色分区，专为 schema 设计)
 ```

 ## Dry Run / 试运行
@@ -47,46 +46,6 @@ dws todo task list --dry-run    # Preview MCP call without executing / 预览但
 dws contact user search --keyword "Alice" -o result.json
 ```

-## Schema Introspection / Schema 查询
-
-`dws schema` 查询已发现的 MCP 产品和工具元数据。不带参数列出所有产品，带路径输出单个工具的完整 schema。
-
-### 路径写法
-
-```bash
-dws schema                                  # 列出所有产品 + 工具名
-dws schema ding.send_ding_message           # canonical: product.rpc_name
-dws schema ding.message.send                # CLI 点路径: product.group.cli_name
-dws schema "ding message send"              # CLI 空格路径（同上）
-dws schema --cli-path "ding message send"   # 显式 flag（脚本友好，免转义）
-dws schema -f pretty ding.send_ding_message # ANSI 着色分区展示（人肉查看最舒服）
-```
-
-Canonical 路径先匹配；落空后走 CLI 路径（product → group.. → cli_name）。
-
-### 单工具输出字段
-
-| 字段 | 说明 |
-|------|------|
-| `name` / `cli_name` / `canonical_path` | MCP RPC 名 / CLI 叶子名 / `product.rpc_name` |
-| `group` | CLI 父级 group 路径（dot-separated） |
-| `title` / `description` | 工具名/说明（overlay 优先） |
-| `parameters` / `required` | MCP 输入 JSON Schema 的 properties / required |
-| `output_schema` | MCP 输出 Schema（上游下发时才有） |
-| `sensitive` | 敏感写操作，需 `--yes` 确认 |
-| `annotations.destructive_hint` | 对齐 MCP 2025+ annotations，目前从 `sensitive` 映射 |
-| `flag_overlay[param]` | CLI 层对 MCP 参数的改写：`alias` / `transform` / `transform_args` / `env_default` / `default` / `hidden` |
-
-**调试 `--flag` 行为的第一站**是 `flag_overlay` —— 比如 `--users 0232...` 能不能直接用，看 `receiverUserIdList.transform == "csv_to_array"` 即可判断。
-
-### 筛选输出
-
-```bash
-dws schema ding.send_ding_message --jq '.tool.flag_overlay'       # 只看 overlay
-dws schema --jq '.products[] | {id, count: (.tools|length)}'      # 各产品工具数
-dws schema aitable.delete_base --jq '.tool.annotations'           # 敏感操作提示
-```
-
 ## Shell Completion / 自动补全

 ```bash
@@ -5,7 +5,6 @@ go 1.25.8
 require (
 	github.com/fatih/color v1.18.0
 	github.com/google/uuid v1.6.0
-	github.com/itchyny/gojq v0.12.18
 	github.com/spf13/cobra v1.10.2
 	github.com/zalando/go-keyring v0.2.8
 	golang.org/x/crypto v0.49.0
@@ -16,6 +15,7 @@ require (
 require (
 	github.com/danieljoos/wincred v1.2.3 // indirect
 	github.com/godbus/dbus/v5 v5.2.2 // indirect
+	github.com/itchyny/gojq v0.12.18 // indirect
 	github.com/itchyny/timefmt-go v0.1.7 // indirect
 	github.com/mattn/go-colorable v0.1.13 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
@@ -1,83 +0,0 @@
-// Copyright 2026 Alibaba Group
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package app
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"io"
-	"log/slog"
-	"path/filepath"
-	"strings"
-
-	authpkg "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/auth"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/edition"
-)
-
-// resolveAccessTokenFromDir loads OAuth then legacy token from configDir, applying
-// the same host compatibility hooks as MCP. It mirrors the former body of
-// getCachedRuntimeToken (excluding process-level cache and timing).
-func resolveAccessTokenFromDir(ctx context.Context, configDir string) (string, error) {
-	disc := slog.New(slog.NewTextHandler(io.Discard, nil))
-	provider := authpkg.NewOAuthProvider(configDir, disc)
-	configureOAuthProviderCompatibility(provider, configDir)
-	token, tokenErr := provider.GetAccessToken(ctx)
-	if tokenErr == nil && strings.TrimSpace(token) != "" {
-		return strings.TrimSpace(token), nil
-	}
-	if tokenErr != nil && errors.Is(tokenErr, authpkg.ErrTokenDecryption) {
-		return "", tokenErr
-	}
-	manager := authpkg.NewManager(configDir, nil)
-	configureLegacyAuthManagerCompatibility(manager)
-	if leg, _, err := manager.GetToken(); err == nil && strings.TrimSpace(leg) != "" {
-		return strings.TrimSpace(leg), nil
-	}
-	return "", nil
-}
-
-// ResolveAuxiliaryAccessToken resolves a bearer token for HTTP clients that should
-// align with MCP tool calls. Non-empty explicitToken wins. When configDir matches
-// the active edition config directory, the same process-cached path as MCP is used.
-// Otherwise tokens are loaded from configDir with host compatibility hooks applied.
-func ResolveAuxiliaryAccessToken(ctx context.Context, configDir, explicitToken string) (string, error) {
-	if t := strings.TrimSpace(explicitToken); t != "" {
-		return t, nil
-	}
-	if strings.TrimSpace(configDir) == "" {
-		return "", fmt.Errorf("config directory is empty")
-	}
-	if filepath.Clean(configDir) == filepath.Clean(defaultConfigDir()) {
-		if tok := resolveRuntimeAuthToken(ctx, ""); tok != "" {
-			return tok, nil
-		}
-		return "", noCredentialsError()
-	}
-	tok, err := resolveAccessTokenFromDir(ctx, configDir)
-	if err != nil {
-		return "", err
-	}
-	if tok != "" {
-		return tok, nil
-	}
-	return "", noCredentialsError()
-}
-
-func noCredentialsError() error {
-	if edition.Get().IsEmbedded {
-		return fmt.Errorf("认证信息已失效，请重新认证")
-	}
-	return fmt.Errorf("no credentials found, run: dws auth login")
-}
@@ -1,26 +0,0 @@
-// Copyright 2026 Alibaba Group
-// Licensed under the Apache License, Version 2.0
-
-package app
-
-import (
-	"context"
-	"testing"
-)
-
-func TestResolveAuxiliaryAccessToken_explicitToken(t *testing.T) {
-	tok, err := ResolveAuxiliaryAccessToken(context.Background(), "/any/dir", "  bearer-xyz  ")
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if tok != "bearer-xyz" {
-		t.Fatalf("got %q, want bearer-xyz", tok)
-	}
-}
-
-func TestResolveAuxiliaryAccessToken_emptyConfigDir(t *testing.T) {
-	_, err := ResolveAuxiliaryAccessToken(context.Background(), "  ", "")
-	if err == nil {
-		t.Fatal("expected error for empty config directory")
-	}
-}
@@ -24,9 +24,8 @@ import (
 	"time"

 	authpkg "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/auth"
+	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/config"
 	apperrors "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/errors"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/config"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/edition"
 	"github.com/spf13/cobra"
 )

@@ -49,9 +48,7 @@ func buildAuthCommand() *cobra.Command {
 		},
 	}

-	if !edition.Get().HideAuthLogin {
-		cmd.AddCommand(newAuthLoginCommand())
-	}
+	cmd.AddCommand(newAuthLoginCommand())
 	cmd.AddCommand(
 		newAuthLogoutCommand(),
 		newAuthStatusCommand(),
@@ -121,7 +118,6 @@ func newAuthLoginCommand() *cobra.Command {
 				}
 			}

-			ResetRuntimeTokenCache()
 			clearCompatCache()

 			w := cmd.OutOrStdout()
@@ -189,31 +185,18 @@ func newAuthLogoutCommand() *cobra.Command {
 			defer cancel()
 			_ = authpkg.RevokeTokenRemote(revokeCtx)

-			// Load token data to get associated clientId before deletion
-			var storedClientID string
-			if tokenData, err := authpkg.LoadTokenData(configDir); err == nil && tokenData != nil {
-				storedClientID = tokenData.ClientID
-			}
-
 			if err := authpkg.DeleteTokenData(configDir); err != nil {
 				return apperrors.NewInternal(fmt.Sprintf("failed to clear token data: %v", err))
 			}
-			// Clean up associated client secret from keychain
-			if storedClientID != "" {
-				_ = authpkg.DeleteClientSecret(storedClientID)
-			}
 			// Clean up app credentials (app.json + keychain secret)
 			_ = authpkg.DeleteAppConfig(configDir)
 			_ = os.Remove(filepath.Join(configDir, "mcp_url"))
 			_ = os.Remove(filepath.Join(configDir, "token"))
 			_ = os.Remove(filepath.Join(configDir, "token.json"))
-			ResetRuntimeTokenCache()
 			clearCompatCache()
 			w := cmd.OutOrStdout()
 			fmt.Fprintln(w, "[OK] 已清除所有认证信息")
-			if !edition.Get().IsEmbedded {
-				fmt.Fprintln(w, "请运行 dws auth login 重新登录")
-			}
+			fmt.Fprintln(w, "请运行 dws auth login 重新登录")
 			return nil
 		},
 	}
@@ -243,8 +226,6 @@ func newAuthStatusCommand() *cobra.Command {
 							tokenData = updatedData
 							refreshed = true
 						}
-					} else if edition.Get().AutoPurgeToken {
-						_ = authpkg.DeleteTokenData(configDir)
 					}
 				}
 				if authStatusAuthenticated(tokenData) {
@@ -272,9 +253,7 @@ func newAuthStatusCommand() *cobra.Command {
 				}
 			} else {
 				fmt.Fprintf(w, "%-16s%s\n", "状态:", "未登录")
-				if !edition.Get().IsEmbedded {
-					fmt.Fprintln(w, "运行 dws auth login 进行登录")
-				}
+				fmt.Fprintln(w, "运行 dws auth login 进行登录")
 			}
 			return nil
 		},
@@ -310,7 +289,6 @@ func newAuthExchangeCommand() *cobra.Command {
 			if err != nil {
 				return apperrors.NewAuth(fmt.Sprintf("failed to exchange authorization code: %v", err))
 			}
-			ResetRuntimeTokenCache()
 			clearCompatCache()

 			w := cmd.OutOrStdout()
@@ -350,13 +328,10 @@ func newAuthResetCommand() *cobra.Command {
 			}
 			_ = os.Remove(filepath.Join(configDir, "mcp_url"))
 			_ = os.Remove(filepath.Join(configDir, "token"))
-			ResetRuntimeTokenCache()
 			clearCompatCache()
 			w := cmd.OutOrStdout()
 			fmt.Fprintln(w, "[OK] 认证信息已重置")
-			if !edition.Get().IsEmbedded {
-				fmt.Fprintln(w, "请运行 dws auth login 重新登录")
-			}
+			fmt.Fprintln(w, "请运行 dws auth login 重新登录")
 			return nil
 		},
 	}
@@ -44,7 +44,7 @@ func TestAuthStatusRefreshFailureLeavesStoredTokenIntact(t *testing.T) {
 		CorpID:       "dingcorp",
 	})
 	if err != nil {
-		t.Skipf("SaveTokenData() unavailable in this environment: %v", err)
+		t.Fatalf("SaveTokenData() error = %v", err)
 	}

 	originalTransport := http.DefaultTransport
@@ -1,59 +0,0 @@
-// Copyright 2026 Alibaba Group
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package app
-
-import "sync"
-
-// PluginAuth holds authentication credentials for a plugin-owned
-// streamable-http MCP server. Each server is keyed by its canonical
-// product ID (CLI.ID) so that different servers can use independent
-// tokens without interfering with each other or with the default
-// DingTalk OAuth token.
-type PluginAuth struct {
-	// Token is the Bearer token extracted from the plugin's
-	// "Authorization" header (e.g. a third-party API key).
-	Token string
-
-	// ExtraHeaders contains any additional custom HTTP headers
-	// declared by the plugin (excluding Authorization).
-	ExtraHeaders map[string]string
-
-	// TrustedDomains lists the hostnames that the token is allowed
-	// to be sent to. Typically derived from the server endpoint.
-	TrustedDomains []string
-}
-
-var (
-	pluginAuthMu       sync.RWMutex
-	pluginAuthRegistry = make(map[string]*PluginAuth)
-)
-
-// RegisterPluginAuth stores authentication credentials for a plugin
-// server keyed by its canonical product ID. The runner looks up these
-// credentials at execution time to inject the correct Bearer token
-// instead of the default DingTalk OAuth token.
-func RegisterPluginAuth(productID string, auth *PluginAuth) {
-	pluginAuthMu.Lock()
-	defer pluginAuthMu.Unlock()
-	pluginAuthRegistry[productID] = auth
-}
-
-// LookupPluginAuth returns the authentication credentials registered
-// for the given product ID, or nil if none exists.
-func LookupPluginAuth(productID string) (*PluginAuth, bool) {
-	pluginAuthMu.RLock()
-	defer pluginAuthMu.RUnlock()
-	auth, ok := pluginAuthRegistry[productID]
-	return auth, ok
-}
@@ -1,213 +0,0 @@
-// Copyright 2026 Alibaba Group
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package app
-
-import (
-	"testing"
-
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/market"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/transport"
-)
-
-func TestPluginAuthRegistry(t *testing.T) {
-	// Clean up after test
-	defer func() {
-		pluginAuthMu.Lock()
-		delete(pluginAuthRegistry, "test-product")
-		pluginAuthMu.Unlock()
-	}()
-
-	// Initially not found
-	if _, ok := LookupPluginAuth("test-product"); ok {
-		t.Error("expected LookupPluginAuth to return false for unregistered product")
-	}
-
-	// Register auth credentials
-	auth := &PluginAuth{
-		Token:          "sk-test-token-12345",
-		ExtraHeaders:   map[string]string{"X-Custom": "value"},
-		TrustedDomains: []string{"api.example.com", "*.example.com"},
-	}
-	RegisterPluginAuth("test-product", auth)
-
-	// Now should be found
-	got, ok := LookupPluginAuth("test-product")
-	if !ok {
-		t.Fatal("expected LookupPluginAuth to return true after registration")
-	}
-	if got != auth {
-		t.Error("LookupPluginAuth returned different auth instance")
-	}
-	if got.Token != "sk-test-token-12345" {
-		t.Errorf("Token = %q, want sk-test-token-12345", got.Token)
-	}
-	if got.ExtraHeaders["X-Custom"] != "value" {
-		t.Errorf("ExtraHeaders[X-Custom] = %q, want value", got.ExtraHeaders["X-Custom"])
-	}
-	if len(got.TrustedDomains) != 2 {
-		t.Errorf("TrustedDomains len = %d, want 2", len(got.TrustedDomains))
-	}
-}
-
-func TestPluginAuthRegistryIsolation(t *testing.T) {
-	// Clean up after test
-	defer func() {
-		pluginAuthMu.Lock()
-		delete(pluginAuthRegistry, "product-a")
-		delete(pluginAuthRegistry, "product-b")
-		pluginAuthMu.Unlock()
-	}()
-
-	authA := &PluginAuth{Token: "token-a"}
-	authB := &PluginAuth{Token: "token-b"}
-
-	RegisterPluginAuth("product-a", authA)
-	RegisterPluginAuth("product-b", authB)
-
-	gotA, okA := LookupPluginAuth("product-a")
-	gotB, okB := LookupPluginAuth("product-b")
-
-	if !okA || !okB {
-		t.Fatal("expected both products to be registered")
-	}
-	if gotA.Token != "token-a" {
-		t.Errorf("product-a Token = %q, want token-a", gotA.Token)
-	}
-	if gotB.Token != "token-b" {
-		t.Errorf("product-b Token = %q, want token-b", gotB.Token)
-	}
-}
-
-func TestDeriveToolCLIName(t *testing.T) {
-	tests := []struct {
-		input string
-		want  string
-	}{
-		{"web_search", "web-search"},
-		{"maps.search_poi", "search-poi"},
-		{"maps.geo", "geo"},
-		{"simple", "simple"},
-		{"a.b.deep_nested_name", "deep-nested-name"},
-		{"already-kebab", "already-kebab"},
-	}
-	for _, tt := range tests {
-		t.Run(tt.input, func(t *testing.T) {
-			got := deriveToolCLIName(tt.input)
-			if got != tt.want {
-				t.Errorf("deriveToolCLIName(%q) = %q, want %q", tt.input, got, tt.want)
-			}
-		})
-	}
-}
-
-func TestRegisterPluginAuthFromHeaders(t *testing.T) {
-	// Clean up after test
-	defer func() {
-		pluginAuthMu.Lock()
-		delete(pluginAuthRegistry, "test-srv")
-		pluginAuthMu.Unlock()
-	}()
-
-	srv := market.ServerDescriptor{
-		Key:      "test-srv",
-		Endpoint: "https://api.example.com/mcp/v1",
-		CLI:      market.CLIOverlay{ID: "test-srv", Command: "test-srv"},
-		AuthHeaders: map[string]string{
-			"Authorization": "Bearer sk-my-secret-key",
-			"X-Custom":      "custom-value",
-		},
-	}
-
-	registerPluginAuthFromHeaders(srv)
-
-	auth, ok := LookupPluginAuth("test-srv")
-	if !ok {
-		t.Fatal("expected auth to be registered after registerPluginAuthFromHeaders")
-	}
-	if auth.Token != "sk-my-secret-key" {
-		t.Errorf("Token = %q, want sk-my-secret-key", auth.Token)
-	}
-	if auth.ExtraHeaders["X-Custom"] != "custom-value" {
-		t.Errorf("ExtraHeaders[X-Custom] = %q, want custom-value", auth.ExtraHeaders["X-Custom"])
-	}
-	if len(auth.TrustedDomains) != 2 {
-		t.Fatalf("TrustedDomains len = %d, want 2", len(auth.TrustedDomains))
-	}
-	if auth.TrustedDomains[0] != "api.example.com" {
-		t.Errorf("TrustedDomains[0] = %q, want api.example.com", auth.TrustedDomains[0])
-	}
-}
-
-func TestRegisterPluginAuthFromHeadersNoAuth(t *testing.T) {
-	srv := market.ServerDescriptor{
-		Key:      "no-auth-srv",
-		Endpoint: "https://api.example.com/mcp/v1",
-		CLI:      market.CLIOverlay{ID: "no-auth-srv"},
-		AuthHeaders: map[string]string{
-			"X-Custom": "custom-value",
-		},
-	}
-
-	registerPluginAuthFromHeaders(srv)
-
-	// Should not register because there's no Authorization header
-	if _, ok := LookupPluginAuth("no-auth-srv"); ok {
-		t.Error("expected no auth registration when Authorization header is missing")
-	}
-}
-
-func TestBuildPluginAuthClient(t *testing.T) {
-	base := transport.NewClient(nil)
-
-	srv := market.ServerDescriptor{
-		Endpoint: "https://dashscope.aliyuncs.com/compatible-mode/v1/mcp",
-		AuthHeaders: map[string]string{
-			"Authorization": "Bearer sk-test-api-key",
-			"X-Extra":       "extra-value",
-		},
-	}
-
-	client := buildPluginAuthClient(base, srv)
-
-	// Should return a different client instance
-	if client == base {
-		t.Error("expected buildPluginAuthClient to return a new client, not the base")
-	}
-
-	// Verify trusted domains
-	if len(client.TrustedDomains) != 2 {
-		t.Fatalf("TrustedDomains len = %d, want 2", len(client.TrustedDomains))
-	}
-	if client.TrustedDomains[0] != "dashscope.aliyuncs.com" {
-		t.Errorf("TrustedDomains[0] = %q, want dashscope.aliyuncs.com", client.TrustedDomains[0])
-	}
-}
-
-func TestBuildPluginAuthClientNoAuth(t *testing.T) {
-	base := transport.NewClient(nil)
-
-	srv := market.ServerDescriptor{
-		Endpoint: "https://api.example.com/mcp/v1",
-		AuthHeaders: map[string]string{
-			"X-Custom": "custom-value",
-		},
-	}
-
-	client := buildPluginAuthClient(base, srv)
-
-	// Should return the base client when no Authorization header
-	if client != base {
-		t.Error("expected buildPluginAuthClient to return base client when no Authorization header")
-	}
-}
@@ -16,21 +16,8 @@ package app
 import (
 	"os"
 	"path/filepath"
-
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/configmeta"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/edition"
 )

-func init() {
-	configmeta.Register(configmeta.ConfigItem{
-		Name:         "DWS_CONFIG_DIR",
-		Category:     configmeta.CategoryCore,
-		Description:  "覆盖默认配置目录 (~/.dws)",
-		DefaultValue: "~/.dws",
-		Example:      "/opt/dws/config",
-	})
-}
-
 // Build-time variables injected via ldflags when available.
 var (
 	buildTime = "unknown"
@@ -41,9 +28,7 @@ func defaultConfigDir() string {
 	if envDir := os.Getenv("DWS_CONFIG_DIR"); envDir != "" {
 		return envDir
 	}
-	if fn := edition.Get().ConfigDir; fn != nil {
-		return fn()
-	}
+
 	homeDir, err := os.UserHomeDir()
 	if err != nil {
 		return exeRelativeConfigDir()
@@ -1,165 +0,0 @@
-// Copyright 2026 Alibaba Group
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package app
-
-import (
-	"fmt"
-	"text/tabwriter"
-
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/output"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/configmeta"
-	"github.com/spf13/cobra"
-)
-
-func newConfigCommand() *cobra.Command {
-	cmd := &cobra.Command{
-		Use:               "config",
-		Short:             "配置管理",
-		Long:              "管理 DWS CLI 的配置项。查看所有支持的环境变量及其当前值。",
-		Args:              cobra.NoArgs,
-		TraverseChildren:  true,
-		DisableAutoGenTag: true,
-		RunE: func(cmd *cobra.Command, args []string) error {
-			return cmd.Help()
-		},
-	}
-	cmd.AddCommand(newConfigListCommand())
-	return cmd
-}
-
-func newConfigListCommand() *cobra.Command {
-	cmd := &cobra.Command{
-		Use:   "list",
-		Short: "列出所有可用配置项",
-		Long:  "显示 DWS CLI 支持的全部环境变量配置项，包括名称、分类、描述和默认值。",
-		RunE:  runConfigList,
-	}
-	cmd.Flags().String("category", "", "按分类过滤 (core|auth|network|security|runtime|debug|external)")
-	cmd.Flags().Bool("show-values", false, "显示配置项的当前实际值 (敏感信息会脱敏)")
-	cmd.Flags().Bool("show-hidden", false, "包含隐藏的内部调试配置项")
-	cmd.Flags().Bool("json", false, "以 JSON 格式输出")
-	return cmd
-}
-
-func runConfigList(cmd *cobra.Command, _ []string) error {
-	category, _ := cmd.Flags().GetString("category")
-	showValues, _ := cmd.Flags().GetBool("show-values")
-	showHidden, _ := cmd.Flags().GetBool("show-hidden")
-	jsonOut, _ := cmd.Flags().GetBool("json")
-
-	var items []configmeta.ConfigItem
-	if category != "" {
-		items = configmeta.ByCategory(configmeta.Category(category))
-	} else {
-		items = configmeta.All()
-	}
-
-	if !showHidden {
-		items = filterVisible(items)
-	}
-
-	if jsonOut {
-		return writeConfigJSON(cmd, items, showValues)
-	}
-	return writeConfigTable(cmd, items, showValues)
-}
-
-func filterVisible(items []configmeta.ConfigItem) []configmeta.ConfigItem {
-	out := make([]configmeta.ConfigItem, 0, len(items))
-	for _, item := range items {
-		if !item.Hidden {
-			out = append(out, item)
-		}
-	}
-	return out
-}
-
-func writeConfigJSON(cmd *cobra.Command, items []configmeta.ConfigItem, showValues bool) error {
-	type jsonItem struct {
-		Name         string `json:"name"`
-		Category     string `json:"category"`
-		Description  string `json:"description"`
-		DefaultValue string `json:"default_value,omitempty"`
-		Example      string `json:"example,omitempty"`
-		Sensitive    bool   `json:"sensitive,omitempty"`
-		CurrentValue string `json:"current_value,omitempty"`
-		IsSet        bool   `json:"is_set"`
-	}
-
-	result := make([]jsonItem, 0, len(items))
-	for _, item := range items {
-		ji := jsonItem{
-			Name:         item.Name,
-			Category:     string(item.Category),
-			Description:  item.Description,
-			DefaultValue: item.DefaultValue,
-			Example:      item.Example,
-			Sensitive:    item.Sensitive,
-		}
-		val, ok := configmeta.Resolve(item.Name)
-		ji.IsSet = ok
-		if showValues && ok {
-			ji.CurrentValue = val
-		}
-		result = append(result, ji)
-	}
-
-	return output.WriteJSON(cmd.OutOrStdout(), map[string]any{
-		"kind":    "config_list",
-		"count":   len(result),
-		"configs": result,
-	})
-}
-
-func writeConfigTable(cmd *cobra.Command, items []configmeta.ConfigItem, showValues bool) error {
-	w := cmd.OutOrStdout()
-
-	if len(items) == 0 {
-		_, _ = fmt.Fprintln(w, "没有找到匹配的配置项。")
-		return nil
-	}
-
-	tw := tabwriter.NewWriter(w, 0, 0, 2, ' ', 0)
-
-	if showValues {
-		_, _ = fmt.Fprintln(tw, "分类\t配置项\t描述\t默认值\t当前值")
-		_, _ = fmt.Fprintln(tw, "────\t──────\t────\t──────\t──────")
-	} else {
-		_, _ = fmt.Fprintln(tw, "分类\t配置项\t描述\t默认值")
-		_, _ = fmt.Fprintln(tw, "────\t──────\t────\t──────")
-	}
-
-	for _, item := range items {
-		def := item.DefaultValue
-		if def == "" {
-			def = "(空)"
-		}
-		if showValues {
-			val, ok := configmeta.Resolve(item.Name)
-			display := "(未设置)"
-			if ok {
-				display = val
-			}
-			_, _ = fmt.Fprintf(tw, "%s\t%s\t%s\t%s\t%s\n",
-				item.Category, item.Name, item.Description, def, display)
-		} else {
-			_, _ = fmt.Fprintf(tw, "%s\t%s\t%s\t%s\n",
-				item.Category, item.Name, item.Description, def)
-		}
-	}
-
-	_ = tw.Flush()
-	_, _ = fmt.Fprintf(w, "\n共 %d 个配置项。使用 --show-values 查看当前值，--show-hidden 显示隐藏项。\n", len(items))
-	return nil
-}
@@ -1,177 +0,0 @@
-// Copyright 2026 Alibaba Group
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package app
-
-import (
-	"bytes"
-	"encoding/json"
-	"strings"
-	"testing"
-
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/configmeta"
-)
-
-func seedTestConfig(t *testing.T) {
-	t.Helper()
-	configmeta.Reset()
-	t.Cleanup(configmeta.Reset)
-
-	configmeta.Register(configmeta.ConfigItem{
-		Name: "DWS_CONFIG_DIR", Category: configmeta.CategoryCore,
-		Description: "覆盖默认配置目录", DefaultValue: "~/.dws",
-	})
-	configmeta.Register(configmeta.ConfigItem{
-		Name: "DWS_CLIENT_SECRET", Category: configmeta.CategoryAuth,
-		Description: "OAuth AppSecret", Sensitive: true,
-	})
-	configmeta.Register(configmeta.ConfigItem{
-		Name: "DWS_CATALOG_FIXTURE", Category: configmeta.CategoryDebug,
-		Description: "目录 Fixture 路径", Hidden: true,
-	})
-}
-
-func TestConfigListTable(t *testing.T) {
-	seedTestConfig(t)
-
-	cmd := newConfigListCommand()
-	buf := new(bytes.Buffer)
-	cmd.SetOut(buf)
-	cmd.SetArgs([]string{})
-
-	if err := cmd.Execute(); err != nil {
-		t.Fatal(err)
-	}
-
-	out := buf.String()
-	if !strings.Contains(out, "DWS_CONFIG_DIR") {
-		t.Error("expected DWS_CONFIG_DIR in output")
-	}
-	if !strings.Contains(out, "DWS_CLIENT_SECRET") {
-		t.Error("expected DWS_CLIENT_SECRET in output")
-	}
-	// Hidden items should be excluded by default
-	if strings.Contains(out, "DWS_CATALOG_FIXTURE") {
-		t.Error("expected DWS_CATALOG_FIXTURE to be hidden")
-	}
-}
-
-func TestConfigListShowHidden(t *testing.T) {
-	seedTestConfig(t)
-
-	cmd := newConfigListCommand()
-	buf := new(bytes.Buffer)
-	cmd.SetOut(buf)
-	cmd.SetArgs([]string{"--show-hidden"})
-
-	if err := cmd.Execute(); err != nil {
-		t.Fatal(err)
-	}
-
-	out := buf.String()
-	if !strings.Contains(out, "DWS_CATALOG_FIXTURE") {
-		t.Error("expected DWS_CATALOG_FIXTURE with --show-hidden")
-	}
-}
-
-func TestConfigListCategory(t *testing.T) {
-	seedTestConfig(t)
-
-	cmd := newConfigListCommand()
-	buf := new(bytes.Buffer)
-	cmd.SetOut(buf)
-	cmd.SetArgs([]string{"--category", "auth"})
-
-	if err := cmd.Execute(); err != nil {
-		t.Fatal(err)
-	}
-
-	out := buf.String()
-	if !strings.Contains(out, "DWS_CLIENT_SECRET") {
-		t.Error("expected DWS_CLIENT_SECRET for auth category")
-	}
-	if strings.Contains(out, "DWS_CONFIG_DIR") {
-		t.Error("DWS_CONFIG_DIR should not appear for auth category")
-	}
-}
-
-func TestConfigListJSON(t *testing.T) {
-	seedTestConfig(t)
-
-	cmd := newConfigListCommand()
-	buf := new(bytes.Buffer)
-	cmd.SetOut(buf)
-	cmd.SetArgs([]string{"--json", "--show-hidden"})
-
-	if err := cmd.Execute(); err != nil {
-		t.Fatal(err)
-	}
-
-	var result map[string]any
-	if err := json.Unmarshal(buf.Bytes(), &result); err != nil {
-		t.Fatalf("invalid JSON output: %v", err)
-	}
-	if result["kind"] != "config_list" {
-		t.Errorf("expected kind=config_list, got %v", result["kind"])
-	}
-	count, ok := result["count"].(float64)
-	if !ok || count != 3 {
-		t.Errorf("expected count=3, got %v", result["count"])
-	}
-}
-
-func TestConfigListShowValues(t *testing.T) {
-	seedTestConfig(t)
-
-	t.Setenv("DWS_CONFIG_DIR", "/custom/dir")
-	t.Setenv("DWS_CLIENT_SECRET", "supersecret123")
-
-	cmd := newConfigListCommand()
-	buf := new(bytes.Buffer)
-	cmd.SetOut(buf)
-	cmd.SetArgs([]string{"--show-values"})
-
-	if err := cmd.Execute(); err != nil {
-		t.Fatal(err)
-	}
-
-	out := buf.String()
-	if !strings.Contains(out, "/custom/dir") {
-		t.Error("expected actual value for DWS_CONFIG_DIR")
-	}
-	if strings.Contains(out, "supersecret123") {
-		t.Error("sensitive value should be masked")
-	}
-	if !strings.Contains(out, "当前值") {
-		t.Error("expected '当前值' column header")
-	}
-}
-
-func TestConfigListEmpty(t *testing.T) {
-	configmeta.Reset()
-	defer configmeta.Reset()
-
-	cmd := newConfigListCommand()
-	buf := new(bytes.Buffer)
-	cmd.SetOut(buf)
-	cmd.SetArgs([]string{})
-
-	if err := cmd.Execute(); err != nil {
-		t.Fatal(err)
-	}
-
-	out := buf.String()
-	if !strings.Contains(out, "没有找到") {
-		t.Error("expected empty message")
-	}
-}
@@ -157,66 +157,6 @@ func DirectRuntimeProductIDs() map[string]bool {
 	return ids
 }

-// AppendDynamicServer adds a single server descriptor to the existing
-// dynamic server registry without replacing the current entries. This
-// is used by the plugin loader to inject plugin servers alongside
-// Market-discovered servers.
-func AppendDynamicServer(server market.ServerDescriptor) {
-	dynamicMu.Lock()
-	defer dynamicMu.Unlock()
-
-	if dynamicEndpoints == nil {
-		dynamicEndpoints = make(map[string]string)
-	}
-	if dynamicProducts == nil {
-		dynamicProducts = make(map[string]bool)
-	}
-	if dynamicAliases == nil {
-		dynamicAliases = make(map[string]string)
-	}
-	if dynamicToolEndpoints == nil {
-		dynamicToolEndpoints = make(map[string]string)
-	}
-
-	if server.CLI.Skip {
-		return
-	}
-
-	id := strings.TrimSpace(server.CLI.ID)
-	endpoint := strings.TrimSpace(server.Endpoint)
-	if id != "" && endpoint != "" {
-		dynamicEndpoints[id] = endpoint
-		dynamicProducts[id] = true
-	}
-	cmd := strings.TrimSpace(server.CLI.Command)
-	if cmd != "" && cmd != id && endpoint != "" {
-		dynamicEndpoints[cmd] = endpoint
-		dynamicProducts[cmd] = true
-	}
-	for _, alias := range server.CLI.Aliases {
-		alias = strings.TrimSpace(alias)
-		if alias != "" && endpoint != "" {
-			dynamicEndpoints[alias] = endpoint
-			dynamicProducts[alias] = true
-			dynamicAliases[alias] = id
-		}
-	}
-	if endpoint != "" {
-		for _, tool := range server.CLI.Tools {
-			toolName := strings.TrimSpace(tool.Name)
-			if toolName != "" {
-				dynamicToolEndpoints[toolName] = endpoint
-			}
-		}
-		for toolName := range server.CLI.ToolOverrides {
-			toolName = strings.TrimSpace(toolName)
-			if toolName != "" {
-				dynamicToolEndpoints[toolName] = endpoint
-			}
-		}
-	}
-}
-
 func normalizeDirectRuntimeProductID(productID string) string {
 	dynamicMu.RLock()
 	da := dynamicAliases
@@ -1,438 +0,0 @@
-// Copyright 2026 Alibaba Group
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package app
-
-import (
-	"context"
-	"fmt"
-	"io"
-	"net/http"
-	"time"
-
-	authpkg "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/auth"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/cache"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/cli"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/market"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/output"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/upgrade"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/config"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/edition"
-	"github.com/spf13/cobra"
-)
-
-// checkStatus represents the outcome of a single doctor check.
-type checkStatus string
-
-const (
-	statusPass checkStatus = "pass"
-	statusWarn checkStatus = "warn"
-	statusFail checkStatus = "fail"
-)
-
-// checkResult holds the outcome of a single doctor check.
-type checkResult struct {
-	Name    string      `json:"name"`
-	Status  checkStatus `json:"status"`
-	Message string      `json:"message"`
-	Hint    string      `json:"hint,omitempty"`
-	Detail  any         `json:"detail,omitempty"`
-}
-
-func newDoctorCommand() *cobra.Command {
-	cmd := &cobra.Command{
-		Use:               "doctor",
-		Short:             "环境健康检查",
-		Long:              "一键检查登录态、网络连通性、缓存状态和版本更新，快速定位常见问题。",
-		Args:              cobra.NoArgs,
-		DisableAutoGenTag: true,
-		RunE:              runDoctor,
-	}
-	cmd.Flags().Bool("json", false, "以 JSON 格式输出")
-	cmd.Flags().Int("timeout", 10, "网络检查超时时间 (秒)")
-	cmd.Flags().Bool("perf", false, "额外展示最近一次性能报告")
-	return cmd
-}
-
-func runDoctor(cmd *cobra.Command, _ []string) error {
-	jsonOut, _ := cmd.Flags().GetBool("json")
-	timeout, _ := cmd.Flags().GetInt("timeout")
-	if timeout <= 0 {
-		timeout = 10
-	}
-	networkTimeout := time.Duration(timeout) * time.Second
-
-	w := cmd.OutOrStdout()
-	checks := make([]checkResult, 0, 4)
-
-	authResult := doctorCheckAuth(cmd.Context(), w, jsonOut)
-	checks = append(checks, authResult)
-
-	networkResult := doctorCheckNetwork(cmd.Context(), w, jsonOut, networkTimeout)
-	checks = append(checks, networkResult)
-
-	cacheResult := doctorCheckCache(w, jsonOut)
-	checks = append(checks, cacheResult)
-
-	versionResult := doctorCheckVersion(w, jsonOut, networkTimeout)
-	checks = append(checks, versionResult)
-
-	showPerf, _ := cmd.Flags().GetBool("perf")
-	if showPerf {
-		perfResult := doctorCheckPerf(w, jsonOut)
-		checks = append(checks, perfResult)
-	}
-
-	pass, warn, fail := countResults(checks)
-
-	if jsonOut {
-		result := map[string]any{
-			"kind":   "doctor",
-			"checks": checks,
-			"summary": map[string]int{
-				"pass": pass,
-				"warn": warn,
-				"fail": fail,
-			},
-		}
-		if showPerf {
-			if report, err := LoadLatestReport(); err == nil {
-				result["perf_report"] = report
-			}
-		}
-		return output.WriteJSON(w, result)
-	}
-
-	fmt.Fprintf(w, "\n诊断完成: %d 项通过, %d 项警告, %d 项失败\n", pass, warn, fail)
-	if fail > 0 {
-		return fmt.Errorf("诊断发现 %d 项失败", fail)
-	}
-	return nil
-}
-
-// ── Auth check ──────────────────────────────────────────────────────────
-
-func doctorCheckAuth(ctx context.Context, w io.Writer, jsonOut bool) checkResult {
-	if !jsonOut {
-		fmt.Fprint(w, "检查登录状态...       ")
-	}
-
-	configDir := defaultConfigDir()
-	provider := authpkg.NewOAuthProvider(configDir, nil)
-	configureOAuthProviderCompatibility(provider, configDir)
-
-	data, err := provider.Status()
-	if err != nil || data == nil {
-		r := checkResult{Name: "auth", Status: statusFail, Message: "未登录"}
-		if !edition.Get().IsEmbedded {
-			r.Hint = "运行 dws auth login 进行登录"
-		}
-		if !jsonOut {
-			printCheckResult(w, r)
-		}
-		return r
-	}
-
-	if data.IsAccessTokenValid() || data.IsRefreshTokenValid() {
-		if !data.IsAccessTokenValid() {
-			refreshCtx, cancel := context.WithTimeout(ctx, 15*time.Second)
-			_, refreshErr := provider.GetAccessToken(refreshCtx)
-			cancel()
-			if refreshErr != nil {
-				r := checkResult{
-					Name:    "auth",
-					Status:  statusWarn,
-					Message: "Refresh Token 有效, 但自动刷新 Access Token 失败",
-					Hint:    "运行 dws auth login 重新登录",
-				}
-				if !jsonOut {
-					printCheckResult(w, r)
-				}
-				return r
-			}
-		}
-
-		r := checkResult{
-			Name:    "auth",
-			Status:  statusPass,
-			Message: "已登录",
-		}
-		if !jsonOut {
-			printCheckResult(w, r)
-		}
-		return r
-	}
-
-	r := checkResult{Name: "auth", Status: statusFail, Message: "登录已过期"}
-	if !edition.Get().IsEmbedded {
-		r.Hint = "运行 dws auth login 重新登录"
-	}
-	if !jsonOut {
-		printCheckResult(w, r)
-	}
-	return r
-}
-
-// ── Network check ───────────────────────────────────────────────────────
-
-func doctorCheckNetwork(ctx context.Context, w io.Writer, jsonOut bool, timeout time.Duration) checkResult {
-	if !jsonOut {
-		fmt.Fprint(w, "检查网络连通性...     ")
-	}
-
-	baseURL := cli.DefaultMarketBaseURL
-	httpClient := &http.Client{Timeout: timeout}
-	client := market.NewClient(baseURL, httpClient)
-
-	start := time.Now()
-	reqCtx, cancel := context.WithTimeout(ctx, timeout)
-	defer cancel()
-
-	_, err := client.FetchServers(reqCtx, 1)
-	latency := time.Since(start)
-
-	if err != nil {
-		r := checkResult{
-			Name:    "network",
-			Status:  statusFail,
-			Message: fmt.Sprintf("mcp.dingtalk.com 不可达: %v", err),
-			Hint:    "请检查网络连接或代理设置",
-		}
-		if !jsonOut {
-			printCheckResult(w, r)
-		}
-		return r
-	}
-
-	r := checkResult{
-		Name:    "network",
-		Status:  statusPass,
-		Message: fmt.Sprintf("mcp.dingtalk.com 可达 (延迟 %dms)", latency.Milliseconds()),
-	}
-	if !jsonOut {
-		printCheckResult(w, r)
-	}
-	return r
-}
-
-// ── Cache check ─────────────────────────────────────────────────────────
-
-func doctorCheckCache(w io.Writer, jsonOut bool) checkResult {
-	if !jsonOut {
-		fmt.Fprint(w, "检查缓存状态...       ")
-	}
-
-	store := cacheStoreFromEnv()
-	files, _, err := cacheDirectoryStats(store.Root)
-	if err != nil {
-		r := checkResult{
-			Name:    "cache",
-			Status:  statusFail,
-			Message: fmt.Sprintf("缓存目录不可读: %v", err),
-			Hint:    "运行 dws cache clean 清理后重试",
-		}
-		if !jsonOut {
-			printCheckResult(w, r)
-		}
-		return r
-	}
-
-	entries, _ := store.ListToolsCacheEntries(config.DefaultPartition)
-
-	if files == 0 && len(entries) == 0 {
-		r := checkResult{
-			Name:    "cache",
-			Status:  statusWarn,
-			Message: "缓存为空 (首次使用)",
-			Hint:    "运行任意 dws 命令后将自动建立缓存",
-		}
-		if !jsonOut {
-			printCheckResult(w, r)
-		}
-		return r
-	}
-
-	staleCount := 0
-	for _, e := range entries {
-		if e.Freshness == cache.FreshnessStale {
-			staleCount++
-		}
-	}
-
-	if staleCount > 0 {
-		r := checkResult{
-			Name:    "cache",
-			Status:  statusWarn,
-			Message: fmt.Sprintf("%d 个文件, %d 个工具缓存, %d 个已过期", files, len(entries), staleCount),
-			Hint:    "运行 dws cache refresh 刷新缓存",
-		}
-		if !jsonOut {
-			printCheckResult(w, r)
-		}
-		return r
-	}
-
-	msg := fmt.Sprintf("%d 个文件, %d 个工具缓存", files, len(entries))
-	if len(entries) > 0 {
-		msg += ", 全部新鲜"
-	}
-	r := checkResult{
-		Name:    "cache",
-		Status:  statusPass,
-		Message: msg,
-	}
-	if !jsonOut {
-		printCheckResult(w, r)
-	}
-	return r
-}
-
-// ── Version check ───────────────────────────────────────────────────────
-
-func doctorCheckVersion(w io.Writer, jsonOut bool, timeout time.Duration) checkResult {
-	if !jsonOut {
-		fmt.Fprint(w, "检查版本更新...       ")
-	}
-
-	currentVer := version
-
-	client := upgrade.NewClient()
-	latest, err := client.FetchLatestRelease()
-	if err != nil {
-		r := checkResult{
-			Name:    "version",
-			Status:  statusFail,
-			Message: fmt.Sprintf("无法获取最新版本: %v", err),
-			Hint:    "请检查网络连接",
-		}
-		if !jsonOut {
-			printCheckResult(w, r)
-		}
-		return r
-	}
-
-	if upgrade.NeedsUpgrade(currentVer, latest.Version) {
-		r := checkResult{
-			Name:    "version",
-			Status:  statusWarn,
-			Message: fmt.Sprintf("有新版本 (当前 %s, 最新 v%s)", ensureV(currentVer), latest.Version),
-			Hint:    "运行 dws upgrade 升级到最新版本",
-		}
-		if !jsonOut {
-			printCheckResult(w, r)
-		}
-		return r
-	}
-
-	r := checkResult{
-		Name:    "version",
-		Status:  statusPass,
-		Message: fmt.Sprintf("已是最新版本 %s", ensureV(currentVer)),
-	}
-	if !jsonOut {
-		printCheckResult(w, r)
-	}
-	return r
-}
-
-// ── Output helpers ──────────────────────────────────────────────────────
-
-func printCheckResult(w io.Writer, r checkResult) {
-	icon := statusIcon(r.Status)
-	fmt.Fprintf(w, "%s %s\n", icon, r.Message)
-	if r.Hint != "" {
-		fmt.Fprintf(w, "                      %s\n", r.Hint)
-	}
-}
-
-func statusIcon(s checkStatus) string {
-	switch s {
-	case statusPass:
-		return "✅"
-	case statusWarn:
-		return "⚠️"
-	case statusFail:
-		return "❌"
-	default:
-		return "?"
-	}
-}
-
-func countResults(checks []checkResult) (pass, warn, fail int) {
-	for _, c := range checks {
-		switch c.Status {
-		case statusPass:
-			pass++
-		case statusWarn:
-			warn++
-		case statusFail:
-			fail++
-		}
-	}
-	return
-}
-
-// ── Perf report check ──────────────────────────────────────────────────
-
-func doctorCheckPerf(w io.Writer, jsonOut bool) checkResult {
-	if !jsonOut {
-		fmt.Fprint(w, "检查性能报告...       ")
-	}
-
-	report, err := LoadLatestReport()
-	if err != nil {
-		r := checkResult{
-			Name:    "perf",
-			Status:  statusWarn,
-			Message: "未找到性能报告",
-			Hint:    "设置 DWS_PERF_REPORT=auto 后运行任意命令生成报告",
-		}
-		if !jsonOut {
-			printCheckResult(w, r)
-		}
-		return r
-	}
-
-	r := checkResult{
-		Name:    "perf",
-		Status:  statusPass,
-		Message: fmt.Sprintf("报告可用 (%s, %s)", report.Command, report.Timestamp.Local().Format("2006-01-02 15:04")),
-	}
-	if !jsonOut {
-		printCheckResult(w, r)
-		printPerfReportSummary(w, report)
-	}
-	return r
-}
-
-func printPerfReportSummary(w io.Writer, report *PerfReport) {
-	fmt.Fprintf(w, "\n最近一次性能报告 (%s, %s):\n",
-		report.Command, report.Timestamp.Local().Format("2006-01-02 15:04"))
-
-	for _, p := range report.Phases {
-		marker := ""
-		if p.Name == report.Slowest {
-			marker = "  ← 最慢"
-		}
-		fmt.Fprintf(w, "  %-25s %dms%s\n", p.Name, p.DurationMs, marker)
-	}
-	fmt.Fprintf(w, "  %-25s ─────────\n", "─────────────────────────")
-	fmt.Fprintf(w, "  %-25s %dms  (框架开销 %dms)\n", "总耗时", report.TotalMs, report.OverheadMs)
-}
-
-func formatLocalTime(t time.Time) string {
-	if t.IsZero() {
-		return ""
-	}
-	return t.Local().Format("2006-01-02 15:04")
-}
@@ -1,172 +0,0 @@
-// Copyright 2026 Alibaba Group
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package app
-
-import (
-	"bytes"
-	"encoding/json"
-	"strings"
-	"testing"
-)
-
-func TestCountResults(t *testing.T) {
-	checks := []checkResult{
-		{Status: statusPass},
-		{Status: statusPass},
-		{Status: statusWarn},
-		{Status: statusFail},
-	}
-	pass, warn, fail := countResults(checks)
-	if pass != 2 || warn != 1 || fail != 1 {
-		t.Errorf("expected (2,1,1), got (%d,%d,%d)", pass, warn, fail)
-	}
-}
-
-func TestCountResultsAllPass(t *testing.T) {
-	checks := []checkResult{
-		{Status: statusPass},
-		{Status: statusPass},
-	}
-	pass, warn, fail := countResults(checks)
-	if pass != 2 || warn != 0 || fail != 0 {
-		t.Errorf("expected (2,0,0), got (%d,%d,%d)", pass, warn, fail)
-	}
-}
-
-func TestStatusIcon(t *testing.T) {
-	tests := []struct {
-		status checkStatus
-		want   string
-	}{
-		{statusPass, "✅"},
-		{statusWarn, "⚠️"},
-		{statusFail, "❌"},
-	}
-	for _, tc := range tests {
-		got := statusIcon(tc.status)
-		if got != tc.want {
-			t.Errorf("statusIcon(%q) = %q, want %q", tc.status, got, tc.want)
-		}
-	}
-}
-
-func TestPrintCheckResult(t *testing.T) {
-	var buf bytes.Buffer
-	r := checkResult{
-		Name:    "test",
-		Status:  statusFail,
-		Message: "something broke",
-		Hint:    "try fixing it",
-	}
-	printCheckResult(&buf, r)
-
-	out := buf.String()
-	if !strings.Contains(out, "❌") {
-		t.Error("expected fail icon")
-	}
-	if !strings.Contains(out, "something broke") {
-		t.Error("expected message")
-	}
-	if !strings.Contains(out, "try fixing it") {
-		t.Error("expected hint")
-	}
-}
-
-func TestPrintCheckResultNoHint(t *testing.T) {
-	var buf bytes.Buffer
-	r := checkResult{
-		Name:    "test",
-		Status:  statusPass,
-		Message: "all good",
-	}
-	printCheckResult(&buf, r)
-
-	out := buf.String()
-	if !strings.Contains(out, "✅") {
-		t.Error("expected pass icon")
-	}
-	lines := strings.Split(strings.TrimSpace(out), "\n")
-	if len(lines) != 1 {
-		t.Errorf("expected 1 line (no hint), got %d", len(lines))
-	}
-}
-
-func TestDoctorCheckCacheEmpty(t *testing.T) {
-	t.Setenv("DWS_CACHE_DIR", t.TempDir())
-
-	var buf bytes.Buffer
-	r := doctorCheckCache(&buf, false)
-
-	if r.Status != statusWarn {
-		t.Errorf("expected warn for empty cache, got %s", r.Status)
-	}
-	if !strings.Contains(r.Message, "缓存为空") {
-		t.Errorf("expected empty cache message, got %q", r.Message)
-	}
-}
-
-func TestDoctorCheckCacheEmptyJSON(t *testing.T) {
-	t.Setenv("DWS_CACHE_DIR", t.TempDir())
-
-	var buf bytes.Buffer
-	r := doctorCheckCache(&buf, true)
-
-	if r.Status != statusWarn {
-		t.Errorf("expected warn for empty cache, got %s", r.Status)
-	}
-	if buf.Len() != 0 {
-		t.Error("expected no output in JSON mode")
-	}
-}
-
-func TestDoctorCommandStructure(t *testing.T) {
-	cmd := newDoctorCommand()
-	if cmd.Use != "doctor" {
-		t.Errorf("Use = %q, want doctor", cmd.Use)
-	}
-
-	jsonFlag := cmd.Flags().Lookup("json")
-	if jsonFlag == nil {
-		t.Error("expected --json flag")
-	}
-	timeoutFlag := cmd.Flags().Lookup("timeout")
-	if timeoutFlag == nil {
-		t.Error("expected --timeout flag")
-	}
-}
-
-func TestCheckResultJSONMarshal(t *testing.T) {
-	r := checkResult{
-		Name:    "auth",
-		Status:  statusPass,
-		Message: "已登录",
-	}
-	data, err := json.Marshal(r)
-	if err != nil {
-		t.Fatal(err)
-	}
-	var parsed map[string]any
-	if err := json.Unmarshal(data, &parsed); err != nil {
-		t.Fatal(err)
-	}
-	if parsed["name"] != "auth" {
-		t.Errorf("expected name=auth, got %v", parsed["name"])
-	}
-	if parsed["status"] != "pass" {
-		t.Errorf("expected status=pass, got %v", parsed["status"])
-	}
-	if _, hasHint := parsed["hint"]; hasHint {
-		t.Error("empty hint should be omitted")
-	}
-}
@@ -14,7 +14,6 @@
 package app

 import (
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/i18n"
 	"github.com/spf13/cobra"
 )

@@ -36,12 +35,12 @@ type GlobalFlags struct {
 }

 func bindPersistentFlags(cmd *cobra.Command, flags *GlobalFlags) {
-	cmd.PersistentFlags().StringVar(&flags.ClientID, "client-id", "", i18n.T("覆盖 OAuth 客户端 ID (钉钉 AppKey)"))
-	cmd.PersistentFlags().StringVar(&flags.ClientSecret, "client-secret", "", i18n.T("覆盖 OAuth 客户端密钥 (钉钉 AppSecret)"))
+	cmd.PersistentFlags().StringVar(&flags.ClientID, "client-id", "", "Override OAuth client ID (DingTalk AppKey)")
+	cmd.PersistentFlags().StringVar(&flags.ClientSecret, "client-secret", "", "Override OAuth client secret (DingTalk AppSecret)")
 	cmd.PersistentFlags().BoolVar(&flags.Debug, "debug", false, "显示调试日志")
 	cmd.PersistentFlags().BoolVar(&flags.DryRun, "dry-run", false, "预览操作内容，不实际执行")
 	cmd.PersistentFlags().StringVar(&flags.Fields, "fields", "", "筛选输出字段 (逗号分隔, 如: name,id,status)")
-	cmd.PersistentFlags().StringVarP(&flags.Format, "format", "f", "json", "输出格式: json|table|raw|pretty")
+	cmd.PersistentFlags().StringVarP(&flags.Format, "format", "f", "json", "输出格式: json|table|raw")
 	cmd.PersistentFlags().StringVar(&flags.JQ, "jq", "", "jq 表达式过滤输出 (如: '.items[] | .name')")
 	cmd.PersistentFlags().BoolVar(&flags.Mock, "mock", false, "使用 Mock 数据 (开发调试用)")
 	cmd.PersistentFlags().StringVarP(&flags.Output, "output", "o", "", "Write command output to a file")
@@ -216,10 +216,10 @@ func TestRootHelpCustomizationDoesNotAffectSubcommandHelp(t *testing.T) {
 	}
 }

-func TestRootCommandRegistersUpgradeCommand(t *testing.T) {
+func TestRootCommandDoesNotRegisterUpgradeCommand(t *testing.T) {
 	root := NewRootCommand()
-	if cmd := lookupCommand(root, "upgrade"); cmd == nil {
-		t.Fatal("upgrade command should be registered on root, but was not found")
+	if cmd := lookupCommand(root, "upgrade"); cmd != nil {
+		t.Fatalf("findCommand(upgrade) = %q, want nil", cmd.CommandPath())
 	}
 }

@@ -1,21 +0,0 @@
-// Copyright 2026 Alibaba Group
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package app
-
-// MCPIdentityHeaders returns the same header map used for MCP HTTP requests
-// (agent identity, env trace headers, edition MergeHeaders). Intended for
-// non-MCP transports such as the A2A gateway client.
-func MCPIdentityHeaders() map[string]string {
-	return resolveIdentityHeaders()
-}
@@ -16,6 +16,7 @@ package app
 import (
 	"context"
 	"encoding/json"
+	"fmt"
 	"log/slog"
 	"net"
 	"net/http"
@@ -29,25 +30,16 @@ import (
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/cli"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/cobracmd"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/compat"
+	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/config"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/executor"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/helpers"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/market"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/config"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/edition"
 	"github.com/spf13/cobra"
 )

 func newLegacyPublicCommands(ctx context.Context, runner executor.Runner) []*cobra.Command {
-	if fn := edition.Get().StaticServers; fn != nil {
-		injectStaticServers(fn())
-		// Static servers provided by the edition hook — skip Market discovery
-		// entirely. The overlay registers its own product commands via
-		// RegisterExtraCommands; we only add the open-source helpers here.
-		commands := helpers.NewPublicCommands(runner)
-		return mergeTopLevelCommands(commands)
-	}
-
 	var commands []*cobra.Command
+	// Generate commands dynamically from the market discovery API.
 	if dynamicCmds := loadDynamicCommands(ctx, runner); len(dynamicCmds) > 0 {
 		commands = append(commands, dynamicCmds...)
 	}
@@ -55,26 +47,6 @@ func newLegacyPublicCommands(ctx context.Context, runner executor.Runner) []*cob
 	return mergeTopLevelCommands(commands)
 }

-// injectStaticServers converts edition.ServerInfo entries into
-// market.ServerDescriptor and feeds them into SetDynamicServers so the
-// direct-runtime endpoint resolver can find them.
-func injectStaticServers(servers []edition.ServerInfo) {
-	descriptors := make([]market.ServerDescriptor, 0, len(servers))
-	for _, s := range servers {
-		descriptors = append(descriptors, market.ServerDescriptor{
-			Key:         s.ID,
-			DisplayName: s.Name,
-			Endpoint:    s.Endpoint,
-			CLI: market.CLIOverlay{
-				ID:       s.ID,
-				Command:  s.ID,
-				Prefixes: s.Prefixes,
-			},
-		})
-	}
-	SetDynamicServers(descriptors)
-}
-
 // loadDynamicCommands loads the server registry and generates CLI commands
 // dynamically from CLIOverlay metadata. It consults the disk cache first.
 // Within the short revalidation window it uses the cached registry directly;
@@ -88,6 +60,13 @@ func injectStaticServers(servers []edition.ServerInfo) {
 // Tests may override discoveryBaseURLOverride to redirect to a local server;
 // in that case the registry cache is always bypassed.
 func loadDynamicCommands(ctx context.Context, runner executor.Runner) []*cobra.Command {
+	totalStart := time.Now()
+	defer func() {
+		if os.Getenv("DWS_PERF_DEBUG") != "" {
+			_, _ = fmt.Fprintf(os.Stderr, "[PERF] loadDynamicCommands total: %v\n", time.Since(totalStart))
+		}
+	}()
+
 	store := cacheStoreFromEnv()
 	partition := config.DefaultPartition

@@ -100,13 +79,18 @@ func loadDynamicCommands(ctx context.Context, runner executor.Runner) []*cobra.C
 	// --- Cache-first server registry ---
 	cacheLoadStart := time.Now()
 	snapshot, freshness, cacheErr := store.LoadRegistry(partition)
-	RecordTiming(ctx, "registry_cache", time.Since(cacheLoadStart))
+	if os.Getenv("DWS_PERF_DEBUG") != "" {
+		_, _ = fmt.Fprintf(os.Stderr, "[PERF] cache load: %v (err=%v)\n", time.Since(cacheLoadStart), cacheErr)
+	}

 	var servers []market.ServerDescriptor
 	now := store.Now().UTC()
 	usingCachedRegistry := useCache && cacheErr == nil && len(snapshot.Servers) > 0

 	if usingCachedRegistry {
+		if os.Getenv("DWS_PERF_DEBUG") != "" {
+			_, _ = fmt.Fprintf(os.Stderr, "[PERF] using cached registry: servers=%d, freshness=%s\n", len(snapshot.Servers), freshness)
+		}
 		servers = snapshot.Servers
 		// Only trigger async revalidation in production (no URL override).
 		// Tests set discoveryBaseURLOverride and control cache expiry directly,
@@ -122,10 +106,15 @@ func loadDynamicCommands(ctx context.Context, runner executor.Runner) []*cobra.C
 		if discoveryBaseURLOverride != "" {
 			baseURL = discoveryBaseURLOverride
 		}
+		if os.Getenv("DWS_PERF_DEBUG") != "" {
+			_, _ = fmt.Fprintf(os.Stderr, "[PERF] fetching from market API: %s\n", baseURL)
+		}
 		fetchStart := time.Now()
 		client := market.NewClient(baseURL, ipv4OnlyHTTPClient())
 		resp, fetchErr := client.FetchServers(ctx, config.DefaultFetchServersLimit)
-		RecordTiming(ctx, "market_fetch", time.Since(fetchStart))
+		if os.Getenv("DWS_PERF_DEBUG") != "" {
+			_, _ = fmt.Fprintf(os.Stderr, "[PERF] market API fetch: %v (err=%v)\n", time.Since(fetchStart), fetchErr)
+		}
 		if fetchErr != nil {
 			slog.Debug("loadDynamicCommands: market API fetch failed", "error", fetchErr)
 			// Degrade to stale cache if available (production only).
@@ -137,13 +126,18 @@ func loadDynamicCommands(ctx context.Context, runner executor.Runner) []*cobra.C
 			}
 		} else {
 			servers = market.NormalizeServers(resp, "market")
+			if os.Getenv("DWS_PERF_DEBUG") != "" {
+				_, _ = fmt.Fprintf(os.Stderr, "[PERF] normalized servers: %d\n", len(servers))
+			}
 			// Persist fresh data (only in non-test mode).
 			if useCache {
 				saveStart := time.Now()
 				if saveErr := store.SaveRegistry(partition, cache.RegistrySnapshot{Servers: servers}); saveErr != nil {
 					slog.Debug("loadDynamicCommands: failed to save registry cache", "error", saveErr)
 				}
-				RecordTiming(ctx, "cache_save", time.Since(saveStart))
+				if os.Getenv("DWS_PERF_DEBUG") != "" {
+					_, _ = fmt.Fprintf(os.Stderr, "[PERF] cache save: %v\n", time.Since(saveStart))
+				}
 			}
 		}
 	}
@@ -156,11 +150,15 @@ func loadDynamicCommands(ctx context.Context, runner executor.Runner) []*cobra.C

 	detailStart := time.Now()
 	detailsByID := loadCachedDetailsFast(store, servers)
-	RecordTiming(ctx, "tool_metadata", time.Since(detailStart))
+	if os.Getenv("DWS_PERF_DEBUG") != "" {
+		_, _ = fmt.Fprintf(os.Stderr, "[PERF] load details: %v\n", time.Since(detailStart))
+	}

 	buildStart := time.Now()
 	cmds := compat.BuildDynamicCommands(servers, runner, detailsByID)
-	RecordTiming(ctx, "build_commands", time.Since(buildStart))
+	if os.Getenv("DWS_PERF_DEBUG") != "" {
+		_, _ = fmt.Fprintf(os.Stderr, "[PERF] build commands: %v (count=%d)\n", time.Since(buildStart), len(cmds))
+	}

 	return cmds
 }
@@ -1,577 +0,0 @@
-// Copyright 2026 Alibaba Group
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package app
-
-import (
-	"context"
-	"encoding/json"
-	stderrors "errors"
-	"fmt"
-	"io"
-	"log/slog"
-	"net/http"
-	"net/url"
-	"os"
-	"os/exec"
-	"regexp"
-	"runtime"
-	"strings"
-	"time"
-
-	authpkg "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/auth"
-	apperrors "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/errors"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/executor"
-	"github.com/fatih/color"
-)
-
-const (
-	// PatAuthRetryTimeout is the maximum time to wait for user authorization
-	// when a PAT scope error is detected.
-	PatAuthRetryTimeout = 10 * time.Minute
-
-	// PatAuthPollInterval is how often we poll to check if the user has
-	// completed authorization.
-	PatAuthPollInterval = 5 * time.Second
-)
-
-// PatScopeError holds information about a missing PAT scope.
-type PatScopeError struct {
-	OriginalError string
-	Identity      string
-	ErrorType     string
-	Message       string
-	Hint          string
-	MissingScope  string
-}
-
-func (e *PatScopeError) Error() string {
-	return e.OriginalError
-}
-
-// patScopeRegex matches PAT-protocol scope error patterns from the API.
-// Only matches explicit scope-related keywords; generic "permission denied" or
-// "forbidden" are intentionally excluded to avoid false positives on business
-// authorization errors (e.g. mailbox access denied, 403 Forbidden).
-var patScopeRegex = regexp.MustCompile(`(?i)(missing_scope|insufficient_scope|scope.*required)`)
-
-// scopeValueRegex extracts a scope identifier (e.g. "calendar:read",
-// "mail:user_mailbox.message:send") from an error message.
-// Supports multi-segment scopes with multiple colons (resource:sub:action).
-var scopeValueRegex = regexp.MustCompile(`([a-zA-Z][a-zA-Z0-9_.]*(?::[a-zA-Z][a-zA-Z0-9_.]*)+)`)
-
-// identityValueRegex extracts an identity label from an error message.
-var identityValueRegex = regexp.MustCompile(`(?i)identity["\s:]+([a-zA-Z_]+)`)
-
-// isPatScopeError checks if an error looks like a PAT scope/permission error
-// that can be resolved by re-authorizing with additional scopes.
-func isPatScopeError(err error) bool {
-	if err == nil {
-		return false
-	}
-	msg := strings.ToLower(err.Error())
-
-	// Check for missing_scope pattern in error message or hint
-	if patScopeRegex.MatchString(msg) {
-		return true
-	}
-
-	var typed *apperrors.Error
-	if stderrors.As(err, &typed) {
-		// Check message, reason, and hint for scope-related patterns
-		fullText := strings.ToLower(typed.Message + " " + typed.Reason + " " + typed.Hint)
-		if typed.Category == apperrors.CategoryAuth {
-			if strings.Contains(fullText, "missing_scope") || strings.Contains(fullText, "insufficient_scope") ||
-				(strings.Contains(fullText, "scope") && strings.Contains(fullText, "required")) {
-				return true
-			}
-		}
-		// Any category with scope/permission hints
-		if strings.Contains(fullText, "missing_scope") || strings.Contains(fullText, "insufficient_scope") {
-			return true
-		}
-	}
-
-	return false
-}
-
-// extractPatScopeError parses an error to extract PAT scope details.
-func extractPatScopeError(err error) *PatScopeError {
-	if err == nil {
-		return nil
-	}
-
-	msg := err.Error()
-	scope := ""
-
-	var typed *apperrors.Error
-	if stderrors.As(err, &typed) {
-		msg = typed.Message
-		if typed.Reason != "" {
-			msg += " (" + typed.Reason + ")"
-		}
-	}
-
-	// Try to extract scope value (e.g. "calendar:read") from error message.
-	scopeMatch := scopeValueRegex.FindStringSubmatch(msg)
-	if len(scopeMatch) > 1 {
-		scope = scopeMatch[1]
-	}
-
-	// Try to extract identity from error message.
-	identity := "user"
-	identityMatch := identityValueRegex.FindStringSubmatch(msg)
-	if len(identityMatch) > 1 {
-		identity = identityMatch[1]
-	}
-
-	return &PatScopeError{
-		OriginalError: err.Error(),
-		Identity:      identity,
-		ErrorType:     "missing_scope",
-		Message:       msg,
-		Hint:          fmt.Sprintf("run `dws auth login --scope %q` to authorize the missing scope", scope),
-		MissingScope:  scope,
-	}
-}
-
-// PrintPatAuthError prints a human-readable PAT authorization error.
-func PrintPatAuthError(w io.Writer, scopeErr *PatScopeError) {
-	bold := color.New(color.Bold).SprintFunc()
-	cyan := color.New(color.FgCyan).SprintFunc()
-	dim := color.New(color.Faint).SprintFunc()
-	green := color.New(color.FgGreen).SprintFunc()
-
-	fmt.Fprintln(w)
-	fmt.Fprintf(w, "{\n")
-	fmt.Fprintf(w, "  %s: %s,\n", bold("\"ok\""), "false")
-	fmt.Fprintf(w, "  %s: %q,\n", bold("\"identity\""), scopeErr.Identity)
-	fmt.Fprintf(w, "  %s: {\n", bold("\"error\""))
-	fmt.Fprintf(w, "    %s: %q,\n", bold("\"type\""), scopeErr.ErrorType)
-	fmt.Fprintf(w, "    %s: %q,\n", bold("\"message\""), scopeErr.Message)
-	fmt.Fprintf(w, "    %s: %q\n", bold("\"hint\""), scopeErr.Hint)
-	fmt.Fprintf(w, "  }\n")
-	fmt.Fprintf(w, "}\n")
-	fmt.Fprintln(w)
-
-	// Print authorization instructions
-	fmt.Fprintf(w, "%s %s\n", green("▶"), bold("需要额外授权"))
-	fmt.Fprintln(w)
-	fmt.Fprintf(w, "  %s %s\n", dim("#"), dim("运行以下命令完成授权"))
-
-	if scopeErr.MissingScope != "" {
-		fmt.Fprintf(w, "  %s %s\n", cyan("$"), cyan(fmt.Sprintf("dws auth login --scope %q", scopeErr.MissingScope)))
-	} else {
-		fmt.Fprintf(w, "  %s %s\n", cyan("$"), cyan("dws auth login"))
-	}
-
-	fmt.Fprintln(w)
-	fmt.Fprintf(w, "  %s 在浏览器中打开授权链接，完成授权后重新执行命令\n", dim("ℹ"))
-	fmt.Fprintln(w)
-}
-
-// PrintPatAuthJSON prints a machine-readable PAT authorization error.
-func PrintPatAuthJSON(w io.Writer, scopeErr *PatScopeError) {
-	payload := map[string]any{
-		"ok":       false,
-		"identity": scopeErr.Identity,
-		"error": map[string]any{
-			"type":    scopeErr.ErrorType,
-			"message": scopeErr.Message,
-			"hint":    scopeErr.Hint,
-		},
-	}
-	if scopeErr.MissingScope != "" {
-		payload["missing_scope"] = scopeErr.MissingScope
-	}
-
-	data, _ := json.MarshalIndent(payload, "", "  ")
-	fmt.Fprintln(w, string(data))
-}
-
-// WaitForPatAuthorization polls until the user completes authorization or timeout.
-// It returns true if authorization was completed, false if timed out or cancelled.
-func WaitForPatAuthorization(ctx context.Context, configDir string, output io.Writer) bool {
-	bold := color.New(color.Bold).SprintFunc()
-	yellow := color.New(color.FgYellow).SprintFunc()
-	green := color.New(color.FgGreen).SprintFunc()
-	red := color.New(color.FgRed).SprintFunc()
-	dim := color.New(color.Faint).SprintFunc()
-
-	timeout := PatAuthRetryTimeout
-	deadline := time.Now().Add(timeout)
-	pollTicker := time.NewTicker(PatAuthPollInterval)
-	defer pollTicker.Stop()
-	start := time.Now()
-
-	fmt.Fprintln(output)
-	fmt.Fprintf(output, "%s %s\n", yellow("⏳"), bold("等待用户授权..."))
-	fmt.Fprintf(output, "  %s 请在另一个终端完成 dws auth login 授权\n", dim("ℹ"))
-	fmt.Fprintf(output, "  %s 超时时间: %s\n", dim("⏱"), timeout)
-	fmt.Fprintln(output)
-
-	pollCount := 0
-	for {
-		select {
-		case <-ctx.Done():
-			fmt.Fprintf(output, "%s 操作已取消\n", red("✗"))
-			return false
-
-		case <-time.After(time.Until(deadline)):
-			fmt.Fprintf(output, "%s 等待授权超时 (%s)\n", red("✗"), timeout)
-			fmt.Fprintf(output, "  %s 请重新执行命令\n", dim("ℹ"))
-			return false
-
-		case <-pollTicker.C:
-			pollCount++
-			elapsed := time.Since(start).Truncate(time.Second)
-			remaining := time.Until(deadline).Truncate(time.Second)
-
-			// Check if token is now valid
-			tokenData, err := authpkg.LoadTokenData(configDir)
-			if err == nil && tokenData != nil {
-				if tokenData.IsAccessTokenValid() || tokenData.IsRefreshTokenValid() {
-					fmt.Fprintf(output, "\r%s %s (%s 已用, %s 剩余)          \n",
-						green("✓"), bold("授权成功!"), elapsed, remaining)
-					fmt.Fprintln(output)
-					return true
-				}
-			}
-
-			// Show polling status
-			fmt.Fprintf(output, "\r%s [%d] 等待授权中... (%s 已用, %s 剩余)          ",
-				dim("⟳"), pollCount, elapsed, remaining)
-		}
-	}
-}
-
-// retryWithPatAuthRetry wraps an invocation that failed with a PAT scope error.
-// It waits for the user to complete authorization and then retries the invocation.
-func retryWithPatAuthRetry(ctx context.Context, runner executor.Runner, invocation executor.Invocation, scopeErr *PatScopeError, configDir string, output io.Writer) (executor.Result, error) {
-	// Print the PAT error in human-readable format
-	PrintPatAuthError(output, scopeErr)
-
-	// Wait for user to complete authorization
-	authorized := WaitForPatAuthorization(ctx, configDir, output)
-	if !authorized {
-		return executor.Result{}, apperrors.NewAuth(
-			"等待用户授权超时",
-			apperrors.WithReason("pat_auth_timeout"),
-			apperrors.WithHint(fmt.Sprintf("授权超时 (%s)，请重新执行命令", PatAuthRetryTimeout)),
-			apperrors.WithActions("dws auth login"),
-		)
-	}
-
-	// Clear the token cache so the new token is loaded
-	ResetRuntimeTokenCache()
-
-	// Retry the invocation
-	fmt.Fprintln(output)
-	fmt.Fprintf(output, "%s %s\n", color.New(color.FgGreen).SprintFunc()("▶"),
-		color.New(color.Bold).SprintFunc()("授权完成，正在重试..."))
-	fmt.Fprintln(output)
-
-	return runner.Run(ctx, invocation)
-}
-
-// ---- handlePatAuthCheck (runner.go entry point) -----------------------------
-
-const (
-	// patPollInterval is how often we poll the device flow status endpoint.
-	patPollInterval = 2 * time.Second
-	// patPollTimeout is the maximum time to wait for user authorization via device flow.
-	patPollTimeout = 10 * time.Minute
-)
-
-// patRetryingKey is a context key to prevent recursive PAT auth checks.
-// After APPROVED, the retry should not trigger another PAT flow.
-type patRetryingKeyType struct{}
-
-var patRetryingKey = patRetryingKeyType{}
-
-// IsPatRetrying returns true if the current context is already in a PAT retry.
-func IsPatRetrying(ctx context.Context) bool {
-	v, _ := ctx.Value(patRetryingKey).(bool)
-	return v
-}
-
-// handlePatAuthCheck is called by runner.executeInvocation when a PAT
-// authorization error is detected.  It injects the server-assigned clientId
-// as x-robot-uid header, prints authorization details, opens the browser,
-// polls the device flow endpoint until the user authorizes, and retries the
-// original invocation on success.
-func handlePatAuthCheck(
-	ctx context.Context,
-	r *runtimeRunner,
-	invocation executor.Invocation,
-	patErr *apperrors.PATError,
-	configDir string,
-	output io.Writer,
-) (executor.Result, error) {
-	// Parse authorization details from PATError.RawJSON.
-	var patData struct {
-		Code string `json:"code"`
-		Data struct {
-			Desc         string `json:"desc"`
-			FlowID       string `json:"flowId"`
-			URI          string `json:"uri"`
-			ClientID     string `json:"clientId"`
-			ClientSecret string `json:"clientSecret"`
-		} `json:"data"`
-	}
-	if err := json.Unmarshal([]byte(patErr.RawJSON), &patData); err != nil {
-		return executor.Result{}, patErr
-	}
-
-	slog.Debug("PAT auth check",
-		"clientId", patData.Data.ClientID,
-		"flowId", patData.Data.FlowID,
-		"hasSecret", patData.Data.ClientSecret != "",
-	)
-
-	// Inject clientId/clientSecret from PAT response as runtime credentials
-	// so that subsequent device flow auth uses the server-assigned app identity.
-	if patData.Data.ClientID != "" {
-		if patData.Data.ClientSecret != "" {
-			// When both clientId and clientSecret are provided, use direct mode
-			// (DingTalk API) rather than MCP proxy — the MCP proxy does not hold
-			// the secret for this particular app.
-			authpkg.SetClientID(patData.Data.ClientID)
-			authpkg.SetClientSecret(patData.Data.ClientSecret)
-		} else {
-			// No clientSecret — rely on MCP proxy to manage the secret server-side.
-			authpkg.SetClientIDFromMCP(patData.Data.ClientID)
-		}
-
-		// Persist clientId (and optionally secret) to ~/.dws/app.json so that
-		// future process invocations can load it at startup and populate
-		// DWS_CLIENT_ID env before the first MCP request.
-		appCfg := &authpkg.AppConfig{
-			ClientID: patData.Data.ClientID,
-		}
-		if patData.Data.ClientSecret != "" {
-			appCfg.ClientSecret = authpkg.PlainSecret(patData.Data.ClientSecret)
-		}
-		if err := authpkg.SaveAppConfig(configDir, appCfg); err != nil {
-			slog.Warn("failed to persist app config from PAT", "error", err)
-			fmt.Fprintf(output, "  \u26a0 保存应用配置失败: %v (下次启动可能需要重新授权)\n", err)
-		}
-	}
-
-	bold := color.New(color.Bold).SprintFunc()
-	cyan := color.New(color.FgCyan).SprintFunc()
-	greenFn := color.New(color.FgGreen).SprintFunc()
-	yellowFn := color.New(color.FgYellow).SprintFunc()
-	redFn := color.New(color.FgRed).SprintFunc()
-	dim := color.New(color.Faint).SprintFunc()
-
-	fmt.Fprintln(output)
-	fmt.Fprintf(output, "%s %s\n", greenFn("▶"), bold("需要 PAT 授权"))
-	if patData.Data.Desc != "" {
-		fmt.Fprintf(output, "  %s %s\n", dim("ℹ"), patData.Data.Desc)
-	}
-	if patData.Data.URI != "" {
-		fmt.Fprintf(output, "  %s %s\n\n", dim("🔗"), cyan(patData.Data.URI))
-		// Best-effort browser open.
-		_ = tryOpenBrowser(patData.Data.URI)
-	}
-
-	// If no flowId, we can't poll — fall back to returning PATError for host-app.
-	if patData.Data.FlowID == "" {
-		fmt.Fprintln(output)
-		return executor.Result{}, patErr
-	}
-
-	// Poll the device flow status until user authorizes, rejects, or timeout.
-	fmt.Fprintf(output, "%s %s\n", yellowFn("⏳"), bold("等待用户授权..."))
-	fmt.Fprintf(output, "  %s 请在浏览器中完成授权，超时时间: %s\n", dim("ℹ"), patPollTimeout)
-	fmt.Fprintln(output)
-
-	pollCtx, cancel := context.WithTimeout(ctx, patPollTimeout)
-	defer cancel()
-
-	status, authCode, err := pollPatDeviceFlow(pollCtx, patData.Data.FlowID, configDir, output)
-	if err != nil {
-		fmt.Fprintf(output, "%s 轮询授权状态失败: %v\n", redFn("✗"), err)
-		return executor.Result{}, patErr
-	}
-
-	switch status {
-	case authpkg.StatusApproved:
-		fmt.Fprintf(output, "%s %s\n", greenFn("✓"), bold("授权成功!"))
-		fmt.Fprintln(output)
-
-		// Exchange authCode for a fresh access token (mirrors device_flow loginOnce).
-		if authCode != "" {
-			slog.Debug("PAT retry: exchanging authCode for token", "hasCode", true)
-			tokenData, exchErr := authpkg.ExchangeCodeForToken(ctx, configDir, authCode)
-			if exchErr != nil {
-				slog.Warn("PAT retry: exchangeCode failed, retrying with existing token", "error", exchErr)
-				fmt.Fprintf(output, "  %s 换取新 token 失败: %v (将使用现有凭证重试)\n", yellowFn("⚠"), exchErr)
-			} else {
-				if err := authpkg.SaveTokenData(configDir, tokenData); err != nil {
-					slog.Warn("PAT retry: failed to save new token", "error", err)
-					fmt.Fprintf(output, "  %s 保存新 token 失败: %v\n", yellowFn("⚠"), err)
-				} else {
-					slog.Debug("PAT retry: token refreshed and saved")
-				}
-			}
-		}
-
-		// Clear token cache so the new credentials take effect.
-		ResetRuntimeTokenCache()
-
-		// Workaround: brief delay to let server-side authorization state propagate
-		// before retrying.  Without this the retry may use stale credentials.
-		slog.Debug("PAT retry: waiting for server-side state propagation", "delay", "1s")
-		time.Sleep(1 * time.Second)
-
-		// Retry the original invocation with pat-retrying flag to prevent recursion.
-		fmt.Fprintf(output, "%s %s\n", greenFn("▶"), bold("授权完成，正在重试..."))
-		fmt.Fprintln(output)
-		slog.Debug("PAT retry: identity env check",
-			"DWS_CLIENT_ID", os.Getenv("DWS_CLIENT_ID"),
-		)
-		retryCtx := context.WithValue(ctx, patRetryingKey, true)
-		return r.Run(retryCtx, invocation)
-
-	case authpkg.StatusRejected:
-		fmt.Fprintf(output, "%s %s\n", redFn("✗"), bold("用户已拒绝授权"))
-		return executor.Result{}, apperrors.NewAuth(
-			"用户已拒绝授权",
-			apperrors.WithReason("pat_auth_rejected"),
-			apperrors.WithHint("用户在浏览器中拒绝了授权请求，请重新执行命令。"),
-		)
-
-	case authpkg.StatusExpired:
-		fmt.Fprintf(output, "%s %s\n", redFn("✗"), bold("授权超时"))
-		return executor.Result{}, apperrors.NewAuth(
-			"授权超时",
-			apperrors.WithReason("pat_auth_expired"),
-			apperrors.WithHint("授权链接已过期，请重新执行命令。"),
-		)
-
-	case authpkg.StatusCancelled:
-		fmt.Fprintf(output, "%s %s\n", redFn("✗"), bold("操作已取消"))
-		return executor.Result{}, apperrors.NewAuth(
-			"操作已取消",
-			apperrors.WithReason("pat_auth_cancelled"),
-			apperrors.WithHint("用户取消了授权操作。"),
-		)
-
-	default:
-		fmt.Fprintf(output, "%s 未知授权状态: %s\n", redFn("✗"), status)
-		return executor.Result{}, patErr
-	}
-}
-
-// pollPatDeviceFlow polls the PAT device flow status endpoint until a terminal
-// state (APPROVED/REJECTED/EXPIRED) is reached or the context is cancelled.
-// Returns the final status string and the authCode (non-empty only on APPROVED).
-func pollPatDeviceFlow(ctx context.Context, flowID string, configDir string, output io.Writer) (string, string, error) {
-	pollURL := fmt.Sprintf("%s%s?flowId=%s",
-		authpkg.GetMCPBaseURL(), authpkg.DevicePollPath, url.QueryEscape(flowID))
-
-	// Load user access token for the poll request header.
-	var accessToken string
-	if tokenData, err := authpkg.LoadTokenData(configDir); err == nil && tokenData != nil {
-		accessToken = tokenData.AccessToken
-	}
-
-	// Use a client that does NOT follow redirects, so we can detect SSO 302.
-	noRedirectClient := &http.Client{
-		CheckRedirect: func(req *http.Request, via []*http.Request) error {
-			return http.ErrUseLastResponse
-		},
-	}
-
-	ticker := time.NewTicker(patPollInterval)
-	defer ticker.Stop()
-
-	dim := color.New(color.Faint).SprintFunc()
-	pollCount := 0
-
-	for {
-		select {
-		case <-ctx.Done():
-			if ctx.Err() == context.Canceled {
-				return authpkg.StatusCancelled, "", nil
-			}
-			return authpkg.StatusExpired, "", nil
-		case <-ticker.C:
-			pollCount++
-			fmt.Fprintf(output, "\r%s [%d] 等待授权中...          ", dim("⟳"), pollCount)
-
-			req, err := http.NewRequestWithContext(ctx, http.MethodGet, pollURL, nil)
-			if err != nil {
-				slog.Debug("PAT poll: failed to create request", "error", err)
-				continue
-			}
-			if accessToken != "" {
-				req.Header.Set("x-user-access-token", accessToken)
-			}
-			resp, err := noRedirectClient.Do(req)
-			if err != nil {
-				slog.Debug("PAT poll: request failed", "error", err)
-				continue // transient network error, keep polling
-			}
-
-			bodyBytes, _ := io.ReadAll(resp.Body)
-			resp.Body.Close()
-
-			// If we got a redirect (302/301), SSO gateway intercepted — skip JSON parse.
-			if resp.StatusCode == http.StatusFound || resp.StatusCode == http.StatusMovedPermanently {
-				continue
-			}
-
-			var pollResp authpkg.DevicePollResponse
-			if err := json.Unmarshal(bodyBytes, &pollResp); err != nil {
-				slog.Debug("PAT poll: failed to parse response", "error", err, "body", string(bodyBytes))
-				continue
-			}
-
-			status := authpkg.ParseDeviceFlowStatus(pollResp.Data.Status, pollResp.Success)
-			switch status {
-			case authpkg.StatusApproved:
-				fmt.Fprintln(output) // clear the polling line
-				return status, pollResp.Data.AuthCode, nil
-			case authpkg.StatusRejected, authpkg.StatusExpired:
-				fmt.Fprintln(output) // clear the polling line
-				return status, "", nil
-			case authpkg.StatusPending:
-				// keep polling
-			default:
-				// ParseDeviceFlowStatus normalizes empty+!success to EXPIRED,
-				// so this branch handles truly unknown statuses.
-				fmt.Fprintln(output)
-				return status, "", nil
-			}
-		}
-	}
-}
-
-// tryOpenBrowser opens url in the default browser; errors are silently ignored.
-func tryOpenBrowser(url string) error {
-	var cmd *exec.Cmd
-	switch runtime.GOOS {
-	case "darwin":
-		cmd = exec.Command("open", url)
-	case "linux":
-		cmd = exec.Command("xdg-open", url)
-	case "windows":
-		cmd = exec.Command("cmd", "/c", "start", url)
-	default:
-		return nil
-	}
-	return cmd.Start()
-}
@@ -1,606 +0,0 @@
-// Copyright 2026 Alibaba Group
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package app
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-	"net/http"
-	"net/http/httptest"
-	"os"
-	"path/filepath"
-	"strings"
-	"sync/atomic"
-	"testing"
-	"time"
-
-	authpkg "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/auth"
-	apperrors "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/errors"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/executor"
-)
-
-func TestIsPatScopeError_MissingScope(t *testing.T) {
-	t.Parallel()
-	err := apperrors.NewAuth("missing required scope(s): mail:user_mailbox.message:send")
-	if !isPatScopeError(err) {
-		t.Fatal("expected missing_scope error to be detected")
-	}
-}
-
-func TestIsPatScopeError_PlainString(t *testing.T) {
-	t.Parallel()
-	err := &PatScopeError{
-		OriginalError: "missing_scope: user lacks required scope",
-		ErrorType:     "missing_scope",
-		Message:       "user lacks required scope",
-	}
-	if !isPatScopeError(err) {
-		t.Fatal("expected plain string with missing_scope to be detected")
-	}
-}
-
-func TestIsPatScopeError_NotScopeError(t *testing.T) {
-	t.Parallel()
-	err := apperrors.NewValidation("invalid parameter")
-	if isPatScopeError(err) {
-		t.Fatal("expected validation error NOT to be detected as scope error")
-	}
-}
-
-func TestIsPatScopeError_Nil(t *testing.T) {
-	t.Parallel()
-	if isPatScopeError(nil) {
-		t.Fatal("nil error should not be detected as scope error")
-	}
-}
-
-func TestIsPatScopeError_WithReason(t *testing.T) {
-	t.Parallel()
-	err := apperrors.NewAuth("API error",
-		apperrors.WithReason("missing_scope"),
-	)
-	if !isPatScopeError(err) {
-		t.Fatal("expected error with missing_scope reason to be detected")
-	}
-}
-
-func TestIsPatScopeError_InsufficientScope(t *testing.T) {
-	t.Parallel()
-	err := apperrors.NewAuth("insufficient_scope for resource",
-		apperrors.WithReason("insufficient_scope"),
-	)
-	if !isPatScopeError(err) {
-		t.Fatal("expected insufficient_scope error to be detected")
-	}
-}
-
-func TestExtractPatScopeError_MissingScope(t *testing.T) {
-	t.Parallel()
-	err := apperrors.NewAuth("missing required scope(s): mail:user_mailbox.message:send")
-	scopeErr := extractPatScopeError(err)
-	if scopeErr == nil {
-		t.Fatal("expected non-nil PatScopeError")
-	}
-	if scopeErr.ErrorType != "missing_scope" {
-		t.Errorf("expected error type 'missing_scope', got %q", scopeErr.ErrorType)
-	}
-	if !strings.Contains(scopeErr.Hint, "dws auth login") {
-		t.Errorf("expected hint to contain 'dws auth login', got %q", scopeErr.Hint)
-	}
-}
-
-func TestExtractPatScopeError_ExtractsScope(t *testing.T) {
-	t.Parallel()
-	err := &PatScopeError{
-		OriginalError: "missing_scope: user needs calendar:read",
-		ErrorType:     "missing_scope",
-		Message:       "user needs calendar:read",
-	}
-	scopeErr := extractPatScopeError(err)
-	if scopeErr == nil {
-		t.Fatal("expected non-nil PatScopeError")
-	}
-	if scopeErr.MissingScope != "calendar:read" {
-		t.Errorf("expected MissingScope 'calendar:read', got %q", scopeErr.MissingScope)
-	}
-}
-
-func TestPrintPatAuthError_HumanReadable(t *testing.T) {
-	t.Parallel()
-	var buf strings.Builder
-	scopeErr := &PatScopeError{
-		Identity:     "user",
-		ErrorType:    "missing_scope",
-		Message:      "missing required scope(s): mail:user_mailbox.message:send",
-		Hint:         "run `dws auth login --scope \"mail:user_mailbox.message:send\"` to authorize",
-		MissingScope: "mail:user_mailbox.message:send",
-	}
-	PrintPatAuthError(&buf, scopeErr)
-
-	output := buf.String()
-	if !strings.Contains(output, "missing_scope") {
-		t.Errorf("expected output to contain 'missing_scope', got: %s", output)
-	}
-	if !strings.Contains(output, "dws auth login") {
-		t.Errorf("expected output to contain 'dws auth login', got: %s", output)
-	}
-	if !strings.Contains(output, "需要额外授权") {
-		t.Errorf("expected output to contain Chinese auth prompt, got: %s", output)
-	}
-}
-
-func TestPrintPatAuthJSON_MachineReadable(t *testing.T) {
-	t.Parallel()
-	var buf strings.Builder
-	scopeErr := &PatScopeError{
-		Identity:     "user",
-		ErrorType:    "missing_scope",
-		Message:      "missing required scope(s): mail:send",
-		Hint:         "run dws auth login --scope mail:send",
-		MissingScope: "mail:send",
-	}
-	PrintPatAuthJSON(&buf, scopeErr)
-
-	output := buf.String()
-	if !strings.Contains(output, `"ok": false`) {
-		t.Errorf("expected JSON to contain ok: false, got: %s", output)
-	}
-	if !strings.Contains(output, `"missing_scope": "mail:send"`) {
-		t.Errorf("expected JSON to contain missing_scope, got: %s", output)
-	}
-}
-
-func TestIsPatScopeError_BusinessPermissionDenied(t *testing.T) {
-	t.Parallel()
-	// Generic business "permission denied" should NOT trigger PAT re-auth.
-	err := apperrors.NewAuth("User has no permission to access this mailbox, permission denied")
-	if isPatScopeError(err) {
-		t.Fatal("generic 'permission denied' should not be detected as PAT scope error")
-	}
-}
-
-func TestIsPatScopeError_GenericForbidden(t *testing.T) {
-	t.Parallel()
-	// HTTP 403 Forbidden should NOT trigger PAT re-auth.
-	err := apperrors.NewAuth("403 Forbidden")
-	if isPatScopeError(err) {
-		t.Fatal("'403 Forbidden' should not be detected as PAT scope error")
-	}
-}
-
-func TestExtractPatScopeError_ComplexScope(t *testing.T) {
-	t.Parallel()
-	err := apperrors.NewAuth("missing required scope(s): mail:user_mailbox.message:send")
-	scopeErr := extractPatScopeError(err)
-	if scopeErr == nil {
-		t.Fatal("expected non-nil PatScopeError")
-	}
-	if scopeErr.MissingScope != "mail:user_mailbox.message:send" {
-		t.Errorf("expected MissingScope 'mail:user_mailbox.message:send', got %q", scopeErr.MissingScope)
-	}
-}
-
-func TestPatScopeError_Error(t *testing.T) {
-	t.Parallel()
-	err := &PatScopeError{
-		OriginalError: "test error message",
-	}
-	if err.Error() != "test error message" {
-		t.Errorf("expected Error() to return OriginalError, got %q", err.Error())
-	}
-}
-
-// ---------------------------------------------------------------------------
-// pollPatDeviceFlow integration tests — httptest mock covering four terminal
-// states: APPROVED, REJECTED, EXPIRED, CANCELLED (ctx cancel).
-// ---------------------------------------------------------------------------
-
-// setupPollServer creates an httptest server that responds to
-// /cli/oauth/device/poll?flowId=<fid> with the given status sequence.
-// It also writes the server URL into a temp DWS_CONFIG_DIR/mcp_url so that
-// GetMCPBaseURL() returns the test server address.
-func setupPollServer(t *testing.T, statuses []authpkg.DevicePollResponse) (*httptest.Server, string) {
-	t.Helper()
-	var callCount atomic.Int32
-
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		idx := int(callCount.Add(1)) - 1
-		if idx >= len(statuses) {
-			idx = len(statuses) - 1
-		}
-		w.Header().Set("Content-Type", "application/json")
-		_ = json.NewEncoder(w).Encode(statuses[idx])
-	}))
-
-	// Write mcp_url so GetMCPBaseURL picks up the test server.
-	tmpDir := t.TempDir()
-	_ = os.WriteFile(filepath.Join(tmpDir, "mcp_url"), []byte(server.URL), 0644)
-	t.Setenv("DWS_CONFIG_DIR", tmpDir)
-
-	return server, tmpDir
-}
-
-func TestPollPatDeviceFlow_Approved(t *testing.T) {
-	server, configDir := setupPollServer(t, []authpkg.DevicePollResponse{
-		{Success: true, Data: authpkg.DevicePollData{Status: "PENDING"}},
-		{Success: true, Data: authpkg.DevicePollData{Status: "APPROVED", AuthCode: "code123"}},
-	})
-	defer server.Close()
-
-	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
-	defer cancel()
-
-	var buf bytes.Buffer
-	status, authCode, err := pollPatDeviceFlow(ctx, "flow-1", configDir, &buf)
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if status != "APPROVED" {
-		t.Errorf("expected APPROVED, got %q", status)
-	}
-	if authCode != "code123" {
-		t.Errorf("expected authCode 'code123', got %q", authCode)
-	}
-}
-
-func TestPollPatDeviceFlow_Rejected(t *testing.T) {
-	server, configDir := setupPollServer(t, []authpkg.DevicePollResponse{
-		{Success: false, Data: authpkg.DevicePollData{Status: "REJECTED"}},
-	})
-	defer server.Close()
-
-	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
-	defer cancel()
-
-	var buf bytes.Buffer
-	status, authCode, err := pollPatDeviceFlow(ctx, "flow-2", configDir, &buf)
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if status != "REJECTED" {
-		t.Errorf("expected REJECTED, got %q", status)
-	}
-	if authCode != "" {
-		t.Errorf("expected empty authCode for REJECTED, got %q", authCode)
-	}
-}
-
-func TestPollPatDeviceFlow_Expired(t *testing.T) {
-	server, configDir := setupPollServer(t, []authpkg.DevicePollResponse{
-		{Success: false, Data: authpkg.DevicePollData{Status: "EXPIRED"}},
-	})
-	defer server.Close()
-
-	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
-	defer cancel()
-
-	var buf bytes.Buffer
-	status, authCode, err := pollPatDeviceFlow(ctx, "flow-3", configDir, &buf)
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if status != "EXPIRED" {
-		t.Errorf("expected EXPIRED, got %q", status)
-	}
-	if authCode != "" {
-		t.Errorf("expected empty authCode for EXPIRED, got %q", authCode)
-	}
-}
-
-func TestPollPatDeviceFlow_Cancelled(t *testing.T) {
-	// Server always returns PENDING so context cancellation is the only exit.
-	server, configDir := setupPollServer(t, []authpkg.DevicePollResponse{
-		{Success: true, Data: authpkg.DevicePollData{Status: "PENDING"}},
-	})
-	defer server.Close()
-
-	ctx, cancel := context.WithCancel(context.Background())
-	// Cancel immediately after first poll tick.
-	go func() {
-		time.Sleep(500 * time.Millisecond)
-		cancel()
-	}()
-
-	var buf bytes.Buffer
-	status, authCode, err := pollPatDeviceFlow(ctx, "flow-4", configDir, &buf)
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if status != "CANCELLED" {
-		t.Errorf("expected CANCELLED, got %q", status)
-	}
-	if authCode != "" {
-		t.Errorf("expected empty authCode for CANCELLED, got %q", authCode)
-	}
-}
-
-// ---------------------------------------------------------------------------
-// IsPatRetrying tests
-// ---------------------------------------------------------------------------
-
-func TestIsPatRetrying_Default(t *testing.T) {
-	t.Parallel()
-	ctx := context.Background()
-	if IsPatRetrying(ctx) {
-		t.Fatal("expected false for plain context")
-	}
-}
-
-func TestIsPatRetrying_WithValue(t *testing.T) {
-	t.Parallel()
-	ctx := context.WithValue(context.Background(), patRetryingKey, true)
-	if !IsPatRetrying(ctx) {
-		t.Fatal("expected true when pat retry key is set")
-	}
-}
-
-// ---------------------------------------------------------------------------
-// pollPatDeviceFlow edge cases
-// ---------------------------------------------------------------------------
-
-func TestPollPatDeviceFlow_ServerErrorFallback(t *testing.T) {
-	// When server returns success=false with empty status, should treat as EXPIRED.
-	server, configDir := setupPollServer(t, []authpkg.DevicePollResponse{
-		{Success: false, Data: authpkg.DevicePollData{Status: ""}},
-	})
-	defer server.Close()
-
-	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
-	defer cancel()
-
-	var buf bytes.Buffer
-	status, authCode, err := pollPatDeviceFlow(ctx, "flow-err", configDir, &buf)
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if status != "EXPIRED" {
-		t.Errorf("expected EXPIRED for server error fallback, got %q", status)
-	}
-	if authCode != "" {
-		t.Errorf("expected empty authCode for server error, got %q", authCode)
-	}
-}
-
-func TestPollPatDeviceFlow_RedirectSkipped(t *testing.T) {
-	// When server returns 302 (SSO redirect), poll should continue until real response.
-	var callCount int32
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		callCount++
-		if callCount <= 1 {
-			// First call: simulate SSO redirect
-			w.Header().Set("Location", "https://sso.example.com")
-			w.WriteHeader(http.StatusFound)
-			return
-		}
-		// Second call: return APPROVED
-		w.Header().Set("Content-Type", "application/json")
-		resp := authpkg.DevicePollResponse{
-			Success: true,
-			Data:    authpkg.DevicePollData{Status: "APPROVED"},
-		}
-		_ = json.NewEncoder(w).Encode(resp)
-	}))
-	defer server.Close()
-
-	tmpDir := t.TempDir()
-	_ = os.WriteFile(filepath.Join(tmpDir, "mcp_url"), []byte(server.URL), 0644)
-	t.Setenv("DWS_CONFIG_DIR", tmpDir)
-
-	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
-	defer cancel()
-
-	var buf bytes.Buffer
-	status, _, err := pollPatDeviceFlow(ctx, "flow-redirect", tmpDir, &buf)
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if status != "APPROVED" {
-		t.Errorf("expected APPROVED after redirect, got %q", status)
-	}
-}
-
-// ---------------------------------------------------------------------------
-// extractPatScopeError edge cases
-// ---------------------------------------------------------------------------
-
-func TestExtractPatScopeError_Nil(t *testing.T) {
-	t.Parallel()
-	if got := extractPatScopeError(nil); got != nil {
-		t.Fatalf("expected nil for nil error, got %+v", got)
-	}
-}
-
-func TestExtractPatScopeError_WithIdentity(t *testing.T) {
-	t.Parallel()
-	err := apperrors.NewAuth(`insufficient_scope: identity "app_user" needs calendar:write`)
-	scopeErr := extractPatScopeError(err)
-	if scopeErr == nil {
-		t.Fatal("expected non-nil PatScopeError")
-	}
-	if scopeErr.Identity != "app_user" {
-		t.Errorf("expected Identity 'app_user', got %q", scopeErr.Identity)
-	}
-	if scopeErr.MissingScope != "calendar:write" {
-		t.Errorf("expected MissingScope 'calendar:write', got %q", scopeErr.MissingScope)
-	}
-}
-
-// ---------------------------------------------------------------------------
-// handlePatAuthCheck integration tests — cover the main orchestrator with
-// mock runner + httptest poll server for APPROVED, REJECTED, EmptyFlowID.
-// ---------------------------------------------------------------------------
-
-// mockRunner is a simple executor.Runner for testing handlePatAuthCheck.
-type mockRunner struct {
-	runFunc func(ctx context.Context, inv executor.Invocation) (executor.Result, error)
-}
-
-func (m *mockRunner) Run(ctx context.Context, inv executor.Invocation) (executor.Result, error) {
-	return m.runFunc(ctx, inv)
-}
-
-// setupHandlePATServer creates an httptest server for handlePatAuthCheck tests.
-// It responds to device poll requests with the given status after the first poll.
-func setupHandlePATServer(t *testing.T, terminalStatus string, authCode string) (*httptest.Server, string) {
-	t.Helper()
-	var pollCount atomic.Int32
-
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if strings.Contains(r.URL.Path, "/cli/oauth/device/poll") {
-			idx := int(pollCount.Add(1)) - 1
-			var resp authpkg.DevicePollResponse
-			if idx == 0 {
-				resp = authpkg.DevicePollResponse{Success: true, Data: authpkg.DevicePollData{Status: "PENDING"}}
-			} else {
-				resp = authpkg.DevicePollResponse{
-					Success: terminalStatus == "APPROVED",
-					Data:    authpkg.DevicePollData{Status: terminalStatus, AuthCode: authCode},
-				}
-			}
-			w.Header().Set("Content-Type", "application/json")
-			_ = json.NewEncoder(w).Encode(resp)
-			return
-		}
-		http.NotFound(w, r)
-	}))
-
-	tmpDir := t.TempDir()
-	_ = os.WriteFile(filepath.Join(tmpDir, "mcp_url"), []byte(server.URL), 0644)
-	t.Setenv("DWS_CONFIG_DIR", tmpDir)
-
-	return server, tmpDir
-}
-
-func makePATErrorJSON(flowID, clientID string) string {
-	type patData struct {
-		Desc     string `json:"desc"`
-		FlowID   string `json:"flowId"`
-		URI      string `json:"uri"`
-		ClientID string `json:"clientId"`
-	}
-	payload := struct {
-		Code string  `json:"code"`
-		Data patData `json:"data"`
-	}{
-		Code: "AGENT_CODE_NOT_EXISTS",
-		Data: patData{
-			Desc:     "test auth",
-			FlowID:   flowID,
-			URI:      "", // empty to avoid opening browser in test
-			ClientID: clientID,
-		},
-	}
-	data, _ := json.Marshal(payload)
-	return string(data)
-}
-
-func TestHandlePatAuthCheck_Approved(t *testing.T) {
-	server, configDir := setupHandlePATServer(t, "APPROVED", "test-auth-code")
-	defer server.Close()
-
-	var retryCalled bool
-	var retryHasKey bool
-	mock := &mockRunner{
-		runFunc: func(ctx context.Context, inv executor.Invocation) (executor.Result, error) {
-			retryCalled = true
-			retryHasKey = IsPatRetrying(ctx)
-			return executor.Result{Response: map[string]any{"ok": true}}, nil
-		},
-	}
-
-	runner := &runtimeRunner{fallback: mock}
-	patErr := &apperrors.PATError{RawJSON: makePATErrorJSON("flow-approved", "test-client-id")}
-
-	ctx := context.Background()
-	var buf bytes.Buffer
-	_, err := handlePatAuthCheck(ctx, runner, executor.Invocation{
-		CanonicalProduct: "test",
-		Tool:             "test_tool",
-	}, patErr, configDir, &buf)
-
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if !retryCalled {
-		t.Fatal("expected mock runner to be called for retry")
-	}
-	if !retryHasKey {
-		t.Fatal("expected retry context to have patRetryingKey")
-	}
-	// Verify SetClientIDFromMCP was called with the PAT response clientId.
-	if cid := authpkg.ClientID(); cid != "test-client-id" {
-		t.Errorf("expected ClientID 'test-client-id', got %q", cid)
-	}
-}
-
-func TestHandlePatAuthCheck_Rejected(t *testing.T) {
-	server, configDir := setupHandlePATServer(t, "REJECTED", "")
-	defer server.Close()
-
-	mock := &mockRunner{
-		runFunc: func(ctx context.Context, inv executor.Invocation) (executor.Result, error) {
-			t.Fatal("runner should not be called on REJECTED")
-			return executor.Result{}, nil
-		},
-	}
-
-	runner := &runtimeRunner{fallback: mock}
-	patErr := &apperrors.PATError{RawJSON: makePATErrorJSON("flow-rejected", "test-client-id")}
-
-	ctx := context.Background()
-	var buf bytes.Buffer
-	_, err := handlePatAuthCheck(ctx, runner, executor.Invocation{
-		CanonicalProduct: "test",
-		Tool:             "test_tool",
-	}, patErr, configDir, &buf)
-
-	if err == nil {
-		t.Fatal("expected error for REJECTED")
-	}
-	if !strings.Contains(err.Error(), "用户已拒绝授权") {
-		t.Errorf("expected rejection error, got: %v", err)
-	}
-}
-
-func TestHandlePatAuthCheck_EmptyFlowID_FallsBackToPATError(t *testing.T) {
-	// No poll server needed — empty flowId means no polling, return PATError directly.
-	tmpDir := t.TempDir()
-	t.Setenv("DWS_CONFIG_DIR", tmpDir)
-
-	mock := &mockRunner{
-		runFunc: func(ctx context.Context, inv executor.Invocation) (executor.Result, error) {
-			t.Fatal("runner should not be called when flowId is empty")
-			return executor.Result{}, nil
-		},
-	}
-
-	runner := &runtimeRunner{fallback: mock}
-	patErr := &apperrors.PATError{RawJSON: makePATErrorJSON("", "test-client-id")}
-
-	ctx := context.Background()
-	var buf bytes.Buffer
-	_, err := handlePatAuthCheck(ctx, runner, executor.Invocation{
-		CanonicalProduct: "test",
-		Tool:             "test_tool",
-	}, patErr, tmpDir, &buf)
-
-	if err == nil {
-		t.Fatal("expected PATError when flowId is empty")
-	}
-	// Should return the original PATError.
-	if _, ok := err.(*apperrors.PATError); !ok {
-		t.Errorf("expected *PATError, got %T: %v", err, err)
-	}
-}
@@ -1,664 +0,0 @@
-// Copyright 2026 Alibaba Group
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package app
-
-import (
-	"fmt"
-	"os"
-	"path/filepath"
-	"strings"
-
-	apperrors "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/errors"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/i18n"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/output"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/plugin"
-	"github.com/spf13/cobra"
-)
-
-func newPluginCommand() *cobra.Command {
-	pluginCmd := newPlaceholderParent("plugin", i18n.T("插件管理"))
-
-	pluginCmd.AddCommand(
-		newPluginListCommand(),
-		newPluginInstallCommand(),
-		newPluginInfoCommand(),
-		newPluginEnableCommand(),
-		newPluginDisableCommand(),
-		newPluginRemoveCommand(),
-		newPluginValidateCommand(),
-		newPluginCreateCommand(),
-		newPluginDevCommand(),
-		newPluginConfigCommand(),
-		newPluginBuildCommand(),
-	)
-
-	return pluginCmd
-}
-
-func newPluginListCommand() *cobra.Command {
-	cmd := &cobra.Command{
-		Use:               "list",
-		Short:             i18n.T("列出已安装的插件"),
-		DisableAutoGenTag: true,
-		RunE: func(cmd *cobra.Command, args []string) error {
-			loader := plugin.NewLoader(RawVersion())
-			plugins := loader.ListInstalled()
-
-			wantJSON, _ := cmd.Flags().GetBool("json")
-			if wantJSON {
-				return output.WriteJSON(cmd.OutOrStdout(), plugins)
-			}
-
-			if len(plugins) == 0 {
-				fmt.Fprintln(cmd.OutOrStdout(), "No plugins installed.")
-				return nil
-			}
-
-			w := cmd.OutOrStdout()
-			fmt.Fprintf(w, "%-35s %-12s %-10s %-10s %s\n",
-				"NAME", "VERSION", "TYPE", "STATUS", "DESCRIPTION")
-			fmt.Fprintln(w, strings.Repeat("-", 85))
-			for _, p := range plugins {
-				fmt.Fprintf(w, "%-35s %-12s %-10s %-10s %s\n",
-					p.Name, p.Version, p.Type, statusStr(p.Enabled), p.Description)
-			}
-			return nil
-		},
-	}
-	cmd.Flags().Bool("json", false, "Output in JSON format")
-	return cmd
-}
-
-func newPluginInstallCommand() *cobra.Command {
-	cmd := &cobra.Command{
-		Use:   "install",
-		Short: i18n.T("安装插件"),
-		Example: `  dws plugin install --dir ./conference
-  dws plugin install --git https://github.com/DingTalk-Real-AI/conference.git`,
-		DisableAutoGenTag: true,
-		RunE: func(cmd *cobra.Command, args []string) error {
-			dirPath, _ := cmd.Flags().GetString("dir")
-			gitURL, _ := cmd.Flags().GetString("git")
-
-			if dirPath == "" && gitURL == "" {
-				return apperrors.NewValidation("specify install source: --dir <path> or --git <url>")
-			}
-
-			loader := plugin.NewLoader(RawVersion())
-
-			if gitURL != "" {
-				p, err := loader.InstallFromGit(gitURL)
-				if err != nil {
-					return apperrors.NewInternal(fmt.Sprintf("install failed: %v", err))
-				}
-				fmt.Fprintf(cmd.OutOrStdout(), "Installed %s (%s)\n", p.Manifest.Name, p.Manifest.Version)
-				return nil
-			}
-
-			p, err := loader.InstallFromDir(dirPath)
-			if err != nil {
-				return apperrors.NewInternal(fmt.Sprintf("install failed: %v", err))
-			}
-
-			fmt.Fprintf(cmd.OutOrStdout(), "Installed %s (%s)\n", p.Manifest.Name, p.Manifest.Version)
-			return nil
-		},
-	}
-	cmd.Flags().String("dir", "", "Install from a local directory")
-	cmd.Flags().String("git", "", "Install from a Git repository")
-	return cmd
-}
-
-func newPluginInfoCommand() *cobra.Command {
-	return &cobra.Command{
-		Use:               "info <name>",
-		Short:             i18n.T("查看插件详情"),
-		Args:              cobra.ExactArgs(1),
-		DisableAutoGenTag: true,
-		RunE: func(cmd *cobra.Command, args []string) error {
-			name := args[0]
-			loader := plugin.NewLoader(RawVersion())
-			plugins := loader.ListInstalled()
-
-			for _, p := range plugins {
-				if p.Name == name {
-					w := cmd.OutOrStdout()
-					fmt.Fprintf(w, "Name:         %s\n", p.Name)
-					fmt.Fprintf(w, "Version:      %s\n", p.Version)
-					fmt.Fprintf(w, "Type:         %s\n", p.Type)
-					fmt.Fprintf(w, "Status:       %s\n", statusStr(p.Enabled))
-					fmt.Fprintf(w, "Path:         %s\n", p.Path)
-					if p.Description != "" {
-						fmt.Fprintf(w, "Description:  %s\n", p.Description)
-					}
-					return nil
-				}
-			}
-			return apperrors.NewValidation(fmt.Sprintf("plugin %q not found", name))
-		},
-	}
-}
-
-func newPluginEnableCommand() *cobra.Command {
-	return &cobra.Command{
-		Use:               "enable <name>",
-		Short:             i18n.T("启用插件"),
-		Args:              cobra.ExactArgs(1),
-		DisableAutoGenTag: true,
-		RunE: func(cmd *cobra.Command, args []string) error {
-			loader := plugin.NewLoader(RawVersion())
-			if err := loader.SetEnabled(args[0], true); err != nil {
-				return apperrors.NewValidation(err.Error())
-			}
-			fmt.Fprintf(cmd.OutOrStdout(), "Plugin %s enabled.\n", args[0])
-			return nil
-		},
-	}
-}
-
-func newPluginDisableCommand() *cobra.Command {
-	return &cobra.Command{
-		Use:               "disable <name>",
-		Short:             i18n.T("禁用插件"),
-		Args:              cobra.ExactArgs(1),
-		DisableAutoGenTag: true,
-		RunE: func(cmd *cobra.Command, args []string) error {
-			loader := plugin.NewLoader(RawVersion())
-			if err := loader.SetEnabled(args[0], false); err != nil {
-				return apperrors.NewValidation(err.Error())
-			}
-			fmt.Fprintf(cmd.OutOrStdout(), "Plugin %s disabled.\n", args[0])
-			return nil
-		},
-	}
-}
-
-func newPluginRemoveCommand() *cobra.Command {
-	cmd := &cobra.Command{
-		Use:               "remove <name>",
-		Short:             i18n.T("卸载已安装的插件"),
-		Args:              cobra.ExactArgs(1),
-		DisableAutoGenTag: true,
-		RunE: func(cmd *cobra.Command, args []string) error {
-			// Stop stdio clients before removing to release file locks
-			StopStdioClientsByPlugin(args[0])
-			keepData, _ := cmd.Flags().GetBool("keep-data")
-			loader := plugin.NewLoader(RawVersion())
-			if err := loader.RemovePlugin(args[0], keepData); err != nil {
-				return apperrors.NewValidation(err.Error())
-			}
-			fmt.Fprintf(cmd.OutOrStdout(), "Plugin %s removed.\n", args[0])
-			return nil
-		},
-	}
-	cmd.Flags().Bool("keep-data", false, "Keep plugin data directory")
-	return cmd
-}
-
-func newPluginValidateCommand() *cobra.Command {
-	return &cobra.Command{
-		Use:               "validate <dir>",
-		Short:             i18n.T("校验 plugin.json"),
-		Args:              cobra.ExactArgs(1),
-		DisableAutoGenTag: true,
-		RunE: func(cmd *cobra.Command, args []string) error {
-			dir := args[0]
-			m, err := plugin.ParseManifest(dir + "/plugin.json")
-			if err != nil {
-				return apperrors.NewValidation(fmt.Sprintf("parse failed: %v", err))
-			}
-			if err := m.Validate(RawVersion()); err != nil {
-				return apperrors.NewValidation(fmt.Sprintf("validation failed: %v", err))
-			}
-			fmt.Fprintf(cmd.OutOrStdout(), "Valid: %s (%s)\n", m.Name, m.Version)
-			return nil
-		},
-	}
-}
-
-func newPluginCreateCommand() *cobra.Command {
-	cmd := &cobra.Command{
-		Use:   "create <name>",
-		Short: i18n.T("脚手架生成新插件目录"),
-		Example: `  dws plugin create my-tool
-  dws plugin create my-tool --description "My awesome tool"`,
-		Args:              cobra.ExactArgs(1),
-		DisableAutoGenTag: true,
-		RunE: func(cmd *cobra.Command, args []string) error {
-			name := args[0]
-			desc, _ := cmd.Flags().GetString("description")
-			pluginType := "user"
-
-			// Validate name format
-			m := &plugin.Manifest{Name: name, Version: "0.1.0", Type: pluginType}
-			if err := m.Validate(""); err != nil {
-				return apperrors.NewValidation(fmt.Sprintf("invalid plugin name: %v", err))
-			}
-
-			dir := filepath.Join(".", name)
-			if _, err := os.Stat(dir); err == nil {
-				return apperrors.NewValidation(fmt.Sprintf("directory %q already exists", dir))
-			}
-
-			// Create directory structure
-			dirs := []string{
-				dir,
-				filepath.Join(dir, "skills", name),
-				filepath.Join(dir, "hooks"),
-			}
-			for _, d := range dirs {
-				if err := os.MkdirAll(d, 0o755); err != nil {
-					return apperrors.NewInternal(fmt.Sprintf("failed to create directory: %v", err))
-				}
-			}
-
-			// Write plugin.json
-			pluginJSON := fmt.Sprintf(`{
-  "name": %q,
-  "version": "0.1.0",
-  "description": %q,
-  "type": %q,
-  "minCLIVersion": %q,
-  "mcpServers": {
-    %q: {
-      "type": "stdio",
-      "command": "${DWS_PLUGIN_ROOT}/bin/server",
-      "args": []
-    }
-  },
-  "build": {
-    "command": "echo 'TODO: replace with your build command, e.g.: bun build --compile src/server.ts --outfile bin/server'",
-    "output": "bin/server"
-  },
-  "skills": "./skills/",
-  "hooks": "./hooks/hooks.json"
-}
-`, name, desc, pluginType, RawVersion(), name)
-
-			if err := os.WriteFile(filepath.Join(dir, "plugin.json"), []byte(pluginJSON), 0o644); err != nil {
-				return apperrors.NewInternal(fmt.Sprintf("failed to write plugin.json: %v", err))
-			}
-
-			// Write SKILL.md template
-			skillMD := fmt.Sprintf(`---
-name: %s
-description: %s
-cli_version: ">=%s"
---
-
-# %s
-
-## Intent Recognition
-
-Use this skill when the user mentions:
- TODO: add your intent keywords here
-
-## Command Decision Tree
-
-| User Intent | Command | Required Parameters |
-|-------------|---------|---------------------|
-| TODO | `+"`dws %s <sub-command>`"+` | `+"`--param`"+` |
-
-## Parameter Rules
-
-### TODO: parameter type
- Format description
- Conversion rules
-`, name, desc, RawVersion(), name, name)
-
-			if err := os.WriteFile(filepath.Join(dir, "skills", name, "SKILL.md"), []byte(skillMD), 0o644); err != nil {
-				return apperrors.NewInternal(fmt.Sprintf("failed to write SKILL.md: %v", err))
-			}
-
-			// Write hooks.json template
-			hooksJSON := `{
-  "hooks": []
-}
-`
-			if err := os.WriteFile(filepath.Join(dir, "hooks", "hooks.json"), []byte(hooksJSON), 0o644); err != nil {
-				return apperrors.NewInternal(fmt.Sprintf("failed to write hooks.json: %v", err))
-			}
-
-			w := cmd.OutOrStdout()
-			fmt.Fprintf(w, "Created plugin scaffold at ./%s/\n", name)
-			fmt.Fprintf(w, "  %s/\n", name)
-			fmt.Fprintf(w, "  ├── plugin.json\n")
-			fmt.Fprintf(w, "  ├── skills/%s/SKILL.md\n", name)
-			fmt.Fprintf(w, "  └── hooks/hooks.json\n")
-			fmt.Fprintln(w)
-			fmt.Fprintf(w, "Next steps:\n")
-			fmt.Fprintf(w, "  1. Edit plugin.json to configure your MCP servers\n")
-			fmt.Fprintf(w, "  2. Edit skills/%s/SKILL.md to describe your commands\n", name)
-			fmt.Fprintf(w, "  3. Run: dws plugin validate ./%s\n", name)
-			fmt.Fprintf(w, "  4. Run: dws plugin dev ./%s\n", name)
-			return nil
-		},
-	}
-	cmd.Flags().String("description", "", "Plugin description")
-	return cmd
-}
-
-func newPluginDevCommand() *cobra.Command {
-	cmd := &cobra.Command{
-		Use:   "dev <dir>",
-		Short: i18n.T("将本地目录注册为开发态插件"),
-		Long: `Registers a plugin from a local source directory for development.
-The plugin is loaded directly from the source directory on next CLI invocation,
-without copying files to ~/.dws/plugins/. Use 'dws plugin dev --off <name>'
-to unregister.`,
-		Example: `  dws plugin dev ./my-tool
-  dws plugin dev --off my-tool`,
-		Args:              cobra.ExactArgs(1),
-		DisableAutoGenTag: true,
-		RunE: func(cmd *cobra.Command, args []string) error {
-			off, _ := cmd.Flags().GetBool("off")
-			loader := plugin.NewLoader(RawVersion())
-
-			if off {
-				// Unregister dev plugin
-				name := args[0]
-				if err := loader.UnregisterDevPlugin(name); err != nil {
-					return apperrors.NewValidation(err.Error())
-				}
-				fmt.Fprintf(cmd.OutOrStdout(), "Dev plugin %q unregistered.\n", name)
-				return nil
-			}
-
-			// Register dev plugin
-			dir := args[0]
-			absDir, err := filepath.Abs(dir)
-			if err != nil {
-				return apperrors.NewValidation(fmt.Sprintf("invalid path: %v", err))
-			}
-
-			// Validate the plugin first
-			m, err := plugin.ParseManifest(filepath.Join(absDir, "plugin.json"))
-			if err != nil {
-				return apperrors.NewValidation(fmt.Sprintf("invalid plugin at %s: %v", dir, err))
-			}
-			if err := m.Validate(RawVersion()); err != nil {
-				return apperrors.NewValidation(fmt.Sprintf("validation failed: %v", err))
-			}
-
-			if err := loader.RegisterDevPlugin(m.Name, absDir); err != nil {
-				return apperrors.NewInternal(fmt.Sprintf("failed to register: %v", err))
-			}
-
-			fmt.Fprintf(cmd.OutOrStdout(), "Dev plugin %q registered from %s\n", m.Name, absDir)
-			fmt.Fprintf(cmd.OutOrStdout(), "It will be loaded on next dws invocation.\n")
-			fmt.Fprintf(cmd.OutOrStdout(), "To unregister: dws plugin dev --off %s\n", m.Name)
-			return nil
-		},
-	}
-	cmd.Flags().Bool("off", false, "Unregister a dev plugin")
-	return cmd
-}
-
-func newPluginConfigCommand() *cobra.Command {
-	configCmd := newPlaceholderParent("config", i18n.T("管理插件配置"))
-	configCmd.AddCommand(
-		newPluginConfigSetCommand(),
-		newPluginConfigGetCommand(),
-		newPluginConfigListCommand(),
-		newPluginConfigUnsetCommand(),
-	)
-	return configCmd
-}
-
-func newPluginConfigSetCommand() *cobra.Command {
-	return &cobra.Command{
-		Use:   "set <plugin-name> <key> <value>",
-		Short: i18n.T("设置插件配置项"),
-		Long: `Persistently set a configuration value for a plugin.
-The value is stored in ~/.dws/settings.json and automatically injected
-as an environment variable when the plugin is loaded.
-
-Environment variables set by the user (e.g. via export) take precedence
-over values stored in settings.json.`,
-		Example: `  dws plugin config set demo-devtool DASHSCOPE_API_KEY sk-xxx
-  dws plugin config set my-plugin API_ENDPOINT https://api.example.com`,
-		Args:              cobra.ExactArgs(3),
-		DisableAutoGenTag: true,
-		RunE: func(cmd *cobra.Command, args []string) error {
-			pluginName, key, value := args[0], args[1], args[2]
-			loader := plugin.NewLoader(RawVersion())
-
-			// Validate that the plugin exists.
-			plugins := loader.ListInstalled()
-			found := false
-			for _, p := range plugins {
-				if p.Name == pluginName {
-					found = true
-					break
-				}
-			}
-			if !found {
-				return apperrors.NewValidation(fmt.Sprintf("plugin %q not found; use 'dws plugin list' to see installed plugins", pluginName))
-			}
-
-			loader.SetPluginConfig(pluginName, key, value)
-			fmt.Fprintf(cmd.OutOrStdout(), "Config saved: %s.%s\n", pluginName, key)
-			return nil
-		},
-	}
-}
-
-func newPluginConfigGetCommand() *cobra.Command {
-	return &cobra.Command{
-		Use:               "get <plugin-name> <key>",
-		Short:             i18n.T("读取插件配置项"),
-		Args:              cobra.ExactArgs(2),
-		DisableAutoGenTag: true,
-		RunE: func(cmd *cobra.Command, args []string) error {
-			pluginName, key := args[0], args[1]
-			loader := plugin.NewLoader(RawVersion())
-
-			val, ok := loader.GetPluginConfig(pluginName, key)
-			if !ok {
-				return apperrors.NewValidation(fmt.Sprintf("config key %q not set for plugin %q", key, pluginName))
-			}
-
-			fmt.Fprintln(cmd.OutOrStdout(), val)
-			return nil
-		},
-	}
-}
-
-func newPluginConfigListCommand() *cobra.Command {
-	cmd := &cobra.Command{
-		Use:               "list <plugin-name>",
-		Short:             i18n.T("列出插件所有配置项"),
-		Args:              cobra.ExactArgs(1),
-		DisableAutoGenTag: true,
-		RunE: func(cmd *cobra.Command, args []string) error {
-			pluginName := args[0]
-			loader := plugin.NewLoader(RawVersion())
-
-			wantJSON, _ := cmd.Flags().GetBool("json")
-			configs := loader.ListPluginConfig(pluginName)
-
-			// Also load the plugin manifest to show declared userConfig keys.
-			declaredKeys := loadDeclaredUserConfig(loader, pluginName)
-
-			if wantJSON {
-				result := make(map[string]any)
-				for k, v := range configs {
-					sensitive := false
-					if ci, ok := declaredKeys[k]; ok {
-						sensitive = ci.Sensitive
-					}
-					if sensitive {
-						result[k] = maskSensitiveValue(v)
-					} else {
-						result[k] = v
-					}
-				}
-				// Include declared but unset keys.
-				for k, ci := range declaredKeys {
-					if _, set := configs[k]; !set {
-						entry := map[string]any{
-							"value":       nil,
-							"description": ci.Description,
-							"required":    ci.Default == "",
-						}
-						result[k] = entry
-					}
-				}
-				return output.WriteJSON(cmd.OutOrStdout(), map[string]any{
-					"kind":   "plugin_config",
-					"plugin": pluginName,
-					"config": result,
-				})
-			}
-
-			w := cmd.OutOrStdout()
-			if len(configs) == 0 && len(declaredKeys) == 0 {
-				fmt.Fprintf(w, "No configuration for plugin %q.\n", pluginName)
-				return nil
-			}
-
-			fmt.Fprintf(w, "Configuration for %s:\n\n", pluginName)
-
-			// Show set values.
-			for k, v := range configs {
-				sensitive := false
-				if ci, ok := declaredKeys[k]; ok {
-					sensitive = ci.Sensitive
-				}
-				displayVal := v
-				if sensitive {
-					displayVal = maskSensitiveValue(v)
-				}
-				fmt.Fprintf(w, "  %s = %s\n", k, displayVal)
-			}
-
-			// Show declared but unset keys.
-			for k, ci := range declaredKeys {
-				if _, set := configs[k]; !set {
-					desc := ""
-					if ci.Description != "" {
-						desc = "  # " + ci.Description
-					}
-					fmt.Fprintf(w, "  %s = (not set)%s\n", k, desc)
-				}
-			}
-			return nil
-		},
-	}
-	cmd.Flags().Bool("json", false, "Output in JSON format")
-	return cmd
-}
-
-func newPluginConfigUnsetCommand() *cobra.Command {
-	return &cobra.Command{
-		Use:               "unset <plugin-name> <key>",
-		Short:             i18n.T("删除插件配置项"),
-		Args:              cobra.ExactArgs(2),
-		DisableAutoGenTag: true,
-		RunE: func(cmd *cobra.Command, args []string) error {
-			pluginName, key := args[0], args[1]
-			loader := plugin.NewLoader(RawVersion())
-
-			if !loader.UnsetPluginConfig(pluginName, key) {
-				return apperrors.NewValidation(fmt.Sprintf("config key %q not set for plugin %q", key, pluginName))
-			}
-
-			fmt.Fprintf(cmd.OutOrStdout(), "Config removed: %s.%s\n", pluginName, key)
-			return nil
-		},
-	}
-}
-
-// loadDeclaredUserConfig loads the userConfig section from a plugin's manifest.
-func loadDeclaredUserConfig(loader *plugin.Loader, pluginName string) map[string]plugin.ConfigItem {
-	plugins := loader.ListInstalled()
-	for _, p := range plugins {
-		if p.Name == pluginName {
-			m, err := plugin.ParseManifest(filepath.Join(p.Path, "plugin.json"))
-			if err != nil {
-				return nil
-			}
-			return m.UserConfig
-		}
-	}
-	return nil
-}
-
-// maskSensitiveValue masks a sensitive value, showing only the first 4
-// and last 2 characters for values longer than 8 characters.
-func maskSensitiveValue(value string) string {
-	if len(value) <= 8 {
-		return strings.Repeat("*", len(value))
-	}
-	return value[:4] + strings.Repeat("*", len(value)-6) + value[len(value)-2:]
-}
-
-func newPluginBuildCommand() *cobra.Command {
-	return &cobra.Command{
-		Use:   "build <dir>",
-		Short: i18n.T("将插件 stdio server 编译为原生二进制"),
-		Long: `Runs the build command declared in plugin.json to compile the
-plugin's server into a single executable. This ensures plugin users
-don't need any language runtime (Node.js, Python, etc.) installed.
-
-The build configuration is read from the "build" field in plugin.json:
-
-  {
-    "build": {
-      "command": "bun build --compile src/server.ts --outfile bin/server",
-      "output": "bin/server"
-    }
-  }`,
-		Example: `  dws plugin build ./my-plugin
-  dws plugin build .`,
-		Args:              cobra.ExactArgs(1),
-		DisableAutoGenTag: true,
-		RunE: func(cmd *cobra.Command, args []string) error {
-			dir := args[0]
-			absDir, err := filepath.Abs(dir)
-			if err != nil {
-				return apperrors.NewValidation(fmt.Sprintf("invalid path: %v", err))
-			}
-
-			m, err := plugin.ParseManifest(filepath.Join(absDir, "plugin.json"))
-			if err != nil {
-				return apperrors.NewValidation(fmt.Sprintf("invalid plugin at %s: %v", dir, err))
-			}
-
-			if m.Build == nil {
-				return apperrors.NewValidation(fmt.Sprintf(
-					"plugin %q has no \"build\" field in plugin.json.\n"+
-						"Add a build config, e.g.:\n\n"+
-						"  \"build\": {\n"+
-						"    \"command\": \"bun build --compile src/server.js --outfile bin/server\",\n"+
-						"    \"output\": \"bin/server\"\n"+
-						"  }", m.Name))
-			}
-
-			if err := plugin.BuildPlugin(absDir); err != nil {
-				return apperrors.NewInternal(err.Error())
-			}
-
-			fmt.Fprintf(cmd.OutOrStdout(), "Build succeeded: %s\n", m.Build.Output)
-			return nil
-		},
-	}
-}
-
-func statusStr(enabled bool) string {
-	if enabled {
-		return "enabled"
-	}
-	return "disabled"
-}
@@ -1,198 +0,0 @@
-// Copyright 2026 Alibaba Group
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package app
-
-import (
-	"fmt"
-	"sync"
-	"testing"
-	"time"
-
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/cache"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/cli"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/market"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/transport"
-)
-
-// TestSharedCacheStoreConcurrentSaveTools verifies that a single *cache.Store
-// instance is safe for goroutines saving tool snapshots concurrently, as long
-// as each goroutine targets a distinct (partition, serverKey). This mirrors
-// the real plugin discovery path where each goroutine owns one plugin/server.
-//
-// Each call serializes to its own "<key>.json.tmp" file followed by a
-// rename(2) to the final path, so concurrent writers targeting distinct keys
-// never collide. The invariant asserted here: after N parallel writes, the
-// Store returns each written snapshot intact under LoadTools.
-func TestSharedCacheStoreConcurrentSaveTools(t *testing.T) {
-	const (
-		partition = "default/default"
-		writers   = 16
-	)
-
-	store := cache.NewStore(t.TempDir())
-
-	var wg sync.WaitGroup
-	for i := 0; i < writers; i++ {
-		wg.Add(1)
-		go func(idx int) {
-			defer wg.Done()
-			key := fmt.Sprintf("plugin:concurrent:%d", idx)
-			if err := store.SaveTools(partition, key, cache.ToolsSnapshot{
-				ServerKey: key,
-			}); err != nil {
-				t.Errorf("SaveTools(%s): %v", key, err)
-			}
-		}(i)
-	}
-	wg.Wait()
-
-	for i := 0; i < writers; i++ {
-		key := fmt.Sprintf("plugin:concurrent:%d", i)
-		snapshot, _, err := store.LoadTools(partition, key)
-		if err != nil {
-			t.Fatalf("LoadTools(%s): %v", key, err)
-		}
-		if snapshot.ServerKey != key {
-			t.Errorf("LoadTools(%s) returned ServerKey %q", key, snapshot.ServerKey)
-		}
-	}
-}
-
-// TestAppendDynamicServerConcurrent exercises the dynamicMu mutex on the
-// write path by spraying distinct server descriptors in parallel. Afterwards
-// every injected product ID must be resolvable — a missing entry would
-// indicate a lost write through an un-synchronized map update.
-func TestAppendDynamicServerConcurrent(t *testing.T) {
-	dynamicMu.Lock()
-	prev := struct {
-		endpoints     map[string]string
-		products      map[string]bool
-		aliases       map[string]string
-		toolEndpoints map[string]string
-	}{dynamicEndpoints, dynamicProducts, dynamicAliases, dynamicToolEndpoints}
-	dynamicEndpoints = nil
-	dynamicProducts = nil
-	dynamicAliases = nil
-	dynamicToolEndpoints = nil
-	dynamicMu.Unlock()
-	t.Cleanup(func() {
-		dynamicMu.Lock()
-		dynamicEndpoints = prev.endpoints
-		dynamicProducts = prev.products
-		dynamicAliases = prev.aliases
-		dynamicToolEndpoints = prev.toolEndpoints
-		dynamicMu.Unlock()
-	})
-
-	const n = 32
-	var wg sync.WaitGroup
-	for i := 0; i < n; i++ {
-		wg.Add(1)
-		go func(idx int) {
-			defer wg.Done()
-			id := fmt.Sprintf("plugin-id-%d", idx)
-			endpoint := fmt.Sprintf("https://example.test/%d", idx)
-			AppendDynamicServer(market.ServerDescriptor{
-				Endpoint: endpoint,
-				CLI: market.CLIOverlay{
-					ID:      id,
-					Command: id,
-				},
-			})
-		}(i)
-	}
-	wg.Wait()
-
-	for i := 0; i < n; i++ {
-		id := fmt.Sprintf("plugin-id-%d", i)
-		if endpoint, ok := directRuntimeEndpoint(id, ""); !ok || endpoint == "" {
-			t.Errorf("directRuntimeEndpoint(%q) = (%q, %v), want non-empty", id, endpoint, ok)
-		}
-	}
-}
-
-// TestRegisterStdioClientConcurrent verifies the stdioMu-protected registry
-// survives concurrent writers — every registered client must be looked up
-// afterwards. Uses nil client pointers since LookupStdioClient only compares
-// keys, not values.
-func TestRegisterStdioClientConcurrent(t *testing.T) {
-	stdioMu.Lock()
-	prev := stdioClients
-	stdioClients = make(map[string]*transport.StdioClient)
-	stdioMu.Unlock()
-	t.Cleanup(func() {
-		stdioMu.Lock()
-		stdioClients = prev
-		stdioMu.Unlock()
-	})
-
-	const n = 32
-	var wg sync.WaitGroup
-	for i := 0; i < n; i++ {
-		wg.Add(1)
-		go func(idx int) {
-			defer wg.Done()
-			RegisterStdioClient(fmt.Sprintf("plugin/%d", idx), nil)
-		}(i)
-	}
-	wg.Wait()
-
-	for i := 0; i < n; i++ {
-		key := fmt.Sprintf("plugin/%d", i)
-		if _, ok := LookupStdioClient(key); !ok {
-			t.Errorf("LookupStdioClient(%q) missing after concurrent registration", key)
-		}
-	}
-}
-
-// TestResolvePluginColdTimeouts covers the three code paths of the env
-// parser: unset (defaults), valid duration (applied to all three slots),
-// and invalid duration (logged and ignored, defaults returned).
-func TestResolvePluginColdTimeouts(t *testing.T) {
-	t.Run("defaults when env unset", func(t *testing.T) {
-		t.Setenv(cli.PluginColdTimeoutEnv, "")
-		got := resolvePluginColdTimeouts()
-		if got.httpNoAuth != 1*time.Second {
-			t.Errorf("httpNoAuth = %v, want 1s", got.httpNoAuth)
-		}
-		if got.httpAuth != 1500*time.Millisecond {
-			t.Errorf("httpAuth = %v, want 1.5s", got.httpAuth)
-		}
-		if got.stdio != 2*time.Second {
-			t.Errorf("stdio = %v, want 2s", got.stdio)
-		}
-	})
-	t.Run("env override applies to all slots", func(t *testing.T) {
-		t.Setenv(cli.PluginColdTimeoutEnv, "3500ms")
-		got := resolvePluginColdTimeouts()
-		want := 3500 * time.Millisecond
-		if got.httpNoAuth != want || got.httpAuth != want || got.stdio != want {
-			t.Errorf("override not propagated: %+v", got)
-		}
-	})
-	t.Run("invalid env falls back to defaults", func(t *testing.T) {
-		t.Setenv(cli.PluginColdTimeoutEnv, "not-a-duration")
-		got := resolvePluginColdTimeouts()
-		if got.httpNoAuth != 1*time.Second || got.stdio != 2*time.Second {
-			t.Errorf("invalid env should not override defaults: %+v", got)
-		}
-	})
-	t.Run("non-positive env falls back to defaults", func(t *testing.T) {
-		t.Setenv(cli.PluginColdTimeoutEnv, "0")
-		got := resolvePluginColdTimeouts()
-		if got.httpNoAuth != 1*time.Second {
-			t.Errorf("zero duration should not override defaults, got %v", got.httpNoAuth)
-		}
-	})
-}
@@ -261,7 +261,7 @@ func TestExecuteWritesRecoveryEventIDToStderrOnCapturedFailure(t *testing.T) {

 	oldArgs := os.Args
 	defer func() { os.Args = oldArgs }()
-	os.Args = []string{"dws", "mcp", "doc", "search_documents", "--json", `{"keyword":"design"}`, "--token", "test-token"}
+	os.Args = []string{"dws", "mcp", "doc", "search_documents", "--json", `{"keyword":"design"}`}

 	stdoutR, stdoutW, err := os.Pipe()
 	if err != nil {
@@ -15,25 +15,21 @@ package app

 import (
 	"context"
-	"encoding/json"
-	stderrors "errors"
 	"fmt"
 	"io"
 	"log/slog"
-	"net/url"
 	"os"
 	"os/signal"
 	"path"
 	"path/filepath"
 	"strings"
-	"sync"
 	"syscall"
 	"time"

 	authpkg "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/auth"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/cache"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/cli"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/compat"
+	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/config"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/discovery"
 	apperrors "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/errors"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/executor"
@@ -41,14 +37,10 @@ import (
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/logging"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/market"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/output"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/pat"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/pipeline"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/pipeline/handlers"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/plugin"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/recovery"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/transport"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/config"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/edition"
 	"github.com/spf13/cobra"
 	"github.com/spf13/pflag"
 )
@@ -58,39 +50,35 @@ type outputFileContextKey struct{}
 const recoveryEventStderrPrefix = "RECOVERY_EVENT_ID="

 // Execute runs the root command and returns the process exit code.
-func Execute() (exitCode int) {
+func Execute() int {
+	totalStart := time.Now()
 	defer func() {
-		if r := recover(); r != nil {
-			fmt.Fprintf(os.Stderr, "Error: internal panic: %v\n", r)
-			exitCode = 5
+		if os.Getenv("DWS_PERF_DEBUG") != "" {
+			_, _ = fmt.Fprintf(os.Stderr, "[PERF] Execute total: %v\n", time.Since(totalStart))
 		}
 	}()

-	timing := NewTimingCollector()
-	defer func() {
-		StopAllStdioClients() // Ensure child processes are terminated on exit
-		timing.PrintIfEnabled()
-		timing.WriteReportIfEnabled(RawVersion(), SanitizeCommand(os.Args))
-	}()
-
 	ctx, cancel := signal.NotifyContext(context.Background(), os.Interrupt, syscall.SIGTERM)
 	defer cancel()

-	// Attach timing collector to context for use by child components
-	ctx = WithTimingCollector(ctx, timing)
-
 	initStart := time.Now()
 	recovery.ResetRuntimeState()
 	engine := newPipelineEngine()
 	root := NewRootCommandWithEngine(ctx, engine)
-	timing.Record("cmd_init", time.Since(initStart))
+	if os.Getenv("DWS_PERF_DEBUG") != "" {
+		_, _ = fmt.Fprintf(os.Stderr, "[PERF] command init: %v\n", time.Since(initStart))
+	}

 	// Run PreParse handlers on raw argv before Cobra parses flags.
 	// This corrects model-generated errors like --userId → --user-id
 	// and --limit100 → --limit 100.
 	pipeline.RunPreParse(root, engine)

+	execStart := time.Now()
 	executed, err := root.ExecuteC()
+	if os.Getenv("DWS_PERF_DEBUG") != "" {
+		_, _ = fmt.Fprintf(os.Stderr, "[PERF] cobra ExecuteC: %v\n", time.Since(execStart))
+	}
 	if err != nil {
 		if executed == nil {
 			executed = root
@@ -141,13 +129,8 @@ func flagErrorWithSuggestions(cmd *cobra.Command, err error) error {
 }

 func printExecutionError(root *cobra.Command, stdout, stderr io.Writer, err error) error {
-	var raw apperrors.RawStderrError
-	if stderrors.As(err, &raw) {
-		_, writeErr := fmt.Fprintln(stderr, raw.RawStderr())
-		return writeErr
-	}
 	if wantsJSONErrors(root) {
-		return apperrors.PrintJSON(stderr, err)
+		return apperrors.PrintJSON(stdout, err)
 	}
 	return apperrors.PrintHumanAt(stderr, err, resolveVerbosity(root))
 }
@@ -238,7 +221,6 @@ func NewRootCommandWithEngine(rootCtx context.Context, engine *pipeline.Engine)
 		AuthTokenFunc: func(ctx context.Context) string {
 			return resolveRuntimeAuthToken(ctx, "")
 		},
-		LoggerFunc: FileLoggerInstance,
 	}
 	runner := newCommandRunnerWithFlags(loader, flags)

@@ -265,16 +247,9 @@ func NewRootCommandWithEngine(rootCtx context.Context, engine *pipeline.Engine)
 			// Configure global slog level based on --debug / --verbose flags.
 			configureLogLevel(flags)

-			if err := configureOutputSink(cmd); err != nil {
-				return err
-			}
-			if fn := edition.Get().AfterPersistentPreRun; fn != nil {
-				return fn(cmd, args)
-			}
-			return nil
+			return configureOutputSink(cmd)
 		},
 		PersistentPostRunE: func(cmd *cobra.Command, args []string) error {
-			StopAllStdioClients()
 			CloseFileLogger()
 			return closeOutputSink(cmd)
 		},
@@ -292,40 +267,17 @@ func NewRootCommandWithEngine(rootCtx context.Context, engine *pipeline.Engine)
 		newAuthCommand(),
 		newSkillCommand(),
 		newCacheCommand(),
-		newConfigCommand(),
-		newDoctorCommand(),
 		newCompletionCommand(root),
 		newRecoveryCommand(rootCtx, loader, flags),
-		newUpgradeCommand(),
 		newVersionCommand(),
-		newPluginCommand(),
 		schemaCmd,
 		genSkillsCmd,
 		mcpCmd,
 	}
 	root.AddCommand(utilityCommands...)
-
 	root.AddCommand(newLegacyPublicCommands(rootCtx, runner)...)
 	root.AddCommand(newLegacyHiddenCommands(runner)...)

-	// --- Plugin loading: runs AFTER legacy commands so that
-	// AppendDynamicServer adds plugin endpoints on top of Market
-	// endpoints (SetDynamicServers is called inside loadDynamicCommands).
-	pluginCmds := loadPlugins(engine, runner)
-	if len(pluginCmds) > 0 {
-		addPluginCommandsSafe(root, pluginCmds)
-	}
-
-	// PAT authorization commands (open-source core)
-	patCaller := newToolCallerAdapter(runner, flags)
-	pat.RegisterCommands(root, patCaller)
-
-	if fn := edition.Get().RegisterExtraCommands; fn != nil {
-		caller := newToolCallerAdapter(runner, flags)
-		fn(root, caller)
-		deduplicateCommands(root)
-	}
-
 	hideNonDirectRuntimeCommands(root)
 	configureRootHelp(root)
 	// Set custom flag error handler for better UX
@@ -504,51 +456,24 @@ func newVersionCommand() *cobra.Command {
 		Example:           "  dws version\n  dws version --format json",
 		DisableAutoGenTag: true,
 		RunE: func(cmd *cobra.Command, args []string) error {
-			wantJSON := cmd.Flags().Changed("format")
-			if wantJSON {
-				format, _ := cmd.Flags().GetString("format")
-				wantJSON = (format == "json")
+			format, err := cmd.Flags().GetString("format")
+			if err != nil {
+				return apperrors.NewInternal("failed to read format flag")
 			}
-
-			editionName := edition.Get().Name
-			if editionName == "" {
-				editionName = "open"
+			payload := map[string]any{
+				"version": Version(),
+				"go":      "1.24+",
 			}
-			ver := RawVersion()
-			bt := BuildTime()
-			gc := GitCommit()
-			goVer := "1.24+"
-
-			arch := "MCP Dynamic Aggregation"
-
-			if wantJSON {
-				payload := map[string]any{
-					"version":      ver,
-					"edition":      editionName,
-					"architecture": arch,
-					"go":           goVer,
-				}
-				if bt != "unknown" {
-					payload["build"] = bt
-				}
-				if gc != "unknown" {
-					payload["commit"] = gc
-				}
+			if format == "json" {
 				return output.WriteJSON(cmd.OutOrStdout(), payload)
 			}
-
-			w := cmd.OutOrStdout()
-			fmt.Fprintf(w, "%-16s%s\n", "Version:", ver)
-			fmt.Fprintf(w, "%-16s%s\n", "Edition:", editionName)
-			if bt != "unknown" {
-				fmt.Fprintf(w, "%-16s%s\n", "Build:", bt)
-			}
-			if gc != "unknown" {
-				fmt.Fprintf(w, "%-16s%s\n", "Commit:", gc)
-			}
-			fmt.Fprintf(w, "%-16s%s\n", "Architecture:", arch)
-			fmt.Fprintf(w, "%-16s%s\n", "Go:", goVer)
-			return nil
+			_, err = fmt.Fprintf(
+				cmd.OutOrStdout(),
+				"版本:  %s\nGo:  %s\n",
+				Version(),
+				"1.24+",
+			)
+			return err
 		},
 	}
 }
@@ -645,34 +570,17 @@ func newMCPCommand(ctx context.Context, loader cli.CatalogLoader, runner executo
 }

 // hideNonDirectRuntimeCommands marks top-level product commands as hidden
-// unless they correspond to a product discovered via dynamic server discovery
-// or listed in the edition's VisibleProducts hook.
+// unless they correspond to a product discovered via dynamic server discovery.
 // Public utility commands (auth, cache, completion, version) are always kept
 // visible; explicitly hidden commands stay hidden.
 func hideNonDirectRuntimeCommands(root *cobra.Command) {
-	var allowedProducts map[string]bool
-	if fn := edition.Get().VisibleProducts; fn != nil {
-		products := fn()
-		allowedProducts = make(map[string]bool, len(products))
-		for _, p := range products {
-			allowedProducts[p] = true
-		}
-	} else {
-		allowedProducts = DirectRuntimeProductIDs()
-	}
+	allowedProducts := DirectRuntimeProductIDs()
 	staticCommands := map[string]bool{
 		"auth":       true,
 		"cache":      true,
-		"config":     true,
-		"doctor":     true,
 		"completion": true,
-		"skill":      true,
-		"plugin":     true,
 		"version":    true,
 		"help":       true,
-		"recovery":   true,
-		"schema":     true,
-		"mcp":        true,
 	}
 	for _, cmd := range root.Commands() {
 		name := cmd.Name()
@@ -689,126 +597,11 @@ func hideNonDirectRuntimeCommands(root *cobra.Command) {
 	}
 }

-// reservedCommands is the set of built-in command names that plugins must
-// not override. This protects core CLI functionality from being hijacked
-// by a malicious or misconfigured plugin.
-var reservedCommands = map[string]bool{
-	"auth": true, "login": true, "logout": true,
-	"plugin": true, "skill": true, "cache": true,
-	"config": true, "doctor": true, "completion": true,
-	"recovery": true, "upgrade": true, "version": true,
-	"schema": true, "mcp": true, "help": true,
-}
-
-// addPluginCommandsSafe registers plugin commands with conflict detection.
-//
-// Rules:
-//   - Plugin vs reserved (auth/plugin/cache/...) → reject, warn
-//   - Plugin vs plugin (same name)               → reject later one, warn
-//   - Plugin vs Market dynamic command            → allow, plugin wins
-func addPluginCommandsSafe(root *cobra.Command, pluginCmds []*cobra.Command) {
-	// Build index of existing commands before plugin registration.
-	existing := make(map[string]bool)
-	for _, cmd := range root.Commands() {
-		existing[cmd.Name()] = true
-	}
-
-	pluginSeen := make(map[string]bool)
-
-	for _, cmd := range pluginCmds {
-		name := cmd.Name()
-
-		// Rule 1: never override reserved built-in commands.
-		if reservedCommands[name] {
-			slog.Warn("plugin: command name conflicts with built-in command, skipping",
-				"command", name)
-			continue
-		}
-
-		// Rule 2: plugin vs plugin — first plugin wins.
-		if pluginSeen[name] {
-			slog.Warn("plugin: duplicate command from another plugin, skipping",
-				"command", name)
-			continue
-		}
-		pluginSeen[name] = true
-
-		// Rule 3: plugin vs Market — plugin wins, remove the old one.
-		if existing[name] {
-			for _, old := range root.Commands() {
-				if old.Name() == name {
-					root.RemoveCommand(old)
-					slog.Debug("plugin: overriding Market command",
-						"command", name)
-					break
-				}
-			}
-		}
-
-		root.AddCommand(cmd)
-	}
-}
-
-// deduplicateCommands removes duplicate top-level commands, keeping the last
-// registered one. This ensures overlay commands take precedence over
-// open-source defaults when both register the same product name.
-func deduplicateCommands(root *cobra.Command) {
-	seen := make(map[string]*cobra.Command)
-	var dups []*cobra.Command
-	for _, cmd := range root.Commands() {
-		name := cmd.Name()
-		if prev, ok := seen[name]; ok {
-			dups = append(dups, prev)
-		}
-		seen[name] = cmd
-	}
-	for _, dup := range dups {
-		root.RemoveCommand(dup)
-	}
-}
-
 func cacheStoreFromEnv() *cache.Store {
 	cacheDir := strings.TrimSpace(os.Getenv(cli.CacheDirEnv))
 	return cache.NewStore(cacheDir)
 }

-// pluginColdTimeouts holds the cold-path discovery budget for plugin MCP
-// servers. Timeouts only apply to the *first* discovery for a given
-// plugin/server; subsequent startups take the warm cache path and bypass
-// the network entirely.
-type pluginColdTimeouts struct {
-	httpNoAuth time.Duration
-	httpAuth   time.Duration
-	stdio      time.Duration
-}
-
-// resolvePluginColdTimeouts returns the cold-discovery budget for plugin MCP
-// servers, applying the DWS_PLUGIN_COLD_TIMEOUT override when set. Defaults
-// are tuned so healthy cross-region HTTP endpoints succeed on a cold start
-// and Python/Node-based stdio plugins have headroom for interpreter load,
-// while an unreachable host still surrenders in bounded time.
-func resolvePluginColdTimeouts() pluginColdTimeouts {
-	t := pluginColdTimeouts{
-		httpNoAuth: 1 * time.Second,
-		httpAuth:   1500 * time.Millisecond,
-		stdio:      2 * time.Second,
-	}
-	raw := strings.TrimSpace(os.Getenv(cli.PluginColdTimeoutEnv))
-	if raw == "" {
-		return t
-	}
-	d, err := time.ParseDuration(raw)
-	if err != nil || d <= 0 {
-		slog.Warn("plugin: ignoring invalid DWS_PLUGIN_COLD_TIMEOUT",
-			"value", raw, "error", err)
-		return t
-	}
-	t.httpNoAuth = d
-	t.httpAuth = d
-	t.stdio = d
-	return t
-}
-
 func configureOutputSink(cmd *cobra.Command) error {
 	if local := cmd.LocalFlags().Lookup("output"); local != nil {
 		return nil
@@ -1065,524 +858,11 @@ func CloseFileLogger() {
 	}
 }

-// loadPlugins scans plugin directories, injects their MCP servers into
-// the dynamic server registry, and registers their pipeline hooks.
-// This runs before legacy command construction so that plugin servers
-// are available for EnvironmentLoader.Load().
-func loadPlugins(engine *pipeline.Engine, runner executor.Runner) []*cobra.Command {
-	pluginLoader := plugin.NewLoader(RawVersion())
-
-	// 0a. Inject plugin config values from settings.json as environment
-	// variables so that expandPluginVars can resolve ${KEY} references
-	// in plugin.json headers, endpoints, etc. User-set env vars take
-	// precedence (InjectPluginConfigEnv skips already-set keys).
-	pluginLoader.InjectPluginConfigEnv()
-
-	// Load TokenData once; reused for stdio injection below.
-	tokenData, _ := authpkg.LoadTokenData(defaultConfigDir())
-	var userCtx *plugin.UserContext
-	if tokenData != nil {
-		// Inject user context if either UserID or CorpID is present.
-		if tokenData.UserID != "" || tokenData.CorpID != "" {
-			userCtx = &plugin.UserContext{
-				UserID: tokenData.UserID,
-				CorpID: tokenData.CorpID,
-			}
-		}
-	}
-
-	// 1. Load user plugins (per settings.json)
-	userPlugins := pluginLoader.LoadUser()
-
-	// 2. Load dev plugins (registered via `dws plugin dev`)
-	devPlugins := pluginLoader.LoadDev()
-
-	allPlugins := append(userPlugins, devPlugins...)
-
-	// 3. Discover tools from streamable-http servers and build CLI commands.
-	//    Third-party servers with auth headers are discovered in parallel
-	//    to avoid sequential 10s timeouts when multiple remote servers exist.
-	var pluginCmds []*cobra.Command
-	tc := transport.NewClient(nil)
-
-	// Collect all server descriptors and register auth first (fast, no I/O).
-	type pluginServer struct {
-		plugin *plugin.Plugin
-		srv    market.ServerDescriptor
-	}
-	var httpServers []pluginServer
-
-	for _, p := range allPlugins {
-		for _, srv := range p.ToServerDescriptors() {
-			AppendDynamicServer(srv)
-
-			if len(srv.AuthHeaders) > 0 {
-				registerPluginAuthFromHeaders(srv)
-			}
-
-			if srv.HasCLIMeta {
-				httpServers = append(httpServers, pluginServer{plugin: p, srv: srv})
-			}
-		}
-	}
-
-	// Collect all stdio clients up front so HTTP + stdio discovery can run
-	// concurrently — the slowest plugin (typically an unreachable HTTP
-	// endpoint hitting its dial timeout) dominates the parallel wall-clock,
-	// not the sum of every plugin's cold timeout.
-	type stdioEntry struct {
-		plugin *plugin.Plugin
-		sc     plugin.StdioServerClient
-	}
-	var stdioEntries []stdioEntry
-	for _, p := range allPlugins {
-		for _, sc := range p.StdioClients(userCtx) {
-			// Use background context so the subprocess lives for the CLI
-			// process lifetime (not killed by a short timeout).
-			if err := sc.Client.Start(context.Background()); err != nil {
-				slog.Warn("plugin: failed to start stdio server",
-					"plugin", p.Manifest.Name, "server", sc.Key, "error", err)
-				continue
-			}
-			stdioEntries = append(stdioEntries, stdioEntry{plugin: p, sc: sc})
-		}
-	}
-
-	// Share one cache.Store across all discovery goroutines. Each goroutine
-	// writes to a distinct serverKey path ("tools/<plugin>_<server>.json") with
-	// atomic tmp+rename, so concurrent writes to different keys never collide
-	// on the filesystem. Global in-process registries (AppendDynamicServer,
-	// RegisterStdioClient) carry their own sync.Mutex; see direct_runtime.go
-	// and stdio_registry.go.
-	sharedStore := cacheStoreFromEnv()
-	coldTimeouts := resolvePluginColdTimeouts()
-
-	// Fan out HTTP and stdio discovery in parallel. Each goroutine resolves
-	// its cache hit locally (no network) or runs a bounded cold-path probe.
-	// Wall-clock cost ≈ max(individual plugin latencies), not the sum.
-	httpResults := make([][]*cobra.Command, len(httpServers))
-	stdioResults := make([][]*cobra.Command, len(stdioEntries))
-	var wg sync.WaitGroup
-	for i, ps := range httpServers {
-		wg.Add(1)
-		go func(idx int, ps pluginServer) {
-			defer wg.Done()
-			httpResults[idx] = registerHTTPServer(ps.plugin, ps.srv, tc, runner, sharedStore, coldTimeouts)
-		}(i, ps)
-	}
-	for i, e := range stdioEntries {
-		wg.Add(1)
-		go func(idx int, e stdioEntry) {
-			defer wg.Done()
-			stdioResults[idx] = registerStdioServer(e.plugin, e.sc, runner, sharedStore, coldTimeouts)
-		}(i, e)
-	}
-	wg.Wait()
-	for _, cmds := range httpResults {
-		pluginCmds = append(pluginCmds, cmds...)
-	}
-	for _, cmds := range stdioResults {
-		pluginCmds = append(pluginCmds, cmds...)
-	}
-
-	// 5. Register plugin hooks into pipeline engine
-	if engine != nil {
-		for _, p := range allPlugins {
-			hooksCfg, err := p.LoadHooks()
-			if err != nil {
-				slog.Warn("plugin: failed to load hooks",
-					"plugin", p.Manifest.Name, "error", err)
-				continue
-			}
-			if hooksCfg == nil {
-				continue
-			}
-			for _, entry := range hooksCfg.Hooks {
-				engine.Register(plugin.NewHookAdapter(p.Manifest.Name, entry))
-			}
-		}
-	}
-
-	// 7. Sync plugin skills to agent directories
-	plugin.SyncSkills(allPlugins)
-
-	if len(allPlugins) > 0 {
-		slog.Debug("plugins loaded",
-			"user", len(userPlugins),
-			"dev", len(devPlugins),
-		)
-	}
-
-	return pluginCmds
-}
-
-// pluginCacheKey derives the cache key used to persist a plugin MCP server's
-// tool list. Prefixed with "plugin:" so entries are namespaced apart from the
-// Market-derived cache, and visible distinctly via `dws cache status`.
-func pluginCacheKey(pluginName, serverKey string) string {
-	return "plugin:" + pluginName + ":" + serverKey
-}
-
-// registerHTTPServer discovers tools from a streamable-http MCP server and
-// builds CLI commands. Used for plugin-owned HTTP servers that provide CLI metadata.
-//
-// Startup-latency strategy (issue #119):
-//   - Warm cache: build commands from the persisted tools snapshot
-//     synchronously — no network I/O. `dws --help` returns in ms even when
-//     the plugin endpoint is unreachable.
-//   - Cold cache: synchronous discovery (Initialize + ListTools) with a tight
-//     timeout. The outcome — success or failure — is persisted so the next
-//     invocation hits the warm path. Refresh on demand via `dws cache clean`
-//     / `dws cache refresh`; the cache TTL (7d) otherwise expires naturally.
-//
-// When the server descriptor carries AuthHeaders (from plugin.json "headers"),
-// a dedicated transport.Client is created with the plugin's Bearer token and
-// trusted domains so that third-party MCP servers requiring independent
-// authentication (e.g. Alibaba Cloud Bailian) can be discovered at startup.
-func registerHTTPServer(p *plugin.Plugin, srv market.ServerDescriptor, tc *transport.Client, runner executor.Runner, store *cache.Store, timeouts pluginColdTimeouts) []*cobra.Command {
-	partition := config.DefaultPartition
-	cacheKey := pluginCacheKey(p.Manifest.Name, srv.Key)
-
-	if snapshot, freshness, err := store.LoadTools(partition, cacheKey); err == nil {
-		slog.Debug("plugin: http server served from cache",
-			"plugin", p.Manifest.Name, "server", srv.Key,
-			"tools", len(snapshot.Tools), "freshness", string(freshness))
-		return buildHTTPCommandsFromTools(srv, snapshot.Tools, runner)
-	}
-
-	// Cold cache: synchronous discovery. Persist the outcome even on failure
-	// (empty tools == negative cache) so the next invocation takes the fast
-	// path regardless of endpoint health.
-	tools := discoverHTTPTools(p, srv, tc, timeouts)
-	_ = store.SaveTools(partition, cacheKey, cache.ToolsSnapshot{
-		ServerKey: cacheKey,
-		Tools:     tools,
-	})
-	return buildHTTPCommandsFromTools(srv, tools, runner)
-}
-
-// discoverHTTPTools performs the blocking Initialize + ListTools handshake
-// for an HTTP MCP server and returns the discovered tools. Returns nil on
-// any transport/protocol error; errors are logged at Debug level.
-func discoverHTTPTools(p *plugin.Plugin, srv market.ServerDescriptor, tc *transport.Client, timeouts pluginColdTimeouts) []transport.ToolDescriptor {
-	// Cold-path budget. An unreachable endpoint will burn the full window
-	// via the TCP dial timeout; a healthy localhost/third-party endpoint
-	// typically responds in <200 ms. Third-party servers with auth get a
-	// slightly larger window to accommodate TLS + auth RTT. Operators with
-	// cross-region endpoints can relax the window via DWS_PLUGIN_COLD_TIMEOUT.
-	// The outcome is persisted as a negative cache so subsequent startups
-	// (80 ms warm) are unaffected. See issue #119.
-	timeout := timeouts.httpNoAuth
-	if len(srv.AuthHeaders) > 0 {
-		timeout = timeouts.httpAuth
-	}
-	ctx, cancel := context.WithTimeout(context.Background(), timeout)
-	defer cancel()
-
-	discoveryClient := tc
-	if len(srv.AuthHeaders) > 0 {
-		discoveryClient = buildPluginAuthClient(tc, srv)
-	}
-
-	if _, err := discoveryClient.Initialize(ctx, srv.Endpoint); err != nil {
-		slog.Debug("plugin: http server offline, skipping tool discovery",
-			"plugin", p.Manifest.Name, "server", srv.Key)
-		return nil
-	}
-
-	toolsResult, err := discoveryClient.ListTools(ctx, srv.Endpoint)
-	if err != nil {
-		slog.Debug("plugin: http ListTools failed",
-			"plugin", p.Manifest.Name, "server", srv.Key, "error", err)
-		return nil
-	}
-	return toolsResult.Tools
-}
-
-// buildHTTPCommandsFromTools converts a tool list into Cobra commands via
-// the BuildDynamicCommands path. Returns nil for an empty tool list.
-func buildHTTPCommandsFromTools(srv market.ServerDescriptor, tools []transport.ToolDescriptor, runner executor.Runner) []*cobra.Command {
-	if len(tools) == 0 {
-		return nil
-	}
-
-	detailsByID := make(map[string][]market.DetailTool)
-	var detailTools []market.DetailTool
-	for _, tool := range tools {
-		schemaJSON := ""
-		if tool.InputSchema != nil {
-			if data, marshalErr := json.Marshal(tool.InputSchema); marshalErr == nil {
-				schemaJSON = string(data)
-			}
-		}
-		detailTools = append(detailTools, market.DetailTool{
-			ToolName:    tool.Name,
-			ToolTitle:   tool.Title,
-			ToolDesc:    tool.Description,
-			IsSensitive: tool.Sensitive,
-			ToolRequest: schemaJSON,
-		})
-	}
-	detailsByID[strings.TrimSpace(srv.CLI.ID)] = detailTools
-
-	// If the server has no ToolOverrides (e.g. third-party MCP servers that
-	// only declare cli.id and cli.command), auto-generate one override per
-	// discovered tool so BuildDynamicCommands can create leaf commands.
-	if len(srv.CLI.ToolOverrides) == 0 {
-		srv.CLI.ToolOverrides = make(map[string]market.CLIToolOverride, len(tools))
-		for _, tool := range tools {
-			srv.CLI.ToolOverrides[tool.Name] = market.CLIToolOverride{
-				CLIName: deriveToolCLIName(tool.Name),
-			}
-		}
-	}
-
-	return compat.BuildDynamicCommands(
-		[]market.ServerDescriptor{srv}, runner, detailsByID)
-}
-
-// deriveToolCLIName converts an MCP tool name (e.g. "web_search" or
-// "maps.search_poi") into a kebab-case CLI command name ("search" or
-// "search-poi"). It strips common prefixes and replaces underscores/dots
-// with hyphens.
-func deriveToolCLIName(toolName string) string {
-	// Use the last segment after "." as the base name.
-	if idx := strings.LastIndex(toolName, "."); idx >= 0 {
-		toolName = toolName[idx+1:]
-	}
-	// Replace underscores with hyphens for kebab-case.
-	return strings.ReplaceAll(toolName, "_", "-")
-}
-
-// buildPluginAuthClient creates a transport.Client copy with the plugin's
-// Bearer token and trusted domains injected. This allows third-party MCP
-// servers that require independent authentication to be discovered at startup.
-func buildPluginAuthClient(base *transport.Client, srv market.ServerDescriptor) *transport.Client {
-	authToken := ""
-	extraHeaders := make(map[string]string)
-	for key, value := range srv.AuthHeaders {
-		if strings.EqualFold(key, "Authorization") {
-			authToken = strings.TrimPrefix(value, "Bearer ")
-			authToken = strings.TrimSpace(authToken)
-		} else {
-			extraHeaders[key] = value
-		}
-	}
-	if authToken == "" {
-		return base
-	}
-	client := base.WithAuth(authToken, extraHeaders)
-	// Trust the endpoint's hostname so the token is actually sent.
-	if parsed, err := url.Parse(srv.Endpoint); err == nil {
-		host := parsed.Hostname()
-		client.TrustedDomains = []string{host, "*." + host}
-	}
-	return client
-}
-
-// registerPluginAuthFromHeaders extracts authentication credentials from
-// a server descriptor's AuthHeaders and registers them in the global
-// PluginAuth registry. The runner uses this registry at execution time
-// to inject the correct Bearer token for third-party MCP servers.
-func registerPluginAuthFromHeaders(srv market.ServerDescriptor) {
-	authToken := ""
-	extraHeaders := make(map[string]string)
-	for key, value := range srv.AuthHeaders {
-		if strings.EqualFold(key, "Authorization") {
-			authToken = strings.TrimPrefix(value, "Bearer ")
-			authToken = strings.TrimSpace(authToken)
-		} else {
-			extraHeaders[key] = value
-		}
-	}
-	if authToken == "" {
-		return
-	}
-	var trustedDomains []string
-	if parsed, err := url.Parse(srv.Endpoint); err == nil {
-		host := parsed.Hostname()
-		trustedDomains = []string{host, "*." + host}
-	}
-	productID := strings.TrimSpace(srv.CLI.ID)
-	if productID == "" {
-		productID = srv.Key
-	}
-	RegisterPluginAuth(productID, &PluginAuth{
-		Token:          authToken,
-		ExtraHeaders:   extraHeaders,
-		TrustedDomains: trustedDomains,
-	})
-}
-
-// registerStdioServer initializes a stdio MCP server, discovers its tools
-// via ListTools, builds CLI commands, and registers the StdioClient for
-// runtime dispatch. Returns generated cobra commands.
-//
-// Warm-cache fast path (issue #119): when a tools snapshot is already cached
-// for this plugin/server, skip the Initialize + ListTools RPC round-trip and
-// rebuild commands directly from the snapshot. Cold cache falls back to
-// synchronous discovery with a 4s cap and persists the outcome.
-func registerStdioServer(p *plugin.Plugin, sc plugin.StdioServerClient, runner executor.Runner, store *cache.Store, timeouts pluginColdTimeouts) []*cobra.Command {
-	partition := config.DefaultPartition
-	cacheKey := pluginCacheKey(p.Manifest.Name, sc.Key)
-
-	if snapshot, freshness, err := store.LoadTools(partition, cacheKey); err == nil {
-		slog.Debug("plugin: stdio server served from cache",
-			"plugin", p.Manifest.Name, "server", sc.Key,
-			"tools", len(snapshot.Tools), "freshness", string(freshness))
-		return buildStdioCommands(p, sc, snapshot.Tools, runner)
-	}
-
-	tools := discoverStdioTools(p, sc, timeouts)
-	_ = store.SaveTools(partition, cacheKey, cache.ToolsSnapshot{
-		ServerKey: cacheKey,
-		Tools:     tools,
-	})
-	return buildStdioCommands(p, sc, tools, runner)
-}
-
-// discoverStdioTools performs the blocking Initialize + ListTools handshake
-// on a stdio MCP subprocess. Returns nil on any error (logged at Warn level).
-// The default 2s budget comfortably accommodates Python/Node runtimes whose
-// interpreter + dependency load dominates the first response. Operators with
-// heavier startup chains can relax further via DWS_PLUGIN_COLD_TIMEOUT.
-func discoverStdioTools(p *plugin.Plugin, sc plugin.StdioServerClient, timeouts pluginColdTimeouts) []transport.ToolDescriptor {
-	ctx, cancel := context.WithTimeout(context.Background(), timeouts.stdio)
-	defer cancel()
-
-	if _, err := sc.Client.Initialize(ctx); err != nil {
-		slog.Warn("plugin: stdio initialize failed",
-			"plugin", p.Manifest.Name, "server", sc.Key, "error", err)
-		return nil
-	}
-	toolsResult, err := sc.Client.ListTools(ctx)
-	if err != nil {
-		slog.Warn("plugin: stdio ListTools failed",
-			"plugin", p.Manifest.Name, "server", sc.Key, "error", err)
-		return nil
-	}
-	return toolsResult.Tools
-}
-
-// buildStdioCommands constructs Cobra commands from a tool list and
-// registers the runtime dispatch state (StdioClient + dynamic server).
-// Returns nil for an empty tool list.
-func buildStdioCommands(p *plugin.Plugin, sc plugin.StdioServerClient, tools []transport.ToolDescriptor, runner executor.Runner) []*cobra.Command {
-	if len(tools) == 0 {
-		slog.Debug("plugin: stdio server has no tools",
-			"plugin", p.Manifest.Name, "server", sc.Key)
-		return nil
-	}
-
-	// Build CLIOverlay: use manifest CLI metadata if present, else auto-generate.
-	serverID := sc.Key
-	overlay := market.CLIOverlay{
-		ID:      serverID,
-		Command: serverID,
-	}
-	if srv, ok := p.Manifest.MCPServers[sc.Key]; ok && len(srv.CLI) > 0 {
-		cliData := srv.CLI
-		// If cli is a JSON string, treat it as a relative file path to an overlay file.
-		if len(cliData) > 0 && cliData[0] == '"' {
-			var cliPath string
-			if err := json.Unmarshal(cliData, &cliPath); err == nil && cliPath != "" {
-				absPath := filepath.Join(p.Root, cliPath)
-				if fileData, readErr := os.ReadFile(absPath); readErr == nil {
-					cliData = fileData
-				} else {
-					slog.Warn("plugin: failed to read CLI overlay file",
-						"plugin", p.Manifest.Name, "path", absPath, "error", readErr)
-				}
-			}
-		}
-		if err := json.Unmarshal(cliData, &overlay); err != nil {
-			slog.Warn("plugin: failed to parse CLI overlay for stdio server",
-				"plugin", p.Manifest.Name, "server", sc.Key, "error", err)
-		}
-		if overlay.ID == "" {
-			overlay.ID = serverID
-		}
-		if overlay.Command == "" {
-			overlay.Command = serverID
-		}
-	}
-
-	// Auto-generate ToolOverrides from discovered tools when not provided.
-	if len(overlay.ToolOverrides) == 0 {
-		overlay.ToolOverrides = make(map[string]market.CLIToolOverride)
-		if len(overlay.Prefixes) == 0 {
-			overlay.Prefixes = []string{serverID}
-		}
-		for _, tool := range tools {
-			overlay.ToolOverrides[tool.Name] = market.CLIToolOverride{
-				IsSensitive: tool.Sensitive,
-			}
-		}
-	}
-
-	// Construct virtual endpoint and server descriptor.
-	endpoint := StdioEndpoint(p.Manifest.Name, sc.Key)
-
-	descriptor := market.ServerDescriptor{
-		Key:         sc.Key,
-		DisplayName: p.Manifest.Name + "/" + sc.Key,
-		Description: p.Manifest.Description,
-		Endpoint:    endpoint,
-		Source:      "plugin",
-		CLI:         overlay,
-		HasCLIMeta:  true,
-	}
-
-	AppendDynamicServer(descriptor)
-	// Register with pluginName/serverKey format for cleanup by plugin name
-	RegisterStdioClient(p.Manifest.Name+"/"+serverID, sc.Client)
-
-	// Convert tool descriptors to DetailTool entries for flag generation.
-	detailsByID := make(map[string][]market.DetailTool)
-	var detailTools []market.DetailTool
-	for _, tool := range tools {
-		schemaJSON := ""
-		if tool.InputSchema != nil {
-			if data, marshalErr := json.Marshal(tool.InputSchema); marshalErr == nil {
-				schemaJSON = string(data)
-			}
-		}
-		detailTools = append(detailTools, market.DetailTool{
-			ToolName:    tool.Name,
-			ToolTitle:   tool.Title,
-			ToolDesc:    tool.Description,
-			IsSensitive: tool.Sensitive,
-			ToolRequest: schemaJSON,
-		})
-	}
-	detailsByID[serverID] = detailTools
-
-	cmds := compat.BuildDynamicCommands(
-		[]market.ServerDescriptor{descriptor}, runner, detailsByID)
-
-	slog.Debug("plugin: stdio server registered",
-		"plugin", p.Manifest.Name, "server", sc.Key,
-		"tools", len(tools), "commands", len(cmds))
-
-	return cmds
-}
-
 // newPipelineEngine creates and configures the pipeline engine with
-// handlers for all five pipeline phases. The phases execute in order:
-// Register → PreParse → PostParse → PreRequest → PostResponse.
-//
-// Phases are invoked at their respective integration points:
-//   - Register:     during command tree construction (newMCPCommand)
-//   - PreParse:     before Cobra parses raw argv (RunPreParse)
-//   - PostParse:    after Cobra parsing, before validation (canonical RunE)
-//   - PreRequest:   after validation, before JSON-RPC dispatch (canonical RunE)
-//   - PostResponse: after transport returns, before stdout (canonical RunE)
+// the standard set of handlers for model input correction.
 func newPipelineEngine() *pipeline.Engine {
 	engine := pipeline.NewEngine()
 	engine.RegisterAll(
-		// Register handler runs during command tree building.
-		handlers.RegisterHandler{},
-
 		// PreParse handlers run in order: alias → sticky → paramname.
 		// Alias normalises case first (--userId → --user-id), then
 		// sticky splits glued values (--limit100 → --limit 100), then
@@ -1593,12 +873,6 @@ func newPipelineEngine() *pipeline.Engine {

 		// PostParse handlers normalise structured values.
 		handlers.ParamValueHandler{},
-
-		// PreRequest handler inspects the validated payload before dispatch.
-		handlers.PreRequestHandler{},
-
-		// PostResponse handler processes the response before output.
-		handlers.PostResponseHandler{},
 	)
 	return engine
 }
@@ -29,14 +29,6 @@ import (
 	mockmcp "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/test/mock_mcp"
 )

-// patLikeError simulates an edition-specific PAT error that implements both
-// ExitCoder (exit code 4) and RawStderrError (raw JSON to stderr).
-type patLikeError struct{ raw string }
-
-func (e *patLikeError) Error() string     { return e.raw }
-func (e *patLikeError) ExitCode() int     { return 4 }
-func (e *patLikeError) RawStderr() string { return e.raw }
-
 func TestPrintExecutionErrorDefaultsToJSON(t *testing.T) {
 	t.Parallel()

@@ -51,11 +43,11 @@ func TestPrintExecutionErrorDefaultsToJSON(t *testing.T) {
 	if err != nil {
 		t.Fatalf("printExecutionError() error = %v", err)
 	}
-	if stdout.Len() != 0 {
-		t.Fatalf("stdout = %q, want empty when errors go to stderr", stdout.String())
+	if stderr.Len() != 0 {
+		t.Fatalf("stderr = %q, want empty for JSON error output", stderr.String())
 	}
-	if !strings.Contains(stderr.String(), "\"category\": \"validation\"") {
-		t.Fatalf("stderr = %q, want JSON error payload", stderr.String())
+	if !strings.Contains(stdout.String(), "\"category\": \"validation\"") {
+		t.Fatalf("stdout = %q, want JSON error payload", stdout.String())
 	}
 }

@@ -73,11 +65,11 @@ func TestPrintExecutionErrorUsesJSONWhenFormatIsJSON(t *testing.T) {
 	if err != nil {
 		t.Fatalf("printExecutionError() error = %v", err)
 	}
-	if stdout.Len() != 0 {
-		t.Fatalf("stdout = %q, want empty when errors go to stderr", stdout.String())
+	if stderr.Len() != 0 {
+		t.Fatalf("stderr = %q, want empty for JSON error output", stderr.String())
 	}
-	if !strings.Contains(stderr.String(), "\"category\": \"validation\"") {
-		t.Fatalf("stderr = %q, want JSON error payload", stderr.String())
+	if !strings.Contains(stdout.String(), "\"category\": \"validation\"") {
+		t.Fatalf("stdout = %q, want JSON error payload", stdout.String())
 	}
 }

@@ -105,11 +97,11 @@ func TestPrintExecutionErrorUsesJSONWhenCommandSetsJSONFlag(t *testing.T) {
 	if err != nil {
 		t.Fatalf("printExecutionError() error = %v", err)
 	}
-	if stdout.Len() != 0 {
-		t.Fatalf("stdout = %q, want empty when errors go to stderr", stdout.String())
+	if stderr.Len() != 0 {
+		t.Fatalf("stderr = %q, want empty for JSON error output", stderr.String())
 	}
-	if !strings.Contains(stderr.String(), "\"category\": \"validation\"") {
-		t.Fatalf("stderr = %q, want JSON error payload", stderr.String())
+	if !strings.Contains(stdout.String(), "\"category\": \"validation\"") {
+		t.Fatalf("stdout = %q, want JSON error payload", stdout.String())
 	}
 }

@@ -180,8 +172,8 @@ func TestVersionCommandDoesNotRequirePINOrLogin(t *testing.T) {
 	if err := root.Execute(); err != nil {
 		t.Fatalf("Execute(version) error = %v", err)
 	}
-	if !strings.Contains(out.String(), "Version:") {
-		t.Fatalf("version output missing Version line:\n%s", out.String())
+	if !strings.Contains(out.String(), "\"version\"") {
+		t.Fatalf("version output missing version key:\n%s", out.String())
 	}
 }

@@ -221,8 +213,8 @@ func TestVersionCommandUsesCachedRegistryWithoutBlockingAgedDiscovery(t *testing
 	if elapsed := time.Since(start); elapsed >= 200*time.Millisecond {
 		t.Fatalf("Execute(version) took %v, want cached startup under 200ms", elapsed)
 	}
-	if !strings.Contains(out.String(), "Version:") {
-		t.Fatalf("version output missing Version line:\n%s", out.String())
+	if !strings.Contains(out.String(), "\"version\"") {
+		t.Fatalf("version output missing version key:\n%s", out.String())
 	}
 }

@@ -263,11 +255,6 @@ func TestRootHelpDoesNotRequirePINOrLogin(t *testing.T) {
 	if !strings.Contains(out.String(), "Discovered MCP Services:") {
 		t.Fatalf("root help output missing MCP summary:\n%s", out.String())
 	}
-	for _, want := range []string{"Utility Commands:", "skill", "auth", "version"} {
-		if !strings.Contains(out.String(), want) {
-			t.Fatalf("root help output missing %q:\n%s", want, out.String())
-		}
-	}
 }

 func TestRootShortHelpDoesNotRequirePINOrLogin(t *testing.T) {
@@ -355,86 +342,3 @@ func TestNestedShortHelpDoesNotRequirePINOrLogin(t *testing.T) {
 		t.Fatalf("nested short help output missing command title:\n%s", out.String())
 	}
 }
-
-func TestPrintExecutionError_RawStderrError_writes_raw_JSON_to_stderr(t *testing.T) {
-	t.Parallel()
-
-	rawJSON := `{"success":false,"code":"PAT_LOW_RISK_NO_PERMISSION","data":{}}`
-	err := &patLikeError{raw: rawJSON}
-
-	root := NewRootCommand()
-	var stdout, stderr bytes.Buffer
-	writeErr := printExecutionError(root, &stdout, &stderr, err)
-	if writeErr != nil {
-		t.Fatalf("printExecutionError() error = %v", writeErr)
-	}
-	if stdout.Len() != 0 {
-		t.Fatalf("stdout = %q, want empty for RawStderrError", stdout.String())
-	}
-	got := strings.TrimSpace(stderr.String())
-	if got != rawJSON {
-		t.Fatalf("stderr = %q, want raw JSON %q", got, rawJSON)
-	}
-}
-
-func TestPrintExecutionError_RawStderrError_exit_code_is_4(t *testing.T) {
-	t.Parallel()
-
-	err := &patLikeError{raw: `{"code":"PAT_MEDIUM_RISK_NO_PERMISSION"}`}
-	exitCode := apperrors.ExitCode(err)
-	if exitCode != 4 {
-		t.Fatalf("apperrors.ExitCode(patLikeError) = %d, want 4", exitCode)
-	}
-}
-
-func TestPrintExecutionError_RawStderrError_takes_precedence_over_JSON_mode(t *testing.T) {
-	t.Parallel()
-
-	rawJSON := `{"success":false,"code":"PAT_HIGH_RISK_NO_PERMISSION"}`
-	err := &patLikeError{raw: rawJSON}
-
-	root := NewRootCommand()
-	_ = root.PersistentFlags().Set("format", "json")
-
-	var stdout, stderr bytes.Buffer
-	writeErr := printExecutionError(root, &stdout, &stderr, err)
-	if writeErr != nil {
-		t.Fatalf("printExecutionError() error = %v", writeErr)
-	}
-	if stdout.Len() != 0 {
-		t.Fatalf("stdout = %q, want empty — RawStderrError should bypass JSON mode", stdout.String())
-	}
-	if !strings.Contains(stderr.String(), "PAT_HIGH_RISK_NO_PERMISSION") {
-		t.Fatalf("stderr = %q, want raw PAT JSON", stderr.String())
-	}
-}
-
-// simulateExecuteWithPanic mirrors the recovery pattern in Execute():
-// named return + defer recover → exitCode = 5 on panic.
-func simulateExecuteWithPanic(doPanic bool) (exitCode int) {
-	defer func() {
-		if r := recover(); r != nil {
-			exitCode = 5
-		}
-	}()
-	if doPanic {
-		panic("test panic")
-	}
-	return 0
-}
-
-func TestExecute_panic_recovery_returns_exit_5(t *testing.T) {
-	t.Parallel()
-	code := simulateExecuteWithPanic(true)
-	if code != 5 {
-		t.Fatalf("panic recovery exitCode = %d, want 5", code)
-	}
-}
-
-func TestExecute_no_panic_returns_0(t *testing.T) {
-	t.Parallel()
-	code := simulateExecuteWithPanic(false)
-	if code != 0 {
-		t.Fatalf("no-panic exitCode = %d, want 0", code)
-	}
-}
@@ -5,8 +5,6 @@ import (
 	"strings"
 	"text/tabwriter"

-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/i18n"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/edition"
 	"github.com/spf13/cobra"
 )

@@ -15,26 +13,6 @@ func configureRootHelp(root *cobra.Command) {
 		return
 	}

-	// Replace the cobra-default English help command with a localized one so
-	// that both its listing short (shown in `dws --help`) and its own
-	// `dws help --help` long text follow the active locale.
-	root.SetHelpCommand(&cobra.Command{
-		Use:   "help [command]",
-		Short: i18n.T("查看任意命令的帮助信息"),
-		Long: i18n.T("显示任意命令的帮助文案。\n" +
-			"用法：dws help [命令路径] 查看完整说明。"),
-		DisableAutoGenTag: true,
-		Run: func(c *cobra.Command, args []string) {
-			target, _, err := c.Root().Find(args)
-			if target == nil || err != nil {
-				c.Root().HelpFunc()(c.Root(), args)
-				return
-			}
-			target.InitDefaultHelpFlag()
-			_ = target.Help()
-		},
-	})
-
 	defaultHelpFunc := root.HelpFunc()
 	root.SetHelpFunc(func(cmd *cobra.Command, args []string) {
 		if cmd != root {
@@ -47,7 +25,6 @@ func configureRootHelp(root *cobra.Command) {

 func renderRootHelp(root *cobra.Command) {
 	services := visibleMCPRootCommands(root)
-	utilities := visibleUtilityRootCommands(root)
 	w := root.OutOrStdout()

 	if len(services) == 0 {
@@ -67,21 +44,8 @@ func renderRootHelp(root *cobra.Command) {

 	_, _ = fmt.Fprintln(w, "Usage:")
 	_, _ = fmt.Fprintln(w, "  dws <service> [command] [flags]")
-	if len(utilities) > 0 {
-		_, _ = fmt.Fprintln(w, "  dws <command> [flags]")
-	}
 	_, _ = fmt.Fprintln(w)
-	if len(utilities) > 0 {
-		_, _ = fmt.Fprintln(w, "Utility Commands:")
-		_, _ = fmt.Fprintln(w)
-		tw := tabwriter.NewWriter(w, 0, 0, 2, ' ', 0)
-		for _, utility := range utilities {
-			_, _ = fmt.Fprintf(tw, "  %s\t%s\n", utility.Name(), strings.TrimSpace(utility.Short))
-		}
-		_ = tw.Flush()
-		_, _ = fmt.Fprintln(w)
-	}
-	_, _ = fmt.Fprintln(w, `Use "dws <service> --help" for more information about a discovered MCP service or "dws <command> --help" for utility commands.`)
+	_, _ = fmt.Fprintln(w, `Use "dws <service> --help" for more information about a discovered MCP service.`)
 }

 func visibleMCPRootCommands(root *cobra.Command) []*cobra.Command {
@@ -89,16 +53,7 @@ func visibleMCPRootCommands(root *cobra.Command) []*cobra.Command {
 		return nil
 	}

-	var allowed map[string]bool
-	if fn := edition.Get().VisibleProducts; fn != nil {
-		products := fn()
-		allowed = make(map[string]bool, len(products))
-		for _, p := range products {
-			allowed[p] = true
-		}
-	} else {
-		allowed = DirectRuntimeProductIDs()
-	}
+	allowed := DirectRuntimeProductIDs()
 	if len(allowed) == 0 {
 		return nil
 	}
@@ -115,29 +70,3 @@ func visibleMCPRootCommands(root *cobra.Command) []*cobra.Command {
 	}
 	return commands
 }
-
-func visibleUtilityRootCommands(root *cobra.Command) []*cobra.Command {
-	if root == nil {
-		return nil
-	}
-
-	productCommands := DirectRuntimeProductIDs()
-	if fn := edition.Get().VisibleProducts; fn != nil {
-		productCommands = make(map[string]bool, len(fn()))
-		for _, product := range fn() {
-			productCommands[product] = true
-		}
-	}
-
-	commands := make([]*cobra.Command, 0)
-	for _, cmd := range root.Commands() {
-		if cmd == nil || cmd.Hidden {
-			continue
-		}
-		if productCommands[cmd.Name()] {
-			continue
-		}
-		commands = append(commands, cmd)
-	}
-	return commands
-}
@@ -15,10 +15,9 @@ package app

 import (
 	"context"
-	"crypto/rand"
-	"encoding/hex"
 	"errors"
 	"fmt"
+	"io"
 	"log/slog"
 	"net/http"
 	"os"
@@ -30,54 +29,10 @@ import (
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/cli"
 	apperrors "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/errors"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/executor"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/logging"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/safety"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/transport"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/configmeta"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/edition"
 )

-func init() {
-	configmeta.Register(configmeta.ConfigItem{
-		Name:        "DWS_RUNTIME_CONTENT_SCAN",
-		Category:    configmeta.CategoryRuntime,
-		Description: "启用 MCP 响应内容安全扫描",
-		Example:     "true",
-	})
-	configmeta.Register(configmeta.ConfigItem{
-		Name:        "DWS_RUNTIME_CONTENT_SCAN_ENFORCE",
-		Category:    configmeta.CategoryRuntime,
-		Description: "内容安全扫描发现问题时阻断响应",
-		Example:     "true",
-	})
-	configmeta.Register(configmeta.ConfigItem{
-		Name:        "DWS_RUNTIME_CONTENT_SCAN_REPORT",
-		Category:    configmeta.CategoryRuntime,
-		Description: "在 JSON 输出中包含安全扫描报告",
-		Example:     "true",
-	})
-	configmeta.Register(configmeta.ConfigItem{
-		Name:        "DINGTALK_AGENT",
-		Category:    configmeta.CategoryExternal,
-		Description: "MCP 请求 x-dingtalk-agent 头",
-	})
-	configmeta.Register(configmeta.ConfigItem{
-		Name:        "DINGTALK_TRACE_ID",
-		Category:    configmeta.CategoryExternal,
-		Description: "MCP 请求 x-dingtalk-trace-id 头",
-	})
-	configmeta.Register(configmeta.ConfigItem{
-		Name:        "DINGTALK_SESSION_ID",
-		Category:    configmeta.CategoryExternal,
-		Description: "MCP 请求 x-dingtalk-session-id 头",
-	})
-	configmeta.Register(configmeta.ConfigItem{
-		Name:        "DINGTALK_MESSAGE_ID",
-		Category:    configmeta.CategoryExternal,
-		Description: "MCP 请求 x-dingtalk-message-id 头",
-	})
-}
-
 const (
 	runtimeContentScanEnv             = "DWS_RUNTIME_CONTENT_SCAN"
 	runtimeContentScanEnforceEnv      = "DWS_RUNTIME_CONTENT_SCAN_ENFORCE"
@@ -88,21 +43,9 @@ const (
 	envDingtalkTraceID   = "DINGTALK_TRACE_ID"
 	envDingtalkSessionID = "DINGTALK_SESSION_ID"
 	envDingtalkMessageID = "DINGTALK_MESSAGE_ID"
-
-	// Environment variables for third-party channel integration
-	envDWSChannel = "DWS_CHANNEL"
 )

 func newCommandRunnerWithFlags(loader cli.CatalogLoader, flags *GlobalFlags) executor.Runner {
-	// Ensure DWS_CLIENT_ID env is populated from persisted config before
-	// resolveIdentityHeaders reads it.  This covers fresh-process cold starts
-	// where no env var has been inherited from a parent process.
-	if os.Getenv("DWS_CLIENT_ID") == "" {
-		if cid := authpkg.ClientID(); cid != "" {
-			_ = os.Setenv("DWS_CLIENT_ID", cid)
-		}
-	}
-
 	var httpClient *http.Client
 	if flags != nil && flags.Timeout > 0 {
 		httpClient = &http.Client{Timeout: time.Duration(flags.Timeout) * time.Second}
@@ -132,6 +75,13 @@ type runtimeRunner struct {
 }

 func (r *runtimeRunner) Run(ctx context.Context, invocation executor.Invocation) (executor.Result, error) {
+	totalStart := time.Now()
+	defer func() {
+		if os.Getenv("DWS_PERF_DEBUG") != "" {
+			_, _ = fmt.Fprintf(os.Stderr, "[PERF] runtimeRunner.Run total: %v\n", time.Since(totalStart))
+		}
+	}()
+
 	if r.loader == nil || r.transport == nil {
 		return r.fallback.Run(ctx, invocation)
 	}
@@ -145,25 +95,15 @@ func (r *runtimeRunner) Run(ctx context.Context, invocation executor.Invocation)
 		return r.executeInvocation(ctx, endpoint, invocation)
 	}

-	// Prefetch the Keychain token in the background. Keychain access costs
-	// ~70ms on macOS; starting it here lets the load overlap with endpoint
-	// resolution and catalog loading below.
-	go getCachedRuntimeToken(ctx)
-
 	if shouldUseDirectRuntime(invocation) {
 		if endpoint, ok := directRuntimeEndpoint(invocation.CanonicalProduct, invocation.Tool); ok {
 			return r.executeInvocation(ctx, endpoint, invocation)
 		}
 	}

-	catalogStart := time.Now()
 	catalog, err := r.loader.Load(ctx)
-	RecordTiming(ctx, "catalog_load", time.Since(catalogStart))
 	if err != nil {
-		var degraded *cli.CatalogDegraded
-		if !errors.As(err, &degraded) {
-			return executor.Result{}, err
-		}
+		return executor.Result{}, err
 	}

 	product, ok := catalog.FindProduct(invocation.CanonicalProduct)
@@ -184,60 +124,19 @@ func (r *runtimeRunner) Run(ctx context.Context, invocation executor.Invocation)
 	return r.executeInvocation(ctx, endpoint, invocation)
 }

-func (r *runtimeRunner) executeInvocation(ctx context.Context, endpoint string, invocation executor.Invocation) (result executor.Result, retErr error) {
-	// Route stdio:// endpoints to the local StdioClient — no HTTP, no auth.
-	if IsStdioEndpoint(endpoint) {
-		return r.executeStdioInvocation(ctx, invocation)
-	}
-
-	invokeStart := time.Now()
-	execID := generateExecutionID()
-	r.transport.ExecutionId = execID
-
+func (r *runtimeRunner) executeInvocation(ctx context.Context, endpoint string, invocation executor.Invocation) (executor.Result, error) {
 	// Lazy bind FileLogger: it may be nil at construction time because
 	// configureLogLevel runs later in PersistentPreRunE.
 	if r.transport.FileLogger == nil {
 		r.transport.FileLogger = FileLoggerInstance()
 	}

-	fl := r.transport.FileLogger
-
-	defer func() {
-		var errCat, errReason string
-		if retErr != nil {
-			var typed *apperrors.Error
-			if errors.As(retErr, &typed) {
-				errCat = string(typed.Category)
-				errReason = typed.Reason
-			} else {
-				errCat = "unknown"
-				errReason = retErr.Error()
-			}
-		}
-		logging.LogCommandEnd(fl, execID,
-			invocation.CanonicalProduct, invocation.Tool,
-			retErr == nil, time.Since(invokeStart), errCat, errReason)
-	}()
-
-	// Check if this product has plugin-level auth credentials registered.
-	// If so, use the plugin's token instead of the default DingTalk OAuth token.
-	// This allows third-party MCP servers (e.g. Bailian) to use their own API keys.
-	pluginAuth, hasPluginAuth := LookupPluginAuth(invocation.CanonicalProduct)
-
-	authToken := ""
-	if hasPluginAuth {
-		authToken = pluginAuth.Token
-	} else {
-		authToken = r.resolveAuthToken(ctx)
+	authStart := time.Now()
+	tc := r.transport.WithAuth(r.resolveAuthToken(ctx), resolveIdentityHeaders())
+	if os.Getenv("DWS_PERF_DEBUG") != "" {
+		_, _ = fmt.Fprintf(os.Stderr, "[PERF] resolveAuthToken: %v\n", time.Since(authStart))
 	}

-	var timeoutSec int
-	if r.globalFlags != nil {
-		timeoutSec = r.globalFlags.Timeout
-	}
-	logging.LogCommandStart(fl, execID,
-		invocation.CanonicalProduct, invocation.Tool, endpoint, version, authToken != "", timeoutSec)
-
 	if invocation.DryRun {
 		return executor.Result{
 			Invocation: invocation,
@@ -267,90 +166,19 @@ func (r *runtimeRunner) executeInvocation(ctx context.Context, endpoint string,
 		}, nil
 	}

-	// Fail-fast: reject unauthenticated requests before making network calls.
-	// This provides a clear error message instead of cryptic HTTP 400 from MCP.
-	if strings.TrimSpace(authToken) == "" {
-		return executor.Result{}, apperrors.NewAuth(
-			"未登录，请先执行 dws auth login",
-			apperrors.WithReason("not_authenticated"),
-			apperrors.WithHint("运行 'dws auth login' 完成登录后重试"),
-			apperrors.WithActions("dws auth login"),
-		)
-	}
-
-	var tc *transport.Client
-	if hasPluginAuth {
-		// Use plugin-level auth: inject the plugin's token and trust its domains.
-		tc = r.transport.WithAuth(authToken, pluginAuth.ExtraHeaders)
-		tc.TrustedDomains = pluginAuth.TrustedDomains
-	} else {
-		// Default path: use DingTalk OAuth token with identity headers.
-		tc = r.transport.WithAuth(authToken, resolveIdentityHeaders())
-	}
-
-	callCtx := ctx
-	if r.globalFlags != nil && r.globalFlags.Timeout > 0 {
-		var cancel context.CancelFunc
-		callCtx, cancel = context.WithTimeout(ctx, time.Duration(r.globalFlags.Timeout)*time.Second)
-		defer cancel()
-	}
-
 	callStart := time.Now()
-	callResult, err := tc.CallTool(callCtx, endpoint, invocation.Tool, invocation.Params)
-	RecordTiming(ctx, "mcp_call", time.Since(callStart))
+	callResult, err := tc.CallTool(ctx, endpoint, invocation.Tool, invocation.Params)
+	if os.Getenv("DWS_PERF_DEBUG") != "" {
+		_, _ = fmt.Fprintf(os.Stderr, "[PERF] MCP CallTool: %v\n", time.Since(callStart))
+	}
 	if err != nil {
-		if isAuthError(err) {
-			if fn := edition.Get().OnAuthError; fn != nil {
-				if overrideErr := fn(defaultConfigDir(), err); overrideErr != nil {
-					captureRuntimeFailure(invocation, err, overrideErr)
-					return executor.Result{}, overrideErr
-				}
-			}
-		}
-		// PAT scope error: offer human-readable output and retry after authorization
-		if isPatScopeError(err) {
-			scopeErr := extractPatScopeError(err)
-			captureRuntimeFailure(invocation, err, err)
-			return retryWithPatAuthRetry(ctx, r, invocation, scopeErr, defaultConfigDir(), os.Stderr)
-		}
 		captureRuntimeFailure(invocation, err, err)
 		return executor.Result{}, err
 	}

-	// ---- Edition hook gets first dibs (preserves overlay PATError passthrough) ----
-	if fn := edition.Get().ClassifyToolResult; fn != nil {
-		if editionErr := fn(callResult.Content); editionErr != nil {
-			if patCheck := apperrors.AsPatAuthCheckError(editionErr); patCheck != nil {
-				if IsPatRetrying(ctx) {
-					return executor.Result{}, patCheck // already retried once, don't loop
-				}
-				return handlePatAuthCheck(ctx, r, invocation, patCheck, defaultConfigDir(), os.Stderr)
-			}
-			return executor.Result{}, editionErr
-		}
-	}
-
-	// ---- Structured PAT auth check (open-source fallback) ----
-	if patCheck := apperrors.ClassifyPatAuthCheck(callResult.Content); patCheck != nil {
-		if IsPatRetrying(ctx) {
-			return executor.Result{}, patCheck // already retried once, don't loop
-		}
-		return handlePatAuthCheck(ctx, r, invocation, patCheck, defaultConfigDir(), os.Stderr)
-	}
-
 	if callResult.IsError {
 		diag := transport.ExtractServerDiagnosticsFromMap(callResult.Content)
 		logBusinessError(r.transport.FileLogger, "mcp_tool_error", invocation, callResult.Content, diag)
-
-		// ClassifyToolResult hook: let the overlay intercept known error
-		// patterns (PAT permission, gateway-auth) before generic handling.
-		if classify := edition.Get().ClassifyToolResult; classify != nil {
-			if hookErr := classify(callResult.Content); hookErr != nil {
-				captureRuntimeFailure(invocation, hookErr, hookErr)
-				return executor.Result{}, hookErr
-			}
-		}
-
 		mcpErr := apperrors.NewAPI(
 			extractMCPErrorMessage(callResult),
 			apperrors.WithOperation("tools/call"),
@@ -359,12 +187,6 @@ func (r *runtimeRunner) executeInvocation(ctx context.Context, endpoint string,
 			apperrors.WithHint("MCP tool returned a business error; check tool parameters and refer to skill documentation."),
 			apperrors.WithServerDiag(diag),
 		)
-		// PAT scope error in business response: offer human-readable output and retry
-		if isPatScopeError(mcpErr) {
-			scopeErr := extractPatScopeError(mcpErr)
-			captureRuntimeFailure(invocation, mcpErr, mcpErr)
-			return retryWithPatAuthRetry(ctx, r, invocation, scopeErr, defaultConfigDir(), os.Stderr)
-		}
 		captureRuntimeFailure(invocation, mcpErr, mcpErr)
 		return executor.Result{}, mcpErr
 	}
@@ -397,78 +219,12 @@ func (r *runtimeRunner) executeInvocation(ctx context.Context, endpoint string,
 	return executor.Result{Invocation: invocation, Response: response}, nil
 }

-// executeStdioInvocation dispatches a tool call through a local StdioClient
-// subprocess instead of the HTTP transport. This is used for plugin stdio
-// servers whose endpoints use the stdio:// scheme.
-func (r *runtimeRunner) executeStdioInvocation(ctx context.Context, invocation executor.Invocation) (executor.Result, error) {
-	if invocation.DryRun {
-		return executor.Result{
-			Invocation: invocation,
-			Response: map[string]any{
-				"dry_run":   true,
-				"transport": "stdio",
-				"request":   executor.ToolCallRequest(invocation.Tool, invocation.Params),
-				"note":      "execution skipped by --dry-run",
-			},
-		}, nil
-	}
-
-	client, ok := LookupStdioClient(invocation.CanonicalProduct)
-	if !ok {
-		return executor.Result{}, apperrors.NewInternal(
-			fmt.Sprintf("stdio client not found for %q", invocation.CanonicalProduct))
-	}
-
-	callCtx := ctx
-	if r.globalFlags != nil && r.globalFlags.Timeout > 0 {
-		var cancel context.CancelFunc
-		callCtx, cancel = context.WithTimeout(ctx, time.Duration(r.globalFlags.Timeout)*time.Second)
-		defer cancel()
-	}
-
-	callResult, err := client.CallTool(callCtx, invocation.Tool, invocation.Params)
-	if err != nil {
-		return executor.Result{}, apperrors.NewAPI(
-			fmt.Sprintf("stdio call failed: %v", err),
-			apperrors.WithOperation("tools/call"),
-			apperrors.WithReason("stdio_error"),
-		)
-	}
-
-	if callResult.IsError {
-		return executor.Result{}, apperrors.NewAPI(
-			extractMCPErrorMessage(callResult),
-			apperrors.WithOperation("tools/call"),
-			apperrors.WithReason("mcp_tool_error"),
-			apperrors.WithServerKey(invocation.CanonicalProduct),
-		)
-	}
-
-	invocation.Implemented = true
-	return executor.Result{
-		Invocation: invocation,
-		Response: map[string]any{
-			"transport": "stdio",
-			"content":   callResult.Content,
-		},
-	}, nil
-}
-
 func (r *runtimeRunner) resolveAuthToken(ctx context.Context) string {
 	explicitToken := ""
 	if r != nil && r.globalFlags != nil {
 		explicitToken = r.globalFlags.Token
 	}
-	if token := strings.TrimSpace(explicitToken); token != "" {
-		return token
-	}
-	if tp := edition.Get().TokenProvider; tp != nil {
-		token, _ := tp(ctx, func() (string, error) {
-			return resolveAccessTokenFromDir(ctx, defaultConfigDir())
-		})
-		return token
-	}
-	return getCachedRuntimeToken(ctx)
+	return resolveRuntimeAuthToken(ctx, explicitToken)
 }

 func resolveRuntimeAuthToken(ctx context.Context, explicitToken string) string {
@@ -490,30 +246,36 @@ var (
 func getCachedRuntimeToken(ctx context.Context) string {
 	cachedRuntimeTokenOnce.Do(func() {
 		loadStart := time.Now()
-		defer func() { RecordTiming(ctx, "auth_keychain", time.Since(loadStart)) }()
+		defer func() {
+			if os.Getenv("DWS_PERF_DEBUG") != "" {
+				_, _ = fmt.Fprintf(os.Stderr, "[PERF] getCachedRuntimeToken (first load): %v\n", time.Since(loadStart))
+			}
+		}()

 		configDir := defaultConfigDir()
-		token, tokenErr := resolveAccessTokenFromDir(ctx, configDir)
+		provider := authpkg.NewOAuthProvider(configDir, slog.New(slog.NewTextHandler(io.Discard, nil)))
+		configureOAuthProviderCompatibility(provider, configDir)
+		token, tokenErr := provider.GetAccessToken(ctx)
+		if tokenErr == nil && strings.TrimSpace(token) != "" {
+			cachedRuntimeToken = strings.TrimSpace(token)
+			return
+		}
+		// If the error is a decryption failure (corrupted data), log and bail out
 		if tokenErr != nil && errors.Is(tokenErr, authpkg.ErrTokenDecryption) {
 			slog.Error(tokenErr.Error())
 			return
 		}
-		if token != "" {
-			cachedRuntimeToken = token
+		// Try legacy manager as fallback
+		manager := authpkg.NewManager(configDir, nil)
+		configureLegacyAuthManagerCompatibility(manager)
+		if token, _, err := manager.GetToken(); err == nil && strings.TrimSpace(token) != "" {
+			cachedRuntimeToken = strings.TrimSpace(token)
+			return
 		}
 	})
 	return cachedRuntimeToken
 }

-// generateExecutionID returns a random 16-char hex string used to correlate
-// all log entries (command_start, jsonrpc_request, command_end, etc.) belonging
-// to a single command invocation.
-func generateExecutionID() string {
-	b := make([]byte, 8)
-	_, _ = rand.Read(b)
-	return hex.EncodeToString(b)
-}
-
 // ResetRuntimeTokenCache clears the cached token, forcing a reload on next access.
 // This should be called after login/logout operations.
 func ResetRuntimeTokenCache() {
@@ -552,14 +314,6 @@ func runtimeFlagEnabled(raw string, defaultValue bool) bool {
 	}
 }

-func isAuthError(err error) bool {
-	var appErr *apperrors.Error
-	if errors.As(err, &appErr) {
-		return appErr.Category == apperrors.CategoryAuth
-	}
-	return false
-}
-
 func productEndpointOverride(productID string) (string, bool) {
 	key := "DINGTALK_" + strings.ToUpper(strings.ReplaceAll(strings.TrimSpace(productID), "-", "_")) + "_MCP_URL"
 	value := strings.TrimSpace(os.Getenv(key))
@@ -578,7 +332,7 @@ func resolveIdentityHeaders() map[string]string {
 		headers = make(map[string]string)
 	}

-	// Inject environment variable based headers for MCP gateway tracking.
+	// Inject environment variable based headers for MCP gateway tracking
 	envHeaders := map[string]string{
 		"x-dingtalk-agent":      os.Getenv(envDingtalkAgent),
 		"x-dingtalk-trace-id":   os.Getenv(envDingtalkTraceID),
@@ -590,15 +344,6 @@ func resolveIdentityHeaders() map[string]string {
 			headers[k] = v
 		}
 	}
-
-	// Inject third-party channel headers
-	if v := os.Getenv(envDWSChannel); v != "" {
-		headers["x-dws-channel"] = v
-	}
-
-	if fn := edition.Get().MergeHeaders; fn != nil {
-		headers = fn(headers)
-	}
 	return headers
 }

@@ -17,7 +17,6 @@ import (
 	"bytes"
 	"context"
 	"encoding/json"
-	"fmt"
 	"net/http"
 	"net/http/httptest"
 	"os"
@@ -26,61 +25,12 @@ import (
 	"testing"

 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/cli"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/edition"
 	mockmcp "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/test/mock_mcp"
 )

 func setupRuntimeCommandTest(t *testing.T) {
 	t.Helper()
 	t.Setenv("DWS_CONFIG_DIR", t.TempDir())
-
-	discoverySrv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
-		_ = json.NewEncoder(w).Encode(contactDiscoveryResponse())
-	}))
-	t.Cleanup(func() { discoverySrv.Close() })
-	SetDiscoveryBaseURL(discoverySrv.URL)
-	t.Cleanup(func() { SetDiscoveryBaseURL("") })
-}
-
-func contactDiscoveryResponse() map[string]any {
-	return map[string]any{
-		"metadata": map[string]any{"count": 1, "nextCursor": ""},
-		"servers": []any{
-			map[string]any{
-				"server": map[string]any{
-					"name":        "Contact",
-					"description": "通讯录",
-					"remotes": []any{
-						map[string]any{
-							"type": "streamable-http",
-							"url":  "https://mcp.dingtalk.com/contact/v1",
-						},
-					},
-				},
-				"_meta": map[string]any{
-					"com.dingtalk.mcp.registry/metadata": map[string]any{
-						"status": "active", "isLatest": true,
-					},
-					"com.dingtalk.mcp.registry/cli": map[string]any{
-						"id":      "contact",
-						"command": "contact",
-						"groups": map[string]any{
-							"user": map[string]any{
-								"description": "用户管理",
-							},
-						},
-						"toolOverrides": map[string]any{
-							"get_current_user_profile": map[string]any{
-								"cliName": "get-self",
-								"group":   "user",
-								"flags":   map[string]any{},
-							},
-						},
-					},
-				},
-			},
-		},
-	}
 }

 func TestRuntimeRunnerIncludesContentScanReportWhenEnabled(t *testing.T) {
@@ -95,7 +45,7 @@ func TestRuntimeRunnerIncludesContentScanReportWhenEnabled(t *testing.T) {
 	var out bytes.Buffer
 	cmd.SetOut(&out)
 	cmd.SetErr(&out)
-	cmd.SetArgs([]string{"mcp", "doc", "search_documents", "--json", `{"keyword":"design"}`, "--token", "test-token"})
+	cmd.SetArgs([]string{"mcp", "doc", "search_documents", "--json", `{"keyword":"design"}`})

 	if err := cmd.Execute(); err != nil {
 		t.Fatalf("Execute() error = %v", err)
@@ -140,7 +90,7 @@ func TestRuntimeRunnerBlocksUnsafeContentWhenEnforced(t *testing.T) {
 	cmd := NewRootCommand()
 	cmd.SetOut(&bytes.Buffer{})
 	cmd.SetErr(&bytes.Buffer{})
-	cmd.SetArgs([]string{"mcp", "doc", "search_documents", "--json", `{"keyword":"design"}`, "--token", "test-token"})
+	cmd.SetArgs([]string{"mcp", "doc", "search_documents", "--json", `{"keyword":"design"}`})

 	err := cmd.Execute()
 	if err == nil {
@@ -171,7 +121,7 @@ func TestCanonicalCommandUsesRuntimeRunnerWhenEnabled(t *testing.T) {
 	var out bytes.Buffer
 	cmd.SetOut(&out)
 	cmd.SetErr(&out)
-	cmd.SetArgs([]string{"mcp", "doc", "create_document", "--json", `{"title":"Quarterly"}`, "--yes", "--token", "test-token"})
+	cmd.SetArgs([]string{"mcp", "doc", "create_document", "--json", `{"title":"Quarterly"}`, "--yes"})

 	if err := cmd.Execute(); err != nil {
 		t.Fatalf("Execute() error = %v", err)
@@ -305,37 +255,6 @@ func TestRuntimeRunnerInjectsAuthTokenFromFlag(t *testing.T) {
 	}
 }

-// TestRuntimeRunnerRejectsUnauthenticatedRequest verifies that requests without
-// a valid token are rejected with a clear error before making any network call.
-func TestRuntimeRunnerRejectsUnauthenticatedRequest(t *testing.T) {
-	setupRuntimeCommandTest(t)
-	server := mockmcp.DefaultServer()
-	defer server.Close()
-
-	t.Setenv(cli.CatalogFixtureEnv, writeDocCatalogFixture(t, server.RemoteURL("/server/doc"), false))
-
-	cmd := NewRootCommand()
-	var stdout, stderr bytes.Buffer
-	cmd.SetOut(&stdout)
-	cmd.SetErr(&stderr)
-	// No --token flag, should be rejected
-	cmd.SetArgs([]string{"mcp", "doc", "search_documents", "--json", `{"keyword":"design"}`})
-
-	err := cmd.Execute()
-	if err == nil {
-		t.Fatal("Execute() error = nil, want authentication error")
-	}
-
-	// Verify we get a clear auth error, not a cryptic HTTP 400
-	errMsg := err.Error()
-	if !strings.Contains(errMsg, "未登录") {
-		t.Fatalf("Execute() error = %v, want error containing '未登录'", err)
-	}
-	if !strings.Contains(errMsg, "auth login") {
-		t.Fatalf("Execute() error = %v, want error containing 'auth login'", err)
-	}
-}
-
 func TestRuntimeRunnerFallsBackForUnavailableProduct(t *testing.T) {
 	setupRuntimeCommandTest(t)
 	server := mockmcp.DefaultServer()
@@ -496,7 +415,7 @@ func TestCanonicalSensitiveToolAcceptsInteractiveConfirmation(t *testing.T) {
 	cmd.SetOut(&out)
 	cmd.SetErr(&errOut)
 	cmd.SetIn(strings.NewReader("yes\n"))
-	cmd.SetArgs([]string{"mcp", "doc", "create_document", "--json", `{"title":"Quarterly"}`, "--token", "test-token"})
+	cmd.SetArgs([]string{"mcp", "doc", "create_document", "--json", `{"title":"Quarterly"}`})

 	if err := cmd.Execute(); err != nil {
 		t.Fatalf("Execute() error = %v", err)
@@ -546,7 +465,7 @@ func TestRuntimeRunnerUsesProductEndpointOverride(t *testing.T) {
 	var out bytes.Buffer
 	cmd.SetOut(&out)
 	cmd.SetErr(&out)
-	cmd.SetArgs([]string{"mcp", "doc", "search_documents", "--json", `{"keyword":"design"}`, "--token", "test-token"})
+	cmd.SetArgs([]string{"mcp", "doc", "search_documents", "--json", `{"keyword":"design"}`})

 	if err := cmd.Execute(); err != nil {
 		t.Fatalf("Execute() error = %v", err)
@@ -646,95 +565,6 @@ func contentScanServer() *mockmcp.Server {
 	return mockmcp.MustNewServer(fixture)
 }

-func TestClassifyToolResultHookPreemptsBusinessError(t *testing.T) {
-	setupRuntimeCommandTest(t)
-	t.Setenv("DWS_ALLOW_HTTP_ENDPOINTS", "1")
-	t.Setenv("DWS_TRUSTED_DOMAINS", "*")
-
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		var req map[string]any
-		if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-			http.Error(w, "bad request", http.StatusBadRequest)
-			return
-		}
-		method, _ := req["method"].(string)
-		switch method {
-		case "initialize":
-			_ = json.NewEncoder(w).Encode(map[string]any{
-				"jsonrpc": "2.0",
-				"id":      req["id"],
-				"result": map[string]any{
-					"protocolVersion": "2025-03-26",
-					"capabilities":    map[string]any{"tools": map[string]any{"listChanged": false}},
-					"serverInfo":      map[string]any{"name": "doc", "version": "1.0.0"},
-				},
-			})
-		case "notifications/initialized":
-			w.WriteHeader(http.StatusNoContent)
-		case "tools/list":
-			_ = json.NewEncoder(w).Encode(map[string]any{
-				"jsonrpc": "2.0",
-				"id":      req["id"],
-				"result": map[string]any{
-					"tools": []map[string]any{{
-						"name":        "search_documents",
-						"title":       "Search",
-						"description": "Search documents",
-						"inputSchema": map[string]any{"type": "object"},
-					}},
-				},
-			})
-		case "tools/call":
-			_ = json.NewEncoder(w).Encode(map[string]any{
-				"jsonrpc": "2.0",
-				"id":      req["id"],
-				"result": map[string]any{
-					"content": map[string]any{
-						"success": false,
-						"code":    "PAT_LOW_RISK_NO_PERMISSION",
-						"data":    map[string]any{"requiredScopes": []any{}},
-					},
-				},
-			})
-		}
-	}))
-	defer server.Close()
-
-	hookCalled := false
-	sentinelMsg := "hook-intercepted-PAT"
-	edition.Override(&edition.Hooks{
-		ClassifyToolResult: func(content map[string]any) error {
-			if code, ok := content["code"].(string); ok && strings.Contains(code, "PAT") {
-				hookCalled = true
-				return fmt.Errorf("%s", sentinelMsg)
-			}
-			return nil
-		},
-	})
-	t.Cleanup(func() { edition.Override(&edition.Hooks{}) })
-
-	t.Setenv(cli.CatalogFixtureEnv, writeDocCatalogFixture(t, server.URL, false))
-
-	cmd := NewRootCommand()
-	cmd.SetOut(&bytes.Buffer{})
-	cmd.SetErr(&bytes.Buffer{})
-	cmd.SetArgs([]string{"mcp", "doc", "search_documents", "--json", `{"keyword":"design"}`, "--token", "test-token"})
-
-	err := cmd.Execute()
-	if err == nil {
-		t.Fatal("Execute() error = nil, want hook sentinel error")
-	}
-	if !hookCalled {
-		t.Fatal("ClassifyToolResult hook was not called")
-	}
-	if !strings.Contains(err.Error(), sentinelMsg) {
-		t.Fatalf("error = %q, want hook sentinel %q (not generic business error)", err.Error(), sentinelMsg)
-	}
-	if strings.Contains(err.Error(), "business_error") || strings.Contains(err.Error(), "mcp_tool_error") {
-		t.Fatalf("error = %q, should NOT contain generic framework error category", err.Error())
-	}
-}
-
 func TestRuntimeRunnerReturnsErrorWhenMCPIsErrorTrue(t *testing.T) {
 	setupRuntimeCommandTest(t)
 	t.Setenv("DWS_ALLOW_HTTP_ENDPOINTS", "1")
@@ -798,7 +628,7 @@ func TestRuntimeRunnerReturnsErrorWhenMCPIsErrorTrue(t *testing.T) {
 	cmd := NewRootCommand()
 	cmd.SetOut(&bytes.Buffer{})
 	cmd.SetErr(&bytes.Buffer{})
-	cmd.SetArgs([]string{"mcp", "doc", "search_documents", "--json", `{"keyword":"design"}`, "--token", "test-token"})
+	cmd.SetArgs([]string{"mcp", "doc", "search_documents", "--json", `{"keyword":"design"}`})

 	err := cmd.Execute()
 	if err == nil {
@@ -19,9 +19,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"io"
-	"mime"
 	"net/http"
-	"net/url"
 	"os"
 	"path/filepath"
 	"strings"
@@ -29,24 +27,10 @@ import (

 	authpkg "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/auth"
 	apperrors "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/errors"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/configmeta"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/edition"
 	"github.com/spf13/cobra"
 )

-func init() {
-	configmeta.Register(configmeta.ConfigItem{
-		Name:         "DWS_SKILL_API_HOST",
-		Category:     configmeta.CategoryNetwork,
-		Description:  "覆盖 Skill API 地址",
-		DefaultValue: "https://mcp.dingtalk.com",
-		Example:      "https://custom-mcp.example.com",
-	})
-}
-
 const (
-	// legacySkillAPIHost is the legacy skill market host used by the old cli.
-	legacySkillAPIHost = "https://mcp.dingtalk.com"
 	// skillDownloadEndpoint is the API endpoint for downloading skills.
 	skillDownloadEndpoint = "https://aihub.dingtalk.com/cli/download"
 	// skillDownloadTimeout is the timeout for skill download operations.
@@ -67,22 +51,6 @@ type downloadSkillResult struct {
 	FileName    string `json:"fileName"`
 }

-// findSkillsResponse represents the legacy skill search API response.
-type findSkillsResponse struct {
-	Success   bool          `json:"success"`
-	ErrorCode string        `json:"errorCode,omitempty"`
-	ErrorMsg  string        `json:"errorMsg,omitempty"`
-	Result    []CliSkillDTO `json:"result,omitempty"`
-}
-
-// CliSkillDTO mirrors the old cli response payload for `skill search`.
-type CliSkillDTO struct {
-	SkillID string `json:"skillId"`
-	Name    string `json:"name"`
-	Desc    string `json:"desc"`
-	Icon    string `json:"icon"`
-}
-
 // agentSkillPaths maps target names to their relative skill installation paths.
 // These paths are relative to the user's home directory.
 var agentSkillPaths = map[string]string{
@@ -107,7 +75,7 @@ func buildSkillCommand() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:               "skill",
 		Short:             "技能管理",
-		Long:              "管理钉钉技能市场的技能。支持搜索、下载与安装到指定 Agent 目录。",
+		Long:              "管理钉钉技能市场的技能。支持下载和安装技能到指定 Agent 目录。",
 		Args:              cobra.NoArgs,
 		TraverseChildren:  true,
 		DisableAutoGenTag: true,
@@ -116,61 +84,13 @@ func buildSkillCommand() *cobra.Command {
 		},
 	}

-	cmd.AddCommand(
-		newSkillInstallCommand(),
-		newSkillGetCommand(),
-		newSkillSearchCommand(),
-		newSkillFindHintCommand(),
-		newSkillAddHintCommand(),
-	)
+	cmd.AddCommand(newSkillAddCommand())
 	return cmd
 }

-func newSkillGetCommand() *cobra.Command {
+func newSkillAddCommand() *cobra.Command {
 	cmd := &cobra.Command{
-		Use:               "get",
-		Short:             "获取技能压缩文件",
-		Long:              "从服务端下载技能包到本地临时目录。命令执行成功后会输出临时目录路径，供调用方使用。",
-		Example:           "  dws skill get --skill-id <skillId>",
-		DisableAutoGenTag: true,
-		RunE:              runSkillGet,
-	}
-	cmd.Flags().String("skill-id", "", "技能 ID（必填）")
-	_ = cmd.MarkFlagRequired("skill-id")
-	return cmd
-}
-
-func newSkillSearchCommand() *cobra.Command {
-	cmd := &cobra.Command{
-		Use:               "search",
-		Short:             "从钉钉技能市场搜索技能",
-		Long:              "从钉钉技能市场搜索技能，根据关键词返回匹配的技能列表。",
-		Example:           "  dws skill search --query 关键词",
-		DisableAutoGenTag: true,
-		RunE:              runSkillFind,
-	}
-	cmd.Flags().String("query", "", "搜索关键词（必填）")
-	_ = cmd.MarkFlagRequired("query")
-	cmd.Flags().String("scopes", "", "查询范围，空格分隔。备选值：DingtalkMarket（钉钉市场）、OrgInternal（企业内部）。为空默认查市场技能")
-	return cmd
-}
-
-func newSkillFindHintCommand() *cobra.Command {
-	return &cobra.Command{
-		Use:               "find",
-		Short:             "兼容旧用法，提示使用 skill search",
-		Hidden:            true,
-		DisableAutoGenTag: true,
-		RunE: func(cmd *cobra.Command, args []string) error {
-			_, _ = fmt.Fprintln(cmd.OutOrStdout(), "use: dws skill search --query <关键词>")
-			return nil
-		},
-	}
-}
-
-func newSkillInstallCommand() *cobra.Command {
-	cmd := &cobra.Command{
-		Use:   "install <skillId> <target>",
+		Use:   "add <skillId> <target>",
 		Short: "下载并安装技能到指定目录",
 		Long: fmt.Sprintf(`从钉钉技能市场下载技能并安装到指定 Agent 目录。

@@ -187,9 +107,9 @@ func newSkillInstallCommand() *cobra.Command {
  .        -> 当前目录

 示例:
-  dws skill install skill-123 qoder     # 安装到 ~/.qoder/skills/
-  dws skill install skill-123 claude    # 安装到 ~/.claude/skills/
-  dws skill install skill-123 .         # 安装到当前目录`, supportedTargets()),
+  dws skill add skill-123 qoder     # 安装到 ~/.qoder/skills/
+  dws skill add skill-123 claude    # 安装到 ~/.claude/skills/
+  dws skill add skill-123 .         # 安装到当前目录`, supportedTargets()),
 		Args:              cobra.ExactArgs(2),
 		DisableAutoGenTag: true,
 		RunE:              runSkillAdd,
@@ -198,96 +118,6 @@ func newSkillInstallCommand() *cobra.Command {
 	return cmd
 }

-func newSkillAddHintCommand() *cobra.Command {
-	return &cobra.Command{
-		Use:               "add",
-		Short:             "兼容旧用法，提示使用 skill install",
-		Hidden:            true,
-		DisableAutoGenTag: true,
-		RunE: func(cmd *cobra.Command, args []string) error {
-			_, _ = fmt.Fprintln(cmd.OutOrStdout(), "use: dws skill install <skillId> <target>")
-			return nil
-		},
-	}
-}
-
-func runSkillGet(cmd *cobra.Command, args []string) error {
-	skillID, _ := cmd.Flags().GetString("skill-id")
-	accessToken, err := loadSkillAccessToken()
-	if err != nil {
-		return err
-	}
-
-	apiURL := fmt.Sprintf("%s/cli/install?skillId=%s", skillAPIHost(), url.QueryEscape(strings.TrimSpace(skillID)))
-	_, _ = fmt.Fprintln(cmd.OutOrStdout(), "⬇️  下载技能包...")
-
-	tmpDir, err := downloadSkillToTmpDir(cmd.Context(), apiURL, accessToken)
-	if err != nil {
-		return err
-	}
-
-	_, _ = fmt.Fprintln(cmd.OutOrStdout(), tmpDir)
-	return nil
-}
-
-func runSkillFind(cmd *cobra.Command, args []string) error {
-	keyword, _ := cmd.Flags().GetString("query")
-	scopes, _ := cmd.Flags().GetString("scopes")
-	accessToken, err := loadSkillAccessToken()
-	if err != nil {
-		return err
-	}
-
-	apiURL := fmt.Sprintf("%s/cli/find-skills?keyword=%s", skillAPIHost(), url.QueryEscape(strings.TrimSpace(keyword)))
-	if scopes != "" {
-		apiURL += "&scopes=" + url.QueryEscape(scopes)
-	}
-	req, err := http.NewRequestWithContext(cmd.Context(), http.MethodGet, apiURL, nil)
-	if err != nil {
-		return apperrors.NewInternal(fmt.Sprintf("failed to create request: %v", err))
-	}
-	req.Header.Set("x-user-access-token", accessToken)
-
-	client := &http.Client{Timeout: 30 * time.Second}
-	resp, err := client.Do(req)
-	if err != nil {
-		return apperrors.NewAPI(fmt.Sprintf("failed to search skills: %v", err), apperrors.WithRetryable(true))
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode != http.StatusOK {
-		return parseLegacySkillAPIError(resp)
-	}
-
-	var result findSkillsResponse
-	if err := json.NewDecoder(resp.Body).Decode(&result); err != nil {
-		return apperrors.NewAPI(fmt.Sprintf("failed to parse search response: %v", err))
-	}
-	if !result.Success {
-		errMsg := strings.TrimSpace(result.ErrorMsg)
-		if errMsg == "" {
-			errMsg = strings.TrimSpace(result.ErrorCode)
-		}
-		if errMsg == "" {
-			errMsg = "unknown error"
-		}
-		return apperrors.NewAPI(fmt.Sprintf("failed to search skills: %s", errMsg))
-	}
-
-	if len(result.Result) == 0 {
-		_, _ = fmt.Fprintln(cmd.OutOrStdout(), "未找到匹配的技能")
-		return nil
-	}
-
-	for _, skill := range result.Result {
-		_, _ = fmt.Fprintf(cmd.OutOrStdout(), "SkillID: %s\n", skill.SkillID)
-		_, _ = fmt.Fprintf(cmd.OutOrStdout(), "Name: %s\n", skill.Name)
-		_, _ = fmt.Fprintf(cmd.OutOrStdout(), "Desc: %s\n", skill.Desc)
-		_, _ = fmt.Fprintln(cmd.OutOrStdout(), "---")
-	}
-	return nil
-}
-
 func runSkillAdd(cmd *cobra.Command, args []string) error {
 	skillID := strings.TrimSpace(args[0])
 	target := strings.TrimSpace(args[1])
@@ -302,9 +132,13 @@ func runSkillAdd(cmd *cobra.Command, args []string) error {
 		return apperrors.NewValidation(fmt.Sprintf("invalid target '%s': %v. Supported targets: %s", target, err, supportedTargets()))
 	}

-	accessToken, err := loadSkillAccessToken()
-	if err != nil {
-		return err
+	// Load auth token
+	configDir := defaultConfigDir()
+	tokenData, err := authpkg.LoadTokenData(configDir)
+	if err != nil || tokenData == nil || !tokenData.IsAccessTokenValid() {
+		return apperrors.NewAuth("not logged in or token expired. Please run 'dws auth login' first",
+			apperrors.WithHint("请先执行 'dws auth login' 登录"),
+			apperrors.WithActions("dws auth login"))
 	}

 	ctx, cancel := context.WithTimeout(cmd.Context(), skillDownloadTimeout)
@@ -314,7 +148,7 @@ func runSkillAdd(cmd *cobra.Command, args []string) error {

 	// Step 1: Get download URL from API
 	fmt.Fprintf(w, "正在获取技能信息...\n")
-	downloadResp, err := fetchSkillDownloadInfo(ctx, accessToken, skillID)
+	downloadResp, err := fetchSkillDownloadInfo(ctx, tokenData.AccessToken, skillID)
 	if err != nil {
 		return err
 	}
@@ -355,33 +189,6 @@ func runSkillAdd(cmd *cobra.Command, args []string) error {
 	return nil
 }

-func loadSkillAccessToken() (string, error) {
-	configDir := defaultConfigDir()
-	tokenData, err := authpkg.LoadTokenData(configDir)
-	if err != nil || tokenData == nil || !tokenData.IsAccessTokenValid() {
-		return "", skillAuthError()
-	}
-	return tokenData.AccessToken, nil
-}
-
-func skillAuthError() error {
-	if edition.Get().IsEmbedded {
-		return apperrors.NewAuth("认证信息已失效",
-			apperrors.WithReason("not_authenticated"),
-			apperrors.WithHint("请先完成钉钉账号登录后重试"))
-	}
-	return apperrors.NewAuth("not logged in or token expired. Please run 'dws auth login' first",
-		apperrors.WithHint("请先执行 'dws auth login' 登录"),
-		apperrors.WithActions("dws auth login"))
-}
-
-func skillAPIHost() string {
-	if override := strings.TrimSpace(os.Getenv("DWS_SKILL_API_HOST")); override != "" {
-		return strings.TrimRight(override, "/")
-	}
-	return legacySkillAPIHost
-}
-
 // resolveSkillTargetPath resolves the target argument to an absolute path.
 func resolveSkillTargetPath(target string) (string, error) {
 	target = strings.TrimSpace(target)
@@ -429,7 +236,9 @@ func fetchSkillDownloadInfo(ctx context.Context, accessToken, skillID string) (*
 	defer resp.Body.Close()

 	if resp.StatusCode == http.StatusUnauthorized {
-		return nil, skillAuthError()
+		return nil, apperrors.NewAuth("authentication failed. Please run 'dws auth login' to refresh your token",
+			apperrors.WithHint("请执行 'dws auth login' 重新登录"),
+			apperrors.WithActions("dws auth login"))
 	}

 	if resp.StatusCode != http.StatusOK {
@@ -450,70 +259,6 @@ func fetchSkillDownloadInfo(ctx context.Context, accessToken, skillID string) (*
 	return &result, nil
 }

-func downloadSkillToTmpDir(ctx context.Context, apiURL, accessToken string) (string, error) {
-	req, err := http.NewRequestWithContext(ctx, http.MethodGet, apiURL, nil)
-	if err != nil {
-		return "", apperrors.NewInternal(fmt.Sprintf("failed to create request: %v", err))
-	}
-	req.Header.Set("x-user-access-token", accessToken)
-
-	client := &http.Client{Timeout: skillDownloadTimeout}
-	resp, err := client.Do(req)
-	if err != nil {
-		return "", apperrors.NewAPI(fmt.Sprintf("failed to download skill package: %v", err), apperrors.WithRetryable(true))
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode != http.StatusOK {
-		return "", parseLegacySkillAPIError(resp)
-	}
-
-	tmpDir, err := os.MkdirTemp("", "dws-skill-*")
-	if err != nil {
-		return "", apperrors.NewInternal(fmt.Sprintf("failed to create temp dir: %v", err))
-	}
-
-	filename := filenameFromDisposition(resp.Header.Get("Content-Disposition"))
-	destPath := filepath.Join(tmpDir, filename)
-	file, err := os.Create(destPath)
-	if err != nil {
-		os.RemoveAll(tmpDir)
-		return "", apperrors.NewInternal(fmt.Sprintf("failed to create temp file: %v", err))
-	}
-	defer file.Close()
-
-	if _, err := io.Copy(file, resp.Body); err != nil {
-		os.RemoveAll(tmpDir)
-		return "", apperrors.NewAPI(fmt.Sprintf("failed to save downloaded file: %v", err))
-	}
-	return tmpDir, nil
-}
-
-func filenameFromDisposition(cd string) string {
-	if cd != "" {
-		if _, params, err := mime.ParseMediaType(cd); err == nil {
-			if name := strings.TrimSpace(params["filename"]); name != "" {
-				return name
-			}
-		}
-	}
-	return "skill.zip"
-}
-
-func parseLegacySkillAPIError(resp *http.Response) error {
-	switch resp.StatusCode {
-	case http.StatusUnauthorized:
-		return skillAuthError()
-	case http.StatusBadRequest:
-		return apperrors.NewValidation("request parameters are invalid")
-	case http.StatusNotFound:
-		return apperrors.NewValidation("skill does not exist or corresponding file was not found")
-	default:
-		return apperrors.NewAPI(fmt.Sprintf("skill API returned HTTP %d", resp.StatusCode),
-			apperrors.WithRetryable(resp.StatusCode >= 500))
-	}
-}
-
 // downloadSkillFile downloads the skill zip file to a temporary location.
 func downloadSkillFile(ctx context.Context, downloadURL, fileName string) (string, error) {
 	req, err := http.NewRequestWithContext(ctx, http.MethodGet, downloadURL, nil)
@@ -319,7 +319,7 @@ func TestExtractSkillZipPreventZipSlip(t *testing.T) {
 	}
 }

-func TestSkillInstallCommandValidation(t *testing.T) {
+func TestSkillAddCommandValidation(t *testing.T) {
 	tests := []struct {
 		name    string
 		args    []string
@@ -328,19 +328,19 @@ func TestSkillInstallCommandValidation(t *testing.T) {
 	}{
 		{
 			name:    "missing arguments",
-			args:    []string{"skill", "install"},
+			args:    []string{"skill", "add"},
 			wantErr: true,
 			errMsg:  "accepts 2 arg(s)",
 		},
 		{
 			name:    "missing target",
-			args:    []string{"skill", "install", "skill-123"},
+			args:    []string{"skill", "add", "skill-123"},
 			wantErr: true,
 			errMsg:  "accepts 2 arg(s)",
 		},
 		{
 			name:    "too many arguments",
-			args:    []string{"skill", "install", "skill-123", "qoder", "extra"},
+			args:    []string{"skill", "add", "skill-123", "qoder", "extra"},
 			wantErr: true,
 			errMsg:  "accepts 2 arg(s)",
 		},
@@ -366,7 +366,7 @@ func TestSkillInstallCommandValidation(t *testing.T) {
 	}
 }

-func TestSkillInstallInvalidTarget(t *testing.T) {
+func TestSkillAddInvalidTarget(t *testing.T) {
 	// Setup: Create config directory with valid token
 	tempDir := t.TempDir()
 	configDir := filepath.Join(tempDir, "config")
@@ -380,11 +380,11 @@ func TestSkillInstallInvalidTarget(t *testing.T) {
 		RefreshExpAt: time.Now().Add(24 * time.Hour),
 	})
 	if err != nil {
-		t.Skipf("SaveTokenData() unavailable in this environment: %v", err)
+		t.Fatalf("failed to save token data: %v", err)
 	}

 	cmd := NewRootCommand()
-	cmd.SetArgs([]string{"skill", "install", "skill-123", "invalid-target"})
+	cmd.SetArgs([]string{"skill", "add", "skill-123", "invalid-target"})

 	var out bytes.Buffer
 	cmd.SetOut(&out)
@@ -399,7 +399,7 @@ func TestSkillInstallInvalidTarget(t *testing.T) {
 	}
 }

-func TestSkillInstallRequiresAuth(t *testing.T) {
+func TestSkillAddRequiresAuth(t *testing.T) {
 	// Setup: Create config directory without token
 	tempDir := t.TempDir()
 	configDir := filepath.Join(tempDir, "config")
@@ -411,7 +411,7 @@ func TestSkillInstallRequiresAuth(t *testing.T) {
 	}

 	cmd := NewRootCommand()
-	cmd.SetArgs([]string{"skill", "install", "skill-123", "qoder"})
+	cmd.SetArgs([]string{"skill", "add", "skill-123", "qoder"})

 	var out bytes.Buffer
 	cmd.SetOut(&out)
@@ -563,16 +563,14 @@ func TestSkillCommandHelp(t *testing.T) {
 	if !strings.Contains(output, "技能") {
 		t.Errorf("help should mention '技能', got: %s", output)
 	}
-	for _, subcmd := range []string{"install", "search", "get"} {
-		if !strings.Contains(output, subcmd) {
-			t.Errorf("help should mention %q subcommand, got: %s", subcmd, output)
-		}
+	if !strings.Contains(output, "add") {
+		t.Errorf("help should mention 'add' subcommand, got: %s", output)
 	}
 }

-func TestSkillInstallCommandHelp(t *testing.T) {
+func TestSkillAddCommandHelp(t *testing.T) {
 	cmd := NewRootCommand()
-	cmd.SetArgs([]string{"skill", "install", "--help"})
+	cmd.SetArgs([]string{"skill", "add", "--help"})

 	var out bytes.Buffer
 	cmd.SetOut(&out)
@@ -592,56 +590,6 @@ func TestSkillInstallCommandHelp(t *testing.T) {
 	}
 }

-func TestSkillGetCommandValidation(t *testing.T) {
-	cmd := NewRootCommand()
-	cmd.SetArgs([]string{"skill", "get"})
-
-	var out bytes.Buffer
-	cmd.SetOut(&out)
-	cmd.SetErr(&out)
-
-	err := cmd.Execute()
-	if err == nil {
-		t.Fatal("Execute() error = nil, want missing required flag error")
-	}
-	if !strings.Contains(err.Error(), "required flag") {
-		t.Fatalf("error = %v, want required flag message", err)
-	}
-}
-
-func TestSkillSearchCommandValidation(t *testing.T) {
-	cmd := NewRootCommand()
-	cmd.SetArgs([]string{"skill", "search"})
-
-	var out bytes.Buffer
-	cmd.SetOut(&out)
-	cmd.SetErr(&out)
-
-	err := cmd.Execute()
-	if err == nil {
-		t.Fatal("Execute() error = nil, want missing required flag error")
-	}
-	if !strings.Contains(err.Error(), "required flag") {
-		t.Fatalf("error = %v, want required flag message", err)
-	}
-}
-
-func TestSkillFindHintCommand(t *testing.T) {
-	cmd := NewRootCommand()
-	cmd.SetArgs([]string{"skill", "find"})
-
-	var out bytes.Buffer
-	cmd.SetOut(&out)
-	cmd.SetErr(&out)
-
-	if err := cmd.Execute(); err != nil {
-		t.Fatalf("Execute() error = %v", err)
-	}
-	if !strings.Contains(out.String(), "dws skill search --query") {
-		t.Fatalf("output = %q, want legacy hint", out.String())
-	}
-}
-
 func TestDownloadSkillFileSuccess(t *testing.T) {
 	// Create a mock server that returns a zip file
 	expectedContent := []byte("fake zip content")
@@ -1,119 +0,0 @@
-// Copyright 2026 Alibaba Group
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package app
-
-import (
-	"log/slog"
-	"strings"
-	"sync"
-
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/transport"
-)
-
-const stdioEndpointScheme = "stdio://"
-
-var (
-	stdioMu      sync.RWMutex
-	stdioClients = make(map[string]*transport.StdioClient)
-)
-
-// RegisterStdioClient stores a StdioClient keyed by its canonical product ID
-// (the CLI.ID used in the server descriptor). The runner looks up this client
-// when a stdio:// endpoint is resolved at execution time.
-func RegisterStdioClient(productID string, client *transport.StdioClient) {
-	stdioMu.Lock()
-	defer stdioMu.Unlock()
-	stdioClients[productID] = client
-}
-
-// LookupStdioClient returns the StdioClient registered for the given product ID.
-// The productID can be either the full key (pluginName/serverKey) or just the serverKey.
-// This supports backward compatibility with existing CanonicalProduct values.
-func LookupStdioClient(productID string) (*transport.StdioClient, bool) {
-	stdioMu.RLock()
-	defer stdioMu.RUnlock()
-	// Try exact match first
-	if c, ok := stdioClients[productID]; ok {
-		return c, true
-	}
-	// If not found, try matching by serverKey suffix (for backward compatibility)
-	for id, c := range stdioClients {
-		if idx := strings.LastIndex(id, "/"); idx >= 0 {
-			if id[idx+1:] == productID {
-				return c, true
-			}
-		}
-	}
-	return nil, false
-}
-
-// StdioEndpoint returns a virtual endpoint URL for a stdio-based MCP server.
-// Format: stdio://{pluginName}/{serverKey}
-func StdioEndpoint(pluginName, serverKey string) string {
-	return stdioEndpointScheme + pluginName + "/" + serverKey
-}
-
-// IsStdioEndpoint returns true if the endpoint uses the stdio:// scheme.
-func IsStdioEndpoint(endpoint string) bool {
-	return strings.HasPrefix(endpoint, stdioEndpointScheme)
-}
-
-// StopAllStdioClients stops all registered stdio clients.
-// This should be called on program exit to terminate child processes.
-func StopAllStdioClients() {
-	stdioMu.Lock()
-	defer stdioMu.Unlock()
-	for id, client := range stdioClients {
-		if err := client.Stop(); err != nil {
-			slog.Warn("failed to stop stdio client", "id", id, "error", err)
-		}
-	}
-	stdioClients = make(map[string]*transport.StdioClient)
-}
-
-// StopStdioClient stops a specific stdio client by product ID.
-// Returns true if the client was found and stopped, false otherwise.
-func StopStdioClient(productID string) bool {
-	stdioMu.Lock()
-	defer stdioMu.Unlock()
-	client, ok := stdioClients[productID]
-	if !ok {
-		return false
-	}
-	if err := client.Stop(); err != nil {
-		slog.Warn("failed to stop stdio client", "id", productID, "error", err)
-	}
-	delete(stdioClients, productID)
-	return true
-}
-
-// StopStdioClientsByPlugin stops all stdio clients belonging to a plugin.
-// The productID format is "pluginName/serverKey". This function stops all
-// clients whose productID has the given pluginName prefix.
-func StopStdioClientsByPlugin(pluginName string) int {
-	stdioMu.Lock()
-	defer stdioMu.Unlock()
-	prefix := pluginName + "/"
-	count := 0
-	for id, client := range stdioClients {
-		if len(id) > len(prefix) && id[:len(prefix)] == prefix {
-			if err := client.Stop(); err != nil {
-				slog.Warn("failed to stop stdio client", "id", id, "error", err)
-			}
-			delete(stdioClients, id)
-			count++
-		}
-	}
-	return count
-}
@@ -1,72 +0,0 @@
-// Copyright 2026 Alibaba Group
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package app
-
-import (
-	"testing"
-
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/transport"
-)
-
-func TestStdioEndpoint(t *testing.T) {
-	endpoint := StdioEndpoint("hello-plugin", "hello")
-	want := "stdio://hello-plugin/hello"
-	if endpoint != want {
-		t.Errorf("StdioEndpoint() = %q, want %q", endpoint, want)
-	}
-}
-
-func TestIsStdioEndpoint(t *testing.T) {
-	tests := []struct {
-		endpoint string
-		want     bool
-	}{
-		{"stdio://hello-plugin/hello", true},
-		{"stdio://conference/local", true},
-		{"https://mcp.dingtalk.com", false},
-		{"", false},
-	}
-	for _, tt := range tests {
-		if got := IsStdioEndpoint(tt.endpoint); got != tt.want {
-			t.Errorf("IsStdioEndpoint(%q) = %v, want %v", tt.endpoint, got, tt.want)
-		}
-	}
-}
-
-func TestStdioClientRegistry(t *testing.T) {
-	// Clean up after test
-	defer func() {
-		stdioMu.Lock()
-		delete(stdioClients, "test-product")
-		stdioMu.Unlock()
-	}()
-
-	// Initially not found
-	if _, ok := LookupStdioClient("test-product"); ok {
-		t.Error("expected LookupStdioClient to return false for unregistered product")
-	}
-
-	// Register a client
-	client := transport.NewStdioClient("echo", nil, nil)
-	RegisterStdioClient("test-product", client)
-
-	// Now should be found
-	got, ok := LookupStdioClient("test-product")
-	if !ok {
-		t.Fatal("expected LookupStdioClient to return true after registration")
-	}
-	if got != client {
-		t.Error("LookupStdioClient returned different client instance")
-	}
-}
@@ -1,381 +0,0 @@
-// Copyright 2026 Alibaba Group
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package app
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"io"
-	"os"
-	"path/filepath"
-	"sort"
-	"strings"
-	"sync"
-	"time"
-
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/configmeta"
-)
-
-func init() {
-	configmeta.Register(configmeta.ConfigItem{
-		Name:        "DWS_PERF_DEBUG",
-		Category:    configmeta.CategoryDebug,
-		Description: "启用性能计时输出到 stderr",
-		Example:     "1",
-	})
-	configmeta.Register(configmeta.ConfigItem{
-		Name:        "DWS_PERF_REPORT",
-		Category:    configmeta.CategoryDebug,
-		Description: "JSON 性能报告输出路径 (auto=~/.dws/perf/latest.json)",
-		Example:     "auto",
-	})
-}
-
-const (
-	// PerfDebugEnv is the environment variable to enable performance timing output.
-	PerfDebugEnv = "DWS_PERF_DEBUG"
-
-	// PerfReportEnv is the environment variable to enable JSON perf report output.
-	// Set to "auto" to write to ~/.dws/perf/latest.json, or a custom file path.
-	PerfReportEnv = "DWS_PERF_REPORT"
-
-	perfReportDir  = "perf"
-	perfReportFile = "latest.json"
-)
-
-// timingContextKey is the context key for TimingCollector.
-type timingContextKey struct{}
-
-// TimingEntry represents a single timing measurement.
-type TimingEntry struct {
-	Name      string
-	Duration  time.Duration
-	Timestamp time.Time
-	Seq       int // insertion order
-}
-
-// TimingCollector collects timing measurements for a single command execution.
-// It is safe for concurrent use.
-type TimingCollector struct {
-	mu      sync.Mutex
-	start   time.Time
-	entries []TimingEntry
-	seq     int
-}
-
-// NewTimingCollector creates a new collector with the start time set to now.
-func NewTimingCollector() *TimingCollector {
-	return &TimingCollector{
-		start:   time.Now(),
-		entries: make([]TimingEntry, 0, 16),
-	}
-}
-
-// Record adds a timing entry with the given name and duration.
-func (tc *TimingCollector) Record(name string, d time.Duration) {
-	if tc == nil {
-		return
-	}
-	tc.mu.Lock()
-	defer tc.mu.Unlock()
-	tc.entries = append(tc.entries, TimingEntry{
-		Name:      name,
-		Duration:  d,
-		Timestamp: time.Now(),
-		Seq:       tc.seq,
-	})
-	tc.seq++
-}
-
-// StartTimer returns a function that, when called, records the elapsed time
-// since StartTimer was called. This is convenient for defer usage:
-//
-//	defer tc.StartTimer("operation")()
-func (tc *TimingCollector) StartTimer(name string) func() {
-	if tc == nil {
-		return func() {}
-	}
-	start := time.Now()
-	return func() {
-		tc.Record(name, time.Since(start))
-	}
-}
-
-// Total returns the total elapsed time since the collector was created.
-func (tc *TimingCollector) Total() time.Duration {
-	if tc == nil {
-		return 0
-	}
-	return time.Since(tc.start)
-}
-
-// Entries returns a copy of all recorded entries in insertion order.
-func (tc *TimingCollector) Entries() []TimingEntry {
-	if tc == nil {
-		return nil
-	}
-	tc.mu.Lock()
-	defer tc.mu.Unlock()
-	result := make([]TimingEntry, len(tc.entries))
-	copy(result, tc.entries)
-	sort.Slice(result, func(i, j int) bool {
-		return result[i].Seq < result[j].Seq
-	})
-	return result
-}
-
-// formatDuration returns a human-friendly duration string.
-// Sub-µs → "0µs", sub-ms → microsecond precision (e.g. "142µs"), else → ms.
-func formatDuration(d time.Duration) string {
-	switch {
-	case d < time.Microsecond:
-		return "0µs"
-	case d < time.Millisecond:
-		return d.Truncate(time.Microsecond).String()
-	default:
-		return d.Truncate(time.Millisecond).String()
-	}
-}
-
-// Print writes a summary of all timing entries to the given writer.
-func (tc *TimingCollector) Print(w io.Writer) {
-	if tc == nil || w == nil {
-		return
-	}
-	entries := tc.Entries()
-	total := tc.Total()
-	if len(entries) == 0 {
-		fmt.Fprintf(w, "\n[Perf] Total: %v (no detailed entries)\n", formatDuration(total))
-		return
-	}
-
-	fmt.Fprintln(w)
-	fmt.Fprintln(w, "[Perf] Execution breakdown:")
-	for _, e := range entries {
-		fmt.Fprintf(w, "  %-30s %v\n", e.Name, formatDuration(e.Duration))
-	}
-	fmt.Fprintf(w, "  %-30s %v\n", "──────────────────────────────", "──────────")
-	fmt.Fprintf(w, "  %-30s %v\n", "Total", formatDuration(total))
-}
-
-// PrintIfEnabled prints timing info to stderr if DWS_PERF_DEBUG is set.
-func (tc *TimingCollector) PrintIfEnabled() {
-	if tc == nil {
-		return
-	}
-	if os.Getenv(PerfDebugEnv) == "" {
-		return
-	}
-	tc.Print(os.Stderr)
-}
-
-// WithTimingCollector returns a new context with the TimingCollector attached.
-func WithTimingCollector(ctx context.Context, tc *TimingCollector) context.Context {
-	return context.WithValue(ctx, timingContextKey{}, tc)
-}
-
-// TimingCollectorFromContext extracts the TimingCollector from context, or nil.
-func TimingCollectorFromContext(ctx context.Context) *TimingCollector {
-	if ctx == nil {
-		return nil
-	}
-	tc, _ := ctx.Value(timingContextKey{}).(*TimingCollector)
-	return tc
-}
-
-// RecordTiming is a convenience function to record timing to the collector in context.
-func RecordTiming(ctx context.Context, name string, d time.Duration) {
-	if tc := TimingCollectorFromContext(ctx); tc != nil {
-		tc.Record(name, d)
-	}
-}
-
-// StartTiming is a convenience function that returns a stop function for defer usage.
-// Example:
-//
-//	defer StartTiming(ctx, "operation")()
-func StartTiming(ctx context.Context, name string) func() {
-	tc := TimingCollectorFromContext(ctx)
-	if tc == nil {
-		return func() {}
-	}
-	return tc.StartTimer(name)
-}
-
-// IsPerfDebugEnabled returns true if performance debug output is enabled.
-func IsPerfDebugEnabled() bool {
-	return os.Getenv(PerfDebugEnv) != ""
-}
-
-// ── Structured Performance Report ──────────────────────────────────────
-
-// PerfPhase is a single phase in the performance report.
-type PerfPhase struct {
-	Name       string `json:"name"`
-	DurationMs int64  `json:"duration_ms"`
-	Seq        int    `json:"seq"`
-}
-
-// PerfReport is the JSON-serialisable performance report.
-type PerfReport struct {
-	Kind       string      `json:"kind"`
-	Version    string      `json:"version"`
-	CLIVersion string      `json:"cli_version"`
-	Command    string      `json:"command"`
-	Timestamp  time.Time   `json:"timestamp"`
-	TotalMs    int64       `json:"total_ms"`
-	Phases     []PerfPhase `json:"phases"`
-	Slowest    string      `json:"slowest"`
-	OverheadMs int64       `json:"overhead_ms"`
-}
-
-// BuildReport constructs a PerfReport from the collected timing entries.
-func (tc *TimingCollector) BuildReport(cliVersion, command string) PerfReport {
-	entries := tc.Entries()
-	total := tc.Total()
-	totalMs := total.Milliseconds()
-
-	phases := make([]PerfPhase, len(entries))
-	var sumMs int64
-	var slowestName string
-	var slowestMs int64
-
-	for i, e := range entries {
-		ms := e.Duration.Milliseconds()
-		phases[i] = PerfPhase{
-			Name:       e.Name,
-			DurationMs: ms,
-			Seq:        e.Seq,
-		}
-		sumMs += ms
-		if ms > slowestMs {
-			slowestMs = ms
-			slowestName = e.Name
-		}
-	}
-
-	overhead := totalMs - sumMs
-	if overhead < 0 {
-		overhead = 0
-	}
-
-	return PerfReport{
-		Kind:       "perf_report",
-		Version:    "1",
-		CLIVersion: cliVersion,
-		Command:    command,
-		Timestamp:  time.Now(),
-		TotalMs:    totalMs,
-		Phases:     phases,
-		Slowest:    slowestName,
-		OverheadMs: overhead,
-	}
-}
-
-// WriteReportIfEnabled checks DWS_PERF_REPORT and writes a JSON report if set.
-func (tc *TimingCollector) WriteReportIfEnabled(cliVersion, command string) {
-	if tc == nil {
-		return
-	}
-	dest := os.Getenv(PerfReportEnv)
-	if dest == "" {
-		return
-	}
-
-	report := tc.BuildReport(cliVersion, command)
-	data, err := json.MarshalIndent(report, "", "  ")
-	if err != nil {
-		return
-	}
-
-	path := resolvePerfReportPath(dest)
-	if path == "" {
-		return
-	}
-
-	dir := filepath.Dir(path)
-	if err := os.MkdirAll(dir, 0o700); err != nil {
-		return
-	}
-
-	tmp := path + ".tmp"
-	if err := os.WriteFile(tmp, data, 0o600); err != nil {
-		_ = os.Remove(tmp)
-		return
-	}
-	_ = os.Rename(tmp, path)
-}
-
-// LoadLatestReport reads the default perf report file (~/.dws/perf/latest.json).
-func LoadLatestReport() (*PerfReport, error) {
-	path := defaultPerfReportPath()
-	data, err := os.ReadFile(path)
-	if err != nil {
-		return nil, err
-	}
-	var report PerfReport
-	if err := json.Unmarshal(data, &report); err != nil {
-		return nil, err
-	}
-	return &report, nil
-}
-
-// resolvePerfReportPath resolves the DWS_PERF_REPORT value to an absolute path.
-func resolvePerfReportPath(dest string) string {
-	if dest == "auto" {
-		return defaultPerfReportPath()
-	}
-	return dest
-}
-
-func defaultPerfReportPath() string {
-	home, err := os.UserHomeDir()
-	if err != nil {
-		return ""
-	}
-	return filepath.Join(home, ".dws", perfReportDir, perfReportFile)
-}
-
-// sensitiveFlags are flag names whose values should be masked in commands.
-var sensitiveFlags = map[string]bool{
-	"--token":         true,
-	"--client-secret": true,
-	"--client-id":     true,
-}
-
-// SanitizeCommand redacts sensitive flag values from a command arg slice.
-func SanitizeCommand(args []string) string {
-	sanitized := make([]string, 0, len(args))
-	skipNext := false
-	for _, arg := range args {
-		if skipNext {
-			sanitized = append(sanitized, "***")
-			skipNext = false
-			continue
-		}
-		if idx := strings.IndexByte(arg, '='); idx > 0 {
-			key := arg[:idx]
-			if sensitiveFlags[key] {
-				sanitized = append(sanitized, key+"=***")
-				continue
-			}
-		}
-		if sensitiveFlags[arg] {
-			skipNext = true
-		}
-		sanitized = append(sanitized, arg)
-	}
-	return strings.Join(sanitized, " ")
-}
@@ -1,453 +0,0 @@
-// Copyright 2026 Alibaba Group
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package app
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-	"time"
-)
-
-func TestTimingCollector_Basic(t *testing.T) {
-	tc := NewTimingCollector()
-	if tc == nil {
-		t.Fatal("NewTimingCollector returned nil")
-	}
-
-	// Record some timings
-	tc.Record("op1", 10*time.Millisecond)
-	tc.Record("op2", 20*time.Millisecond)
-
-	entries := tc.Entries()
-	if len(entries) != 2 {
-		t.Errorf("expected 2 entries, got %d", len(entries))
-	}
-
-	// Check ordering
-	if entries[0].Name != "op1" {
-		t.Errorf("expected first entry to be 'op1', got %q", entries[0].Name)
-	}
-	if entries[1].Name != "op2" {
-		t.Errorf("expected second entry to be 'op2', got %q", entries[1].Name)
-	}
-}
-
-func TestTimingCollector_StartTimer(t *testing.T) {
-	tc := NewTimingCollector()
-
-	stop := tc.StartTimer("timed_op")
-	time.Sleep(5 * time.Millisecond)
-	stop()
-
-	entries := tc.Entries()
-	if len(entries) != 1 {
-		t.Fatalf("expected 1 entry, got %d", len(entries))
-	}
-	if entries[0].Name != "timed_op" {
-		t.Errorf("expected entry name 'timed_op', got %q", entries[0].Name)
-	}
-	if entries[0].Duration < 5*time.Millisecond {
-		t.Errorf("expected duration >= 5ms, got %v", entries[0].Duration)
-	}
-}
-
-func TestTimingCollector_NilSafe(t *testing.T) {
-	var tc *TimingCollector
-
-	// Should not panic on nil collector
-	tc.Record("op", 10*time.Millisecond)
-	stop := tc.StartTimer("op")
-	stop()
-	_ = tc.Total()
-	_ = tc.Entries()
-	tc.Print(nil)
-	tc.PrintIfEnabled()
-}
-
-func TestTimingCollector_Print(t *testing.T) {
-	tc := NewTimingCollector()
-	tc.Record("auth_token", 44*time.Millisecond)
-	tc.Record("mcp_call", 150*time.Millisecond)
-
-	var buf bytes.Buffer
-	tc.Print(&buf)
-
-	output := buf.String()
-	if !strings.Contains(output, "[Perf]") {
-		t.Error("output should contain [Perf] header")
-	}
-	if !strings.Contains(output, "auth_token") {
-		t.Error("output should contain 'auth_token'")
-	}
-	if !strings.Contains(output, "mcp_call") {
-		t.Error("output should contain 'mcp_call'")
-	}
-	if !strings.Contains(output, "Total") {
-		t.Error("output should contain 'Total'")
-	}
-}
-
-func TestTimingCollector_PrintIfEnabled(t *testing.T) {
-	// Set environment variable
-	os.Setenv(PerfDebugEnv, "1")
-	defer os.Unsetenv(PerfDebugEnv)
-
-	tc := NewTimingCollector()
-	tc.Record("test_op", 10*time.Millisecond)
-
-	// This should not panic and should print to stderr
-	tc.PrintIfEnabled()
-}
-
-func TestTimingCollector_ContextIntegration(t *testing.T) {
-	tc := NewTimingCollector()
-	ctx := WithTimingCollector(context.Background(), tc)
-
-	// Retrieve from context
-	retrieved := TimingCollectorFromContext(ctx)
-	if retrieved != tc {
-		t.Error("TimingCollectorFromContext should return the same collector")
-	}
-
-	// Use convenience functions
-	RecordTiming(ctx, "ctx_op", 30*time.Millisecond)
-	stop := StartTiming(ctx, "ctx_timed")
-	time.Sleep(2 * time.Millisecond)
-	stop()
-
-	entries := tc.Entries()
-	if len(entries) != 2 {
-		t.Errorf("expected 2 entries, got %d", len(entries))
-	}
-}
-
-func TestTimingCollectorFromContext_NilContext(t *testing.T) {
-	//lint:ignore SA1012 Testing explicit nil-context guard in TimingCollectorFromContext.
-	tc := TimingCollectorFromContext(nil)
-	if tc != nil {
-		t.Error("TimingCollectorFromContext(nil) should return nil")
-	}
-}
-
-func TestTimingCollectorFromContext_NoCollector(t *testing.T) {
-	tc := TimingCollectorFromContext(context.Background())
-	if tc != nil {
-		t.Error("TimingCollectorFromContext with no collector should return nil")
-	}
-}
-
-func TestStartTiming_NoCollector(t *testing.T) {
-	ctx := context.Background()
-	stop := StartTiming(ctx, "no_collector")
-	// Should not panic
-	stop()
-}
-
-func TestIsPerfDebugEnabled(t *testing.T) {
-	// Clear the env var first
-	os.Unsetenv(PerfDebugEnv)
-
-	if IsPerfDebugEnabled() {
-		t.Error("IsPerfDebugEnabled should return false when env var is not set")
-	}
-
-	os.Setenv(PerfDebugEnv, "1")
-	defer os.Unsetenv(PerfDebugEnv)
-
-	if !IsPerfDebugEnabled() {
-		t.Error("IsPerfDebugEnabled should return true when env var is set")
-	}
-}
-
-// ── PerfReport tests ────────────────────────────────────────────────────
-
-func TestBuildReport(t *testing.T) {
-	tc := NewTimingCollector()
-	tc.Record("cmd_init", 45*time.Millisecond)
-	tc.Record("auth_keychain", 72*time.Millisecond)
-	tc.Record("mcp_call", 620*time.Millisecond)
-
-	report := tc.BuildReport("v1.0.8", "dws aitable list-records")
-
-	if report.Kind != "perf_report" {
-		t.Errorf("expected kind 'perf_report', got %q", report.Kind)
-	}
-	if report.Version != "1" {
-		t.Errorf("expected version '1', got %q", report.Version)
-	}
-	if report.CLIVersion != "v1.0.8" {
-		t.Errorf("expected cli_version 'v1.0.8', got %q", report.CLIVersion)
-	}
-	if report.Command != "dws aitable list-records" {
-		t.Errorf("expected command 'dws aitable list-records', got %q", report.Command)
-	}
-	if len(report.Phases) != 3 {
-		t.Fatalf("expected 3 phases, got %d", len(report.Phases))
-	}
-	if report.Phases[0].Name != "cmd_init" || report.Phases[0].DurationMs != 45 {
-		t.Errorf("unexpected first phase: %+v", report.Phases[0])
-	}
-	if report.Slowest != "mcp_call" {
-		t.Errorf("expected slowest 'mcp_call', got %q", report.Slowest)
-	}
-	if report.TotalMs < 0 {
-		t.Errorf("total_ms should be >= 0, got %d", report.TotalMs)
-	}
-	if report.OverheadMs < 0 {
-		t.Errorf("overhead_ms should be >= 0, got %d", report.OverheadMs)
-	}
-}
-
-func TestBuildReportEmpty(t *testing.T) {
-	tc := NewTimingCollector()
-	report := tc.BuildReport("dev", "dws version")
-
-	if len(report.Phases) != 0 {
-		t.Errorf("expected 0 phases, got %d", len(report.Phases))
-	}
-	if report.Slowest != "" {
-		t.Errorf("expected empty slowest, got %q", report.Slowest)
-	}
-}
-
-func TestBuildReportJSON(t *testing.T) {
-	tc := NewTimingCollector()
-	tc.Record("cmd_init", 10*time.Millisecond)
-
-	report := tc.BuildReport("v1.0.0", "dws version")
-	data, err := json.Marshal(report)
-	if err != nil {
-		t.Fatalf("json.Marshal failed: %v", err)
-	}
-
-	var parsed map[string]any
-	if err := json.Unmarshal(data, &parsed); err != nil {
-		t.Fatalf("json.Unmarshal failed: %v", err)
-	}
-
-	requiredKeys := []string{"kind", "version", "cli_version", "command", "timestamp", "total_ms", "phases", "slowest", "overhead_ms"}
-	for _, key := range requiredKeys {
-		if _, ok := parsed[key]; !ok {
-			t.Errorf("missing key %q in JSON output", key)
-		}
-	}
-}
-
-func TestWriteReportIfEnabled(t *testing.T) {
-	dir := t.TempDir()
-	reportPath := filepath.Join(dir, "report.json")
-
-	t.Setenv(PerfReportEnv, reportPath)
-
-	tc := NewTimingCollector()
-	tc.Record("cmd_init", 50*time.Millisecond)
-	tc.Record("mcp_call", 200*time.Millisecond)
-
-	tc.WriteReportIfEnabled("v1.0.0", "dws version")
-
-	data, err := os.ReadFile(reportPath)
-	if err != nil {
-		t.Fatalf("report file not written: %v", err)
-	}
-
-	var report PerfReport
-	if err := json.Unmarshal(data, &report); err != nil {
-		t.Fatalf("invalid JSON in report: %v", err)
-	}
-	if report.Kind != "perf_report" {
-		t.Errorf("expected kind 'perf_report', got %q", report.Kind)
-	}
-	if len(report.Phases) != 2 {
-		t.Errorf("expected 2 phases, got %d", len(report.Phases))
-	}
-}
-
-func TestWriteReportIfEnabled_Auto(t *testing.T) {
-	tmpHome := t.TempDir()
-	expected := filepath.Join(tmpHome, ".dws", "perf", "latest.json")
-
-	// Temporarily override HOME for defaultPerfReportPath
-	t.Setenv("HOME", tmpHome)
-	t.Setenv(PerfReportEnv, "auto")
-
-	tc := NewTimingCollector()
-	tc.Record("cmd_init", 10*time.Millisecond)
-	tc.WriteReportIfEnabled("v1.0.0", "dws version")
-
-	if _, err := os.Stat(expected); err != nil {
-		t.Fatalf("expected report at %s: %v", expected, err)
-	}
-}
-
-func TestWriteReportIfEnabled_Disabled(t *testing.T) {
-	t.Setenv(PerfReportEnv, "")
-
-	tc := NewTimingCollector()
-	tc.Record("op", 10*time.Millisecond)
-	tc.WriteReportIfEnabled("v1.0.0", "dws version")
-	// No file should be written; no error expected
-}
-
-func TestWriteReportIfEnabled_NilCollector(t *testing.T) {
-	t.Setenv(PerfReportEnv, "/tmp/should-not-exist.json")
-	var tc *TimingCollector
-	tc.WriteReportIfEnabled("v1.0.0", "dws version")
-}
-
-func TestLoadLatestReport(t *testing.T) {
-	tmpHome := t.TempDir()
-	t.Setenv("HOME", tmpHome)
-
-	perfDir := filepath.Join(tmpHome, ".dws", "perf")
-	if err := os.MkdirAll(perfDir, 0o700); err != nil {
-		t.Fatal(err)
-	}
-
-	report := PerfReport{
-		Kind:       "perf_report",
-		Version:    "1",
-		CLIVersion: "v1.0.0",
-		Command:    "dws version",
-		TotalMs:    100,
-		Phases:     []PerfPhase{{Name: "cmd_init", DurationMs: 50, Seq: 0}},
-		Slowest:    "cmd_init",
-		OverheadMs: 50,
-	}
-	data, _ := json.MarshalIndent(report, "", "  ")
-	if err := os.WriteFile(filepath.Join(perfDir, "latest.json"), data, 0o600); err != nil {
-		t.Fatal(err)
-	}
-
-	loaded, err := LoadLatestReport()
-	if err != nil {
-		t.Fatalf("LoadLatestReport failed: %v", err)
-	}
-	if loaded.CLIVersion != "v1.0.0" {
-		t.Errorf("expected cli_version 'v1.0.0', got %q", loaded.CLIVersion)
-	}
-	if len(loaded.Phases) != 1 {
-		t.Errorf("expected 1 phase, got %d", len(loaded.Phases))
-	}
-}
-
-func TestLoadLatestReport_NotFound(t *testing.T) {
-	tmpHome := t.TempDir()
-	t.Setenv("HOME", tmpHome)
-
-	_, err := LoadLatestReport()
-	if err == nil {
-		t.Error("expected error when report file does not exist")
-	}
-}
-
-func TestSanitizeCommand(t *testing.T) {
-	tests := []struct {
-		name string
-		args []string
-		want string
-	}{
-		{
-			name: "no sensitive flags",
-			args: []string{"dws", "aitable", "list-records"},
-			want: "dws aitable list-records",
-		},
-		{
-			name: "token with space-separated value",
-			args: []string{"dws", "--token", "secret123", "version"},
-			want: "dws --token *** version",
-		},
-		{
-			name: "token with equals sign",
-			args: []string{"dws", "--token=secret123", "version"},
-			want: "dws --token=*** version",
-		},
-		{
-			name: "client-secret space-separated",
-			args: []string{"dws", "--client-secret", "mysecret", "--client-id", "myid", "auth"},
-			want: "dws --client-secret *** --client-id *** auth",
-		},
-		{
-			name: "client-id with equals",
-			args: []string{"dws", "--client-id=abc123"},
-			want: "dws --client-id=***",
-		},
-		{
-			name: "empty args",
-			args: []string{},
-			want: "",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			got := SanitizeCommand(tt.args)
-			if got != tt.want {
-				t.Errorf("SanitizeCommand(%v) = %q, want %q", tt.args, got, tt.want)
-			}
-		})
-	}
-}
-
-func TestResolvePerfReportPath_Auto(t *testing.T) {
-	p := resolvePerfReportPath("auto")
-	if p == "" {
-		t.Skip("HOME not available")
-	}
-	if !strings.HasSuffix(p, filepath.Join("perf", "latest.json")) {
-		t.Errorf("expected path ending in perf/latest.json, got %q", p)
-	}
-}
-
-func TestResolvePerfReportPath_Custom(t *testing.T) {
-	p := resolvePerfReportPath("/tmp/my-report.json")
-	if p != "/tmp/my-report.json" {
-		t.Errorf("expected '/tmp/my-report.json', got %q", p)
-	}
-}
-
-func TestPrintPerfReportSummary(t *testing.T) {
-	report := &PerfReport{
-		Command:    "dws version",
-		Timestamp:  time.Now(),
-		TotalMs:    300,
-		Phases:     []PerfPhase{{Name: "cmd_init", DurationMs: 50, Seq: 0}, {Name: "mcp_call", DurationMs: 200, Seq: 1}},
-		Slowest:    "mcp_call",
-		OverheadMs: 50,
-	}
-
-	var buf bytes.Buffer
-	printPerfReportSummary(&buf, report)
-	out := buf.String()
-
-	if !strings.Contains(out, "cmd_init") {
-		t.Error("output should contain 'cmd_init'")
-	}
-	if !strings.Contains(out, "mcp_call") {
-		t.Error("output should contain 'mcp_call'")
-	}
-	if !strings.Contains(out, "← 最慢") {
-		t.Error("output should contain '← 最慢' marker")
-	}
-	if !strings.Contains(out, "总耗时") {
-		t.Error("output should contain '总耗时'")
-	}
-	if !strings.Contains(out, "框架开销") {
-		t.Error("output should contain '框架开销'")
-	}
-}
@@ -1,104 +0,0 @@
-// Copyright 2026 Alibaba Group
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package app
-
-import (
-	"context"
-	"encoding/json"
-
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/executor"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/edition"
-)
-
-// toolCallerAdapter bridges executor.Runner to the public edition.ToolCaller
-// interface so that private overlays can invoke MCP tools without importing
-// internal packages.
-type toolCallerAdapter struct {
-	runner executor.Runner
-	flags  *GlobalFlags
-}
-
-func newToolCallerAdapter(runner executor.Runner, flags *GlobalFlags) edition.ToolCaller {
-	return &toolCallerAdapter{runner: runner, flags: flags}
-}
-
-func (a *toolCallerAdapter) CallTool(ctx context.Context, productID, toolName string, args map[string]any) (*edition.ToolResult, error) {
-	inv := executor.NewHelperInvocation("overlay."+productID+"."+toolName, productID, toolName, args)
-	result, err := a.runner.Run(ctx, inv)
-	if err != nil {
-		return nil, err
-	}
-	return convertResult(result), nil
-}
-
-func (a *toolCallerAdapter) Format() string {
-	if a.flags != nil {
-		return a.flags.Format
-	}
-	return "json"
-}
-
-func (a *toolCallerAdapter) DryRun() bool {
-	return a.flags != nil && a.flags.DryRun
-}
-
-func convertResult(r executor.Result) *edition.ToolResult {
-	resp := r.Response
-	if resp == nil {
-		return &edition.ToolResult{}
-	}
-
-	// The runtime runner stores MCP response content under "content".
-	contentRaw, ok := resp["content"]
-	if !ok {
-		// Dry-run or echo mode: serialize the whole response as text.
-		data, _ := json.Marshal(resp)
-		return &edition.ToolResult{
-			Content: []edition.ContentBlock{{Type: "text", Text: string(data)}},
-		}
-	}
-
-	// Content may be a []any of {type, text} blocks from the MCP response,
-	// or a single map for mock mode.
-	switch v := contentRaw.(type) {
-	case []any:
-		blocks := make([]edition.ContentBlock, 0, len(v))
-		for _, item := range v {
-			if m, ok := item.(map[string]any); ok {
-				blocks = append(blocks, edition.ContentBlock{
-					Type: strVal(m, "type"),
-					Text: strVal(m, "text"),
-				})
-			}
-		}
-		return &edition.ToolResult{Content: blocks}
-	case map[string]any:
-		data, _ := json.Marshal(v)
-		return &edition.ToolResult{
-			Content: []edition.ContentBlock{{Type: "text", Text: string(data)}},
-		}
-	default:
-		data, _ := json.Marshal(contentRaw)
-		return &edition.ToolResult{
-			Content: []edition.ContentBlock{{Type: "text", Text: string(data)}},
-		}
-	}
-}
-
-func strVal(m map[string]any, key string) string {
-	if v, ok := m[key].(string); ok {
-		return v
-	}
-	return ""
-}
@@ -1,747 +0,0 @@
-// Copyright 2026 Alibaba Group
-// Licensed under the Apache License, Version 2.0
-
-package app
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"strings"
-	"time"
-
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/upgrade"
-	"github.com/fatih/color"
-	"github.com/spf13/cobra"
-)
-
-var (
-	ugBold    = color.New(color.Bold).SprintFunc()
-	ugGreen   = color.New(color.FgGreen).SprintFunc()
-	ugYellow  = color.New(color.FgYellow).SprintFunc()
-	ugRed     = color.New(color.FgRed).SprintFunc()
-	ugCyan    = color.New(color.FgCyan).SprintFunc()
-	ugDim     = color.New(color.Faint).SprintFunc()
-	ugBoldGrn = color.New(color.Bold, color.FgGreen).SprintFunc()
-)
-
-const defaultListLimit = 10
-
-func newUpgradeCommand() *cobra.Command {
-	var (
-		flagCheck      bool
-		flagList       bool
-		flagVersion    string
-		flagRollback   bool
-		flagForce      bool
-		flagSkipSkills bool
-		flagAll        bool
-	)
-
-	cmd := &cobra.Command{
-		Use:   "upgrade",
-		Short: "升级 DWS CLI 到最新版本",
-		Long: `检查并升级 DWS CLI 到最新版本。
-
-自动下载匹配当前平台的二进制文件和技能包，通过 SHA256 校验后原子替换。
-升级前会自动备份当前版本，可通过 --rollback 回滚。`,
-		Example: `  dws upgrade                    # 交互式升级到最新版本
-  dws upgrade --check            # 仅检查是否有新版本
-  dws upgrade --list             # 列出最近版本
-  dws upgrade --list --all       # 列出所有版本
-  dws upgrade --version v1.0.5   # 升级到指定版本
-  dws upgrade --rollback         # 回滚到上一版本
-  dws upgrade -y                 # 跳过确认直接升级`,
-		Args: cobra.NoArgs,
-		RunE: func(cmd *cobra.Command, args []string) error {
-			yes, _ := cmd.Flags().GetBool("yes")
-			format := resolveUpgradeFormat(cmd)
-
-			if flagList {
-				limit := defaultListLimit
-				if flagAll {
-					limit = 0
-				}
-				return runUpgradeList(cmd, format, limit)
-			}
-			if flagRollback {
-				return runUpgradeRollback(yes)
-			}
-			if flagCheck {
-				return runUpgradeCheck(cmd, format)
-			}
-			return runUpgrade(cmd.Context(), upgradeOptions{
-				targetVersion: flagVersion,
-				force:         flagForce,
-				skipSkills:    flagSkipSkills,
-				yes:           yes,
-			})
-		},
-	}
-
-	cmd.Flags().BoolVar(&flagCheck, "check", false, "仅检查是否有新版本")
-	cmd.Flags().BoolVar(&flagList, "list", false, "列出可用版本")
-	cmd.Flags().BoolVar(&flagAll, "all", false, "与 --list 搭配，显示所有版本")
-	cmd.Flags().StringVar(&flagVersion, "version", "", "升级到指定版本")
-	cmd.Flags().BoolVar(&flagRollback, "rollback", false, "回滚到上一版本")
-	cmd.Flags().BoolVar(&flagForce, "force", false, "强制重新安装当前版本")
-	cmd.Flags().BoolVar(&flagSkipSkills, "skip-skills", false, "跳过技能包更新")
-
-	return cmd
-}
-
-type upgradeOptions struct {
-	targetVersion string
-	force         bool
-	skipSkills    bool
-	yes           bool
-}
-
-// --- dws upgrade --check ---
-
-func runUpgradeCheck(cmd *cobra.Command, format string) error {
-	client := upgrade.NewClient()
-
-	if format != "json" {
-		fmt.Printf("  %s\n", ugDim("检查更新..."))
-	}
-
-	latest, err := client.FetchLatestRelease()
-	if err != nil {
-		return fmt.Errorf("检查更新失败: %w", err)
-	}
-
-	currentVer := version
-	needsUpgrade := upgrade.NeedsUpgrade(currentVer, latest.Version)
-
-	if format == "json" {
-		return writeJSON(cmd.OutOrStdout(), map[string]any{
-			"current_version": ensureV(currentVer),
-			"latest_version":  "v" + latest.Version,
-			"needs_upgrade":   needsUpgrade,
-			"release_date":    latest.Date,
-			"prerelease":      latest.Prerelease,
-			"changelog":       parseChangelogEntries(latest.Changelog, 10),
-			"release_url":     latest.HTMLURL,
-		})
-	}
-
-	if !needsUpgrade {
-		fmt.Printf("\n  %s 已是最新版本 %s\n", ugBoldGrn("✔"), ugBold(ensureV(currentVer)))
-		return nil
-	}
-
-	fmt.Println()
-	fmt.Printf("  %s  %s %s %s\n", ugBold("新版本可用:"), ugDim(ensureV(currentVer)), ugBold("→"), ugBoldGrn("v"+latest.Version))
-	if latest.Date != "" {
-		fmt.Printf("  %s  %s\n", ugBold("发布日期:  "), latest.Date)
-	}
-	if latest.Prerelease {
-		fmt.Printf("  %s  %s\n", ugBold("通道:      "), ugYellow("pre-release"))
-	}
-	if entries := parseChangelogEntries(latest.Changelog, 5); len(entries) > 0 {
-		fmt.Printf("  %s\n", ugBold("更新内容:"))
-		for _, e := range entries {
-			fmt.Printf("    %s %s\n", ugGreen("•"), e)
-		}
-	}
-	fmt.Println()
-	fmt.Printf("  %s\n", ugDim("运行 dws upgrade 进行升级"))
-	return nil
-}
-
-// --- dws upgrade --list ---
-
-// runUpgradeList displays available versions. When limit > 0, only the most
-// recent `limit` versions are shown; pass 0 to show all (--all flag).
-func runUpgradeList(cmd *cobra.Command, format string, limit int) error {
-	client := upgrade.NewClient()
-
-	if format != "json" {
-		fmt.Printf("  %s\n", ugDim("获取版本列表..."))
-	}
-
-	versions, err := client.FetchAllReleases()
-	if err != nil {
-		return fmt.Errorf("获取版本列表失败: %w", err)
-	}
-
-	totalCount := len(versions)
-	truncated := false
-	if limit > 0 && len(versions) > limit {
-		versions = versions[:limit]
-		truncated = true
-	}
-
-	currentVer := strings.TrimPrefix(version, "v")
-
-	if format == "json" {
-		var items []map[string]any
-		for _, v := range versions {
-			items = append(items, map[string]any{
-				"version":    "v" + v.Version,
-				"date":       v.Date,
-				"prerelease": v.Prerelease,
-				"installed":  v.Version == currentVer,
-				"changelog":  parseChangelogEntries(v.Changelog, 10),
-			})
-		}
-		result := map[string]any{
-			"current_version": ensureV(version),
-			"versions":        items,
-			"total":           totalCount,
-		}
-		if truncated {
-			result["truncated"] = true
-			result["shown"] = limit
-		}
-		return writeJSON(cmd.OutOrStdout(), result)
-	}
-
-	if totalCount == 0 {
-		fmt.Printf("  %s\n", ugYellow("未找到任何版本"))
-		return nil
-	}
-
-	fmt.Println()
-	fmt.Printf("  %s\n", ugBold(fmt.Sprintf("%-12s %-12s %-12s %s", "VERSION", "DATE", "TYPE", "CHANGELOG")))
-	fmt.Printf("  %s\n", ugDim(strings.Repeat("─", 70)))
-
-	for _, v := range versions {
-		releaseType := ugGreen("stable")
-		if v.Prerelease {
-			releaseType = ugYellow("pre-release")
-		}
-		versionStr := fmt.Sprintf("v%-11s", v.Version)
-		marker := ""
-		if v.Version == currentVer {
-			versionStr = ugBoldGrn(versionStr)
-			marker = ugCyan(" ← 已安装")
-		}
-		changelog := ugDim(truncateChangelogForList(v.Changelog, 40))
-		fmt.Printf("  %s %-12s %-23s %s%s\n", versionStr, v.Date, releaseType, changelog, marker)
-	}
-
-	fmt.Println()
-	fmt.Printf("  %s %s\n", ugBold("当前版本:"), ugBoldGrn(ensureV(version)))
-	if truncated {
-		fmt.Printf("  %s\n", ugDim(fmt.Sprintf("显示最近 %d 个版本（共 %d 个），使用 --list --all 查看全部", limit, totalCount)))
-	}
-	fmt.Printf("  %s\n", ugDim("提示: 使用 dws upgrade --version v1.0.7 安装指定版本"))
-	return nil
-}
-
-// --- dws upgrade --rollback ---
-
-func runUpgradeRollback(yes bool) error {
-	rm := upgrade.NewRollbackManager()
-
-	backups, err := rm.ListBackups()
-	if err != nil {
-		return fmt.Errorf("获取备份列表失败: %w", err)
-	}
-	if len(backups) == 0 {
-		return fmt.Errorf("没有可用的备份，无法回滚")
-	}
-
-	target := backups[0]
-	targetVer := ensureV(target.Version)
-	currentVer := ensureV(version)
-
-	fmt.Println()
-	fmt.Printf("  当前版本:  %s\n", ugBold(currentVer))
-	fmt.Printf("  回滚目标:  %s  %s\n", ugCyan(targetVer), ugDim("("+target.CreatedAt.Format("2006-01-02 15:04")+")"))
-
-	if !yes {
-		fmt.Println()
-		fmt.Printf("是否回滚到 %s? [y/N] ", ugBold(targetVer))
-		var answer string
-		fmt.Scanln(&answer)
-		if answer != "y" && answer != "Y" {
-			fmt.Println("已取消")
-			return nil
-		}
-	}
-
-	fmt.Print("  回滚中...")
-	if err := rm.RollbackTo(target); err != nil {
-		return fmt.Errorf("\n回滚失败: %w", err)
-	}
-	fmt.Printf(" %s\n", ugGreen("✓"))
-
-	fmt.Println()
-	fmt.Printf("  %s\n", ugDim("──────────────────────────────────────"))
-	fmt.Printf("  %s 已回滚  %s %s %s\n", ugBoldGrn("✔"), ugDim(currentVer), ugBold("→"), ugBoldGrn(targetVer))
-	fmt.Printf("  %s\n", ugDim("──────────────────────────────────────"))
-	fmt.Println()
-	fmt.Printf("  %s\n", ugDim("运行 dws version 验证当前版本"))
-	return nil
-}
-
-// --- dws upgrade (full) ---
-//
-// The upgrade flow is split into two phases for atomicity:
-//   Phase 1 (Prepare): download, verify, extract — all in a temp directory, zero side effects.
-//   Phase 2 (Apply):   replace binary + install skills — only runs if Phase 1 fully succeeds.
-// If anything fails in Phase 1, no files on disk are modified.
-
-func runUpgrade(ctx context.Context, opts upgradeOptions) error {
-	fmt.Printf("  %s\n", ugDim("检查更新..."))
-
-	if err := upgrade.EnsureUpgradeDirectories(); err != nil {
-		return fmt.Errorf("初始化目录结构失败: %w", err)
-	}
-
-	upgrade.CleanupStaleFiles()
-
-	client := upgrade.NewClient()
-	var release *upgrade.ReleaseInfo
-	var err error
-
-	if opts.targetVersion != "" {
-		fmt.Printf("  指定版本: %s\n", ugCyan("v"+opts.targetVersion))
-		release, err = client.FetchReleaseByTag(opts.targetVersion)
-		if err != nil {
-			return fmt.Errorf("获取版本 %s 信息失败: %w", opts.targetVersion, err)
-		}
-	} else {
-		release, err = client.FetchLatestRelease()
-		if err != nil {
-			return fmt.Errorf("检查更新失败: %w", err)
-		}
-	}
-
-	currentVer := version
-	if !opts.force && !upgrade.NeedsUpgrade(currentVer, release.Version) {
-		fmt.Printf("\n  %s 已是最新版本 %s\n", ugBoldGrn("✔"), ugBold(ensureV(currentVer)))
-		return nil
-	}
-
-	fmt.Println()
-	fmt.Printf("  %s  %s %s %s\n", ugBold("新版本可用:"), ugDim(ensureV(currentVer)), ugBold("→"), ugBoldGrn("v"+release.Version))
-	if release.Date != "" {
-		fmt.Printf("  %s  %s\n", ugBold("发布日期:  "), release.Date)
-	}
-	if release.Prerelease {
-		fmt.Printf("  %s  %s\n", ugBold("通道:      "), ugYellow("pre-release"))
-	}
-
-	if !opts.yes {
-		fmt.Println()
-		fmt.Printf("是否升级? [y/N] ")
-		var answer string
-		fmt.Scanln(&answer)
-		if answer != "y" && answer != "Y" {
-			fmt.Println("已取消")
-			return nil
-		}
-	}
-
-	binaryAsset, err := upgrade.FindBinaryAsset(release.Assets)
-	if err != nil {
-		return err
-	}
-
-	tmpDir, err := os.MkdirTemp(upgrade.DownloadCacheDir(), "upgrade-*")
-	if err != nil {
-		tmpDir, err = os.MkdirTemp("", "dws-upgrade-*")
-		if err != nil {
-			return fmt.Errorf("创建临时目录失败: %w", err)
-		}
-	}
-	defer os.RemoveAll(tmpDir)
-
-	hasSkills := upgrade.FindSkillsAsset(release.Assets) != nil && !opts.skipSkills
-	// Steps: 1.备份  2.下载  3.校验  4.解压验证  5.替换+安装
-	const totalSteps = 5
-	stepFmt := func(n int) string { return ugBold(fmt.Sprintf("[%d/%d]", n, totalSteps)) }
-
-	// ========================================================================
-	// Phase 1: Prepare (download + verify + extract — no side effects)
-	// ========================================================================
-
-	fmt.Println()
-
-	// --- Step 1: Backup ---
-	fmt.Printf("  %s 备份当前版本...", stepFmt(1))
-	rm := upgrade.NewRollbackManager()
-	_, backupErr := rm.Backup(strings.TrimPrefix(currentVer, "v"))
-	if backupErr != nil {
-		fmt.Printf(" %s %v\n", ugYellow("⚠"), backupErr)
-	} else {
-		fmt.Printf(" %s\n", ugGreen("✓"))
-	}
-
-	// Fetch checksums.txt (needed for strict verification of both binary and skills)
-	var checksumsContent string
-	checksumsAsset := upgrade.FindChecksumsAsset(release.Assets)
-	if checksumsAsset != nil {
-		checksumsPath := filepath.Join(tmpDir, "checksums.txt")
-		if _, dlErr := upgrade.Download(checksumsAsset.BrowserDownloadURL, checksumsPath); dlErr == nil {
-			if data, readErr := os.ReadFile(checksumsPath); readErr == nil {
-				checksumsContent = string(data)
-			}
-		}
-	}
-
-	// --- Step 2: Download (binary + skills together) ---
-	sl := stepFmt(2)
-	progressPrefix := fmt.Sprintf("  %s 下载 %s", sl, ugCyan(binaryAsset.Name))
-	fmt.Print(progressPrefix)
-	start := time.Now()
-	binaryArchivePath := filepath.Join(tmpDir, binaryAsset.Name)
-	n, err := upgrade.DownloadWithProgress(ctx, binaryAsset.BrowserDownloadURL, binaryArchivePath,
-		func(percent float64, downloaded, total int64) {
-			bar := progressBar(percent)
-			fmt.Printf("\r  %s 下载 %s [%s] %5.1f%%", sl, ugCyan(binaryAsset.Name), ugCyan(bar), percent)
-		})
-	if err != nil {
-		fmt.Println()
-		return fmt.Errorf("下载二进制失败: %w", err)
-	}
-	elapsed := time.Since(start)
-	clearLine := strings.Repeat(" ", 100)
-
-	var skillsZipPath string
-	if hasSkills {
-		skillsAsset := upgrade.FindSkillsAsset(release.Assets)
-		fmt.Printf("\r%s\r%s %s %s\n", clearLine, progressPrefix, ugGreen("✓"), ugDim(fmt.Sprintf("(%.1fMB, %.1fs)", float64(n)/1024/1024, elapsed.Seconds())))
-
-		fmt.Printf("        下载 %s...", ugCyan("dws-skills.zip"))
-		skillsZipPath = filepath.Join(tmpDir, "dws-skills.zip")
-		if _, dlErr := upgrade.Download(skillsAsset.BrowserDownloadURL, skillsZipPath); dlErr != nil {
-			fmt.Printf(" %s\n", ugRed("✗"))
-			return fmt.Errorf("技能包下载失败: %w", dlErr)
-		}
-		fmt.Printf(" %s\n", ugGreen("✓"))
-	} else {
-		fmt.Printf("\r%s\r%s %s %s\n", clearLine, progressPrefix, ugGreen("✓"), ugDim(fmt.Sprintf("(%.1fMB, %.1fs)", float64(n)/1024/1024, elapsed.Seconds())))
-	}
-
-	// --- Step 3: Verify SHA256 (binary + skills together) ---
-	if err := strictVerifyFile(stepFmt(3), binaryArchivePath, binaryAsset.Name, binaryAsset.Digest, checksumsContent); err != nil {
-		return err
-	}
-	if hasSkills {
-		skillsAsset := upgrade.FindSkillsAsset(release.Assets)
-		if err := strictVerifyFile("     ", skillsZipPath, "dws-skills.zip", skillsAsset.Digest, checksumsContent); err != nil {
-			return err
-		}
-	}
-
-	// --- Step 4: Extract + validate ---
-	fmt.Printf("  %s 解压并验证...", stepFmt(4))
-	extractDir := filepath.Join(tmpDir, "extracted")
-	if strings.HasSuffix(binaryAsset.Name, ".zip") {
-		if err := upgrade.ExtractZip(binaryArchivePath, extractDir); err != nil {
-			fmt.Println()
-			return fmt.Errorf("解压失败: %w", err)
-		}
-	} else {
-		if err := extractTarGz(binaryArchivePath, extractDir); err != nil {
-			fmt.Println()
-			return fmt.Errorf("解压失败: %w", err)
-		}
-	}
-	binaryPath := upgrade.FindBinaryInDir(extractDir)
-	if binaryPath == "" {
-		fmt.Println()
-		return fmt.Errorf("在解压目录中未找到 dws 二进制文件")
-	}
-	if err := validateNewBinary(binaryPath, release.Version); err != nil {
-		fmt.Println()
-		return fmt.Errorf("验证失败: %w", err)
-	}
-
-	var skillSrc string
-	if hasSkills {
-		skillsExtractDir := filepath.Join(tmpDir, "skills-extracted")
-		os.MkdirAll(skillsExtractDir, 0755)
-		if err := upgrade.ExtractZip(skillsZipPath, skillsExtractDir); err != nil {
-			fmt.Println()
-			return fmt.Errorf("技能包解压失败 (文件可能损坏，请检查网络后重试): %w", err)
-		}
-		skillSrc = upgrade.LocateSkillMD(skillsExtractDir)
-		if skillSrc == "" {
-			fmt.Println()
-			return fmt.Errorf("技能包结构异常 (未找到 SKILL.md)，请反馈到 GitHub Issues")
-		}
-	}
-	fmt.Printf(" %s\n", ugGreen("✓"))
-
-	// ========================================================================
-	// Phase 2: Apply (all preparations succeeded — now do the actual changes)
-	// ========================================================================
-
-	// --- Step 5: Replace binary + install skills ---
-	fmt.Printf("  %s 替换并安装...", stepFmt(5))
-	if err := upgrade.ReplaceSelf(binaryPath); err != nil {
-		fmt.Printf(" %s\n", ugRed("✗"))
-		return fmt.Errorf("替换二进制失败: %w", err)
-	}
-
-	if hasSkills {
-		result, installErr := upgrade.UpgradeSkillLocations(skillSrc)
-		if installErr != nil {
-			fmt.Printf(" %s\n", ugRed("✗"))
-			return fmt.Errorf("技能包安装失败: %w", installErr)
-		}
-		failed := result.Failed()
-		if len(failed) > 0 {
-			fmt.Printf(" %s\n", ugRed("✗"))
-			for _, d := range failed {
-				fmt.Printf("       %s %s %s\n", ugRed("✗"), shortenHome(d.Dir), ugDim(d.Err.Error()))
-			}
-			return fmt.Errorf("技能包安装到 %d 个目录失败，请检查权限后手动重试: dws upgrade --force", len(failed))
-		}
-		succeeded := result.Succeeded()
-		fmt.Printf(" %s\n", ugGreen("✓"))
-		fmt.Printf("       %s %s\n", ugGreen("✓"), ugDim("二进制已替换"))
-		fmt.Printf("       %s %s\n", ugGreen("✓"), ugDim(fmt.Sprintf("技能包已安装 (%d 个位置)", len(succeeded))))
-		for _, d := range succeeded {
-			fmt.Printf("         %s %s\n", ugDim("→"), ugCyan(shortenHome(d.Dir)))
-		}
-	} else {
-		fmt.Printf(" %s\n", ugGreen("✓"))
-	}
-
-	// Cleanup old backups
-	rm.Cleanup(5)
-
-	// Summary
-	fmt.Println()
-	fmt.Printf("  %s\n", ugDim("──────────────────────────────────────"))
-	fmt.Printf("  %s 升级完成  %s %s %s\n", ugBoldGrn("✔"), ugDim(ensureV(currentVer)), ugBold("→"), ugBoldGrn("v"+release.Version))
-	fmt.Printf("  %s\n", ugDim("──────────────────────────────────────"))
-	fmt.Println()
-	fmt.Printf("  %s\n", ugDim("运行 dws version 验证当前版本"))
-	fmt.Printf("  %s\n", ugDim("如遇问题，运行 dws upgrade --rollback 回滚"))
-
-	return nil
-}
-
-// strictVerifyFile performs SHA256 verification with strict semantics:
-//   - If checksum info is available and matches → ✓
-//   - If checksum info is available but MISMATCHES → error (abort upgrade)
-//   - If no checksum info at all → skip (no data to compare against)
-func strictVerifyFile(label, filePath, fileName, assetDigest, checksumsContent string) error {
-	fmt.Printf("  %s 校验 %s...", label, fileName)
-
-	// Source 1: checksums.txt
-	if checksumsContent != "" {
-		checksums := upgrade.ParseChecksumFile(checksumsContent)
-		if expectedHash, ok := checksums[fileName]; ok {
-			if err := upgrade.VerifySHA256(filePath, expectedHash); err != nil {
-				fmt.Printf(" %s\n", ugRed("✗"))
-				return fmt.Errorf("SHA256 校验失败 (%s): %w\n       文件可能被篡改或下载不完整，请重试升级", fileName, err)
-			}
-			fmt.Printf(" %s\n", ugGreen("✓"))
-			return nil
-		}
-	}
-
-	// Source 2: GitHub asset digest
-	if digest := upgrade.ExtractDigestSHA256(assetDigest); digest != "" {
-		if err := upgrade.VerifySHA256(filePath, digest); err != nil {
-			fmt.Printf(" %s\n", ugRed("✗"))
-			return fmt.Errorf("SHA256 校验失败 (%s): %w\n       文件可能被篡改或下载不完整，请重试升级", fileName, err)
-		}
-		fmt.Printf(" %s\n", ugGreen("✓"))
-		return nil
-	}
-
-	// No checksum info available at all
-	fmt.Printf(" %s\n", ugDim("- 跳过 (无可用校验信息)"))
-	return nil
-}
-
-// validateNewBinary checks the downloaded binary is valid.
-func validateNewBinary(binaryPath, expectedVersion string) error {
-	info, err := os.Stat(binaryPath)
-	if err != nil {
-		return fmt.Errorf("文件不存在: %w", err)
-	}
-	if info.Size() == 0 {
-		return fmt.Errorf("文件为空")
-	}
-	if err := os.Chmod(binaryPath, 0755); err != nil {
-		return fmt.Errorf("设置执行权限失败: %w", err)
-	}
-
-	// Try running the binary
-	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-	defer cancel()
-
-	out, err := exec.CommandContext(ctx, binaryPath, "version").CombinedOutput()
-	if err != nil {
-		return fmt.Errorf("二进制无法执行: %w", err)
-	}
-
-	if !strings.Contains(string(out), expectedVersion) {
-		// Not fatal, version format might differ
-		fmt.Printf("\n  注意: 版本输出中未包含 %s", expectedVersion)
-	}
-	return nil
-}
-
-// extractTarGz extracts a .tar.gz file using the system tar command.
-func extractTarGz(archivePath, destDir string) error {
-	os.MkdirAll(destDir, 0755)
-	cmd := exec.Command("tar", "xzf", archivePath, "-C", destDir)
-	if out, err := cmd.CombinedOutput(); err != nil {
-		return fmt.Errorf("tar 解压失败: %v: %s", err, string(out))
-	}
-	return nil
-}
-
-func progressBar(percent float64) string {
-	width := 20
-	filled := int(percent / 100 * float64(width))
-	if filled > width {
-		filled = width
-	}
-	return strings.Repeat("█", filled) + strings.Repeat("░", width-filled)
-}
-
-// parseChangelogEntries extracts human-readable commit messages from a
-// GitHub Release body. The body typically looks like:
-//
-//	## Changelog
-//	* abcdef1234 - some commit message
-//	* 0123456789 Merge branch 'main' into main
-//
-// We strip the hash prefix and skip noisy entries (Merge branch, Merge pull request).
-func parseChangelogEntries(body string, maxEntries int) []string {
-	var entries []string
-	for _, line := range strings.Split(body, "\n") {
-		line = strings.TrimSpace(line)
-		if line == "" || strings.HasPrefix(line, "#") {
-			continue
-		}
-		line = strings.TrimPrefix(line, "* ")
-		line = strings.TrimPrefix(line, "- ")
-
-		msg := stripCommitHash(line)
-		if msg == "" {
-			continue
-		}
-		if isNoiseCommit(msg) {
-			continue
-		}
-		entries = append(entries, msg)
-		if maxEntries > 0 && len(entries) >= maxEntries {
-			break
-		}
-	}
-	return entries
-}
-
-// truncateChangelog returns a short one-line summary for the --check output.
-func truncateChangelog(body string) string {
-	entries := parseChangelogEntries(body, 3)
-	if len(entries) == 0 {
-		return ""
-	}
-	return strings.Join(entries, "; ")
-}
-
-// truncateChangelogForList returns a compact summary for the --list table.
-func truncateChangelogForList(body string, maxLen int) string {
-	entries := parseChangelogEntries(body, 2)
-	if len(entries) == 0 {
-		return "-"
-	}
-	summary := strings.Join(entries, "; ")
-	if len(summary) > maxLen {
-		return summary[:maxLen-3] + "..."
-	}
-	return summary
-}
-
-// stripCommitHash removes a leading Git commit hash (7-40 hex chars)
-// and optional separator (" - ", " ") from a line.
-func stripCommitHash(line string) string {
-	if len(line) < 8 {
-		return line
-	}
-	// Check if line starts with hex chars (commit hash)
-	hashEnd := 0
-	for hashEnd < len(line) && hashEnd < 40 {
-		c := line[hashEnd]
-		if (c >= '0' && c <= '9') || (c >= 'a' && c <= 'f') || (c >= 'A' && c <= 'F') {
-			hashEnd++
-		} else {
-			break
-		}
-	}
-	if hashEnd < 7 {
-		return line
-	}
-	rest := line[hashEnd:]
-	rest = strings.TrimPrefix(rest, " - ")
-	rest = strings.TrimLeft(rest, " ")
-	return rest
-}
-
-func isNoiseCommit(msg string) bool {
-	lower := strings.ToLower(msg)
-	noisePatterns := []string{
-		"merge branch",
-		"merge pull request",
-		"merge remote-tracking",
-	}
-	for _, p := range noisePatterns {
-		if strings.HasPrefix(lower, p) {
-			return true
-		}
-	}
-	return false
-}
-
-// ensureV ensures a version string has a "v" prefix for display consistency.
-// Non-semver values like "dev" or "unknown" are returned as-is.
-func ensureV(ver string) string {
-	if ver == "" {
-		return "v0.0.0"
-	}
-	if strings.HasPrefix(ver, "v") {
-		return ver
-	}
-	// Only add "v" prefix for semver-like strings (starts with digit)
-	if len(ver) > 0 && ver[0] >= '0' && ver[0] <= '9' {
-		return "v" + ver
-	}
-	return ver
-}
-
-// resolveUpgradeFormat returns "json" only when the user explicitly passes -f json.
-// Unlike other commands, upgrade defaults to table (human-friendly) output.
-func resolveUpgradeFormat(cmd *cobra.Command) string {
-	pf := cmd.Root().PersistentFlags()
-	if pf.Changed("format") {
-		if f, err := pf.GetString("format"); err == nil {
-			return strings.ToLower(strings.TrimSpace(f))
-		}
-	}
-	return "table"
-}
-
-func writeJSON(w interface{ Write([]byte) (int, error) }, v any) error {
-	enc := json.NewEncoder(w)
-	enc.SetIndent("", "  ")
-	return enc.Encode(v)
-}
-
-func shortenHome(path string) string {
-	homeDir, err := os.UserHomeDir()
-	if err != nil {
-		return path
-	}
-	if strings.HasPrefix(path, homeDir) {
-		return "~" + path[len(homeDir):]
-	}
-	return path
-}
@@ -1,430 +0,0 @@
-// Copyright 2026 Alibaba Group
-// Licensed under the Apache License, Version 2.0
-
-package app
-
-import (
-	"bytes"
-	"crypto/sha256"
-	"encoding/hex"
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-
-	"github.com/spf13/cobra"
-)
-
-// --- ensureV ---
-
-func TestEnsureV(t *testing.T) {
-	tests := []struct {
-		in   string
-		want string
-	}{
-		{"1.0.6", "v1.0.6"},
-		{"v1.0.6", "v1.0.6"},
-		{"0.0.1", "v0.0.1"},
-		{"dev", "dev"},
-		{"unknown", "unknown"},
-		{"", "v0.0.0"},
-		{"v", "v"},
-	}
-	for _, tt := range tests {
-		got := ensureV(tt.in)
-		if got != tt.want {
-			t.Errorf("ensureV(%q) = %q, want %q", tt.in, got, tt.want)
-		}
-	}
-}
-
-// --- parseChangelogEntries ---
-
-func TestParseChangelogEntries(t *testing.T) {
-	body := `## Changelog
-* abcdef1234567 - fix login bug
-* 0123456789abc Merge branch 'main' into main
-* fedcba9876543 - add upgrade command
-* deadbeef12345 Merge pull request #42
-* 1234567890abc - improve error handling
-`
-	entries := parseChangelogEntries(body, 10)
-
-	if len(entries) != 3 {
-		t.Fatalf("len(entries) = %d, want 3 (merge commits should be filtered)", len(entries))
-	}
-	if entries[0] != "fix login bug" {
-		t.Errorf("entries[0] = %q, want %q", entries[0], "fix login bug")
-	}
-	if entries[1] != "add upgrade command" {
-		t.Errorf("entries[1] = %q, want %q", entries[1], "add upgrade command")
-	}
-	if entries[2] != "improve error handling" {
-		t.Errorf("entries[2] = %q, want %q", entries[2], "improve error handling")
-	}
-}
-
-func TestParseChangelogEntries_MaxLimit(t *testing.T) {
-	body := "* abc1234 - msg1\n* def5678 - msg2\n* ghi9012 - msg3\n"
-	entries := parseChangelogEntries(body, 2)
-	if len(entries) != 2 {
-		t.Errorf("len = %d, want 2 (should respect maxEntries)", len(entries))
-	}
-}
-
-func TestParseChangelogEntries_EmptyBody(t *testing.T) {
-	entries := parseChangelogEntries("", 10)
-	if len(entries) != 0 {
-		t.Errorf("len = %d, want 0 for empty body", len(entries))
-	}
-}
-
-func TestParseChangelogEntries_OnlyHeaders(t *testing.T) {
-	body := "## Changelog\n## Another heading\n"
-	entries := parseChangelogEntries(body, 10)
-	if len(entries) != 0 {
-		t.Errorf("len = %d, want 0 for headers-only body", len(entries))
-	}
-}
-
-func TestParseChangelogEntries_OnlyMergeCommits(t *testing.T) {
-	body := "* abc1234 Merge branch 'main'\n* def5678 Merge pull request #10\n"
-	entries := parseChangelogEntries(body, 10)
-	if len(entries) != 0 {
-		t.Errorf("len = %d, want 0 (all merge commits should be filtered)", len(entries))
-	}
-}
-
-func TestParseChangelogEntries_DashPrefixedLines(t *testing.T) {
-	body := "- fix bug\n- add feature\n"
-	entries := parseChangelogEntries(body, 10)
-	if len(entries) != 2 {
-		t.Fatalf("len = %d, want 2", len(entries))
-	}
-	if entries[0] != "fix bug" {
-		t.Errorf("entries[0] = %q, want %q", entries[0], "fix bug")
-	}
-}
-
-// --- stripCommitHash ---
-
-func TestStripCommitHash(t *testing.T) {
-	tests := []struct {
-		in   string
-		want string
-	}{
-		{"abcdef1234567 - fix bug", "fix bug"},
-		{"abcdef1234567 fix bug", "fix bug"},
-		{"short", "short"},   // too short to be a hash
-		{"abc123", "abc123"}, // less than 7 hex chars
-		{"no hash here", "no hash here"},
-		{"ABCDEF1234567 - upper case hash", "upper case hash"},
-	}
-	for _, tt := range tests {
-		got := stripCommitHash(tt.in)
-		if got != tt.want {
-			t.Errorf("stripCommitHash(%q) = %q, want %q", tt.in, got, tt.want)
-		}
-	}
-}
-
-// --- isNoiseCommit ---
-
-func TestIsNoiseCommit(t *testing.T) {
-	tests := []struct {
-		msg  string
-		want bool
-	}{
-		{"Merge branch 'main'", true},
-		{"merge branch 'develop'", true},
-		{"Merge pull request #42", true},
-		{"Merge remote-tracking branch 'origin/main'", true},
-		{"fix login bug", false},
-		{"add new feature", false},
-		{"merge conflicts resolved", false}, // doesn't start with "merge branch"
-	}
-	for _, tt := range tests {
-		got := isNoiseCommit(tt.msg)
-		if got != tt.want {
-			t.Errorf("isNoiseCommit(%q) = %v, want %v", tt.msg, got, tt.want)
-		}
-	}
-}
-
-// --- truncateChangelog ---
-
-func TestTruncateChangelog(t *testing.T) {
-	body := "## Changelog\n* abc1234 - fix A\n* def5678 - fix B\n* ghi9012 - fix C\n* jkl3456 - fix D\n"
-	result := truncateChangelog(body)
-	if result == "" {
-		t.Error("truncateChangelog returned empty")
-	}
-	// Should contain max 3 entries separated by "; "
-	parts := strings.Split(result, "; ")
-	if len(parts) > 3 {
-		t.Errorf("truncateChangelog should have at most 3 entries, got %d", len(parts))
-	}
-}
-
-func TestTruncateChangelog_EmptyBody(t *testing.T) {
-	if got := truncateChangelog(""); got != "" {
-		t.Errorf("truncateChangelog('') = %q, want empty", got)
-	}
-}
-
-// --- truncateChangelogForList ---
-
-func TestTruncateChangelogForList(t *testing.T) {
-	tests := []struct {
-		body   string
-		maxLen int
-		want   string
-	}{
-		{"", 40, "-"},
-		{"## Changelog\n", 40, "-"},
-	}
-	for _, tt := range tests {
-		got := truncateChangelogForList(tt.body, tt.maxLen)
-		if got != tt.want {
-			t.Errorf("truncateChangelogForList(%q, %d) = %q, want %q", tt.body, tt.maxLen, got, tt.want)
-		}
-	}
-}
-
-func TestTruncateChangelogForList_Truncation(t *testing.T) {
-	body := "* abc1234 - a very long commit message that should be truncated eventually\n"
-	result := truncateChangelogForList(body, 20)
-	if len(result) > 20 {
-		t.Errorf("result len = %d, want <= 20", len(result))
-	}
-	if !strings.HasSuffix(result, "...") {
-		t.Errorf("truncated result should end with '...' , got %q", result)
-	}
-}
-
-// --- progressBar ---
-
-func TestProgressBar(t *testing.T) {
-	tests := []struct {
-		percent float64
-		filled  int
-	}{
-		{0, 0},
-		{50, 10},
-		{100, 20},
-		{150, 20}, // capped
-	}
-	for _, tt := range tests {
-		bar := progressBar(tt.percent)
-		if len(bar) != 20*len("█") && len(bar) != 20*len("░") {
-			// Since multi-byte chars, just check total rune count
-			runes := []rune(bar)
-			if len(runes) != 20 {
-				t.Errorf("progressBar(%v) rune count = %d, want 20", tt.percent, len(runes))
-			}
-		}
-		filledCount := strings.Count(bar, "█")
-		if filledCount != tt.filled {
-			t.Errorf("progressBar(%v) filled = %d, want %d", tt.percent, filledCount, tt.filled)
-		}
-	}
-}
-
-// --- shortenHome ---
-
-func TestShortenHome(t *testing.T) {
-	// Non-home path should be unchanged
-	got := shortenHome("/tmp/somewhere")
-	if got != "/tmp/somewhere" {
-		t.Errorf("shortenHome(/tmp/somewhere) = %q", got)
-	}
-}
-
-// --- resolveUpgradeFormat ---
-
-func TestResolveUpgradeFormat_Default(t *testing.T) {
-	root := &cobra.Command{}
-	root.PersistentFlags().String("format", "json", "output format")
-	child := &cobra.Command{}
-	root.AddCommand(child)
-
-	// format not changed => should default to "table" for upgrade
-	got := resolveUpgradeFormat(child)
-	if got != "table" {
-		t.Errorf("resolveUpgradeFormat(unchanged) = %q, want %q", got, "table")
-	}
-}
-
-func TestResolveUpgradeFormat_ExplicitJSON(t *testing.T) {
-	root := &cobra.Command{}
-	root.PersistentFlags().String("format", "json", "output format")
-	child := &cobra.Command{}
-	root.AddCommand(child)
-
-	// Simulate user explicitly setting format
-	root.PersistentFlags().Set("format", "json")
-
-	got := resolveUpgradeFormat(child)
-	if got != "json" {
-		t.Errorf("resolveUpgradeFormat(explicit json) = %q, want %q", got, "json")
-	}
-}
-
-func TestResolveUpgradeFormat_ExplicitTable(t *testing.T) {
-	root := &cobra.Command{}
-	root.PersistentFlags().String("format", "json", "output format")
-	child := &cobra.Command{}
-	root.AddCommand(child)
-
-	root.PersistentFlags().Set("format", "table")
-
-	got := resolveUpgradeFormat(child)
-	if got != "table" {
-		t.Errorf("resolveUpgradeFormat(explicit table) = %q, want %q", got, "table")
-	}
-}
-
-// --- writeJSON ---
-
-func TestWriteJSON(t *testing.T) {
-	var buf bytes.Buffer
-	data := map[string]any{
-		"version": "v1.0.6",
-		"ok":      true,
-	}
-	if err := writeJSON(&buf, data); err != nil {
-		t.Fatalf("writeJSON() error = %v", err)
-	}
-	output := buf.String()
-	if !strings.Contains(output, `"version": "v1.0.6"`) {
-		t.Errorf("output missing version: %s", output)
-	}
-	if !strings.Contains(output, `"ok": true`) {
-		t.Errorf("output missing ok: %s", output)
-	}
-}
-
-// --- strictVerifyFile ---
-
-func TestStrictVerifyFile_MatchesChecksums(t *testing.T) {
-	dir := t.TempDir()
-	filePath := filepath.Join(dir, "test.tar.gz")
-	content := []byte("valid binary content")
-	os.WriteFile(filePath, content, 0644)
-
-	hash := computeTestSHA256(t, content)
-	checksums := hash + "  test.tar.gz\n"
-
-	err := strictVerifyFile("[1/5]", filePath, "test.tar.gz", "", checksums)
-	if err != nil {
-		t.Errorf("expected success, got %v", err)
-	}
-}
-
-func TestStrictVerifyFile_ChecksumMismatch(t *testing.T) {
-	dir := t.TempDir()
-	filePath := filepath.Join(dir, "test.tar.gz")
-	os.WriteFile(filePath, []byte("tampered content"), 0644)
-
-	checksums := "0000000000000000000000000000000000000000000000000000000000000000  test.tar.gz\n"
-
-	err := strictVerifyFile("[1/5]", filePath, "test.tar.gz", "", checksums)
-	if err == nil {
-		t.Fatal("expected error for checksum mismatch")
-	}
-	if !strings.Contains(err.Error(), "校验失败") {
-		t.Errorf("error = %q, want to contain '校验失败'", err.Error())
-	}
-}
-
-func TestStrictVerifyFile_DigestMismatch(t *testing.T) {
-	dir := t.TempDir()
-	filePath := filepath.Join(dir, "test.tar.gz")
-	os.WriteFile(filePath, []byte("tampered"), 0644)
-
-	err := strictVerifyFile("[1/5]", filePath, "test.tar.gz",
-		"sha256:0000000000000000000000000000000000000000000000000000000000000000",
-		"")
-	if err == nil {
-		t.Fatal("expected error for digest mismatch")
-	}
-}
-
-func TestStrictVerifyFile_NoChecksumInfo(t *testing.T) {
-	dir := t.TempDir()
-	filePath := filepath.Join(dir, "test.tar.gz")
-	os.WriteFile(filePath, []byte("content"), 0644)
-
-	err := strictVerifyFile("[1/5]", filePath, "test.tar.gz", "", "")
-	if err != nil {
-		t.Errorf("no checksum info should skip, not error: %v", err)
-	}
-}
-
-func TestStrictVerifyFile_FileNotInChecksums_FallsToDigest(t *testing.T) {
-	dir := t.TempDir()
-	filePath := filepath.Join(dir, "skills.zip")
-	content := []byte("skills content")
-	os.WriteFile(filePath, content, 0644)
-
-	hash := computeTestSHA256(t, content)
-	// checksums.txt has entries but NOT skills.zip
-	checksums := "abcdef1234567890  other-file.tar.gz\n"
-
-	err := strictVerifyFile("[1/5]", filePath, "skills.zip", "sha256:"+hash, checksums)
-	if err != nil {
-		t.Errorf("should fall through to digest and succeed: %v", err)
-	}
-}
-
-func computeTestSHA256(t *testing.T, data []byte) string {
-	t.Helper()
-	h := sha256.Sum256(data)
-	return hex.EncodeToString(h[:])
-}
-
-// --- newUpgradeCommand ---
-
-func TestNewUpgradeCommand_Flags(t *testing.T) {
-	cmd := newUpgradeCommand()
-
-	if cmd.Use != "upgrade" {
-		t.Errorf("Use = %q, want upgrade", cmd.Use)
-	}
-
-	expectedFlags := []string{"check", "list", "version", "rollback", "force", "skip-skills"}
-	for _, name := range expectedFlags {
-		if cmd.Flags().Lookup(name) == nil {
-			t.Errorf("missing flag: --%s", name)
-		}
-	}
-}
-
-func TestNewUpgradeCommand_NoArgs(t *testing.T) {
-	cmd := newUpgradeCommand()
-	// Simulate passing positional args - should error with cobra.NoArgs
-	cmd.SetArgs([]string{"rollback"})
-	err := cmd.Execute()
-	if err == nil {
-		t.Error("expected error for positional args (NoArgs)")
-	}
-}
-
-func TestNewUpgradeCommand_Help(t *testing.T) {
-	cmd := newUpgradeCommand()
-	var buf bytes.Buffer
-	cmd.SetOut(&buf)
-	cmd.SetArgs([]string{"--help"})
-	cmd.Execute()
-	help := buf.String()
-
-	if !strings.Contains(help, "upgrade") {
-		t.Error("help should contain 'upgrade'")
-	}
-	if !strings.Contains(help, "--check") {
-		t.Error("help should contain --check")
-	}
-	if !strings.Contains(help, "--rollback") {
-		t.Error("help should contain --rollback")
-	}
-}
@@ -13,22 +13,7 @@

 package app

-var version = "dev"
-
-// SetVersion overrides the version, build time and git commit strings.
-// Called by pkg/cli.SetVersion for overlay modules that inject their own
-// version info via ldflags.
-func SetVersion(v, bt, gc string) {
-	if v != "" {
-		version = v
-	}
-	if bt != "" {
-		buildTime = bt
-	}
-	if gc != "" {
-		gitCommit = gc
-	}
-}
+var version = "v1.0.6"

 // Version returns the current CLI version string, including build metadata
 // when injected via ldflags (buildTime, gitCommit).
@@ -38,12 +23,3 @@ func Version() string {
 	}
 	return version
 }
-
-// RawVersion returns the bare version string without build metadata.
-func RawVersion() string { return version }
-
-// BuildTime returns the build timestamp injected via ldflags.
-func BuildTime() string { return buildTime }
-
-// GitCommit returns the git commit hash injected via ldflags.
-func GitCommit() string { return gitCommit }
@@ -1,144 +0,0 @@
-// Copyright 2026 Alibaba Group
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package auth
-
-import "testing"
-
-func TestClassifyDenialReason(t *testing.T) {
-	cases := []struct {
-		name           string
-		status         *CLIAuthStatus
-		currentChannel string
-		want           string
-	}{
-		{
-			name: "error CHANNEL_REQUIRED",
-			status: &CLIAuthStatus{
-				ErrorCode: "CHANNEL_REQUIRED",
-			},
-			want: "channel_required",
-		},
-		{
-			name: "error NO_AUTH",
-			status: &CLIAuthStatus{
-				ErrorCode: "NO_AUTH",
-			},
-			want: "no_auth",
-		},
-		{
-			name: "success false or nil result → unknown",
-			status: &CLIAuthStatus{
-				Success: false,
-			},
-			want: "unknown",
-		},
-		{
-			name: "cliAuthEnabled true → no denial",
-			status: &CLIAuthStatus{
-				Success: true,
-				Result:  &CLIAuthResult{CLIAuthEnabled: true},
-			},
-			want: "",
-		},
-		{
-			name: "userScope forbidden wins over channel",
-			status: &CLIAuthStatus{
-				Success: true,
-				Result: &CLIAuthResult{
-					CLIAuthEnabled:  false,
-					UserScope:       "forbidden",
-					ChannelScope:    "specified",
-					AllowedChannels: []string{"channel-a"},
-				},
-			},
-			currentChannel: "channel-b",
-			want:           "user_forbidden",
-		},
-		{
-			// Real-world case reported: user is in allowedUsers but the current
-			// DWS_CHANNEL is not in allowedChannels. Reason must be channel,
-			// NOT user.
-			name: "user allowed but channel not in allowedChannels → channel_not_allowed",
-			status: &CLIAuthStatus{
-				Success: true,
-				Result: &CLIAuthResult{
-					CLIAuthEnabled:  false,
-					UserScope:       "specified",
-					AllowedUsers:    []string{"014566033934857460"},
-					ChannelScope:    "specified",
-					AllowedChannels: []string{"2a4a658e467998befb7fa333c19ba2b3a3bacfa4"},
-				},
-			},
-			currentChannel: "different-channel",
-			want:           "channel_not_allowed",
-		},
-		{
-			name: "channelScope specified but current channel empty → channel_required",
-			status: &CLIAuthStatus{
-				Success: true,
-				Result: &CLIAuthResult{
-					CLIAuthEnabled:  false,
-					UserScope:       "specified",
-					ChannelScope:    "specified",
-					AllowedChannels: []string{"channel-a"},
-				},
-			},
-			currentChannel: "",
-			want:           "channel_required",
-		},
-		{
-			name: "channel matches allowedChannels → fall back to user denial",
-			status: &CLIAuthStatus{
-				Success: true,
-				Result: &CLIAuthResult{
-					CLIAuthEnabled:  false,
-					UserScope:       "specified",
-					ChannelScope:    "specified",
-					AllowedChannels: []string{"channel-a"},
-				},
-			},
-			currentChannel: "channel-a",
-			want:           "user_not_allowed",
-		},
-		{
-			name: "only userScope=specified, no channel restriction → user_not_allowed",
-			status: &CLIAuthStatus{
-				Success: true,
-				Result: &CLIAuthResult{
-					CLIAuthEnabled: false,
-					UserScope:      "specified",
-				},
-			},
-			currentChannel: "",
-			want:           "user_not_allowed",
-		},
-		{
-			name: "no user or channel restriction → cli_not_enabled",
-			status: &CLIAuthStatus{
-				Success: true,
-				Result:  &CLIAuthResult{CLIAuthEnabled: false},
-			},
-			want: "cli_not_enabled",
-		},
-	}
-
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			got := classifyDenialReason(tc.status, tc.currentChannel)
-			if got != tc.want {
-				t.Fatalf("classifyDenialReason() = %q, want %q", got, tc.want)
-			}
-		})
-	}
-}
@@ -1,847 +0,0 @@
-// Copyright 2026 Alibaba Group
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package auth
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"io"
-	"net/http"
-	"net/http/httptest"
-	"os"
-	"path/filepath"
-	"strings"
-	"sync/atomic"
-	"testing"
-	"time"
-)
-
-// setupMCPConfigDir creates a temp config dir with mcp_url pointing to the
-// given test server and sets DWS_CONFIG_DIR via t.Setenv.
-// NOTE: tests calling this must NOT use t.Parallel().
-func setupMCPConfigDir(t *testing.T, srvURL string) string {
-	t.Helper()
-	dir := t.TempDir()
-	os.WriteFile(filepath.Join(dir, "mcp_url"), []byte(srvURL), 0o600)
-	t.Setenv("DWS_CONFIG_DIR", dir)
-	return dir
-}
-
-// resetClientIDFromMCP clears the MCP-sourced flag (test helper).
-func resetClientIDFromMCP() {
-	clientMu.Lock()
-	defer clientMu.Unlock()
-	clientIDFromMCP = false
-}
-
-// ---------------------------------------------------------------------------
-// 1. CheckCLIAuthEnabled: interface error → fail-closed with retry
-// ---------------------------------------------------------------------------
-
-func TestCheckCLIAuthEnabled_ServerError_FailClosed(t *testing.T) {
-	var calls atomic.Int32
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		calls.Add(1)
-		http.Error(w, "Internal Server Error", http.StatusInternalServerError)
-	}))
-	defer srv.Close()
-
-	configDir := setupMCPConfigDir(t, srv.URL)
-	p := &OAuthProvider{configDir: configDir, httpClient: srv.Client()}
-
-	_, err := p.CheckCLIAuthEnabled(context.Background(), "fake-token")
-
-	if err == nil {
-		t.Fatal("expected error from CheckCLIAuthEnabled when server returns 500, got nil")
-	}
-	if !strings.Contains(err.Error(), "failed after 3 attempts") {
-		t.Fatalf("error should mention retry exhaustion, got: %s", err)
-	}
-	if c := calls.Load(); c != 3 {
-		t.Fatalf("expected 3 retry attempts, got %d", c)
-	}
-	t.Logf("✅ Server 500 → fail-closed: error=%q, attempts=%d", err, calls.Load())
-}
-
-func TestCheckCLIAuthEnabled_ConnectionRefused_FailClosed(t *testing.T) {
-	configDir := setupMCPConfigDir(t, "http://127.0.0.1:1")
-	p := &OAuthProvider{
-		configDir:  configDir,
-		httpClient: &http.Client{Timeout: 2 * time.Second},
-	}
-
-	_, err := p.CheckCLIAuthEnabled(context.Background(), "fake-token")
-
-	if err == nil {
-		t.Fatal("expected error when connection is refused, got nil")
-	}
-	if !strings.Contains(err.Error(), "failed after 3 attempts") {
-		t.Fatalf("error should mention retry exhaustion, got: %s", err)
-	}
-	t.Logf("✅ Connection refused → fail-closed: error=%q", err)
-}
-
-func TestCheckCLIAuthEnabled_MalformedJSON_FailClosed(t *testing.T) {
-	var calls atomic.Int32
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		calls.Add(1)
-		w.Header().Set("Content-Type", "application/json")
-		fmt.Fprint(w, `{this is not valid json}`)
-	}))
-	defer srv.Close()
-
-	configDir := setupMCPConfigDir(t, srv.URL)
-	p := &OAuthProvider{configDir: configDir, httpClient: srv.Client()}
-
-	_, err := p.CheckCLIAuthEnabled(context.Background(), "fake-token")
-
-	if err == nil {
-		t.Fatal("expected error for malformed JSON, got nil")
-	}
-	if c := calls.Load(); c != 3 {
-		t.Fatalf("expected 3 retry attempts, got %d", c)
-	}
-	t.Logf("✅ Malformed JSON → fail-closed: error=%q, attempts=%d", err, calls.Load())
-}
-
-func TestCheckCLIAuthEnabled_Timeout_FailClosed(t *testing.T) {
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		time.Sleep(5 * time.Second)
-	}))
-	defer srv.Close()
-
-	configDir := setupMCPConfigDir(t, srv.URL)
-	p := &OAuthProvider{
-		configDir:  configDir,
-		httpClient: &http.Client{Timeout: 200 * time.Millisecond},
-	}
-
-	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-	defer cancel()
-
-	_, err := p.CheckCLIAuthEnabled(ctx, "fake-token")
-
-	if err == nil {
-		t.Fatal("expected error on request timeout, got nil")
-	}
-	t.Logf("✅ Timeout → fail-closed: error=%q", err)
-}
-
-// ---------------------------------------------------------------------------
-// 2. CheckCLIAuthEnabled: transient error then recovery → succeeds
-// ---------------------------------------------------------------------------
-
-func TestCheckCLIAuthEnabled_TransientThenSuccess(t *testing.T) {
-	var calls atomic.Int32
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		n := calls.Add(1)
-		if n <= 2 {
-			http.Error(w, "Service Unavailable", http.StatusServiceUnavailable)
-			return
-		}
-		w.Header().Set("Content-Type", "application/json")
-		json.NewEncoder(w).Encode(CLIAuthStatus{
-			Success: true,
-			Result:  &CLIAuthResult{CLIAuthEnabled: true},
-		})
-	}))
-	defer srv.Close()
-
-	configDir := setupMCPConfigDir(t, srv.URL)
-	p := &OAuthProvider{configDir: configDir, httpClient: srv.Client()}
-
-	status, err := p.CheckCLIAuthEnabled(context.Background(), "fake-token")
-
-	if err != nil {
-		t.Fatalf("expected success after transient failures, got error: %v", err)
-	}
-	if !status.Success || status.Result == nil || !status.Result.CLIAuthEnabled {
-		t.Fatalf("expected CLIAuthEnabled=true, got %+v", status)
-	}
-	if c := calls.Load(); c != 3 {
-		t.Fatalf("expected 3 attempts (2 failures + 1 success), got %d", c)
-	}
-	t.Logf("✅ Transient error then success: attempts=%d, enabled=%v", calls.Load(), status.Result.CLIAuthEnabled)
-}
-
-// ---------------------------------------------------------------------------
-// 3. CheckCLIAuthEnabled: normal responses (pass-through)
-// ---------------------------------------------------------------------------
-
-func TestCheckCLIAuthEnabled_Enabled(t *testing.T) {
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if r.Header.Get("x-user-access-token") != "good-token" {
-			t.Errorf("missing access token header")
-		}
-		w.Header().Set("Content-Type", "application/json")
-		json.NewEncoder(w).Encode(CLIAuthStatus{
-			Success: true,
-			Result:  &CLIAuthResult{CLIAuthEnabled: true},
-		})
-	}))
-	defer srv.Close()
-
-	configDir := setupMCPConfigDir(t, srv.URL)
-	p := &OAuthProvider{configDir: configDir, httpClient: srv.Client()}
-
-	status, err := p.CheckCLIAuthEnabled(context.Background(), "good-token")
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if status.Result == nil || !status.Result.CLIAuthEnabled {
-		t.Fatal("expected CLIAuthEnabled=true")
-	}
-	t.Logf("✅ Normal enabled response: success=%v, enabled=%v", status.Success, status.Result.CLIAuthEnabled)
-}
-
-func TestCheckCLIAuthEnabled_Disabled(t *testing.T) {
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set("Content-Type", "application/json")
-		json.NewEncoder(w).Encode(CLIAuthStatus{
-			Success: true,
-			Result:  &CLIAuthResult{CLIAuthEnabled: false},
-		})
-	}))
-	defer srv.Close()
-
-	configDir := setupMCPConfigDir(t, srv.URL)
-	p := &OAuthProvider{configDir: configDir, httpClient: srv.Client()}
-
-	status, err := p.CheckCLIAuthEnabled(context.Background(), "fake-token")
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if status.Result == nil || status.Result.CLIAuthEnabled {
-		t.Fatal("expected CLIAuthEnabled=false")
-	}
-	t.Logf("✅ Normal disabled response: success=%v, enabled=%v", status.Success, status.Result.CLIAuthEnabled)
-}
-
-// ---------------------------------------------------------------------------
-// 4. OAuth callback: simulates the fail-closed logic at the /callback level
-// ---------------------------------------------------------------------------
-
-func TestOAuthCallback_CLIAuthError_ShowsNotEnabledPage(t *testing.T) {
-	t.Parallel()
-
-	var statusErr error = fmt.Errorf("simulated network error")
-	var authStatus *CLIAuthStatus
-	_ = authStatus
-
-	// This is the exact expression used in oauth_provider.go callback:
-	// cliAuthEnabled := statusErr == nil && authStatus.Success && authStatus.Result.CLIAuthEnabled
-	cliAuthEnabled := statusErr == nil // false
-
-	if cliAuthEnabled {
-		t.Fatal("cliAuthEnabled should be false when statusErr != nil")
-	}
-	t.Logf("✅ OAuth callback: statusErr=%v → cliAuthEnabled=%v → shows notEnabledHTML (fail-closed)", statusErr, cliAuthEnabled)
-}
-
-func TestOAuthCallback_CLIAuthEnabled_ShowsSuccessPage(t *testing.T) {
-	t.Parallel()
-
-	var statusErr error
-	authStatus := &CLIAuthStatus{
-		Success: true,
-		Result:  &CLIAuthResult{CLIAuthEnabled: true},
-	}
-
-	cliAuthEnabled := statusErr == nil && authStatus.Success && authStatus.Result != nil && authStatus.Result.CLIAuthEnabled
-	if !cliAuthEnabled {
-		t.Fatal("cliAuthEnabled should be true when API returns enabled")
-	}
-	t.Logf("✅ OAuth callback: statusErr=nil, enabled=true → cliAuthEnabled=%v → shows successHTML", cliAuthEnabled)
-}
-
-func TestOAuthCallback_CLIAuthDisabledByServer_ShowsNotEnabledPage(t *testing.T) {
-	t.Parallel()
-
-	var statusErr error
-	authStatus := &CLIAuthStatus{
-		Success: true,
-		Result:  &CLIAuthResult{CLIAuthEnabled: false},
-	}
-
-	cliAuthEnabled := statusErr == nil && authStatus.Success && authStatus.Result != nil && authStatus.Result.CLIAuthEnabled
-	if cliAuthEnabled {
-		t.Fatal("cliAuthEnabled should be false when server says disabled")
-	}
-	t.Logf("✅ OAuth callback: statusErr=nil, enabled=false → cliAuthEnabled=%v → shows notEnabledHTML", cliAuthEnabled)
-}
-
-// ---------------------------------------------------------------------------
-// 5. Device Flow: loginOnce with broken cliAuthEnabled endpoint
-// ---------------------------------------------------------------------------
-
-func TestDeviceFlow_LoginOnce_CLIAuthError_FailClosed(t *testing.T) {
-	SetClientIDFromMCP("test-client-id")
-	t.Cleanup(func() {
-		SetClientID("")
-		resetClientIDFromMCP()
-	})
-
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set("Content-Type", "application/json")
-
-		switch {
-		case strings.HasSuffix(r.URL.Path, DeviceCodePath):
-			writeServiceResult(w, true, DeviceAuthResponse{
-				DeviceCode:      "dc-test",
-				UserCode:        "TEST-CODE",
-				VerificationURI: "https://example.com/verify",
-				ExpiresIn:       60,
-				Interval:        1,
-				FlowID:          "test-flow-id",
-			}, "", "")
-
-		case strings.HasSuffix(r.URL.Path, DevicePollPath):
-			// New terminal API: return APPROVED status
-			json.NewEncoder(w).Encode(map[string]interface{}{
-				"success": true,
-				"data": map[string]string{
-					"status":   "APPROVED",
-					"authCode": "test-auth-code",
-				},
-			})
-
-		case strings.HasSuffix(r.URL.Path, MCPOAuthTokenPath):
-			json.NewEncoder(w).Encode(map[string]any{
-				"accessToken":  "test-access-token",
-				"refreshToken": "test-refresh-token",
-				"expiresIn":    7200,
-				"corpId":       "corp123",
-			})
-
-		case strings.HasSuffix(r.URL.Path, CLIAuthEnabledPath):
-			http.Error(w, "Service Unavailable", http.StatusServiceUnavailable)
-
-		default:
-			http.Error(w, "not found: "+r.URL.Path, http.StatusNotFound)
-		}
-	}))
-	defer srv.Close()
-
-	configDir := setupMCPConfigDir(t, srv.URL)
-	provider := &DeviceFlowProvider{
-		configDir:       configDir,
-		clientID:        "test-client-id",
-		scope:           DefaultScopes,
-		baseURL:         srv.URL,
-		terminalBaseURL: srv.URL,
-		logger:          newDeviceFlowTestLogger(),
-		Output:          io.Discard,
-		httpClient:      srv.Client(),
-	}
-
-	_, err := provider.loginOnce(context.Background(), 1)
-
-	if err == nil {
-		t.Fatal("expected loginOnce to fail when CLI auth check fails, got nil")
-	}
-	if !strings.Contains(err.Error(), "检查 CLI 授权状态失败") && !strings.Contains(err.Error(), "Failed to check CLI auth status") {
-		t.Fatalf("unexpected error message: %s", err)
-	}
-	t.Logf("✅ Device Flow: CLI auth check error → login blocked: %s", err)
-}
-
-func TestDeviceFlow_LoginOnce_CLIAuthDisabled_ShowsError(t *testing.T) {
-	SetClientIDFromMCP("test-client-id")
-	t.Cleanup(func() {
-		SetClientID("")
-		resetClientIDFromMCP()
-	})
-
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set("Content-Type", "application/json")
-
-		switch {
-		case strings.HasSuffix(r.URL.Path, DeviceCodePath):
-			writeServiceResult(w, true, DeviceAuthResponse{
-				DeviceCode:      "dc-test",
-				UserCode:        "TEST-CODE",
-				VerificationURI: "https://example.com/verify",
-				ExpiresIn:       60,
-				Interval:        1,
-				FlowID:          "test-flow-id",
-			}, "", "")
-
-		case strings.HasSuffix(r.URL.Path, DevicePollPath):
-			// New terminal API: return APPROVED status
-			json.NewEncoder(w).Encode(map[string]interface{}{
-				"success": true,
-				"data": map[string]string{
-					"status":   "APPROVED",
-					"authCode": "test-auth-code",
-				},
-			})
-
-		case strings.HasSuffix(r.URL.Path, MCPOAuthTokenPath):
-			json.NewEncoder(w).Encode(map[string]any{
-				"accessToken":  "test-access-token",
-				"refreshToken": "test-refresh-token",
-				"expiresIn":    7200,
-				"corpId":       "corp123",
-			})
-
-		case strings.HasSuffix(r.URL.Path, CLIAuthEnabledPath):
-			json.NewEncoder(w).Encode(CLIAuthStatus{
-				Success: true,
-				Result:  &CLIAuthResult{CLIAuthEnabled: false},
-			})
-
-		case strings.HasSuffix(r.URL.Path, SuperAdminPath):
-			json.NewEncoder(w).Encode(SuperAdminResponse{
-				Success: true,
-				Result:  []SuperAdmin{{StaffID: "admin1", Name: "张三"}},
-			})
-
-		default:
-			http.Error(w, "not found", http.StatusNotFound)
-		}
-	}))
-	defer srv.Close()
-
-	configDir := setupMCPConfigDir(t, srv.URL)
-	provider := &DeviceFlowProvider{
-		configDir:       configDir,
-		clientID:        "test-client-id",
-		scope:           DefaultScopes,
-		baseURL:         srv.URL,
-		terminalBaseURL: srv.URL,
-		logger:          newDeviceFlowTestLogger(),
-		Output:          io.Discard,
-		httpClient:      srv.Client(),
-	}
-
-	_, err := provider.loginOnce(context.Background(), 1)
-
-	if err == nil {
-		t.Fatal("expected loginOnce to fail when CLI auth is disabled, got nil")
-	}
-	t.Logf("✅ Device Flow: CLI auth disabled by server → login blocked: %s", err)
-}
-
-func TestDeviceFlow_LoginOnce_CLIAuthEnabled_Success(t *testing.T) {
-	SetClientIDFromMCP("test-client-id")
-	t.Cleanup(func() {
-		SetClientID("")
-		resetClientIDFromMCP()
-	})
-
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set("Content-Type", "application/json")
-
-		switch {
-		case strings.HasSuffix(r.URL.Path, DeviceCodePath):
-			writeServiceResult(w, true, DeviceAuthResponse{
-				DeviceCode:      "dc-test",
-				UserCode:        "TEST-CODE",
-				VerificationURI: "https://example.com/verify",
-				ExpiresIn:       60,
-				Interval:        1,
-				FlowID:          "test-flow-id",
-			}, "", "")
-
-		case strings.HasSuffix(r.URL.Path, DevicePollPath):
-			// New terminal API: return APPROVED status
-			json.NewEncoder(w).Encode(map[string]interface{}{
-				"success": true,
-				"data": map[string]string{
-					"status":   "APPROVED",
-					"authCode": "test-auth-code",
-				},
-			})
-
-		case strings.HasSuffix(r.URL.Path, MCPOAuthTokenPath):
-			json.NewEncoder(w).Encode(map[string]any{
-				"accessToken":  "test-access-token",
-				"refreshToken": "test-refresh-token",
-				"expiresIn":    7200,
-				"corpId":       "corp123",
-			})
-
-		case strings.HasSuffix(r.URL.Path, CLIAuthEnabledPath):
-			json.NewEncoder(w).Encode(CLIAuthStatus{
-				Success: true,
-				Result:  &CLIAuthResult{CLIAuthEnabled: true},
-			})
-
-		default:
-			http.Error(w, "not found", http.StatusNotFound)
-		}
-	}))
-	defer srv.Close()
-
-	configDir := setupMCPConfigDir(t, srv.URL)
-	provider := &DeviceFlowProvider{
-		configDir:       configDir,
-		clientID:        "test-client-id",
-		scope:           DefaultScopes,
-		baseURL:         srv.URL,
-		terminalBaseURL: srv.URL,
-		logger:          newDeviceFlowTestLogger(),
-		Output:          io.Discard,
-		httpClient:      srv.Client(),
-	}
-
-	token, err := provider.loginOnce(context.Background(), 1)
-
-	if err != nil {
-		t.Fatalf("expected loginOnce to succeed, got error: %v", err)
-	}
-	if token.AccessToken != "test-access-token" {
-		t.Fatalf("unexpected token: %s", token.AccessToken)
-	}
-	t.Logf("✅ Device Flow: CLI auth enabled → login succeeded, token=%s", token.AccessToken)
-}
-
-// ---------------------------------------------------------------------------
-// 6. FetchClientIDFromMCP: /cli/clientId error handling
-// ---------------------------------------------------------------------------
-
-func TestFetchClientIDFromMCP_ServerError_FailClosed(t *testing.T) {
-	var calls atomic.Int32
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		calls.Add(1)
-		http.Error(w, "Internal Server Error", http.StatusInternalServerError)
-	}))
-	defer srv.Close()
-
-	setupMCPConfigDir(t, srv.URL)
-
-	_, err := FetchClientIDFromMCP(context.Background())
-
-	if err == nil {
-		t.Fatal("expected error when /cli/clientId returns 500, got nil")
-	}
-	if !strings.Contains(err.Error(), "failed after 3 attempts") {
-		t.Fatalf("error should mention retry exhaustion, got: %s", err)
-	}
-	if c := calls.Load(); c != 3 {
-		t.Fatalf("expected 3 retry attempts, got %d", c)
-	}
-	t.Logf("✅ /cli/clientId 500 → fail-closed with retry: error=%q, attempts=%d", err, calls.Load())
-}
-
-func TestFetchClientIDFromMCP_ConnectionRefused_FailClosed(t *testing.T) {
-	setupMCPConfigDir(t, "http://127.0.0.1:1")
-
-	_, err := FetchClientIDFromMCP(context.Background())
-
-	if err == nil {
-		t.Fatal("expected error when connection is refused, got nil")
-	}
-	if !strings.Contains(err.Error(), "failed after 3 attempts") {
-		t.Fatalf("error should mention retry exhaustion, got: %s", err)
-	}
-	t.Logf("✅ /cli/clientId connection refused → fail-closed: error=%q", err)
-}
-
-func TestFetchClientIDFromMCP_MalformedJSON_FailClosed(t *testing.T) {
-	var calls atomic.Int32
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		calls.Add(1)
-		w.Header().Set("Content-Type", "application/json")
-		fmt.Fprint(w, `not json at all`)
-	}))
-	defer srv.Close()
-
-	setupMCPConfigDir(t, srv.URL)
-
-	_, err := FetchClientIDFromMCP(context.Background())
-
-	if err == nil {
-		t.Fatal("expected error for malformed JSON, got nil")
-	}
-	if c := calls.Load(); c != 3 {
-		t.Fatalf("expected 3 retry attempts, got %d", c)
-	}
-	t.Logf("✅ /cli/clientId malformed JSON → fail-closed: error=%q, attempts=%d", err, calls.Load())
-}
-
-func TestFetchClientIDFromMCP_BusinessError_FailClosed(t *testing.T) {
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set("Content-Type", "application/json")
-		json.NewEncoder(w).Encode(ClientIDResponse{
-			Success:   false,
-			ErrorCode: "forbidden",
-			ErrorMsg:  "access denied",
-		})
-	}))
-	defer srv.Close()
-
-	setupMCPConfigDir(t, srv.URL)
-
-	_, err := FetchClientIDFromMCP(context.Background())
-
-	if err == nil {
-		t.Fatal("expected error when server returns success=false, got nil")
-	}
-	if !strings.Contains(err.Error(), "access denied") {
-		t.Fatalf("error should contain server error message, got: %s", err)
-	}
-	t.Logf("✅ /cli/clientId business error → fail-closed: error=%q", err)
-}
-
-func TestFetchClientIDFromMCP_TransientThenSuccess(t *testing.T) {
-	var calls atomic.Int32
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		n := calls.Add(1)
-		if n <= 2 {
-			http.Error(w, "Service Unavailable", http.StatusServiceUnavailable)
-			return
-		}
-		w.Header().Set("Content-Type", "application/json")
-		json.NewEncoder(w).Encode(ClientIDResponse{
-			Success: true,
-			Result:  "recovered-client-id",
-		})
-	}))
-	defer srv.Close()
-
-	setupMCPConfigDir(t, srv.URL)
-
-	id, err := FetchClientIDFromMCP(context.Background())
-
-	if err != nil {
-		t.Fatalf("expected success after transient failures, got error: %v", err)
-	}
-	if id != "recovered-client-id" {
-		t.Fatalf("expected client ID 'recovered-client-id', got %q", id)
-	}
-	if c := calls.Load(); c != 3 {
-		t.Fatalf("expected 3 attempts (2 failures + 1 success), got %d", c)
-	}
-	t.Logf("✅ /cli/clientId transient then success: attempts=%d, id=%s", calls.Load(), id)
-}
-
-func TestFetchClientIDFromMCP_Success(t *testing.T) {
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if r.URL.Path != ClientIDPath {
-			http.Error(w, "not found", http.StatusNotFound)
-			return
-		}
-		w.Header().Set("Content-Type", "application/json")
-		json.NewEncoder(w).Encode(ClientIDResponse{
-			Success: true,
-			Result:  "my-client-id-123",
-		})
-	}))
-	defer srv.Close()
-
-	setupMCPConfigDir(t, srv.URL)
-
-	id, err := FetchClientIDFromMCP(context.Background())
-
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if id != "my-client-id-123" {
-		t.Fatalf("expected 'my-client-id-123', got %q", id)
-	}
-	t.Logf("✅ /cli/clientId normal success: id=%s", id)
-}
-
-// ---------------------------------------------------------------------------
-// 7. GetSuperAdmins: /cli/superAdmin error handling
-// ---------------------------------------------------------------------------
-
-func TestGetSuperAdmins_ServerError_RetriesAndFails(t *testing.T) {
-	var calls atomic.Int32
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		calls.Add(1)
-		http.Error(w, "Internal Server Error", http.StatusInternalServerError)
-	}))
-	defer srv.Close()
-
-	setupMCPConfigDir(t, srv.URL)
-
-	_, err := GetSuperAdmins(context.Background(), "fake-token")
-
-	if err == nil {
-		t.Fatal("expected error when /cli/superAdmin returns 500, got nil")
-	}
-	if !strings.Contains(err.Error(), "failed after 3 attempts") {
-		t.Fatalf("error should mention retry exhaustion, got: %s", err)
-	}
-	if c := calls.Load(); c != 3 {
-		t.Fatalf("expected 3 retry attempts, got %d", c)
-	}
-	t.Logf("✅ /cli/superAdmin 500 → retried 3 times: error=%q", err)
-}
-
-func TestGetSuperAdmins_TransientThenSuccess(t *testing.T) {
-	var calls atomic.Int32
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		n := calls.Add(1)
-		if n <= 2 {
-			http.Error(w, "Service Unavailable", http.StatusServiceUnavailable)
-			return
-		}
-		w.Header().Set("Content-Type", "application/json")
-		json.NewEncoder(w).Encode(SuperAdminResponse{
-			Success: true,
-			Result:  []SuperAdmin{{StaffID: "a1", Name: "张三"}, {StaffID: "a2", Name: "李四"}},
-		})
-	}))
-	defer srv.Close()
-
-	setupMCPConfigDir(t, srv.URL)
-
-	result, err := GetSuperAdmins(context.Background(), "fake-token")
-
-	if err != nil {
-		t.Fatalf("expected success after transient failures, got error: %v", err)
-	}
-	if !result.Success || len(result.Result) != 2 {
-		t.Fatalf("unexpected result: %+v", result)
-	}
-	if c := calls.Load(); c != 3 {
-		t.Fatalf("expected 3 attempts, got %d", c)
-	}
-	t.Logf("✅ /cli/superAdmin transient then success: attempts=%d, admins=%v", calls.Load(), result.Result)
-}
-
-func TestGetSuperAdmins_Success(t *testing.T) {
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if r.Header.Get("x-user-access-token") != "good-token" {
-			t.Errorf("missing access token header")
-		}
-		w.Header().Set("Content-Type", "application/json")
-		json.NewEncoder(w).Encode(SuperAdminResponse{
-			Success: true,
-			Result:  []SuperAdmin{{StaffID: "admin1", Name: "王五"}},
-		})
-	}))
-	defer srv.Close()
-
-	setupMCPConfigDir(t, srv.URL)
-
-	result, err := GetSuperAdmins(context.Background(), "good-token")
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if len(result.Result) != 1 || result.Result[0].Name != "王五" {
-		t.Fatalf("unexpected result: %+v", result)
-	}
-	t.Logf("✅ /cli/superAdmin normal success: admins=%v", result.Result)
-}
-
-// ---------------------------------------------------------------------------
-// 8. SendCliAuthApply: /cli/sendCliAuthApply error handling
-// ---------------------------------------------------------------------------
-
-func TestSendCliAuthApply_ServerError_RetriesAndFails(t *testing.T) {
-	var calls atomic.Int32
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		calls.Add(1)
-		http.Error(w, "Internal Server Error", http.StatusInternalServerError)
-	}))
-	defer srv.Close()
-
-	setupMCPConfigDir(t, srv.URL)
-
-	_, err := SendCliAuthApply(context.Background(), "fake-token", "admin1")
-
-	if err == nil {
-		t.Fatal("expected error when /cli/sendCliAuthApply returns 500, got nil")
-	}
-	if !strings.Contains(err.Error(), "failed after 3 attempts") {
-		t.Fatalf("error should mention retry exhaustion, got: %s", err)
-	}
-	if c := calls.Load(); c != 3 {
-		t.Fatalf("expected 3 retry attempts, got %d", c)
-	}
-	t.Logf("✅ /cli/sendCliAuthApply 500 → retried 3 times: error=%q", err)
-}
-
-func TestSendCliAuthApply_TransientThenSuccess(t *testing.T) {
-	var calls atomic.Int32
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		n := calls.Add(1)
-		if n <= 1 {
-			http.Error(w, "Service Unavailable", http.StatusServiceUnavailable)
-			return
-		}
-		w.Header().Set("Content-Type", "application/json")
-		json.NewEncoder(w).Encode(SendApplyResponse{Success: true, Result: true})
-	}))
-	defer srv.Close()
-
-	setupMCPConfigDir(t, srv.URL)
-
-	result, err := SendCliAuthApply(context.Background(), "fake-token", "admin1")
-
-	if err != nil {
-		t.Fatalf("expected success after transient failure, got error: %v", err)
-	}
-	if !result.Success || !result.Result {
-		t.Fatalf("unexpected result: %+v", result)
-	}
-	if c := calls.Load(); c != 2 {
-		t.Fatalf("expected 2 attempts, got %d", c)
-	}
-	t.Logf("✅ /cli/sendCliAuthApply transient then success: attempts=%d", calls.Load())
-}
-
-func TestSendCliAuthApply_Success(t *testing.T) {
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if r.Header.Get("x-user-access-token") != "good-token" {
-			t.Errorf("missing access token header")
-		}
-		if !strings.Contains(r.URL.RawQuery, "adminStaffId=admin123") {
-			t.Errorf("missing or wrong adminStaffId param: %s", r.URL.RawQuery)
-		}
-		w.Header().Set("Content-Type", "application/json")
-		json.NewEncoder(w).Encode(SendApplyResponse{Success: true, Result: true})
-	}))
-	defer srv.Close()
-
-	setupMCPConfigDir(t, srv.URL)
-
-	result, err := SendCliAuthApply(context.Background(), "good-token", "admin123")
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if !result.Success || !result.Result {
-		t.Fatalf("unexpected result: %+v", result)
-	}
-	t.Logf("✅ /cli/sendCliAuthApply normal success: result=%+v", result)
-}
-
-func TestSendCliAuthApply_BusinessError(t *testing.T) {
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set("Content-Type", "application/json")
-		json.NewEncoder(w).Encode(SendApplyResponse{
-			Success:   false,
-			ErrorCode: "invalid_admin",
-			ErrorMsg:  "admin not found",
-			Result:    false,
-		})
-	}))
-	defer srv.Close()
-
-	setupMCPConfigDir(t, srv.URL)
-
-	result, err := SendCliAuthApply(context.Background(), "fake-token", "nonexistent")
-	if err != nil {
-		t.Fatalf("unexpected transport error: %v", err)
-	}
-	if result.Success {
-		t.Fatal("expected success=false for business error")
-	}
-	t.Logf("✅ /cli/sendCliAuthApply business error: errorCode=%s, errorMsg=%s", result.ErrorCode, result.ErrorMsg)
-}
@@ -26,44 +26,39 @@ import (
 	"strings"
 	"time"

+	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/config"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/i18n"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/config"
 	"github.com/fatih/color"
 )

 const (
 	// defaultPollInterval is the default seconds between device token polls.
-	// The server-side Redis TTL is 10 minutes; a 2-second interval keeps the
-	// user-perceived latency low while staying well within rate limits.
-	defaultPollInterval = 2
+	defaultPollInterval = 5
 	// maxPollInterval caps the polling interval to prevent DoS via slow_down.
 	maxPollInterval = 30
 	// maxPollTotalWait caps the total wait time for device authorization.
-	// Aligned with the server-side Redis TTL (10 minutes).
-	maxPollTotalWait = 10 * time.Minute
+	maxPollTotalWait = 15 * time.Minute
 )

 type DeviceFlowProvider struct {
-	configDir       string
-	clientID        string
-	scope           string
-	baseURL         string
-	terminalBaseURL string
-	logger          *slog.Logger
-	Output          io.Writer
-	httpClient      *http.Client
+	configDir  string
+	clientID   string
+	scope      string
+	baseURL    string
+	logger     *slog.Logger
+	Output     io.Writer
+	httpClient *http.Client
 }

 func NewDeviceFlowProvider(configDir string, logger *slog.Logger) *DeviceFlowProvider {
 	return &DeviceFlowProvider{
-		configDir:       configDir,
-		clientID:        ClientID(),
-		scope:           DefaultScopes,
-		baseURL:         DefaultDeviceBaseURL,
-		terminalBaseURL: GetMCPBaseURL(),
-		logger:          logger,
-		Output:          os.Stderr,
-		httpClient:      &http.Client{Timeout: 30 * time.Second},
+		configDir:  configDir,
+		clientID:   ClientID(),
+		scope:      DefaultScopes,
+		baseURL:    DefaultDeviceBaseURL,
+		logger:     logger,
+		Output:     os.Stderr,
+		httpClient: &http.Client{Timeout: 30 * time.Second},
 	}
 }

@@ -71,18 +66,6 @@ func (p *DeviceFlowProvider) SetBaseURL(baseURL string) {
 	p.baseURL = strings.TrimRight(baseURL, "/")
 }

-// SetTerminalBaseURL sets the terminal API base URL for device flow polling.
-func (p *DeviceFlowProvider) SetTerminalBaseURL(baseURL string) {
-	p.terminalBaseURL = strings.TrimRight(baseURL, "/")
-}
-
-// SetScope overrides the OAuth scope for the device flow.
-func (p *DeviceFlowProvider) SetScope(scope string) {
-	if p != nil {
-		p.scope = scope
-	}
-}
-
 func (p *DeviceFlowProvider) output() io.Writer {
 	if p != nil && p.Output != nil {
 		return p.Output
@@ -97,7 +80,6 @@ type DeviceAuthResponse struct {
 	VerificationURIComplete string `json:"verificationUriComplete"`
 	ExpiresIn               int    `json:"expiresIn"`
 	Interval                int    `json:"interval"`
-	FlowID                  string `json:"flowId"`
 }

 type DeviceTokenResponse struct {
@@ -106,20 +88,6 @@ type DeviceTokenResponse struct {
 	Error       string `json:"error"`
 }

-// DevicePollResponse represents the response from the terminal API poll endpoint.
-type DevicePollResponse struct {
-	Success bool           `json:"success"`
-	Code    string         `json:"code,omitempty"`
-	Message string         `json:"message,omitempty"`
-	Data    DevicePollData `json:"data"`
-}
-
-type DevicePollData struct {
-	Status   string `json:"status"`
-	AuthCode string `json:"authCode,omitempty"`
-	FlowID   string `json:"flowId,omitempty"`
-}
-
 type serviceResult struct {
 	Success   bool            `json:"success"`
 	Result    json.RawMessage `json:"result"`
@@ -199,70 +167,41 @@ func (p *DeviceFlowProvider) loginOnce(ctx context.Context, attempt int) (*Token
 		return nil, fmt.Errorf("%s: %w", i18n.T("换取 token 失败"), err)
 	}

-	// Check if CLI auth is enabled for this organization (fail-closed: block on error)
+	// Check if CLI auth is enabled for this organization
 	dfPrintStep(p.output(), 4, i18n.T("检查组织 CLI 授权状态..."), 0)
 	authStatus, authErr := oauthProvider.CheckCLIAuthEnabled(ctx, tokenData.AccessToken)
 	if authErr != nil {
-		_, _ = fmt.Fprintln(p.output(), "")
-		_, _ = fmt.Fprintln(p.output(), dfRed(i18n.T("⚠️  无法检查 CLI 数据访问权限状态")))
-		_, _ = fmt.Fprintln(p.output(), i18n.T("   请检查网络连接后重试。"))
-		_, _ = fmt.Fprintln(p.output(), "")
-		return nil, fmt.Errorf("%s: %w", i18n.T("检查 CLI 授权状态失败"), authErr)
-	}
-	denialReason := classifyDenialReason(authStatus, os.Getenv("DWS_CHANNEL"))
-	if denialReason != "" {
-		_, _ = fmt.Fprintln(p.output(), "")
-		switch denialReason {
-		case "user_forbidden":
-			_, _ = fmt.Fprintln(p.output(), dfRed(i18n.T("⚠️  该组织已禁止所有成员使用 CLI")))
-			_, _ = fmt.Fprintln(p.output(), "")
-			return nil, errors.New(i18n.T("该组织已禁止所有成员使用 CLI"))
-		case "user_not_allowed":
-			_, _ = fmt.Fprintln(p.output(), dfRed(i18n.T("⚠️  您不在该组织的 CLI 授权人员范围内")))
-			_, _ = fmt.Fprintln(p.output(), i18n.T("   请联系组织管理员将您加入 CLI 授权人员名单。"))
-			_, _ = fmt.Fprintln(p.output(), "")
-			return nil, errors.New(i18n.T("您不在该组织的 CLI 授权人员范围内，请联系组织管理员"))
-		case "channel_not_allowed":
-			ch := os.Getenv("DWS_CHANNEL")
-			_, _ = fmt.Fprintf(p.output(), dfRed(i18n.T("⚠️  当前渠道 %s 未获得该组织授权"))+"\n", ch)
-			_, _ = fmt.Fprintln(p.output(), i18n.T("   请联系组织管理员开通该渠道的访问权限。"))
-			_, _ = fmt.Fprintln(p.output(), "")
-			return nil, fmt.Errorf(i18n.T("当前渠道 %s 未获得该组织授权，请联系组织管理员"), ch)
-		case "channel_required":
-			_, _ = fmt.Fprintln(p.output(), dfRed(i18n.T("⚠️  当前组织已开启渠道管控")))
-			_, _ = fmt.Fprintln(p.output(), i18n.T("   请升级到最新版本的 CLI 后重试。"))
-			_, _ = fmt.Fprintln(p.output(), "")
-			return nil, errors.New(i18n.T("当前组织已开启渠道管控，请升级到最新版本的 CLI 后重试"))
-		case "no_auth":
-			_, _ = fmt.Fprintln(p.output(), dfRed(i18n.T("⚠️  认证已失效")))
-			_, _ = fmt.Fprintln(p.output(), i18n.T("   请执行 dws auth 重新登录。"))
-			_, _ = fmt.Fprintln(p.output(), "")
-			return nil, errors.New(i18n.T("认证已失效，请执行 dws auth 重新登录"))
-		default:
-			// cli_not_enabled or unknown — show existing admin-apply flow
-			_, _ = fmt.Fprintln(p.output(), dfRed(i18n.T("⚠️  该组织尚未开启 CLI 数据访问权限")))
-			_, _ = fmt.Fprintln(p.output(), i18n.T("   你所选择的组织管理员尚未开启「允许成员通过 CLI 访问其个人数据」的权限。"))
-			_, _ = fmt.Fprintln(p.output(), "")
-
-			admins, adminErr := GetSuperAdmins(ctx, tokenData.AccessToken)
-			if adminErr == nil && admins.Success && len(admins.Result) > 0 {
-				maxAdmins := 3
-				if len(admins.Result) < maxAdmins {
-					maxAdmins = len(admins.Result)
-				}
-				var adminNames []string
-				for i := 0; i < maxAdmins; i++ {
-					adminNames = append(adminNames, admins.Result[i].Name)
-				}
-				_, _ = fmt.Fprintf(p.output(), "   %s%s\n", i18n.T("组织主管理员："), strings.Join(adminNames, "、"))
-			}
-
-			_, _ = fmt.Fprintln(p.output(), i18n.T("   请联系组织主管理员开启后重新登录。"))
-			_, _ = fmt.Fprintln(p.output(), "")
-			_, _ = fmt.Fprintf(p.output(), "   %s%s\n", i18n.T("管理员操作入口："), config.GetDeveloperSettingsURL())
-			_, _ = fmt.Fprintln(p.output(), "")
-			return nil, errors.New(i18n.T("该组织尚未开启 CLI 数据访问权限，请联系管理员开启"))
+		if p.logger != nil {
+			p.logger.Warn("failed to check CLI auth status", "error", authErr)
 		}
+		// Continue anyway - fail open for better UX
+	} else if authStatus.Success && !authStatus.Result.CLIAuthEnabled {
+		// CLI auth is disabled - show detailed error with admin info
+		_, _ = fmt.Fprintln(p.output(), "")
+		_, _ = fmt.Fprintln(p.output(), dfRed(i18n.T("⚠️  该组织尚未开启 CLI 数据访问权限")))
+		_, _ = fmt.Fprintln(p.output(), i18n.T("   你所选择的组织管理员尚未开启「允许成员通过 CLI 访问其个人数据」的权限。"))
+		_, _ = fmt.Fprintln(p.output(), "")
+
+		// Try to get super admin list
+		admins, adminErr := GetSuperAdmins(ctx, tokenData.AccessToken)
+		if adminErr == nil && admins.Success && len(admins.Result) > 0 {
+			// Show up to 3 admins
+			maxAdmins := 3
+			if len(admins.Result) < maxAdmins {
+				maxAdmins = len(admins.Result)
+			}
+			var adminNames []string
+			for i := 0; i < maxAdmins; i++ {
+				adminNames = append(adminNames, admins.Result[i].Name)
+			}
+			_, _ = fmt.Fprintf(p.output(), "   %s%s\n", i18n.T("组织主管理员："), strings.Join(adminNames, "、"))
+		}
+
+		_, _ = fmt.Fprintln(p.output(), i18n.T("   请联系组织主管理员开启后重新登录。"))
+		_, _ = fmt.Fprintln(p.output(), "")
+		_, _ = fmt.Fprintln(p.output(), i18n.T("   管理员操作入口：https://open-dev.dingtalk.com/fe/old#/developerSettings"))
+		_, _ = fmt.Fprintln(p.output(), "")
+		return nil, errors.New(i18n.T("该组织尚未开启 CLI 数据访问权限，请联系管理员开启"))
 	}

 	// Save token data with associated client ID for refresh
@@ -271,13 +210,6 @@ func (p *DeviceFlowProvider) loginOnce(ctx context.Context, attempt int) (*Token
 		return nil, fmt.Errorf("%s: %w", i18n.T("保存 token 失败"), err)
 	}

-	// Always persist clientId to app.json so future process startups
-	// can load it via ResolveAppCredentials and populate DWS_CLIENT_ID env.
-	if p.clientID != "" {
-		_ = os.Setenv("DWS_CLIENT_ID", p.clientID)
-		_ = SaveAppConfig(p.configDir, &AppConfig{ClientID: p.clientID})
-	}
-
 	// Persist app credentials if using custom client credentials
 	oauthProvider.persistAppConfigIfNeeded()

@@ -346,91 +278,7 @@ func (p *DeviceFlowProvider) pollDeviceToken(ctx context.Context, deviceCode str
 	return &resp, nil
 }

-// pollDeviceStatus polls the terminal API for device authorization status.
-//
-// Note: The server returns success=false for REJECTED and EXPIRED terminal
-// states (with a valid data.Status value).  These are normal business outcomes,
-// not transport errors, so we return the response to the caller and let the
-// status-switch handle them.
-func (p *DeviceFlowProvider) pollDeviceStatus(ctx context.Context, flowID string) (*DevicePollResponse, error) {
-	endpoint := fmt.Sprintf("%s%s?flowId=%s", p.terminalBaseURL, DevicePollPath, url.QueryEscape(flowID))
-	body, err := p.doGet(ctx, endpoint)
-	if err != nil {
-		return nil, err
-	}
-
-	var resp DevicePollResponse
-	if err := json.Unmarshal(body, &resp); err != nil {
-		return nil, fmt.Errorf("%s: %w", i18n.T("解析响应失败"), err)
-	}
-	// REJECTED/EXPIRED carry success=false but have a valid data.Status;
-	// only treat as a real server error when data.Status is empty.
-	if !resp.Success && resp.Data.Status == "" {
-		return nil, fmt.Errorf("%s: [%s] %s", i18n.T("服务端返回错误"), resp.Code, resp.Message)
-	}
-	return &resp, nil
-}
-
 func (p *DeviceFlowProvider) waitForAuthorization(ctx context.Context, auth *DeviceAuthResponse) (*DeviceTokenResponse, error) {
-	if auth.FlowID == "" {
-		// Keep the pre-flowId device-code polling path for regular device flow
-		// login responses that do not include terminal polling metadata.
-		return p.waitForAuthorizationByDeviceCode(ctx, auth)
-	}
-	return p.waitForAuthorizationByFlowID(ctx, auth)
-}
-
-func (p *DeviceFlowProvider) waitForAuthorizationByFlowID(ctx context.Context, auth *DeviceAuthResponse) (*DeviceTokenResponse, error) {
-	startTime := time.Now()
-	interval := time.Duration(auth.Interval) * time.Second
-	deadline := time.Duration(auth.ExpiresIn) * time.Second
-	pollCount := 0
-
-	for {
-		elapsed := time.Since(startTime)
-		if elapsed >= maxPollTotalWait || elapsed >= deadline {
-			_, _ = fmt.Fprintln(p.output(), "")
-			return nil, fmt.Errorf("%s", i18n.Tf("设备授权码已过期（%d 秒），请重试", auth.ExpiresIn))
-		}
-
-		select {
-		case <-ctx.Done():
-			return nil, ctx.Err()
-		case <-time.After(interval):
-		}
-
-		pollCount++
-		elapsedSec := int(time.Since(startTime).Seconds())
-		dfPrintPollStatus(p.output(), pollCount, elapsedSec)
-
-		pollResp, err := p.pollDeviceStatus(ctx, auth.FlowID)
-		if err != nil {
-			dfPrintPollResult(p.output(), "network_error", i18n.T("网络错误，继续重试..."))
-			if p.logger != nil {
-				p.logger.Debug("poll error", "error", err)
-			}
-			continue
-		}
-
-		switch pollResp.Data.Status {
-		case StatusApproved:
-			dfPrintPollResult(p.output(), "authorized", i18n.T("授权成功!"))
-			return &DeviceTokenResponse{AuthCode: pollResp.Data.AuthCode}, nil
-		case StatusPending:
-			dfPrintPollResult(p.output(), "pending", i18n.T("等待用户授权..."))
-		case StatusRejected:
-			_, _ = fmt.Fprintln(p.output(), "")
-			return nil, errors.New(i18n.T("用户拒绝了授权请求"))
-		case StatusExpired:
-			_, _ = fmt.Fprintln(p.output(), "")
-			return nil, errors.New(i18n.T("设备授权码已过期"))
-		default:
-			dfPrintPollResult(p.output(), "unknown", fmt.Sprintf(i18n.T("未知状态: %s"), pollResp.Data.Status))
-		}
-	}
-}
-
-func (p *DeviceFlowProvider) waitForAuthorizationByDeviceCode(ctx context.Context, auth *DeviceAuthResponse) (*DeviceTokenResponse, error) {
 	startTime := time.Now()
 	interval := time.Duration(auth.Interval) * time.Second
 	deadline := time.Duration(auth.ExpiresIn) * time.Second
@@ -510,29 +358,6 @@ func (p *DeviceFlowProvider) postForm(ctx context.Context, endpoint string, para
 	return body, nil
 }

-// doGet performs an HTTP GET request and returns the response body.
-func (p *DeviceFlowProvider) doGet(ctx context.Context, endpoint string) ([]byte, error) {
-	req, err := http.NewRequestWithContext(ctx, http.MethodGet, endpoint, nil)
-	if err != nil {
-		return nil, fmt.Errorf("%s: %w", i18n.T("创建请求失败"), err)
-	}
-
-	resp, err := p.httpClient.Do(req)
-	if err != nil {
-		return nil, fmt.Errorf("%s: %w", i18n.T("发送请求失败"), err)
-	}
-	defer resp.Body.Close()
-
-	body, err := io.ReadAll(io.LimitReader(resp.Body, config.MaxResponseBodySize))
-	if err != nil {
-		return nil, fmt.Errorf("%s: %w", i18n.T("读取响应失败"), err)
-	}
-	if resp.StatusCode != http.StatusOK {
-		return nil, fmt.Errorf("HTTP %d: %s", resp.StatusCode, truncateBody(body, 200))
-	}
-	return body, nil
-}
-
 // truncateBody returns a string of at most maxLen bytes from body, appending
 // "...(truncated)" when the content exceeds the limit. This prevents leaking
 // potentially sensitive response payloads in error messages.
@@ -1,41 +0,0 @@
-// Copyright 2026 Alibaba Group
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package auth
-
-// Device flow authorization status constants.
-// Shared across device_flow.go and pat_auth_retry.go to avoid maintaining
-// string literals in multiple places.
-const (
-	StatusPending   = "PENDING"
-	StatusApproved  = "APPROVED"
-	StatusRejected  = "REJECTED"
-	StatusExpired   = "EXPIRED"
-	StatusCancelled = "CANCELLED"
-)
-
-// ParseDeviceFlowStatus normalizes a raw status string from the device flow
-// poll response into a canonical status constant.  When the server returns an
-// empty status with success=false, it falls back to StatusExpired (server
-// error / flow not found).
-func ParseDeviceFlowStatus(rawStatus string, success bool) string {
-	switch rawStatus {
-	case StatusApproved, StatusRejected, StatusExpired, StatusPending, StatusCancelled:
-		return rawStatus
-	default:
-		if rawStatus == "" && !success {
-			return StatusExpired
-		}
-		return rawStatus
-	}
-}
@@ -14,21 +14,15 @@
 package auth

 import (
-	"bytes"
 	"context"
 	"encoding/json"
-	"errors"
-	"fmt"
 	"io"
 	"log/slog"
 	"net/http"
 	"net/http/httptest"
-	"strings"
 	"sync/atomic"
 	"testing"
 	"time"
-
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/i18n"
 )

 func newDeviceFlowTestLogger() *slog.Logger {
@@ -95,42 +89,22 @@ func TestWaitForAuthorizationSucceedsAfterPending(t *testing.T) {

 	var calls atomic.Int32
 	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		// New terminal API uses GET method
-		if r.Method != http.MethodGet {
-			t.Fatalf("method = %s, want GET", r.Method)
-		}
-		if !strings.Contains(r.URL.RawQuery, "flowId=") {
-			t.Fatal("flowId query parameter should be present")
-		}
 		if calls.Add(1) <= 2 {
-			// Return PENDING status
-			w.Header().Set("Content-Type", "application/json")
-			json.NewEncoder(w).Encode(map[string]interface{}{
-				"success": true,
-				"data":    map[string]string{"status": "PENDING"},
-			})
+			writeServiceResult(w, true, DeviceTokenResponse{Error: "authorization_pending"}, "", "")
 			return
 		}
-		// Return APPROVED status with authCode
-		w.Header().Set("Content-Type", "application/json")
-		json.NewEncoder(w).Encode(map[string]interface{}{
-			"success": true,
-			"data": map[string]string{
-				"status":   "APPROVED",
-				"authCode": "final-auth-code",
-			},
-		})
+		writeServiceResult(w, true, DeviceTokenResponse{AuthCode: "final-auth-code"}, "", "")
 	}))
 	defer server.Close()

 	provider := NewDeviceFlowProvider(t.TempDir(), newDeviceFlowTestLogger())
 	provider.Output = io.Discard
-	provider.SetTerminalBaseURL(server.URL)
+	provider.SetBaseURL(server.URL)

 	resp, err := provider.waitForAuthorization(context.Background(), &DeviceAuthResponse{
-		FlowID:    "test-flow-id",
-		ExpiresIn: 10,
-		Interval:  1,
+		DeviceCode: "dc-1",
+		ExpiresIn:  10,
+		Interval:   1,
 	})
 	if err != nil {
 		t.Fatalf("waitForAuthorization() error = %v", err)
@@ -143,87 +117,9 @@ func TestWaitForAuthorizationSucceedsAfterPending(t *testing.T) {
 	}
 }

-func TestWaitForAuthorizationFallsBackToDeviceCodeWhenFlowIDMissing(t *testing.T) {
-	t.Parallel()
-
-	var calls atomic.Int32
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if r.Method != http.MethodPost {
-			t.Fatalf("method = %s, want POST", r.Method)
-		}
-		if err := r.ParseForm(); err != nil {
-			t.Fatalf("ParseForm() error = %v", err)
-		}
-		if got := r.FormValue("device_code"); got != "legacy-device-code" {
-			t.Fatalf("device_code = %q, want legacy-device-code", got)
-		}
-		if calls.Add(1) <= 2 {
-			writeServiceResult(w, true, DeviceTokenResponse{Error: "authorization_pending"}, "", "")
-			return
-		}
-		writeServiceResult(w, true, DeviceTokenResponse{AuthCode: "legacy-auth-code"}, "", "")
-	}))
-	defer server.Close()
-
-	provider := NewDeviceFlowProvider(t.TempDir(), newDeviceFlowTestLogger())
-	var output bytes.Buffer
-	provider.Output = &output
-	provider.SetBaseURL(server.URL)
-
-	resp, err := provider.waitForAuthorization(context.Background(), &DeviceAuthResponse{
-		DeviceCode: "legacy-device-code",
-		ExpiresIn:  10,
-		Interval:   1,
-	})
-	if err != nil {
-		t.Fatalf("waitForAuthorization() error = %v", err)
-	}
-	if resp.AuthCode != "legacy-auth-code" {
-		t.Fatalf("auth code = %q, want legacy-auth-code", resp.AuthCode)
-	}
-	if calls.Load() != 3 {
-		t.Fatalf("poll calls = %d, want 3", calls.Load())
-	}
-	if !strings.Contains(output.String(), i18n.T("等待用户授权...")) {
-		t.Fatalf("expected device-code path to emit pending output, got %q", output.String())
-	}
-	if !strings.Contains(output.String(), i18n.T("授权成功!")) {
-		t.Fatalf("expected device-code path to emit success output, got %q", output.String())
-	}
-}
-
 func TestWaitForAuthorizationHonorsContextCancellation(t *testing.T) {
 	t.Parallel()

-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		// New terminal API uses GET method
-		w.Header().Set("Content-Type", "application/json")
-		json.NewEncoder(w).Encode(map[string]interface{}{
-			"success": true,
-			"data":    map[string]string{"status": "PENDING"},
-		})
-	}))
-	defer server.Close()
-
-	provider := NewDeviceFlowProvider(t.TempDir(), newDeviceFlowTestLogger())
-	provider.Output = io.Discard
-	provider.SetTerminalBaseURL(server.URL)
-
-	ctx, cancel := context.WithTimeout(context.Background(), 1500*time.Millisecond)
-	defer cancel()
-
-	if _, err := provider.waitForAuthorization(ctx, &DeviceAuthResponse{
-		FlowID:    "test-flow-id-2",
-		ExpiresIn: 60,
-		Interval:  1,
-	}); err == nil {
-		t.Fatal("waitForAuthorization() error = nil, want context cancellation")
-	}
-}
-
-func TestWaitForAuthorizationByDeviceCodeHonorsContextCancellation(t *testing.T) {
-	t.Parallel()
-
 	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		writeServiceResult(w, true, DeviceTokenResponse{Error: "authorization_pending"}, "", "")
 	}))
@@ -236,89 +132,11 @@ func TestWaitForAuthorizationByDeviceCodeHonorsContextCancellation(t *testing.T)
 	ctx, cancel := context.WithTimeout(context.Background(), 1500*time.Millisecond)
 	defer cancel()

-	_, err := provider.waitForAuthorization(ctx, &DeviceAuthResponse{
-		DeviceCode: "legacy-device-code",
+	if _, err := provider.waitForAuthorization(ctx, &DeviceAuthResponse{
+		DeviceCode: "dc-2",
 		ExpiresIn:  60,
 		Interval:   1,
-	})
-	if !errors.Is(err, context.DeadlineExceeded) {
-		t.Fatalf("waitForAuthorization() error = %v, want context deadline exceeded", err)
-	}
-}
-
-func TestWaitForAuthorizationByDeviceCodeErrorStates(t *testing.T) {
-	t.Parallel()
-
-	tests := []struct {
-		name       string
-		timeout    time.Duration
-		responses  []DeviceTokenResponse
-		wantErr    string
-		wantErrIs  error
-		wantOutput string
-	}{
-		{
-			name:       "slow_down_then_context_cancelled",
-			timeout:    1500 * time.Millisecond,
-			responses:  []DeviceTokenResponse{{Error: "slow_down"}},
-			wantErrIs:  context.DeadlineExceeded,
-			wantOutput: fmt.Sprintf(i18n.T("轮询过快，间隔增加至 %ds"), 6),
-		},
-		{
-			name:       "access_denied",
-			timeout:    5 * time.Second,
-			responses:  []DeviceTokenResponse{{Error: "access_denied"}},
-			wantErr:    i18n.T("用户拒绝了授权请求"),
-			wantOutput: fmt.Sprintf(i18n.T("[%d] 轮询中... (%ds)"), 1, 1),
-		},
-		{
-			name:       "expired_token",
-			timeout:    5 * time.Second,
-			responses:  []DeviceTokenResponse{{Error: "expired_token"}},
-			wantErr:    i18n.T("设备授权码已过期"),
-			wantOutput: fmt.Sprintf(i18n.T("[%d] 轮询中... (%ds)"), 1, 1),
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			t.Parallel()
-
-			var calls atomic.Int32
-			server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-				idx := int(calls.Add(1)) - 1
-				if idx >= len(tt.responses) {
-					idx = len(tt.responses) - 1
-				}
-				writeServiceResult(w, true, tt.responses[idx], "", "")
-			}))
-			defer server.Close()
-
-			provider := NewDeviceFlowProvider(t.TempDir(), newDeviceFlowTestLogger())
-			var output bytes.Buffer
-			provider.Output = &output
-			provider.SetBaseURL(server.URL)
-
-			ctx, cancel := context.WithTimeout(context.Background(), tt.timeout)
-			defer cancel()
-
-			_, err := provider.waitForAuthorization(ctx, &DeviceAuthResponse{
-				DeviceCode: "legacy-device-code",
-				ExpiresIn:  60,
-				Interval:   1,
-			})
-
-			if tt.wantErrIs != nil {
-				if !errors.Is(err, tt.wantErrIs) {
-					t.Fatalf("waitForAuthorization() error = %v, want %v", err, tt.wantErrIs)
-				}
-			} else if err == nil || err.Error() != tt.wantErr {
-				t.Fatalf("waitForAuthorization() error = %v, want %q", err, tt.wantErr)
-			}
-
-			if !strings.Contains(output.String(), tt.wantOutput) {
-				t.Fatalf("expected output to contain %q, got %q", tt.wantOutput, output.String())
-			}
-		})
+	}); err == nil {
+		t.Fatal("waitForAuthorization() error = nil, want context cancellation")
 	}
 }
@@ -18,34 +18,8 @@ import (
 	"path/filepath"
 	"strings"
 	"sync"
-
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/config"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/configmeta"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/edition"
 )

-func init() {
-	configmeta.Register(configmeta.ConfigItem{
-		Name:         "DWS_CLIENT_ID",
-		Category:     configmeta.CategoryAuth,
-		Description:  "OAuth AppKey (DingTalk 应用凭证)",
-		DefaultValue: "(内置)",
-		Sensitive:    true,
-	})
-	configmeta.Register(configmeta.ConfigItem{
-		Name:         "DWS_CLIENT_SECRET",
-		Category:     configmeta.CategoryAuth,
-		Description:  "OAuth AppSecret (DingTalk 应用凭证)",
-		DefaultValue: "(内置)",
-		Sensitive:    true,
-	})
-	configmeta.Register(configmeta.ConfigItem{
-		Name:        "DWS_CHANNEL",
-		Category:    configmeta.CategoryExternal,
-		Description: "第三方渠道编码 (channelCode)，如 Qoderwork",
-	})
-}
-
 const (
 	// AuthorizeURL is the DingTalk OAuth authorization page.
 	AuthorizeURL = "https://login.dingtalk.com/oauth2/auth"
@@ -84,14 +58,6 @@ const (
 	// DeviceGrantType is the grant_type value defined by RFC 8628.
 	DeviceGrantType = "urn:ietf:params:oauth:grant-type:device_code"

-	// Terminal API base URL for developer settings page.
-	DefaultTerminalBaseURL = "https://open-dev.dingtalk.com"
-	// DevicePollPath is the device flow polling path (used with MCP base URL).
-	DevicePollPath = "/cli/oauth/device/poll"
-
-	// DeveloperSettingsPath is the path to the organization developer settings page.
-	DeveloperSettingsPath = "/fe/old#/developerSettings"
-
 	LogoutURL         = "https://login.dingtalk.com/oauth2/logout"
 	LogoutContinueURL = "https://login.dingtalk.com"

@@ -108,19 +74,6 @@ const (
 	MCPRevokeTokenPath  = "/oauth2/revokeToken"
 )

-// GetTerminalBaseURL returns the terminal base URL with priority:
-// 1. ~/.dws/terminal_url file content (for pre-release environment)
-// 2. Default value (https://open-dev.dingtalk.com)
-func GetTerminalBaseURL() string {
-	return config.GetTerminalBaseURL()
-}
-
-// GetDeveloperSettingsURL returns the full URL to the organization developer
-// settings page, derived from the terminal base URL.
-func GetDeveloperSettingsURL() string {
-	return config.GetDeveloperSettingsURL()
-}
-
 // GetMCPBaseURL returns the MCP base URL with priority:
 // 1. ~/.dws/mcp_url file content (for pre-release environment)
 // 2. Default value (https://mcp.dingtalk.com)
@@ -157,7 +110,7 @@ func SetClientIDFromMCP(id string) {
 func IsClientIDFromMCP() bool {
 	clientMu.RLock()
 	defer clientMu.RUnlock()
-	return clientIDFromMCP || edition.Get().AuthClientFromMCP
+	return clientIDFromMCP
 }

 // GetUserAccessTokenURL returns the appropriate token exchange URL.
@@ -187,27 +140,6 @@ func GetRevokeTokenURL() string {
 	return "" // Direct mode doesn't have revoke endpoint
 }

-// resolveCredentialSource determines the source of the current credentials.
-// Returns one of: "flag", "env", "app", "default".
-// This is used to track where credentials came from for token refresh.
-func resolveCredentialSource() string {
-	clientMu.RLock()
-	hasRuntimeOverride := runtimeClientID != "" || runtimeClientSecret != ""
-	clientMu.RUnlock()
-
-	if hasRuntimeOverride {
-		return "flag"
-	}
-	// Check if loaded from app config
-	if id, _ := ResolveAppCredentials(getDefaultConfigDir()); id != "" {
-		return "app"
-	}
-	if os.Getenv("DWS_CLIENT_ID") != "" || os.Getenv("DWS_CLIENT_SECRET") != "" {
-		return "env"
-	}
-	return "default"
-}
-
 // SetClientID allows runtime override of the client ID (e.g., from CLI flags).
 func SetClientID(id string) {
 	clientMu.Lock()
@@ -236,9 +168,6 @@ func ClientID() string {
 	if override != "" {
 		return override
 	}
-	if id := edition.Get().AuthClientID; id != "" {
-		return id
-	}
 	// Try loading from persisted app config
 	if id, _ := ResolveAppCredentials(getDefaultConfigDir()); id != "" {
 		return id
@@ -21,7 +21,7 @@ import (
 	"sync"
 	"time"

-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/config"
+	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/config"
 )

 const (
@@ -25,8 +25,7 @@ import (
 	"os"
 	"path/filepath"

-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/config"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/edition"
+	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/config"
 )

 const identityFile = "identity.json"
@@ -83,11 +82,8 @@ func (id *Identity) Headers() map[string]string {
 	if id.Source != "" {
 		h["x-dws-source"] = id.Source
 	}
-	scenarioCode := "com.dingtalk.cli"
-	if sc := edition.Get().ScenarioCode; sc != "" {
-		scenarioCode = sc
-	}
-	h["x-dingtalk-scenario-code"] = scenarioCode
+	// Constant headers for MCP gateway tracking
+	h["x-dingtalk-scenario-code"] = "com.dingtalk.cli"
 	h["x-dingtalk-source"] = "github"
 	return h
 }
@@ -105,45 +105,3 @@ func EnsureMigration(configDir string, logger *slog.Logger) {
 func IsMigrationDone() bool {
 	return migrationDone
 }
-
-// Client credential storage functions.
-// These store the clientSecret associated with a specific clientId,
-// allowing token refresh to work even if environment variables change.
-
-const clientSecretPrefix = "client-secret:"
-
-// SaveClientSecret stores the client secret for a specific client ID.
-// This is called during login to snapshot the credentials used.
-func SaveClientSecret(clientID, clientSecret string) error {
-	if clientID == "" || clientSecret == "" {
-		return nil // Nothing to save
-	}
-	account := clientSecretPrefix + clientID
-	if err := keychain.Set(keychain.Service, account, clientSecret); err != nil {
-		return fmt.Errorf("save client secret: %w", err)
-	}
-	return nil
-}
-
-// LoadClientSecret retrieves the stored client secret for a specific client ID.
-// Returns empty string if not found.
-func LoadClientSecret(clientID string) string {
-	if clientID == "" {
-		return ""
-	}
-	account := clientSecretPrefix + clientID
-	secret, err := keychain.Get(keychain.Service, account)
-	if err != nil {
-		return ""
-	}
-	return secret
-}
-
-// DeleteClientSecret removes the stored client secret for a specific client ID.
-func DeleteClientSecret(clientID string) error {
-	if clientID == "" {
-		return nil
-	}
-	account := clientSecretPrefix + clientID
-	return keychain.Remove(keychain.Service, account)
-}
@@ -15,8 +15,8 @@ package auth

 import (
 	"fmt"
+	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/config"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/i18n"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/config"
 	"log/slog"
 	"os"
 	"path/filepath"
@@ -124,7 +124,6 @@ func (p *OAuthProvider) Login(ctx context.Context, force bool) (*TokenData, erro
 		token           *TokenData
 		err             error
 		cliAuthDisabled bool
-		denialReason    string
 	}
 	resultCh := make(chan callbackResult, 1)
 	errCh := make(chan error, 1)
@@ -132,11 +131,10 @@ func (p *OAuthProvider) Login(ctx context.Context, force bool) (*TokenData, erro
 	// Shared state for API handlers (protected by mutex)
 	var (
 		callbackToken           *TokenData
-		callbackProcessedCode   string // The auth code that has been successfully processed
+		callbackProcessed       bool
 		callbackAuthDisabled    bool
 		callbackApplySent       bool   // Whether apply request was sent
 		callbackSelectedAdminId string // Selected admin ID for apply
-		callbackCodeInProgress  string // Code currently being processed (to prevent concurrent exchange)
 		callbackTokenMu         sync.Mutex
 	)

@@ -148,48 +146,23 @@ func (p *OAuthProvider) Login(ctx context.Context, force bool) (*TokenData, erro
 			code = r.URL.Query().Get("code")
 		}

-		// Check state and handle page refresh or concurrent requests
+		// Check if this is a page refresh (no code) and callback was already processed
 		callbackTokenMu.Lock()
-		processedCode := callbackProcessedCode
-		processedAuthDisabled := callbackAuthDisabled
-		codeInProgress := callbackCodeInProgress
-		hasToken := callbackToken != nil
-
-		// Case 1: This code was already successfully processed - show cached page
-		if code != "" && code == processedCode {
-			callbackTokenMu.Unlock()
+		if code == "" && callbackProcessed {
 			w.Header().Set("Content-Type", "text/html; charset=utf-8")
-			if processedAuthDisabled {
+			if callbackAuthDisabled {
 				_, _ = fmt.Fprint(w, notEnabledHTML)
 			} else {
 				_, _ = fmt.Fprint(w, successHTML)
 			}
-			return
-		}
-
-		// Case 2: This code is being processed by another request - show wait page
-		if code != "" && code == codeInProgress {
 			callbackTokenMu.Unlock()
-			w.Header().Set("Content-Type", "text/html; charset=utf-8")
-			_, _ = fmt.Fprint(w, `<html><head><meta http-equiv="refresh" content="1"></head><body><p>正在处理授权，请稍候...</p></body></html>`)
 			return
 		}
-
-		// Case 3: No code but we have a processed token - show cached page
-		if code == "" && hasToken {
-			callbackTokenMu.Unlock()
-			w.Header().Set("Content-Type", "text/html; charset=utf-8")
-			if processedAuthDisabled {
-				_, _ = fmt.Fprint(w, notEnabledHTML)
-			} else {
-				_, _ = fmt.Fprint(w, successHTML)
-			}
-			return
-		}
-
-		// Case 4: New code - mark as in-progress and process
-		if code != "" {
-			callbackCodeInProgress = code
+		// Reset state for new authorization (user switched org)
+		if code != "" && callbackProcessed {
+			callbackProcessed = false
+			callbackApplySent = false
+			callbackSelectedAdminId = ""
 		}
 		callbackTokenMu.Unlock()

@@ -203,13 +176,20 @@ func (p *OAuthProvider) Login(ctx context.Context, force bool) (*TokenData, erro
 			return
 		}

-		// Exchange code for token
+		// Exchange code for token immediately in callback
 		tokenData, exchangeErr := p.exchangeCode(ctx, code)
 		if exchangeErr != nil {
-			// Clear in-progress state on error
+			// Check if we already have a processed state (authCode reused on refresh)
 			callbackTokenMu.Lock()
-			if callbackCodeInProgress == code {
-				callbackCodeInProgress = ""
+			if callbackProcessed {
+				w.Header().Set("Content-Type", "text/html; charset=utf-8")
+				if callbackAuthDisabled {
+					_, _ = fmt.Fprint(w, notEnabledHTML)
+				} else {
+					_, _ = fmt.Fprint(w, successHTML)
+				}
+				callbackTokenMu.Unlock()
+				return
 			}
 			callbackTokenMu.Unlock()

@@ -222,45 +202,23 @@ func (p *OAuthProvider) Login(ctx context.Context, force bool) (*TokenData, erro
 			return
 		}

-		// Mark as processed immediately after successful exchange
-		callbackTokenMu.Lock()
-		previouslyProcessed := callbackProcessedCode != ""
-		callbackToken = tokenData
-		callbackProcessedCode = code // Remember this code was successfully processed
-		callbackCodeInProgress = ""  // Clear in-progress state
-		// Reset apply state for new authorization (user switched org)
-		if previouslyProcessed {
-			callbackApplySent = false
-			callbackSelectedAdminId = ""
-		}
-		callbackTokenMu.Unlock()
-
-		// Check CLI auth enabled status (fail-closed: treat errors as disabled)
+		// Check CLI auth enabled status
 		authStatus, statusErr := p.CheckCLIAuthEnabled(ctx, tokenData.AccessToken)
-		var denialReason string
-		if statusErr != nil {
-			denialReason = "unknown"
-		} else {
-			denialReason = classifyDenialReason(authStatus, os.Getenv("DWS_CHANNEL"))
-		}
-		cliAuthEnabled := denialReason == ""
+		cliAuthDisabled := statusErr == nil && authStatus.Success && !authStatus.Result.CLIAuthEnabled

-		// Update CLI auth disabled state
+		// Store token and state for API handlers and refresh handling
 		callbackTokenMu.Lock()
-		callbackAuthDisabled = !cliAuthEnabled
+		callbackToken = tokenData
+		callbackProcessed = true
+		callbackAuthDisabled = cliAuthDisabled
 		callbackTokenMu.Unlock()

-		// Display appropriate HTML based on auth status and denial reason
+		// Display appropriate HTML based on CLI auth status
 		w.Header().Set("Content-Type", "text/html; charset=utf-8")
-		switch {
-		case cliAuthEnabled:
-			_, _ = fmt.Fprint(w, successHTML)
-		case denialReason == "user_forbidden" || denialReason == "user_not_allowed":
-			_, _ = fmt.Fprint(w, accessDeniedHTML)
-		case denialReason == "channel_not_allowed" || denialReason == "channel_required":
-			_, _ = fmt.Fprint(w, channelDeniedHTML)
-		default:
+		if cliAuthDisabled {
 			_, _ = fmt.Fprint(w, notEnabledHTML)
+		} else {
+			_, _ = fmt.Fprint(w, successHTML)
 		}
 		// Ensure response is flushed to client
 		if f, ok := w.(http.Flusher); ok {
@@ -268,7 +226,7 @@ func (p *OAuthProvider) Login(ctx context.Context, force bool) (*TokenData, erro
 		}
 		// Notify main goroutine with full result
 		select {
-		case resultCh <- callbackResult{token: tokenData, cliAuthDisabled: !cliAuthEnabled, denialReason: denialReason}:
+		case resultCh <- callbackResult{token: tokenData, cliAuthDisabled: cliAuthDisabled}:
 		default:
 		}
 	})
@@ -407,18 +365,8 @@ func (p *OAuthProvider) Login(ctx context.Context, force bool) (*TokenData, erro
 		return nil, fmt.Errorf("%s: %w", i18n.T("换取 token 失败"), result.err)
 	}

-	// Handle CLI auth disabled - for terminal denial reasons, exit immediately
-	// (page shows accessDeniedHTML/channelDeniedHTML with no apply button,
-	// so polling for apply submission would hang forever).
-	// Error messages are kept consistent with the text shown on the HTML pages.
+	// Handle CLI auth disabled - keep server running for user to apply
 	if result.cliAuthDisabled {
-		switch result.denialReason {
-		case "user_forbidden", "user_not_allowed":
-			return nil, errors.New(i18n.T("您不在该组织的 CLI 授权人员范围内，请联系组织管理员将您加入授权名单"))
-		case "channel_not_allowed", "channel_required":
-			return nil, errors.New(i18n.T("当前渠道未获得该组织授权，或组织已开启渠道管控，请联系组织管理员开通渠道访问权限，或升级到最新版本的 CLI"))
-		}
-
 		_, _ = fmt.Fprintln(p.output(), "")
 		_, _ = fmt.Fprintln(p.output(), i18n.T("⏳ 该组织尚未开启 CLI 数据访问权限，请在浏览器中提交授权申请..."))

@@ -457,7 +405,7 @@ func (p *OAuthProvider) Login(ctx context.Context, force bool) (*TokenData, erro
 				// Check if CLI auth is now enabled (admin approved)
 				if currentToken != nil {
 					authStatus, err := p.CheckCLIAuthEnabled(ctx, currentToken.AccessToken)
-					if err == nil && classifyDenialReason(authStatus, os.Getenv("DWS_CHANNEL")) == "" {
+					if err == nil && authStatus.Success && authStatus.Result.CLIAuthEnabled {
 						_, _ = fmt.Fprintf(p.output(), "\r%s\n", i18n.T("✅ 权限已开启，继续登录..."))
 						time.Sleep(2 * time.Second)
 						result.token = currentToken
@@ -485,13 +433,6 @@ continueLogin:
 		return nil, fmt.Errorf("%s: %w", i18n.T("保存 token 失败"), err)
 	}

-	// Always persist clientId to app.json so future process startups
-	// can load it via ResolveAppCredentials and populate DWS_CLIENT_ID env.
-	if p.clientID != "" {
-		_ = os.Setenv("DWS_CLIENT_ID", p.clientID)
-		_ = SaveAppConfig(p.configDir, &AppConfig{ClientID: p.clientID})
-	}
-
 	// Persist app credentials if using custom client credentials
 	p.persistAppConfigIfNeeded()

@@ -21,8 +21,8 @@ import (
 	"path/filepath"
 	"sync"

+	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/config"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/security"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/config"
 )

 const secureDataFile = ".data"
@@ -20,11 +20,7 @@ import (
 	"fmt"
 	"net/http"
 	"net/url"
-	"os"
-	"path/filepath"
 	"time"
-
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/edition"
 )

 // TokenData holds the OAuth token set persisted to disk.
@@ -65,88 +61,44 @@ func (t *TokenData) HasPersistentCode() bool {
 	return t != nil && t.PersistentCode != ""
 }

-const tokenJSONFile = "token.json"
-
-// TokenMarker is a lightweight file the host application reads to detect
-// whether the CLI has a valid token without accessing the keychain.
-type TokenMarker struct {
-	UpdatedAt string `json:"updated_at"`
-}
-
-// WriteTokenMarker writes a token.json marker containing only an updated_at
-// timestamp. The host application uses this file's presence and mtime to
-// decide whether it needs to trigger a new auth exchange.
-func WriteTokenMarker(configDir string) error {
-	marker := TokenMarker{UpdatedAt: time.Now().Format(time.RFC3339)}
-	data, _ := json.MarshalIndent(marker, "", "  ")
-	if err := os.MkdirAll(configDir, 0o700); err != nil {
-		return err
-	}
-	tmp := filepath.Join(configDir, tokenJSONFile+".tmp")
-	if err := os.WriteFile(tmp, data, 0o600); err != nil {
-		return err
-	}
-	return os.Rename(tmp, filepath.Join(configDir, tokenJSONFile))
-}
-
-// DeleteTokenMarker removes the token.json marker file.
-func DeleteTokenMarker(configDir string) error {
-	return os.Remove(filepath.Join(configDir, tokenJSONFile))
-}
-
-// SaveTokenData persists TokenData. When an edition hook (SaveToken) is
-// registered, it delegates entirely to the hook; otherwise it falls back
-// to the default keychain-based storage.
+// SaveTokenData saves TokenData to the platform keychain.
+// Uses the new keychain-based storage with random master key for better security.
 func SaveTokenData(configDir string, data *TokenData) error {
-	if h := edition.Get(); h.SaveToken != nil {
-		jsonData, err := json.MarshalIndent(data, "", "  ")
-		if err != nil {
-			return fmt.Errorf("marshaling token data for hook: %w", err)
-		}
-		return h.SaveToken(configDir, jsonData)
-	}
 	return SaveTokenDataKeychain(data)
 }

-// LoadTokenData reads TokenData. When an edition hook (LoadToken) is
-// registered, it delegates entirely to the hook; otherwise it falls back
-// to keychain with legacy .data migration.
+// LoadTokenData reads TokenData from the platform keychain.
+// On first call, it attempts to migrate legacy .data file if present.
 func LoadTokenData(configDir string) (*TokenData, error) {
-	if h := edition.Get(); h.LoadToken != nil {
-		jsonData, err := h.LoadToken(configDir)
-		if err != nil {
-			return nil, err
-		}
-		var td TokenData
-		if err := json.Unmarshal(jsonData, &td); err != nil {
-			return nil, fmt.Errorf("parsing token data from hook: %w", err)
-		}
-		return &td, nil
-	}
-
-	// Default: keychain with legacy .data migration
+	// Try loading from new keychain first
 	if TokenDataExistsKeychain() {
 		return LoadTokenDataKeychain()
 	}
+
+	// Fallback: try legacy .data file and migrate
 	data, err := LoadSecureTokenData(configDir)
 	if err != nil {
 		return nil, err
 	}
+
+	// Migrate to keychain for future use
 	if err := SaveTokenDataKeychain(data); err == nil {
+		// Successfully migrated, delete legacy file
 		_ = DeleteSecureData(configDir)
 	}
+
 	return data, nil
 }

-// DeleteTokenData removes token data. When an edition hook (DeleteToken) is
-// registered, it delegates entirely to the hook; otherwise it falls back
-// to keychain + legacy cleanup.
+// DeleteTokenData removes token data from both keychain and legacy storage.
 func DeleteTokenData(configDir string) error {
-	if h := edition.Get(); h.DeleteToken != nil {
-		return h.DeleteToken(configDir)
-	}
+	// Delete from keychain
 	keychainErr := DeleteTokenDataKeychain()
+
+	// Also clean up any legacy .data file
 	legacyErr := DeleteSecureData(configDir)
+
+	// Return keychain error if any, otherwise legacy error
 	if keychainErr != nil {
 		return keychainErr
 	}
@@ -20,18 +20,17 @@ import (
 	"errors"
 	"fmt"
 	"io"
-	"log/slog"
 	"sort"
 	"strconv"
 	"strings"

 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/cobracmd"
+	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/convert"
 	apperrors "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/errors"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/executor"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/ir"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/output"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/pipeline"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/convert"
 	"github.com/spf13/cobra"
 )

@@ -104,59 +103,24 @@ func NewMCPCommand(ctx context.Context, loader CatalogLoader, runner executor.Ru
 }

 func NewSchemaCommand(loader CatalogLoader) *cobra.Command {
-	cmd := &cobra.Command{
-		Use:   "schema [path]",
+	return &cobra.Command{
+		Use:   "schema [product.tool]",
 		Short: "查看 MCP 工具 Schema (产品列表 / 工具参数)",
 		Long: `查看已发现的 MCP 产品和工具的 Schema 元数据。

-不带参数时列出所有产品及其工具数量；带路径时输出该工具的完整
-输入 Schema（JSON Schema 格式）、输出 Schema、MCP 注解和 CLI
-层的 flag overlay（alias/transform/env_default）。
-
-路径支持三种写法：
-  product.rpc_name           规范路径 (e.g. ding.send_ding_message)
-  product.group.cli_name     CLI 点路径 (e.g. ding.message.send)
-  "product group cli_name"   CLI 空格/斜杠路径 (e.g. "ding message send")
+不带参数时列出所有产品及其工具数量；带 product.tool 路径时
+输出该工具的完整输入 Schema（JSON Schema 格式）。

 示例:
-  dws schema                                # 列出所有产品
-  dws schema ding.send_ding_message         # 规范路径
-  dws schema "ding message send"            # CLI 路径（空格）
-  dws schema --cli-path "ding message send" # 同上，显式 flag（脚本友好）
-  dws schema -f pretty ding.send_ding_message  # ANSI 彩色分区展示
-  dws schema --jq '.tool.flag_overlay'      # 只看 CLI overlay`,
+  dws schema                         # 列出所有产品
+  dws schema aitable.query_records   # 查看 aitable query_records 的参数 Schema
+  dws schema --fields id,tools       # 只显示 id 和 tools 字段
+  dws schema --jq '.products[].id'   # 用 jq 提取所有产品 ID`,
 		Args:              cobra.MaximumNArgs(1),
 		DisableAutoGenTag: true,
 		RunE: func(cmd *cobra.Command, args []string) error {
-			cliPath, _ := cmd.Flags().GetString("cli-path")
-			cliPath = strings.TrimSpace(cliPath)
-			if cliPath != "" {
-				if len(args) > 0 {
-					return apperrors.NewValidation("--cli-path and positional argument are mutually exclusive")
-				}
-				args = []string{cliPath}
-			}
 			catalog, err := loader.Load(cmd.Context())
 			if err != nil {
-				var degraded *CatalogDegraded
-				if errors.As(err, &degraded) {
-					fmt.Fprintf(cmd.ErrOrStderr(), "hint: %s\n", degraded.Hint)
-					payload := map[string]any{
-						"kind":     "schema",
-						"count":    0,
-						"products": []any{},
-						"degraded": true,
-						"reason":   string(degraded.Reason),
-						"hint":     degraded.Hint,
-					}
-					return output.WriteFiltered(
-						cmd.OutOrStdout(),
-						output.ResolveFormat(cmd, output.FormatJSON),
-						payload,
-						output.ResolveFields(cmd),
-						output.ResolveJQ(cmd),
-					)
-				}
 				return err
 			}

@@ -174,8 +138,6 @@ func NewSchemaCommand(loader CatalogLoader) *cobra.Command {
 			)
 		},
 	}
-	cmd.Flags().String("cli-path", "", "按 CLI 命令路径查询 (等同于位置参数，便于脚本使用无需转义)")
-	return cmd
 }

 func BuildFlagSpecs(schema map[string]any, hints map[string]ir.CLIFlagHint) []FlagSpec {
@@ -251,27 +213,6 @@ func newProductCommand(product ir.CanonicalProduct, runner executor.Runner, engi
 	for _, tool := range product.Tools {
 		cmd.AddCommand(newToolCommand(product, tool, runner, engine))
 	}
-
-	// Register phase: notify the pipeline that a product and its
-	// tools have been added to the command tree. This runs once at
-	// startup (not per-request) and enables handlers to inspect or
-	// enrich the registered command surface.
-	if engine != nil && engine.HasHandlers(pipeline.Register) {
-		pctx := &pipeline.Context{
-			Command: product.ID,
-		}
-		// Best-effort — registration errors are logged but do not
-		// prevent the CLI from starting.
-		if pipeErr := engine.RunPhase(pipeline.Register, pctx); pipeErr != nil {
-			slog.Debug("pipeline register phase", "product", product.ID, "error", pipeErr)
-		} else {
-			slog.Debug("pipeline register",
-				"product", product.ID,
-				"tool_count", len(product.Tools),
-			)
-		}
-	}
-
 	return cmd
 }

@@ -427,16 +368,6 @@ func newToolCommand(product ir.CanonicalProduct, tool ir.ToolDescriptor, runner
 					return pipeErr
 				}
 				params = pctx.Params
-				for _, c := range pctx.Corrections {
-					slog.Debug("pipeline correction",
-						"phase", "post-parse",
-						"handler", c.Handler,
-						"kind", c.Kind,
-						"field", c.Field,
-						"original", c.Original,
-						"corrected", c.Corrected,
-					)
-				}
 			}

 			if err := ValidateInputSchema(params, tool.InputSchema); err != nil {
@@ -461,10 +392,6 @@ func newToolCommand(product ir.CanonicalProduct, tool ir.ToolDescriptor, runner
 					return pipeErr
 				}
 				params = pctx.Params
-				slog.Debug("pipeline pre-request",
-					"command", tool.CanonicalPath,
-					"param_count", len(params),
-				)
 			}

 			invocation := executor.NewInvocation(product, tool, params)
@@ -487,10 +414,6 @@ func newToolCommand(product ir.CanonicalProduct, tool ir.ToolDescriptor, runner
 					return pipeErr
 				}
 				result.Response = pctx.Response
-				slog.Debug("pipeline post-response",
-					"command", tool.CanonicalPath,
-					"has_response", result.Response != nil,
-				)
 			}

 			if warning := lifecycleWarning(product); warning != "" {
@@ -682,7 +605,7 @@ func schemaPayload(catalog ir.Catalog, args []string) (map[string]any, error) {
 		}, nil
 	}

-	product, tool, ok := resolveSchemaPath(catalog, args[0])
+	product, tool, ok := catalog.FindTool(args[0])
 	if !ok {
 		return nil, apperrors.NewValidation(fmt.Sprintf("unknown canonical schema path %q", args[0]))
 	}
@@ -694,100 +617,23 @@ func schemaPayload(catalog ir.Catalog, args []string) (map[string]any, error) {
 	}, nil
 }

-// resolveSchemaPath accepts three input forms and maps to (product, tool):
-//   - "product.rpc_name"   (canonical, e.g. "ding.send_ding_message")
-//   - "product.cli_name"   (single-level CLI path, e.g. "doc.create")
-//   - CLI path with group  ("ding message send" or "ding.message.send";
-//     also accepts "/" and multiple whitespace between tokens)
-//
-// Canonical form is tried first so existing callers and scripts keep
-// working; only when that fails does the CLI-path resolver run.
-func resolveSchemaPath(catalog ir.Catalog, raw string) (ir.CanonicalProduct, ir.ToolDescriptor, bool) {
-	raw = strings.TrimSpace(raw)
-	if raw == "" {
-		return ir.CanonicalProduct{}, ir.ToolDescriptor{}, false
-	}
-
-	if product, tool, ok := catalog.FindTool(raw); ok {
-		return product, tool, true
-	}
-
-	tokens := splitSchemaPathTokens(raw)
-	if len(tokens) < 2 {
-		return ir.CanonicalProduct{}, ir.ToolDescriptor{}, false
-	}
-
-	productID := tokens[0]
-	leaf := tokens[len(tokens)-1]
-	groupPath := strings.Join(tokens[1:len(tokens)-1], ".")
-
-	product, ok := catalog.FindProduct(productID)
-	if !ok {
-		return ir.CanonicalProduct{}, ir.ToolDescriptor{}, false
-	}
-
-	for _, tool := range product.Tools {
-		if tool.CLIName != leaf {
-			continue
-		}
-		if strings.TrimSpace(tool.Group) != groupPath {
-			continue
-		}
-		return product, tool, true
-	}
-	return ir.CanonicalProduct{}, ir.ToolDescriptor{}, false
-}
-
-// splitSchemaPathTokens splits a CLI path on dots, slashes, and
-// whitespace, returning only non-empty tokens. "ding message send",
-// "ding.message.send", and "ding/message/send" all yield the same
-// three tokens.
-func splitSchemaPathTokens(raw string) []string {
-	fields := strings.FieldsFunc(raw, func(r rune) bool {
-		return r == '.' || r == '/' || r == ' ' || r == '\t'
-	})
-	out := fields[:0]
-	for _, f := range fields {
-		if s := strings.TrimSpace(f); s != "" {
-			out = append(out, s)
-		}
-	}
-	return out
-}
-
 // compactTool returns a lean representation of a tool for schema
-// output, keeping the fields AI agents and scripts need: RPC + CLI
-// identity, input/output schema, sensitivity, MCP annotations, and the
-// CLI flag overlay (alias/transform/envDefault/default) that shapes
-// how raw MCP parameters appear on the command line.
+// output, keeping only the fields that AI agents and developers
+// need: name, description, parameters, and sensitivity flag.
 func compactTool(t ir.ToolDescriptor) map[string]any {
 	tool := map[string]any{
-		"name":           t.RPCName,
-		"cli_name":       t.CLIName,
-		"canonical_path": t.CanonicalPath,
-		"title":          t.Title,
-		"description":    t.Description,
-		"sensitive":      t.Sensitive,
+		"name":        t.RPCName,
+		"title":       t.Title,
+		"description": t.Description,
+		"sensitive":   t.Sensitive,
 	}

-	if strings.TrimSpace(t.Group) != "" {
-		tool["group"] = t.Group
-	}
 	if props, ok := t.InputSchema["properties"]; ok {
 		tool["parameters"] = props
 	}
 	if req := requiredFields(t.InputSchema); len(req) > 0 {
 		tool["required"] = req
 	}
-	if len(t.OutputSchema) > 0 {
-		tool["output_schema"] = t.OutputSchema
-	}
-	if t.Annotations != nil {
-		tool["annotations"] = t.Annotations
-	}
-	if len(t.FlagOverlay) > 0 {
-		tool["flag_overlay"] = t.FlagOverlay
-	}

 	return tool
 }
@@ -121,205 +121,6 @@ func TestSchemaPayloadFindsTool(t *testing.T) {
 	}
 }

-func TestCompactToolEmitsExtendedFields(t *testing.T) {
-	t.Parallel()
-
-	destructive := true
-	tool := ir.ToolDescriptor{
-		RPCName:       "send_ding_message",
-		CLIName:       "send",
-		Group:         "message",
-		CanonicalPath: "ding.send_ding_message",
-		Title:         "发送DING消息",
-		Description:   "desc",
-		Sensitive:     true,
-		InputSchema: map[string]any{
-			"type":     "object",
-			"required": []any{"robotCode"},
-			"properties": map[string]any{
-				"robotCode": map[string]any{"type": "string"},
-			},
-		},
-		OutputSchema: map[string]any{
-			"type": "object",
-			"properties": map[string]any{
-				"openDingId": map[string]any{"type": "string"},
-			},
-		},
-		Annotations: &ir.ToolAnnotations{DestructiveHint: &destructive},
-		FlagOverlay: map[string]ir.FlagOverlay{
-			"receiverUserIdList": {Alias: "users", Transform: "csv_to_array"},
-		},
-	}
-
-	out := compactTool(tool)
-	if out["name"] != "send_ding_message" {
-		t.Errorf("name = %v", out["name"])
-	}
-	if out["cli_name"] != "send" {
-		t.Errorf("cli_name = %v", out["cli_name"])
-	}
-	if out["canonical_path"] != "ding.send_ding_message" {
-		t.Errorf("canonical_path = %v", out["canonical_path"])
-	}
-	if out["group"] != "message" {
-		t.Errorf("group = %v", out["group"])
-	}
-	if _, ok := out["output_schema"]; !ok {
-		t.Errorf("output_schema missing, keys = %v", keysOf(out))
-	}
-	if _, ok := out["annotations"]; !ok {
-		t.Errorf("annotations missing, keys = %v", keysOf(out))
-	}
-	overlay, ok := out["flag_overlay"].(map[string]ir.FlagOverlay)
-	if !ok {
-		t.Fatalf("flag_overlay type = %T", out["flag_overlay"])
-	}
-	if overlay["receiverUserIdList"].Alias != "users" {
-		t.Errorf("overlay alias = %q", overlay["receiverUserIdList"].Alias)
-	}
-}
-
-func TestCompactToolOmitsEmptyExtras(t *testing.T) {
-	t.Parallel()
-
-	tool := ir.ToolDescriptor{
-		RPCName:       "list_documents",
-		CLIName:       "list",
-		CanonicalPath: "doc.list_documents",
-		InputSchema:   map[string]any{"type": "object"},
-	}
-	out := compactTool(tool)
-	for _, key := range []string{"output_schema", "annotations", "flag_overlay", "group"} {
-		if _, has := out[key]; has {
-			t.Errorf("key %q should be omitted when empty, got %#v", key, out[key])
-		}
-	}
-}
-
-func TestSchemaPayloadResolvesCLIPath(t *testing.T) {
-	t.Parallel()
-
-	catalog := ir.Catalog{
-		Products: []ir.CanonicalProduct{
-			{
-				ID: "ding",
-				Tools: []ir.ToolDescriptor{
-					{
-						RPCName:       "send_ding_message",
-						CLIName:       "send",
-						Group:         "message",
-						CanonicalPath: "ding.send_ding_message",
-						InputSchema:   map[string]any{"type": "object"},
-					},
-					{
-						RPCName:       "recall_ding_message",
-						CLIName:       "recall",
-						Group:         "message",
-						CanonicalPath: "ding.recall_ding_message",
-						InputSchema:   map[string]any{"type": "object"},
-					},
-				},
-			},
-		},
-	}
-
-	cases := []struct {
-		name    string
-		input   string
-		wantRPC string
-		wantErr bool
-	}{
-		{"canonical rpc path", "ding.send_ding_message", "send_ding_message", false},
-		{"dotted cli path", "ding.message.send", "send_ding_message", false},
-		{"space cli path", "ding message send", "send_ding_message", false},
-		{"slash cli path", "ding/message/recall", "recall_ding_message", false},
-		{"unknown leaf", "ding message nope", "", true},
-		{"unknown group", "ding random send", "", true},
-		{"unknown product", "nope send", "", true},
-	}
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			payload, err := schemaPayload(catalog, []string{tc.input})
-			if (err != nil) != tc.wantErr {
-				t.Fatalf("err = %v, wantErr = %v", err, tc.wantErr)
-			}
-			if tc.wantErr {
-				return
-			}
-			tool, ok := payload["tool"].(map[string]any)
-			if !ok {
-				t.Fatalf("payload tool missing, got %#v", payload)
-			}
-			if tool["name"] != tc.wantRPC {
-				t.Errorf("tool name = %v, want %s", tool["name"], tc.wantRPC)
-			}
-		})
-	}
-}
-
-func TestSchemaCommandCLIPathFlag(t *testing.T) {
-	t.Parallel()
-
-	loader := StaticLoader{Catalog: ir.Catalog{
-		Products: []ir.CanonicalProduct{{
-			ID: "ding",
-			Tools: []ir.ToolDescriptor{{
-				RPCName:       "send_ding_message",
-				CLIName:       "send",
-				Group:         "message",
-				CanonicalPath: "ding.send_ding_message",
-				InputSchema:   map[string]any{"type": "object"},
-			}},
-		}},
-	}}
-
-	t.Run("resolves via --cli-path", func(t *testing.T) {
-		cmd := NewSchemaCommand(loader)
-		var out bytes.Buffer
-		cmd.SetOut(&out)
-		cmd.SetErr(&bytes.Buffer{})
-		cmd.SetArgs([]string{"--cli-path", "ding message send"})
-		if err := cmd.Execute(); err != nil {
-			t.Fatalf("Execute() error = %v", err)
-		}
-		var payload map[string]any
-		if err := json.Unmarshal(out.Bytes(), &payload); err != nil {
-			t.Fatalf("decode: %v", err)
-		}
-		tool, ok := payload["tool"].(map[string]any)
-		if !ok {
-			t.Fatalf("tool missing: %#v", payload)
-		}
-		if tool["name"] != "send_ding_message" {
-			t.Errorf("tool name = %v", tool["name"])
-		}
-	})
-
-	t.Run("rejects positional + flag collision", func(t *testing.T) {
-		cmd := NewSchemaCommand(loader)
-		var out bytes.Buffer
-		cmd.SetOut(&out)
-		cmd.SetErr(&bytes.Buffer{})
-		cmd.SetArgs([]string{"--cli-path", "ding message send", "ding.send_ding_message"})
-		err := cmd.Execute()
-		if err == nil {
-			t.Fatalf("expected mutual-exclusion error, got nil")
-		}
-		if !strings.Contains(err.Error(), "mutually exclusive") {
-			t.Errorf("err = %v, want mutual-exclusion message", err)
-		}
-	})
-}
-
-func keysOf(m map[string]any) []string {
-	out := make([]string, 0, len(m))
-	for k := range m {
-		out = append(out, k)
-	}
-	return out
-}
-
 func TestNewMCPCommandReturnsLoaderErrorForInvocations(t *testing.T) {
 	t.Parallel()

@@ -1232,83 +1033,6 @@ func newTestMCPCommand(t *testing.T, catalog ir.Catalog, runner executor.Runner)
 	return cmd
 }

-func TestSchemaCommandOutputsDegradedOnUnauthenticated(t *testing.T) {
-	t.Parallel()
-
-	degradedErr := &CatalogDegraded{
-		Reason: DegradedUnauthenticated,
-		Hint:   "未登录，无法发现 MCP 服务。请先执行: dws auth login",
-	}
-	cmd := NewSchemaCommand(errorLoader{err: degradedErr})
-
-	var out, errOut bytes.Buffer
-	cmd.SetOut(&out)
-	cmd.SetErr(&errOut)
-
-	if err := cmd.Execute(); err != nil {
-		t.Fatalf("Execute() error = %v, want nil (degraded handled gracefully)", err)
-	}
-
-	var payload map[string]any
-	if err := json.Unmarshal(out.Bytes(), &payload); err != nil {
-		t.Fatalf("json.Unmarshal() error = %v\noutput:\n%s", err, out.String())
-	}
-	if payload["degraded"] != true {
-		t.Fatalf("payload[degraded] = %v, want true", payload["degraded"])
-	}
-	if payload["reason"] != "unauthenticated" {
-		t.Fatalf("payload[reason] = %v, want unauthenticated", payload["reason"])
-	}
-	if payload["count"] != float64(0) {
-		t.Fatalf("payload[count] = %v, want 0", payload["count"])
-	}
-	if !strings.Contains(errOut.String(), "hint:") {
-		t.Fatalf("stderr = %q, want hint message", errOut.String())
-	}
-}
-
-func TestSchemaCommandOutputsDegradedOnMarketUnreachable(t *testing.T) {
-	t.Parallel()
-
-	degradedErr := &CatalogDegraded{
-		Reason: DegradedMarketUnreachable,
-		Hint:   "无法连接 MCP 市场 (mcp.dingtalk.com)，请检查网络",
-	}
-	cmd := NewSchemaCommand(errorLoader{err: degradedErr})
-
-	var out, errOut bytes.Buffer
-	cmd.SetOut(&out)
-	cmd.SetErr(&errOut)
-
-	if err := cmd.Execute(); err != nil {
-		t.Fatalf("Execute() error = %v, want nil", err)
-	}
-
-	var payload map[string]any
-	if err := json.Unmarshal(out.Bytes(), &payload); err != nil {
-		t.Fatalf("json.Unmarshal() error = %v\noutput:\n%s", err, out.String())
-	}
-	if payload["reason"] != "market_unreachable" {
-		t.Fatalf("payload[reason] = %v, want market_unreachable", payload["reason"])
-	}
-}
-
-func TestSchemaCommandPropagatesNonDegradedError(t *testing.T) {
-	t.Parallel()
-
-	wantErr := errors.New("unexpected failure")
-	cmd := NewSchemaCommand(errorLoader{err: wantErr})
-
-	var out bytes.Buffer
-	cmd.SetOut(&out)
-	cmd.SetErr(&out)
-
-	err := cmd.Execute()
-	if !errors.Is(err, wantErr) {
-		t.Fatalf("Execute() error = %v, want %v", err, wantErr)
-	}
-}
-
 type errorLoader struct {
 	err error
 }
@@ -17,107 +17,25 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
-	"log/slog"
 	"os"
 	"strings"
 	"time"

 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/cache"
+	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/config"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/discovery"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/ir"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/market"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/transport"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/config"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/configmeta"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/edition"
 )

-func init() {
-	configmeta.Register(configmeta.ConfigItem{
-		Name:         "DWS_CACHE_DIR",
-		Category:     configmeta.CategoryCore,
-		Description:  "覆盖缓存目录",
-		DefaultValue: "~/.dws/cache",
-		Example:      "/tmp/dws-cache",
-	})
-	configmeta.Register(configmeta.ConfigItem{
-		Name:        "DWS_CATALOG_FIXTURE",
-		Category:    configmeta.CategoryDebug,
-		Description: "使用本地 JSON 文件替代在线目录发现",
-		Example:     "/path/to/catalog.json",
-		Hidden:      true,
-	})
-	configmeta.Register(configmeta.ConfigItem{
-		Name:         "DWS_PLUGIN_COLD_TIMEOUT",
-		Category:     configmeta.CategoryCore,
-		Description:  "插件 MCP 冷启动发现的超时时长（Go duration 格式，如 2s / 1500ms）。设置后同时覆盖 HTTP 与 stdio 插件的冷启动预算；未设置时使用内置默认值（HTTP 无鉴权 1s / 有鉴权 1.5s / stdio 2s）。",
-		DefaultValue: "",
-		Example:      "3s",
-	})
-}
-
-// CatalogDegradedReason identifies why catalog discovery returned empty.
-type CatalogDegradedReason string
-
-const (
-	DegradedUnauthenticated   CatalogDegradedReason = "unauthenticated"
-	DegradedMarketUnreachable CatalogDegradedReason = "market_unreachable"
-	DegradedRuntimeAllFailed  CatalogDegradedReason = "runtime_all_failed"
-)
-
-// CatalogDegraded is returned by EnvironmentLoader.Load when discovery
-// fails for a diagnosable reason. Callers that need graceful degradation
-// (e.g. the runtime runner) can check errors.As and fall back to an
-// empty catalog; callers like the schema command can surface the hint.
-type CatalogDegraded struct {
-	Reason      CatalogDegradedReason
-	Hint        string
-	ServerCount int // number of servers discovered (only set for runtime_all_failed)
-}
-
-func (e *CatalogDegraded) Error() string { return string(e.Reason) + ": " + e.Hint }
-
-func degradedHint(reason CatalogDegradedReason, serverCount int) string {
-	embedded := edition.Get().IsEmbedded
-	switch reason {
-	case DegradedUnauthenticated:
-		if embedded {
-			return "未登录，请重新认证"
-		}
-		return "未登录，无法发现 MCP 服务。请先执行: dws auth login"
-	case DegradedMarketUnreachable:
-		if embedded {
-			return "无法连接 MCP 市场，请检查网络"
-		}
-		return "无法连接 MCP 市场 (mcp.dingtalk.com)，请检查网络"
-	case DegradedRuntimeAllFailed:
-		if embedded {
-			return fmt.Sprintf("已发现 %d 个服务但连接全部失败，请稍后重试", serverCount)
-		}
-		return fmt.Sprintf("已发现 %d 个服务但连接全部失败，请稍后重试或执行: dws cache refresh", serverCount)
-	default:
-		return "MCP 服务发现失败"
-	}
-}
-
-func newCatalogDegraded(reason CatalogDegradedReason, serverCount int) *CatalogDegraded {
-	return &CatalogDegraded{
-		Reason:      reason,
-		Hint:        degradedHint(reason, serverCount),
-		ServerCount: serverCount,
-	}
-}
-
 const (
 	CatalogFixtureEnv    = "DWS_CATALOG_FIXTURE"
 	CacheDirEnv          = "DWS_CACHE_DIR"
-	PluginColdTimeoutEnv = "DWS_PLUGIN_COLD_TIMEOUT"
 	DefaultMarketBaseURL = "https://mcp.dingtalk.com"

 	// defaultDiscoveryTimeout bounds the time spent on live registry discovery.
-	// Tightened to 4s so a slow/unreachable discovery endpoint cannot block
-	// every CLI command invocation. See issue #119.
-	defaultDiscoveryTimeout = 4 * time.Second
+	defaultDiscoveryTimeout = 10 * time.Second
 )

 type CatalogLoader interface {
@@ -174,10 +92,6 @@ type EnvironmentLoader struct {
 	// AuthTokenFunc returns an access token for MCP discovery requests
 	// (initialize, tools/list). When nil, discovery runs without auth.
 	AuthTokenFunc func(context.Context) string
-	// LoggerFunc returns a structured logger for discovery diagnostics.
-	// Called lazily because the file logger may not be initialized at
-	// construction time (it's set up during PersistentPreRunE).
-	LoggerFunc func() *slog.Logger
 }

 type cachedCatalogState struct {
@@ -209,23 +123,17 @@ func (l EnvironmentLoader) Load(ctx context.Context) (ir.Catalog, error) {
 	// Startup command construction should not block on synchronous discovery
 	// just because the cache has aged past the short revalidation window.
 	cached := l.loadFromCache(store)
-	if cached.Available && len(cached.Catalog.Products) > 0 {
+	if cached.Available {
 		return cached.Catalog, nil
 	}

 	transportClient := transport.NewClient(nil)
-	hasAuth := false
 	if l.AuthTokenFunc != nil {
 		if token := l.AuthTokenFunc(ctx); token != "" {
 			transportClient = transportClient.WithAuth(token, nil)
-			hasAuth = true
 		}
 	}

-	if !hasAuth {
-		return ir.Catalog{}, newCatalogDegraded(DegradedUnauthenticated, 0)
-	}
-
 	// Use a bounded context so discovery doesn't hang in test or CI environments.
 	timeout := defaultDiscoveryTimeout
 	if l.DiscoveryTimeout > 0 {
@@ -239,15 +147,14 @@ func (l EnvironmentLoader) Load(ctx context.Context) (ir.Catalog, error) {
 		transportClient,
 		store,
 	)
-	if l.LoggerFunc != nil {
-		service.Logger = l.LoggerFunc()
-	}
 	response, err := service.MarketClient.FetchServers(discoverCtx, 200)
 	if err != nil {
-		if cached.Available && len(cached.Catalog.Products) > 0 {
+		// Graceful degradation: return empty catalog on discovery failure.
+		// The runtime runner will fall back to EchoRunner for unknown products.
+		if cached.Available {
 			return cached.Catalog, nil
 		}
-		return ir.Catalog{}, newCatalogDegraded(DegradedMarketUnreachable, 0)
+		return ir.Catalog{}, nil
 	}

 	servers := market.NormalizeServers(response, "live_market")
@@ -277,10 +184,10 @@ func (l EnvironmentLoader) Load(ctx context.Context) (ir.Catalog, error) {

 	refreshed, failures := service.DiscoverAllRuntime(discoverCtx, toRefresh)
 	if len(unchangedRuntime) == 0 && len(refreshed) == 0 && len(failures) > 0 {
-		if cached.Available && len(cached.Catalog.Products) > 0 {
+		if cached.Available {
 			return cached.Catalog, nil
 		}
-		return ir.Catalog{}, newCatalogDegraded(DegradedRuntimeAllFailed, len(servers))
+		return ir.Catalog{}, nil
 	}

 	refreshedByKey := make(map[string]discovery.RuntimeServer, len(refreshed))
@@ -95,13 +95,9 @@ func BuildDynamicCommands(servers []market.ServerDescriptor, runner executor.Run

 			bindings, normalizer := buildOverrideBindings(override)

-			// Resolve Short/Long from Detail API toolTitle/toolDesc;
-			// fallback to overlay description; then to generic cmdName/cliName.
+			// Resolve Short/Long from Detail API toolTitle/toolDesc; fallback to generic.
 			short := fmt.Sprintf("%s/%s", cmdName, cliName)
 			long := ""
-			if desc := strings.TrimSpace(override.Description); desc != "" {
-				short = desc
-			}
 			if dt, ok := detailIndex[toolName]; ok {
 				if title := strings.TrimSpace(dt.ToolTitle); title != "" {
 					short = title
@@ -166,7 +162,7 @@ func BuildDynamicCommands(servers []market.ServerDescriptor, runner executor.Run
 	}
 	for _, child := range children {
 		if parent, ok := topLevel[child.parent]; ok {
-			attachOrMerge(parent, child.cmd)
+			parent.AddCommand(child.cmd)
 		} else {
 			// Parent not found among dynamic commands; emit as top-level.
 			name := child.cmd.Name()
@@ -389,43 +385,6 @@ func resolveNestedGroup(root *cobra.Command, groupPath string, registry map[stri
 	return ensureNestedGroup(root, groupPath, groupPath, registry)
 }

-// attachOrMerge adds child as a sub-command of parent. If parent already has a
-// sub-command with the same Name(), the two are merged recursively: child's
-// sub-commands are moved onto the existing one and child itself is discarded.
-// Leaf collisions (two commands with the same Name and no further children)
-// are resolved first-wins — the incoming one is dropped.
-//
-// This lets multiple server entries share a cli.command under the same parent,
-// e.g. bot-message (command="message", parent="chat") can contribute leaves
-// into the same "message" subtree already built from chat's own toolOverrides,
-// without creating a duplicate "message" sibling in chat's help output.
-func attachOrMerge(parent, child *cobra.Command) {
-	existing := findSubcommand(parent, child.Name())
-	if existing == nil {
-		parent.AddCommand(child)
-		return
-	}
-	// Snapshot child's sub-commands before we start moving them (RemoveCommand
-	// mutates the slice we'd be iterating).
-	subs := make([]*cobra.Command, len(child.Commands()))
-	copy(subs, child.Commands())
-	for _, sub := range subs {
-		child.RemoveCommand(sub)
-		attachOrMerge(existing, sub)
-	}
-}
-
-// findSubcommand returns the first sub-command of parent with the given name,
-// or nil if none match.
-func findSubcommand(parent *cobra.Command, name string) *cobra.Command {
-	for _, sub := range parent.Commands() {
-		if sub.Name() == name {
-			return sub
-		}
-	}
-	return nil
-}
-
 // buildOverrideBindings converts CLIToolOverride flags into FlagBindings and
 // constructs a Normalizer that applies transform rules.
 // Implements §2.1-§2.5 of the conversion rules.
@@ -16,8 +16,6 @@ package compat
 import (
 	"testing"

-	"github.com/spf13/cobra"
-
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/executor"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/market"
 )
@@ -145,210 +143,3 @@ func TestBuildDynamicCommands_NoParent(t *testing.T) {
 		t.Fatalf("expected 2 top-level commands, got %d", len(cmds))
 	}
 }
-
-// TestBuildDynamicCommands_ParentMergeSameName covers the case where two
-// servers share the same cli.command + cli.parent. Instead of producing two
-// sibling subcommands with the same Name under the parent (which cobra allows
-// but `--help` renders as duplicate rows), the compat layer merges them into
-// a single subcommand whose children are the union of both sides.
-func TestBuildDynamicCommands_ParentMergeSameName(t *testing.T) {
-	t.Parallel()
-
-	servers := []market.ServerDescriptor{
-		{
-			Endpoint: "https://endpoint-chat",
-			CLI: market.CLIOverlay{
-				ID:      "group-chat",
-				Command: "chat",
-				Groups: map[string]market.CLIGroupDef{
-					"message": {Description: "会话消息管理"},
-				},
-				ToolOverrides: map[string]market.CLIToolOverride{
-					"send_message_as_user":         {CLIName: "send", Group: "message"},
-					"list_conversation_message_v2": {CLIName: "list", Group: "message"},
-				},
-			},
-		},
-		{
-			// Second server contributes more leaves into the same "message"
-			// namespace via command="message" + parent="chat".
-			Endpoint: "https://endpoint-bot",
-			CLI: market.CLIOverlay{
-				ID:      "bot-message",
-				Command: "message",
-				Parent:  "chat",
-				ToolOverrides: map[string]market.CLIToolOverride{
-					"send_robot_group_message":     {CLIName: "send-by-bot"},
-					"send_message_by_custom_robot": {CLIName: "send-by-webhook"},
-				},
-			},
-		},
-	}
-
-	cmds := BuildDynamicCommands(servers, executor.EchoRunner{}, nil)
-	if len(cmds) != 1 || cmds[0].Name() != "chat" {
-		t.Fatalf("expected single top-level 'chat', got %d cmds", len(cmds))
-	}
-
-	// There must be exactly one child named "message" under chat, not two.
-	var messageCmds []*cobra.Command
-	for _, sub := range cmds[0].Commands() {
-		if sub.Name() == "message" {
-			messageCmds = append(messageCmds, sub)
-		}
-	}
-	if len(messageCmds) != 1 {
-		names := make([]string, 0, len(cmds[0].Commands()))
-		for _, c := range cmds[0].Commands() {
-			names = append(names, c.Name())
-		}
-		t.Fatalf("expected exactly one 'message' under chat, got %d — chat children: %v", len(messageCmds), names)
-	}
-
-	// The merged message subcommand must contain all four leaves.
-	want := map[string]bool{"send": false, "list": false, "send-by-bot": false, "send-by-webhook": false}
-	for _, leaf := range messageCmds[0].Commands() {
-		if _, ok := want[leaf.Name()]; ok {
-			want[leaf.Name()] = true
-		}
-	}
-	for leaf, seen := range want {
-		if !seen {
-			t.Errorf("expected 'chat message %s' after merge, missing", leaf)
-		}
-	}
-}
-
-// TestBuildDynamicCommands_ParentMergeRecursive covers a multi-level merge:
-// chat already has `group.members` (with add/remove), and a separate
-// bot-group server contributes `dws chat group members add-bot` via
-// command=group + parent=chat + groups.members. The "group" and "members"
-// nodes must each be merged, not duplicated.
-func TestBuildDynamicCommands_ParentMergeRecursive(t *testing.T) {
-	t.Parallel()
-
-	servers := []market.ServerDescriptor{
-		{
-			Endpoint: "https://endpoint-chat",
-			CLI: market.CLIOverlay{
-				ID:      "group-chat",
-				Command: "chat",
-				Groups: map[string]market.CLIGroupDef{
-					"group":         {Description: "群组管理"},
-					"group.members": {Description: "群成员管理"},
-				},
-				ToolOverrides: map[string]market.CLIToolOverride{
-					"add_group_member":    {CLIName: "add", Group: "group.members"},
-					"remove_group_member": {CLIName: "remove", Group: "group.members"},
-				},
-			},
-		},
-		{
-			Endpoint: "https://endpoint-bot",
-			CLI: market.CLIOverlay{
-				ID:      "bot-group",
-				Command: "group",
-				Parent:  "chat",
-				Groups: map[string]market.CLIGroupDef{
-					"members": {Description: "机器人群成员"},
-				},
-				ToolOverrides: map[string]market.CLIToolOverride{
-					"add_robot_to_group": {CLIName: "add-bot", Group: "members"},
-				},
-			},
-		},
-	}
-
-	cmds := BuildDynamicCommands(servers, executor.EchoRunner{}, nil)
-	if len(cmds) != 1 || cmds[0].Name() != "chat" {
-		t.Fatalf("expected single top-level 'chat', got %d", len(cmds))
-	}
-
-	// One 'group' under chat.
-	var groupCmds []*cobra.Command
-	for _, sub := range cmds[0].Commands() {
-		if sub.Name() == "group" {
-			groupCmds = append(groupCmds, sub)
-		}
-	}
-	if len(groupCmds) != 1 {
-		t.Fatalf("expected single 'group' under chat, got %d", len(groupCmds))
-	}
-
-	// One 'members' under chat.group.
-	var membersCmds []*cobra.Command
-	for _, sub := range groupCmds[0].Commands() {
-		if sub.Name() == "members" {
-			membersCmds = append(membersCmds, sub)
-		}
-	}
-	if len(membersCmds) != 1 {
-		t.Fatalf("expected single 'members' under chat.group, got %d", len(membersCmds))
-	}
-
-	// The merged members subcommand must contain add, remove, add-bot.
-	want := map[string]bool{"add": false, "remove": false, "add-bot": false}
-	for _, leaf := range membersCmds[0].Commands() {
-		if _, ok := want[leaf.Name()]; ok {
-			want[leaf.Name()] = true
-		}
-	}
-	for leaf, seen := range want {
-		if !seen {
-			t.Errorf("expected 'chat group members %s', missing", leaf)
-		}
-	}
-}
-
-// TestBuildDynamicCommands_ParentMergeLeafCollision verifies that when two
-// servers both produce the same leaf path (e.g. both try to register
-// `chat message send`), the first one wins and the second is silently
-// dropped rather than producing a duplicate cobra command.
-func TestBuildDynamicCommands_ParentMergeLeafCollision(t *testing.T) {
-	t.Parallel()
-
-	servers := []market.ServerDescriptor{
-		{
-			Endpoint: "https://endpoint-chat",
-			CLI: market.CLIOverlay{
-				ID:      "group-chat",
-				Command: "chat",
-				Groups:  map[string]market.CLIGroupDef{"message": {Description: "消息"}},
-				ToolOverrides: map[string]market.CLIToolOverride{
-					"send_message_as_user": {CLIName: "send", Group: "message"},
-				},
-			},
-		},
-		{
-			Endpoint: "https://endpoint-bot",
-			CLI: market.CLIOverlay{
-				ID:      "bot-message",
-				Command: "message",
-				Parent:  "chat",
-				ToolOverrides: map[string]market.CLIToolOverride{
-					// Intentional collision: same leaf name.
-					"send_robot_group_message": {CLIName: "send"},
-				},
-			},
-		},
-	}
-
-	cmds := BuildDynamicCommands(servers, executor.EchoRunner{}, nil)
-	if len(cmds) != 1 {
-		t.Fatalf("expected 1 top-level, got %d", len(cmds))
-	}
-	messageCmd := findSubcommand(cmds[0], "message")
-	if messageCmd == nil {
-		t.Fatal("expected 'message' subcommand under chat")
-	}
-	// Exactly one 'send' leaf.
-	var sendCount int
-	for _, leaf := range messageCmd.Commands() {
-		if leaf.Name() == "send" {
-			sendCount++
-		}
-	}
-	if sendCount != 1 {
-		t.Fatalf("expected exactly one 'send' leaf, got %d", sendCount)
-	}
-}
@@ -26,12 +26,11 @@ import (

 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/cli"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/cobracmd"
+	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/convert"
 	apperrors "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/errors"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/executor"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/output"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/convert"
 	"github.com/spf13/cobra"
-	"github.com/spf13/pflag"
 )

 type ValueKind string
@@ -140,11 +139,6 @@ func NewDirectCommand(route Route, runner executor.Runner) *cobra.Command {
 			for key, value := range bindingParams {
 				params[key] = value
 			}
-
-			// Collect schema-derived flags (from buildFlagsFromDetailSchema)
-			// that are not covered by explicit bindings.
-			collectSchemaFlags(cmd, route.Bindings, params)
-
 			if route.Normalizer != nil {
 				if err := route.Normalizer(cmd, params); err != nil {
 					return err
@@ -252,70 +246,6 @@ func ApplyBindings(cmd *cobra.Command, bindings []FlagBinding) {
 	_ = cmd.Flags().MarkHidden("params")
 }

-// collectSchemaFlags picks up flags created by buildFlagsFromDetailSchema that
-// have no explicit FlagBinding. This bridges the gap for plugin-defined tools
-// whose parameters come from the MCP inputSchema rather than CLIToolOverride.Flags.
-func collectSchemaFlags(cmd *cobra.Command, bindings []FlagBinding, params map[string]any) {
-	// Build a set of flag names already covered by bindings.
-	bound := make(map[string]bool, len(bindings)*2)
-	for _, b := range bindings {
-		if n := strings.TrimSpace(b.FlagName); n != "" {
-			bound[n] = true
-		}
-		if a := strings.TrimSpace(b.Alias); a != "" {
-			bound[a] = true
-		}
-	}
-
-	// Reserved/internal flags that should never be forwarded as tool params.
-	skip := map[string]bool{
-		"json": true, "params": true, "help": true,
-		"format": true, "fields": true, "jq": true,
-		"debug": true, "verbose": true, "dry-run": true,
-		"yes": true, "mock": true, "timeout": true,
-		"client-id": true, "client-secret": true,
-	}
-
-	cmd.Flags().Visit(func(f *pflag.Flag) {
-		if bound[f.Name] || skip[f.Name] {
-			return
-		}
-		// Convert flag name back to the original parameter name (kebab → snake/camel)
-		// For simplicity, use the flag name as-is since MCP tools typically
-		// use snake_case which maps to kebab-case flags.
-		paramName := toOriginalParamName(f.Name)
-		if _, exists := params[paramName]; exists {
-			return // already set by --json/--params
-		}
-
-		switch f.Value.Type() {
-		case "int":
-			if v, err := cmd.Flags().GetInt(f.Name); err == nil {
-				params[paramName] = v
-			}
-		case "bool":
-			if v, err := cmd.Flags().GetBool(f.Name); err == nil {
-				params[paramName] = v
-			}
-		case "stringSlice":
-			if v, err := cmd.Flags().GetStringSlice(f.Name); err == nil {
-				params[paramName] = v
-			}
-		default:
-			if v, err := cmd.Flags().GetString(f.Name); err == nil {
-				params[paramName] = v
-			}
-		}
-	})
-}
-
-// toOriginalParamName converts a kebab-case flag name back to the original
-// MCP parameter name. Since toKebabCase converts both camelCase and snake_case
-// to kebab-case, we default to snake_case (the MCP convention).
-func toOriginalParamName(flagName string) string {
-	return strings.ReplaceAll(flagName, "-", "_")
-}
-
 func CollectBindings(cmd *cobra.Command, bindings []FlagBinding, existing map[string]any) (map[string]any, error) {
 	if existing == nil {
 		existing = map[string]any{}
@@ -146,102 +146,3 @@ func TestCollectBindingsParsesJSONFlagValue(t *testing.T) {
 		t.Fatalf("config.options = %#v, want array of 1", config["options"])
 	}
 }
-
-func TestCollectSchemaFlagsPicksUpUnboundFlags(t *testing.T) {
-	t.Parallel()
-
-	// Simulate a plugin command with schema-generated flags but no bindings.
-	cmd := &cobra.Command{Use: "greet"}
-	cmd.Flags().String("name", "", "Name of person")
-	cmd.Flags().String("language", "en", "Language")
-	cmd.Flags().Int("count", 0, "Repeat count")
-	cmd.Flags().Bool("loud", false, "Loud mode")
-	cmd.Flags().String("json", "", "")
-	cmd.Flags().String("params", "", "")
-
-	// User sets --name and --count but not --language
-	_ = cmd.Flags().Set("name", "Alice")
-	_ = cmd.Flags().Set("count", "3")
-	_ = cmd.Flags().Set("loud", "true")
-
-	params := make(map[string]any)
-	collectSchemaFlags(cmd, nil, params)
-
-	if params["name"] != "Alice" {
-		t.Errorf("name = %v, want Alice", params["name"])
-	}
-	if params["count"] != 3 {
-		t.Errorf("count = %v, want 3", params["count"])
-	}
-	if params["loud"] != true {
-		t.Errorf("loud = %v, want true", params["loud"])
-	}
-	// language was not set by user, should not appear
-	if _, exists := params["language"]; exists {
-		t.Errorf("language should not be in params (not set by user)")
-	}
-	// json/params are reserved, should not appear
-	if _, exists := params["json"]; exists {
-		t.Error("json should be skipped")
-	}
-}
-
-func TestCollectSchemaFlagsSkipsBoundFlags(t *testing.T) {
-	t.Parallel()
-
-	bindings := []FlagBinding{
-		{FlagName: "dept-id", Property: "deptId", Kind: ValueString},
-	}
-
-	cmd := &cobra.Command{Use: "test"}
-	ApplyBindings(cmd, bindings)
-	// Also add a schema-generated flag
-	cmd.Flags().String("title", "", "Title")
-
-	_ = cmd.Flags().Set("dept-id", "D001")
-	_ = cmd.Flags().Set("title", "Hello")
-
-	params := make(map[string]any)
-	collectSchemaFlags(cmd, bindings, params)
-
-	// dept-id is bound, should NOT be collected by collectSchemaFlags
-	if _, exists := params["dept_id"]; exists {
-		t.Error("dept-id should be skipped (already has binding)")
-	}
-	// title is unbound, should be collected
-	if params["title"] != "Hello" {
-		t.Errorf("title = %v, want Hello", params["title"])
-	}
-}
-
-func TestCollectSchemaFlagsSkipsGlobalFlags(t *testing.T) {
-	t.Parallel()
-
-	cmd := &cobra.Command{Use: "test"}
-	cmd.Flags().String("name", "", "Name")
-	cmd.Flags().Bool("debug", false, "Debug")
-	cmd.Flags().Bool("verbose", false, "Verbose")
-	cmd.Flags().Bool("dry-run", false, "Dry run")
-	cmd.Flags().String("format", "json", "Format")
-	cmd.Flags().String("json", "", "")
-	cmd.Flags().String("params", "", "")
-
-	_ = cmd.Flags().Set("name", "Bob")
-	_ = cmd.Flags().Set("debug", "true")
-	_ = cmd.Flags().Set("verbose", "true")
-	_ = cmd.Flags().Set("dry-run", "true")
-	_ = cmd.Flags().Set("format", "table")
-
-	params := make(map[string]any)
-	collectSchemaFlags(cmd, nil, params)
-
-	if params["name"] != "Bob" {
-		t.Errorf("name = %v, want Bob", params["name"])
-	}
-	// Global flags should be skipped
-	for _, skip := range []string{"debug", "verbose", "dry_run", "format"} {
-		if _, exists := params[skip]; exists {
-			t.Errorf("%s should be skipped (global flag)", skip)
-		}
-	}
-}
@@ -20,8 +20,6 @@ import (
 	"strings"
 	"time"

-	"gopkg.in/yaml.v3"
-
 	apperrors "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/errors"
 )

@@ -112,18 +110,6 @@ func transformCSVToArray(value any) (any, error) {
 	return result, nil
 }

-// transformJSONParse parses a CLI string into a structured value so callers can
-// pass complex payloads (JSON arrays/objects) through a single flag.
-//
-// Two input dialects are accepted, in order:
-//  1. Strict JSON  — `[{"fieldName":"x","type":"text"}]`
-//  2. YAML (flow)  — `[{fieldName: x, type: text}]`
-//
-// YAML is a superset of JSON that permits unquoted keys and strings, which
-// dramatically reduces the need for shell-level escaping. Users can therefore
-// write `--fields '[{fieldName: 标题, type: text}]'` instead of piling quotes
-// around every token. The output shape is the same either way; downstream
-// consumers see the parsed Go value, not the original dialect.
 func transformJSONParse(value any) (any, error) {
 	s, ok := toString(value)
 	if !ok {
@@ -133,22 +119,11 @@ func transformJSONParse(value any) (any, error) {
 	if s == "" {
 		return value, nil
 	}
-	// Strict JSON first — fast path and unambiguous type promotion (numbers
-	// stay numbers, etc.).
 	var parsed any
-	if err := json.Unmarshal([]byte(s), &parsed); err == nil {
-		return parsed, nil
+	if err := json.Unmarshal([]byte(s), &parsed); err != nil {
+		return nil, apperrors.NewValidation(fmt.Sprintf("json_parse: invalid JSON: %v", err))
 	}
-	// YAML (flow) fallback — accepts `{key: value}` without surrounding
-	// quotes, which is the natural form when typing at a shell prompt.
-	if err := yaml.Unmarshal([]byte(s), &parsed); err == nil {
-		return parsed, nil
-	}
-	return nil, apperrors.NewValidation(
-		"json_parse: input is not valid JSON or YAML; " +
-			"quote the whole value and use `[{key: value, ...}]` for ad-hoc input, " +
-			"or pass `@path/to/file.json` to read from a file",
-	)
+	return parsed, nil
 }

 func transformEnumMap(value any, args map[string]any) (any, error) {
@@ -1,125 +0,0 @@
-// Copyright 2026 Alibaba Group
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package compat
-
-import (
-	"reflect"
-	"testing"
-)
-
-// TestJSONParse_StrictJSON covers the primary path: callers passing
-// canonical JSON (as generated programmatically or by agents).
-func TestJSONParse_StrictJSON(t *testing.T) {
-	t.Parallel()
-
-	input := `[{"fieldName":"title","type":"text"},{"fieldName":"count","type":"number"}]`
-	got, err := ApplyTransform(input, "json_parse", nil)
-	if err != nil {
-		t.Fatalf("strict JSON should parse, got err: %v", err)
-	}
-	arr, ok := got.([]any)
-	if !ok || len(arr) != 2 {
-		t.Fatalf("expected []any of length 2, got %T %v", got, got)
-	}
-}
-
-// TestJSONParse_YAMLFlowFallback is the motivating case: a user types an
-// ad-hoc JSON-shaped array without quoting every key and value. YAML flow
-// syntax accepts it and the parsed output is indistinguishable from the
-// strict-JSON equivalent.
-func TestJSONParse_YAMLFlowFallback(t *testing.T) {
-	t.Parallel()
-
-	// Intentionally unquoted keys, unquoted string values, and Chinese
-	// identifiers — typical of what humans type at a shell.
-	input := `[{fieldName: 标题, type: text}, {fieldName: 数量, type: number, config: {formatter: INT}}, {fieldName: 状态, type: singleSelect, config: {options: [{name: 待办}, {name: 进行中}, {name: 已完成}]}}, {fieldName: 已确认, type: checkbox}]`
-
-	got, err := ApplyTransform(input, "json_parse", nil)
-	if err != nil {
-		t.Fatalf("YAML-flow input should parse, got err: %v", err)
-	}
-	arr, ok := got.([]any)
-	if !ok {
-		t.Fatalf("expected []any, got %T", got)
-	}
-	if len(arr) != 4 {
-		t.Fatalf("expected 4 field definitions, got %d", len(arr))
-	}
-
-	// Spot-check the third entry, which is the most deeply nested.
-	third, ok := arr[2].(map[string]any)
-	if !ok {
-		t.Fatalf("arr[2] expected map[string]any, got %T", arr[2])
-	}
-	if third["fieldName"] != "状态" {
-		t.Errorf("arr[2].fieldName: want 状态, got %v", third["fieldName"])
-	}
-	config, ok := third["config"].(map[string]any)
-	if !ok {
-		t.Fatalf("arr[2].config expected map, got %T", third["config"])
-	}
-	options, ok := config["options"].([]any)
-	if !ok || len(options) != 3 {
-		t.Fatalf("arr[2].config.options: want 3 items, got %v", config["options"])
-	}
-}
-
-// TestJSONParse_EmptyString preserves the legacy behaviour of returning the
-// original value untouched when the caller passes an empty / whitespace-only
-// string, matching how other transforms treat empty input.
-func TestJSONParse_EmptyString(t *testing.T) {
-	t.Parallel()
-
-	cases := []string{"", "   ", "\n\t"}
-	for _, in := range cases {
-		got, err := ApplyTransform(in, "json_parse", nil)
-		if err != nil {
-			t.Errorf("empty input %q should not error: %v", in, err)
-			continue
-		}
-		if !reflect.DeepEqual(got, in) {
-			t.Errorf("empty input %q should pass through, got %v", in, got)
-		}
-	}
-}
-
-// TestJSONParse_NonString passes through non-string inputs (already-parsed
-// values flowing through the pipeline).
-func TestJSONParse_NonString(t *testing.T) {
-	t.Parallel()
-
-	preParsed := []any{map[string]any{"k": "v"}}
-	got, err := ApplyTransform(preParsed, "json_parse", nil)
-	if err != nil {
-		t.Fatalf("non-string should pass through: %v", err)
-	}
-	if !reflect.DeepEqual(got, preParsed) {
-		t.Errorf("non-string should pass through unchanged, got %v", got)
-	}
-}
-
-// TestJSONParse_InvalidInput verifies that genuine garbage is still rejected
-// with a user-facing validation error that nudges towards `@file` syntax.
-func TestJSONParse_InvalidInput(t *testing.T) {
-	t.Parallel()
-
-	// Unterminated bracket — neither valid JSON nor valid YAML flow.
-	_, err := ApplyTransform("[{fieldName:", "json_parse", nil)
-	if err == nil {
-		t.Fatal("expected error for malformed input")
-	}
-	if msg := err.Error(); msg == "" {
-		t.Fatal("error message should be non-empty")
-	}
-}
@@ -18,8 +18,6 @@ package config

 import (
 	"os"
-	"path/filepath"
-	"strings"
 	"time"
 )

@@ -108,64 +106,3 @@ const (
 	// MaxUploadFileSize is the maximum file size for attachment uploads.
 	MaxUploadFileSize int64 = 100 * 1024 * 1024 // 100 MB
 )
-
-// ── Plugin system ──────────────────────────────────────────────────────
-
-const (
-	// PluginUserDir is the subdirectory under ~/.dws/plugins/ where all
-	// third-party plugins are installed. Every plugin — whether authored
-	// by the DingTalk team or anyone else — lives here with equal status.
-	PluginUserDir = "user"
-
-	// PluginDataDir is the subdirectory under ~/.dws/plugins/ for
-	// plugin persistent data that survives across version updates.
-	PluginDataDir = "data"
-
-	// PluginHookTimeout is the default timeout for plugin hook commands.
-	PluginHookTimeout = 30 * time.Second
-)
-
-// ── Platform URLs ────────────────────────────────────────────────────────────
-// Shared across auth, errors, and device-flow packages.
-
-const (
-	// DefaultTerminalBaseURL is the DingTalk developer platform base URL.
-	// Override at runtime via ~/.dws/terminal_url file.
-	DefaultTerminalBaseURL = "https://open-dev.dingtalk.com"
-
-	// DeveloperSettingsPath is the path to the organization developer
-	// settings page (CLI access management).
-	DeveloperSettingsPath = "/fe/old#/developerSettings"
-)
-
-// DefaultConfigDir returns the default DWS configuration directory.
-// Priority: DWS_CONFIG_DIR env var > ~/.dws
-func DefaultConfigDir() string {
-	if envDir := os.Getenv("DWS_CONFIG_DIR"); envDir != "" {
-		return envDir
-	}
-	homeDir, err := os.UserHomeDir()
-	if err != nil {
-		return ".dws"
-	}
-	return filepath.Join(homeDir, ".dws")
-}
-
-// GetTerminalBaseURL returns the terminal base URL with priority:
-//  1. ~/.dws/terminal_url file content (for pre-release environment)
-//  2. Default value (https://open-dev.dingtalk.com)
-func GetTerminalBaseURL() string {
-	terminalURLPath := filepath.Join(DefaultConfigDir(), "terminal_url")
-	if data, err := os.ReadFile(terminalURLPath); err == nil {
-		if u := strings.TrimSpace(string(data)); u != "" {
-			return u
-		}
-	}
-	return DefaultTerminalBaseURL
-}
-
-// GetDeveloperSettingsURL returns the full URL to the organization developer
-// settings page, derived from the terminal base URL.
-func GetDeveloperSettingsURL() string {
-	return GetTerminalBaseURL() + DeveloperSettingsPath
-}
@@ -21,30 +21,12 @@ import (
 	"log/slog"
 	"os"
 	"strings"
-	"sync"
-	"time"

 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/cache"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/market"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/transport"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/configmeta"
 )

-func init() {
-	configmeta.Register(configmeta.ConfigItem{
-		Name:         "DWS_TENANT",
-		Category:     configmeta.CategoryCore,
-		Description:  "缓存分区的租户标识",
-		DefaultValue: "default",
-	})
-	configmeta.Register(configmeta.ConfigItem{
-		Name:         "DWS_AUTH_IDENTITY",
-		Category:     configmeta.CategorySecurity,
-		Description:  "缓存分区的认证身份标识",
-		DefaultValue: "default",
-	})
-}
-
 const (
 	tenantEnv       = "DWS_TENANT"
 	authIdentityEnv = "DWS_AUTH_IDENTITY"
@@ -59,11 +41,6 @@ type Service struct {
 	Tenant       string
 	AuthIdentity string
 	Logger       *slog.Logger
-	// PerServerTimeout overrides the default per-server discovery timeout
-	// when greater than zero. Useful for tests and for callers that need a
-	// tighter or looser bound. When zero, defaultPerServerDiscoveryTimeout
-	// applies.
-	PerServerTimeout time.Duration
 }

 type RuntimeServer struct {
@@ -175,121 +152,29 @@ func (s *Service) DiscoverServerRuntime(ctx context.Context, server market.Serve
 	}, nil
 }

-// defaultPerServerDiscoveryTimeout bounds the time spent discovering tools on
-// a single registry-listed server. Tightened to 2s so a slow/unreachable
-// server cannot stall every CLI command — a healthy MCP endpoint negotiates
-// well under a second. See issue #119.
-const defaultPerServerDiscoveryTimeout = 2 * time.Second
-
 func (s *Service) DiscoverAllRuntime(ctx context.Context, servers []market.ServerDescriptor) ([]RuntimeServer, []RuntimeFailure) {
-	type discoveryResult struct {
-		server  RuntimeServer
-		failure *RuntimeFailure
-	}
-
-	perServerTimeout := defaultPerServerDiscoveryTimeout
-	if s.PerServerTimeout > 0 {
-		perServerTimeout = s.PerServerTimeout
-	}
-
-	filtered := make([]market.ServerDescriptor, 0, len(servers))
-	for _, srv := range servers {
-		if !srv.CLI.Skip {
-			filtered = append(filtered, srv)
-		}
-	}
-	if len(filtered) == 0 {
-		return nil, nil
-	}
-
-	ch := make(chan discoveryResult, len(filtered))
-	var wg sync.WaitGroup
-	for _, srv := range filtered {
-		wg.Add(1)
-		go func(server market.ServerDescriptor) {
-			defer wg.Done()
-			serverCtx, cancel := context.WithTimeout(ctx, perServerTimeout)
-			defer cancel()
-			start := time.Now()
-			rs, err := s.DiscoverServerRuntime(serverCtx, server)
-			elapsed := time.Since(start)
-			if err != nil {
-				if errors.Is(err, errCLIServerSkipped) {
-					return
-				}
-				if s.Logger != nil {
-					s.Logger.Warn("server_discovery_failed",
-						slog.String("server_key", server.Key),
-						slog.String("duration", elapsed.Truncate(time.Millisecond).String()),
-						slog.String("error", err.Error()),
-						slog.Bool("is_timeout", errors.Is(err, context.DeadlineExceeded)),
-					)
-				}
-				// Per-server sub-context timed out but parent is still alive:
-				// try cache fallback instead of reporting a hard failure.
-				if errors.Is(err, context.DeadlineExceeded) && ctx.Err() == nil {
-					if cached, cacheErr := s.loadServerFromCache(server); cacheErr == nil {
-						if s.Logger != nil {
-							s.Logger.Info("server_discovery_cache_fallback",
-								slog.String("server_key", server.Key),
-								slog.String("source", cached.Source),
-							)
-						}
-						ch <- discoveryResult{server: cached}
-						return
-					}
-				}
-				ch <- discoveryResult{failure: &RuntimeFailure{ServerKey: server.Key, Err: err}}
-				return
-			}
-			if s.Logger != nil {
-				s.Logger.Debug("server_discovery_ok",
-					slog.String("server_key", server.Key),
-					slog.String("duration", elapsed.Truncate(time.Millisecond).String()),
-					slog.String("source", rs.Source),
-				)
-			}
-			ch <- discoveryResult{server: rs}
-		}(srv)
-	}
-	go func() {
-		wg.Wait()
-		close(ch)
-	}()
-
-	results := make([]RuntimeServer, 0, len(filtered))
+	results := make([]RuntimeServer, 0, len(servers))
 	failures := make([]RuntimeFailure, 0)
-	for dr := range ch {
-		if dr.failure != nil {
-			failures = append(failures, *dr.failure)
-		} else {
-			results = append(results, dr.server)
+	for _, server := range servers {
+		if server.CLI.Skip {
+			continue
 		}
+		runtimeServer, err := s.DiscoverServerRuntime(ctx, server)
+		if err != nil {
+			if errors.Is(err, errCLIServerSkipped) {
+				continue
+			}
+			failures = append(failures, RuntimeFailure{
+				ServerKey: server.Key,
+				Err:       err,
+			})
+			continue
+		}
+		results = append(results, runtimeServer)
 	}
 	return results, failures
 }

-// loadServerFromCache tries to load a server's tools from cache, returning a
-// degraded RuntimeServer. Used as fallback when a per-server discovery timeout
-// fires but the parent context is still alive.
-func (s *Service) loadServerFromCache(server market.ServerDescriptor) (RuntimeServer, error) {
-	partition := s.partition()
-	snapshot, freshness, err := s.Cache.LoadTools(partition, server.Key)
-	if err != nil {
-		return RuntimeServer{}, err
-	}
-	server.NegotiatedProtocolVersion = snapshot.ProtocolVersion
-	server.Source = string(freshness) + "_cache"
-	server.Degraded = true
-	return RuntimeServer{
-		Server:                    server,
-		NegotiatedProtocolVersion: snapshot.ProtocolVersion,
-		Tools:                     snapshot.Tools,
-		Source:                    string(freshness) + "_cache",
-		Degraded:                  true,
-	}, nil
-}
-
 func (s *Service) DiscoverDetail(ctx context.Context, server market.ServerDescriptor) (market.DetailResponse, error) {
 	partition := s.partition()
 	var fetchErr error
@@ -20,8 +20,6 @@ import (
 	"fmt"
 	"io"
 	"strings"
-
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/config"
 )

 // Category represents a stable error class with a documented exit code.
@@ -200,31 +198,12 @@ func NewInternal(message string, opts ...Option) error {
 	return newError(CategoryInternal, message, opts...)
 }

-// ExitCoder is implemented by errors that provide their own exit code.
-// Edition-specific error types (e.g. PATError, CLIError) implement this
-// so the framework can resolve exit codes without importing edition packages.
-type ExitCoder interface {
-	ExitCode() int
-}
-
-// RawStderrError is implemented by errors that must output raw content
-// directly to stderr, bypassing all CLI formatting (e.g. "Error:" prefix).
-// PAT authorization errors use this to pass JSON through to the desktop runtime.
-type RawStderrError interface {
-	error
-	RawStderr() string
-}
-
 // ExitCode maps any error to a stable exit code.
 func ExitCode(err error) int {
 	var typed *Error
 	if stderrors.As(err, &typed) {
 		return typed.ExitCode()
 	}
-	var ec ExitCoder
-	if stderrors.As(err, &ec) {
-		return ec.ExitCode()
-	}
 	return 5
 }

@@ -278,7 +257,7 @@ func PrintJSON(w io.Writer, err error) error {
 				switch typed.ServerDiag.ServerErrorCode {
 				case "TOKEN_VERIFIED_FAILED", "CLI_ORG_NOT_AUTHORIZED":
 					errorPayload["friendly_hint"] = "该组织尚未开启 CLI 数据访问权限，请联系组织主管理员开启。"
-					errorPayload["action_url"] = config.GetDeveloperSettingsURL()
+					errorPayload["action_url"] = "https://open-dev.dingtalk.com/fe/old#/developerSettings"
 				}
 			}
 			if typed.ServerDiag.TechnicalDetail != "" {
@@ -344,7 +323,7 @@ func PrintHumanAt(w io.Writer, err error, v Verbosity) error {
 	switch typed.ServerDiag.ServerErrorCode {
 	case "TOKEN_VERIFIED_FAILED", "CLI_ORG_NOT_AUTHORIZED":
 		lines = append(lines, "Hint: 该组织尚未开启 CLI 数据访问权限，请联系组织主管理员开启。")
-		lines = append(lines, "Action: 开启地址: "+config.GetDeveloperSettingsURL())
+		lines = append(lines, "Action: 开启地址: https://open-dev.dingtalk.com/fe/old#/developerSettings")
 	}

 	if len(typed.Actions) > 0 {
@@ -1,59 +0,0 @@
-package errors
-
-import (
-	stderrors "errors"
-	"strings"
-	"testing"
-)
-
-type stubExitCoder struct{ code int }
-
-func (s *stubExitCoder) Error() string { return "stub" }
-func (s *stubExitCoder) ExitCode() int { return s.code }
-
-type stubRawStderr struct{ raw string }
-
-func (s *stubRawStderr) Error() string     { return s.raw }
-func (s *stubRawStderr) RawStderr() string { return s.raw }
-
-func TestExitCode_ExitCoderInterface(t *testing.T) {
-	t.Parallel()
-
-	cases := []struct {
-		name string
-		err  error
-		want int
-	}{
-		{"exit code 4 via interface", &stubExitCoder{code: 4}, 4},
-		{"exit code 1 via interface", &stubExitCoder{code: 1}, 1},
-		{"framework Error takes precedence", NewAPI("api"), 1},
-		{"plain error falls back to 5", stderrors.New("plain"), 5},
-	}
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			if got := ExitCode(tc.err); got != tc.want {
-				t.Errorf("ExitCode() = %d, want %d", got, tc.want)
-			}
-		})
-	}
-}
-
-func TestExitCode_WrappedExitCoder(t *testing.T) {
-	t.Parallel()
-	wrapped := stderrors.Join(stderrors.New("context"), &stubExitCoder{code: 4})
-	if got := ExitCode(wrapped); got != 4 {
-		t.Errorf("ExitCode(wrapped) = %d, want 4", got)
-	}
-}
-
-func TestRawStderrError_Interface(t *testing.T) {
-	t.Parallel()
-	err := &stubRawStderr{raw: `{"code":"PAT_LOW_RISK_NO_PERMISSION"}`}
-	var raw RawStderrError
-	if !stderrors.As(err, &raw) {
-		t.Fatal("expected errors.As to match RawStderrError")
-	}
-	if !strings.Contains(raw.RawStderr(), "PAT_LOW_RISK_NO_PERMISSION") {
-		t.Errorf("RawStderr() = %q, want PAT code", raw.RawStderr())
-	}
-}
@@ -1,289 +0,0 @@
-// Copyright 2026 Alibaba Group
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package errors
-
-import (
-	"encoding/json"
-	stderrors "errors"
-	"fmt"
-	"strings"
-)
-
-// ExitCodePermission is the process exit code for PAT authorisation failures.
-const ExitCodePermission = 4
-
-// PATError represents a PAT (Personal Action Token) authorization failure
-// that should be passed through to stderr as raw JSON without any CLI-layer
-// wrapping.  The host application (e.g. RewindDesktop) parses the JSON to
-// display its own authorisation UI.
-type PATError struct {
-	RawJSON string
-}
-
-func (e *PATError) Error() string { return e.RawJSON }
-
-// ExitCode returns the documented exit code for PAT permission errors (4).
-func (e *PATError) ExitCode() int { return ExitCodePermission }
-
-// RawStderr returns the raw JSON to be written directly to stderr.
-func (e *PATError) RawStderr() string { return e.RawJSON }
-
-// patNoPermissionCodes are PAT error codes that should be passed through
-// as transparent PATError without CLI-level wrapping.
-var patNoPermissionCodes = map[string]bool{
-	"PAT_NO_PERMISSION":             true,
-	"PAT_LOW_RISK_NO_PERMISSION":    true,
-	"PAT_MEDIUM_RISK_NO_PERMISSION": true,
-	"PAT_HIGH_RISK_NO_PERMISSION":   true,
-}
-
-// patAuthRequiredCodes are error codes that trigger the PAT authorization
-// flow (e.g. the server auto-created a CLI app and returned auth details).
-var patAuthRequiredCodes = map[string]bool{
-	"AGENT_CODE_NOT_EXISTS": true,
-}
-
-// IsPATError reports whether err is a *PATError.
-func IsPATError(err error) bool {
-	_, ok := err.(*PATError)
-	return ok
-}
-
-// IsPATNoPermissionCode reports whether code is a known PAT permission error code.
-func IsPATNoPermissionCode(code string) bool {
-	return patNoPermissionCodes[code]
-}
-
-// ---- DWS gateway auth errors (shared between PAT & general auth) ----------
-
-// dwsGatewayErrors is the set of DWS gateway-level auth error codes.
-var dwsGatewayErrors = map[string]bool{
-	"DWS_SERVICE_UNAUTHORIZED": true,
-	"DWS_AUTH_SERVICE_FAILED":  true,
-}
-
-// getDWSGatewayErrorCode extracts a DWS gateway error code from errBody
-// (supports both errorCode and error_code field names).
-func getDWSGatewayErrorCode(errBody map[string]any) (string, bool) {
-	for _, key := range []string{"errorCode", "error_code"} {
-		if code, ok := errBody[key].(string); ok && dwsGatewayErrors[code] {
-			return code, true
-		}
-	}
-	return "", false
-}
-
-// isNotLoggedInError checks if the error body indicates missing authentication.
-func isNotLoggedInError(body map[string]any) bool {
-	if errMsg, ok := body["error"].(string); ok {
-		if strings.Contains(errMsg, "Missing service_id or access_key") {
-			return true
-		}
-	}
-	return false
-}
-
-// isBusinessError checks if a parsed JSON body represents a business-level error.
-func isBusinessError(body map[string]any) bool {
-	if _, ok := body["error"].(string); ok {
-		return true
-	}
-	if v, ok := body["success"].(bool); ok && !v {
-		return true
-	}
-	if v, ok := body["success"].(string); ok && strings.EqualFold(v, "false") {
-		return true
-	}
-	return false
-}
-
-// ---- Classification functions -----------------------------------------------
-
-// ClassifyToolResultContent checks a raw MCP tool result content map for
-// DWS gateway auth errors and PAT permission error codes.  This is intended
-// for use as the edition.Hooks.ClassifyToolResult callback so the framework's
-// runner returns a typed error before its generic business-error classification.
-//
-// Check order: DWS gateway auth > PAT permission.
-func ClassifyToolResultContent(content map[string]any) error {
-	if _, ok := getDWSGatewayErrorCode(content); ok {
-		raw, _ := json.Marshal(content)
-		return NewAuth(string(raw),
-			WithReason("gateway_auth_expired"),
-			WithHint(authExpiredHint()),
-		)
-	}
-	for _, key := range []string{"code", "errorCode"} {
-		if code, ok := content[key].(string); ok && patNoPermissionCodes[code] {
-			return &PATError{RawJSON: cleanPATJSON(content, code)}
-		}
-	}
-	return nil
-}
-
-// ClassifyMCPResponseText classifies a text response returned by an MCP tool call.
-// Returns a typed error for known gateway auth failures, PAT interceptions,
-// and business-level errors embedded in HTTP-200 JSON bodies.
-//
-// Check order: DWS gateway > PAT permission > generic business error.
-func ClassifyMCPResponseText(text string) error {
-	var body map[string]any
-	if json.Unmarshal([]byte(text), &body) != nil {
-		return nil
-	}
-
-	if _, ok := getDWSGatewayErrorCode(body); ok {
-		return NewAuth(text,
-			WithReason("gateway_auth_expired"),
-			WithHint(authExpiredHint()),
-		)
-	}
-
-	if isNotLoggedInError(body) {
-		return NewAuth("当前未登录",
-			WithReason("not_configured"),
-			WithHint(notLoggedInHint()),
-			WithActions("dws auth login"),
-		)
-	}
-
-	for _, key := range []string{"code", "errorCode"} {
-		if code, ok := body[key].(string); ok && patNoPermissionCodes[code] {
-			return &PATError{RawJSON: cleanPATJSON(body, code)}
-		}
-	}
-
-	if isBusinessError(body) {
-		return NewAPI(text,
-			WithReason("business_error"),
-			WithHint(suggestForBusinessErrorText(body)),
-		)
-	}
-
-	return nil
-}
-
-// ---- Hints -----------------------------------------------------------------
-
-func authExpiredHint() string {
-	return "Re-authenticate: dws auth login"
-}
-
-func notLoggedInHint() string {
-	return "请先登录：dws auth login"
-}
-
-func suggestForBusinessErrorText(body map[string]any) string {
-	msg := ""
-	if v, ok := body["errorMsg"].(string); ok {
-		msg = v
-	} else if v, ok := body["message"].(string); ok {
-		msg = v
-	} else if v, ok := body["error"].(string); ok {
-		msg = v
-	}
-	switch {
-	case strings.Contains(msg, "搜索内容不能为空"):
-		return "请提供非空搜索关键词: dws doc search --query \"关键词\""
-	case strings.Contains(msg, "User has no permission to access this email"):
-		return "请确认邮箱地址正确，查看可用邮箱: dws mail mailbox list"
-	case strings.Contains(msg, "频率超限") || strings.Contains(msg, "rate limit"):
-		return "API rate limit exceeded, wait a moment and retry"
-	case strings.Contains(msg, "参数错误") || strings.Contains(msg, "param error"):
-		return "Check input parameters. Use --help for available flags"
-	default:
-		return "MCP tool returned a business error; check parameters and refer to skill documentation."
-	}
-}
-
-// ---- PAT JSON helpers ------------------------------------------------------
-
-var patTopLevelStrip = map[string]bool{
-	"success": true, "code": true, "errorCode": true, "error_code": true,
-	"message": true, "error": true, "trace_id": true, "class": true,
-}
-
-func cleanPATJSON(body map[string]any, code string) string {
-	out := map[string]any{
-		"success": false,
-		"code":    code,
-	}
-	if data, ok := body["data"]; ok {
-		out["data"] = stripClassFields(data)
-	} else {
-		fallback := map[string]any{}
-		for k, v := range body {
-			if !patTopLevelStrip[k] {
-				fallback[k] = v
-			}
-		}
-		if len(fallback) > 0 {
-			out["data"] = stripClassFields(fallback)
-		}
-	}
-	b, err := json.MarshalIndent(out, "", "  ")
-	if err != nil {
-		return fmt.Sprintf(`{"success":false,"code":"%s"}`, code)
-	}
-	return string(b)
-}
-
-// ---- Runner adapter functions ------------------------------------------------
-// These match the function signatures referenced by runner.go's PAT check
-// framework (ClassifyPatAuthCheck / AsPatAuthCheckError).
-
-// ClassifyPatAuthCheck is the open-source fallback that checks a tool-call
-// Content map for PAT permission codes and auth-required codes.  Returns a
-// non-nil *PATError when the content carries a recognised PAT/auth error.
-func ClassifyPatAuthCheck(content map[string]any) *PATError {
-	for _, key := range []string{"code", "errorCode"} {
-		if code, ok := content[key].(string); ok {
-			if patNoPermissionCodes[code] || patAuthRequiredCodes[code] {
-				return &PATError{RawJSON: cleanPATJSON(content, code)}
-			}
-		}
-	}
-	return nil
-}
-
-// AsPatAuthCheckError extracts a *PATError from an error chain.
-func AsPatAuthCheckError(err error) *PATError {
-	var patErr *PATError
-	if stderrors.As(err, &patErr) {
-		return patErr
-	}
-	return nil
-}
-
-func stripClassFields(v any) any {
-	switch val := v.(type) {
-	case map[string]any:
-		clean := make(map[string]any, len(val))
-		for k, item := range val {
-			if k == "class" {
-				continue
-			}
-			clean[k] = stripClassFields(item)
-		}
-		return clean
-	case []any:
-		clean := make([]any, len(val))
-		for i, item := range val {
-			clean[i] = stripClassFields(item)
-		}
-		return clean
-	default:
-		return v
-	}
-}
@@ -1,521 +0,0 @@
-// Copyright 2026 Alibaba Group
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package errors
-
-import (
-	stderrors "errors"
-	"strings"
-	"testing"
-)
-
-// ---------------------------------------------------------------------------
-// PATError basic behaviour
-// ---------------------------------------------------------------------------
-
-func TestPATError_Implements(t *testing.T) {
-	t.Parallel()
-	raw := `{"success":false,"code":"PAT_NO_PERMISSION"}`
-	pe := &PATError{RawJSON: raw}
-
-	if pe.Error() != raw {
-		t.Errorf("Error() = %q, want %q", pe.Error(), raw)
-	}
-	if pe.ExitCode() != ExitCodePermission {
-		t.Errorf("ExitCode() = %d, want %d", pe.ExitCode(), ExitCodePermission)
-	}
-	if pe.RawStderr() != raw {
-		t.Errorf("RawStderr() = %q, want %q", pe.RawStderr(), raw)
-	}
-}
-
-func TestIsPATError_True(t *testing.T) {
-	t.Parallel()
-	err := &PATError{RawJSON: "{}"}
-	if !IsPATError(err) {
-		t.Fatal("expected IsPATError to return true for *PATError")
-	}
-}
-
-func TestIsPATError_False(t *testing.T) {
-	t.Parallel()
-	err := stderrors.New("some other error")
-	if IsPATError(err) {
-		t.Fatal("expected IsPATError to return false for non-PATError")
-	}
-}
-
-// ---------------------------------------------------------------------------
-// IsPATNoPermissionCode
-// ---------------------------------------------------------------------------
-
-func TestIsPATNoPermissionCode(t *testing.T) {
-	t.Parallel()
-	cases := []struct {
-		code string
-		want bool
-	}{
-		{"PAT_NO_PERMISSION", true},
-		{"PAT_LOW_RISK_NO_PERMISSION", true},
-		{"PAT_MEDIUM_RISK_NO_PERMISSION", true},
-		{"PAT_HIGH_RISK_NO_PERMISSION", true},
-		{"AGENT_CODE_NOT_EXISTS", false},
-		{"UNKNOWN_CODE", false},
-		{"", false},
-	}
-	for _, tc := range cases {
-		if got := IsPATNoPermissionCode(tc.code); got != tc.want {
-			t.Errorf("IsPATNoPermissionCode(%q) = %v, want %v", tc.code, got, tc.want)
-		}
-	}
-}
-
-// ---------------------------------------------------------------------------
-// getDWSGatewayErrorCode
-// ---------------------------------------------------------------------------
-
-func TestGetDWSGatewayErrorCode_ErrorCode(t *testing.T) {
-	t.Parallel()
-	body := map[string]any{"errorCode": "DWS_SERVICE_UNAUTHORIZED"}
-	code, ok := getDWSGatewayErrorCode(body)
-	if !ok || code != "DWS_SERVICE_UNAUTHORIZED" {
-		t.Errorf("got (%q, %v), want (DWS_SERVICE_UNAUTHORIZED, true)", code, ok)
-	}
-}
-
-func TestGetDWSGatewayErrorCode_ErrorCodeUnderscore(t *testing.T) {
-	t.Parallel()
-	body := map[string]any{"error_code": "DWS_AUTH_SERVICE_FAILED"}
-	code, ok := getDWSGatewayErrorCode(body)
-	if !ok || code != "DWS_AUTH_SERVICE_FAILED" {
-		t.Errorf("got (%q, %v), want (DWS_AUTH_SERVICE_FAILED, true)", code, ok)
-	}
-}
-
-func TestGetDWSGatewayErrorCode_Unknown(t *testing.T) {
-	t.Parallel()
-	body := map[string]any{"errorCode": "SOME_OTHER_ERROR"}
-	_, ok := getDWSGatewayErrorCode(body)
-	if ok {
-		t.Fatal("expected ok=false for unknown error code")
-	}
-}
-
-func TestGetDWSGatewayErrorCode_Empty(t *testing.T) {
-	t.Parallel()
-	body := map[string]any{}
-	_, ok := getDWSGatewayErrorCode(body)
-	if ok {
-		t.Fatal("expected ok=false for empty body")
-	}
-}
-
-// ---------------------------------------------------------------------------
-// isNotLoggedInError
-// ---------------------------------------------------------------------------
-
-func TestIsNotLoggedInError_True(t *testing.T) {
-	t.Parallel()
-	body := map[string]any{"error": "Missing service_id or access_key in request headers"}
-	if !isNotLoggedInError(body) {
-		t.Fatal("expected true for Missing service_id message")
-	}
-}
-
-func TestIsNotLoggedInError_False(t *testing.T) {
-	t.Parallel()
-	body := map[string]any{"error": "something else happened"}
-	if isNotLoggedInError(body) {
-		t.Fatal("expected false for unrelated error message")
-	}
-}
-
-func TestIsNotLoggedInError_NoErrorField(t *testing.T) {
-	t.Parallel()
-	body := map[string]any{"message": "Missing service_id or access_key"}
-	if isNotLoggedInError(body) {
-		t.Fatal("expected false when error field is absent")
-	}
-}
-
-// ---------------------------------------------------------------------------
-// isBusinessError
-// ---------------------------------------------------------------------------
-
-func TestIsBusinessError_ErrorField(t *testing.T) {
-	t.Parallel()
-	body := map[string]any{"error": "some error message"}
-	if !isBusinessError(body) {
-		t.Fatal("expected true when 'error' field is present")
-	}
-}
-
-func TestIsBusinessError_SuccessBoolFalse(t *testing.T) {
-	t.Parallel()
-	body := map[string]any{"success": false}
-	if !isBusinessError(body) {
-		t.Fatal("expected true when success=false (bool)")
-	}
-}
-
-func TestIsBusinessError_SuccessStringFalse(t *testing.T) {
-	t.Parallel()
-	body := map[string]any{"success": "False"}
-	if !isBusinessError(body) {
-		t.Fatal("expected true when success=\"False\" (string)")
-	}
-}
-
-func TestIsBusinessError_SuccessTrue(t *testing.T) {
-	t.Parallel()
-	body := map[string]any{"success": true, "data": "ok"}
-	if isBusinessError(body) {
-		t.Fatal("expected false when success=true")
-	}
-}
-
-func TestIsBusinessError_EmptyBody(t *testing.T) {
-	t.Parallel()
-	body := map[string]any{"data": "hello"}
-	if isBusinessError(body) {
-		t.Fatal("expected false for body without error indicators")
-	}
-}
-
-// ---------------------------------------------------------------------------
-// ClassifyToolResultContent
-// ---------------------------------------------------------------------------
-
-func TestClassifyToolResultContent_GatewayAuth(t *testing.T) {
-	t.Parallel()
-	content := map[string]any{"errorCode": "DWS_SERVICE_UNAUTHORIZED", "message": "expired"}
-	err := ClassifyToolResultContent(content)
-	if err == nil {
-		t.Fatal("expected non-nil error for gateway auth")
-	}
-	var typed *Error
-	if !stderrors.As(err, &typed) {
-		t.Fatalf("expected *Error, got %T", err)
-	}
-	if typed.Category != CategoryAuth {
-		t.Errorf("Category = %v, want %v", typed.Category, CategoryAuth)
-	}
-	if typed.Reason != "gateway_auth_expired" {
-		t.Errorf("Reason = %q, want gateway_auth_expired", typed.Reason)
-	}
-}
-
-func TestClassifyToolResultContent_PATPermission(t *testing.T) {
-	t.Parallel()
-	content := map[string]any{
-		"code": "PAT_NO_PERMISSION",
-		"data": map[string]any{"desc": "需要授权"},
-	}
-	err := ClassifyToolResultContent(content)
-	if err == nil {
-		t.Fatal("expected non-nil error for PAT permission")
-	}
-	var patErr *PATError
-	if !stderrors.As(err, &patErr) {
-		t.Fatalf("expected *PATError, got %T", err)
-	}
-	if !strings.Contains(patErr.RawJSON, "PAT_NO_PERMISSION") {
-		t.Errorf("RawJSON should contain PAT_NO_PERMISSION, got: %s", patErr.RawJSON)
-	}
-}
-
-func TestClassifyToolResultContent_NoError(t *testing.T) {
-	t.Parallel()
-	content := map[string]any{"success": true, "data": "ok"}
-	if err := ClassifyToolResultContent(content); err != nil {
-		t.Fatalf("expected nil error, got %v", err)
-	}
-}
-
-// ---------------------------------------------------------------------------
-// ClassifyMCPResponseText
-// ---------------------------------------------------------------------------
-
-func TestClassifyMCPResponseText_GatewayAuth(t *testing.T) {
-	t.Parallel()
-	text := `{"errorCode":"DWS_SERVICE_UNAUTHORIZED","message":"token expired"}`
-	err := ClassifyMCPResponseText(text)
-	if err == nil {
-		t.Fatal("expected non-nil error")
-	}
-	var typed *Error
-	if !stderrors.As(err, &typed) {
-		t.Fatalf("expected *Error, got %T", err)
-	}
-	if typed.Reason != "gateway_auth_expired" {
-		t.Errorf("Reason = %q, want gateway_auth_expired", typed.Reason)
-	}
-}
-
-func TestClassifyMCPResponseText_NotLoggedIn(t *testing.T) {
-	t.Parallel()
-	text := `{"error":"Missing service_id or access_key in headers"}`
-	err := ClassifyMCPResponseText(text)
-	if err == nil {
-		t.Fatal("expected non-nil error")
-	}
-	var typed *Error
-	if !stderrors.As(err, &typed) {
-		t.Fatalf("expected *Error, got %T", err)
-	}
-	if typed.Reason != "not_configured" {
-		t.Errorf("Reason = %q, want not_configured", typed.Reason)
-	}
-}
-
-func TestClassifyMCPResponseText_PATPermission(t *testing.T) {
-	t.Parallel()
-	text := `{"code":"PAT_HIGH_RISK_NO_PERMISSION","data":{"desc":"high risk"}}`
-	err := ClassifyMCPResponseText(text)
-	if err == nil {
-		t.Fatal("expected non-nil error")
-	}
-	var patErr *PATError
-	if !stderrors.As(err, &patErr) {
-		t.Fatalf("expected *PATError, got %T", err)
-	}
-	if !strings.Contains(patErr.RawJSON, "PAT_HIGH_RISK_NO_PERMISSION") {
-		t.Errorf("RawJSON should contain code, got: %s", patErr.RawJSON)
-	}
-}
-
-func TestClassifyMCPResponseText_BusinessError(t *testing.T) {
-	t.Parallel()
-	text := `{"success":false,"errorMsg":"搜索内容不能为空"}`
-	err := ClassifyMCPResponseText(text)
-	if err == nil {
-		t.Fatal("expected non-nil error")
-	}
-	var typed *Error
-	if !stderrors.As(err, &typed) {
-		t.Fatalf("expected *Error, got %T", err)
-	}
-	if typed.Reason != "business_error" {
-		t.Errorf("Reason = %q, want business_error", typed.Reason)
-	}
-	if !strings.Contains(typed.Hint, "搜索关键词") {
-		t.Errorf("Hint should contain search suggestion, got: %s", typed.Hint)
-	}
-}
-
-func TestClassifyMCPResponseText_InvalidJSON(t *testing.T) {
-	t.Parallel()
-	text := "not json at all"
-	if err := ClassifyMCPResponseText(text); err != nil {
-		t.Fatalf("expected nil for invalid JSON, got %v", err)
-	}
-}
-
-func TestClassifyMCPResponseText_NoError(t *testing.T) {
-	t.Parallel()
-	text := `{"success":true,"data":"hello"}`
-	if err := ClassifyMCPResponseText(text); err != nil {
-		t.Fatalf("expected nil for success response, got %v", err)
-	}
-}
-
-// ---------------------------------------------------------------------------
-// ClassifyPatAuthCheck
-// ---------------------------------------------------------------------------
-
-func TestClassifyPatAuthCheck_PATNoPermission(t *testing.T) {
-	t.Parallel()
-	content := map[string]any{"code": "PAT_NO_PERMISSION", "data": map[string]any{"flowId": "f1"}}
-	patErr := ClassifyPatAuthCheck(content)
-	if patErr == nil {
-		t.Fatal("expected non-nil *PATError")
-	}
-	if !strings.Contains(patErr.RawJSON, "PAT_NO_PERMISSION") {
-		t.Errorf("RawJSON should contain code, got: %s", patErr.RawJSON)
-	}
-}
-
-func TestClassifyPatAuthCheck_AgentCodeNotExists(t *testing.T) {
-	t.Parallel()
-	content := map[string]any{"errorCode": "AGENT_CODE_NOT_EXISTS", "data": map[string]any{"clientId": "c1"}}
-	patErr := ClassifyPatAuthCheck(content)
-	if patErr == nil {
-		t.Fatal("expected non-nil *PATError for AGENT_CODE_NOT_EXISTS")
-	}
-	if !strings.Contains(patErr.RawJSON, "AGENT_CODE_NOT_EXISTS") {
-		t.Errorf("RawJSON should contain AGENT_CODE_NOT_EXISTS, got: %s", patErr.RawJSON)
-	}
-}
-
-func TestClassifyPatAuthCheck_NoMatch(t *testing.T) {
-	t.Parallel()
-	content := map[string]any{"code": "SOME_BUSINESS_ERROR", "message": "oops"}
-	if patErr := ClassifyPatAuthCheck(content); patErr != nil {
-		t.Fatalf("expected nil, got %v", patErr)
-	}
-}
-
-func TestClassifyPatAuthCheck_EmptyContent(t *testing.T) {
-	t.Parallel()
-	content := map[string]any{}
-	if patErr := ClassifyPatAuthCheck(content); patErr != nil {
-		t.Fatalf("expected nil for empty content, got %v", patErr)
-	}
-}
-
-// ---------------------------------------------------------------------------
-// AsPatAuthCheckError
-// ---------------------------------------------------------------------------
-
-func TestAsPatAuthCheckError_Wrapped(t *testing.T) {
-	t.Parallel()
-	inner := &PATError{RawJSON: `{"code":"PAT_NO_PERMISSION"}`}
-	wrapped := stderrors.Join(stderrors.New("context"), inner)
-	got := AsPatAuthCheckError(wrapped)
-	if got == nil {
-		t.Fatal("expected non-nil *PATError from wrapped error")
-	}
-	if got.RawJSON != inner.RawJSON {
-		t.Errorf("RawJSON = %q, want %q", got.RawJSON, inner.RawJSON)
-	}
-}
-
-func TestAsPatAuthCheckError_NotPAT(t *testing.T) {
-	t.Parallel()
-	err := stderrors.New("just a plain error")
-	if got := AsPatAuthCheckError(err); got != nil {
-		t.Fatalf("expected nil for non-PAT error, got %v", got)
-	}
-}
-
-// ---------------------------------------------------------------------------
-// cleanPATJSON
-// ---------------------------------------------------------------------------
-
-func TestCleanPATJSON_WithData(t *testing.T) {
-	t.Parallel()
-	body := map[string]any{
-		"success": false,
-		"code":    "PAT_NO_PERMISSION",
-		"data": map[string]any{
-			"desc":   "需要授权",
-			"flowId": "f123",
-			"class":  "com.foo.Bar",
-		},
-	}
-	result := cleanPATJSON(body, "PAT_NO_PERMISSION")
-	if !strings.Contains(result, "PAT_NO_PERMISSION") {
-		t.Errorf("expected code in output, got: %s", result)
-	}
-	if !strings.Contains(result, "flowId") {
-		t.Errorf("expected flowId in data, got: %s", result)
-	}
-	if strings.Contains(result, "class") {
-		t.Errorf("expected class field to be stripped, got: %s", result)
-	}
-}
-
-func TestCleanPATJSON_WithoutData(t *testing.T) {
-	t.Parallel()
-	body := map[string]any{
-		"success": false,
-		"code":    "PAT_NO_PERMISSION",
-		"message": "no permission",
-		"extra":   "value",
-	}
-	result := cleanPATJSON(body, "PAT_NO_PERMISSION")
-	if !strings.Contains(result, "extra") {
-		t.Errorf("expected extra field in fallback data, got: %s", result)
-	}
-	// Top-level stripped fields should not appear
-	if strings.Contains(result, `"message"`) {
-		t.Errorf("expected message to be stripped from top level, got: %s", result)
-	}
-}
-
-// ---------------------------------------------------------------------------
-// stripClassFields
-// ---------------------------------------------------------------------------
-
-func TestStripClassFields_Map(t *testing.T) {
-	t.Parallel()
-	input := map[string]any{
-		"name":  "test",
-		"class": "com.foo.Bar",
-		"nested": map[string]any{
-			"value": 42,
-			"class": "com.baz.Qux",
-		},
-	}
-	result := stripClassFields(input).(map[string]any)
-	if _, ok := result["class"]; ok {
-		t.Error("top-level class should be removed")
-	}
-	nested := result["nested"].(map[string]any)
-	if _, ok := nested["class"]; ok {
-		t.Error("nested class should be removed")
-	}
-	if nested["value"] != 42 {
-		t.Errorf("nested value should be preserved, got %v", nested["value"])
-	}
-}
-
-func TestStripClassFields_Array(t *testing.T) {
-	t.Parallel()
-	input := []any{
-		map[string]any{"id": 1, "class": "Foo"},
-		map[string]any{"id": 2},
-	}
-	result := stripClassFields(input).([]any)
-	first := result[0].(map[string]any)
-	if _, ok := first["class"]; ok {
-		t.Error("class in array element should be removed")
-	}
-	if first["id"] != 1 {
-		t.Error("other fields in array element should be preserved")
-	}
-}
-
-func TestStripClassFields_Scalar(t *testing.T) {
-	t.Parallel()
-	if stripClassFields("hello") != "hello" {
-		t.Error("scalar string should pass through unchanged")
-	}
-	if stripClassFields(42) != 42 {
-		t.Error("scalar int should pass through unchanged")
-	}
-}
-
-// ---------------------------------------------------------------------------
-// suggestForBusinessErrorText
-// ---------------------------------------------------------------------------
-
-func TestSuggestForBusinessErrorText(t *testing.T) {
-	t.Parallel()
-	cases := []struct {
-		body     map[string]any
-		contains string
-	}{
-		{map[string]any{"errorMsg": "搜索内容不能为空"}, "搜索关键词"},
-		{map[string]any{"message": "User has no permission to access this email"}, "邮箱"},
-		{map[string]any{"error": "频率超限"}, "rate limit"},
-		{map[string]any{"errorMsg": "参数错误"}, "parameters"},
-		{map[string]any{"error": "unknown"}, "business error"},
-	}
-	for _, tc := range cases {
-		hint := suggestForBusinessErrorText(tc.body)
-		if !strings.Contains(strings.ToLower(hint), strings.ToLower(tc.contains)) {
-			t.Errorf("suggestForBusinessErrorText(%v) = %q, want to contain %q", tc.body, hint, tc.contains)
-		}
-	}
-}
@@ -20,27 +20,9 @@ import (
 	"strings"

 	registryassets "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/registry"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/configmeta"
 	"gopkg.in/yaml.v3"
 )

-func init() {
-	configmeta.Register(configmeta.ConfigItem{
-		Name:        "DWS_SKILLS_PERSONAS_FILE",
-		Category:    configmeta.CategoryDebug,
-		Description: "覆盖内置 personas.yaml 的本地文件路径",
-		Example:     "/path/to/personas.yaml",
-		Hidden:      true,
-	})
-	configmeta.Register(configmeta.ConfigItem{
-		Name:        "DWS_SKILLS_RECIPES_FILE",
-		Category:    configmeta.CategoryDebug,
-		Description: "覆盖内置 recipes.yaml 的本地文件路径",
-		Example:     "/path/to/recipes.yaml",
-		Hidden:      true,
-	})
-}
-
 const (
 	PersonaRegistryPathEnv = "DWS_SKILLS_PERSONAS_FILE"
 	RecipeRegistryPathEnv  = "DWS_SKILLS_RECIPES_FILE"
@@ -26,9 +26,9 @@ import (
 	"time"

 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/cobracmd"
+	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/config"
 	apperrors "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/errors"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/executor"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/config"
 	"github.com/spf13/cobra"
 )

@@ -66,14 +66,7 @@ func (aitableHandler) Command(runner executor.Runner) *cobra.Command {
 			return cmd.Help()
 		},
 	}
-	base.AddCommand(
-		newAitableBaseListCommand(runner),
-		newAitableBaseSearchCommand(runner),
-		newAitableBaseGetCommand(runner),
-		newAitableBaseCreateCommand(runner),
-		newAitableBaseUpdateCommand(runner),
-		newAitableBaseDeleteCommand(runner),
-	)
+	base.AddCommand(newAitableBaseDeleteCommand(runner))

 	table := &cobra.Command{
 		Use:               "table",
@@ -85,12 +78,7 @@ func (aitableHandler) Command(runner executor.Runner) *cobra.Command {
 			return cmd.Help()
 		},
 	}
-	table.AddCommand(
-		newAitableTableGetCommand(runner),
-		newAitableTableCreateCommand(runner),
-		newAitableTableUpdateCommand(runner),
-		newAitableTableDeleteCommand(runner),
-	)
+	table.AddCommand(newAitableTableDeleteCommand(runner))

 	field := &cobra.Command{
 		Use:               "field",
@@ -102,12 +90,7 @@ func (aitableHandler) Command(runner executor.Runner) *cobra.Command {
 			return cmd.Help()
 		},
 	}
-	field.AddCommand(
-		newAitableFieldGetCommand(runner),
-		newAitableFieldCreateCommand(runner),
-		newAitableFieldUpdateCommand(runner),
-		newAitableFieldDeleteCommand(runner),
-	)
+	field.AddCommand(newAitableFieldDeleteCommand(runner))

 	record := &cobra.Command{
 		Use:               "record",
@@ -119,24 +102,7 @@ func (aitableHandler) Command(runner executor.Runner) *cobra.Command {
 			return cmd.Help()
 		},
 	}
-	record.AddCommand(
-		newAitableRecordQueryCommand(runner),
-		newAitableRecordCreateCommand(runner),
-		newAitableRecordUpdateCommand(runner),
-		newAitableRecordDeleteCommand(runner),
-	)
-
-	template := &cobra.Command{
-		Use:               "template",
-		Short:             i18n.T("模板搜索"),
-		Args:              cobra.NoArgs,
-		TraverseChildren:  true,
-		DisableAutoGenTag: true,
-		RunE: func(cmd *cobra.Command, args []string) error {
-			return cmd.Help()
-		},
-	}
-	template.AddCommand(newAitableTemplateSearchCommand(runner))
+	record.AddCommand(newAitableRecordDeleteCommand(runner))

 	attachment := &cobra.Command{
 		Use:               "attachment",
@@ -148,12 +114,9 @@ func (aitableHandler) Command(runner executor.Runner) *cobra.Command {
 			return cmd.Help()
 		},
 	}
-	attachment.AddCommand(
-		newAITableAttachmentUploadCommand(runner),
-		newAITableUploadFileCommand(runner),
-	)
+	attachment.AddCommand(newAITableUploadFileCommand(runner))

-	root.AddCommand(base, table, field, record, template, attachment)
+	root.AddCommand(base, table, field, record, attachment)
 	return root
 }

@@ -1,727 +0,0 @@
-// Copyright 2026 Alibaba Group
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package helpers
-
-import (
-	"encoding/json"
-	"fmt"
-	"strings"
-
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/cobracmd"
-	apperrors "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/errors"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/executor"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/i18n"
-	"github.com/spf13/cobra"
-)
-
-// ── base ────────────────────────────────────────────────────
-
-func newAitableBaseListCommand(runner executor.Runner) *cobra.Command {
-	cmd := &cobra.Command{
-		Use:               "list",
-		Short:             i18n.T("获取 AI 表格列表"),
-		Example:           "  dws aitable base list\n  dws aitable base list --limit 5 --cursor NEXT_CURSOR",
-		Args:              cobra.NoArgs,
-		DisableAutoGenTag: true,
-		RunE: func(cmd *cobra.Command, args []string) error {
-			params := map[string]any{}
-			if limit, _ := cmd.Flags().GetInt("limit"); limit > 0 {
-				params["limit"] = limit
-			}
-			if cursor := aitableStringFlag(cmd, "cursor"); cursor != "" {
-				params["cursor"] = cursor
-			}
-			return runAitableTool(cmd, runner, "list_bases", params)
-		},
-	}
-	preferLegacyLeaf(cmd)
-	cmd.Flags().Int("limit", 0, i18n.T("每页数量"))
-	cmd.Flags().String("cursor", "", i18n.T("分页游标"))
-	return cmd
-}
-
-func newAitableBaseSearchCommand(runner executor.Runner) *cobra.Command {
-	cmd := &cobra.Command{
-		Use:               "search",
-		Short:             i18n.T("搜索 AI 表格"),
-		Example:           "  dws aitable base search --query 项目管理",
-		Args:              cobra.NoArgs,
-		DisableAutoGenTag: true,
-		RunE: func(cmd *cobra.Command, args []string) error {
-			query := aitableFlagOrFallback(cmd, "query", "keyword")
-			if query == "" {
-				return apperrors.NewValidation("--query is required")
-			}
-			params := map[string]any{"query": query}
-			if cursor := aitableStringFlag(cmd, "cursor"); cursor != "" {
-				params["cursor"] = cursor
-			}
-			return runAitableTool(cmd, runner, "search_bases", params)
-		},
-	}
-	preferLegacyLeaf(cmd)
-	cmd.Flags().String("query", "", i18n.T("Base 名称关键词 (必填)"))
-	cmd.Flags().String("keyword", "", i18n.T("--query 的别名"))
-	_ = cmd.Flags().MarkHidden("keyword")
-	cmd.Flags().String("cursor", "", i18n.T("分页游标"))
-	return cmd
-}
-
-func newAitableBaseGetCommand(runner executor.Runner) *cobra.Command {
-	cmd := &cobra.Command{
-		Use:               "get",
-		Short:             i18n.T("获取 AI 表格信息"),
-		Example:           "  dws aitable base get --base-id BASE_ID",
-		Args:              cobra.NoArgs,
-		DisableAutoGenTag: true,
-		RunE: func(cmd *cobra.Command, args []string) error {
-			baseID, err := aitableRequiredFlagOrFallback(cmd, "base-id", "base")
-			if err != nil {
-				return err
-			}
-			return runAitableTool(cmd, runner, "get_base", map[string]any{
-				"baseId": baseID,
-			})
-		},
-	}
-	preferLegacyLeaf(cmd)
-	cmd.Flags().String("base-id", "", i18n.T("Base ID (必填)"))
-	return cmd
-}
-
-func newAitableBaseCreateCommand(runner executor.Runner) *cobra.Command {
-	cmd := &cobra.Command{
-		Use:               "create",
-		Short:             i18n.T("创建 AI 表格"),
-		Example:           "  dws aitable base create --name 项目跟踪",
-		Args:              cobra.NoArgs,
-		DisableAutoGenTag: true,
-		RunE: func(cmd *cobra.Command, args []string) error {
-			name, err := aitableRequiredFlag(cmd, "name")
-			if err != nil {
-				return err
-			}
-			params := map[string]any{"baseName": name}
-			if templateID := aitableStringFlag(cmd, "template-id"); templateID != "" {
-				params["templateId"] = templateID
-			}
-			return runAitableTool(cmd, runner, "create_base", params)
-		},
-	}
-	preferLegacyLeaf(cmd)
-	cmd.Flags().String("name", "", i18n.T("Base 名称 (必填)"))
-	cmd.Flags().String("template-id", "", i18n.T("模板 ID"))
-	return cmd
-}
-
-func newAitableBaseUpdateCommand(runner executor.Runner) *cobra.Command {
-	cmd := &cobra.Command{
-		Use:               "update",
-		Short:             i18n.T("更新 AI 表格"),
-		Example:           "  dws aitable base update --base-id BASE_ID --name 新名称",
-		Args:              cobra.NoArgs,
-		DisableAutoGenTag: true,
-		RunE: func(cmd *cobra.Command, args []string) error {
-			baseID, err := aitableRequiredFlagOrFallback(cmd, "base-id", "base")
-			if err != nil {
-				return err
-			}
-			name, err := aitableRequiredFlag(cmd, "name")
-			if err != nil {
-				return err
-			}
-			params := map[string]any{
-				"baseId":      baseID,
-				"newBaseName": name,
-			}
-			if desc := aitableStringFlag(cmd, "desc"); desc != "" {
-				params["description"] = desc
-			}
-			return runAitableTool(cmd, runner, "update_base", params)
-		},
-	}
-	preferLegacyLeaf(cmd)
-	cmd.Flags().String("base-id", "", i18n.T("Base ID (必填)"))
-	cmd.Flags().String("name", "", i18n.T("新名称 (必填)"))
-	cmd.Flags().String("desc", "", i18n.T("备注文本"))
-	return cmd
-}
-
-// ── table ───────────────────────────────────────────────────
-
-func newAitableTableGetCommand(runner executor.Runner) *cobra.Command {
-	cmd := &cobra.Command{
-		Use:               "get",
-		Short:             i18n.T("获取数据表"),
-		Example:           "  dws aitable table get --base-id BASE_ID\n  dws aitable table get --base-id BASE_ID --table-ids tbl1,tbl2",
-		Args:              cobra.NoArgs,
-		DisableAutoGenTag: true,
-		RunE: func(cmd *cobra.Command, args []string) error {
-			baseID, err := aitableRequiredFlagOrFallback(cmd, "base-id", "base")
-			if err != nil {
-				return err
-			}
-			params := map[string]any{"baseId": baseID}
-			if tableIDs := aitableStringFlag(cmd, "table-ids"); tableIDs != "" {
-				params["tableIds"] = parseAitableCSVValues(tableIDs)
-			}
-			return runAitableTool(cmd, runner, "get_tables", params)
-		},
-	}
-	preferLegacyLeaf(cmd)
-	cmd.Flags().String("base-id", "", i18n.T("Base ID (必填)"))
-	cmd.Flags().String("table-ids", "", i18n.T("Table ID 列表，逗号分隔"))
-	return cmd
-}
-
-func newAitableTableCreateCommand(runner executor.Runner) *cobra.Command {
-	cmd := &cobra.Command{
-		Use:               "create",
-		Short:             i18n.T("创建数据表"),
-		Example:           "  dws aitable table create --base-id BASE_ID --name 任务表 --fields '[{\"fieldName\":\"名称\",\"type\":\"text\"}]'",
-		Args:              cobra.NoArgs,
-		DisableAutoGenTag: true,
-		RunE: func(cmd *cobra.Command, args []string) error {
-			baseID, err := aitableRequiredFlagOrFallback(cmd, "base-id", "base")
-			if err != nil {
-				return err
-			}
-			tableName := aitableFlagOrFallback(cmd, "name", "table-name")
-			if tableName == "" {
-				return apperrors.NewValidation("--name is required")
-			}
-			fieldsRaw, err := aitableRequiredFlag(cmd, "fields")
-			if err != nil {
-				return err
-			}
-			fields, err := parseAitableFieldsJSON(fieldsRaw)
-			if err != nil {
-				return err
-			}
-			return runAitableTool(cmd, runner, "create_table", map[string]any{
-				"baseId":    baseID,
-				"tableName": tableName,
-				"fields":    fields,
-			})
-		},
-	}
-	preferLegacyLeaf(cmd)
-	cmd.Flags().String("base-id", "", i18n.T("Base ID (必填)"))
-	cmd.Flags().String("name", "", i18n.T("表格名称 (必填)"))
-	cmd.Flags().String("table-name", "", i18n.T("--name 的别名"))
-	_ = cmd.Flags().MarkHidden("table-name")
-	cmd.Flags().String("fields", "", i18n.T("字段 JSON 数组 (必填)"))
-	return cmd
-}
-
-func newAitableTableUpdateCommand(runner executor.Runner) *cobra.Command {
-	cmd := &cobra.Command{
-		Use:               "update",
-		Short:             i18n.T("更新数据表"),
-		Example:           "  dws aitable table update --base-id BASE_ID --table-id TABLE_ID --name 新表名",
-		Args:              cobra.NoArgs,
-		DisableAutoGenTag: true,
-		RunE: func(cmd *cobra.Command, args []string) error {
-			baseID, err := aitableRequiredFlagOrFallback(cmd, "base-id", "base")
-			if err != nil {
-				return err
-			}
-			tableID, err := aitableRequiredFlag(cmd, "table-id")
-			if err != nil {
-				return err
-			}
-			name, err := aitableRequiredFlag(cmd, "name")
-			if err != nil {
-				return err
-			}
-			return runAitableTool(cmd, runner, "update_table", map[string]any{
-				"baseId":       baseID,
-				"tableId":      tableID,
-				"newTableName": name,
-			})
-		},
-	}
-	preferLegacyLeaf(cmd)
-	cmd.Flags().String("base-id", "", i18n.T("Base ID (必填)"))
-	cmd.Flags().String("table-id", "", i18n.T("Table ID (必填)"))
-	cmd.Flags().String("name", "", i18n.T("新表名 (必填)"))
-	return cmd
-}
-
-// ── field ───────────────────────────────────────────────────
-
-func newAitableFieldGetCommand(runner executor.Runner) *cobra.Command {
-	cmd := &cobra.Command{
-		Use:               "get",
-		Short:             i18n.T("获取字段详情"),
-		Example:           "  dws aitable field get --base-id BASE_ID --table-id TABLE_ID\n  dws aitable field get --base-id BASE_ID --table-id TABLE_ID --field-ids fld1,fld2",
-		Args:              cobra.NoArgs,
-		DisableAutoGenTag: true,
-		RunE: func(cmd *cobra.Command, args []string) error {
-			baseID, err := aitableRequiredFlagOrFallback(cmd, "base-id", "base")
-			if err != nil {
-				return err
-			}
-			tableID, err := aitableRequiredFlag(cmd, "table-id")
-			if err != nil {
-				return err
-			}
-			params := map[string]any{
-				"baseId":  baseID,
-				"tableId": tableID,
-			}
-			if fieldIDs := aitableStringFlag(cmd, "field-ids"); fieldIDs != "" {
-				params["fieldIds"] = parseAitableCSVValues(fieldIDs)
-			}
-			return runAitableTool(cmd, runner, "get_fields", params)
-		},
-	}
-	preferLegacyLeaf(cmd)
-	cmd.Flags().String("base-id", "", i18n.T("Base ID (必填)"))
-	cmd.Flags().String("table-id", "", i18n.T("Table ID (必填)"))
-	cmd.Flags().String("field-ids", "", i18n.T("Field ID 列表，逗号分隔"))
-	return cmd
-}
-
-func newAitableFieldCreateCommand(runner executor.Runner) *cobra.Command {
-	cmd := &cobra.Command{
-		Use:               "create",
-		Short:             i18n.T("创建字段"),
-		Example:           "  dws aitable field create --base-id BASE_ID --table-id TABLE_ID --fields '[{\"fieldName\":\"状态\",\"type\":\"singleSelect\"}]'",
-		Args:              cobra.NoArgs,
-		DisableAutoGenTag: true,
-		RunE: func(cmd *cobra.Command, args []string) error {
-			baseID, err := aitableRequiredFlagOrFallback(cmd, "base-id", "base")
-			if err != nil {
-				return err
-			}
-			tableID, err := aitableRequiredFlag(cmd, "table-id")
-			if err != nil {
-				return err
-			}
-
-			var fields []any
-			fieldsRaw := aitableStringFlag(cmd, "fields")
-			if fieldsRaw != "" {
-				fields, err = parseAitableFieldsJSON(fieldsRaw)
-				if err != nil {
-					return err
-				}
-			} else {
-				name, nameErr := aitableRequiredFlag(cmd, "name")
-				if nameErr != nil {
-					return apperrors.NewValidation("must specify either --fields or both --name and --type")
-				}
-				fieldType, typeErr := aitableRequiredFlag(cmd, "type")
-				if typeErr != nil {
-					return apperrors.NewValidation("must specify either --fields or both --name and --type")
-				}
-				field := map[string]any{
-					"fieldName": name,
-					"type":      fieldType,
-				}
-				if configRaw := aitableStringFlag(cmd, "config"); configRaw != "" {
-					configValue, err := parseAitableJSONObject(configRaw, "config")
-					if err != nil {
-						return err
-					}
-					field["config"] = configValue
-				}
-				fields = []any{field}
-			}
-
-			return runAitableTool(cmd, runner, "create_fields", map[string]any{
-				"baseId":  baseID,
-				"tableId": tableID,
-				"fields":  fields,
-			})
-		},
-	}
-	preferLegacyLeaf(cmd)
-	cmd.Flags().String("base-id", "", i18n.T("Base ID (必填)"))
-	cmd.Flags().String("table-id", "", i18n.T("Table ID (必填)"))
-	cmd.Flags().String("fields", "", i18n.T("字段 JSON 数组"))
-	cmd.Flags().String("name", "", i18n.T("单字段名称"))
-	cmd.Flags().String("type", "", i18n.T("单字段类型"))
-	cmd.Flags().String("config", "", i18n.T("字段配置 JSON"))
-	return cmd
-}
-
-func newAitableFieldUpdateCommand(runner executor.Runner) *cobra.Command {
-	cmd := &cobra.Command{
-		Use:               "update",
-		Short:             i18n.T("更新字段"),
-		Example:           "  dws aitable field update --base-id BASE_ID --table-id TABLE_ID --field-id FIELD_ID --name 新字段名",
-		Args:              cobra.NoArgs,
-		DisableAutoGenTag: true,
-		RunE: func(cmd *cobra.Command, args []string) error {
-			baseID, err := aitableRequiredFlagOrFallback(cmd, "base-id", "base")
-			if err != nil {
-				return err
-			}
-			tableID, err := aitableRequiredFlag(cmd, "table-id")
-			if err != nil {
-				return err
-			}
-			fieldID, err := aitableRequiredFlag(cmd, "field-id")
-			if err != nil {
-				return err
-			}
-			name := aitableStringFlag(cmd, "name")
-			configRaw := aitableStringFlag(cmd, "config")
-			if name == "" && configRaw == "" {
-				return apperrors.NewValidation("at least one of --name or --config is required")
-			}
-
-			params := map[string]any{
-				"baseId":  baseID,
-				"tableId": tableID,
-				"fieldId": fieldID,
-			}
-			if name != "" {
-				params["newFieldName"] = name
-			}
-			if configRaw != "" {
-				configValue, err := parseAitableJSONObject(configRaw, "config")
-				if err != nil {
-					return err
-				}
-				params["config"] = configValue
-			}
-			return runAitableTool(cmd, runner, "update_field", params)
-		},
-	}
-	preferLegacyLeaf(cmd)
-	cmd.Flags().String("base-id", "", i18n.T("Base ID (必填)"))
-	cmd.Flags().String("table-id", "", i18n.T("Table ID (必填)"))
-	cmd.Flags().String("field-id", "", i18n.T("Field ID (必填)"))
-	cmd.Flags().String("name", "", i18n.T("新字段名"))
-	cmd.Flags().String("config", "", i18n.T("字段配置 JSON"))
-	return cmd
-}
-
-// ── record ──────────────────────────────────────────────────
-
-func newAitableRecordQueryCommand(runner executor.Runner) *cobra.Command {
-	cmd := &cobra.Command{
-		Use:               "query",
-		Short:             i18n.T("查询记录"),
-		Example:           "  dws aitable record query --base-id BASE_ID --table-id TABLE_ID --keyword 关键词 --limit 50",
-		Args:              cobra.NoArgs,
-		DisableAutoGenTag: true,
-		RunE: func(cmd *cobra.Command, args []string) error {
-			baseID, err := aitableRequiredFlagOrFallback(cmd, "base-id", "base")
-			if err != nil {
-				return err
-			}
-			tableID, err := aitableRequiredFlag(cmd, "table-id")
-			if err != nil {
-				return err
-			}
-
-			params := map[string]any{
-				"baseId":  baseID,
-				"tableId": tableID,
-			}
-			if recordIDs := aitableStringFlag(cmd, "record-ids"); recordIDs != "" {
-				params["recordIds"] = parseAitableCSVValues(recordIDs)
-			}
-			if fieldIDs := aitableStringFlag(cmd, "field-ids"); fieldIDs != "" {
-				params["fieldIds"] = parseAitableCSVValues(fieldIDs)
-			}
-			if filtersRaw := aitableStringFlag(cmd, "filters"); filtersRaw != "" {
-				filters, err := parseAitableJSONObject(filtersRaw, "filters")
-				if err != nil {
-					return err
-				}
-				params["filters"] = filters
-			}
-			if sortRaw := aitableStringFlag(cmd, "sort"); sortRaw != "" {
-				sortValue, err := parseAitableJSONArray(sortRaw, "sort")
-				if err != nil {
-					return err
-				}
-				params["sort"] = sortValue
-			}
-			if keyword := aitableFlagOrFallback(cmd, "query", "keyword"); keyword != "" {
-				params["keyword"] = keyword
-			}
-			if limit, _ := cmd.Flags().GetInt("limit"); limit > 0 {
-				params["limit"] = limit
-			}
-			if cursor := aitableStringFlag(cmd, "cursor"); cursor != "" {
-				params["cursor"] = cursor
-			}
-			return runAitableTool(cmd, runner, "query_records", params)
-		},
-	}
-	preferLegacyLeaf(cmd)
-	cmd.Flags().String("base-id", "", i18n.T("Base ID (必填)"))
-	cmd.Flags().String("table-id", "", i18n.T("Table ID (必填)"))
-	cmd.Flags().String("record-ids", "", i18n.T("Record ID 列表，逗号分隔"))
-	cmd.Flags().String("field-ids", "", i18n.T("Field ID 列表，逗号分隔"))
-	cmd.Flags().String("filters", "", i18n.T("过滤条件 JSON"))
-	cmd.Flags().String("sort", "", i18n.T("排序 JSON 数组"))
-	cmd.Flags().String("query", "", i18n.T("全文关键词"))
-	cmd.Flags().String("keyword", "", i18n.T("--query 的别名"))
-	_ = cmd.Flags().MarkHidden("keyword")
-	cmd.Flags().Int("limit", 0, i18n.T("单次最大记录数"))
-	cmd.Flags().String("cursor", "", i18n.T("分页游标"))
-	return cmd
-}
-
-func newAitableRecordCreateCommand(runner executor.Runner) *cobra.Command {
-	cmd := &cobra.Command{
-		Use:               "create",
-		Short:             i18n.T("新增记录"),
-		Example:           "  dws aitable record create --base-id BASE_ID --table-id TABLE_ID --records '[{\"cells\":{\"fld1\":\"hello\"}}]'",
-		Args:              cobra.NoArgs,
-		DisableAutoGenTag: true,
-		RunE: func(cmd *cobra.Command, args []string) error {
-			baseID, err := aitableRequiredFlagOrFallback(cmd, "base-id", "base")
-			if err != nil {
-				return err
-			}
-			tableID, err := aitableRequiredFlag(cmd, "table-id")
-			if err != nil {
-				return err
-			}
-			recordsRaw, err := aitableRequiredFlag(cmd, "records")
-			if err != nil {
-				return err
-			}
-			records, err := parseAitableJSONArray(recordsRaw, "records")
-			if err != nil {
-				return err
-			}
-			return runAitableTool(cmd, runner, "create_records", map[string]any{
-				"baseId":  baseID,
-				"tableId": tableID,
-				"records": records,
-			})
-		},
-	}
-	preferLegacyLeaf(cmd)
-	cmd.Flags().String("base-id", "", i18n.T("Base ID (必填)"))
-	cmd.Flags().String("table-id", "", i18n.T("Table ID (必填)"))
-	cmd.Flags().String("records", "", i18n.T("记录 JSON 数组 (必填)"))
-	return cmd
-}
-
-func newAitableRecordUpdateCommand(runner executor.Runner) *cobra.Command {
-	cmd := &cobra.Command{
-		Use:               "update",
-		Short:             i18n.T("更新记录"),
-		Example:           "  dws aitable record update --base-id BASE_ID --table-id TABLE_ID --records '[{\"recordId\":\"rec1\",\"cells\":{\"fld1\":\"updated\"}}]'",
-		Args:              cobra.NoArgs,
-		DisableAutoGenTag: true,
-		RunE: func(cmd *cobra.Command, args []string) error {
-			baseID, err := aitableRequiredFlagOrFallback(cmd, "base-id", "base")
-			if err != nil {
-				return err
-			}
-			tableID, err := aitableRequiredFlag(cmd, "table-id")
-			if err != nil {
-				return err
-			}
-			recordsRaw, err := aitableRequiredFlag(cmd, "records")
-			if err != nil {
-				return err
-			}
-			records, err := parseAitableJSONArray(recordsRaw, "records")
-			if err != nil {
-				return err
-			}
-			return runAitableTool(cmd, runner, "update_records", map[string]any{
-				"baseId":  baseID,
-				"tableId": tableID,
-				"records": records,
-			})
-		},
-	}
-	preferLegacyLeaf(cmd)
-	cmd.Flags().String("base-id", "", i18n.T("Base ID (必填)"))
-	cmd.Flags().String("table-id", "", i18n.T("Table ID (必填)"))
-	cmd.Flags().String("records", "", i18n.T("记录 JSON 数组 (必填)"))
-	return cmd
-}
-
-// ── template ────────────────────────────────────────────────
-
-func newAitableTemplateSearchCommand(runner executor.Runner) *cobra.Command {
-	cmd := &cobra.Command{
-		Use:               "search",
-		Short:             i18n.T("搜索模板"),
-		Example:           "  dws aitable template search --query 项目管理",
-		Args:              cobra.NoArgs,
-		DisableAutoGenTag: true,
-		RunE: func(cmd *cobra.Command, args []string) error {
-			query := aitableFlagOrFallback(cmd, "query", "keyword")
-			if query == "" {
-				return apperrors.NewValidation("--query is required")
-			}
-			params := map[string]any{"query": query}
-			if limit, _ := cmd.Flags().GetInt("limit"); limit > 0 {
-				params["limit"] = limit
-			}
-			if cursor := aitableStringFlag(cmd, "cursor"); cursor != "" {
-				params["cursor"] = cursor
-			}
-			return runAitableTool(cmd, runner, "search_templates", params)
-		},
-	}
-	preferLegacyLeaf(cmd)
-	cmd.Flags().String("query", "", i18n.T("模板关键词 (必填)"))
-	cmd.Flags().String("keyword", "", i18n.T("--query 的别名"))
-	_ = cmd.Flags().MarkHidden("keyword")
-	cmd.Flags().Int("limit", 0, i18n.T("每页数量"))
-	cmd.Flags().String("cursor", "", i18n.T("分页游标"))
-	return cmd
-}
-
-// ── attachment ──────────────────────────────────────────────
-
-func newAITableAttachmentUploadCommand(runner executor.Runner) *cobra.Command {
-	cmd := &cobra.Command{
-		Use:               "upload",
-		Short:             i18n.T("准备附件上传"),
-		Example:           "  dws aitable attachment upload --base-id BASE_ID --file-name report.pdf --size 1024",
-		Args:              cobra.NoArgs,
-		DisableAutoGenTag: true,
-		RunE: func(cmd *cobra.Command, args []string) error {
-			baseID, err := aitableRequiredFlag(cmd, "base-id")
-			if err != nil {
-				return err
-			}
-			fileName, err := aitableRequiredFlag(cmd, "file-name")
-			if err != nil {
-				return err
-			}
-			params := map[string]any{
-				"baseId":   baseID,
-				"fileName": fileName,
-			}
-			if size, _ := cmd.Flags().GetInt64("size"); size > 0 {
-				params["size"] = size
-			}
-			if mimeType := aitableStringFlag(cmd, "mime-type"); mimeType != "" {
-				params["mimeType"] = mimeType
-			}
-			return runAitableTool(cmd, runner, "prepare_attachment_upload", params)
-		},
-	}
-	preferLegacyLeaf(cmd)
-	cmd.Flags().String("base-id", "", i18n.T("Base ID (必填)"))
-	cmd.Flags().String("file-name", "", i18n.T("文件名 (必填)"))
-	cmd.Flags().Int64("size", 0, i18n.T("文件大小（字节）"))
-	cmd.Flags().String("mime-type", "", i18n.T("文件 MIME Type"))
-	return cmd
-}
-
-// ── helpers ────────────────────────────────────────────────
-
-func runAitableTool(cmd *cobra.Command, runner executor.Runner, tool string, params map[string]any) error {
-	invocation := executor.NewHelperInvocation(
-		cobracmd.LegacyCommandPath(cmd),
-		"aitable",
-		tool,
-		params,
-	)
-	invocation.DryRun = commandDryRun(cmd)
-	result, err := runner.Run(cmd.Context(), invocation)
-	if err != nil {
-		return err
-	}
-	return writeCommandPayload(cmd, result)
-}
-
-func aitableStringFlag(cmd *cobra.Command, name string) string {
-	if cmd == nil {
-		return ""
-	}
-	if value, err := cmd.Flags().GetString(name); err == nil && strings.TrimSpace(value) != "" {
-		return strings.TrimSpace(value)
-	}
-	if value, err := cmd.InheritedFlags().GetString(name); err == nil && strings.TrimSpace(value) != "" {
-		return strings.TrimSpace(value)
-	}
-	return ""
-}
-
-func aitableFlagOrFallback(cmd *cobra.Command, primary string, aliases ...string) string {
-	if value := aitableStringFlag(cmd, primary); value != "" {
-		return value
-	}
-	for _, alias := range aliases {
-		if value := aitableStringFlag(cmd, alias); value != "" {
-			return value
-		}
-	}
-	return ""
-}
-
-func aitableRequiredFlag(cmd *cobra.Command, name string) (string, error) {
-	if value := aitableStringFlag(cmd, name); value != "" {
-		return value, nil
-	}
-	return "", apperrors.NewValidation(fmt.Sprintf("--%s is required", name))
-}
-
-func aitableRequiredFlagOrFallback(cmd *cobra.Command, primary string, aliases ...string) (string, error) {
-	if value := aitableFlagOrFallback(cmd, primary, aliases...); value != "" {
-		return value, nil
-	}
-	return "", apperrors.NewValidation(fmt.Sprintf("--%s is required", primary))
-}
-
-func parseAitableCSVValues(raw string) []string {
-	parts := strings.Split(raw, ",")
-	values := make([]string, 0, len(parts))
-	for _, part := range parts {
-		if trimmed := strings.TrimSpace(part); trimmed != "" {
-			values = append(values, trimmed)
-		}
-	}
-	return values
-}
-
-func parseAitableFieldsJSON(raw string) ([]any, error) {
-	var fields []any
-	if err := json.Unmarshal([]byte(raw), &fields); err == nil {
-		return fields, nil
-	}
-	var wrapper map[string]any
-	if err := json.Unmarshal([]byte(raw), &wrapper); err == nil {
-		if wrappedFields, ok := wrapper["fields"].([]any); ok {
-			return wrappedFields, nil
-		}
-	}
-	return nil, apperrors.NewValidation("--fields JSON parse failed: expect a JSON array")
-}
-
-func parseAitableJSONArray(raw, flagName string) ([]any, error) {
-	var value []any
-	if err := json.Unmarshal([]byte(raw), &value); err != nil {
-		return nil, apperrors.NewValidation(fmt.Sprintf("--%s JSON parse failed: %v", flagName, err))
-	}
-	return value, nil
-}
-
-func parseAitableJSONObject(raw, flagName string) (map[string]any, error) {
-	var value map[string]any
-	if err := json.Unmarshal([]byte(raw), &value); err != nil {
-		return nil, apperrors.NewValidation(fmt.Sprintf("--%s JSON parse failed: %v", flagName, err))
-	}
-	return value, nil
-}
@@ -95,7 +95,7 @@ func newChatMessageSendByBotCommand(runner executor.Runner) *cobra.Command {

 			invocation := executor.NewHelperInvocation(
 				cobracmd.LegacyCommandPath(cmd),
-				"bot",
+				"chat",
 				tool,
 				params,
 			)
@@ -43,55 +43,4 @@ func TestChatMessageSendByBotIgnoresLegacyRealBuildModeEnv(t *testing.T) {
 	if got := runner.last.Params["robotCode"]; got != "robot-001" {
 		t.Fatalf("robotCode = %#v, want robot-001", got)
 	}
-	if got := runner.last.CanonicalProduct; got != "bot" {
-		t.Fatalf("CanonicalProduct = %q, want bot", got)
-	}
-}
-
-func TestChatMessageSendByBotRoutesToBotProduct(t *testing.T) {
-	cases := []struct {
-		name     string
-		args     []string
-		wantTool string
-	}{
-		{
-			name: "single-chat",
-			args: []string{
-				"--users", "user-001",
-				"--robot-code", "robot-001",
-				"--title", "t",
-				"--text", "x",
-			},
-			wantTool: "batch_send_robot_msg_to_users",
-		},
-		{
-			name: "group-chat",
-			args: []string{
-				"--group", "cid-xyz",
-				"--robot-code", "robot-001",
-				"--title", "t",
-				"--text", "x",
-			},
-			wantTool: "send_robot_group_message",
-		},
-	}
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			runner := &captureRunner{}
-			cmd := newChatMessageSendByBotCommand(runner)
-			var out bytes.Buffer
-			cmd.SetOut(&out)
-			cmd.SetErr(&out)
-			cmd.SetArgs(tc.args)
-			if err := cmd.Execute(); err != nil {
-				t.Fatalf("Execute() error = %v\noutput:\n%s", err, out.String())
-			}
-			if got := runner.last.CanonicalProduct; got != "bot" {
-				t.Fatalf("CanonicalProduct = %q, want bot", got)
-			}
-			if got := runner.last.Tool; got != tc.wantTool {
-				t.Fatalf("Tool = %q, want %q", got, tc.wantTool)
-			}
-		})
-	}
 }
@@ -14,14 +14,15 @@
 package helpers

 import (
+	"fmt"
 	"strconv"
 	"strings"
+	"time"

 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/cobracmd"
 	apperrors "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/errors"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/executor"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/i18n"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/cmdutil"
 	"github.com/spf13/cobra"
 )

@@ -87,7 +88,7 @@ func newTodoTaskCreateCommand(runner executor.Runner) *cobra.Command {
 		Args:              cobra.NoArgs,
 		DisableAutoGenTag: true,
 		RunE: func(cmd *cobra.Command, args []string) error {
-			title := cmdutil.FlagOrFallback(cmd, "title", "subject", "content")
+			title := flagOrFallback(cmd, "title", "subject", "content")
 			if strings.TrimSpace(title) == "" {
 				return apperrors.NewValidation("--title is required")
 			}
@@ -102,7 +103,7 @@ func newTodoTaskCreateCommand(runner executor.Runner) *cobra.Command {
 				"executorIds": executorIds,
 			}
 			if v, _ := cmd.Flags().GetString("due"); v != "" {
-				ms, err := cmdutil.ParseISOTimeToMillis("due", v)
+				ms, err := parseISOTimeToMillis("due", v)
 				if err != nil {
 					return err
 				}
@@ -269,7 +270,7 @@ func newTodoTaskUpdateCommand(runner executor.Runner) *cobra.Command {
 				inner["subject"] = v
 			}
 			if v, _ := cmd.Flags().GetString("due"); v != "" {
-				ms, err := cmdutil.ParseISOTimeToMillis("due", v)
+				ms, err := parseISOTimeToMillis("due", v)
 				if err != nil {
 					return err
 				}
@@ -443,6 +444,16 @@ func newTodoTaskDeleteCommand(runner executor.Runner) *cobra.Command {

 // ── helpers ────────────────────────────────────────────────

+// flagOrFallback returns the first non-empty value among the given flag names.
+func flagOrFallback(cmd *cobra.Command, names ...string) string {
+	for _, name := range names {
+		if v, _ := cmd.Flags().GetString(name); strings.TrimSpace(v) != "" {
+			return v
+		}
+	}
+	return ""
+}
+
 // parseExecutorIds splits "id1,id2" into []string for the MCP executorIds array.
 func parseExecutorIds(s string) []string {
 	s = strings.TrimSpace(s)
@@ -459,6 +470,25 @@ func parseExecutorIds(s string) []string {
 	return ids
 }

+// parseISOTimeToMillis parses an ISO-8601 datetime string and returns Unix
+// milliseconds. It supports timezone offsets (e.g. +08:00) and UTC "Z" suffix.
+func parseISOTimeToMillis(flagName, value string) (int64, error) {
+	formats := []string{
+		time.RFC3339,
+		"2006-01-02T15:04:05Z07:00",
+		"2006-01-02T15:04:05",
+		"2006-01-02 15:04:05",
+	}
+	for _, layout := range formats {
+		if t, err := time.Parse(layout, value); err == nil {
+			return t.UnixMilli(), nil
+		}
+	}
+	return 0, apperrors.NewValidation(
+		fmt.Sprintf("--%s format error, use ISO-8601 e.g. 2026-03-10T18:00:00+08:00", flagName),
+	)
+}
+
 // ── list pagination helpers ────────────────────────────────

 func normalizePage(raw string) string {
@@ -37,20 +37,9 @@ import (
 	"strings"
 	"sync"

-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/configmeta"
 	"golang.org/x/text/language"
 )

-func init() {
-	configmeta.Register(configmeta.ConfigItem{
-		Name:         "DWS_LANG",
-		Category:     configmeta.CategoryCore,
-		Description:  "界面语言 (en/zh)，回退到 LANG",
-		DefaultValue: "en",
-		Example:      "zh",
-	})
-}
-
 //go:embed locales/*.json
 var localeFS embed.FS

@@ -155,40 +155,5 @@
  "返回数据缺少 uploadUrl 或 fileToken": "Response data missing uploadUrl or fileToken",
  "附件工作流": "Attachment workflow",
  "页码 (必填)": "page number (required)",
-  "⚠️  无法检查 CLI 数据访问权限状态": "⚠️  Unable to verify CLI data access permission status",
-  "   请检查网络连接后重试。": "   Please check your network connection and retry.",
-  "检查 CLI 授权状态失败": "Failed to check CLI auth status",
-  "⚠️  该组织尚未开启 CLI 数据访问权限": "⚠️  CLI data access is not enabled for this organization",
-  "   你所选择的组织管理员尚未开启「允许成员通过 CLI 访问其个人数据」的权限。": "   The organization admin has not enabled \"Allow members to access their personal data via CLI\".",
-  "   组织主管理员：": "   Organization super admins: ",
-  "   请联系组织主管理员开启后重新登录。": "   Please contact the organization super admin to enable it and re-login.",
-  "管理员操作入口：": "Admin settings: ",
-  "该组织尚未开启 CLI 数据访问权限，请联系管理员开启": "CLI data access is not enabled for this organization, please contact admin to enable it",
-  "⏳ 该组织尚未开启 CLI 数据访问权限，请在浏览器中提交授权申请...": "⏳ CLI data access is not enabled for this organization, please submit an authorization request in the browser...",
-  "✅ 权限已开启，继续登录...": "✅ Permission enabled, continuing login...",
-  "等待管理员审批中": "Waiting for admin approval",
-  "等待提交申请中": "Waiting to submit request",
-  "操作超时，请重新登录": "Operation timed out, please re-login",
-  "检查组织 CLI 授权状态...": "Checking organization CLI auth status...",
-  "🔐 登录钉钉": "🔐 Login to DingTalk",
-  "插件管理": "Manage plugins",
-  "列出已安装的插件": "List installed plugins",
-  "安装插件": "Install a plugin",
-  "查看插件详情": "Show plugin details",
-  "启用插件": "Enable a plugin",
-  "禁用插件": "Disable a plugin",
-  "卸载已安装的插件": "Remove an installed plugin",
-  "校验 plugin.json": "Validate a plugin.json",
-  "脚手架生成新插件目录": "Scaffold a new plugin directory",
-  "将本地目录注册为开发态插件": "Register a local directory as a dev plugin",
-  "管理插件配置": "Manage plugin configuration",
-  "设置插件配置项": "Set a plugin config value",
-  "读取插件配置项": "Get a plugin config value",
-  "列出插件所有配置项": "List all config values for a plugin",
-  "删除插件配置项": "Remove a plugin config value",
-  "将插件 stdio server 编译为原生二进制": "Build plugin's stdio server into a native binary",
-  "覆盖 OAuth 客户端 ID (钉钉 AppKey)": "Override OAuth client ID (DingTalk AppKey)",
-  "覆盖 OAuth 客户端密钥 (钉钉 AppSecret)": "Override OAuth client secret (DingTalk AppSecret)",
-  "查看任意命令的帮助信息": "Help about any command",
-  "显示任意命令的帮助文案。\n用法：dws help [命令路径] 查看完整说明。": "Help provides help for any command in the application.\nSimply type dws help [path to command] for full details."
+  "🔐 登录钉钉": "🔐 Login to DingTalk"
 }
@@ -155,40 +155,5 @@
  "返回数据缺少 uploadUrl 或 fileToken": "返回数据缺少 uploadUrl 或 fileToken",
  "附件工作流": "附件工作流",
  "页码 (必填)": "页码 (必填)",
-  "⚠️  无法检查 CLI 数据访问权限状态": "⚠️  无法检查 CLI 数据访问权限状态",
-  "   请检查网络连接后重试。": "   请检查网络连接后重试。",
-  "检查 CLI 授权状态失败": "检查 CLI 授权状态失败",
-  "⚠️  该组织尚未开启 CLI 数据访问权限": "⚠️  该组织尚未开启 CLI 数据访问权限",
-  "   你所选择的组织管理员尚未开启「允许成员通过 CLI 访问其个人数据」的权限。": "   你所选择的组织管理员尚未开启「允许成员通过 CLI 访问其个人数据」的权限。",
-  "   组织主管理员：": "   组织主管理员：",
-  "   请联系组织主管理员开启后重新登录。": "   请联系组织主管理员开启后重新登录。",
-  "管理员操作入口：": "管理员操作入口：",
-  "该组织尚未开启 CLI 数据访问权限，请联系管理员开启": "该组织尚未开启 CLI 数据访问权限，请联系管理员开启",
-  "⏳ 该组织尚未开启 CLI 数据访问权限，请在浏览器中提交授权申请...": "⏳ 该组织尚未开启 CLI 数据访问权限，请在浏览器中提交授权申请...",
-  "✅ 权限已开启，继续登录...": "✅ 权限已开启，继续登录...",
-  "等待管理员审批中": "等待管理员审批中",
-  "等待提交申请中": "等待提交申请中",
-  "操作超时，请重新登录": "操作超时，请重新登录",
-  "检查组织 CLI 授权状态...": "检查组织 CLI 授权状态...",
-  "🔐 登录钉钉": "🔐 登录钉钉",
-  "插件管理": "插件管理",
-  "列出已安装的插件": "列出已安装的插件",
-  "安装插件": "安装插件",
-  "查看插件详情": "查看插件详情",
-  "启用插件": "启用插件",
-  "禁用插件": "禁用插件",
-  "卸载已安装的插件": "卸载已安装的插件",
-  "校验 plugin.json": "校验 plugin.json",
-  "脚手架生成新插件目录": "脚手架生成新插件目录",
-  "将本地目录注册为开发态插件": "将本地目录注册为开发态插件",
-  "管理插件配置": "管理插件配置",
-  "设置插件配置项": "设置插件配置项",
-  "读取插件配置项": "读取插件配置项",
-  "列出插件所有配置项": "列出插件所有配置项",
-  "删除插件配置项": "删除插件配置项",
-  "将插件 stdio server 编译为原生二进制": "将插件 stdio server 编译为原生二进制",
-  "覆盖 OAuth 客户端 ID (钉钉 AppKey)": "覆盖 OAuth 客户端 ID (钉钉 AppKey)",
-  "覆盖 OAuth 客户端密钥 (钉钉 AppSecret)": "覆盖 OAuth 客户端密钥 (钉钉 AppSecret)",
-  "查看任意命令的帮助信息": "查看任意命令的帮助信息",
-  "显示任意命令的帮助文案。\n用法：dws help [命令路径] 查看完整说明。": "显示任意命令的帮助文案。\n用法：dws help [命令路径] 查看完整说明。"
+  "🔐 登录钉钉": "🔐 登录钉钉"
 }
@@ -49,29 +49,6 @@ type CLIFlagHint struct {
 	Alias     string `json:"alias,omitempty"`
 }

-// FlagOverlay carries CLI-layer transformation metadata for a single
-// MCP parameter: the flag alias the user types, the transform applied
-// before dispatch, env-var fallback, default value, and whether the flag
-// is hidden from help. Sourced from market.CLIToolOverride.Flags.
-type FlagOverlay struct {
-	Alias         string         `json:"alias,omitempty"`
-	Transform     string         `json:"transform,omitempty"`
-	TransformArgs map[string]any `json:"transform_args,omitempty"`
-	EnvDefault    string         `json:"env_default,omitempty"`
-	Default       string         `json:"default,omitempty"`
-	Hidden        bool           `json:"hidden,omitempty"`
-}
-
-// ToolAnnotations mirrors MCP 2025+ tool annotations. All hints are
-// nullable: absence means "unknown", not "false". Populate only when the
-// source has a clear signal — don't guess.
-type ToolAnnotations struct {
-	DestructiveHint *bool `json:"destructive_hint,omitempty"`
-	ReadOnlyHint    *bool `json:"read_only_hint,omitempty"`
-	IdempotentHint  *bool `json:"idempotent_hint,omitempty"`
-	OpenWorldHint   *bool `json:"open_world_hint,omitempty"`
-}
-
 type CanonicalProduct struct {
 	ID                        string              `json:"id"`
 	DisplayName               string              `json:"display_name"`
@@ -90,16 +67,13 @@ type CanonicalProduct struct {
 type ToolDescriptor struct {
 	RPCName         string                 `json:"rpc_name"`
 	CLIName         string                 `json:"cli_name,omitempty"`
-	Group           string                 `json:"group,omitempty"`
 	Title           string                 `json:"title,omitempty"`
 	Description     string                 `json:"description,omitempty"`
 	InputSchema     map[string]any         `json:"input_schema,omitempty"`
 	OutputSchema    map[string]any         `json:"output_schema,omitempty"`
 	Sensitive       bool                   `json:"sensitive"`
-	Annotations     *ToolAnnotations       `json:"annotations,omitempty"`
 	Hidden          bool                   `json:"hidden,omitempty"`
 	FlagHints       map[string]CLIFlagHint `json:"flag_hints,omitempty"`
-	FlagOverlay     map[string]FlagOverlay `json:"flag_overlay,omitempty"`
 	SourceServerKey string                 `json:"source_server_key"`
 	CanonicalPath   string                 `json:"canonical_path"`
 }
@@ -131,58 +105,10 @@ func BuildCatalog(runtimeServers []discovery.RuntimeServer) Catalog {
 		sensitiveByTool := make(map[string]bool, len(runtimeServer.Server.CLI.Tools))
 		hasSensitiveOverride := make(map[string]bool, len(runtimeServer.Server.CLI.Tools))
 		toolCLIName := make(map[string]string, len(runtimeServer.Server.CLI.Tools))
-		toolGroup := make(map[string]string)
 		toolHidden := make(map[string]bool, len(runtimeServer.Server.CLI.Tools))
 		toolTitleOverride := make(map[string]string, len(runtimeServer.Server.CLI.Tools))
 		toolDescriptionOverride := make(map[string]string, len(runtimeServer.Server.CLI.Tools))
 		toolFlagHints := make(map[string]map[string]CLIFlagHint, len(runtimeServer.Server.CLI.Tools))
-		toolFlagOverlay := make(map[string]map[string]FlagOverlay)
-
-		// Merge richer market.CLIToolOverride data (group, cliName, flag
-		// transforms/aliases/env-defaults) that the dynamic compat layer
-		// already consumes but the IR previously dropped.
-		for name, override := range runtimeServer.Server.CLI.ToolOverrides {
-			trimmed := strings.TrimSpace(name)
-			if trimmed == "" {
-				continue
-			}
-			if cn := strings.TrimSpace(override.CLIName); cn != "" {
-				toolCLIName[trimmed] = cn
-			}
-			if gp := strings.TrimSpace(override.Group); gp != "" {
-				toolGroup[trimmed] = gp
-			}
-			if override.Hidden {
-				toolHidden[trimmed] = true
-			}
-			if override.IsSensitive {
-				sensitiveByTool[trimmed] = true
-				hasSensitiveOverride[trimmed] = true
-			}
-			if desc := strings.TrimSpace(override.Description); desc != "" && toolDescriptionOverride[trimmed] == "" {
-				toolDescriptionOverride[trimmed] = desc
-			}
-			if len(override.Flags) > 0 {
-				overlay := make(map[string]FlagOverlay, len(override.Flags))
-				for paramName, flagOverride := range override.Flags {
-					paramTrim := strings.TrimSpace(paramName)
-					if paramTrim == "" {
-						continue
-					}
-					overlay[paramTrim] = FlagOverlay{
-						Alias:         strings.TrimSpace(flagOverride.Alias),
-						Transform:     strings.TrimSpace(flagOverride.Transform),
-						TransformArgs: cloneTransformArgs(flagOverride.TransformArgs),
-						EnvDefault:    strings.TrimSpace(flagOverride.EnvDefault),
-						Default:       strings.TrimSpace(flagOverride.Default),
-						Hidden:        flagOverride.Hidden,
-					}
-				}
-				if len(overlay) > 0 {
-					toolFlagOverlay[trimmed] = overlay
-				}
-			}
-		}
 		for _, cliTool := range runtimeServer.Server.CLI.Tools {
 			name := strings.TrimSpace(cliTool.Name)
 			if name == "" {
@@ -238,16 +164,13 @@ func BuildCatalog(runtimeServers []discovery.RuntimeServer) Catalog {
 			tools = append(tools, ToolDescriptor{
 				RPCName:         tool.Name,
 				CLIName:         cliName,
-				Group:           strings.TrimSpace(toolGroup[tool.Name]),
 				Title:           title,
 				Description:     description,
 				InputSchema:     cloneMap(tool.InputSchema),
 				OutputSchema:    cloneMap(tool.OutputSchema),
 				Sensitive:       sensitive,
-				Annotations:     deriveAnnotations(sensitive),
 				Hidden:          toolHidden[tool.Name],
 				FlagHints:       cloneFlagHints(toolFlagHints[tool.Name]),
-				FlagOverlay:     cloneFlagOverlay(toolFlagOverlay[tool.Name]),
 				SourceServerKey: runtimeServer.Server.Key,
 				CanonicalPath:   fmt.Sprintf("%s.%s", productID, tool.Name),
 			})
@@ -440,43 +363,3 @@ func cloneFlagHints(value map[string]CLIFlagHint) map[string]CLIFlagHint {
 	}
 	return out
 }
-
-func cloneFlagOverlay(value map[string]FlagOverlay) map[string]FlagOverlay {
-	if len(value) == 0 {
-		return nil
-	}
-	out := make(map[string]FlagOverlay, len(value))
-	for key, overlay := range value {
-		overlay.TransformArgs = cloneTransformArgs(overlay.TransformArgs)
-		out[key] = overlay
-	}
-	return out
-}
-
-func cloneTransformArgs(value map[string]any) map[string]any {
-	if len(value) == 0 {
-		return nil
-	}
-	data, err := json.Marshal(value)
-	if err != nil {
-		return nil
-	}
-	var cloned map[string]any
-	if err := json.Unmarshal(data, &cloned); err != nil {
-		return nil
-	}
-	return cloned
-}
-
-// deriveAnnotations maps the coarse-grained Sensitive bool onto MCP 2025+
-// annotation hints. Only DestructiveHint is populated — the other hints
-// (read_only, idempotent, open_world) stay nil until the upstream tool
-// manifest advertises them explicitly. Guessing from name prefixes
-// ("list_", "get_") risks false signals for AI agents.
-func deriveAnnotations(sensitive bool) *ToolAnnotations {
-	if !sensitive {
-		return nil
-	}
-	destructive := true
-	return &ToolAnnotations{DestructiveHint: &destructive}
-}
@@ -216,114 +216,6 @@ func TestBuildCatalogFallsBackToRuntimeSensitiveMetadata(t *testing.T) {
 	}
 }

-func TestBuildCatalogCarriesToolOverrideGroupAndFlagOverlay(t *testing.T) {
-	t.Parallel()
-
-	catalog := BuildCatalog([]discovery.RuntimeServer{
-		{
-			Server: market.ServerDescriptor{
-				Key:         "ding-key",
-				DisplayName: "DING",
-				Endpoint:    "https://example.com/server/ding",
-				CLI: market.CLIOverlay{
-					Command: "ding",
-					ToolOverrides: map[string]market.CLIToolOverride{
-						"send_ding_message": {
-							CLIName:     "send",
-							Group:       "message",
-							IsSensitive: true,
-							Flags: map[string]market.CLIFlagOverride{
-								"receiverUserIdList": {
-									Alias:     "users",
-									Transform: "csv_to_array",
-								},
-								"robotCode": {
-									Alias:      "robot-code",
-									EnvDefault: "DINGTALK_DING_ROBOT_CODE",
-								},
-								"remindType": {
-									Alias:     "type",
-									Transform: "enum_map",
-									TransformArgs: map[string]any{
-										"_default": float64(1),
-										"app":      float64(1),
-									},
-								},
-							},
-						},
-					},
-				},
-			},
-			Tools: []transport.ToolDescriptor{
-				{Name: "send_ding_message", Title: "发送DING消息", InputSchema: map[string]any{"type": "object"}},
-			},
-		},
-	})
-
-	if len(catalog.Products) != 1 {
-		t.Fatalf("products len = %d, want 1", len(catalog.Products))
-	}
-	product := catalog.Products[0]
-	if product.ID != "ding" {
-		t.Fatalf("product ID = %q, want ding", product.ID)
-	}
-	tool, ok := product.FindTool("send_ding_message")
-	if !ok {
-		t.Fatalf("tool not found")
-	}
-	if tool.CLIName != "send" {
-		t.Fatalf("CLIName = %q, want send", tool.CLIName)
-	}
-	if tool.Group != "message" {
-		t.Fatalf("Group = %q, want message", tool.Group)
-	}
-	if !tool.Sensitive {
-		t.Fatalf("Sensitive = false, want true (from overlay)")
-	}
-	if tool.Annotations == nil || tool.Annotations.DestructiveHint == nil || !*tool.Annotations.DestructiveHint {
-		t.Fatalf("DestructiveHint not propagated, got %#v", tool.Annotations)
-	}
-	if tool.Annotations.ReadOnlyHint != nil {
-		t.Fatalf("ReadOnlyHint should be nil when source is unknown, got %#v", *tool.Annotations.ReadOnlyHint)
-	}
-	users := tool.FlagOverlay["receiverUserIdList"]
-	if users.Alias != "users" || users.Transform != "csv_to_array" {
-		t.Fatalf("receiverUserIdList overlay = %#v", users)
-	}
-	robot := tool.FlagOverlay["robotCode"]
-	if robot.Alias != "robot-code" || robot.EnvDefault != "DINGTALK_DING_ROBOT_CODE" {
-		t.Fatalf("robotCode overlay = %#v", robot)
-	}
-	remind := tool.FlagOverlay["remindType"]
-	if remind.Transform != "enum_map" {
-		t.Fatalf("remindType.Transform = %q, want enum_map", remind.Transform)
-	}
-	if v, _ := remind.TransformArgs["app"].(float64); v != 1 {
-		t.Fatalf("remindType.TransformArgs[app] = %v, want 1", remind.TransformArgs["app"])
-	}
-}
-
-func TestBuildCatalogLeavesAnnotationsNilForNonSensitive(t *testing.T) {
-	t.Parallel()
-
-	catalog := BuildCatalog([]discovery.RuntimeServer{
-		{
-			Server: market.ServerDescriptor{
-				Key:         "doc-key",
-				DisplayName: "文档",
-				Endpoint:    "https://example.com/server/doc",
-			},
-			Tools: []transport.ToolDescriptor{
-				{Name: "list_documents", InputSchema: map[string]any{"type": "object"}},
-			},
-		},
-	})
-	tool := catalog.Products[0].Tools[0]
-	if tool.Annotations != nil {
-		t.Fatalf("Annotations = %#v, want nil for non-sensitive tool", tool.Annotations)
-	}
-}
-
 func TestBuildCatalogConsumesCLIRouteMetadata(t *testing.T) {
 	t.Parallel()

@@ -24,7 +24,7 @@ import (
 	"strconv"
 	"sync"

-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/config"
+	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/config"
 )

 const (
@@ -16,7 +16,6 @@ package logging
 import (
 	"context"
 	"log/slog"
-	"runtime"
 	"time"
 )

@@ -53,15 +52,14 @@ func LogRequestBody(logger *slog.Logger, method, executionId string, toolName st
 	)
 }

-// LogResponse logs a JSON-RPC response at Debug level (Warn on error).
-func LogResponse(logger *slog.Logger, method, endpoint, executionId string, statusCode int, respSize int, duration time.Duration, err error) {
+// LogResponse logs a JSON-RPC response at Debug level.
+func LogResponse(logger *slog.Logger, method, endpoint string, statusCode int, respSize int, duration time.Duration, err error) {
 	if logger == nil {
 		return
 	}
 	attrs := []slog.Attr{
 		slog.String("method", method),
 		slog.String("endpoint", redactEndpoint(endpoint)),
-		slog.String("execution_id", executionId),
 		slog.Int("status", statusCode),
 		slog.Int("resp_size", respSize),
 		slog.String("duration", duration.Truncate(time.Millisecond).String()),
@@ -139,24 +137,18 @@ func LogErrorClassified(logger *slog.Logger, method, executionId, category, reas
 }

 // LogCommandStart logs the beginning of a command execution.
-func LogCommandStart(logger *slog.Logger, executionId, product, tool, endpoint, version string, authPresent bool, timeoutSec int) {
+func LogCommandStart(logger *slog.Logger, executionId, command, product, tool, version string, authPresent bool) {
 	if logger == nil {
 		return
 	}
-	attrs := []slog.Attr{
+	logger.Info("command_start",
 		slog.String("execution_id", executionId),
+		slog.String("command", command),
 		slog.String("product", product),
 		slog.String("tool", tool),
-		slog.String("endpoint", redactEndpoint(endpoint)),
 		slog.String("cli_version", version),
-		slog.String("os", runtime.GOOS),
-		slog.String("arch", runtime.GOARCH),
 		slog.Bool("auth_token_present", authPresent),
-	}
-	if timeoutSec > 0 {
-		attrs = append(attrs, slog.Int("timeout_sec", timeoutSec))
-	}
-	logger.LogAttrs(context.TODO(), slog.LevelInfo, "command_start", attrs...)
+	)
 }

 // LogCommandEnd logs the end of a command execution.
@@ -52,7 +52,7 @@ func TestLogResponseSuccess(t *testing.T) {
 	var buf bytes.Buffer
 	logger := slog.New(slog.NewJSONHandler(&buf, &slog.HandlerOptions{Level: slog.LevelDebug}))

-	LogResponse(logger, "tools/call", "https://mcp.dingtalk.com/api", "exec-1", 200, 1024, 150*time.Millisecond, nil)
+	LogResponse(logger, "tools/call", "https://mcp.dingtalk.com/api", 200, 1024, 150*time.Millisecond, nil)

 	out := buf.String()
 	if !strings.Contains(out, "jsonrpc_response") {
@@ -72,7 +72,7 @@ func TestLogResponseError(t *testing.T) {
 	var buf bytes.Buffer
 	logger := slog.New(slog.NewJSONHandler(&buf, &slog.HandlerOptions{Level: slog.LevelDebug}))

-	LogResponse(logger, "initialize", "https://mcp.dingtalk.com", "exec-2", 500, 0, 2*time.Second, errors.New("connection refused"))
+	LogResponse(logger, "initialize", "https://mcp.dingtalk.com", 500, 0, 2*time.Second, errors.New("connection refused"))

 	out := buf.String()
 	if !strings.Contains(out, "WARN") {
@@ -87,12 +87,12 @@ func TestLogRequestNilLogger(t *testing.T) {
 	t.Parallel()
 	// Should not panic
 	LogRequest(nil, "test", "http://localhost", "", 0)
-	LogResponse(nil, "test", "http://localhost", "", 200, 0, 0, nil)
+	LogResponse(nil, "test", "http://localhost", 200, 0, 0, nil)
 	LogRequestBody(nil, "tools/call", "exec-1", "tool", nil)
 	LogResponseBody(nil, "tools/call", "exec-1", 200, nil, "")
 	LogRetryAttempt(nil, "tools/call", "exec-1", 0, 2, 429, 0, nil)
 	LogErrorClassified(nil, "tools/call", "exec-1", "api", "timeout", 0, 0, true, "")
-	LogCommandStart(nil, "exec-1", "doc", "list", "https://mcp.example.com", "1.0.0", false, 0)
+	LogCommandStart(nil, "exec-1", "dws test", "doc", "list", "1.0.0", false)
 	LogCommandEnd(nil, "exec-1", "doc", "list", true, 0, "", "")
 }

@@ -26,8 +26,8 @@ import (
 	"strings"
 	"time"

+	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/config"
 	apperrors "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/errors"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/config"
 )

 const (
@@ -107,7 +107,6 @@ type CLIGroupDef struct {
 // CLIToolOverride maps an MCP tool to a CLI command with flag aliases and transforms.
 type CLIToolOverride struct {
 	CLIName      string                     `json:"cliName"`
-	Description  string                     `json:"description,omitempty"`
 	Group        string                     `json:"group,omitempty"`
 	IsSensitive  bool                       `json:"isSensitive,omitempty"`
 	Hidden       bool                       `json:"hidden,omitempty"`
@@ -181,23 +180,22 @@ type DetailLocator struct {
 }

 type ServerDescriptor struct {
-	Key                       string            `json:"key"`
-	SourceServerID            string            `json:"source_server_id,omitempty"`
-	DisplayName               string            `json:"display_name"`
-	Description               string            `json:"description,omitempty"`
-	Endpoint                  string            `json:"endpoint"`
-	SchemaURI                 string            `json:"schema_uri,omitempty"`
-	NegotiatedProtocolVersion string            `json:"negotiated_protocol_version,omitempty"`
-	UpdatedAt                 time.Time         `json:"updated_at,omitempty"`
-	PublishedAt               time.Time         `json:"published_at,omitempty"`
-	Status                    string            `json:"status,omitempty"`
-	Source                    string            `json:"source"`
-	Degraded                  bool              `json:"degraded"`
-	DetailLocator             DetailLocator     `json:"detail_locator,omitempty"`
-	Lifecycle                 LifecycleInfo     `json:"lifecycle,omitempty"`
-	CLI                       CLIOverlay        `json:"cli,omitempty"`
-	HasCLIMeta                bool              `json:"has_cli_meta,omitempty"`
-	AuthHeaders               map[string]string `json:"auth_headers,omitempty"` // plugin-level auth headers for third-party MCP servers
+	Key                       string        `json:"key"`
+	SourceServerID            string        `json:"source_server_id,omitempty"`
+	DisplayName               string        `json:"display_name"`
+	Description               string        `json:"description,omitempty"`
+	Endpoint                  string        `json:"endpoint"`
+	SchemaURI                 string        `json:"schema_uri,omitempty"`
+	NegotiatedProtocolVersion string        `json:"negotiated_protocol_version,omitempty"`
+	UpdatedAt                 time.Time     `json:"updated_at,omitempty"`
+	PublishedAt               time.Time     `json:"published_at,omitempty"`
+	Status                    string        `json:"status,omitempty"`
+	Source                    string        `json:"source"`
+	Degraded                  bool          `json:"degraded"`
+	DetailLocator             DetailLocator `json:"detail_locator,omitempty"`
+	Lifecycle                 LifecycleInfo `json:"lifecycle,omitempty"`
+	CLI                       CLIOverlay    `json:"cli,omitempty"`
+	HasCLIMeta                bool          `json:"has_cli_meta,omitempty"`
 }

 func NewClient(baseURL string, httpClient *http.Client) *Client {
@@ -29,10 +29,9 @@ import (
 type Format string

 const (
-	FormatJSON   Format = "json"
-	FormatTable  Format = "table"
-	FormatRaw    Format = "raw"
-	FormatPretty Format = "pretty"
+	FormatJSON  Format = "json"
+	FormatTable Format = "table"
+	FormatRaw   Format = "raw"
 )

 var preferredListKeys = []string{"items", "results", "data", "list", "records", "tools", "servers", "products"}
@@ -76,8 +75,6 @@ func Write(w io.Writer, format Format, payload any) error {
 		return writeRaw(w, payload)
 	case FormatTable:
 		return writeTableish(w, payload)
-	case FormatPretty:
-		return writePretty(w, payload)
 	default:
 		return WriteJSON(w, payload)
 	}
@@ -126,8 +123,6 @@ func normalizeFormat(raw string, fallback Format) Format {
 		return FormatRaw
 	case string(FormatTable):
 		return FormatTable
-	case string(FormatPretty):
-		return FormatPretty
 	default:
 		return fallback
 	}
@@ -153,70 +148,45 @@ func WriteFiltered(w io.Writer, format Format, payload any, fields, jq string) e
 }

 // ResolveFields extracts the --fields flag value from the command.
-// It ensures that we do not mistakenly grab a business parameter also named "fields"
-// by matching the flag's usage string against the global root definition.
 func ResolveFields(cmd *cobra.Command) string {
 	if cmd == nil {
 		return ""
 	}
-	rootFlags := rootPersistentFlags(cmd)
-	if rootFlags == nil {
-		return ""
-	}
-	globalFlag := rootFlags.Lookup("fields")
-	if globalFlag == nil {
-		return ""
-	}
-
 	for _, flags := range []*pflag.FlagSet{
 		cmd.Flags(),
 		cmd.InheritedFlags(),
-		rootFlags,
+		rootPersistentFlags(cmd),
 	} {
 		if flags == nil {
 			continue
 		}
 		if f := flags.Lookup("fields"); f != nil && f.Changed {
-			// To avoid collision with business flags (e.g. table create --fields),
-			// verify this flag shares the same usage string as the global one.
-			if f.Usage == globalFlag.Usage {
-				if v, err := flags.GetString("fields"); err == nil {
-					return v
-				}
+			if v, err := flags.GetString("fields"); err == nil {
+				return v
 			}
 		}
 	}
 	return ""
 }

-// ResolveJQ extracts the --jq flag value from the command. It ensures
-// that we only grab the global output filter, not a similarly named business parameter.
+// ResolveJQ extracts the --jq flag value from the command. It checks
+// local flags, inherited flags, and root persistent flags because
+// --jq is registered as a root PersistentFlag.
 func ResolveJQ(cmd *cobra.Command) string {
 	if cmd == nil {
 		return ""
 	}
-	rootFlags := rootPersistentFlags(cmd)
-	if rootFlags == nil {
-		return ""
-	}
-	globalFlag := rootFlags.Lookup("jq")
-	if globalFlag == nil {
-		return ""
-	}
-
 	for _, flags := range []*pflag.FlagSet{
 		cmd.Flags(),
 		cmd.InheritedFlags(),
-		rootFlags,
+		rootPersistentFlags(cmd),
 	} {
 		if flags == nil {
 			continue
 		}
 		if f := flags.Lookup("jq"); f != nil && f.Changed {
-			if f.Usage == globalFlag.Usage {
-				if v, err := flags.GetString("jq"); err == nil {
-					return v
-				}
+			if v, err := flags.GetString("jq"); err == nil {
+				return v
 			}
 		}
 	}
@@ -1,38 +0,0 @@
-package output
-
-import (
-	"github.com/spf13/cobra"
-	"testing"
-)
-
-func TestResolveFieldsShadowing(t *testing.T) {
-	t.Run("global persistent flag propagates", func(t *testing.T) {
-		rootCmd := &cobra.Command{Use: "dws"}
-		rootCmd.PersistentFlags().String("fields", "", "筛选输出字段 (逗号分隔, 如: name,id,status)")
-
-		normalCmd := &cobra.Command{Use: "normal"}
-		rootCmd.AddCommand(normalCmd)
-		rootCmd.SetArgs([]string{"normal", "--fields", "data,status"})
-		rootCmd.Execute()
-
-		if fields := ResolveFields(normalCmd); fields != "data,status" {
-			t.Errorf("expected 'data,status' for normal cmd, got %q", fields)
-		}
-	})
-
-	t.Run("shadowed local flag is ignored", func(t *testing.T) {
-		rootCmd := &cobra.Command{Use: "dws"}
-		rootCmd.PersistentFlags().String("fields", "", "筛选输出字段 (逗号分隔, 如: name,id,status)")
-
-		bizCmd := &cobra.Command{Use: "biz"}
-		bizCmd.Flags().String("fields", "", "JSON string array of objects")
-		rootCmd.AddCommand(bizCmd)
-
-		rootCmd.SetArgs([]string{"biz", "--fields", "[\"fake\"]"})
-		rootCmd.Execute()
-
-		if fields := ResolveFields(bizCmd); fields != "" {
-			t.Errorf("expected empty fields for shadowed cmd since it's a business param, got %q", fields)
-		}
-	})
-}
--- a/Show More
+++ b/Show More