fix(devapp): restore paginated mock contracts

Merge remote-tracking branch 'upstream/main' into codex/issue-917-devapp-pagination-contract
# Conflicts: # CHANGELOG.md
2026-08-10 16:41:08 +08:00 · 2026-08-10 16:38:23 +08:00 · 2026-08-10 15:50:34 +08:00 · 2026-08-09 08:03:16 +08:00
226 changed files with 5364 additions and 30674 deletions
@@ -1,61 +0,0 @@
-# /eval 自助触发允许名单
-#
-# 名单内的 GitHub 登录名可对【自己创建的 PR】触发 /eval 评测；
-# 对任意 PR 触发仍需仓库 write/maintain/admin 权限（维护者背书）。
-# 授权读取的始终是默认分支上的本文件，PR 无法修改自身授权。
-#
-# 变更本文件必须走 PR 评审。每行一个 GitHub login，# 开头为注释。
-
-aftersss
-notable-open
-EdgarWang0925
-ayunya
-yutongshe
-qingyang1014
-caiTriumph
-xlb1130
-Anonymity-0
-FuShu-Yang
-guimingyue
-AlwaysLee
-TaoJikun
-zengyoulingzyl-stack
-liyuan333
-huangyoo
-lifeihong
-nitonitori
-cywan1998
-gangwn
-junlonghuo2
-aqruan
-Freda0909
-ShawnWhite777
-PeterGuy326
-abucraft
-pengzhihan47-star
-rainyak8
-gongrongyun
-huangyuanzhuo-coder
-ybcstudy
-bigqy
-liwang-ai
-meng93
-wxianfeng
-Patrick-Star-CN
-rossluo28-hz
-dxy704330469
-gtezg30062
-Neige-Premaire
-zhuoyu20
-avicii-chen
-typefield
-Haofeng0705
-Huwenjiao
-liuzeyang
-maoqxxmm
-FloralTide
-lingyun9833
-dxb121
-C0922
-xiaoji121
-H3java
@@ -148,7 +148,6 @@ jobs:
                filename === '.github/actionlint.yaml' ||
                filename.startsWith('scripts/') ||
                filename.startsWith('verify/') ||
-                filename.startsWith('internal/helpers/') ||
                filename.startsWith('internal/generator/') ||
                filename.startsWith('internal/cli/schema') ||
                filename.startsWith('internal/interfacesnapshot/') ||
@@ -1371,47 +1370,36 @@ jobs:
          if [ -z "$base_ref" ] || [ "$base_ref" = "0000000000000000000000000000000000000000" ]; then
            base_ref="$(git rev-parse HEAD^)"
          fi
-          candidate_ref="$(git rev-parse 'HEAD^{commit}')"
-          if [ "$GITHUB_EVENT_NAME" = "pull_request" ] && [ "$candidate_ref" != "$PR_HEAD_SHA" ]; then
-            echo "Compatibility checkout $candidate_ref does not match PR head $PR_HEAD_SHA" >&2
-            exit 1
-          fi
          git rev-parse --verify "${base_ref}^{commit}" >/dev/null
-          . ./scripts/release/release-lib.sh
-          stable_ref=""
-          for tag in $(git tag --merged "$base_ref" --list 'v*' --sort=-version:refname); do
-            release_is_stable_version "$tag" || continue
-            if git rev-parse --verify --quiet "refs/tags/withdrawn/$tag" >/dev/null; then
-              continue
-            fi
-            stable_ref="$tag"
-            break
-          done
+          stable_ref="$(git tag --merged "$base_ref" --list 'v[0-9]*' --sort=-version:refname | awk 'index($0, "-") == 0 { print; exit }')"
          if [ -z "$stable_ref" ]; then
            echo "No stable release tag is reachable from compatibility base $base_ref" >&2
            exit 1
          fi
          git rev-parse --verify "${stable_ref}^{commit}" >/dev/null
-          printf '%s\n' \
-            "COMPATIBILITY_BASE_REF=$base_ref" \
-            "COMPATIBILITY_STABLE_REF=$stable_ref" \
-            "COMPATIBILITY_CANDIDATE_REF=$candidate_ref" >> "$GITHUB_ENV"
+          echo "COMPATIBILITY_BASE_REF=$base_ref" >> "$GITHUB_ENV"
+          echo "COMPATIBILITY_STABLE_REF=$stable_ref" >> "$GITHUB_ENV"

-      - name: Check historical commands, help, and complete CLI compatibility
+      - name: Check historical commands and help compatibility
        if: ${{ needs.lint.outputs.changelog_only != 'true' && needs.lint.outputs.docs_only != 'true' && (needs.lint.outputs.full_suite == 'true' || needs.lint.outputs.interface_sensitive == 'true') }}
        run: |
          make authoritative-interface-integrity \
-            BASE_REF="$COMPATIBILITY_BASE_REF" \
-            STABLE_REF="$COMPATIBILITY_STABLE_REF" \
-            CANDIDATE_REF="$COMPATIBILITY_CANDIDATE_REF"
+            BASE_REF="$COMPATIBILITY_BASE_REF"
+          if [ "$(git rev-parse "${COMPATIBILITY_BASE_REF}^{commit}")" != "$(git rev-parse "${COMPATIBILITY_STABLE_REF}^{commit}")" ]; then
+            make authoritative-interface-integrity \
+              BASE_REF="$COMPATIBILITY_STABLE_REF"
+          fi
+
+      - name: Check complete CLI command compatibility
+        if: ${{ needs.lint.outputs.changelog_only != 'true' && needs.lint.outputs.docs_only != 'true' && (needs.lint.outputs.full_suite == 'true' || needs.lint.outputs.interface_sensitive == 'true') }}
+        run: |
+          ./scripts/policy/check-command-compatibility.sh \
+            --base-ref "$COMPATIBILITY_BASE_REF" \
+            --stable-ref "$COMPATIBILITY_STABLE_REF"

      - name: Check complete Schema compatibility
        if: ${{ needs.lint.outputs.changelog_only != 'true' && needs.lint.outputs.docs_only != 'true' && (needs.lint.outputs.full_suite == 'true' || needs.lint.outputs.interface_sensitive == 'true') }}
-        run: |
-          make schema-compatibility \
-            BASE_REF="$COMPATIBILITY_BASE_REF" \
-            STABLE_REF="$COMPATIBILITY_STABLE_REF" \
-            CANDIDATE_REF="$COMPATIBILITY_CANDIDATE_REF"
+        run: make schema-compatibility BASE_REF="$COMPATIBILITY_BASE_REF"

      - name: Check skill command references
        if: ${{ needs.lint.outputs.changelog_only != 'true' && needs.lint.outputs.docs_only != 'true' && (needs.lint.outputs.full_suite == 'true' || needs.lint.outputs.interface_sensitive == 'true') }}
@@ -1,139 +0,0 @@
-name: PR Eval Dispatch
-
-# `/eval <products> [sha=<full-head-sha>] [cases=<ref>]` PR 评论 → 触发内网评测流水线，报告由内网 bot 回贴。
-# 本 workflow 只在默认分支上下文运行，不 checkout、不执行 PR 代码。
-# 审核 SHA 规则：评测他人 PR 必须显式携带 sha=（审阅背书凭据，验证
-# 其恰为当前 open head）；评测自己创建的 PR 可省略，自动钉住派发时刻
-# 的当前 head（作者自背书，无第三方偷换窗口）；内网 CI 另以
-# FETCH_HEAD 校验兜底派发后的变更。
-# 授权两级：仓库 write/maintain/admin 可派发任意 PR；默认分支
-# .github/eval-allowlist.txt 名单内的用户仅可派发自己创建的 PR。
-# 触发通道与凭证全部经 secrets 注入，文件内不出现任何内网信息。
-
-on:
-  issue_comment:
-    types:
-      - created
-
-permissions: {}
-
-concurrency:
-  group: eval-dispatch-${{ github.event.issue.number }}
-  cancel-in-progress: false
-
-jobs:
-  dispatch:
-    name: Dispatch internal evaluation
-    if: >-
-      github.event.issue.pull_request &&
-      startsWith(github.event.comment.body, '/eval')
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    permissions:
-      contents: read
-      issues: write
-      pull-requests: read
-    steps:
-      - name: Check out default branch tooling
-        uses: actions/checkout@v4
-
-      - name: Verify commenter dispatch authorization
-        env:
-          GH_TOKEN: ${{ github.token }}
-          COMMENTER: ${{ github.event.comment.user.login }}
-          PR_AUTHOR: ${{ github.event.issue.user.login }}
-          EVAL_ALLOWLIST_PATH: .github/eval-allowlist.txt
-        run: |
-          # 不用 --fail：非协作者查权限返回 404 错误体，交由 guard 走名单分支；硬网络错误降级为空对象同样 fail-closed
-          permission_json="$(curl --silent --show-error \
-            -H "Authorization: Bearer ${GH_TOKEN}" \
-            -H "Accept: application/vnd.github+json" \
-            "https://api.github.com/repos/${GITHUB_REPOSITORY}/collaborators/${COMMENTER}/permission")" || permission_json='{}'
-          printf '%s' "$permission_json" | python3 scripts/ci/eval_dispatch_guard.py permission
-
-      - name: Parse /eval command
-        id: parse
-        continue-on-error: true
-        env:
-          COMMENT_BODY: ${{ github.event.comment.body }}
-        run: python3 scripts/ci/eval_comment_parse.py
-
-      - name: Reply usage on parse failure
-        if: steps.parse.outcome == 'failure'
-        env:
-          GH_TOKEN: ${{ github.token }}
-          PR_NUMBER: ${{ github.event.issue.number }}
-          PARSE_ERROR: ${{ steps.parse.outputs.error }}
-        run: |
-          body="❌ /eval 命令解析失败：${PARSE_ERROR}"
-          jq -n --arg body "$body" '{body: $body}' | curl --fail --silent --show-error \
-            -X POST \
-            -H "Authorization: Bearer ${GH_TOKEN}" \
-            -H "Accept: application/vnd.github+json" \
-            --data @- \
-            "https://api.github.com/repos/${GITHUB_REPOSITORY}/issues/${PR_NUMBER}/comments" > /dev/null
-          exit 1
-
-      - name: Verify reviewed PR head
-        id: pr
-        env:
-          GH_TOKEN: ${{ github.token }}
-          PR_NUMBER: ${{ github.event.issue.number }}
-          EXPECTED_PR_NUMBER: ${{ github.event.issue.number }}
-          REVIEWED_SHA: ${{ steps.parse.outputs.reviewed_sha }}
-          COMMENTER: ${{ github.event.comment.user.login }}
-        run: |
-          pr_json="$(curl --fail --silent --show-error \
-            -H "Authorization: Bearer ${GH_TOKEN}" \
-            -H "Accept: application/vnd.github+json" \
-            "https://api.github.com/repos/${GITHUB_REPOSITORY}/pulls/${PR_NUMBER}")"
-          printf '%s' "$pr_json" \
-            | python3 scripts/ci/eval_dispatch_guard.py head \
-            >> "$GITHUB_OUTPUT"
-
-      - name: Trigger internal evaluation pipeline
-        env:
-          EVAL_TRIGGER_TOKEN: ${{ secrets.EVAL_TRIGGER_TOKEN }}
-          EVAL_TRIGGER_URL: ${{ secrets.EVAL_TRIGGER_URL }}
-          PR_NUMBER: ${{ github.event.issue.number }}
-          PR_HEAD_SHA: ${{ steps.pr.outputs.head_sha }}
-          PRODUCTS: ${{ steps.parse.outputs.products }}
-          CASES_REF: ${{ steps.parse.outputs.cases_ref }}
-        run: |
-          if [ -z "$EVAL_TRIGGER_TOKEN" ] || [ -z "$EVAL_TRIGGER_URL" ]; then
-            echo "EVAL_TRIGGER_URL / EVAL_TRIGGER_TOKEN not configured; cannot dispatch." >&2
-            exit 1
-          fi
-          jq -n \
-            --arg pr "$PR_NUMBER" \
-            --arg sha "$PR_HEAD_SHA" \
-            --arg products "$PRODUCTS" \
-            --arg cases "$CASES_REF" \
-            '{branch: "main", params: {pr_number: $pr, pr_head_sha: $sha, products: $products, cases_ref: $cases}}' \
-          | curl --fail --silent --show-error \
-            -X POST \
-            -H "private-token: ${EVAL_TRIGGER_TOKEN}" \
-            -H "Content-Type: application/json" \
-            --data @- \
-            "$EVAL_TRIGGER_URL"
-          echo "Internal evaluation dispatched."
-
-      - name: Acknowledge on PR
-        env:
-          GH_TOKEN: ${{ github.token }}
-          PR_NUMBER: ${{ github.event.issue.number }}
-          PR_HEAD_SHA: ${{ steps.pr.outputs.head_sha }}
-          PRODUCTS: ${{ steps.parse.outputs.products }}
-          CASES_REF: ${{ steps.parse.outputs.cases_ref }}
-        run: |
-          cases_note=""
-          if [ -n "$CASES_REF" ]; then
-            cases_note="，用例版本 \`${CASES_REF}\`"
-          fi
-          body="🛰️ /eval 已受理：产品集 \`${PRODUCTS}\`${cases_note}，评测对象 \`${PR_HEAD_SHA}\`。内网评测流水线运行结束后将由 bot 回贴报告（首行为基线对比头条）。"
-          jq -n --arg body "$body" '{body: $body}' | curl --fail --silent --show-error \
-            -X POST \
-            -H "Authorization: Bearer ${GH_TOKEN}" \
-            -H "Accept: application/vnd.github+json" \
-            --data @- \
-            "https://api.github.com/repos/${GITHUB_REPOSITORY}/issues/${PR_NUMBER}/comments" > /dev/null
@@ -6,57 +6,16 @@ The format is inspired by [Keep a Changelog](https://keepachangelog.com/) and th

 ## [Unreleased]

-## [1.0.58-beta.3] - 2026-08-11
-
-### Added
-
- **Aitable workflow execution and history** — adds `dws aitable workflow run` for confirmed asynchronous execution of scheduled or record-triggered workflows, plus `dws aitable workflow history` for status-, time-, and page-filtered execution records. The commands map directly to `aitable/run_workflow` and `aitable/get_flow_record_list`, validate trigger-specific arguments locally, and document the `executionId` / `instanceId` correlation.
- **Streaming-card mentions** — `chat +messages-send-card` now accepts
-  `--at-open-dingtalk-ids` and `--at-all` for group cards, passing mention
-  targets to the initial card-creation request and prepending its returned
-  `atTag` to the automatic streaming update.
- **Personal OA approval events** — personal event consumers now support task
-  creation, completion, redirection, instance start, termination, and
-  completion events, with typed output and matching usage documentation.
-
 ### Fixed

- **Machine-readable export and download receipts** — `dws doc export`,
-  `dws drive download`, and `dws drive download --version` now keep progress
-  logs on stderr under `--format json` and emit one JSON result on stdout after
-  a successful local write. The result includes the saved path and byte size;
-  document exports additionally report the node, requested format, job/task
-  ID, and final status.
- **IM search and card-write safety** — conversation-scoped search now fails
-  closed when the target cannot be verified, and streaming-card updates require
-  business evidence rather than a transport-only success response.
- **Document shortcut reliability** — document write, readback verification,
-  pagination, template/version discovery, export, media, and local-file
-  workflows now preserve compatibility while rejecting ambiguous write results.
- **Event runtime-token handoff** — personal `event consume`, `status`,
-  `stop`, and `+listen-im` honor the root `--token` without falling back to a
-  stale OAuth profile. Detached buses negotiate an owner-only, memory-only IPC
-  credential channel; tokens are never placed in child argv, environment,
-  profiles, logs, or run-state files.
-
-### Changed
-
- **Minutes `permission apply --policy` type** — `--policy` is now declared as
-  an `int` flag and its required check uses `Flags().Changed`, matching the
-  numeric-parameter convention. `--help` reports `int` instead of `string`;
-  accepted values (2/3/4) and gateway behavior are unchanged.
- **Minutes skill references** — document `permission apply` in both Minutes
-  skill references: list it in the command trees, describe its policy values and
-  how it differs from `permission add`, and add its intent routing.
- **Chat paging guidance** — typed chat message commands now document
-  `--page-all`, aggregate result shapes, and cursor behavior in CLI Help and
-  Agent selection examples.
- **Calendar skill parity** — mono and multi Calendar references are aligned to
-  prevent documentation drift without changing CLI behavior.
- **Release engineering** — CI now shards helper-package changes through the
-  full race suite, widens a flaky stdio idempotency test budget, governs exact
-  reviewed CLI/Schema type migrations, and lets authorized maintainers trigger
-  internal MCP evaluation with a reviewed `/eval` PR comment.
+- **Fail-closed devapp list pagination** (#917) — the paginated `dws devapp`
+  list shortcuts (`+list`, `+permission-list`, `+event-list`, and
+  `+version-list`) now preserve `hasMore` and `nextCursor` with each single-page
+  result, forward opaque cursors byte-for-byte (including surrounding or
+  whitespace-only values), normalize deployed providers' terminal missing,
+  null, empty, or last-observed cursor to `nextCursor: ""`, and reject malformed
+  or ambiguous pagination pages and unprojectable app items instead of emitting
+  terminal-looking partial results.

 ## [1.0.58-beta.2] - 2026-08-10

@@ -84,12 +43,6 @@ The format is inspired by [Keep a Changelog](https://keepachangelog.com/) and th
 - **`sheet range batch-clear` / `batch-set-style` 的 `--ranges` 拒绝空白工作表前缀**（用户可见行为变更）— 此前只按原始串里 `!` 的位置判断，`" !A1:B2"` 修剪后工作表名成了空串，操作却照样带着 `sheetId: ""` 提交：服务端要么让整批 `batch_update` 失败，要么更糟——落到默认工作表而不是用户指定的那张表，且命令报成功。现在工作表名与范围都必须在修剪之后仍非空，否则在发起任何请求之前报错。`batch-set-style --batch` 的纯空白 `sheetId` / `range` 同样拒绝（此前只挡空字符串）；`--batch` 下发仍用原值不替用户修剪，因为 `sheetId` 可以是允许带首尾空格的工作表**名**。两条 `--ranges` 路径现在共用同一个拆分器。
 - **`sheet insert-dimension` / `delete-dimension` / `update-dimension` 的 `--length` 严格校验**（用户可见行为变更）— 解析由 `fmt.Sscanf("%d")` 改为 `strconv.Atoi`。此前只消费前缀数字，`--length 2x` / `3foo` 会被静默当成 `2` / `3` 并对错误的行列数执行操作（删除方向不可回滚）；现在整个值必须是合法正整数，否则报错「`--length` 必须为正整数（>= 1）」且不发起任何请求。**升级影响**：原先依赖这种宽松解析、在传畸形 `--length` 的脚本会开始报错，请把参数修正为纯数字。合法数字值行为不变，上限仍为 5000。`add-dimension` 的 `--length` 是 `Int` 类型 flag，一直由 cobra 严格校验，不受影响。
 - **CLI 接口兼容门禁支持 reviewed flag 类型豁免**（无用户可见变更）— `authoritative-interface-integrity` 与 `check-command-compatibility.sh` 此前一律拒绝历史命令的 flag 类型变更，即使新类型只是把同一套校验从 RunE 前移到解析期，也没有任何评审通道。现在两道门禁各带一张精确豁免表：命令路径 + flag 名 + 旧类型 → 新类型四元组全等才命中、方向敏感（`string`→`int` 与 `int`→`string` 是两个不同的键，只有被评审的方向可用），且仅当该 flag 的其他契约（shorthand / required / hidden / no-opt / scope）纹丝不动时才放行，因此豁免夹带不了别的破坏。首条也是目前唯一一条登记的是 `dws minutes permission apply --policy` 的 `string` → `int`（配合 #912）：旧实现在 RunE 里做 `strconv.ParseInt(v, 10, 64)` 再校验 `[2,4]`，新实现由 pflag 以 `strconv.ParseInt(s, 0, 64)` 解析后仍校验 `[2,4]`，**历史上能成功的调用集是新调用集的子集**（base 0 额外接受 `0x3` 这类写法，只放宽不收紧），非法值依然失败、只是报错文案与时机前移；flag 默认值由 `""` 变 `"0"` 是类型的必然结果，两道门禁都不比较默认值，且该 flag 必须显式给出、默认值不可达。两张表必须逐字一致并有守卫测试锚定漂移——重复是被迫的而非选择：`check-authoritative-interface-baselines.sh` 会把整个 `scripts/policy/interface-baseline` 目录复制进检出历史版本的 worktree 再编译，那份拷贝不能 import 本分支新增的包。
- **Schema 兼容门禁支持 reviewed 参数类型豁免**（无用户可见变更）— 接上一条。`schema-compatibility` 是同一个 `Interface Integrity` job 里排在两道 CLI 接口门禁之后的第三道检查，此前也一律拒绝已发布参数的 `type` 变更。由于前两道先失败、`set -e` 让它从未在 CI 上暴露，上一条豁免只解决了三分之二。现在 `checkParameterCompatibility` 也带一张精确豁免表：`<product>/<tool id>` + 参数名 + 旧类型 + 新类型四元组全等才命中、方向敏感，且仅当该参数**除 `type` 外的全部已发布字段逐字段相等**时才放行。这里刻意用相等性比较而非「没有产生其他兼容性错误」：放宽 `required` / `cli_required`、清空 `required_when`、扩宽 `enum`、清空 `interface_type`、经 reviewed mapping exclusion 清空 `property`——这些变化单独看都是兼容的、根本不产生错误，若以错误列表代替相等性检查，它们就能搭着一次已评审的类型迁移一起蒙混过关。结构体整体比较还意味着将来给 `parameterSchema` 新增字段时会自动纳入守卫，而不是悄悄放宽每一条既有条目。唯一条目是 `minutes/minutes.apply_minutes_permission` 的 `policy` 由 `"string"` 迁移到 `"integer"`（配合 #912）：该 `type` 由 Cobra flag 类型投影而来（provenance `cobra_flag_type`），描述的是 CLI 如何接受取值；消费方据此拼装的是命令行，而 `--policy 4` 在两种声明下是同一个 argv，加引号的 `--policy "4"` 到 pflag 仍是 4，RunE 也仍校验 `[2,4]`——而且该参数映射的 property `policyId` 一直以数字上报，新声明比旧声明更贴近真实请求。表里的类型值必须是 `schemaType` 实际产出的带引号形态（`"string"` 而非裸 `string`），守卫测试用 `schemaType` 复算并校验类型名属于 JSON Schema 的封闭取值集合——`reviewedInterfaceRefRedirect` 曾因键的书写形态错误两次静默失效，这里不重犯。
-
-### Fixed
-
- **Event runtime-token handoff** — personal `event consume`, `status`, `stop`, and `+listen-im` now honor the existing root `--token` instead of falling back to a stale local OAuth profile. Detached personal-event buses negotiate the credential only after an additive capability handshake, receive and rotate it through owner-only local IPC, and keep it in memory; the token is never forwarded through child argv, environment variables, profiles, logs, or run-state files. Existing OAuth and multi-profile behavior is unchanged when `--token` is absent. A new client refuses to send a runtime token to an older bus and leaves its existing consumers and subscriptions untouched; the recovery message asks users to inspect `event status --as user`, preview `event stop --as user --all --dry-run`, and explicitly confirm `event stop --as user --all --yes` before retrying.
-
 ## [1.0.58-beta.1] - 2026-08-07

 ### Added
@@ -68,17 +68,9 @@ coverage is additionally selected for platform-sensitive code.
 3. Include both the commands/results and user-visible or contract-level
   behavior evidence in the PR description.
 4. Run `./scripts/policy/check-command-surface.sh --strict` when command
-   paths/flags change. CI resolves the exact merge-base, latest reachable
-   non-withdrawn stable GA tag, and committed candidate SHA, then enters the single compatibility
-   decision seam through
-   `make authoritative-interface-integrity BASE_REF=<merge-base> STABLE_REF=<latest-GA-tag> CANDIDATE_REF=<candidate-sha>`.
-   The Make target delegates to the authoritative wrapper; CI does not invoke a
-   second comparator or the legacy fixture checker. See
-   [CLI flag compatibility migration governance](docs/cli-interface-flag-migrations.md)
-   for the reviewed two-stage `pending` → `consumed` lifecycle.
-   Agent-visible flag migrations must also run
-   `make schema-compatibility BASE_REF=<merge-base> STABLE_REF=<latest-GA-tag> CANDIDATE_REF=<candidate-sha>`;
-   it consumes the same base-owned ledger rather than a second exception list.
+   paths/flags change. CI also runs
+   `./scripts/policy/check-command-compatibility.sh --base-ref <main-ref> --stable-ref <latest-GA-tag>`
+   against both the target branch and latest stable release.
 5. Run `./scripts/policy/check-generated-drift.sh` when generated artifacts may
   change.
 6. Run `./scripts/release/verify-package-managers.sh` when packaging or
@@ -24,13 +24,13 @@ help:
 	@printf "  make format-check  - Check all repository Go source files with gofmt\n"
 	@printf "  make fmt           - Format all repository Go source files\n"
 	@printf "  make policy        - Check the built dws plus open-source and Schema policies\n"
-	@printf "  make interface-integrity [BASE_REF=<ref>] [STABLE_REF=<tag>] [CANDIDATE_REF=<ref>] - Check authoritative CLI history\n"
-	@printf "  make authoritative-interface-integrity BASE_REF=<ref> [STABLE_REF=<tag>] [CANDIDATE_REF=<ref>] - Check Git-owned CLI history\n"
+	@printf "  make interface-integrity - Check historical commands and help contracts still work\n"
+	@printf "  make authoritative-interface-integrity BASE_REF=<ref> - Check the Git-owned PR merge-base\n"
 	@printf "  make coverage-gate BASE_REF=<ref> - Enforce overall non-regression and 100%% changed-code coverage\n"
 	@printf "  make coverage-gate-platform BASE_REF=<ref> PROFILE=<file> - Enforce 100%% native changed-code coverage\n"
-	@printf "  make update-interface-baseline - Update the non-authoritative CLI smoke fixture\n"
-	@printf "  make reset-interface-baseline - DANGEROUS: replace the non-authoritative CLI smoke fixture\n"
-	@printf "  make schema-compatibility BASE_REF=<ref> [STABLE_REF=<tag>] [CANDIDATE_REF=<ref>] - Check the authoritative Schema history\n"
+	@printf "  make update-interface-baseline - Add new CLI contracts without removing history\n"
+	@printf "  make reset-interface-baseline - DANGEROUS: replace all CLI compatibility history\n"
+	@printf "  make schema-compatibility BASE_REF=<ref> - Check the complete Schema contract against the PR merge-base\n"
 	@printf "  make skill-command-integrity - Check dws commands referenced by skills exist\n"
 	@printf "  make skill-context-budget - Check generated Skill drift and common-path context budgets\n"
 	@printf "  make multi-im-skill-chain-integrity - Check reviewed IM intents keep one default Skill route\n"
@@ -103,22 +103,10 @@ edition-test:
 	$(GO) test -v -count=1 ./pkg/editiontest/...

 interface-integrity:
-	@base_ref="$(BASE_REF)"; \
-	candidate_ref="$(CANDIDATE_REF)"; \
-	if [ -z "$$base_ref" ]; then base_ref="origin/main"; fi; \
-	if [ -z "$$candidate_ref" ]; then candidate_ref="HEAD"; fi; \
-	./scripts/policy/check-authoritative-interface-baselines.sh \
-		--base-ref "$$base_ref" \
-		--stable-ref "$(STABLE_REF)" \
-		--candidate-ref "$$candidate_ref"
+	@./scripts/policy/check-interface-baseline.sh

 authoritative-interface-integrity:
-	@candidate_ref="$(CANDIDATE_REF)"; \
-	if [ -z "$$candidate_ref" ]; then candidate_ref="HEAD"; fi; \
-	./scripts/policy/check-authoritative-interface-baselines.sh \
-		--base-ref "$(BASE_REF)" \
-		--stable-ref "$(STABLE_REF)" \
-		--candidate-ref "$$candidate_ref"
+	@./scripts/policy/check-authoritative-interface-baselines.sh --base-ref "$(BASE_REF)"

 coverage-gate:
 	@./scripts/policy/check-coverage-gate.sh --base-ref "$(BASE_REF)" --scope-buildable
@@ -133,12 +121,7 @@ reset-interface-baseline:
 	@./scripts/policy/check-interface-baseline.sh --reset

 schema-compatibility:
-	@candidate_ref="$(CANDIDATE_REF)"; \
-	if [ -z "$$candidate_ref" ]; then candidate_ref="HEAD"; fi; \
-	./scripts/policy/check-authoritative-schema-compatibility.sh \
-		--base-ref "$(BASE_REF)" \
-		--stable-ref "$(STABLE_REF)" \
-		--candidate-ref "$$candidate_ref"
+	@./scripts/policy/check-authoritative-schema-compatibility.sh --base-ref "$(BASE_REF)"

 skill-command-integrity:
 	@./scripts/policy/check-skill-commands.sh
@@ -471,7 +471,7 @@ Env vars: `DWS_SKILL_MODE=mono|multi` (also honored by `install.sh` / `install.p
 <details>
 <summary><strong>Personal Event Subscription</strong> — real-time DingTalk messages for event-driven agents</summary>

-`dws event consume` subscribes as the currently logged-in user over a managed Stream WebSocket and emits each event as one NDJSON line on stdout. The public catalog covers scoped and all one-to-one/group messages, specified senders, read/recall/reaction events, group lifecycle events, and six OA approval task/instance events.
+`dws event consume` subscribes as the currently logged-in user over a managed Stream WebSocket and emits each event as one NDJSON line on stdout. The public catalog covers scoped and all one-to-one/group messages, specified senders, read/recall/reaction events, and group title/disband lifecycle events.

 The default `ndjson`, `json`, and `pretty` output preserves the transport envelope (`type`, `event_type`, string `data`, and `headers`) for existing scripts; `compact` retains its existing processor. Add `--flatten` to emit the stable top-level business fields used by Agent workflows. `--format` controls JSON serialization; `--flatten` controls the data structure and cannot be combined with `-f raw` or `--debug-raw-events`.

@@ -481,33 +481,28 @@ For an event-focused installation, use the official convenience installer:

 ```bash
 curl -fsSL https://raw.githubusercontent.com/DingTalk-Real-AI/dingtalk-workspace-cli/main/scripts/install-event.sh | sh
-
-# Or install the standalone multi skill from an existing dws installation
-dws skill setup --mode multi -s event
 ```

 ```bash
 # Inspect the public personal event catalog and schema
 dws event list
 dws event schema user_im_message_receive_o2o --flatten
-dws event list --category oa
-dws event schema user_oa_approval_task_created --flatten

 # Listen for messages that mention the current user
-dws event +listen-im --kind at-me -f ndjson
+dws event consume user_im_message_receive_at --flatten -f ndjson

-# Listen for messages from a specified sender
-dws event +listen-im --kind sender --user <userId> -f ndjson
+# Listen for one-to-one messages with a specified user
+dws event consume user_im_message_receive_o2o --user <userId> --flatten -f ndjson

 # Listen by openDingtalkId (external contact, bot, or cross-organization identity)
-dws event +listen-im --kind sender --open-dingtalk-id <openDingtalkId> -f ndjson
+dws event consume user_im_message_receive_o2o --open-dingtalk-id <openDingtalkId> --flatten -f ndjson

 # Listen for messages in a specified group
-dws event +listen-im --kind group --chat-id <openConversationId> -f ndjson
+dws event consume user_im_message_receive_group --group <openConversationId> --flatten -f ndjson

 # Listen for all one-to-one or all group messages
-dws event +listen-im --kind all-direct -f ndjson
-dws event +listen-im --kind all-group -f ndjson
+dws event consume user_im_message_receive_o2o_all --flatten -f ndjson
+dws event consume user_im_message_receive_group_all --flatten -f ndjson

 # Listen for a specified group's title changes, member changes, or disband event
 dws event consume user_im_group_updated --group <openConversationId> --flatten -f ndjson
@@ -515,19 +510,14 @@ dws event consume user_im_group_member_added --group <openConversationId> --flat
 dws event consume user_im_group_member_exited --group <openConversationId> --flatten -f ndjson
 dws event consume user_im_group_disbanded --group <openConversationId> --flatten -f ndjson

-# Listen for messages, reads, and recalls from the same sender in one process
-dws event +listen-im --kind sender --user <userId> \
-  --events message,read,recall -f ndjson
-
-# Listen for all six public OA approval events in one process
+# Listen for multiple events for the same user in one process
 dws event consume \
-  user_oa_approval_task_created \
-  user_oa_approval_task_finished \
-  user_oa_approval_task_redirected \
-  user_oa_approval_instance_started \
-  user_oa_approval_instance_terminated \
-  user_oa_approval_instance_finished \
-  --flatten -f ndjson
+  user_im_message_receive_o2o \
+  user_im_message_read_o2o \
+  user_im_message_recall_o2o \
+  --user <userId> \
+  --flatten \
+  -f ndjson

 # Inspect local consumers and cancel a subscription
 dws event status
@@ -546,7 +536,7 @@ For one-to-one and specified-sender events, use exactly one target identity: `--
 | Observability | `status` shows remote subscriptions, the personal bus, and local consumers |
 | Cross-platform | Unix Socket on macOS/Linux, Windows Named Pipe on Windows |

-See `skills/multi/dingtalk-event/SKILL.md` for the Agent workflow and supported event parameters.
+See `skills/multi/dingtalk-misc/references/event.md` for the Agent workflow and supported event parameters.

 </details>

@@ -465,7 +465,7 @@ DWS_SKILL_SOURCE=/path/to/skills dws skill setup --mode multi
 <details>
 <summary><strong>个人事件订阅</strong> — 实时接收钉钉消息，驱动事件触发的 Agent</summary>

-`dws event consume` 使用当前 OAuth 登录用户建立托管的 Stream WebSocket 长连接，并把每条事件以 NDJSON 一行输出到 stdout。当前公开目录覆盖指定范围和全量单聊/群消息、指定发送人、已读/撤回/表情回应、群生命周期，以及六个 OA 审批任务/实例事件。
+`dws event consume` 使用当前 OAuth 登录用户建立托管的 Stream WebSocket 长连接，并把每条事件以 NDJSON 一行输出到 stdout。当前公开目录覆盖指定范围和全量单聊/群消息、指定发送人、已读/撤回/表情回应，以及群标题变更和群解散事件。

 默认 `ndjson`、`json`、`pretty` 输出保留兼容 transport envelope（`type`、`event_type`、字符串 `data`、`headers`），`compact` 继续沿用原 processor。Agent 或新脚本显式加 `--flatten` 后，输出稳定的顶层业务字段。`--format` 控制 JSON 序列化，`--flatten` 控制数据结构，且不能与 `-f raw` 或 `--debug-raw-events` 同时使用。

@@ -475,33 +475,28 @@ DWS_SKILL_SOURCE=/path/to/skills dws skill setup --mode multi

 ```bash
 curl -fsSL https://raw.githubusercontent.com/DingTalk-Real-AI/dingtalk-workspace-cli/main/scripts/install-event.sh | sh
-
-# 或在已有 dws 环境中安装独立的 multi skill
-dws skill setup --mode multi -s event
 ```

 ```bash
 # 查看公开个人事件目录和 schema
 dws event list
 dws event schema user_im_message_receive_o2o --flatten
-dws event list --category oa
-dws event schema user_oa_approval_task_created --flatten

 # 监听当前用户被 @ 的消息
-dws event +listen-im --kind at-me -f ndjson
+dws event consume user_im_message_receive_at --flatten -f ndjson

-# 监听指定发送人的消息
-dws event +listen-im --kind sender --user <userId> -f ndjson
+# 监听与指定用户的单聊消息
+dws event consume user_im_message_receive_o2o --user <userId> --flatten -f ndjson

 # 使用 openDingtalkId 监听外部联系人、机器人或跨组织身份
-dws event +listen-im --kind sender --open-dingtalk-id <openDingtalkId> -f ndjson
+dws event consume user_im_message_receive_o2o --open-dingtalk-id <openDingtalkId> --flatten -f ndjson

 # 监听指定群的消息
-dws event +listen-im --kind group --chat-id <openConversationId> -f ndjson
+dws event consume user_im_message_receive_group --group <openConversationId> --flatten -f ndjson

 # 监听所有单聊或所有群消息
-dws event +listen-im --kind all-direct -f ndjson
-dws event +listen-im --kind all-group -f ndjson
+dws event consume user_im_message_receive_o2o_all --flatten -f ndjson
+dws event consume user_im_message_receive_group_all --flatten -f ndjson

 # 监听指定群标题变更、成员进退群或群解散
 dws event consume user_im_group_updated --group <openConversationId> --flatten -f ndjson
@@ -509,19 +504,14 @@ dws event consume user_im_group_member_added --group <openConversationId> --flat
 dws event consume user_im_group_member_exited --group <openConversationId> --flatten -f ndjson
 dws event consume user_im_group_disbanded --group <openConversationId> --flatten -f ndjson

-# 一个进程监听同一发送人的消息、已读和撤回
-dws event +listen-im --kind sender --user <userId> \
-  --events message,read,recall -f ndjson
-
-# 一个进程监听全部六个公开 OA 审批事件
+# 一个进程监听同一用户的多个事件
 dws event consume \
-  user_oa_approval_task_created \
-  user_oa_approval_task_finished \
-  user_oa_approval_task_redirected \
-  user_oa_approval_instance_started \
-  user_oa_approval_instance_terminated \
-  user_oa_approval_instance_finished \
-  --flatten -f ndjson
+  user_im_message_receive_o2o \
+  user_im_message_read_o2o \
+  user_im_message_recall_o2o \
+  --user <userId> \
+  --flatten \
+  -f ndjson

 # 查看本地 consume，并取消指定订阅
 dws event status
@@ -540,7 +530,7 @@ dws event stop <subscribe_id>
 | 状态可观测 | `status` 同时显示服务端订阅、personal bus 和本地 consumers |
 | 跨平台 | macOS/Linux 使用 Unix Socket，Windows 使用 Named Pipe |

-Agent 工作流和事件参数详见 `skills/multi/dingtalk-event/SKILL.md`。
+Agent 工作流和事件参数详见 `skills/multi/dingtalk-misc/references/event.md`。

 </details>

@@ -17,23 +17,18 @@
 package main

 import (
-	"bytes"
 	"encoding/json"
 	"flag"
 	"fmt"
 	"io"
 	"os"
 	"path/filepath"
-	"strings"

 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/app"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/i18n"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/interfacesnapshot"
-	"github.com/spf13/cobra"
 )

-var newRootCommand = func() *cobra.Command { return app.NewRootCommand() }
-
 func main() {
 	os.Exit(run(os.Args[1:], os.Stdout, os.Stderr))
 }
@@ -117,11 +112,7 @@ func runGenerate(args []string, stdout, stderr io.Writer) error {
 	defer i18n.SetLang(previousLang)
 	i18n.SetLang("en")

-	root := newRootCommand()
-	snapshot := interfacesnapshot.Capture(root)
-	if err := validateHelpRendering(root, snapshot); err != nil {
-		return err
-	}
+	snapshot := interfacesnapshot.Capture(app.NewRootCommand())
 	if *output == "-" {
 		return interfacesnapshot.Write(stdout, snapshot)
 	}
@@ -147,16 +138,6 @@ func runCompare(args []string, stdout, stderr io.Writer) (bool, error) {
 	currentPath := flags.String("current", "", "candidate snapshot path")
 	basePath := flags.String("base", "", "target main/development baseline snapshot path")
 	stablePath := flags.String("stable", "", "latest stable GA snapshot path")
-	approvedMigrationsPath := flags.String(
-		"approved-flag-migrations",
-		"",
-		"merge-base-owned approved flag migration manifest",
-	)
-	candidateMigrationsPath := flags.String(
-		"candidate-flag-migrations",
-		"",
-		"candidate flag migration manifest",
-	)
 	if err := flags.Parse(args); err != nil {
 		return false, err
 	}
@@ -169,14 +150,6 @@ func runCompare(args []string, stdout, stderr io.Writer) (bool, error) {
 	if *basePath == "" && *stablePath == "" {
 		return false, fmt.Errorf("compare requires --base, --stable, or both")
 	}
-	if (*approvedMigrationsPath == "") != (*candidateMigrationsPath == "") {
-		return false, fmt.Errorf(
-			"--approved-flag-migrations and --candidate-flag-migrations must be provided together",
-		)
-	}
-	if *approvedMigrationsPath != "" && (*basePath == "" || *stablePath == "") {
-		return false, fmt.Errorf("flag migration compare requires both --base and --stable")
-	}

 	current, err := readSnapshot(*currentPath)
 	if err != nil {
@@ -197,25 +170,6 @@ func runCompare(args []string, stdout, stderr io.Writer) (bool, error) {
 	}

 	report := interfacesnapshot.CompareAll(current, references)
-	if *approvedMigrationsPath != "" {
-		approved, readErr := readFlagMigrationManifest(*approvedMigrationsPath)
-		if readErr != nil {
-			return false, fmt.Errorf("read approved flag migrations: %w", readErr)
-		}
-		candidate, readErr := readFlagMigrationManifest(*candidateMigrationsPath)
-		if readErr != nil {
-			return false, fmt.Errorf("read candidate flag migrations: %w", readErr)
-		}
-		report, err = interfacesnapshot.CompareAllWithFlagMigrations(
-			current,
-			references,
-			approved,
-			candidate,
-		)
-		if err != nil {
-			return false, fmt.Errorf("validate flag migration lifecycle: %w", err)
-		}
-	}
 	encoder := json.NewEncoder(stdout)
 	encoder.SetEscapeHTML(false)
 	encoder.SetIndent("", "  ")
@@ -225,49 +179,6 @@ func runCompare(args []string, stdout, stderr io.Writer) (bool, error) {
 	return report.Compatible, nil
 }

-func readFlagMigrationManifest(path string) (interfacesnapshot.FlagMigrationManifest, error) {
-	file, err := os.Open(filepath.Clean(path))
-	if err != nil {
-		return interfacesnapshot.FlagMigrationManifest{}, err
-	}
-	defer file.Close()
-	return interfacesnapshot.ReadFlagMigrationManifest(file)
-}
-
-func validateHelpRendering(root *cobra.Command, snapshot interfacesnapshot.Snapshot) error {
-	for _, command := range snapshot.Commands {
-		path := strings.TrimPrefix(command.Path, "dws")
-		resolved, remaining, err := root.Find(strings.Fields(path))
-		if err != nil || len(remaining) != 0 || resolved == nil {
-			return fmt.Errorf("resolve %q before help rendering: remaining=%v error=%v", command.Path, remaining, err)
-		}
-		if err := renderCommandHelp(resolved); err != nil {
-			return fmt.Errorf("render %q help: %w", command.Path, err)
-		}
-	}
-	return nil
-}
-
-func renderCommandHelp(command *cobra.Command) (err error) {
-	var stdout, stderr bytes.Buffer
-	command.InitDefaultHelpFlag()
-	command.SetOut(&stdout)
-	command.SetErr(&stderr)
-	defer func() {
-		if recovered := recover(); recovered != nil {
-			err = fmt.Errorf("help renderer panicked: %v", recovered)
-		}
-	}()
-	command.HelpFunc()(command, []string{})
-	if stderr.Len() > 0 {
-		return fmt.Errorf("help renderer wrote an error: %s", strings.TrimSpace(stderr.String()))
-	}
-	if stdout.Len() == 0 {
-		return fmt.Errorf("help renderer produced empty output")
-	}
-	return nil
-}
-
 func readSnapshot(path string) (interfacesnapshot.Snapshot, error) {
 	file, err := os.Open(filepath.Clean(path))
 	if err != nil {
@@ -280,5 +191,5 @@ func readSnapshot(path string) (interfacesnapshot.Snapshot, error) {
 func printUsage(w io.Writer) {
 	fmt.Fprintln(w, "usage:")
 	fmt.Fprintln(w, "  interface-snapshot generate [--output FILE]")
-	fmt.Fprintln(w, "  interface-snapshot compare --current FILE [--base FILE] [--stable FILE] [--approved-flag-migrations FILE --candidate-flag-migrations FILE]")
+	fmt.Fprintln(w, "  interface-snapshot compare --current FILE [--base FILE] [--stable FILE]")
 }
@@ -15,16 +15,11 @@ package main

 import (
 	"bytes"
-	"errors"
-	"io"
 	"os"
 	"path/filepath"
-	"strings"
 	"testing"

 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/interfacesnapshot"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/testseam"
-	"github.com/spf13/cobra"
 )

 func TestCrossPlatformCoverageRunGenerateCapturesActualRootOffline(t *testing.T) {
@@ -61,24 +56,6 @@ func TestCrossPlatformCoverageRunGenerateCapturesActualRootOffline(t *testing.T)
 	}
 }

-func TestCrossPlatformCoverageRunGenerateRejectsHelpRenderingFailure(t *testing.T) {
-	testseam.Swap(t, &newRootCommand, func() *cobra.Command {
-		root := &cobra.Command{Use: "dws"}
-		root.SetHelpFunc(func(command *cobra.Command, _ []string) {
-			_, _ = io.WriteString(command.ErrOrStderr(), "injected help failure")
-		})
-		return root
-	})
-
-	var stdout, stderr bytes.Buffer
-	if exitCode := run([]string{"generate"}, &stdout, &stderr); exitCode != 2 {
-		t.Fatalf("run(generate) exit=%d stderr=%s", exitCode, stderr.String())
-	}
-	if !strings.Contains(stderr.String(), "injected help failure") {
-		t.Fatalf("run(generate) stderr=%q", stderr.String())
-	}
-}
-
 func TestCrossPlatformCoverageRunCompareUsesBothSnapshotInputsAndExitCode(t *testing.T) {
 	current := commandSnapshot("dws")
 	mergeBase := commandSnapshot("dws")
@@ -106,368 +83,6 @@ func TestCrossPlatformCoverageRunCompareUsesBothSnapshotInputsAndExitCode(t *tes
 	}
 }

-func TestCrossPlatformCoverageRunCompareEnforcesBaseOwnedFlagMigrationLifecycle(t *testing.T) {
-	dir := t.TempDir()
-	before := flagMigrationSnapshot(false)
-	after := flagMigrationSnapshot(true)
-	currentPath := writeSnapshot(t, dir, "current.json", after)
-	basePath := writeSnapshot(t, dir, "base.json", before)
-	stablePath := writeSnapshot(t, dir, "stable.json", before)
-	approvedPath := writeManifest(t, dir, "approved.json", flagMigrationManifestJSON("pending"))
-	candidatePath := writeManifest(t, dir, "candidate.json", flagMigrationManifestJSON("consumed"))
-
-	var stdout, stderr bytes.Buffer
-	exitCode := run([]string{
-		"compare",
-		"--current", currentPath,
-		"--base", basePath,
-		"--stable", stablePath,
-		"--approved-flag-migrations", approvedPath,
-		"--candidate-flag-migrations", candidatePath,
-	}, &stdout, &stderr)
-	if exitCode != 0 {
-		t.Fatalf("exact base-owned migration exit=%d stderr=%s", exitCode, stderr.String())
-	}
-	if !bytes.Contains(stdout.Bytes(), []byte(`"compatible": true`)) {
-		t.Fatalf("exact migration report is not compatible:\n%s", stdout.String())
-	}
-
-	stdout.Reset()
-	stderr.Reset()
-	emptyApproved := writeManifest(t, dir, "empty-approved.json", `{"version":1,"migrations":[]}`)
-	exitCode = run([]string{
-		"compare",
-		"--current", currentPath,
-		"--base", basePath,
-		"--stable", stablePath,
-		"--approved-flag-migrations", emptyApproved,
-		"--candidate-flag-migrations", candidatePath,
-	}, &stdout, &stderr)
-	if exitCode != 2 || !strings.Contains(stderr.String(), "must start pending") {
-		t.Fatalf("candidate self-approval exit=%d stdout=%s stderr=%s", exitCode, stdout.String(), stderr.String())
-	}
-}
-
-func TestCrossPlatformCoverageRunCompareRequiresBothFlagMigrationInputs(t *testing.T) {
-	dir := t.TempDir()
-	currentPath := writeSnapshot(t, dir, "current.json", commandSnapshot("dws"))
-	basePath := writeSnapshot(t, dir, "base.json", commandSnapshot("dws"))
-	approvedPath := writeManifest(t, dir, "approved.json", `{"version":1,"migrations":[]}`)
-
-	var stdout, stderr bytes.Buffer
-	exitCode := run([]string{
-		"compare",
-		"--current", currentPath,
-		"--base", basePath,
-		"--approved-flag-migrations", approvedPath,
-	}, &stdout, &stderr)
-	if exitCode != 2 || !strings.Contains(stderr.String(), "must be provided together") {
-		t.Fatalf("one-sided migration input exit=%d stdout=%s stderr=%s", exitCode, stdout.String(), stderr.String())
-	}
-}
-
-func TestCrossPlatformCoverageRunCompareRequiresBothReferencesForFlagMigrations(t *testing.T) {
-	dir := t.TempDir()
-	currentPath := writeSnapshot(t, dir, "current.json", commandSnapshot("dws"))
-	basePath := writeSnapshot(t, dir, "base.json", commandSnapshot("dws"))
-	stablePath := writeSnapshot(t, dir, "stable.json", commandSnapshot("dws"))
-	approvedPath := writeManifest(t, dir, "approved.json", `{"version":1,"migrations":[]}`)
-	candidatePath := writeManifest(t, dir, "candidate.json", `{"version":1,"migrations":[]}`)
-
-	tests := []struct {
-		name string
-		args []string
-	}{
-		{
-			name: "missing stable",
-			args: []string{"--base", basePath},
-		},
-		{
-			name: "missing base",
-			args: []string{"--stable", stablePath},
-		},
-	}
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			args := []string{"compare", "--current", currentPath}
-			args = append(args, test.args...)
-			args = append(args,
-				"--approved-flag-migrations", approvedPath,
-				"--candidate-flag-migrations", candidatePath,
-			)
-			var stdout, stderr bytes.Buffer
-			exitCode := run(args, &stdout, &stderr)
-			if exitCode != 2 || !strings.Contains(stderr.String(), "requires both --base and --stable") {
-				t.Fatalf("one-reference migration compare exit=%d stdout=%s stderr=%s", exitCode, stdout.String(), stderr.String())
-			}
-		})
-	}
-}
-
-func TestCrossPlatformCoverageRunPrintsUsageForMissingAndUnknownCommands(t *testing.T) {
-	tests := []struct {
-		name       string
-		args       []string
-		wantStderr []string
-	}{
-		{
-			name:       "missing command",
-			args:       nil,
-			wantStderr: []string{"usage:", "interface-snapshot generate", "--approved-flag-migrations"},
-		},
-		{
-			name:       "unknown command",
-			args:       []string{"unknown"},
-			wantStderr: []string{`unknown command "unknown"`, "usage:", "interface-snapshot compare"},
-		},
-	}
-
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			var stdout, stderr bytes.Buffer
-			if exitCode := run(test.args, &stdout, &stderr); exitCode != 2 {
-				t.Fatalf("run(%v) exit=%d, want 2", test.args, exitCode)
-			}
-			if stdout.Len() != 0 {
-				t.Fatalf("run(%v) unexpectedly wrote stdout: %s", test.args, stdout.String())
-			}
-			for _, want := range test.wantStderr {
-				if !strings.Contains(stderr.String(), want) {
-					t.Errorf("run(%v) stderr missing %q:\n%s", test.args, want, stderr.String())
-				}
-			}
-		})
-	}
-}
-
-func TestCrossPlatformCoverageRunRejectsInvalidSubcommandArguments(t *testing.T) {
-	tests := []struct {
-		name string
-		args []string
-		want string
-	}{
-		{name: "generate unknown flag", args: []string{"generate", "--unknown"}, want: "flag provided but not defined"},
-		{name: "generate positional", args: []string{"generate", "unexpected"}, want: "generate accepts no positional arguments"},
-		{name: "compare unknown flag", args: []string{"compare", "--unknown"}, want: "flag provided but not defined"},
-		{name: "compare positional", args: []string{"compare", "unexpected"}, want: "compare accepts no positional arguments"},
-		{name: "compare missing current", args: []string{"compare", "--base", "base.json"}, want: "compare requires --current"},
-		{name: "compare missing reference", args: []string{"compare", "--current", "current.json"}, want: "compare requires --base, --stable, or both"},
-	}
-
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			var stdout, stderr bytes.Buffer
-			if exitCode := run(test.args, &stdout, &stderr); exitCode != 2 {
-				t.Fatalf("run(%v) exit=%d, want 2", test.args, exitCode)
-			}
-			if !strings.Contains(stderr.String(), test.want) {
-				t.Fatalf("run(%v) stderr missing %q:\n%s", test.args, test.want, stderr.String())
-			}
-		})
-	}
-}
-
-func TestCrossPlatformCoverageRunGenerateRejectsUnsafeOutputPath(t *testing.T) {
-	outputDirectory := t.TempDir()
-	var stdout, stderr bytes.Buffer
-	exitCode := run([]string{"generate", "--output", outputDirectory}, &stdout, &stderr)
-	if exitCode != 2 || !strings.Contains(stderr.String(), "create snapshot") {
-		t.Fatalf("directory output exit=%d stdout=%s stderr=%s", exitCode, stdout.String(), stderr.String())
-	}
-}
-
-func TestCrossPlatformCoverageRunGenerateReportsTemporaryDirectoryFailure(t *testing.T) {
-	missingTempRoot := filepath.Join(t.TempDir(), "missing")
-	for _, name := range []string{"TMPDIR", "TMP", "TEMP"} {
-		t.Setenv(name, missingTempRoot)
-	}
-
-	var stdout, stderr bytes.Buffer
-	exitCode := run([]string{"generate"}, &stdout, &stderr)
-	if exitCode != 2 || !strings.Contains(stderr.String(), "create isolated home") {
-		t.Fatalf("invalid temporary root exit=%d stdout=%s stderr=%s", exitCode, stdout.String(), stderr.String())
-	}
-}
-
-func TestCrossPlatformCoverageRunCompareReportsSnapshotReadFailures(t *testing.T) {
-	dir := t.TempDir()
-	validPath := writeSnapshot(t, dir, "valid.json", commandSnapshot("dws"))
-	missingPath := filepath.Join(dir, "missing.json")
-	tests := []struct {
-		name string
-		args []string
-		want string
-	}{
-		{
-			name: "current",
-			args: []string{"compare", "--current", missingPath, "--base", validPath},
-			want: "read current snapshot",
-		},
-		{
-			name: "main",
-			args: []string{"compare", "--current", validPath, "--base", missingPath},
-			want: "read main/development baseline snapshot",
-		},
-		{
-			name: "stable",
-			args: []string{"compare", "--current", validPath, "--stable", missingPath},
-			want: "read stable snapshot",
-		},
-	}
-
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			var stdout, stderr bytes.Buffer
-			if exitCode := run(test.args, &stdout, &stderr); exitCode != 2 {
-				t.Fatalf("run(compare) exit=%d, want 2", exitCode)
-			}
-			if !strings.Contains(stderr.String(), test.want) {
-				t.Fatalf("stderr missing %q:\n%s", test.want, stderr.String())
-			}
-		})
-	}
-}
-
-func TestCrossPlatformCoverageRunCompareReportsEachManifestReadFailure(t *testing.T) {
-	dir := t.TempDir()
-	snapshotPath := writeSnapshot(t, dir, "snapshot.json", commandSnapshot("dws"))
-	validManifest := writeManifest(t, dir, "valid-manifest.json", `{"version":1,"migrations":[]}`)
-	invalidManifest := writeManifest(t, dir, "invalid-manifest.json", `{`)
-	tests := []struct {
-		name      string
-		approved  string
-		candidate string
-		want      string
-	}{
-		{
-			name:      "approved manifest",
-			approved:  invalidManifest,
-			candidate: validManifest,
-			want:      "read approved flag migrations",
-		},
-		{
-			name:      "candidate manifest",
-			approved:  validManifest,
-			candidate: invalidManifest,
-			want:      "read candidate flag migrations",
-		},
-	}
-
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			var stdout, stderr bytes.Buffer
-			exitCode := run([]string{
-				"compare",
-				"--current", snapshotPath,
-				"--base", snapshotPath,
-				"--stable", snapshotPath,
-				"--approved-flag-migrations", test.approved,
-				"--candidate-flag-migrations", test.candidate,
-			}, &stdout, &stderr)
-			if exitCode != 2 || !strings.Contains(stderr.String(), test.want) {
-				t.Fatalf("%s exit=%d stdout=%s stderr=%s", test.name, exitCode, stdout.String(), stderr.String())
-			}
-		})
-	}
-}
-
-func TestCrossPlatformCoverageRunCompareReportsOutputFailure(t *testing.T) {
-	dir := t.TempDir()
-	snapshotPath := writeSnapshot(t, dir, "snapshot.json", commandSnapshot("dws"))
-	var stderr bytes.Buffer
-	exitCode := run([]string{
-		"compare",
-		"--current", snapshotPath,
-		"--base", snapshotPath,
-	}, failingWriter{}, &stderr)
-	if exitCode != 2 || !strings.Contains(stderr.String(), "write comparison report") {
-		t.Fatalf("comparison output failure exit=%d stderr=%s", exitCode, stderr.String())
-	}
-}
-
-func TestCrossPlatformCoverageReadHelpersRejectMissingAndInvalidInputs(t *testing.T) {
-	dir := t.TempDir()
-	missingPath := filepath.Join(dir, "missing.json")
-	invalidPath := filepath.Join(dir, "invalid.json")
-	if err := os.WriteFile(invalidPath, []byte(`{`), 0o600); err != nil {
-		t.Fatalf("write invalid fixture: %v", err)
-	}
-
-	if _, err := readSnapshot(missingPath); err == nil {
-		t.Fatal("readSnapshot(missing) unexpectedly succeeded")
-	}
-	if _, err := readSnapshot(invalidPath); err == nil {
-		t.Fatal("readSnapshot(invalid) unexpectedly succeeded")
-	}
-	if _, err := readFlagMigrationManifest(missingPath); err == nil {
-		t.Fatal("readFlagMigrationManifest(missing) unexpectedly succeeded")
-	}
-	if _, err := readFlagMigrationManifest(invalidPath); err == nil {
-		t.Fatal("readFlagMigrationManifest(invalid) unexpectedly succeeded")
-	}
-}
-
-func TestCrossPlatformCoverageValidateHelpRenderingReportsResolveError(t *testing.T) {
-	root := &cobra.Command{Use: "dws"}
-	err := validateHelpRendering(root, commandSnapshot("dws missing"))
-	if err == nil || !strings.Contains(err.Error(), `resolve "dws missing" before help rendering`) {
-		t.Fatalf("validateHelpRendering resolve error = %v", err)
-	}
-}
-
-func TestCrossPlatformCoverageValidateHelpRenderingReportsTemplateError(t *testing.T) {
-	root := &cobra.Command{Use: "dws"}
-	root.SetHelpTemplate(`{{index .Commands 99}}`)
-	err := validateHelpRendering(root, commandSnapshot("dws"))
-	if err == nil || !strings.Contains(err.Error(), `render "dws" help`) {
-		t.Fatalf("validateHelpRendering template error = %v", err)
-	}
-}
-
-func TestCrossPlatformCoverageValidateHelpRenderingRecoversTemplatePanic(t *testing.T) {
-	root := &cobra.Command{Use: "dws"}
-	root.SetHelpTemplate("{{")
-	err := validateHelpRendering(root, commandSnapshot("dws"))
-	if err == nil || !strings.Contains(err.Error(), `render "dws" help`) {
-		t.Fatalf("validateHelpRendering template panic = %v", err)
-	}
-}
-
-func TestCrossPlatformCoverageValidateHelpRenderingRejectsCustomHelpStderr(t *testing.T) {
-	root := &cobra.Command{Use: "dws"}
-	root.SetHelpFunc(func(command *cobra.Command, _ []string) {
-		_, _ = io.WriteString(command.ErrOrStderr(), "injected help failure")
-	})
-	err := validateHelpRendering(root, commandSnapshot("dws"))
-	if err == nil || !strings.Contains(err.Error(), "injected help failure") {
-		t.Fatalf("validateHelpRendering custom stderr = %v", err)
-	}
-}
-
-func TestCrossPlatformCoverageValidateHelpRenderingRejectsEmptyOutput(t *testing.T) {
-	root := &cobra.Command{Use: "dws"}
-	root.SetHelpFunc(func(*cobra.Command, []string) {})
-	err := validateHelpRendering(root, commandSnapshot("dws"))
-	if err == nil || !strings.Contains(err.Error(), "empty") {
-		t.Fatalf("validateHelpRendering empty output = %v", err)
-	}
-}
-
-func TestCrossPlatformCoverageValidateHelpRenderingAcceptsNormalOutput(t *testing.T) {
-	root := &cobra.Command{Use: "dws", Short: "root command"}
-	if err := validateHelpRendering(root, commandSnapshot("dws")); err != nil {
-		t.Fatalf("validateHelpRendering normal output: %v", err)
-	}
-}
-
-type failingWriter struct{}
-
-func (failingWriter) Write([]byte) (int, error) {
-	return 0, errors.New("injected write failure")
-}
-
-var _ io.Writer = failingWriter{}
-
 func commandSnapshot(paths ...string) interfacesnapshot.Snapshot {
 	commands := make([]interfacesnapshot.Command, 0, len(paths))
 	for _, path := range paths {
@@ -505,68 +120,6 @@ func writeSnapshot(t *testing.T, dir, name string, snapshot interfacesnapshot.Sn
 	return path
 }

-func writeManifest(t *testing.T, dir, name, contents string) string {
-	t.Helper()
-	path := filepath.Join(dir, name)
-	if err := os.WriteFile(path, []byte(contents), 0o600); err != nil {
-		t.Fatalf("write %s: %v", path, err)
-	}
-	return path
-}
-
-func flagMigrationSnapshot(after bool) interfacesnapshot.Snapshot {
-	legacy := interfacesnapshot.Flag{
-		Name:      "legacy-id",
-		Shorthand: "l",
-		Type:      "string",
-		Default:   "",
-		NoOpt:     "auto",
-		Required:  true,
-	}
-	flags := []interfacesnapshot.Flag{legacy}
-	if after {
-		legacy.Required = false
-		legacy.Hidden = true
-		legacy.AliasOf = "message-id"
-		flags = []interfacesnapshot.Flag{
-			legacy,
-			{Name: "message-id", Type: "string", Default: "", Required: true},
-		}
-	}
-	return interfacesnapshot.Snapshot{
-		SchemaVersion: interfacesnapshot.SchemaVersion,
-		Rules: interfacesnapshot.Rules{
-			ExcludedCommandSubtrees: []string{},
-			ExcludedFlags:           []string{},
-		},
-		Commands: []interfacesnapshot.Command{
-			{Path: "dws", Runnable: true, Aliases: []string{}, LocalFlags: []interfacesnapshot.Flag{}, InheritedFlags: []interfacesnapshot.Flag{}},
-			{Path: "dws chat send", Runnable: true, Aliases: []string{}, LocalFlags: flags, InheritedFlags: []interfacesnapshot.Flag{}},
-		},
-	}
-}
-
-func flagMigrationManifestJSON(state string) string {
-	return strings.Replace(`{
-  "version": 1,
-  "migrations": [{
-    "command": "dws chat send",
-    "legacy": {
-      "name": "legacy-id",
-      "before": {"present": true, "type": "string", "required": true, "shorthand": "l", "no_opt": "auto", "scope": "local"},
-      "after": {"present": true, "type": "string", "hidden": true, "shorthand": "l", "no_opt": "auto", "scope": "local", "alias_of": "message-id"}
-    },
-    "canonical": {
-      "name": "message-id",
-      "before": {"present": false},
-      "after": {"present": true, "type": "string", "required": true, "scope": "local"}
-    },
-    "state": "STATE",
-    "reason": "reviewed exact migration"
-  }]
-}`, "STATE", state, 1)
-}
-
 func hasFlag(flags []interfacesnapshot.Flag, name, flagType string) bool {
 	for _, flag := range flags {
 		if flag.Name == name && flag.Type == flagType {
@@ -157,33 +157,15 @@ expected to repeat every CI job locally:
 ```sh
 make build
 make policy
-make interface-integrity BASE_REF=<merge-base> STABLE_REF=<stable-tag> CANDIDATE_REF=<candidate-sha>
-make schema-compatibility BASE_REF=<merge-base> STABLE_REF=<stable-tag> CANDIDATE_REF=<candidate-sha>
+make interface-integrity
+make authoritative-interface-integrity BASE_REF=<merge-base>
+make schema-compatibility BASE_REF=<merge-base>
 make skill-command-integrity
 make cli-smoke
 make mock-mcp-smoke
 go test -v -count=1 ./pkg/editiontest/...
 ```

-CI 先解析并核对精确的 merge-base、最近可达且未撤回的 stable GA tag 和已提交的 candidate
-SHA，再调用 `make authoritative-interface-integrity`。本地 `make interface-integrity`
-与该 CI target 都只委托给同一个 modern authoritative wrapper，不存在第二个比较
-入口。省略 `BASE_REF` 时本地 target 默认比较 `origin/main`，省略 `STABLE_REF` 时自动
-选择该 base 可达且未撤回的最近 stable GA tag，省略 `CANDIDATE_REF` 时比较已提交的 `HEAD`。
-需要逐字复现某次 CI 时，应显式传入该次运行记录的 merge-base、stable tag 和
-candidate SHA。
-
-`make update-interface-baseline` / `make reset-interface-baseline` 只维护
-`test/fixtures/cli-interface-baseline.txt` 这一份非权威 CLI Smoke fixture。底层旧
-`check-interface-baseline.sh` 不再作为本地或 CI 的兼容性审批入口，也不能用于批准
-flag 迁移。
-
-Schema compatibility 使用同一组 base、stable、candidate refs 和同一份 base-owned flag
-migration ledger。merge-base-owned checker 分别规范化 merge-base 与 stable 的完整
-Schema，并让 candidate 对两份历史 contract 独立执行检查；它只把已通过 Interface
-lifecycle 的 exact rename 规范化到当前历史副本，不会维护第二份 allowlist，也不会
-放宽其他 Schema 历史字段。
-
 For an exact CHANGELOG-only branch:

 ```sh
@@ -204,24 +186,11 @@ are evaluated by the same block-deduplicating checker; supporting policy and
 shortcut profiles contribute to changed-code coverage only. The checked-in
 badge is presentation only and is never read as a gate input.

-CLI 兼容检查只使用 modern Interface Snapshot 这一处权威比较 seam，并从 PR
-merge-base 和最近的可达 stable release 生成权威快照。本治理机制合入后，
-merge-base 拥有生成器、比较器和已审批迁移清单，因此 candidate 不能通过修改
-helper、fixture 或在同一 PR 新增 self-approval 记录来放行 breaking change。首次
-bootstrap 仍由 merge-base 已有的 modern helper 做无豁免比较，并只接受 candidate
-提交中的规范空清单；完整边界见下方治理文档。
-
-精确的两阶段 flag 迁移生命周期见
-[CLI flag 兼容迁移治理](cli-interface-flag-migrations.md)。治理 PR 只能在
-surface 未变化时新增 `pending`；后续产品 PR 达到审批的精确 surface 后，才能
-消费 base-owned 记录并改为 `consumed`。在 main 与 stable 都达到 after 状态前
-必须保留该回执，之后再由单独 PR 清理。机制只放行记录中的 legacy
-visible-to-hidden，以及 canonical required 新增或提升；删除、type、scope、
-shorthand、no-opt 和任何无关漂移仍然阻塞。Schema 可以新增；历史 product、
-tool、parameter、mapping、positional execution、constraint 与 safety 语义继续
-受保护。`alias_of` 只是一项由 `FlagSpec.Aliases` 产生的框架关系证据，不是 payload
-等价证明；产品 PR 仍须证明 canonical 与 legacy 的最终运行 payload 等价并在 transport
-前拒绝冲突输入。当前迁移清单为空，不授权 PR #904。
+Compatibility checks derive authoritative Interface snapshots from the PR
+merge-base and the latest reachable stable release. The candidate cannot bless
+a breaking change by editing a fixture. Schema additions are allowed;
+historical products, tools, parameters, mappings, positional execution fields,
+constraints, and safety semantics remain protected.

 ## Required GitHub repository settings

@@ -1,176 +0,0 @@
-# CLI flag 兼容迁移治理
-
-本文定义一种受控迁移：保留旧 flag 的可执行兼容性，但把它从 Help 与 Agent Schema 中隐藏，并将新的规范 flag 提升为必填。它只解决这一种精确变更，不是通用 breaking-change 豁免。
-
-同名 flag 的精确类型迁移属于另一类评审机制，只能进入
-`internal/interfacesnapshot/reviewed.go` 与 legacy smoke helper 的镜像表；flag rename
-只能进入本文的 JSON lifecycle ledger。一项迁移不得跨两种机制组合授权。
-
-## 唯一比较入口与信任边界
-
-PR 与本地兼容性审批的唯一权威比较入口是 modern Interface Snapshot：
-
- `cmd/interface-snapshot` 生成和比较快照；
- `internal/interfacesnapshot` 实现兼容规则和迁移生命周期；
- `scripts/policy/check-command-compatibility.sh` 组装 candidate、PR merge-base 和最近可达且未撤回的 stable GA 三份快照；
- `scripts/policy/check-authoritative-interface-baselines.sh` 只保留为 Makefile 的兼容包装，不再维护第二套判断逻辑。
-
-紧随其后的 Schema compatibility 不是第二份审批清单。它从同一 merge-base-owned
-ledger 和同一组三方 Interface Snapshot 取得已经完成 lifecycle 校验的
-authorization。merge-base-owned checker 会分别规范化 merge-base 与 stable 的完整
-Schema，并让 candidate 对两份历史 contract 独立执行检查；授权的 flag rename 只会
-精确投影到当前被检查的历史副本。candidate 不能为 CLI 与 Schema 分别提供两套例外。
-
-`make interface-integrity` 也调用上述 authoritative wrapper；默认 base 为
-`origin/main`，stable 可由包装脚本自动解析，candidate 默认为已提交的 `HEAD`。旧
-`scripts/policy/check-interface-baseline.sh` 只供
-`make update-interface-baseline` / `make reset-interface-baseline` 维护非权威 CLI
-Smoke fixture，不参与迁移审批。
-
-直接调用 `interface-snapshot compare` 时，只要提供 migration manifest 参数，就必须
-同时提供 `--base` 与 `--stable`；核心 lifecycle 也拒绝缺失 stable 的非空清单，避免
-调用方因漏传历史参考而提前清理 consumed receipt。
-
-PR merge-base 同时拥有快照生成器、比较器和已审批清单。门禁用这套 base-owned helper 检查同一个已提交 candidate revision、merge-base 与 stable，candidate 不能通过修改自己的 Go 比较 helper 来放宽规则。candidate 中的清单只参与迁移状态流转，不能批准同一个 PR 引入的接口变化。首次引入本机制时，merge-base 尚无迁移解析器；bootstrap 会用 merge-base 已有的 modern Interface Snapshot 做不带豁免的普通比较，并只接受 candidate 中逐字匹配的空清单，不会让 candidate 新增的 comparator 决定本 PR 是否兼容。bootstrap 无法让旧 helper 证明新治理实现本身正确，因此本治理 PR 的新 parser、lifecycle、launcher 与 hostile tests 仍是必须由真人评审的受保护策略变更；它们合入后才成为后续 PR 的 base-owned authority。
-
-这条边界保护比较规则和审批数据，不是任意代码沙箱。GitHub workflow / launcher 的变更仍由仓库保护规则和真人评审负责；candidate Cobra 构建也会执行 candidate 代码，因此对同一 runner 上的主动恶意代码，需要独立进程或文件系统隔离，不能把本门禁描述成已经解决。
-
-已审批清单固定为：
-
-```text
-scripts/policy/interface-migrations/approved-flag-migrations-v1.json
-```
-
-清单使用严格 JSON 解析：版本、字段名大小写、JSON 值类型、命令路径和 flag 名都必须精确；拒绝重复键、未知键、scalar `null` 与尾随 JSON 值，`reason` 不能为空；禁止 `*`、`?`、前缀规则或其他 wildcard。当前清单为空，因此本治理 PR **不授权 PR #904 或任何产品接口变化**。
-
-## 两阶段迁移与回执清理
-
-每条迁移以 `(command, legacy flag, canonical flag)` 为唯一精确键，并经历以下生命周期：
-
-| 阶段 | PR 可以做什么 | 必须满足的快照状态 |
-|---|---|---|
-| 1. 治理审批 | 新增 `state: pending` 的精确记录；不得在同一个 PR 修改产品 surface | candidate 和 merge-base 都与记录中的 `before` 完全一致；该记录不改变 stable 的判断 |
-| 2. 产品迁移 | merge-base 已拥有 `pending` 后，按记录一次性切到精确 `after`，并把记录改为 `state: consumed` | legacy 仍存在但由 visible 变 hidden，且声明 `alias_of`；canonical 达到记录的必填状态 |
-| 3. 保留回执 | 产品 PR 合入后，如果 stable 仍是 `before`，继续保留 `consumed` | merge-base 或 stable 仍有任一份尚未达到 `after` |
-| 4. 单独清理 | 当 merge-base 和 stable 都已经是 `after`，在后续 PR 删除该记录 | 两份参考快照均精确匹配 `after`；继续保留过期回执会被门禁拒绝 |
-
-因此，新增 `pending` 和修改产品 surface 不能发生在同一个 PR；candidate 自己新增的记录不能 self-approve。迁移也不能部分执行：legacy、canonical、`alias_of` 或状态只要有一项不匹配，门禁即失败。
-
-下面只是清单结构示例，不代表已审批命令；实际字段必须从 Interface Snapshot 核对：
-
-```json
-{
-  "version": 1,
-  "migrations": [
-    {
-      "command": "dws chat message recall",
-      "legacy": {
-        "name": "msg-id",
-        "before": {
-          "present": true,
-          "type": "string",
-          "required": true,
-          "scope": "local"
-        },
-        "after": {
-          "present": true,
-          "type": "string",
-          "hidden": true,
-          "scope": "local",
-          "alias_of": "message-id"
-        }
-      },
-      "canonical": {
-        "name": "message-id",
-        "before": { "present": false },
-        "after": {
-          "present": true,
-          "type": "string",
-          "required": true,
-          "scope": "local"
-        }
-      },
-      "state": "pending",
-      "reason": "保留旧 argv 兼容性，并将规范 flag 设为唯一可见入口"
-    }
-  ]
-}
-```
-
-产品迁移 PR 必须保持同一条记录的命令、flag、before/after 和 reason 不变，只把 `pending` 改成 `consumed`。
-
-## `alias_of` 是框架来源的受评审关系证据
-
-`alias_of` 不是 Schema 同义词、参数概念词典或任意文字声明。它只能由 `FlagSpec.Aliases` 写入，并与内部 origin `corecmd.flag_spec_aliases.v1` 成对出现；每次 Interface Integrity 都会在已提交的 detached candidate 上执行源码门禁，禁止其他生产文件写入或复刻这些 evidence token。Interface Snapshot 会验证：
-
- legacy 与 canonical 位于同一个可执行命令；
- canonical flag 确实存在；
- legacy 与 canonical 类型一致；
- legacy 不是指向自身，也不存在 alias chain；
- legacy 的 after 状态精确指向该记录中的 canonical flag。
-
-通过命令框架声明 `FlagSpec.Aliases` 时，框架会自动注册隐藏的兼容 flag，并写入两项 relation annotation；仅手写 `alias_of`、伪造 origin、重复值或不精确值都会让快照生成失败。不要用 Schema overlay、迁移清单或手写 Cobra annotation 伪造关系。
-
-这项关系证据只证明 legacy/canonical 经过受控框架路径建立关系，不证明最终 transport payload 等价，也不会替产品代码实现命令特有的值同步。当前框架还禁止把
-`MarkRequired` 与 `FlagSpec.Aliases` 直接组合，因为 Cobra 的 hard-required
-校验只识别 canonical spelling。若产品迁移同时需要 canonical 的 Cobra required
-标记和 legacy spelling，产品 PR 必须提供明确的运行时方案，并通过 canonical / legacy
-最终 payload 等价、同值输入一致、冲突输入在 transport 前失败、legacy 仍可调用但 Help 隐藏等测试；迁移清单和 relation evidence 都不能替代这些证明。
-
-## 豁免边界
-
-一条 base-owned、状态正确且前后快照精确匹配的记录，只会从普通兼容报告中移除以下两类预期 finding：
-
-1. legacy flag 的 `flag_became_hidden`（visible → hidden）；
-2. canonical flag 的 `required_flag_added`（新增时即必填）或 `flag_became_required`（已有 flag 从可选变必填）。
-
-以下变化仍按普通兼容规则阻塞，不能被迁移记录掩盖：
-
- 删除 legacy、canonical、命令或其他 flag；
- flag 类型或迁移记录中的 scope、shorthand、`no_opt` 漂移；
- `alias_of` 缺失、指向变化或 alias chain；
- 命令路径及任何无关的阻塞性接口变化；
- 不精确、部分完成、超出记录范围的 surface 变化。
-
-## Schema 投影边界
-
-Agent-visible command 会把 visible Cobra flag 投影为 Schema parameter，因此合法的
-legacy hidden 迁移会同时表现为历史 parameter 消失，constraint member 也可能从
-legacy 名改为 canonical 名。Schema adapter 只接受已经由三方 Interface Snapshot
-判定为 authorized 的迁移，并按 tool 的精确 `primary_cli_path` 绑定：
-
- reference 仍处于 `before` 且该 flag 有 Schema surface 时，baseline legacy parameter
-  必须存在，candidate legacy parameter 必须消失，candidate canonical parameter 必须存在；
-  如果 baseline 只有 canonical、没有 legacy，则 adapter 不得借 CLI ledger 提升
-  `required` / `cli_required` 或重写 constraint；
- rename 前后的 `type`、`property`、`interface_type`、default、format、enum 与
-  `required_when` 必须完全一致；
- `required` / `cli_required` 只能保持不变或按审批从 `false` 提升为 `true`，禁止降低；
- constraint 只允许在同一 tool 内按已枚举的 legacy → canonical map 做 member 替换、
-  排序与去重；group kind、非迁移 member 或 group 增删仍然阻塞；
- 多个 legacy 指向同一 canonical 时，所有历史 parameter signature 必须一致，否则
-  fail closed。
-
-adapter 先构造经过上述验证的历史 contract 副本，再调用原 Schema checker；它不会按
-错误字符串删除 finding。这样既能处理纯 rename，也能阻止“旧 required 参数改名后意外
-变为 optional”或 property 漂移等伪兼容。`consumed` 回执在 merge-base Schema 已经处于
-canonical-only `after` 状态时不需要再次投影；adapter 保持 baseline 不变，由原 checker
-验证 candidate 是否仍与该 canonical contract 兼容。
-
-## 本地验证
-
-先确保 merge-base 和 stable tag 已在本地，然后运行与 CI 相同的权威门禁：
-
-```sh
-make interface-integrity \
-  BASE_REF=<merge-base> \
-  STABLE_REF=<stable-tag> \
-  CANDIDATE_REF=<candidate-sha>
-
-make schema-compatibility \
-  BASE_REF=<merge-base> \
-  STABLE_REF=<stable-tag> \
-  CANDIDATE_REF=<candidate-sha>
-```
-
-`STABLE_REF` 必须解析到从该 merge-base 可达的最高未撤回 stable GA tag；primary checker 会按 release contract 独立核对，不能用任意 after commit 或已撤回版本提前清理回执。包装脚本可以在省略时自动解析。`CANDIDATE_REF` 省略时固定为命令启动时的已提交 `HEAD`；评审和复现 CI 时应显式传入 candidate SHA，避免 surface 与清单来自不同 revision。
@@ -4,7 +4,7 @@ Defines the stable `dws event consume` subprocess contract so an
 orchestrator can determine when the consumer is ready, stop it cleanly,
 and machine-read why it exited.

-Scope of this branch: the six **contract** items below. Reconnect
+Scope of this branch: the five **contract** items below. Reconnect
 resilience (keeping the stream alive across a transient upstream drop) is
 tracked separately and intentionally out of scope here.

@@ -159,46 +159,6 @@ marker; reconnecting an established Stream remains a separate mechanism.
  `terminal_hold`, and identity-scoped cleanup; skill/docs tests pin the
  operational recovery instructions.

-### 6. Host runtime-token handoff
-
-When the root command carries an explicit host-supplied `--token`, personal
-event control requests and the foreground Stream use that token with higher
-priority than local OAuth. A detached bus receives it only through the
-owner-only local IPC transport:
-
-1. The child starts in runtime-token mode with non-sensitive identity and
-   ticket metadata only; neither its argv nor environment contains the token.
-2. The consumer sends `Hello` with `credential_mode=runtime_token`.
-3. The bus advertises the additive `runtime_token_v1` capability and its
-   in-memory credential generation in `HelloAck`.
-4. Only after that capability is confirmed does the consumer send a bounded
-   `credential_update` frame. The bus applies it with generation CAS, replies
-   with `credential_update_ack`, and registers the consumer only on success.
-
-The bus blocks ticket acquisition until the first runtime credential arrives.
-A later invocation may rotate Token A to Token B on a compatible existing bus;
-the current WebSocket remains connected and the next ticket request or natural
-reconnect uses B. If a 401 rejects the current runtime token, only an already
-installed newer generation is retried; the runtime path never refreshes or
-falls back to a local OAuth profile and never suggests `dws auth login`.
-
-Clients do not send a token to a bus that lacks the capability, do not stop
-other consumers automatically, and fail before printing the ready marker. With
-no explicit `--token`, the original OAuth, refresh, profile, and old-client to
-new-bus protocol behavior remains unchanged.
-
-**Verification**
- T6a: a stale local Token A and root Token B produce control and ticket
-  requests authenticated only with B.
- T6b: compatible bus reuse supports A-to-B rotation and generation conflicts;
-  401 retries only an already-installed newer runtime token.
- T6c: an old bus receives no credential and remains running; the new consumer
-  exits before its ready marker.
- T6d: a canary credential is absent from child argv/environment, dry-run,
-  stdout/stderr, `bus.meta`, `bus.log`, run state, and returned errors.
- T6e: no-token OAuth, refresh, multi-profile, marker/cache, and bus-reuse tests
-  continue to pass.
-
 ## Out of scope (next branch)

 **Reconnect resilience** — today `personal source` retries only
@@ -1,84 +0,0 @@
-// Copyright 2026 Alibaba Group
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-
-package app
-
-import (
-	"strings"
-	"testing"
-
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/shortcut/chatmsg"
-)
-
-func TestCrossPlatformCoverageChatMessageReceiptActionsBindToRunnableCommands(t *testing.T) {
-	testCases := []struct {
-		name    string
-		payload map[string]any
-	}{
-		{
-			name: "send receipt awaiting status",
-			payload: chatmsg.ProjectMessageSendReceipt(map[string]any{
-				"openTaskId": "task-pending",
-			}),
-		},
-		{
-			name: "send receipt ready for message actions",
-			payload: chatmsg.ProjectMessageSendReceipt(map[string]any{
-				"openTaskId":         "task-ready",
-				"openMessageId":      "message-ready",
-				"openConversationId": "conversation-ready",
-			}),
-		},
-		{
-			name: "send status awaiting message reference",
-			payload: chatmsg.ProjectMessageSendStatus(map[string]any{
-				"status": "PENDING",
-			}, "task-pending"),
-		},
-		{
-			name: "send status ready for message actions",
-			payload: chatmsg.ProjectMessageSendStatus(map[string]any{
-				"openTaskId":         "task-ready",
-				"openMessageId":      "message-ready",
-				"openConversationId": "conversation-ready",
-				"status":             "SUCCESS",
-			}, "task-ready"),
-		},
-	}
-
-	root := NewRootCommand()
-	for _, testCase := range testCases {
-		t.Run(testCase.name, func(t *testing.T) {
-			actions, ok := testCase.payload["nextActions"].([]map[string]any)
-			if !ok || len(actions) == 0 {
-				t.Fatalf("nextActions = %#v, want non-empty []map[string]any", testCase.payload["nextActions"])
-			}
-
-			for index, action := range actions {
-				cliPath, ok := action["cliPath"].(string)
-				if !ok || strings.TrimSpace(cliPath) == "" {
-					t.Fatalf("nextActions[%d].cliPath = %#v, want non-empty string", index, action["cliPath"])
-				}
-
-				command, remaining, err := root.Find(strings.Fields(cliPath))
-				if err != nil {
-					t.Fatalf("nextActions[%d].cliPath %q does not bind: %v", index, cliPath, err)
-				}
-				if command == nil || len(remaining) != 0 || !command.Runnable() {
-					t.Fatalf("nextActions[%d].cliPath %q resolved to command=%v remaining=%v runnable=%v", index, cliPath, command, remaining, command != nil && command.Runnable())
-				}
-
-				arguments, ok := action["arguments"].(map[string]any)
-				if !ok {
-					t.Fatalf("nextActions[%d].arguments = %#v, want map[string]any", index, action["arguments"])
-				}
-				for name := range arguments {
-					if command.Flags().Lookup(name) == nil && command.InheritedFlags().Lookup(name) == nil {
-						t.Errorf("nextActions[%d] argument %q is not a flag of runnable command %q", index, name, cliPath)
-					}
-				}
-			}
-		})
-	}
-}
@@ -0,0 +1,233 @@
+// Copyright 2026 Alibaba Group
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package app
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"io"
+	"strings"
+	"testing"
+
+	apperrors "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/errors"
+	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/executor"
+	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/helpers"
+	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/testseam"
+)
+
+func executeDevAppListRoot(t *testing.T, args ...string) (string, string, error) {
+	return executeDevAppRoot(t, "+list", args...)
+}
+
+func executeDevAppRoot(t *testing.T, command string, args ...string) (string, string, error) {
+	t.Helper()
+	helpers.InitDepsForTest(t, helpers.GetCaller())
+	root := NewRootCommand()
+	var stdout bytes.Buffer
+	var stderr bytes.Buffer
+	root.SetOut(&stdout)
+	root.SetErr(&stderr)
+	root.SetArgs(append([]string{"devapp", command}, args...))
+	err := root.Execute()
+	return stdout.String(), stderr.String(), err
+}
+
+func TestCrossPlatformCoverageDevAppPaginatedShortcutsMock(t *testing.T) {
+	for _, test := range []struct {
+		name       string
+		command    string
+		collection string
+		args       []string
+	}{
+		{name: "apps", command: "+list", collection: "apps"},
+		{name: "permissions", command: "+permission-list", collection: "permissions", args: []string{"--unified-app-id", "X"}},
+		{name: "events", command: "+event-list", collection: "events", args: []string{"--unified-app-id", "X"}},
+		{name: "versions", command: "+version-list", collection: "versions", args: []string{"--unified-app-id", "X"}},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			args := append(append([]string(nil), test.args...), "--mock", "--format", "json")
+			stdout, stderr, err := executeDevAppRoot(t, test.command, args...)
+			if err != nil {
+				t.Fatalf("mock %s error = %v, stderr=%q", test.command, err, stderr)
+			}
+			if stderr != "" {
+				t.Fatalf("mock %s stderr = %q", test.command, stderr)
+			}
+
+			var payload map[string]any
+			if err := json.Unmarshal([]byte(stdout), &payload); err != nil {
+				t.Fatalf("decode mock %s output: %v, output=%q", test.command, err, stdout)
+			}
+			items, ok := payload[test.collection].([]any)
+			if len(payload) != 4 || !ok || len(items) != 0 || payload["count"] != float64(0) ||
+				payload["hasMore"] != false || payload["nextCursor"] != "" {
+				t.Fatalf("mock %s payload = %#v", test.command, payload)
+			}
+		})
+	}
+}
+
+func TestCrossPlatformCoverageDevAppListMockPaginationFormats(t *testing.T) {
+	for _, format := range []string{"json", "raw", "ndjson", "pretty"} {
+		t.Run(format, func(t *testing.T) {
+			if format == "pretty" {
+				t.Setenv("NO_COLOR", "1")
+			}
+			stdout, stderr, err := executeDevAppListRoot(t, "--mock", "--format", format)
+			if err != nil {
+				t.Fatalf("mock list error = %v, stderr=%q", err, stderr)
+			}
+			if stderr != "" {
+				t.Fatalf("mock list stderr = %q", stderr)
+			}
+			if format == "pretty" {
+				values := map[string]string{}
+				lines := strings.Split(strings.TrimSuffix(stdout, "\n"), "\n")
+				if len(lines) != 4 {
+					t.Fatalf("pretty mock lines = %d, want four: %q", len(lines), stdout)
+				}
+				for _, line := range lines {
+					parts := strings.SplitN(line, ":", 2)
+					if len(parts) != 2 {
+						t.Fatalf("pretty mock line is not key/value: %q", line)
+					}
+					values[strings.TrimSpace(parts[0])] = strings.TrimSpace(parts[1])
+				}
+				if len(values) != 4 || values["apps"] != "[]" || values["count"] != "0" ||
+					values["hasMore"] != "false" || values["nextCursor"] != "" {
+					t.Fatalf("pretty mock values = %#v, output=%q", values, stdout)
+				}
+				return
+			}
+			if format == "ndjson" && len(strings.Split(strings.TrimSuffix(stdout, "\n"), "\n")) != 1 {
+				t.Fatalf("ndjson mock output expanded envelope: %q", stdout)
+			}
+			var payload map[string]any
+			if err := json.Unmarshal([]byte(stdout), &payload); err != nil {
+				t.Fatalf("decode mock output: %v, output=%q", err, stdout)
+			}
+			apps, ok := payload["apps"].([]any)
+			if len(payload) != 4 || !ok || len(apps) != 0 || payload["count"] != float64(0) ||
+				payload["hasMore"] != false || payload["nextCursor"] != "" {
+				t.Fatalf("mock pagination payload = %#v", payload)
+			}
+		})
+	}
+}
+
+type devAppListFixtureRunner struct {
+	response string
+}
+
+func (r devAppListFixtureRunner) Run(
+	_ context.Context,
+	invocation executor.Invocation,
+) (executor.Result, error) {
+	return executor.Result{
+		Invocation: invocation,
+		Response: map[string]any{
+			"content": []any{map[string]any{"type": "text", "text": r.response}},
+		},
+	}, nil
+}
+
+func TestCrossPlatformCoverageDevAppListInvalidContractJSONError(t *testing.T) {
+	helpers.InitDepsForTest(t, helpers.GetCaller())
+	testseam.Swap(t, &rootNewCommandRunnerWithFlags, func(*GlobalFlags) executor.Runner {
+		return devAppListFixtureRunner{response: `{
+			"apps":[{"unifiedAppId":"would-be-partial"},"payload-do-not-leak"],
+			"hasMore":false,
+			"nextCursor":""
+		}`}
+	})
+
+	root := NewRootCommand()
+	var stdout bytes.Buffer
+	var cobraStderr bytes.Buffer
+	root.SetOut(&stdout)
+	root.SetErr(&cobraStderr)
+	root.SetArgs([]string{"devapp", "+list", "--cursor", "cursor-do-not-leak", "--format", "json"})
+	err := root.Execute()
+	if err == nil {
+		t.Fatal("invalid pagination contract unexpectedly succeeded")
+	}
+	if stdout.Len() != 0 || cobraStderr.Len() != 0 {
+		t.Fatalf("invalid contract leaked command output: stdout=%q stderr=%q", stdout.String(), cobraStderr.String())
+	}
+	if code := apperrors.ExitCode(err); code != 1 {
+		t.Fatalf("exit code = %d, want 1", code)
+	}
+
+	var machineStderr bytes.Buffer
+	if printErr := printExecutionError(root, &stdout, &machineStderr, err); printErr != nil {
+		t.Fatalf("print JSON error: %v", printErr)
+	}
+	if stdout.Len() != 0 {
+		t.Fatalf("JSON error wrote stdout: %q", stdout.String())
+	}
+	decoder := json.NewDecoder(strings.NewReader(machineStderr.String()))
+	var payload map[string]any
+	if err := decoder.Decode(&payload); err != nil {
+		t.Fatalf("decode stderr JSON: %v, stderr=%q", err, machineStderr.String())
+	}
+	if err := decoder.Decode(&map[string]any{}); err != io.EOF {
+		t.Fatalf("stderr contained more than one JSON value: %v, stderr=%q", err, machineStderr.String())
+	}
+	errorPayload, ok := payload["error"].(map[string]any)
+	message, messageOK := errorPayload["message"].(string)
+	if len(payload) != 1 || !ok || len(errorPayload) != 4 ||
+		errorPayload["category"] != "api" || errorPayload["code"] != float64(1) ||
+		errorPayload["reason"] != "devapp_pagination_contract_invalid" ||
+		!messageOK || strings.TrimSpace(message) == "" {
+		t.Fatalf("JSON error contract = %#v", payload)
+	}
+	if strings.Contains(machineStderr.String(), "cursor-do-not-leak") ||
+		strings.Contains(machineStderr.String(), "payload-do-not-leak") ||
+		strings.Contains(machineStderr.String(), "would-be-partial") {
+		t.Fatalf("JSON error leaked request or response data: %q", machineStderr.String())
+	}
+}
+
+func TestCrossPlatformCoverageDevAppListMockIsolation(t *testing.T) {
+	helpers.InitDepsForTest(t, helpers.GetCaller())
+	runner := newCommandRunnerWithFlags(&GlobalFlags{Mock: true})
+
+	for _, test := range []struct {
+		name    string
+		product string
+		tool    string
+	}{
+		{name: "other devapp tool", product: "devapp", tool: "get_dev_app"},
+		{name: "other product", product: "contact", tool: "list_contacts"},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			invocation := executor.NewHelperInvocation(
+				"mock.isolation", test.product, test.tool, map[string]any{},
+			)
+			result, err := runner.Run(context.Background(), invocation)
+			if err != nil {
+				t.Fatalf("mock invocation error = %v", err)
+			}
+			content, ok := result.Response["content"].(map[string]any)
+			if !ok {
+				t.Fatalf("mock content = %#v", result.Response["content"])
+			}
+			mockResult, ok := content["result"].([]any)
+			if !ok || len(mockResult) != 0 {
+				t.Fatalf("non-target mock result changed = %#v", content["result"])
+			}
+		})
+	}
+}
@@ -38,7 +38,6 @@ import (
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/event/bus"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/event/busctl"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/event/consume"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/event/personal"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/event/registry"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/event/source"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/event/transport"
@@ -75,18 +74,18 @@ var (

 // newEventCommand returns the `event` parent command and all its subcommands.
 // Wired into root.go's utilityCommands list.
-func newEventCommand(globalFlags ...*GlobalFlags) *cobra.Command {
+func newEventCommand() *cobra.Command {
 	// Product-level Agent routing Decl (migrated from selection/event.json
 	// products.event). Catalog assembly stamps provenance contract_final.
 	contract.RegisterProductDecl(contract.ProductDecl{
 		ID: "event",
 		Selection: contract.ProductSelectionDecl{
-			AgentSummary: "实时监听当前用户相关的个人 IM 与 OA 审批事件，并管理订阅生命周期",
+			AgentSummary: "订阅/消费个人消息、动作与群生命周期事件，并管理订阅生命周期",
 			UseWhen: []string{
-				"需要实时监听未来发生的个人消息、消息动作、群生命周期或 OA 审批任务/实例事件，或管理个人事件订阅生命周期",
+				"需要实时监听个人消息接收、全量消息、已读、撤回、表情回应或群生命周期事件，或管理个人事件订阅生命周期",
 			},
 			AvoidWhen: []string{
-				"查历史聊天或主动发消息用 chat；查询或处理审批实例/任务用 oa；配置开放平台应用事件回调用 dev app event",
+				"查历史聊天或主动发消息分别用 chat 查询/发送命令",
 			},
 		},
 	})
@@ -100,12 +99,12 @@ func newEventCommand(globalFlags ...*GlobalFlags) *cobra.Command {
 		RunE:              func(c *cobra.Command, _ []string) error { return c.Help() },
 	}
 	cmd.AddCommand(
-		newEventListenIMCommand(globalFlags...),
-		newEventConsumeCommand(globalFlags...),
+		newEventListenIMCommand(),
+		newEventConsumeCommand(),
 		newEventListCommand(),
 		newEventSchemaCommand(),
-		newEventStatusCommandWithFlags(globalFlags...),
-		newEventStopCommandWithFlags(globalFlags...),
+		newEventStatusCommand(),
+		newEventStopCommand(),
 		newEventBusCommand(),
 	)
 	return cmd
@@ -115,7 +114,7 @@ func newEventCommand(globalFlags ...*GlobalFlags) *cobra.Command {
 //  event consume
 // ─────────────────────────────────────────────────────────────────────

-func newEventConsumeCommand(globalFlags ...*GlobalFlags) *cobra.Command {
+func newEventConsumeCommand() *cobra.Command {
 	var (
 		eventTypes   []string
 		filter       string
@@ -171,8 +170,6 @@ SIGTERM、关 stdin，或先用 dws event stop <subscribe_id> --dry-run 预览
 				return err
 			}
 			if as == "user" {
-				personalOpts.ExplicitToken = eventExplicitToken(globalFlags)
-				personalOpts.ClientIDOverride = eventExplicitClientID(globalFlags)
 				personalOpts.EventKeys = dedupePersonalEventKeys(args)
 				personalOpts.EventKey = firstArg(personalOpts.EventKeys)
 				personalOpts.Flatten = flatten
@@ -336,7 +333,7 @@ SIGTERM、关 stdin，或先用 dws event stop <subscribe_id> --dry-run 预览
 	f.BoolVar(&force, "force", false,
 		"仅 --foreground 模式生效：跳过单实例锁 (慎用：会让云事件被随机切分)")
 	f.BoolVar(&dryRun, "dry-run", false,
-		"仅打印解析后的配置；不创建订阅、不连接 bus；复用 --subscribe-id 时会只读查询控制面")
+		"仅打印解析后的配置，不连接 bus / 云端")
 	f.BoolVar(&foreground, "foreground", false,
 		"当前进程直接跑 bus 服务、不 fork、不打印事件（给 systemd/k8s 托管用）；读事件不要用它")
 	f.StringVar(&personalOpts.SubscribeID, "subscribe-id", "",
@@ -401,21 +398,22 @@ SIGTERM、关 stdin，或先用 dws event stop <subscribe_id> --dry-run 预览
 				Reason:       "Reviewed composite workflow: the command creates or reuses a remote personal-event subscription and coordinates the local event bus and Stream consumer; no single pinned RPC represents the workflow.",
 			},
 			Selection: contract.SelectionSpec{
-				AgentSummary: "消费 OA、群生命周期或需要底层控制的个人事件流；Agent 通常使用 --flatten 输出 NDJSON",
+				AgentSummary: "订阅并持续消费一个或多个兼容的个人事件；Agent 使用 --flatten 输出顶层业务 NDJSON",
 				UseWhen: []string{
-					"需要监听六个公开 OA 审批任务/实例 EventKey 中的一个或多个事件",
+					"需要实时监听 @我、指定单聊、指定群或指定发送人的后续消息事件",
+					"用户明确要求监听当前身份的所有单聊或所有群消息",
+					"需要监听指定单聊或群聊中的消息已读、撤回或表情回应事件",
 					"需要监听指定群的标题变更、成员进退群或群解散事件",
-					"用户显式给出原始 EventKey、Filter DSL、subscribe_id，要求原始 transport envelope，或需要普通 IM facade 不提供的高级多事件控制",
+					"监听机器人、外部联系人等以 openDingtalkId 标识的单聊目标",
+					"同一目标、同一过滤条件需要同时监听多个兼容事件",
 				},
 				AvoidWhen: []string{
-					"普通 @我、指定发送人/群、全部单聊/群聊及 message/reaction/read/recall 监听优先使用 event +listen-im",
 					"只查历史聊天记录时用 chat 查询命令",
-					"查询、同意、拒绝、转交、撤销或发起审批时用 oa；配置应用事件回调时用 dev app event",
 					"只看事件目录/字段时用 event list / event schema",
 				},
 				Examples: []string{
-					"dws event consume user_oa_approval_task_created user_oa_approval_instance_finished --flatten --duration 10m --format ndjson",
-					"dws event consume user_im_group_member_added --group cid-example --flatten --max-events 1 --format ndjson",
+					"dws event consume user_im_message_receive_user --open-dingtalk-id open-example --flatten --max-events 1 --format ndjson",
+					"dws event consume user_im_message_receive_o2o user_im_message_read_o2o --user test-user-001 --flatten --max-events 2 --format ndjson",
 				},
 			},
 		},
@@ -566,8 +564,6 @@ func newEventBusCommand() *cobra.Command {
 		clientIDOverride string
 		idleTimeout      time.Duration
 		sourceKindRaw    string
-		runtimeTokenMode bool
-		identityHashFlag string
 		streamOpts       eventStreamTicketOptions
 	)
 	cmd := &cobra.Command{
@@ -604,45 +600,23 @@ func newEventBusCommand() *cobra.Command {
 				sourceKind = dwsevent.SourceKindAppStream
 			}
 			if sourceKind == dwsevent.SourceKindPersonalStream {
-				var (
-					identity     personal.Identity
-					identityHash string
-				)
-				if runtimeTokenMode {
-					identityHash = strings.TrimSpace(identityHashFlag)
-					if !validPersonalIdentityHash(identityHash) {
-						return failEarly(errors.New("event _bus: --identity-hash must be a 16-character hexadecimal identity hash in runtime token mode"))
-					}
-					if strings.TrimSpace(clientIDOverride) == "" {
-						return failEarly(errors.New("event _bus: --client-id is required in runtime token mode"))
-					}
-					identity = personal.Identity{
-						ClientID: strings.TrimSpace(clientIDOverride),
-						SourceID: personalEventStreamSourceID(streamOpts.SourceID),
-					}
-				} else {
-					var err error
-					identity, err = eventResolvePersonal(ctx, configDir, streamOpts.SourceID)
-					if err != nil {
-						return failEarly(fmt.Errorf("event _bus: %w", err))
-					}
-					if clientIDOverride != "" {
-						identity.ClientID = clientIDOverride
-					}
-					identityHash = dwsevent.IdentityHash(identity.Key())
+				identity, err := eventResolvePersonal(ctx, configDir, streamOpts.SourceID)
+				if err != nil {
+					return failEarly(fmt.Errorf("event _bus: %w", err))
 				}
+				if clientIDOverride != "" {
+					identity.ClientID = clientIDOverride
+				}
+				identityHash := dwsevent.IdentityHash(identity.Key())
 				editionName := editionNameOrDefault()
 				workDir := eventWorkDir(configDir, editionName, dwsevent.SourceKindPersonalStream, identityHash)
 				endpoint := defaultIPCEndpoint(workDir, editionName, dwsevent.SourceKindPersonalStream, identityHash)
-				credentialBroker := newPersonalCredentialBroker(configDir, runtimeTokenMode, runtimeTokenMode)
 				src, err := eventNewPersonalSource(ctx, personalStreamSourceOptions{
 					ConfigDir:        configDir,
 					Identity:         identity,
 					TicketMode:       streamOpts.Mode,
 					TicketURL:        streamOpts.TicketURL,
 					ClientIDOverride: clientIDOverride,
-					CredentialBroker: credentialBroker,
-					RuntimeTokenMode: runtimeTokenMode,
 				})
 				if err != nil {
 					return failEarly(err)
@@ -655,18 +629,17 @@ func newEventBusCommand() *cobra.Command {
 					}
 				}
 				busCfg := bus.Config{
-					WorkDir:          workDir,
-					IPCEndpoint:      endpoint,
-					ClientID:         identity.ClientID,
-					Edition:          editionName,
-					SourceKind:       dwsevent.SourceKindPersonalStream,
-					IdentityHash:     identityHash,
-					SourceID:         identity.SourceID,
-					Source:           src,
-					IdleTimeout:      idleTimeout,
-					ReadyPipe:        readyPipe,
-					Logger:           slog.Default(),
-					CredentialBroker: credentialBroker,
+					WorkDir:      workDir,
+					IPCEndpoint:  endpoint,
+					ClientID:     identity.ClientID,
+					Edition:      editionName,
+					SourceKind:   dwsevent.SourceKindPersonalStream,
+					IdentityHash: identityHash,
+					SourceID:     identity.SourceID,
+					Source:       src,
+					IdleTimeout:  idleTimeout,
+					ReadyPipe:    readyPipe,
+					Logger:       slog.Default(),
 				}
 				bus.ApplyEnvTuning(&busCfg)
 				return eventBusRun(ctx, busCfg)
@@ -726,18 +699,12 @@ func newEventBusCommand() *cobra.Command {
 		"exit after this long with zero consumers (0 = disabled)")
 	cmd.Flags().StringVar(&sourceKindRaw, "source-kind", string(dwsevent.SourceKindAppStream),
 		"event source kind: app_stream|personal_stream")
-	cmd.Flags().BoolVar(&runtimeTokenMode, "runtime-token-mode", false,
-		"use an owner-injected in-memory runtime credential")
-	cmd.Flags().StringVar(&identityHashFlag, "identity-hash", "",
-		"pre-resolved non-sensitive personal identity hash")
 	cmd.Flags().StringVar(&streamOpts.Mode, "stream-ticket-mode", strings.TrimSpace(os.Getenv("DWS_STREAM_TICKET_MODE")),
 		"用户 Stream 建联模式：空=SDK app credential；normal/custom=portal 取票")
 	cmd.Flags().StringVar(&streamOpts.SourceID, "stream-source-id", strings.TrimSpace(os.Getenv("DWS_STREAM_SOURCE_ID")),
 		"用户 Stream sourceId；personal_stream 开源版默认 open")
 	cmd.Flags().StringVar(&streamOpts.TicketURL, "stream-ticket-url", strings.TrimSpace(os.Getenv("DWS_STREAM_TICKET_URL")),
 		"用户 Stream 取票 URL；personal_stream 默认由 MCP base URL 派生")
-	_ = cmd.Flags().MarkHidden("runtime-token-mode")
-	_ = cmd.Flags().MarkHidden("identity-hash")
 	return cmd
 }

@@ -856,10 +823,6 @@ func newEventListCommand() *cobra.Command {
 // ─────────────────────────────────────────────────────────────────────

 func newEventStatusCommand() *cobra.Command {
-	return newEventStatusCommandWithFlags()
-}
-
-func newEventStatusCommandWithFlags(globalFlags ...*GlobalFlags) *cobra.Command {
 	var (
 		all          bool
 		allEditions  bool
@@ -885,8 +848,6 @@ func newEventStatusCommandWithFlags(globalFlags ...*GlobalFlags) *cobra.Command
 					return fmt.Errorf("event status: %w", err)
 				}
 				personalOpts.Format = formatRaw
-				personalOpts.ExplicitToken = eventExplicitToken(globalFlags)
-				personalOpts.ClientIDOverride = eventExplicitClientID(globalFlags)
 				return eventRunPersonalStatus(c, personalOpts)
 			}
 			if err := rejectChangedFlags(c, "user", "event", "status", "subscribe-id", "personal-event-base-url", "stream-source-id"); err != nil {
@@ -1178,10 +1139,6 @@ func renderStatusBlock(w io.Writer, qs busctl.EntryStatus) {
 }

 func newEventStopCommand() *cobra.Command {
-	return newEventStopCommandWithFlags()
-}
-
-func newEventStopCommandWithFlags(globalFlags ...*GlobalFlags) *cobra.Command {
 	var asIdentity string
 	var opts personalStopOptions
 	cmd := &cobra.Command{
@@ -1202,8 +1159,6 @@ func newEventStopCommandWithFlags(globalFlags ...*GlobalFlags) *cobra.Command {
 			}
 			if as == "user" {
 				opts.SubscribeID = firstArg(args)
-				opts.ExplicitToken = eventExplicitToken(globalFlags)
-				opts.ClientIDOverride = eventExplicitClientID(globalFlags)
 				if eventStopDryRun(c) {
 					return writeEventStopDryRun(c, as, opts)
 				}
@@ -1307,20 +1262,6 @@ func eventStopDryRun(cmd *cobra.Command) bool {
 	return value
 }

-func eventExplicitToken(globalFlags []*GlobalFlags) string {
-	if len(globalFlags) == 0 || globalFlags[0] == nil {
-		return ""
-	}
-	return strings.TrimSpace(globalFlags[0].Token)
-}
-
-func eventExplicitClientID(globalFlags []*GlobalFlags) string {
-	if len(globalFlags) == 0 || globalFlags[0] == nil {
-		return ""
-	}
-	return strings.TrimSpace(globalFlags[0].ClientID)
-}
-
 func writeEventStopDryRun(cmd *cobra.Command, identity string, opts personalStopOptions) error {
 	payload := map[string]any{
 		"dry_run":  true,
@@ -65,13 +65,13 @@ func (eventTargetReader) CallMCPData(product, tool string, params map[string]any

 var eventListenIMReader = func() targetresolver.Reader { return eventTargetReader{} }

-func newEventListenIMCommand(globalFlags ...*GlobalFlags) *cobra.Command {
+func newEventListenIMCommand() *cobra.Command {
 	var opts listenIMOptions
 	cmd := &cobra.Command{
 		Use:   "+listen-im",
 		Short: "按 IM 意图解析目标并监听一个或多个个人消息事件",
 		Long: "把 @我、指定发送人、指定群、全部单聊或全部群聊等用户意图确定性编译为个人 EventKey，" +
-			"自然姓名/群名会先唯一解析，再复用 event consume 的订阅、ready marker、NDJSON、取消、回滚和清理生命周期；本命令只处理 IM，不接收 OA 审批事件。",
+			"自然姓名/群名会先唯一解析，再复用 event consume 的订阅、ready marker、NDJSON、取消、回滚和清理生命周期。",
 		Args:              cobra.NoArgs,
 		DisableAutoGenTag: true,
 		RunE: func(c *cobra.Command, _ []string) error {
@@ -91,8 +91,6 @@ func newEventListenIMCommand(globalFlags ...*GlobalFlags) *cobra.Command {
 				StreamTicketMode: opts.StreamTicketMode,
 				StreamTicketURL:  opts.StreamTicketURL,
 				StreamSourceID:   opts.StreamSourceID,
-				ExplicitToken:    eventExplicitToken(globalFlags),
-				ClientIDOverride: eventExplicitClientID(globalFlags),
 				Common: commonConsumeOptions{
 					FormatRaw: "ndjson",
 					MaxEvents: opts.MaxEvents,
@@ -145,12 +143,12 @@ func newEventListenIMCommand(globalFlags ...*GlobalFlags) *cobra.Command {
 				Reason:       "Reviewed IM event facade: it deterministically maps kind/events to public personal EventKeys, resolves one natural user/chat target with the shared typed resolver, then delegates one single- or multi-event invocation to the existing subscription, bus, ready-marker, NDJSON, rollback, cancellation, and cleanup lifecycle.",
 			},
 			Selection: contract.SelectionSpec{
-				AgentSummary: "按 @我、发送人、群或全量范围监听普通 IM message/reaction/read/recall 事件",
+				AgentSummary: "按 @我、姓名、群名或全量范围监听一个或多个 IM 消息事件",
 				UseWhen: []string{
 					"已知要监听 @我、指定发送人、指定群、全部单聊或全部群聊的 message/reaction/read/recall 事件时使用；姓名用 --user-query、群名用 --chat-query，CLI 会唯一解析目标并把多个兼容事件合并到一个消费生命周期。",
 				},
 				AvoidWhen: []string{
-					"OA 审批事件、群标题/成员/解散等生命周期事件、显式 EventKey、复用 subscribe_id、Filter DSL、原始 transport envelope 或其它底层控制使用 event consume；只查历史消息使用 chat 查询入口",
+					"需要群标题/成员/解散等生命周期事件、显式 EventKey、复用 subscribe_id、Filter DSL、原始 transport envelope 或其它底层 consume 控制时使用 event consume；只查历史消息时使用 chat 查询入口",
 				},
 				Examples: []string{
 					"dws event +listen-im --kind at-me --max-events 1",
@@ -28,7 +28,6 @@ import (

 	apperrors "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/errors"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/event/personal"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/event/runtimecred"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/config"
 )

@@ -185,25 +184,6 @@ func (r *personalSubscriptionAttemptReservation) completeSuccess() error {
 	return nil
 }

-// releaseRuntimeTokenFailure releases the in-flight claim without recording a
-// cross-invocation hold. A host may supply a fresh token on the very next
-// command, which must be allowed to retry immediately.
-func (r *personalSubscriptionAttemptReservation) releaseRuntimeTokenFailure() error {
-	if r == nil {
-		return runtimecred.ErrRuntimeTokenRejected
-	}
-	if r.store == nil || r.claim == nil {
-		return personalSubscriptionGuardError(errors.Join(
-			runtimecred.ErrRuntimeTokenRejected,
-			errors.New("personal event: subscription attempt reservation is incomplete"),
-		))
-	}
-	if err := r.store.Release(r.claim); err != nil {
-		return personalSubscriptionGuardError(errors.Join(runtimecred.ErrRuntimeTokenRejected, err))
-	}
-	return runtimecred.ErrRuntimeTokenRejected
-}
-
 func (r *personalSubscriptionAttemptReservation) completeFailure(
 	ctx context.Context,
 	failedIndex int,
@@ -152,8 +152,8 @@ func TestCrossPlatformCoveragePersonalSubscriptionProtectionCoversAllPublicEvent
 		}
 	}

-	if publicCount != 22 {
-		t.Fatalf("public personal events = %d, want 22 (16 IM + 6 OA)", publicCount)
+	if publicCount != 16 {
+		t.Fatalf("public personal events = %d, want 16", publicCount)
 	}
 	for _, ruleType := range []string{"at", "all", "singleChat", "sender", "group"} {
 		if !ruleTypes[ruleType] {
@@ -14,7 +14,6 @@
 package app

 import (
-	"bytes"
 	"context"
 	"crypto/sha256"
 	"encoding/hex"
@@ -27,7 +26,6 @@ import (
 	"path/filepath"
 	"sort"
 	"strings"
-	"sync"
 	"text/tabwriter"
 	"time"

@@ -41,7 +39,6 @@ import (
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/event/busctl"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/event/consume"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/event/personal"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/event/runtimecred"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/event/source"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/event/transport"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/config"
@@ -84,8 +81,6 @@ type personalConsumeOptions struct {
 	StreamTicketMode string
 	StreamTicketURL  string
 	StreamSourceID   string
-	ExplicitToken    string
-	ClientIDOverride string
 }

 type personalListOptions struct {
@@ -96,23 +91,19 @@ type personalListOptions struct {
 }

 type personalStatusOptions struct {
-	EventKey         string
-	Status           string
-	SubscribeID      string
-	Format           string
-	ControlBaseURL   string
-	StreamSourceID   string
-	ExplicitToken    string
-	ClientIDOverride string
+	EventKey       string
+	Status         string
+	SubscribeID    string
+	Format         string
+	ControlBaseURL string
+	StreamSourceID string
 }

 type personalStopOptions struct {
-	SubscribeID      string
-	All              bool
-	ControlBaseURL   string
-	StreamSourceID   string
-	ExplicitToken    string
-	ClientIDOverride string
+	SubscribeID    string
+	All            bool
+	ControlBaseURL string
+	StreamSourceID string
 }

 type personalStreamSourceOptions struct {
@@ -121,8 +112,6 @@ type personalStreamSourceOptions struct {
 	TicketMode       string
 	TicketURL        string
 	ClientIDOverride string
-	CredentialBroker *runtimecred.Broker
-	RuntimeTokenMode bool
 }

 var (
@@ -152,19 +141,10 @@ var (
 	personalResolveAuxiliaryAccessToken = ResolveAuxiliaryAccessToken
 	personalForceRefreshRejectedToken   = forceRefreshRejectedAccessToken
 	personalLoadTokenData               = authpkg.LoadTokenData
-	personalLoadProfiles                = authpkg.LoadProfiles
 	personalClientID                    = authpkg.ClientID
-	personalRuntimeEventClientID        = runtimePersonalEventClientID
 	personalResolveAppCredentialsStrict = authpkg.ResolveAppCredentialsStrict
 )

-func runtimePersonalEventClientID() string {
-	if clientID := strings.TrimSpace(edition.Get().AuthClientID); clientID != "" {
-		return clientID
-	}
-	return strings.TrimSpace(os.Getenv("DWS_CLIENT_ID"))
-}
-
 func newEventSchemaCommand() *cobra.Command {
 	var asIdentity string
 	var formatRaw string
@@ -221,15 +201,12 @@ func newEventSchemaCommand() *cobra.Command {
 			},
 			Selection: contract.SelectionSpec{
 				AgentSummary: "查询指定个人事件码的输出字段结构；Agent 应查询 --flatten 模式",
-				UseWhen:      []string{"已知任一公开个人 IM 或 OA event_key，消费前需要理解 --flatten 输出字段或 payload 契约"},
+				UseWhen:      []string{"已知任一公开个人 IM event_key，消费前需要理解输出字段或保守 payload 契约"},
 				AvoidWhen: []string{
 					"查询 CLI 命令参数契约时用顶层 dws schema",
 					"要实际收事件时用 event consume",
 				},
-				Examples: []string{
-					"dws event schema user_im_message_receive_at --flatten --format json",
-					"dws event schema user_oa_approval_task_created --flatten --format json",
-				},
+				Examples: []string{"dws event schema user_im_message_receive_at --flatten --format json"},
 			},
 		},
 	})
@@ -285,9 +262,6 @@ func runPersonalEventConsumeSingle(c *cobra.Command, opts personalConsumeOptions
 	if err := ensurePublicPersonalEvent(opts.EventKey); err != nil {
 		return personalSubscriptionValidationError(err)
 	}
-	if err := validatePersonalOAOptions(opts.EventKey, opts); err != nil {
-		return fmt.Errorf("event consume --as user: %w", personalSubscriptionValidationError(err))
-	}
 	rawFormat := ""
 	if f := c.Flags().Lookup("format"); f != nil && f.Changed {
 		rawFormat = opts.Common.FormatRaw
@@ -302,7 +276,7 @@ func runPersonalEventConsumeSingle(c *cobra.Command, opts personalConsumeOptions
 	projector := personalEventProjector(opts.DebugRawEvents, opts.Flatten)

 	configDir := defaultConfigDir()
-	identity, err := resolvePersonalEventIdentityForToken(ctx, configDir, opts.StreamSourceID, opts.ExplicitToken, opts.ClientIDOverride)
+	identity, err := personalResolveEventIdentity(ctx, configDir, opts.StreamSourceID)
 	if err != nil {
 		return fmt.Errorf("event consume --as user: %w", err)
 	}
@@ -310,41 +284,23 @@ func runPersonalEventConsumeSingle(c *cobra.Command, opts personalConsumeOptions
 	editionName := editionNameOrDefault()
 	workDir := eventWorkDir(configDir, editionName, dwsevent.SourceKindPersonalStream, identityHash)
 	ipcEndpoint := defaultIPCEndpoint(workDir, editionName, dwsevent.SourceKindPersonalStream, identityHash)
-	spawnProfileSelector := ""
-	if strings.TrimSpace(opts.ExplicitToken) == "" {
-		spawnProfileSelector = personalBusProfileSelector(configDir, identity)
-	}
-	spawnArgs := personalBusSpawnArgsForToken(
-		identity,
-		identityHash,
-		opts.StreamTicketMode,
-		opts.StreamTicketURL,
-		spawnProfileSelector,
-		opts.ExplicitToken,
-	)
+	spawnProfileSelector := personalBusProfileSelector(configDir, identity)

 	routes, err := consume.ParseRoutes(opts.Common.RoutesRaw)
 	if err != nil {
 		return fmt.Errorf("event consume --as user: %w", personalSubscriptionValidationError(err))
 	}
-	client := newPersonalEventControlClient(configDir, personalEventControlBaseURL(opts.ControlBaseURL, configDir), identity, opts.ExplicitToken)
 	if opts.Common.DryRun {
 		if strings.TrimSpace(opts.SubscribeID) == "" {
 			if err := validatePersonalSubscriptionOptions(opts); err != nil {
 				return fmt.Errorf("event consume --as user: %w", personalSubscriptionValidationError(err))
 			}
-		} else {
-			_, eventKey, _, err := personalEnsureSubscription(ctx, client, identity, opts)
-			if err != nil {
-				return fmt.Errorf("event consume --as user: %w", err)
-			}
-			opts.EventKey = eventKey
 		}
 		cfg := consume.Config{
 			WorkDir:        workDir,
 			IPCEndpoint:    ipcEndpoint,
 			ClientID:       identity.ClientID,
-			SpawnExtraArgs: personalBusSpawnArgsForToken(identity, identityHash, opts.StreamTicketMode, personalEventStreamTicketURL(opts.StreamTicketURL, configDir), spawnProfileSelector, opts.ExplicitToken),
+			SpawnExtraArgs: personalBusSpawnArgs(identity, opts.StreamTicketMode, personalEventStreamTicketURL(opts.StreamTicketURL, configDir), spawnProfileSelector),
 			Compact:        opts.Common.Compact,
 			MaxEvents:      opts.Common.MaxEvents,
 			Duration:       opts.Common.Duration,
@@ -371,8 +327,7 @@ func runPersonalEventConsumeSingle(c *cobra.Command, opts personalConsumeOptions
 		WorkDir:        workDir,
 		IPCEndpoint:    ipcEndpoint,
 		ClientID:       identity.ClientID,
-		SpawnExtraArgs: spawnArgs,
-		RuntimeToken:   strings.TrimSpace(opts.ExplicitToken),
+		SpawnExtraArgs: personalBusSpawnArgs(identity, opts.StreamTicketMode, opts.StreamTicketURL, spawnProfileSelector),
 		Compact:        opts.Common.Compact,
 		MaxEvents:      opts.Common.MaxEvents,
 		Duration:       opts.Common.Duration,
@@ -401,31 +356,20 @@ func runPersonalEventConsumeSingle(c *cobra.Command, opts personalConsumeOptions
 		}
 	}

-	var (
-		foregroundSource *source.PersonalSource
-		foregroundBroker *runtimecred.Broker
-	)
+	var foregroundSource *source.PersonalSource
 	if opts.Common.Foreground {
-		explicitToken := strings.TrimSpace(opts.ExplicitToken)
-		foregroundBroker = newPersonalCredentialBroker(configDir, explicitToken != "", false)
-		if explicitToken != "" {
-			if _, err := foregroundBroker.Update(0, explicitToken); err != nil {
-				return personalSubscriptionValidationError(err)
-			}
-		}
 		foregroundSource, err = personalNewStreamSource(ctx, personalStreamSourceOptions{
-			ConfigDir:        configDir,
-			Identity:         identity,
-			TicketMode:       opts.StreamTicketMode,
-			TicketURL:        opts.StreamTicketURL,
-			CredentialBroker: foregroundBroker,
-			RuntimeTokenMode: explicitToken != "",
+			ConfigDir:  configDir,
+			Identity:   identity,
+			TicketMode: opts.StreamTicketMode,
+			TicketURL:  opts.StreamTicketURL,
 		})
 		if err != nil {
 			return personalSubscriptionValidationError(err)
 		}
 	}

+	client := newPersonalEventControlClient(configDir, personalEventControlBaseURL(opts.ControlBaseURL, configDir), identity)
 	var attempt *personalSubscriptionAttemptReservation
 	if strings.TrimSpace(opts.SubscribeID) == "" {
 		attempt, err = reservePersonalSubscriptionAttempts(
@@ -441,10 +385,6 @@ func runPersonalEventConsumeSingle(c *cobra.Command, opts personalConsumeOptions
 	}
 	sub, eventKey, ruleType, err := personalEnsureSubscription(ctx, client, identity, opts)
 	if err != nil {
-		if strings.TrimSpace(opts.ExplicitToken) != "" && personalRuntimeTokenControlRejection(err) {
-			err = attempt.releaseRuntimeTokenFailure()
-			return fmt.Errorf("event consume --as user: %w", err)
-		}
 		err = attempt.completeFailure(ctx, 0, 0, err, nil)
 		return fmt.Errorf("event consume --as user: %w", err)
 	}
@@ -468,17 +408,9 @@ func runPersonalEventConsumeSingle(c *cobra.Command, opts personalConsumeOptions
 		)
 		return fmt.Errorf("event consume --as user: %w", err)
 	}
-	selfCreated := strings.TrimSpace(opts.SubscribeID) == ""
-	ownsSubscription := selfCreated || opts.Ephemeral
-	var cleanupOnce sync.Once
-	cleanupOwnedSubscription := func(cleanupCtx context.Context) {
-		if !ownsSubscription {
-			return
-		}
-		cleanupOnce.Do(func() {
-			_ = personalDeleteSubscription(client, cleanupCtx, sub.SubscribeID)
-			_ = personalRemoveRunStates(workDir, []string{sub.SubscribeID})
-		})
+	cleanup := func(cleanupCtx context.Context) {
+		_ = personalDeleteSubscription(client, cleanupCtx, sub.SubscribeID)
+		_ = personalRemoveRunStates(workDir, []string{sub.SubscribeID})
 	}
 	if err := personalUpsertRunState(workDir, personal.RunState{
 		SubscribeID:  sub.SubscribeID,
@@ -489,19 +421,19 @@ func runPersonalEventConsumeSingle(c *cobra.Command, opts personalConsumeOptions
 		IdentityHash: identityHash,
 	}); err != nil {
 		wrapped := fmt.Errorf("save run state: %w", err)
-		cleanupCtx := context.Background()
-		if personalSubscriptionCanceled(ctx, wrapped) {
-			cleanupCtx = ctx
-		}
 		if attempt != nil {
+			cleanupCtx := context.Background()
+			if personalSubscriptionCanceled(ctx, wrapped) {
+				cleanupCtx = ctx
+			}
 			classification := personalSubscriptionLocalFailure()
 			wrapped = attempt.completeFailure(ctx, 0, 0, wrapped, &classification)
+			cleanup(cleanupCtx)
 		}
-		cleanupOwnedSubscription(cleanupCtx)
 		return fmt.Errorf("event consume --as user: %w", wrapped)
 	}
 	if err := attempt.completeSuccess(); err != nil {
-		cleanupOwnedSubscription(context.Background())
+		cleanup(context.Background())
 		return fmt.Errorf("event consume --as user: %w", err)
 	}
 	// Ownership-based cleanup: a subscription this run CREATED is
@@ -510,8 +442,9 @@ func runPersonalEventConsumeSingle(c *cobra.Command, opts personalConsumeOptions
 	// leaks server-side. A subscription REUSED via --subscribe-id is left
 	// intact — the caller owns its lifecycle. --ephemeral forces cleanup
 	// either way.
-	if ownsSubscription {
-		defer cleanupOwnedSubscription(context.Background())
+	selfCreated := strings.TrimSpace(opts.SubscribeID) == ""
+	if opts.Ephemeral || selfCreated {
+		defer cleanup(context.Background())
 	}

 	cfg.EventKey = eventKey
@@ -523,20 +456,27 @@ func runPersonalEventConsumeSingle(c *cobra.Command, opts personalConsumeOptions
 	}
 	if opts.Common.Foreground {
 		busCfg := bus.Config{
-			WorkDir:          workDir,
-			IPCEndpoint:      ipcEndpoint,
-			ClientID:         identity.ClientID,
-			Edition:          editionName,
-			SourceKind:       dwsevent.SourceKindPersonalStream,
-			IdentityHash:     identityHash,
-			SourceID:         identity.SourceID,
-			Source:           foregroundSource,
-			CredentialBroker: foregroundBroker,
+			WorkDir:      workDir,
+			IPCEndpoint:  ipcEndpoint,
+			ClientID:     identity.ClientID,
+			Edition:      editionName,
+			SourceKind:   dwsevent.SourceKindPersonalStream,
+			IdentityHash: identityHash,
+			SourceID:     identity.SourceID,
+			Source:       foregroundSource,
 		}
 		bus.ApplyEnvTuning(&busCfg)
-		return personalBusRun(ctx, busCfg)
+		err = personalBusRun(ctx, busCfg)
+		if err != nil && !opts.Ephemeral {
+			cleanup(context.Background())
+		}
+		return err
 	}
-	return personalConsumeRun(ctx, cfg)
+	err = personalConsumeRun(ctx, cfg)
+	if err != nil && !opts.Ephemeral {
+		cleanup(context.Background())
+	}
+	return err
 }

 type personalMultiSubscription struct {
@@ -565,7 +505,7 @@ func runPersonalEventConsumeMany(c *cobra.Command, opts personalConsumeOptions)

 	ctx := c.Context()
 	configDir := defaultConfigDir()
-	identity, err := resolvePersonalEventIdentityForToken(ctx, configDir, opts.StreamSourceID, opts.ExplicitToken, opts.ClientIDOverride)
+	identity, err := personalResolveEventIdentity(ctx, configDir, opts.StreamSourceID)
 	if err != nil {
 		return fmt.Errorf("event consume --as user: %w", err)
 	}
@@ -573,10 +513,7 @@ func runPersonalEventConsumeMany(c *cobra.Command, opts personalConsumeOptions)
 	editionName := editionNameOrDefault()
 	workDir := eventWorkDir(configDir, editionName, dwsevent.SourceKindPersonalStream, identityHash)
 	ipcEndpoint := defaultIPCEndpoint(workDir, editionName, dwsevent.SourceKindPersonalStream, identityHash)
-	spawnProfileSelector := ""
-	if strings.TrimSpace(opts.ExplicitToken) == "" {
-		spawnProfileSelector = personalBusProfileSelector(configDir, identity)
-	}
+	spawnProfileSelector := personalBusProfileSelector(configDir, identity)
 	routes, err := consume.ParseRoutes(opts.Common.RoutesRaw)
 	if err != nil {
 		return fmt.Errorf("event consume --as user: %w", personalSubscriptionValidationError(err))
@@ -585,7 +522,7 @@ func runPersonalEventConsumeMany(c *cobra.Command, opts personalConsumeOptions)
 		WorkDir:        workDir,
 		IPCEndpoint:    ipcEndpoint,
 		ClientID:       identity.ClientID,
-		SpawnExtraArgs: personalBusSpawnArgsForToken(identity, identityHash, opts.StreamTicketMode, personalEventStreamTicketURL(opts.StreamTicketURL, configDir), spawnProfileSelector, opts.ExplicitToken),
+		SpawnExtraArgs: personalBusSpawnArgs(identity, opts.StreamTicketMode, personalEventStreamTicketURL(opts.StreamTicketURL, configDir), spawnProfileSelector),
 		Compact:        opts.Common.Compact,
 		MaxEvents:      opts.Common.MaxEvents,
 		Duration:       opts.Common.Duration,
@@ -611,9 +548,8 @@ func runPersonalEventConsumeMany(c *cobra.Command, opts personalConsumeOptions)
 		printPersonalMultiDryRun(c.ErrOrStderr(), baseCfg, plans)
 		return nil
 	}
-	baseCfg.RuntimeToken = strings.TrimSpace(opts.ExplicitToken)

-	client := newPersonalEventControlClient(configDir, personalEventControlBaseURL(opts.ControlBaseURL, configDir), identity, opts.ExplicitToken)
+	client := newPersonalEventControlClient(configDir, personalEventControlBaseURL(opts.ControlBaseURL, configDir), identity)
 	attempt, err := reservePersonalSubscriptionAttempts(
 		workDir,
 		client,
@@ -650,10 +586,6 @@ func runPersonalEventConsumeMany(c *cobra.Command, opts personalConsumeOptions)
 		if personalSubscriptionCanceled(ctx, cause) {
 			cleanupCtx = ctx
 		}
-		if strings.TrimSpace(opts.ExplicitToken) != "" && personalRuntimeTokenControlRejection(cause) {
-			cleanup(cleanupCtx)
-			return attempt.releaseRuntimeTokenFailure()
-		}
 		completed := attempt.completeFailure(ctx, failedIndex, succeededCount, cause, override)
 		// Persist the hold (or release a canceled claim) before any potentially
 		// slow remote rollback. Otherwise the attempt lease can expire while
@@ -756,9 +688,6 @@ func preparePersonalMultiOptions(opts personalConsumeOptions) ([]personalConsume
 		if !def.Public {
 			return nil, personal.PublicAvailabilityError(eventKey)
 		}
-		if err := validatePersonalOAOptions(eventKey, opts); err != nil {
-			return nil, err
-		}
 		switch def.RuleType {
 		case "singleChat", "sender":
 			hasUserScope = true
@@ -885,9 +814,6 @@ func applyPersonalConsumeFilters(cfg *consume.Config, opts personalConsumeOption
 }

 func validatePersonalSubscriptionOptions(opts personalConsumeOptions) error {
-	if err := validatePersonalOAOptions(opts.EventKey, opts); err != nil {
-		return err
-	}
 	if _, _, err := personal.BuildRuleParam(opts.EventKey, personal.RuleOptions{
 		RuleType:       opts.Rule,
 		UserID:         opts.UserID,
@@ -900,37 +826,6 @@ func validatePersonalSubscriptionOptions(opts personalConsumeOptions) error {
 	return err
 }

-func validatePersonalOAOptions(eventKey string, opts personalConsumeOptions) error {
-	changed := personalOAOptionNames(opts)
-	if len(changed) == 0 {
-		return nil
-	}
-	def, ok := personalLookupDefinition(strings.TrimSpace(eventKey))
-	if !ok || def.Category != "oa" {
-		return nil
-	}
-	return fmt.Errorf("%s not supported for OA event %s", strings.Join(changed, ", "), eventKey)
-}
-
-func personalOAOptionNames(opts personalConsumeOptions) []string {
-	var changed []string
-	for _, item := range []struct {
-		name  string
-		value string
-	}{
-		{name: "--user", value: opts.UserID},
-		{name: "--open-dingtalk-id", value: opts.OpenDingTalkID},
-		{name: "--group", value: opts.GroupID},
-		{name: "--query", value: opts.QueryCSV},
-		{name: "--filter-json", value: opts.FilterJSON},
-	} {
-		if strings.TrimSpace(item.value) != "" {
-			changed = append(changed, item.name)
-		}
-	}
-	return changed
-}
-
 type personalPreparedSubscription struct {
 	EventKey string
 	RuleType string
@@ -944,9 +839,6 @@ func preparePersonalSubscription(identity personal.Identity, opts personalConsum
 	if err := ensurePublicPersonalEvent(opts.EventKey); err != nil {
 		return personalPreparedSubscription{}, err
 	}
-	if err := validatePersonalOAOptions(opts.EventKey, opts); err != nil {
-		return personalPreparedSubscription{}, err
-	}
 	ruleType, ruleParam, err := personal.BuildRuleParam(opts.EventKey, personal.RuleOptions{
 		RuleType:       opts.Rule,
 		UserID:         opts.UserID,
@@ -993,32 +885,13 @@ func ensurePersonalSubscription(ctx context.Context, client *personal.Client, id
 		if err != nil {
 			return nil, "", "", err
 		}
-		if sub == nil {
-			return nil, "", "", errors.New("personal event: server returned an empty subscription")
-		}
-		requestedEventKey := strings.TrimSpace(opts.EventKey)
-		actualEventKey := strings.TrimSpace(sub.EventKey)
-		if requestedEventKey != "" && actualEventKey != "" && requestedEventKey != actualEventKey {
-			return nil, "", "", fmt.Errorf(
-				"event_key %q does not match reused subscription %q event_key %q",
-				requestedEventKey,
-				strings.TrimSpace(opts.SubscribeID),
-				actualEventKey,
-			)
-		}
-		eventKey := actualEventKey
-		if eventKey == "" {
-			eventKey = requestedEventKey
-		}
+		eventKey := firstNonEmptyPersonalString(opts.EventKey, sub.EventKey)
 		if eventKey == "" {
 			return nil, "", "", fmt.Errorf("event_key is required when --subscribe-id lookup returns no event_key")
 		}
 		if err := ensurePublicPersonalEvent(eventKey); err != nil {
 			return nil, "", "", err
 		}
-		if err := validatePersonalOAOptions(eventKey, opts); err != nil {
-			return nil, "", "", err
-		}
 		ruleType := firstNonEmptyPersonalString(sub.RuleType, opts.Rule)
 		if ruleType == "" {
 			if def, ok := personal.Lookup(eventKey); ok {
@@ -1041,7 +914,7 @@ func runPersonalEventStatus(c *cobra.Command, opts personalStatusOptions) error
 		return err
 	}
 	configDir := defaultConfigDir()
-	identity, err := resolvePersonalEventIdentityForToken(ctx, configDir, opts.StreamSourceID, opts.ExplicitToken, opts.ClientIDOverride)
+	identity, err := personalResolveEventIdentity(ctx, configDir, opts.StreamSourceID)
 	if err != nil {
 		return fmt.Errorf("event status --as user: %w", err)
 	}
@@ -1073,7 +946,7 @@ func runPersonalEventStatus(c *cobra.Command, opts personalStatusOptions) error
 	if status == "" || status == "all" {
 		status = ""
 	}
-	subs, err := personalListSubscriptions(newPersonalEventControlClient(configDir, personalEventControlBaseURL(opts.ControlBaseURL, configDir), identity, opts.ExplicitToken), ctx, personal.ListOptions{
+	subs, err := personalListSubscriptions(newPersonalEventControlClient(configDir, personalEventControlBaseURL(opts.ControlBaseURL, configDir), identity), ctx, personal.ListOptions{
 		Status:      status,
 		EventKey:    opts.EventKey,
 		SubscribeID: opts.SubscribeID,
@@ -1094,15 +967,6 @@ func runPersonalEventStatus(c *cobra.Command, opts personalStatusOptions) error
 	return nil
 }

-func personalRuntimeTokenControlRejection(err error) bool {
-	var apiErr *personal.APIError
-	if !errors.As(err, &apiErr) || apiErr == nil {
-		return false
-	}
-	return apiErr.HTTPStatus == http.StatusUnauthorized ||
-		strings.EqualFold(strings.TrimSpace(apiErr.Code), "RUNTIME_TOKEN_REJECTED")
-}
-
 func ensurePublicPersonalEvent(eventKey string) error {
 	eventKey = strings.TrimSpace(eventKey)
 	if eventKey == "" {
@@ -1185,7 +1049,7 @@ func runPersonalEventStop(c *cobra.Command, opts personalStopOptions) error {
 	}

 	configDir := defaultConfigDir()
-	identity, err := resolvePersonalEventIdentityForToken(ctx, configDir, opts.StreamSourceID, opts.ExplicitToken, opts.ClientIDOverride)
+	identity, err := personalResolveEventIdentity(ctx, configDir, opts.StreamSourceID)
 	if err != nil {
 		return fmt.Errorf("event stop --as user: %w", err)
 	}
@@ -1197,7 +1061,7 @@ func runPersonalEventStop(c *cobra.Command, opts personalStopOptions) error {
 	if err != nil {
 		return fmt.Errorf("event stop --as user: %w", err)
 	}
-	client := newPersonalEventControlClient(configDir, personalEventControlBaseURL(opts.ControlBaseURL, configDir), identity, opts.ExplicitToken)
+	client := newPersonalEventControlClient(configDir, personalEventControlBaseURL(opts.ControlBaseURL, configDir), identity)
 	for _, id := range subscribeIDs {
 		if err := personalDeleteSubscription(client, ctx, id); err != nil {
 			return fmt.Errorf("event stop --as user: cancel subscription %s: %w", id, err)
@@ -1313,138 +1177,6 @@ func printPersonalStopResult(w io.Writer, subscribeIDs []string, single bool, bu
 	fmt.Fprintf(w, "cancelled %d personal subscription(s); %s\n", len(subscribeIDs), busState)
 }

-func resolvePersonalEventIdentityForToken(ctx context.Context, configDir, sourceIDOverride, explicitToken string, clientIDOverrides ...string) (personal.Identity, error) {
-	explicitToken = strings.TrimSpace(explicitToken)
-	if explicitToken == "" {
-		return personalResolveEventIdentity(ctx, configDir, sourceIDOverride)
-	}
-	clientIDOverride := ""
-	if len(clientIDOverrides) > 0 {
-		clientIDOverride = strings.TrimSpace(clientIDOverrides[0])
-	}
-	return resolvePersonalEventIdentityWithToken(ctx, configDir, sourceIDOverride, explicitToken, clientIDOverride)
-}
-
-// resolvePersonalEventIdentityWithToken resolves only non-sensitive identity
-// metadata around a caller-supplied bearer token. It intentionally does not
-// call LoadTokenData or any refresh-capable token resolver: an explicit root
-// --token must never be replaced with, persisted into, or used to refresh a
-// local OAuth profile.
-func resolvePersonalEventIdentityWithToken(ctx context.Context, configDir, sourceIDOverride, explicitToken string, clientIDOverrides ...string) (personal.Identity, error) {
-	explicitToken = strings.TrimSpace(explicitToken)
-	if explicitToken == "" {
-		return resolvePersonalEventIdentity(ctx, configDir, sourceIDOverride)
-	}
-	if strings.Contains(strings.TrimSpace(authpkg.RuntimeProfile()), ",") {
-		return personal.Identity{}, fmt.Errorf("personal events require exactly one --profile")
-	}
-
-	corpID := resolveRuntimeDefault(ctx, "$corpId")
-	userID := resolveRuntimeDefault(ctx, "$currentUserId")
-	clientID := ""
-	if len(clientIDOverrides) > 0 {
-		clientID = strings.TrimSpace(clientIDOverrides[0])
-	}
-	if clientID == "" {
-		// An edition hook or explicit environment value is runtime identity,
-		// not persisted app state. Resolve it before profiles.json so a complete
-		// host context never depends on local OAuth metadata health.
-		clientID = strings.TrimSpace(personalRuntimeEventClientID())
-	}
-	explicitProfile := strings.TrimSpace(authpkg.RuntimeProfile()) != ""
-	if explicitProfile || corpID == "" || userID == "" || clientID == "" {
-		profile, err := personalEventProfileMetadata(configDir)
-		if err != nil {
-			// A user-selected --profile remains a strict contract. Without an
-			// explicit selector, profiles.json is optional metadata for a
-			// host-managed bearer: malformed or stale persisted state must not
-			// override complete runtime defaults or prevent the later global
-			// client-id fallback.
-			if explicitProfile {
-				return personal.Identity{}, fmt.Errorf("load OAuth identity metadata: %w", err)
-			}
-			profile = nil
-		}
-		if profile != nil {
-			if corpID == "" {
-				corpID = strings.TrimSpace(profile.CorpID)
-			}
-			if userID == "" {
-				userID = strings.TrimSpace(profile.UserID)
-			}
-			if clientID == "" {
-				clientID = strings.TrimSpace(profile.ClientID)
-			}
-		}
-	}
-	if clientID == "" {
-		// Persisted/global app credentials are only a fallback after the
-		// selected profile, so an old app config cannot override profile.ClientID.
-		clientID = strings.TrimSpace(personalClientID())
-	}
-	if clientID == "" {
-		if id, _, _, _, resolveErr := personalResolveAppCredentialsStrict(configDir); resolveErr == nil {
-			clientID = strings.TrimSpace(id)
-		}
-	}
-	if clientID == "" {
-		return personal.Identity{}, fmt.Errorf("cannot resolve OAuth client_id for personal events")
-	}
-
-	sourceID := strings.TrimSpace(sourceIDOverride)
-	if sourceID == "" {
-		sourceID = personalEventStreamSourceID("")
-	}
-	localSubject := ""
-	if corpID == "" || userID == "" {
-		localSubject = personalTokenSubject("access", explicitToken)
-	}
-	return personal.Identity{
-		LocalSubject: localSubject,
-		CorpID:       corpID,
-		UserID:       userID,
-		ClientID:     clientID,
-		SourceID:     sourceID,
-	}, nil
-}
-
-func personalEventProfileMetadata(configDir string) (*authpkg.Profile, error) {
-	cfg, err := personalLoadProfiles(configDir)
-	if err != nil {
-		return nil, err
-	}
-	selector := strings.TrimSpace(authpkg.RuntimeProfile())
-	explicitSelector := selector != ""
-	if strings.Contains(selector, ",") {
-		return nil, fmt.Errorf("personal events require exactly one --profile")
-	}
-	if cfg == nil || len(cfg.Profiles) == 0 {
-		if explicitSelector {
-			return nil, fmt.Errorf("profile %q not found", selector)
-		}
-		return nil, nil
-	}
-	if selector == "" {
-		selector = strings.TrimSpace(cfg.CurrentProfile)
-	}
-	if selector == "" {
-		return nil, nil
-	}
-	profile, err := selectPersonalEventProfileMetadata(cfg, selector, make(map[string]struct{}))
-	if err != nil && !explicitSelector {
-		// A stale persisted CurrentProfile must not make a host-provided bearer
-		// unusable. Runtime defaults and the one-way local subject are sufficient
-		// to isolate the event bus without consulting local OAuth credentials.
-		return nil, nil
-	}
-	return profile, err
-}
-
-func selectPersonalEventProfileMetadata(cfg *authpkg.ProfilesConfig, selector string, visited map[string]struct{}) (*authpkg.Profile, error) {
-	_ = visited // retained for the focused compatibility seam used by app tests.
-	return authpkg.ResolveProfileMetadata(cfg, strings.TrimSpace(selector))
-}
-
 func resolvePersonalEventIdentity(ctx context.Context, configDir string, sourceIDOverride string) (personal.Identity, error) {
 	accessToken, err := personalResolveAuxiliaryAccessToken(ctx, configDir, "")
 	if err != nil {
@@ -1499,11 +1231,7 @@ func resolvePersonalEventIdentity(ctx context.Context, configDir string, sourceI
 	}, nil
 }

-func newPersonalEventControlClient(configDir, baseURL string, identity personal.Identity, explicitTokens ...string) *personal.Client {
-	explicitToken := ""
-	if len(explicitTokens) > 0 {
-		explicitToken = strings.TrimSpace(explicitTokens[0])
-	}
+func newPersonalEventControlClient(configDir, baseURL string, identity personal.Identity) *personal.Client {
 	identity.AccessToken = ""
 	client := personal.NewClient(baseURL, identity)
 	version := strings.TrimSpace(RawVersion())
@@ -1512,146 +1240,12 @@ func newPersonalEventControlClient(configDir, baseURL string, identity personal.
 	}
 	client.ClientVersion = version
 	client.UserAgent = "dws-cli/" + version
-	if explicitToken != "" {
-		client.AccessTokenProvider = func(context.Context) (string, error) { return explicitToken, nil }
-		client.HTTPClient.Transport = runtimeTokenControlTransport{base: http.DefaultTransport, token: explicitToken}
-		client.HTTPClient.CheckRedirect = runtimeTokenRedirectPolicy
-	} else {
-		client.AccessTokenProvider = func(ctx context.Context) (string, error) {
-			return personalResolveAuxiliaryAccessToken(ctx, configDir, "")
-		}
+	client.AccessTokenProvider = func(ctx context.Context) (string, error) {
+		return personalResolveAuxiliaryAccessToken(ctx, configDir, "")
 	}
 	return client
 }

-// runtimeTokenRedirectPolicy prevents Go's redirect machinery from copying
-// DWS's custom x-user-access-token header to another authority. Returning
-// ErrUseLastResponse keeps the 3xx response available to the caller without a
-// url.Error that could echo an attacker-controlled Location value.
-func runtimeTokenRedirectPolicy(req *http.Request, via []*http.Request) error {
-	if len(via) == 0 || req == nil || req.URL == nil || via[0] == nil || via[0].URL == nil {
-		return http.ErrUseLastResponse
-	}
-	origin := via[0].URL
-	if !strings.EqualFold(strings.TrimSpace(req.URL.Host), strings.TrimSpace(origin.Host)) {
-		return http.ErrUseLastResponse
-	}
-	if strings.EqualFold(origin.Scheme, "https") && !strings.EqualFold(req.URL.Scheme, "https") {
-		return http.ErrUseLastResponse
-	}
-	return nil
-}
-
-const runtimeTokenControlErrorBody = `{"code":"RUNTIME_TOKEN_REJECTED","message":"event runtime token was rejected; retry with a fresh host credential"}`
-
-// runtimeTokenControlTransport scrubs an explicit bearer from every response
-// body and diagnostic header before the control client decodes or logs it. A
-// 401 is replaced with a fixed rejection envelope so untrusted response text
-// can never escape through stderr or debug logs.
-type runtimeTokenControlTransport struct {
-	base  http.RoundTripper
-	token string
-}
-
-func (t runtimeTokenControlTransport) RoundTrip(req *http.Request) (*http.Response, error) {
-	base := t.base
-	if base == nil {
-		base = http.DefaultTransport
-	}
-	resp, err := base.RoundTrip(req)
-	if err != nil {
-		if token := strings.TrimSpace(t.token); token != "" && strings.Contains(err.Error(), token) {
-			return nil, errors.New("personal event: runtime-token control request failed")
-		}
-		return nil, err
-	}
-	if resp == nil {
-		return resp, err
-	}
-	token := strings.TrimSpace(t.token)
-	for key, values := range resp.Header {
-		for i := range values {
-			if token != "" {
-				values[i] = strings.ReplaceAll(values[i], token, "<redacted-runtime-token>")
-			}
-		}
-		resp.Header[key] = values
-	}
-	var responseBody []byte
-	if resp.Body != nil {
-		responseBody, err = io.ReadAll(io.LimitReader(resp.Body, config.MaxResponseBodySize))
-		_ = resp.Body.Close()
-		if err != nil {
-			return nil, errors.New("personal event: read runtime-token control response")
-		}
-	}
-	if resp.StatusCode == http.StatusUnauthorized {
-		responseBody = []byte(runtimeTokenControlErrorBody)
-	} else if token != "" {
-		responseBody = redactRuntimeTokenResponseBody(responseBody, token)
-	}
-	resp.Body = io.NopCloser(bytes.NewReader(responseBody))
-	resp.ContentLength = int64(len(responseBody))
-	if resp.Header == nil {
-		resp.Header = make(http.Header)
-	}
-	resp.Header.Set("Content-Type", "application/json")
-	resp.Header.Set("Content-Length", fmt.Sprintf("%d", len(responseBody)))
-	return resp, nil
-}
-
-func redactRuntimeTokenResponseBody(data []byte, token string) []byte {
-	token = strings.TrimSpace(token)
-	if len(data) == 0 || token == "" {
-		return data
-	}
-	decoder := json.NewDecoder(bytes.NewReader(data))
-	decoder.UseNumber()
-	var decoded any
-	if err := decoder.Decode(&decoded); err == nil {
-		var trailing any
-		if trailingErr := decoder.Decode(&trailing); errors.Is(trailingErr, io.EOF) {
-			if redacted, changed := redactRuntimeTokenJSONValue(decoded, token); changed {
-				if encoded, marshalErr := json.Marshal(redacted); marshalErr == nil {
-					return encoded
-				}
-			}
-		}
-	}
-	return bytes.ReplaceAll(data, []byte(token), []byte("<redacted-runtime-token>"))
-}
-
-func redactRuntimeTokenJSONValue(value any, token string) (any, bool) {
-	switch typed := value.(type) {
-	case string:
-		redacted := strings.ReplaceAll(typed, token, "<redacted-runtime-token>")
-		return redacted, redacted != typed
-	case []any:
-		changed := false
-		for i := range typed {
-			var itemChanged bool
-			typed[i], itemChanged = redactRuntimeTokenJSONValue(typed[i], token)
-			changed = changed || itemChanged
-		}
-		return typed, changed
-	case map[string]any:
-		changed := false
-		redactedMap := make(map[string]any, len(typed))
-		for key, item := range typed {
-			redactedKey := strings.ReplaceAll(key, token, "<redacted-runtime-token>")
-			redacted, itemChanged := redactRuntimeTokenJSONValue(item, token)
-			redactedMap[redactedKey] = redacted
-			changed = changed || itemChanged || redactedKey != key
-		}
-		if !changed {
-			return typed, false
-		}
-		return redactedMap, true
-	default:
-		return value, false
-	}
-}
-
 func personalTokenSubject(kind, token string) string {
 	token = strings.TrimSpace(token)
 	if token == "" {
@@ -1661,15 +1255,6 @@ func personalTokenSubject(kind, token string) string {
 	return strings.TrimSpace(kind) + ":" + hex.EncodeToString(sum[:])
 }

-func validPersonalIdentityHash(value string) bool {
-	value = strings.TrimSpace(value)
-	if len(value) != 16 {
-		return false
-	}
-	_, err := hex.DecodeString(value)
-	return err == nil
-}
-
 func resolveRuntimeDefault(ctx context.Context, key string) string {
 	if fnMap := edition.Get().RuntimeDefaults; fnMap != nil {
 		if fn := fnMap()[key]; fn != nil {
@@ -1707,42 +1292,20 @@ func newPersonalStreamSource(ctx context.Context, opts personalStreamSourceOptio
 		}
 		clientSecret = secret
 	}
-	credentialBroker := opts.CredentialBroker
-	if credentialBroker == nil {
-		credentialBroker = newPersonalCredentialBroker(opts.ConfigDir, false, false)
-	}
-	httpClient := &http.Client{Timeout: 30 * time.Second}
-	if opts.RuntimeTokenMode {
-		httpClient.CheckRedirect = runtimeTokenRedirectPolicy
-	}
 	_ = ctx
 	return source.NewPersonal(source.PersonalConfig{
 		AccessTokenProvider: func(ctx context.Context) (string, error) {
-			return credentialBroker.Resolve(ctx)
+			return personalResolveAuxiliaryAccessToken(ctx, opts.ConfigDir, "")
 		},
 		ForceRefreshToken: func(ctx context.Context, rejectedToken string) (string, error) {
-			return credentialBroker.RefreshRejected(ctx, rejectedToken)
-		},
-		ClassifyRetryReject: credentialBroker.ClassifyRejectedAfterRetry,
-		ClientID:            clientID,
-		ClientSecret:        clientSecret,
-		SourceID:            opts.Identity.SourceID,
-		TicketURL:           ticketURL,
-		TicketMode:          mode,
-		HTTPClient:          httpClient,
-	})
-}
-
-func newPersonalCredentialBroker(configDir string, requireSeed, requireActivation bool) *runtimecred.Broker {
-	return runtimecred.New(runtimecred.Config{
-		RequireSeed:       requireSeed,
-		RequireActivation: requireActivation,
-		LocalResolve: func(ctx context.Context) (string, error) {
-			return personalResolveAuxiliaryAccessToken(ctx, configDir, "")
-		},
-		LocalRefresh: func(ctx context.Context, rejectedToken string) (string, error) {
-			return personalForceRefreshRejectedToken(ctx, configDir, rejectedToken)
+			return personalForceRefreshRejectedToken(ctx, opts.ConfigDir, rejectedToken)
 		},
+		ClientID:     clientID,
+		ClientSecret: clientSecret,
+		SourceID:     opts.Identity.SourceID,
+		TicketURL:    ticketURL,
+		TicketMode:   mode,
+		HTTPClient:   &http.Client{Timeout: 30 * time.Second},
 	})
 }

@@ -1807,25 +1370,6 @@ func personalBusSpawnArgs(identity personal.Identity, ticketMode, ticketURL stri
 	return args
 }

-func personalBusSpawnArgsForToken(identity personal.Identity, identityHash, ticketMode, ticketURL, profileSelector, explicitToken string) []string {
-	if strings.TrimSpace(explicitToken) == "" {
-		return personalBusSpawnArgs(identity, ticketMode, ticketURL, profileSelector)
-	}
-	args := []string{
-		"--source-kind", string(dwsevent.SourceKindPersonalStream),
-		"--runtime-token-mode",
-		"--identity-hash", strings.TrimSpace(identityHash),
-		"--stream-source-id", strings.TrimSpace(identity.SourceID),
-	}
-	if strings.TrimSpace(ticketMode) != "" {
-		args = append(args, "--stream-ticket-mode", strings.TrimSpace(ticketMode))
-	}
-	if strings.TrimSpace(ticketURL) != "" {
-		args = append(args, "--stream-ticket-url", strings.TrimSpace(ticketURL))
-	}
-	return args
-}
-
 func personalEventTypes(eventKey string, explicit []string) []string {
 	if len(explicit) > 0 {
 		return explicit
@@ -18,7 +18,6 @@ import (
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/event/personal"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/event/source"
 	eventtransport "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/event/transport"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/testseam"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/edition"
 	"github.com/spf13/cobra"
 )
@@ -37,20 +36,18 @@ func TestCrossPlatformCoveragePersonalEventRemainingSchemaAndSubscriptionCoverag
 		}
 	}

-	testseam.Protect(t, &personalGetSubscription)
-	testseam.Protect(t, &personalCreateSubscription)
+	oldGet := personalGetSubscription
+	oldCreate := personalCreateSubscription
+	t.Cleanup(func() {
+		personalGetSubscription = oldGet
+		personalCreateSubscription = oldCreate
+	})
 	client := personal.NewClient("https://example.test", personal.Identity{})
 	wantErr := errors.New("subscription")
 	personalGetSubscription = func(*personal.Client, context.Context, string) (*personal.Subscription, error) { return nil, wantErr }
 	if _, _, _, err := ensurePersonalSubscription(context.Background(), client, personal.Identity{}, personalConsumeOptions{SubscribeID: "sub"}); !errors.Is(err, wantErr) {
 		t.Fatalf("get subscription error = %v", err)
 	}
-	personalGetSubscription = func(*personal.Client, context.Context, string) (*personal.Subscription, error) {
-		return nil, nil
-	}
-	if _, _, _, err := ensurePersonalSubscription(context.Background(), client, personal.Identity{}, personalConsumeOptions{SubscribeID: "sub"}); err == nil || !strings.Contains(err.Error(), "empty subscription") {
-		t.Fatalf("nil subscription = %v", err)
-	}
 	personalGetSubscription = func(*personal.Client, context.Context, string) (*personal.Subscription, error) {
 		return &personal.Subscription{}, nil
 	}
@@ -1,627 +0,0 @@
-// Copyright 2026 Alibaba Group
-// Licensed under the Apache License, Version 2.0 (the "License");
-
-package app
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-	"io"
-	"reflect"
-	"strings"
-	"testing"
-
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/event/consume"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/event/personal"
-	"github.com/spf13/cobra"
-)
-
-func TestPersonalOAEventListAndSchemaCommands(t *testing.T) {
-	list := newEventListCommand()
-	list.SilenceUsage = true
-	list.SilenceErrors = true
-	var listOut bytes.Buffer
-	list.SetOut(&listOut)
-	list.SetArgs([]string{"--category", "oa"})
-	if err := list.Execute(); err != nil {
-		t.Fatalf("event list --category oa error = %v", err)
-	}
-	tests := []struct {
-		eventKey   string
-		properties []string
-	}{
-		{
-			eventKey: personal.EventOAApprovalTaskCreated,
-			properties: []string{
-				"type", "event_id", "timestamp", "subscribe_id", "process_instance_id",
-				"process_code", "task_id", "title", "status", "create_time", "event_time",
-			},
-		},
-		{
-			eventKey: personal.EventOAApprovalTaskFinished,
-			properties: []string{
-				"type", "event_id", "timestamp", "subscribe_id", "process_instance_id",
-				"process_code", "task_id", "title", "status", "result", "create_time",
-				"finish_time", "event_time",
-			},
-		},
-		{
-			eventKey: personal.EventOAApprovalTaskRedirected,
-			properties: []string{
-				"type", "event_id", "timestamp", "subscribe_id", "process_instance_id",
-				"process_code", "task_id", "title", "status", "result", "create_time",
-				"finish_time", "event_time",
-			},
-		},
-		{
-			eventKey: personal.EventOAApprovalInstanceStarted,
-			properties: []string{
-				"type", "event_id", "timestamp", "subscribe_id", "process_instance_id",
-				"process_code", "title", "status", "create_time", "event_time",
-			},
-		},
-		{
-			eventKey: personal.EventOAApprovalInstanceTerminated,
-			properties: []string{
-				"type", "event_id", "timestamp", "subscribe_id", "process_instance_id",
-				"process_code", "title", "status", "create_time", "finish_time", "event_time",
-			},
-		},
-		{
-			eventKey: personal.EventOAApprovalInstanceFinished,
-			properties: []string{
-				"type", "event_id", "timestamp", "subscribe_id", "process_instance_id",
-				"process_code", "title", "status", "result", "create_time", "finish_time",
-				"event_time",
-			},
-		},
-	}
-	for _, tt := range tests {
-		eventKey := tt.eventKey
-		if !strings.Contains(listOut.String(), eventKey) {
-			t.Fatalf("OA event list missing %s:\n%s", eventKey, listOut.String())
-		}
-
-		schema := newEventSchemaCommand()
-		schema.SilenceUsage = true
-		schema.SilenceErrors = true
-		var schemaOut bytes.Buffer
-		schema.SetOut(&schemaOut)
-		schema.SetArgs([]string{eventKey, "--flatten"})
-		if err := schema.Execute(); err != nil {
-			t.Fatalf("event schema %s --flatten error = %v", eventKey, err)
-		}
-		var doc map[string]any
-		if err := json.Unmarshal(schemaOut.Bytes(), &doc); err != nil {
-			t.Fatalf("decode schema for %s: %v\n%s", eventKey, err, schemaOut.String())
-		}
-		if doc["event_key"] != eventKey || doc["rule_type"] != "all" || doc["jq_root_path"] != "." {
-			t.Fatalf("schema document for %s = %#v", eventKey, doc)
-		}
-		schemaBody, ok := doc["schema"].(map[string]any)
-		if !ok {
-			t.Fatalf("schema body for %s = %#v", eventKey, doc["schema"])
-		}
-		properties, ok := schemaBody["properties"].(map[string]any)
-		if !ok || len(properties) != len(tt.properties) {
-			t.Fatalf("schema properties for %s = %#v, want %d fields", eventKey, schemaBody["properties"], len(tt.properties))
-		}
-		for _, name := range tt.properties {
-			if _, ok := properties[name].(map[string]any); !ok {
-				t.Fatalf("schema property %s for %s = %#v", name, eventKey, properties[name])
-			}
-		}
-		if _, ok := properties["payload"]; ok {
-			t.Fatalf("schema for %s exposed generic payload: %#v", eventKey, properties)
-		}
-	}
-	if strings.Contains(listOut.String(), personal.EventMention) {
-		t.Fatalf("OA category list leaked IM event:\n%s", listOut.String())
-	}
-}
-
-func TestPersonalOAEventConsumeDryRunAndValidation(t *testing.T) {
-	oldIdentity := personalResolveEventIdentity
-	oldGet := personalGetSubscription
-	t.Cleanup(func() {
-		personalResolveEventIdentity = oldIdentity
-		personalGetSubscription = oldGet
-	})
-	personalResolveEventIdentity = func(context.Context, string, string) (personal.Identity, error) {
-		return personal.Identity{
-			AccessToken:  "token",
-			LocalSubject: "subject",
-			ClientID:     "client",
-			SourceID:     "open",
-		}, nil
-	}
-	personalGetSubscription = func(_ *personal.Client, _ context.Context, subscribeID string) (*personal.Subscription, error) {
-		switch subscribeID {
-		case "oa-sub-task":
-			return &personal.Subscription{
-				SubscribeID: subscribeID,
-				EventKey:    personal.EventOAApprovalTaskCreated,
-				RuleType:    "all",
-			}, nil
-		case "im-sub-at":
-			return &personal.Subscription{
-				SubscribeID: subscribeID,
-				EventKey:    personal.EventMention,
-				RuleType:    "at",
-			}, nil
-		default:
-			t.Fatalf("unexpected subscription lookup %q", subscribeID)
-			return nil, nil
-		}
-	}
-
-	oaEvents := []string{
-		personal.EventOAApprovalTaskCreated,
-		personal.EventOAApprovalTaskFinished,
-		personal.EventOAApprovalTaskRedirected,
-		personal.EventOAApprovalInstanceStarted,
-		personal.EventOAApprovalInstanceTerminated,
-		personal.EventOAApprovalInstanceFinished,
-	}
-	for _, eventKey := range oaEvents {
-		t.Run(eventKey+"/dry-run", func(t *testing.T) {
-			cmd := newEventConsumeCommand()
-			cmd.SilenceUsage = true
-			cmd.SilenceErrors = true
-			var stderr bytes.Buffer
-			cmd.SetOut(io.Discard)
-			cmd.SetErr(&stderr)
-			cmd.SetArgs([]string{eventKey, "--dry-run"})
-			if err := cmd.Execute(); err != nil {
-				t.Fatalf("OA dry-run error = %v", err)
-			}
-			if !strings.Contains(stderr.String(), "event_types      : "+eventKey) {
-				t.Fatalf("OA dry-run does not select %s:\n%s", eventKey, stderr.String())
-			}
-		})
-
-		for _, args := range [][]string{
-			{"--user", "user-1"},
-			{"--open-dingtalk-id", "open-user-1"},
-			{"--group", "cid-1"},
-			{"--query", "urgent"},
-			{"--filter-json", `{"field":"content","op":"eq","value":"urgent"}`},
-		} {
-			name := strings.TrimPrefix(args[0], "--")
-			t.Run(eventKey+"/reject-"+name, func(t *testing.T) {
-				cmd := newEventConsumeCommand()
-				cmd.SilenceUsage = true
-				cmd.SilenceErrors = true
-				cmd.SetOut(io.Discard)
-				cmd.SetErr(io.Discard)
-				cmd.SetArgs(append([]string{eventKey}, append(args, "--dry-run")...))
-				err := cmd.Execute()
-				if err == nil || !strings.Contains(err.Error(), "not supported") {
-					t.Fatalf("OA consume %s error = %v, want unsupported option", args[0], err)
-				}
-			})
-		}
-	}
-
-	t.Run("multi-dry-run", func(t *testing.T) {
-		cmd := newEventConsumeCommand()
-		cmd.SilenceUsage = true
-		cmd.SilenceErrors = true
-		var stderr bytes.Buffer
-		cmd.SetOut(io.Discard)
-		cmd.SetErr(&stderr)
-		cmd.SetArgs(append(append([]string(nil), oaEvents...), "--dry-run"))
-		if err := cmd.Execute(); err != nil {
-			t.Fatalf("multi OA dry-run error = %v", err)
-		}
-		for _, eventKey := range oaEvents {
-			want := "event_key=" + eventKey + " rule_type=all rule_param={}"
-			if !strings.Contains(stderr.String(), want) {
-				t.Fatalf("multi OA dry-run missing %q:\n%s", want, stderr.String())
-			}
-		}
-	})
-
-	reuseOverrides := [][]string{
-		{"--user", "user-1"},
-		{"--open-dingtalk-id", "open-user-1"},
-		{"--group", "cid-1"},
-		{"--query", "urgent"},
-		{"--filter-json", `{"field":"content","op":"eq","value":"urgent"}`},
-	}
-	t.Run("reuse-dry-run/implicit-event-key/resolves-oa-event", func(t *testing.T) {
-		cmd := newEventConsumeCommand()
-		cmd.SilenceUsage = true
-		cmd.SilenceErrors = true
-		var stderr bytes.Buffer
-		cmd.SetOut(io.Discard)
-		cmd.SetErr(&stderr)
-		cmd.SetArgs([]string{"--subscribe-id", "oa-sub-task", "--dry-run"})
-		if err := cmd.Execute(); err != nil {
-			t.Fatalf("implicit reused OA dry-run error = %v", err)
-		}
-		if !strings.Contains(stderr.String(), "event_types      : "+personal.EventOAApprovalTaskCreated) {
-			t.Fatalf("implicit reused OA dry-run did not resolve event key:\n%s", stderr.String())
-		}
-	})
-	for _, explicitEventKey := range []bool{true, false} {
-		mode := "implicit-event-key"
-		if explicitEventKey {
-			mode = "explicit-event-key"
-		}
-		for _, override := range reuseOverrides {
-			flag := override[0]
-			t.Run("reuse-dry-run/"+mode+"/"+strings.TrimPrefix(flag, "--"), func(t *testing.T) {
-				args := make([]string, 0, 6)
-				if explicitEventKey {
-					args = append(args, personal.EventOAApprovalTaskCreated)
-				}
-				args = append(args, "--subscribe-id", "oa-sub-task", flag, override[1], "--dry-run")
-				cmd := newEventConsumeCommand()
-				cmd.SilenceUsage = true
-				cmd.SilenceErrors = true
-				cmd.SetOut(io.Discard)
-				cmd.SetErr(io.Discard)
-				cmd.SetArgs(args)
-				err := cmd.Execute()
-				if err == nil || !strings.Contains(err.Error(), flag+" not supported for OA event") {
-					t.Fatalf("%s reused OA dry-run %s error = %v", mode, flag, err)
-				}
-			})
-		}
-	}
-
-	t.Run("reuse-dry-run/implicit-im-remains-supported", func(t *testing.T) {
-		cmd := newEventConsumeCommand()
-		cmd.SilenceUsage = true
-		cmd.SilenceErrors = true
-		cmd.SetOut(io.Discard)
-		cmd.SetErr(io.Discard)
-		cmd.SetArgs([]string{"--subscribe-id", "im-sub-at", "--query", "urgent", "--dry-run"})
-		if err := cmd.Execute(); err != nil {
-			t.Fatalf("implicit reused IM dry-run error = %v", err)
-		}
-	})
-
-	for _, override := range reuseOverrides {
-		flag, value := override[0], override[1]
-		t.Run("multi-reject-"+strings.TrimPrefix(flag, "--"), func(t *testing.T) {
-			cmd := newEventConsumeCommand()
-			cmd.SilenceUsage = true
-			cmd.SilenceErrors = true
-			cmd.SetOut(io.Discard)
-			cmd.SetErr(io.Discard)
-			args := append([]string(nil), oaEvents...)
-			args = append(args, flag, value, "--dry-run")
-			cmd.SetArgs(args)
-			err := cmd.Execute()
-			if err == nil || !strings.Contains(err.Error(), "not supported for OA event") {
-				t.Fatalf("multi OA consume %s error = %v", flag, err)
-			}
-		})
-	}
-
-	for _, test := range []struct {
-		name string
-		args []string
-	}{
-		{
-			name: "message query remains supported",
-			args: []string{personal.EventMention, "--query", "urgent", "--dry-run"},
-		},
-		{
-			name: "single group lifecycle filter remains supported",
-			args: []string{
-				personal.EventGroupUpdated,
-				"--group", "cid-1",
-				"--filter-json", `{"field":"future","op":"eq","value":"value"}`,
-				"--dry-run",
-			},
-		},
-	} {
-		t.Run(test.name, func(t *testing.T) {
-			cmd := newEventConsumeCommand()
-			cmd.SilenceUsage = true
-			cmd.SilenceErrors = true
-			cmd.SetOut(io.Discard)
-			cmd.SetErr(io.Discard)
-			cmd.SetArgs(test.args)
-			if err := cmd.Execute(); err != nil {
-				t.Fatalf("existing IM consume behavior changed: %v", err)
-			}
-		})
-	}
-}
-
-func TestCrossPlatformCoveragePersonalOAValidationBranches(t *testing.T) {
-	invalid := personalConsumeOptions{
-		EventKey: personal.EventOAApprovalTaskCreated,
-		UserID:   "user-1",
-	}
-	if err := validatePersonalSubscriptionOptions(invalid); err == nil ||
-		!strings.Contains(err.Error(), "--user not supported for OA event") {
-		t.Fatalf("validatePersonalSubscriptionOptions() error = %v", err)
-	}
-	if _, err := preparePersonalSubscription(personal.Identity{}, invalid); err == nil ||
-		!strings.Contains(err.Error(), "--user not supported for OA event") {
-		t.Fatalf("preparePersonalSubscription() error = %v", err)
-	}
-
-	oldGet := personalGetSubscription
-	t.Cleanup(func() { personalGetSubscription = oldGet })
-	personalGetSubscription = func(*personal.Client, context.Context, string) (*personal.Subscription, error) {
-		return &personal.Subscription{
-			SubscribeID: "oa-sub-without-event-key",
-			RuleType:    "all",
-		}, nil
-	}
-	_, _, _, err := ensurePersonalSubscription(
-		context.Background(),
-		nil,
-		personal.Identity{},
-		personalConsumeOptions{
-			SubscribeID: "oa-sub-without-event-key",
-			EventKey:    personal.EventOAApprovalTaskCreated,
-			UserID:      "user-1",
-		},
-	)
-	if err == nil || !strings.Contains(err.Error(), "--user not supported for OA event") {
-		t.Fatalf("ensurePersonalSubscription() error = %v", err)
-	}
-}
-
-func TestPersonalOAMultiConsumeCreatesIndependentAllSubscriptionsOnSharedBus(t *testing.T) {
-	restoreMany := installPersonalManySeams(t)
-	defer restoreMany()
-	oldCreate := personalCreateSubscription
-	defer func() { personalCreateSubscription = oldCreate }()
-	t.Setenv("DWS_CONFIG_DIR", t.TempDir())
-
-	identity := personal.Identity{
-		AccessToken:  "token",
-		LocalSubject: "subject",
-		ClientID:     "client",
-		SourceID:     "open",
-	}
-	personalResolveEventIdentity = func(context.Context, string, string) (personal.Identity, error) {
-		return identity, nil
-	}
-	var requests []personal.CreateSubscriptionRequest
-	personalCreateSubscription = func(_ *personal.Client, _ context.Context, req personal.CreateSubscriptionRequest) (*personal.Subscription, error) {
-		requests = append(requests, req)
-		return &personal.Subscription{SubscribeID: "sub-" + req.EventKey}, nil
-	}
-	personalEnsureSubscription = ensurePersonalSubscription
-	var states []personal.RunState
-	personalUpsertRunState = func(_ string, state personal.RunState) error {
-		states = append(states, state)
-		return nil
-	}
-	personalDeleteSubscription = func(*personal.Client, context.Context, string) error { return nil }
-	personalRemoveRunStates = func(string, []string) error { return nil }
-	personalValidateConsumeConfig = func(consume.Config) error { return nil }
-	runManyCalls := 0
-	var gotSpecs []consume.ConsumerSpec
-	personalConsumeRunMany = func(_ context.Context, _ consume.Config, specs []consume.ConsumerSpec) error {
-		runManyCalls++
-		gotSpecs = append([]consume.ConsumerSpec(nil), specs...)
-		return nil
-	}
-
-	eventKeys := []string{
-		personal.EventOAApprovalTaskCreated,
-		personal.EventOAApprovalTaskFinished,
-		personal.EventOAApprovalTaskRedirected,
-		personal.EventOAApprovalInstanceStarted,
-		personal.EventOAApprovalInstanceTerminated,
-		personal.EventOAApprovalInstanceFinished,
-	}
-	if err := runPersonalEventConsume(newPersonalCoverageCommand(), personalConsumeOptions{
-		EventKeys: eventKeys,
-		Flatten:   true,
-	}); err != nil {
-		t.Fatalf("multi OA consume error = %v", err)
-	}
-	if runManyCalls != 1 {
-		t.Fatalf("RunMany calls = %d, want one shared-bus consume call", runManyCalls)
-	}
-	if len(requests) != len(eventKeys) || len(states) != len(eventKeys) || len(gotSpecs) != len(eventKeys) {
-		t.Fatalf("requests=%d states=%d specs=%d, want %d each", len(requests), len(states), len(gotSpecs), len(eventKeys))
-	}
-	for i, eventKey := range eventKeys {
-		req := requests[i]
-		if req.EventKey != eventKey || req.RuleType != "all" || req.RuleParam == nil || len(req.RuleParam) != 0 || req.Filter != nil {
-			t.Fatalf("subscription request[%d] = %#v, want %s all/{}", i, req, eventKey)
-		}
-		if states[i].EventKey != eventKey || states[i].RuleType != "all" {
-			t.Fatalf("run state[%d] = %#v", i, states[i])
-		}
-		wantSpec := consume.ConsumerSpec{
-			EventKey:         eventKey,
-			EventTypes:       []string{eventKey},
-			SubscribeID:      "sub-" + eventKey,
-			ReadySubscribeID: "sub-" + eventKey,
-		}
-		if !reflect.DeepEqual(gotSpecs[i], wantSpec) {
-			t.Fatalf("consumer spec[%d] = %#v, want %#v", i, gotSpecs[i], wantSpec)
-		}
-	}
-}
-
-func TestPersonalOAReusedSubscriptionRejectsDefinitionOverridesAtRuntime(t *testing.T) {
-	oldGet := personalGetSubscription
-	t.Cleanup(func() { personalGetSubscription = oldGet })
-	getCalls := 0
-	personalGetSubscription = func(*personal.Client, context.Context, string) (*personal.Subscription, error) {
-		getCalls++
-		return &personal.Subscription{
-			SubscribeID: "oa-sub-task",
-			EventKey:    personal.EventOAApprovalTaskCreated,
-			RuleType:    "all",
-		}, nil
-	}
-
-	tests := []struct {
-		name string
-		set  func(*personalConsumeOptions)
-	}{
-		{name: "user", set: func(opts *personalConsumeOptions) { opts.UserID = "user-1" }},
-		{name: "open-dingtalk-id", set: func(opts *personalConsumeOptions) { opts.OpenDingTalkID = "open-user-1" }},
-		{name: "group", set: func(opts *personalConsumeOptions) { opts.GroupID = "cid-1" }},
-		{name: "query", set: func(opts *personalConsumeOptions) { opts.QueryCSV = "urgent" }},
-		{name: "filter-json", set: func(opts *personalConsumeOptions) { opts.FilterJSON = `{"field":"content","op":"eq","value":"urgent"}` }},
-	}
-	for _, explicitEventKey := range []bool{true, false} {
-		mode := "implicit-event-key"
-		if explicitEventKey {
-			mode = "explicit-event-key"
-		}
-		for _, test := range tests {
-			t.Run(mode+"/"+test.name, func(t *testing.T) {
-				opts := personalConsumeOptions{SubscribeID: "oa-sub-task"}
-				if explicitEventKey {
-					opts.EventKey = personal.EventOAApprovalTaskCreated
-				}
-				test.set(&opts)
-				before := getCalls
-				_, _, _, err := ensurePersonalSubscription(
-					context.Background(),
-					nil,
-					personal.Identity{},
-					opts,
-				)
-				if err == nil || !strings.Contains(err.Error(), "--"+test.name+" not supported for OA event") {
-					t.Fatalf("reused OA subscription %s error = %v", test.name, err)
-				}
-				if getCalls != before+1 {
-					t.Fatalf("subscription lookup calls = %d, want %d", getCalls, before+1)
-				}
-			})
-		}
-	}
-}
-
-func TestPersonalOAImplicitReuseRuntimeLooksUpEventBeforeValidation(t *testing.T) {
-	oldIdentity := personalResolveEventIdentity
-	oldGet := personalGetSubscription
-	t.Cleanup(func() {
-		personalResolveEventIdentity = oldIdentity
-		personalGetSubscription = oldGet
-	})
-	personalResolveEventIdentity = func(context.Context, string, string) (personal.Identity, error) {
-		return personal.Identity{
-			AccessToken:  "token",
-			LocalSubject: "subject",
-			ClientID:     "client",
-			SourceID:     "open",
-		}, nil
-	}
-	getCalls := 0
-	personalGetSubscription = func(*personal.Client, context.Context, string) (*personal.Subscription, error) {
-		getCalls++
-		return &personal.Subscription{
-			SubscribeID: "oa-sub-task",
-			EventKey:    personal.EventOAApprovalTaskCreated,
-			RuleType:    "all",
-		}, nil
-	}
-
-	cmd := newEventConsumeCommand()
-	cmd.SilenceUsage = true
-	cmd.SilenceErrors = true
-	cmd.SetOut(io.Discard)
-	cmd.SetErr(io.Discard)
-	cmd.SetArgs([]string{"--subscribe-id", "oa-sub-task", "--group", "cid-1"})
-	err := cmd.Execute()
-	if err == nil || !strings.Contains(err.Error(), "--group not supported for OA event "+personal.EventOAApprovalTaskCreated) {
-		t.Fatalf("implicit reused OA runtime error = %v", err)
-	}
-	if getCalls != 1 {
-		t.Fatalf("subscription lookup calls = %d, want 1", getCalls)
-	}
-}
-
-func TestPersonalIMReusedSubscriptionWithExistingOverridesRemainsSupported(t *testing.T) {
-	oldGet := personalGetSubscription
-	t.Cleanup(func() { personalGetSubscription = oldGet })
-	personalGetSubscription = func(*personal.Client, context.Context, string) (*personal.Subscription, error) {
-		return &personal.Subscription{
-			SubscribeID: "im-sub",
-			EventKey:    personal.EventSingleChat,
-			RuleType:    "singleChat",
-		}, nil
-	}
-
-	sub, eventKey, ruleType, err := ensurePersonalSubscription(
-		context.Background(),
-		nil,
-		personal.Identity{},
-		personalConsumeOptions{
-			SubscribeID: "im-sub",
-			EventKey:    personal.EventSingleChat,
-			UserID:      "user-1",
-			QueryCSV:    "urgent",
-			FilterJSON:  `{"field":"content","op":"eq","value":"urgent"}`,
-		},
-	)
-	if err != nil {
-		t.Fatalf("reused IM subscription error = %v", err)
-	}
-	if sub.SubscribeID != "im-sub" || eventKey != personal.EventSingleChat || ruleType != "singleChat" {
-		t.Fatalf("reused IM subscription = %#v, event=%q rule=%q", sub, eventKey, ruleType)
-	}
-}
-
-func TestPersonalOAStatusAndStopCommandWiring(t *testing.T) {
-	oldStatus := eventRunPersonalStatus
-	oldStop := eventRunPersonalStop
-	t.Cleanup(func() {
-		eventRunPersonalStatus = oldStatus
-		eventRunPersonalStop = oldStop
-	})
-
-	var statusOpts personalStatusOptions
-	eventRunPersonalStatus = func(_ *cobra.Command, opts personalStatusOptions) error {
-		statusOpts = opts
-		return nil
-	}
-	status := newEventStatusCommand()
-	status.SilenceUsage = true
-	status.SilenceErrors = true
-	status.SetOut(io.Discard)
-	status.SetErr(io.Discard)
-	status.SetArgs([]string{
-		"--event", personal.EventOAApprovalTaskCreated,
-		"--subscribe-id", "oa-sub-task",
-		"--status", "all",
-	})
-	if err := status.Execute(); err != nil {
-		t.Fatalf("OA event status error = %v", err)
-	}
-	if statusOpts.EventKey != personal.EventOAApprovalTaskCreated ||
-		statusOpts.SubscribeID != "oa-sub-task" ||
-		statusOpts.Status != "all" {
-		t.Fatalf("OA status options = %#v", statusOpts)
-	}
-
-	var stopOpts personalStopOptions
-	eventRunPersonalStop = func(_ *cobra.Command, opts personalStopOptions) error {
-		stopOpts = opts
-		return nil
-	}
-	root := &cobra.Command{Use: "dws", SilenceUsage: true, SilenceErrors: true}
-	root.SetOut(io.Discard)
-	root.SetErr(io.Discard)
-	root.PersistentFlags().Bool("yes", false, "")
-	event := &cobra.Command{Use: "event"}
-	event.AddCommand(newEventStopCommand())
-	root.AddCommand(event)
-	root.SetArgs([]string{"event", "stop", "oa-sub-task", "--yes"})
-	if err := root.Execute(); err != nil {
-		t.Fatalf("OA event stop error = %v", err)
-	}
-	if stopOpts.SubscribeID != "oa-sub-task" || stopOpts.All {
-		t.Fatalf("OA stop options = %#v", stopOpts)
-	}
-}
@@ -1,427 +0,0 @@
-// Copyright 2026 Alibaba Group
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package app
-
-import (
-	"context"
-	"errors"
-	"strings"
-	"testing"
-
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/event/bus"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/event/consume"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/event/personal"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/event/source"
-)
-
-func TestPersonalConsumeCleanupOwnershipRuntimeMatrix(t *testing.T) {
-	runErr := errors.New("runtime failed")
-	for _, foreground := range []bool{false, true} {
-		for _, selfCreated := range []bool{false, true} {
-			for _, ephemeral := range []bool{false, true} {
-				for _, failRuntime := range []bool{false, true} {
-					name := strings.Join([]string{
-						map[bool]string{false: "background", true: "foreground"}[foreground],
-						map[bool]string{false: "reused", true: "self-created"}[selfCreated],
-						map[bool]string{false: "persistent", true: "ephemeral"}[ephemeral],
-						map[bool]string{false: "success", true: "error"}[failRuntime],
-					}, "/")
-					t.Run(name, func(t *testing.T) {
-						restore := installPersonalManySeams(t)
-						t.Cleanup(restore)
-						t.Setenv("DWS_CONFIG_DIR", t.TempDir())
-
-						oldNewSource := personalNewStreamSource
-						oldBusRun := personalBusRun
-						oldConsumeRun := personalConsumeRun
-						t.Cleanup(func() {
-							personalNewStreamSource = oldNewSource
-							personalBusRun = oldBusRun
-							personalConsumeRun = oldConsumeRun
-						})
-
-						personalResolveEventIdentity = func(context.Context, string, string) (personal.Identity, error) {
-							return personal.Identity{
-								AccessToken:  "token",
-								ClientID:     "client",
-								SourceID:     "open",
-								LocalSubject: "subject",
-							}, nil
-						}
-						personalEnsureSubscription = func(
-							context.Context,
-							*personal.Client,
-							personal.Identity,
-							personalConsumeOptions,
-						) (*personal.Subscription, string, string, error) {
-							return &personal.Subscription{SubscribeID: "sub-one"}, personal.EventMention, "at", nil
-						}
-						personalValidateConsumeConfig = func(consume.Config) error { return nil }
-						personalValidateNoOutputConflict = func(consume.Config, string) error { return nil }
-						personalUpsertRunState = func(string, personal.RunState) error { return nil }
-
-						deleteCalls := 0
-						removeCalls := 0
-						personalDeleteSubscription = func(*personal.Client, context.Context, string) error {
-							deleteCalls++
-							return nil
-						}
-						personalRemoveRunStates = func(string, []string) error {
-							removeCalls++
-							return nil
-						}
-
-						personalNewStreamSource = func(context.Context, personalStreamSourceOptions) (*source.PersonalSource, error) {
-							return nil, nil
-						}
-						personalBusRun = func(context.Context, bus.Config) error {
-							if failRuntime {
-								return runErr
-							}
-							return nil
-						}
-						personalConsumeRun = func(context.Context, consume.Config) error {
-							if failRuntime {
-								return runErr
-							}
-							return nil
-						}
-
-						opts := personalConsumeOptions{
-							EventKey:       personal.EventMention,
-							Ephemeral:      ephemeral,
-							ControlBaseURL: "https://mcp.example.test/dws",
-							Common: commonConsumeOptions{
-								Foreground: foreground,
-							},
-						}
-						if !selfCreated {
-							opts.SubscribeID = "sub-one"
-						}
-
-						err := runPersonalEventConsumeSingle(newPersonalCoverageCommand(), opts)
-						if failRuntime {
-							if !errors.Is(err, runErr) {
-								t.Fatalf("runtime error = %v, want %v", err, runErr)
-							}
-						} else if err != nil {
-							t.Fatalf("consume error = %v", err)
-						}
-
-						wantCleanup := 0
-						if selfCreated || ephemeral {
-							wantCleanup = 1
-						}
-						if deleteCalls != wantCleanup || removeCalls != wantCleanup {
-							t.Fatalf(
-								"cleanup delete/remove = %d/%d, want %d/%d",
-								deleteCalls,
-								removeCalls,
-								wantCleanup,
-								wantCleanup,
-							)
-						}
-					})
-				}
-			}
-		}
-	}
-}
-
-func TestPersonalConsumeCleanupOwnershipOnRunStateFailure(t *testing.T) {
-	stateErr := errors.New("save state failed")
-	for _, test := range []struct {
-		name        string
-		selfCreated bool
-		ephemeral   bool
-		wantCleanup int
-	}{
-		{name: "self-created", selfCreated: true, wantCleanup: 1},
-		{name: "reused persistent", wantCleanup: 0},
-		{name: "reused ephemeral", ephemeral: true, wantCleanup: 1},
-	} {
-		t.Run(test.name, func(t *testing.T) {
-			restore := installPersonalManySeams(t)
-			t.Cleanup(restore)
-			t.Setenv("DWS_CONFIG_DIR", t.TempDir())
-
-			personalResolveEventIdentity = func(context.Context, string, string) (personal.Identity, error) {
-				return personal.Identity{AccessToken: "token", ClientID: "client", SourceID: "open"}, nil
-			}
-			personalEnsureSubscription = func(
-				context.Context,
-				*personal.Client,
-				personal.Identity,
-				personalConsumeOptions,
-			) (*personal.Subscription, string, string, error) {
-				return &personal.Subscription{SubscribeID: "sub-one"}, personal.EventMention, "at", nil
-			}
-			personalValidateConsumeConfig = func(consume.Config) error { return nil }
-			personalUpsertRunState = func(string, personal.RunState) error { return stateErr }
-			deleteCalls := 0
-			removeCalls := 0
-			personalDeleteSubscription = func(*personal.Client, context.Context, string) error {
-				deleteCalls++
-				return nil
-			}
-			personalRemoveRunStates = func(string, []string) error {
-				removeCalls++
-				return nil
-			}
-
-			opts := personalConsumeOptions{
-				EventKey:       personal.EventMention,
-				Ephemeral:      test.ephemeral,
-				ControlBaseURL: "https://mcp.example.test/dws",
-			}
-			if !test.selfCreated {
-				opts.SubscribeID = "sub-one"
-			}
-			if err := runPersonalEventConsumeSingle(newPersonalCoverageCommand(), opts); !errors.Is(err, stateErr) {
-				t.Fatalf("state error = %v, want %v", err, stateErr)
-			}
-			if deleteCalls != test.wantCleanup || removeCalls != test.wantCleanup {
-				t.Fatalf(
-					"cleanup delete/remove = %d/%d, want %d/%d",
-					deleteCalls,
-					removeCalls,
-					test.wantCleanup,
-					test.wantCleanup,
-				)
-			}
-		})
-	}
-}
-
-func TestPersonalReusedSubscriptionEventKeyResolution(t *testing.T) {
-	oldGet := personalGetSubscription
-	t.Cleanup(func() { personalGetSubscription = oldGet })
-
-	for _, test := range []struct {
-		name      string
-		requested string
-		actual    string
-		wantKey   string
-		wantErr   bool
-	}{
-		{
-			name:      "matching key uses actual",
-			requested: personal.EventMention,
-			actual:    personal.EventMention,
-			wantKey:   personal.EventMention,
-		},
-		{
-			name:    "implicit key uses actual",
-			actual:  personal.EventOAApprovalTaskCreated,
-			wantKey: personal.EventOAApprovalTaskCreated,
-		},
-		{
-			name:      "missing actual falls back to requested",
-			requested: personal.EventOAApprovalTaskCreated,
-			wantKey:   personal.EventOAApprovalTaskCreated,
-		},
-		{
-			name:      "requested IM mismatches actual OA",
-			requested: personal.EventMention,
-			actual:    personal.EventOAApprovalTaskCreated,
-			wantErr:   true,
-		},
-		{
-			name:      "requested OA mismatches actual IM",
-			requested: personal.EventOAApprovalTaskCreated,
-			actual:    personal.EventMention,
-			wantErr:   true,
-		},
-	} {
-		t.Run(test.name, func(t *testing.T) {
-			personalGetSubscription = func(*personal.Client, context.Context, string) (*personal.Subscription, error) {
-				return &personal.Subscription{
-					SubscribeID: "sub-one",
-					EventKey:    test.actual,
-				}, nil
-			}
-			_, eventKey, _, err := ensurePersonalSubscription(
-				context.Background(),
-				nil,
-				personal.Identity{},
-				personalConsumeOptions{SubscribeID: "sub-one", EventKey: test.requested},
-			)
-			if test.wantErr {
-				if err == nil || !strings.Contains(err.Error(), "does not match reused subscription") {
-					t.Fatalf("mismatch error = %v", err)
-				}
-				if !strings.Contains(err.Error(), test.requested) || !strings.Contains(err.Error(), test.actual) {
-					t.Fatalf("mismatch error does not identify both keys: %v", err)
-				}
-				return
-			}
-			if err != nil {
-				t.Fatalf("resolve reused subscription: %v", err)
-			}
-			if eventKey != test.wantKey {
-				t.Fatalf("resolved event key = %q, want %q", eventKey, test.wantKey)
-			}
-		})
-	}
-}
-
-func TestPersonalReusedSubscriptionMismatchStopsDryRunAndRuntime(t *testing.T) {
-	for _, mode := range []struct {
-		name       string
-		dryRun     bool
-		foreground bool
-	}{
-		{name: "dry-run", dryRun: true},
-		{name: "background"},
-		{name: "foreground", foreground: true},
-	} {
-		t.Run(mode.name, func(t *testing.T) {
-			restore := installPersonalManySeams(t)
-			t.Cleanup(restore)
-			t.Setenv("DWS_CONFIG_DIR", t.TempDir())
-
-			oldGet := personalGetSubscription
-			oldNewSource := personalNewStreamSource
-			oldBusRun := personalBusRun
-			oldConsumeRun := personalConsumeRun
-			t.Cleanup(func() {
-				personalGetSubscription = oldGet
-				personalNewStreamSource = oldNewSource
-				personalBusRun = oldBusRun
-				personalConsumeRun = oldConsumeRun
-			})
-
-			personalResolveEventIdentity = func(context.Context, string, string) (personal.Identity, error) {
-				return personal.Identity{AccessToken: "token", ClientID: "client", SourceID: "open"}, nil
-			}
-			personalEnsureSubscription = ensurePersonalSubscription
-			personalGetSubscription = func(*personal.Client, context.Context, string) (*personal.Subscription, error) {
-				return &personal.Subscription{
-					SubscribeID: "sub-one",
-					EventKey:    personal.EventOAApprovalTaskCreated,
-					RuleType:    "all",
-				}, nil
-			}
-			personalValidateConsumeConfig = func(consume.Config) error { return nil }
-			personalValidateNoOutputConflict = func(consume.Config, string) error { return nil }
-
-			upsertCalls := 0
-			consumeCalls := 0
-			busCalls := 0
-			personalUpsertRunState = func(string, personal.RunState) error {
-				upsertCalls++
-				return nil
-			}
-			personalNewStreamSource = func(context.Context, personalStreamSourceOptions) (*source.PersonalSource, error) {
-				return nil, nil
-			}
-			personalBusRun = func(context.Context, bus.Config) error {
-				busCalls++
-				return nil
-			}
-			personalConsumeRun = func(context.Context, consume.Config) error {
-				consumeCalls++
-				return nil
-			}
-
-			err := runPersonalEventConsumeSingle(newPersonalCoverageCommand(), personalConsumeOptions{
-				EventKey:       personal.EventMention,
-				SubscribeID:    "sub-one",
-				ControlBaseURL: "https://mcp.example.test/dws",
-				Common: commonConsumeOptions{
-					DryRun:     mode.dryRun,
-					Foreground: mode.foreground,
-				},
-			})
-			if err == nil || !strings.Contains(err.Error(), "does not match reused subscription") {
-				t.Fatalf("mismatch error = %v", err)
-			}
-			if upsertCalls != 0 || consumeCalls != 0 || busCalls != 0 {
-				t.Fatalf(
-					"mismatch reached upsert/consumer/bus = %d/%d/%d",
-					upsertCalls,
-					consumeCalls,
-					busCalls,
-				)
-			}
-		})
-	}
-}
-
-func TestPersonalReusedSubscriptionUsesActualKeyInDryRunAndRuntime(t *testing.T) {
-	for _, dryRun := range []bool{true, false} {
-		name := map[bool]string{false: "runtime", true: "dry-run"}[dryRun]
-		t.Run(name, func(t *testing.T) {
-			restore := installPersonalManySeams(t)
-			t.Cleanup(restore)
-			t.Setenv("DWS_CONFIG_DIR", t.TempDir())
-
-			oldGet := personalGetSubscription
-			oldConsumeRun := personalConsumeRun
-			t.Cleanup(func() {
-				personalGetSubscription = oldGet
-				personalConsumeRun = oldConsumeRun
-			})
-
-			personalResolveEventIdentity = func(context.Context, string, string) (personal.Identity, error) {
-				return personal.Identity{AccessToken: "token", ClientID: "client", SourceID: "open"}, nil
-			}
-			personalEnsureSubscription = ensurePersonalSubscription
-			personalGetSubscription = func(*personal.Client, context.Context, string) (*personal.Subscription, error) {
-				return &personal.Subscription{
-					SubscribeID: "sub-oa",
-					EventKey:    personal.EventOAApprovalInstanceFinished,
-					RuleType:    "all",
-				}, nil
-			}
-			personalValidateConsumeConfig = func(consume.Config) error { return nil }
-			personalValidateNoOutputConflict = func(consume.Config, string) error { return nil }
-			personalUpsertRunState = func(_ string, state personal.RunState) error {
-				if state.EventKey != personal.EventOAApprovalInstanceFinished {
-					t.Fatalf("run state event key = %q", state.EventKey)
-				}
-				return nil
-			}
-
-			var got consume.Config
-			personalConsumeRun = func(_ context.Context, cfg consume.Config) error {
-				got = cfg
-				return nil
-			}
-			if err := runPersonalEventConsumeSingle(newPersonalCoverageCommand(), personalConsumeOptions{
-				SubscribeID:    "sub-oa",
-				ControlBaseURL: "https://mcp.example.test/dws",
-				Common: commonConsumeOptions{
-					DryRun: dryRun,
-				},
-			}); err != nil {
-				t.Fatalf("reuse subscription: %v", err)
-			}
-			if got.EventKey != personal.EventOAApprovalInstanceFinished ||
-				len(got.EventTypes) != 1 || got.EventTypes[0] != personal.EventOAApprovalInstanceFinished ||
-				got.SubscribeID != "sub-oa" {
-				t.Fatalf("consume config = %#v", got)
-			}
-		})
-	}
-}
-
-func TestEventConsumeDryRunHelpDescribesReuseLookup(t *testing.T) {
-	usage := newEventConsumeCommand().Flags().Lookup("dry-run").Usage
-	for _, want := range []string{"不创建订阅", "不连接 bus", "复用 --subscribe-id", "只读查询控制面"} {
-		if !strings.Contains(usage, want) {
-			t.Fatalf("dry-run help %q missing %q", usage, want)
-		}
-	}
-}
@@ -1,396 +0,0 @@
-// Copyright 2026 Alibaba Group
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-
-package app
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"io/fs"
-	"log/slog"
-	"os"
-	"os/signal"
-	"path/filepath"
-	"runtime"
-	"strings"
-	"syscall"
-	"testing"
-	"time"
-
-	dwsevent "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/event"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/event/bus"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/event/busctl"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/event/consume"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/event/personal"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/event/runtimecred"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/event/transport"
-)
-
-const (
-	runtimeTokenDetachedChildEnv     = "DWS_EVENT_RUNTIME_TOKEN_E2E_CHILD"
-	runtimeTokenDetachedWorkDirEnv   = "DWS_EVENT_RUNTIME_TOKEN_E2E_WORKDIR"
-	runtimeTokenDetachedEndpointEnv  = "DWS_EVENT_RUNTIME_TOKEN_E2E_ENDPOINT"
-	runtimeTokenDetachedEvidenceEnv  = "DWS_EVENT_RUNTIME_TOKEN_E2E_EVIDENCE"
-	runtimeTokenDetachedCanaryA      = "dws-runtime-e2e-A-9f34c8d10b7e"
-	runtimeTokenDetachedCanaryB      = "dws-runtime-e2e-B-2ad761e5c490"
-	runtimeTokenDetachedClientID     = "runtime-e2e-client"
-	runtimeTokenDetachedIdentityHash = "90abcdef12345678"
-	runtimeTokenDetachedSourceID     = "runtime-e2e-source"
-)
-
-// runRuntimeTokenDetachedE2EChild is called at the very start of TestMain.
-// busctl.Spawn executes this test binary with production-style `event _bus`
-// arguments; the env marker lets the child run a real bus daemon before the Go
-// test runner attempts to parse those CLI arguments.
-func runRuntimeTokenDetachedE2EChild() (int, bool) {
-	if os.Getenv(runtimeTokenDetachedChildEnv) != "1" {
-		return 0, false
-	}
-	workDir := strings.TrimSpace(os.Getenv(runtimeTokenDetachedWorkDirEnv))
-	endpoint := strings.TrimSpace(os.Getenv(runtimeTokenDetachedEndpointEnv))
-	evidence := strings.TrimSpace(os.Getenv(runtimeTokenDetachedEvidenceEnv))
-	if workDir == "" || endpoint == "" || evidence == "" {
-		return 91, true
-	}
-
-	argvClean := !runtimeTokenDetachedContainsCanary(strings.Join(os.Args, "\x00"))
-	envClean := !runtimeTokenDetachedContainsCanary(strings.Join(os.Environ(), "\x00"))
-	if err := appendRuntimeTokenDetachedEvidence(evidence,
-		fmt.Sprintf("child_start argv_clean=%t env_clean=%t", argvClean, envClean)); err != nil {
-		return 92, true
-	}
-	if !argvClean || !envClean {
-		return 93, true
-	}
-
-	logFile, err := os.OpenFile(filepath.Join(workDir, "bus.log"), os.O_CREATE|os.O_APPEND|os.O_WRONLY, 0o600)
-	if err != nil {
-		return 94, true
-	}
-	defer logFile.Close()
-
-	broker := runtimecred.New(runtimecred.Config{RequireSeed: true, RequireActivation: true})
-	ctx, cancel := signal.NotifyContext(context.Background(), os.Interrupt, syscall.SIGTERM)
-	defer cancel()
-	err = bus.Run(ctx, bus.Config{
-		WorkDir:          workDir,
-		IPCEndpoint:      endpoint,
-		ClientID:         runtimeTokenDetachedClientID,
-		SourceKind:       dwsevent.SourceKindPersonalStream,
-		IdentityHash:     runtimeTokenDetachedIdentityHash,
-		SourceID:         runtimeTokenDetachedSourceID,
-		Edition:          "open",
-		SDKVersion:       "runtime-e2e",
-		Source:           &runtimeTokenDetachedSource{broker: broker, evidence: evidence},
-		CredentialBroker: broker,
-		ReadyPipe:        busctl.ReadyFDFromEnv(),
-		Logger:           slog.New(slog.NewTextHandler(logFile, nil)),
-	})
-	if err != nil && !errors.Is(err, context.Canceled) {
-		_ = appendRuntimeTokenDetachedEvidence(evidence, "bus_exit clean=false")
-		return 95, true
-	}
-	_ = appendRuntimeTokenDetachedEvidence(evidence, "bus_exit clean=true")
-	return 0, true
-}
-
-type runtimeTokenDetachedSource struct {
-	broker   *runtimecred.Broker
-	evidence string
-}
-
-// Start models the credential-sensitive part of a reconnecting Stream source
-// without network access. It resolves A for the first connection, waits until a
-// second consumer rotates the broker to B, then exercises the exact 401 path:
-// RefreshRejected(A) must return B and must not fall back to local OAuth.
-func (s *runtimeTokenDetachedSource) Start(ctx context.Context, _ dwsevent.EmitFn) error {
-	first, err := s.broker.Resolve(ctx)
-	if err != nil {
-		return errors.New("runtime e2e: initial credential unavailable")
-	}
-	if first != runtimeTokenDetachedCanaryA || s.broker.Generation() != 1 {
-		return errors.New("runtime e2e: initial credential mismatch")
-	}
-	if err := appendRuntimeTokenDetachedEvidence(s.evidence, "resolved_a=true generation=1"); err != nil {
-		return errors.New("runtime e2e: record initial connection")
-	}
-
-	ticker := time.NewTicker(5 * time.Millisecond)
-	defer ticker.Stop()
-	for s.broker.Generation() < 2 {
-		select {
-		case <-ctx.Done():
-			return ctx.Err()
-		case <-ticker.C:
-		}
-	}
-	rotated, err := s.broker.RefreshRejected(ctx, first)
-	if err != nil || rotated != runtimeTokenDetachedCanaryB {
-		return errors.New("runtime e2e: rotated credential unavailable")
-	}
-	if err := appendRuntimeTokenDetachedEvidence(s.evidence, "rejected_a=true resolved_b=true reconnect=true generation=2"); err != nil {
-		return errors.New("runtime e2e: record reconnect")
-	}
-	<-ctx.Done()
-	return ctx.Err()
-}
-
-func appendRuntimeTokenDetachedEvidence(path, line string) error {
-	f, err := os.OpenFile(path, os.O_CREATE|os.O_APPEND|os.O_WRONLY, 0o600)
-	if err != nil {
-		return err
-	}
-	defer f.Close()
-	_, err = fmt.Fprintln(f, line)
-	return err
-}
-
-func runtimeTokenDetachedContainsCanary(value string) bool {
-	return strings.Contains(value, runtimeTokenDetachedCanaryA) ||
-		strings.Contains(value, runtimeTokenDetachedCanaryB)
-}
-
-func TestCrossPlatformCoverageUnixDetachedRuntimeTokenLifecycleAndCanaryLeakScan(t *testing.T) {
-	if runtime.GOOS == "windows" {
-		t.Skip("real detached-process lifecycle is Unix-only; Windows named-pipe code is cross-compiled separately")
-	}
-
-	root, err := os.MkdirTemp("/tmp", "dws-runtime-token-e2e-")
-	if err != nil {
-		t.Fatal(err)
-	}
-	t.Cleanup(func() { _ = os.RemoveAll(root) })
-	workDir := filepath.Join(root, "events", "open", string(dwsevent.SourceKindPersonalStream), runtimeTokenDetachedIdentityHash)
-	if err := os.MkdirAll(workDir, 0o700); err != nil {
-		t.Fatal(err)
-	}
-	endpoint := dwsevent.IPCEndpoint(workDir, "open", dwsevent.SourceKindPersonalStream, runtimeTokenDetachedIdentityHash)
-	evidencePath := filepath.Join(workDir, "runtime-e2e.evidence")
-
-	identity := personal.Identity{
-		ClientID: runtimeTokenDetachedClientID,
-		SourceID: runtimeTokenDetachedSourceID,
-		CorpID:   "runtime-e2e-corp",
-		UserID:   "runtime-e2e-user",
-	}
-	spawnArgs := personalBusSpawnArgsForToken(identity, runtimeTokenDetachedIdentityHash, "", "", "corp:user", runtimeTokenDetachedCanaryA)
-	assertRuntimeTokenDetachedClean(t, "spawn argv", []byte(strings.Join(spawnArgs, "\x00")))
-
-	childEnv := append([]string{}, os.Environ()...)
-	childEnv = append(childEnv,
-		runtimeTokenDetachedChildEnv+"=1",
-		runtimeTokenDetachedWorkDirEnv+"="+workDir,
-		runtimeTokenDetachedEndpointEnv+"="+endpoint,
-		runtimeTokenDetachedEvidenceEnv+"="+evidencePath,
-	)
-	assertRuntimeTokenDetachedClean(t, "spawn environment", []byte(strings.Join(childEnv, "\x00")))
-
-	pid, err := busctl.Spawn(busctl.SpawnConfig{
-		ExecPath:  os.Args[0],
-		ClientID:  runtimeTokenDetachedClientID,
-		ExtraArgs: spawnArgs,
-		Env:       childEnv,
-	})
-	if err != nil {
-		failRuntimeTokenDetachedError(t, "spawn detached runtime bus", err)
-	}
-	stopped := false
-	t.Cleanup(func() {
-		if !stopped {
-			_ = busctl.Stop(busctl.StopConfig{WorkDir: workDir, Timeout: 2 * time.Second})
-			if proc, findErr := os.FindProcess(pid); findErr == nil {
-				_ = proc.Kill()
-			}
-		}
-	})
-
-	waitRuntimeTokenDetachedFile(t, evidencePath, "child_start argv_clean=true env_clean=true", 3*time.Second)
-
-	var stdoutA, stderrA bytes.Buffer
-	err = consume.Run(context.Background(), runtimeTokenDetachedConsumeConfig(
-		workDir, endpoint, "sub-runtime-a", runtimeTokenDetachedCanaryA, 500*time.Millisecond, &stdoutA, &stderrA,
-	))
-	if err != nil {
-		failRuntimeTokenDetachedError(t, "consume token A", err)
-	}
-	waitRuntimeTokenDetachedFile(t, evidencePath, "resolved_a=true generation=1", 3*time.Second)
-
-	if err := personal.UpsertRunState(workDir, personal.RunState{
-		SubscribeID:  "sub-runtime-b",
-		EventKey:     personal.EventMention,
-		ClientID:     runtimeTokenDetachedClientID,
-		SourceID:     runtimeTokenDetachedSourceID,
-		IdentityHash: runtimeTokenDetachedIdentityHash,
-	}); err != nil {
-		failRuntimeTokenDetachedError(t, "persist non-sensitive run state", err)
-	}
-
-	var stdoutB, stderrB bytes.Buffer
-	consumeDone := make(chan error, 1)
-	go func() {
-		consumeDone <- consume.Run(context.Background(), runtimeTokenDetachedConsumeConfig(
-			workDir, endpoint, "sub-runtime-b", runtimeTokenDetachedCanaryB, 5*time.Second, &stdoutB, &stderrB,
-		))
-	}()
-
-	status := waitRuntimeTokenDetachedStatus(t, endpoint, "sub-runtime-b", 3*time.Second)
-	if status.Bus.PID != pid || status.Bus.IdentityHash != runtimeTokenDetachedIdentityHash {
-		t.Fatalf("status bus identity = %#v, want pid=%d identity=%s", status.Bus, pid, runtimeTokenDetachedIdentityHash)
-	}
-	waitRuntimeTokenDetachedFile(t, evidencePath, "rejected_a=true resolved_b=true reconnect=true generation=2", 3*time.Second)
-
-	stopResp, err := busctl.StopConsumers(endpoint, []string{"sub-runtime-b"})
-	if err != nil {
-		failRuntimeTokenDetachedError(t, "targeted consumer stop", err)
-	}
-	if len(stopResp.Stopped) != 1 || stopResp.Stopped[0] != "sub-runtime-b" {
-		t.Fatalf("targeted stop response = %#v", stopResp)
-	}
-	select {
-	case err := <-consumeDone:
-		if err != nil {
-			failRuntimeTokenDetachedError(t, "consume token B after targeted stop", err)
-		}
-	case <-time.After(3 * time.Second):
-		t.Fatal("token B consumer did not exit after targeted stop")
-	}
-	status = waitRuntimeTokenDetachedStatus(t, endpoint, "", 3*time.Second)
-	if len(status.Consumers) != 0 {
-		t.Fatalf("status consumers after stop = %#v", status.Consumers)
-	}
-
-	if err := busctl.Stop(busctl.StopConfig{WorkDir: workDir, Timeout: 4 * time.Second}); err != nil {
-		failRuntimeTokenDetachedError(t, "stop detached bus", err)
-	}
-	stopped = true
-	waitRuntimeTokenDetachedFile(t, evidencePath, "bus_exit clean=true", 3*time.Second)
-
-	statusJSON, err := json.Marshal(status)
-	if err != nil {
-		t.Fatal(err)
-	}
-	stopJSON, err := json.Marshal(stopResp)
-	if err != nil {
-		t.Fatal(err)
-	}
-	for name, artifact := range map[string][]byte{
-		"consume A stdout": stdoutA.Bytes(),
-		"consume A stderr": stderrA.Bytes(),
-		"consume B stdout": stdoutB.Bytes(),
-		"consume B stderr": stderrB.Bytes(),
-		"status response":  statusJSON,
-		"stop response":    stopJSON,
-	} {
-		assertRuntimeTokenDetachedClean(t, name, artifact)
-	}
-	assertRuntimeTokenDetachedTreeClean(t, root)
-
-	for _, required := range []string{
-		filepath.Join(workDir, bus.MetaFileName),
-		filepath.Join(workDir, "bus.log"),
-		filepath.Join(workDir, personal.StateFileName),
-		evidencePath,
-	} {
-		if info, statErr := os.Stat(required); statErr != nil || !info.Mode().IsRegular() {
-			t.Fatalf("expected runtime artifact %s: info=%v err=%v", required, info, statErr)
-		}
-	}
-}
-
-func runtimeTokenDetachedConsumeConfig(workDir, endpoint, subscribeID, token string, duration time.Duration, stdout, stderr *bytes.Buffer) consume.Config {
-	return consume.Config{
-		WorkDir:          workDir,
-		IPCEndpoint:      endpoint,
-		ClientID:         runtimeTokenDetachedClientID,
-		RuntimeToken:     token,
-		EventTypes:       []string{personal.EventMention},
-		EventKey:         personal.EventMention,
-		SubscribeID:      subscribeID,
-		ReadySubscribeID: subscribeID,
-		Duration:         duration,
-		Format:           consume.FormatNDJSON,
-		Stdout:           stdout,
-		Stderr:           stderr,
-	}
-}
-
-func waitRuntimeTokenDetachedFile(t *testing.T, path, want string, timeout time.Duration) string {
-	t.Helper()
-	deadline := time.Now().Add(timeout)
-	for time.Now().Before(deadline) {
-		data, err := os.ReadFile(path)
-		if err == nil && strings.Contains(string(data), want) {
-			return string(data)
-		}
-		time.Sleep(10 * time.Millisecond)
-	}
-	data, err := os.ReadFile(path)
-	if runtimeTokenDetachedContainsCanary(string(data)) {
-		t.Fatalf("runtime credential leaked into child evidence while waiting for %q", want)
-	}
-	t.Fatalf("evidence %s missing %q: data=%q err=%v", path, want, data, err)
-	return ""
-}
-
-func waitRuntimeTokenDetachedStatus(t *testing.T, endpoint, subscribeID string, timeout time.Duration) *transport.StatusResp {
-	t.Helper()
-	deadline := time.Now().Add(timeout)
-	var lastErr error
-	for time.Now().Before(deadline) {
-		status, err := busctl.QueryStatus(endpoint)
-		if err == nil {
-			if subscribeID == "" && len(status.Consumers) == 0 {
-				return status
-			}
-			for _, consumer := range status.Consumers {
-				if consumer.SubscribeID == subscribeID {
-					return status
-				}
-			}
-		}
-		lastErr = err
-		time.Sleep(10 * time.Millisecond)
-	}
-	t.Fatalf("status never reached subscribe_id=%q: %v", subscribeID, lastErr)
-	return nil
-}
-
-func assertRuntimeTokenDetachedTreeClean(t *testing.T, root string) {
-	t.Helper()
-	err := filepath.WalkDir(root, func(path string, entry fs.DirEntry, walkErr error) error {
-		if walkErr != nil {
-			return walkErr
-		}
-		if entry.IsDir() || !entry.Type().IsRegular() {
-			return nil
-		}
-		data, err := os.ReadFile(path)
-		if err != nil {
-			return err
-		}
-		assertRuntimeTokenDetachedClean(t, path, data)
-		return nil
-	})
-	if err != nil {
-		t.Fatalf("scan runtime artifacts: %v", err)
-	}
-}
-
-func assertRuntimeTokenDetachedClean(t *testing.T, name string, artifact []byte) {
-	t.Helper()
-	if runtimeTokenDetachedContainsCanary(string(artifact)) {
-		t.Fatalf("runtime credential leaked into %s", name)
-	}
-}
-
-func failRuntimeTokenDetachedError(t *testing.T, step string, err error) {
-	t.Helper()
-	if err != nil && runtimeTokenDetachedContainsCanary(err.Error()) {
-		t.Fatalf("%s failed and exposed a runtime credential", step)
-	}
-	t.Fatalf("%s: %v", step, err)
-}
@@ -1,335 +0,0 @@
-// Copyright 2026 Alibaba Group
-// Licensed under the Apache License, Version 2.0 (the "License");
-
-package app
-
-import (
-	"context"
-	"errors"
-	"io"
-	"net/http"
-	"strings"
-	"testing"
-	"time"
-
-	authpkg "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/auth"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/event/consume"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/event/personal"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/event/runtimecred"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/edition"
-)
-
-func TestCrossPlatformCoverageRuntimeTokenBusRejectsIncompleteIdentity(t *testing.T) {
-	t.Setenv("DWS_CONFIG_DIR", t.TempDir())
-	for _, tc := range []struct {
-		name string
-		args []string
-		want string
-	}{
-		{
-			name: "invalid identity hash",
-			args: []string{"--source-kind", "personal_stream", "--runtime-token-mode", "--identity-hash", "not-a-hash", "--client-id", "client"},
-			want: "16-character hexadecimal identity hash",
-		},
-		{
-			name: "missing client id",
-			args: []string{"--source-kind", "personal_stream", "--runtime-token-mode", "--identity-hash", "0123456789abcdef"},
-			want: "--client-id is required",
-		},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			cmd := newEventBusCommand()
-			cmd.SetOut(io.Discard)
-			cmd.SetErr(io.Discard)
-			cmd.SetArgs(tc.args)
-			err := cmd.Execute()
-			if err == nil || !strings.Contains(err.Error(), tc.want) {
-				t.Fatalf("Execute() error = %v, want %q", err, tc.want)
-			}
-		})
-	}
-}
-
-type eventRuntimeTokenReleaseErrorStore struct {
-	err error
-}
-
-func (*eventRuntimeTokenReleaseErrorStore) Claim([]personal.AttemptSpec, time.Duration) (*personal.AttemptClaim, error) {
-	return nil, nil
-}
-
-func (*eventRuntimeTokenReleaseErrorStore) CompleteSuccess(*personal.AttemptClaim) error {
-	return nil
-}
-
-func (*eventRuntimeTokenReleaseErrorStore) CompleteFailure(*personal.AttemptClaim, []string, personal.AttemptFailure) (personal.AttemptHold, error) {
-	return personal.AttemptHold{}, nil
-}
-
-func (s *eventRuntimeTokenReleaseErrorStore) Release(*personal.AttemptClaim) error {
-	return s.err
-}
-
-func TestCrossPlatformCoverageRuntimeTokenAttemptReleaseGuardEdges(t *testing.T) {
-	var nilReservation *personalSubscriptionAttemptReservation
-	if err := nilReservation.releaseRuntimeTokenFailure(); !errors.Is(err, runtimecred.ErrRuntimeTokenRejected) {
-		t.Fatalf("nil reservation error = %v", err)
-	}
-
-	incomplete := &personalSubscriptionAttemptReservation{}
-	if err := incomplete.releaseRuntimeTokenFailure(); !errors.Is(err, runtimecred.ErrRuntimeTokenRejected) ||
-		!strings.Contains(err.Error(), "reservation is incomplete") {
-		t.Fatalf("incomplete reservation error = %v", err)
-	}
-
-	wantErr := errors.New("release failed")
-	reservation := &personalSubscriptionAttemptReservation{
-		store: &eventRuntimeTokenReleaseErrorStore{err: wantErr},
-		claim: &personal.AttemptClaim{AttemptID: "attempt"},
-	}
-	if err := reservation.releaseRuntimeTokenFailure(); !errors.Is(err, runtimecred.ErrRuntimeTokenRejected) ||
-		!errors.Is(err, wantErr) {
-		t.Fatalf("release failure error = %v", err)
-	}
-}
-
-func TestCrossPlatformCoverageRuntimeTokenConsumeRejectionAndOversizeEdges(t *testing.T) {
-	t.Setenv("DWS_CONFIG_DIR", t.TempDir())
-	oldEdition := edition.Get()
-	oldProfile := authpkg.RuntimeProfile()
-	oldLoadProfiles := personalLoadProfiles
-	oldValidate := personalValidateConsumeConfig
-	oldConflict := personalValidateNoOutputConflict
-	oldAttemptStore := personalNewSubscriptionAttemptStore
-	oldEnsure := personalEnsureSubscription
-	t.Cleanup(func() {
-		edition.Override(oldEdition)
-		authpkg.SetRuntimeProfile(oldProfile)
-		personalLoadProfiles = oldLoadProfiles
-		personalValidateConsumeConfig = oldValidate
-		personalValidateNoOutputConflict = oldConflict
-		personalNewSubscriptionAttemptStore = oldAttemptStore
-		personalEnsureSubscription = oldEnsure
-	})
-	edition.Override(&edition.Hooks{})
-	authpkg.SetRuntimeProfile("")
-	personalLoadProfiles = func(string) (*authpkg.ProfilesConfig, error) { return nil, nil }
-	personalValidateConsumeConfig = func(consume.Config) error { return nil }
-	personalValidateNoOutputConflict = func(consume.Config, string) error { return nil }
-
-	oversized := strings.Repeat("x", runtimecred.DefaultMaxTokenBytes+1)
-	err := runPersonalEventConsumeSingle(newPersonalCoverageCommand(), personalConsumeOptions{
-		EventKey:         personal.EventMention,
-		ExplicitToken:    oversized,
-		ClientIDOverride: "runtime-client",
-		Common:           commonConsumeOptions{Foreground: true},
-	})
-	if !errors.Is(err, runtimecred.ErrTokenTooLarge) {
-		t.Fatalf("oversized foreground token error = %v", err)
-	}
-
-	rejection := &personal.APIError{
-		Code:       "RUNTIME_TOKEN_REJECTED",
-		HTTPStatus: http.StatusUnauthorized,
-	}
-	if personalRuntimeTokenControlRejection(errors.New("ordinary failure")) {
-		t.Fatal("ordinary error classified as runtime-token rejection")
-	}
-
-	singleStore := &personalRecordingAttemptStore{}
-	personalNewSubscriptionAttemptStore = func(string) personalSubscriptionAttemptStore { return singleStore }
-	personalEnsureSubscription = func(context.Context, *personal.Client, personal.Identity, personalConsumeOptions) (*personal.Subscription, string, string, error) {
-		return nil, "", "", rejection
-	}
-	err = runPersonalEventConsumeSingle(newPersonalCoverageCommand(), personalConsumeOptions{
-		EventKey:         personal.EventMention,
-		ExplicitToken:    "runtime-token-single",
-		ClientIDOverride: "runtime-client",
-		ControlBaseURL:   "https://control.example.test",
-	})
-	if !errors.Is(err, runtimecred.ErrRuntimeTokenRejected) || singleStore.releaseCalls != 1 || singleStore.failureCalls != 0 {
-		t.Fatalf("single rejection = %v, release=%d failure=%d", err, singleStore.releaseCalls, singleStore.failureCalls)
-	}
-
-	manyStore := &personalRecordingAttemptStore{}
-	personalNewSubscriptionAttemptStore = func(string) personalSubscriptionAttemptStore { return manyStore }
-	err = runPersonalEventConsumeMany(newPersonalCoverageCommand(), personalConsumeOptions{
-		EventKeys:        []string{personal.EventMention, personal.EventAllSingleChat},
-		ExplicitToken:    "runtime-token-many",
-		ClientIDOverride: "runtime-client",
-		ControlBaseURL:   "https://control.example.test",
-	})
-	if !errors.Is(err, runtimecred.ErrRuntimeTokenRejected) || manyStore.releaseCalls != 1 || manyStore.failureCalls != 0 {
-		t.Fatalf("multi rejection = %v, release=%d failure=%d", err, manyStore.releaseCalls, manyStore.failureCalls)
-	}
-}
-
-func TestCrossPlatformCoverageRuntimeTokenIdentityFallbackEdges(t *testing.T) {
-	configDir := t.TempDir()
-	oldEdition := edition.Get()
-	oldProfile := authpkg.RuntimeProfile()
-	oldResolveIdentity := personalResolveEventIdentity
-	oldResolveAuxiliary := personalResolveAuxiliaryAccessToken
-	oldLoadTokenData := personalLoadTokenData
-	oldLoadProfiles := personalLoadProfiles
-	oldRuntimeClientID := personalRuntimeEventClientID
-	oldClientID := personalClientID
-	oldResolveCredentials := personalResolveAppCredentialsStrict
-	t.Cleanup(func() {
-		edition.Override(oldEdition)
-		authpkg.SetRuntimeProfile(oldProfile)
-		personalResolveEventIdentity = oldResolveIdentity
-		personalResolveAuxiliaryAccessToken = oldResolveAuxiliary
-		personalLoadTokenData = oldLoadTokenData
-		personalLoadProfiles = oldLoadProfiles
-		personalRuntimeEventClientID = oldRuntimeClientID
-		personalClientID = oldClientID
-		personalResolveAppCredentialsStrict = oldResolveCredentials
-	})
-
-	legacy := personal.Identity{ClientID: "legacy-client", SourceID: "legacy-source"}
-	personalResolveEventIdentity = func(context.Context, string, string) (personal.Identity, error) { return legacy, nil }
-	identity, err := resolvePersonalEventIdentityForToken(context.Background(), configDir, "", "  ")
-	if err != nil || identity.ClientID != legacy.ClientID {
-		t.Fatalf("wrapper empty-token fallback = %#v, %v", identity, err)
-	}
-	personalResolveAuxiliaryAccessToken = func(context.Context, string, string) (string, error) {
-		return "legacy-access", nil
-	}
-	personalLoadTokenData = func(string) (*authpkg.TokenData, error) {
-		return &authpkg.TokenData{
-			CorpID: "legacy-corp", UserID: "legacy-user", ClientID: "direct-client",
-		}, nil
-	}
-	identity, err = resolvePersonalEventIdentityWithToken(context.Background(), configDir, "", "  ")
-	if err != nil || identity.ClientID != "direct-client" {
-		t.Fatalf("direct empty-token fallback = %#v, %v", identity, err)
-	}
-
-	edition.Override(&edition.Hooks{})
-	personalRuntimeEventClientID = func() string { return "" }
-	personalClientID = func() string { return "" }
-	wantMetadataErr := errors.New("profiles unreadable")
-	personalLoadProfiles = func(string) (*authpkg.ProfilesConfig, error) { return nil, wantMetadataErr }
-	authpkg.SetRuntimeProfile("corp:user")
-	if _, err := resolvePersonalEventIdentityWithToken(context.Background(), configDir, "", "token", "runtime-client"); !errors.Is(err, wantMetadataErr) {
-		t.Fatalf("explicit profile metadata error = %v", err)
-	}
-
-	authpkg.SetRuntimeProfile("")
-	personalLoadProfiles = func(string) (*authpkg.ProfilesConfig, error) { return nil, nil }
-	personalResolveAppCredentialsStrict = func(string) (string, string, authpkg.CredentialSource, authpkg.CredentialSource, error) {
-		return "app-client", "", "", "", nil
-	}
-	identity, err = resolvePersonalEventIdentityWithToken(context.Background(), configDir, "", "runtime-token")
-	if err != nil || identity.ClientID != "app-client" || !strings.HasPrefix(identity.LocalSubject, "access:") {
-		t.Fatalf("app-credential fallback identity = %#v, %v", identity, err)
-	}
-
-	personalResolveAppCredentialsStrict = func(string) (string, string, authpkg.CredentialSource, authpkg.CredentialSource, error) {
-		return "", "", "", "", errors.New("missing app credentials")
-	}
-	if _, err := resolvePersonalEventIdentityWithToken(context.Background(), configDir, "", "runtime-token"); err == nil || !strings.Contains(err.Error(), "cannot resolve OAuth client_id") {
-		t.Fatalf("missing client ID error = %v", err)
-	}
-
-	personalLoadProfiles = func(string) (*authpkg.ProfilesConfig, error) {
-		return &authpkg.ProfilesConfig{
-			CurrentProfile: "stale",
-			Profiles:       []authpkg.Profile{{Name: "other", CorpID: "corp", UserID: "user"}},
-		}, nil
-	}
-	profile, err := personalEventProfileMetadata(configDir)
-	if err != nil || profile != nil {
-		t.Fatalf("stale implicit current profile = %#v, %v", profile, err)
-	}
-
-	personalLoadProfiles = func(string) (*authpkg.ProfilesConfig, error) {
-		return &authpkg.ProfilesConfig{Profiles: []authpkg.Profile{{Name: "other"}}}, nil
-	}
-	profile, err = personalEventProfileMetadata(configDir)
-	if err != nil || profile != nil {
-		t.Fatalf("empty implicit selector = %#v, %v", profile, err)
-	}
-
-	authpkg.SetRuntimeProfile("corp-a:user-a,corp-b:user-b")
-	personalLoadProfiles = func(string) (*authpkg.ProfilesConfig, error) { return nil, nil }
-	if _, err := personalEventProfileMetadata(configDir); err == nil || !strings.Contains(err.Error(), "exactly one --profile") {
-		t.Fatalf("multi-profile metadata error = %v", err)
-	}
-}
-
-type eventRuntimeTokenReadErrorBody struct{}
-
-func (eventRuntimeTokenReadErrorBody) Read([]byte) (int, error) {
-	return 0, errors.New("body read failed")
-}
-
-func (eventRuntimeTokenReadErrorBody) Close() error { return nil }
-
-func TestCrossPlatformCoverageRuntimeTokenControlTransportErrorEdges(t *testing.T) {
-	const token = "runtime-control-edge-canary"
-
-	unsupported, err := http.NewRequest(http.MethodGet, "unsupported://control.example.test/path", nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if _, err := (runtimeTokenControlTransport{}).RoundTrip(unsupported); err == nil {
-		t.Fatal("nil base unexpectedly accepted an unsupported protocol")
-	}
-
-	wantTransportErr := errors.New("ordinary transport failure")
-	ordinary := runtimeTokenControlTransport{base: eventRuntimeRoundTripFunc(func(*http.Request) (*http.Response, error) {
-		return nil, wantTransportErr
-	})}
-	if _, err := ordinary.RoundTrip(unsupported); !errors.Is(err, wantTransportErr) {
-		t.Fatalf("ordinary transport error = %v", err)
-	}
-
-	leaking := runtimeTokenControlTransport{
-		token: token,
-		base: eventRuntimeRoundTripFunc(func(*http.Request) (*http.Response, error) {
-			return nil, errors.New("reflected " + token)
-		}),
-	}
-	if _, err := leaking.RoundTrip(unsupported); err == nil || strings.Contains(err.Error(), token) ||
-		err.Error() != "personal event: runtime-token control request failed" {
-		t.Fatalf("redacted transport error = %v", err)
-	}
-
-	nilResponse := runtimeTokenControlTransport{base: eventRuntimeRoundTripFunc(func(*http.Request) (*http.Response, error) {
-		return nil, nil
-	})}
-	if resp, err := nilResponse.RoundTrip(unsupported); resp != nil || err != nil {
-		t.Fatalf("nil response = %#v, %v", resp, err)
-	}
-
-	readFailure := runtimeTokenControlTransport{base: eventRuntimeRoundTripFunc(func(req *http.Request) (*http.Response, error) {
-		return &http.Response{
-			StatusCode: http.StatusInternalServerError,
-			Header:     make(http.Header),
-			Body:       eventRuntimeTokenReadErrorBody{},
-			Request:    req,
-		}, nil
-	})}
-	if _, err := readFailure.RoundTrip(unsupported); err == nil || !strings.Contains(err.Error(), "read runtime-token control response") {
-		t.Fatalf("body read error = %v", err)
-	}
-
-	nilHeader := runtimeTokenControlTransport{base: eventRuntimeRoundTripFunc(func(req *http.Request) (*http.Response, error) {
-		return &http.Response{StatusCode: http.StatusOK, Request: req}, nil
-	})}
-	resp, err := nilHeader.RoundTrip(unsupported)
-	if err != nil || resp == nil || resp.Header == nil || resp.Header.Get("Content-Type") != "application/json" {
-		t.Fatalf("nil-header response = %#v, %v", resp, err)
-	}
-
-	if got := redactRuntimeTokenResponseBody(nil, token); len(got) != 0 {
-		t.Fatalf("empty response redaction = %q", got)
-	}
-	value, changed := redactRuntimeTokenJSONValue([]any{"plain", "prefix-" + token}, token)
-	items, ok := value.([]any)
-	if !ok || !changed || len(items) != 2 || strings.Contains(items[1].(string), token) {
-		t.Fatalf("array redaction = %#v changed=%t", value, changed)
-	}
-}
@@ -1,917 +0,0 @@
-// Copyright 2026 Alibaba Group
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-
-package app
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-	"errors"
-	"io"
-	"log/slog"
-	"net/http"
-	"net/http/httptest"
-	"strings"
-	"sync/atomic"
-	"testing"
-	"time"
-
-	authpkg "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/auth"
-	dwsevent "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/event"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/event/bus"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/event/consume"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/event/personal"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/event/runtimecred"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/event/source"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/edition"
-	"github.com/spf13/cobra"
-)
-
-func TestCrossPlatformCoverageEventCommandsWireTrimmedRootRuntimeToken(t *testing.T) {
-	oldConsume := eventRunPersonalConsume
-	oldStatus := eventRunPersonalStatus
-	oldStop := eventRunPersonalStop
-	t.Cleanup(func() {
-		eventRunPersonalConsume = oldConsume
-		eventRunPersonalStatus = oldStatus
-		eventRunPersonalStop = oldStop
-	})
-
-	flags := &GlobalFlags{Token: "  runtime-canary  ", ClientID: " root-client "}
-	assertIdentity := func(token, clientID string) {
-		t.Helper()
-		if token != "runtime-canary" || clientID != "root-client" {
-			t.Fatalf("runtime identity = token %q client %q", token, clientID)
-		}
-	}
-
-	eventRunPersonalConsume = func(_ *cobra.Command, opts personalConsumeOptions) error {
-		assertIdentity(opts.ExplicitToken, opts.ClientIDOverride)
-		return nil
-	}
-	consumeCmd := newEventConsumeCommand(flags)
-	if err := consumeCmd.RunE(consumeCmd, []string{personal.EventMention}); err != nil {
-		t.Fatalf("consume RunE() error = %v", err)
-	}
-
-	eventRunPersonalStatus = func(_ *cobra.Command, opts personalStatusOptions) error {
-		assertIdentity(opts.ExplicitToken, opts.ClientIDOverride)
-		return nil
-	}
-	statusCmd := newEventStatusCommandWithFlags(flags)
-	if err := statusCmd.RunE(statusCmd, nil); err != nil {
-		t.Fatalf("status RunE() error = %v", err)
-	}
-
-	eventRunPersonalStop = func(_ *cobra.Command, opts personalStopOptions) error {
-		assertIdentity(opts.ExplicitToken, opts.ClientIDOverride)
-		return nil
-	}
-	stopCmd := newEventStopCommandWithFlags(flags)
-	stopRoot := &cobra.Command{Use: "dws"}
-	stopRoot.PersistentFlags().Bool("yes", true, "")
-	stopRoot.AddCommand(stopCmd)
-	if err := stopCmd.RunE(stopCmd, []string{"sub-runtime"}); err != nil {
-		t.Fatalf("stop RunE() error = %v", err)
-	}
-
-	listenCmd := newEventListenIMCommand(flags)
-	if err := listenCmd.RunE(listenCmd, nil); err != nil {
-		t.Fatalf("listen-im RunE() error = %v", err)
-	}
-}
-
-func TestCrossPlatformCoverageEventConsumeParsesRootRuntimeTokenBeforeAndAfterSubcommand(t *testing.T) {
-	oldConsume := eventRunPersonalConsume
-	t.Cleanup(func() { eventRunPersonalConsume = oldConsume })
-	for _, tc := range []struct {
-		name string
-		args []string
-	}{
-		{name: "before", args: []string{"--token", "runtime-before", "event", "consume", personal.EventMention}},
-		{name: "after", args: []string{"event", "consume", personal.EventMention, "--token", "runtime-after"}},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			flags := &GlobalFlags{}
-			root := &cobra.Command{Use: "dws", SilenceErrors: true, SilenceUsage: true}
-			bindPersistentFlags(root, flags)
-			root.AddCommand(newEventCommand(flags))
-			var got string
-			eventRunPersonalConsume = func(_ *cobra.Command, opts personalConsumeOptions) error {
-				got = opts.ExplicitToken
-				return nil
-			}
-			root.SetArgs(tc.args)
-			if err := root.Execute(); err != nil {
-				t.Fatalf("Execute() error = %v", err)
-			}
-			want := "runtime-" + tc.name
-			if got != want {
-				t.Fatalf("ExplicitToken = %q, want %q", got, want)
-			}
-		})
-	}
-}
-
-func TestCrossPlatformCoverageResolvePersonalEventIdentityWithTokenUsesMetadataOnly(t *testing.T) {
-	oldEdition := edition.Get()
-	oldLoadProfiles := personalLoadProfiles
-	oldLoadToken := personalLoadTokenData
-	oldAux := personalResolveAuxiliaryAccessToken
-	oldClientID := personalClientID
-	oldCredentials := personalResolveAppCredentialsStrict
-	previousProfile := authpkg.RuntimeProfile()
-	t.Cleanup(func() {
-		edition.Override(oldEdition)
-		personalLoadProfiles = oldLoadProfiles
-		personalLoadTokenData = oldLoadToken
-		personalResolveAuxiliaryAccessToken = oldAux
-		personalClientID = oldClientID
-		personalResolveAppCredentialsStrict = oldCredentials
-		authpkg.SetRuntimeProfile(previousProfile)
-	})
-
-	personalLoadTokenData = func(string) (*authpkg.TokenData, error) {
-		t.Fatal("explicit token identity read sensitive TokenData")
-		return nil, nil
-	}
-	personalResolveAuxiliaryAccessToken = func(context.Context, string, string) (string, error) {
-		t.Fatal("explicit token identity resolved local OAuth")
-		return "", nil
-	}
-	personalClientID = func() string {
-		t.Fatal("explicit root client ID was not preferred")
-		return ""
-	}
-	personalResolveAppCredentialsStrict = func(string) (string, string, authpkg.CredentialSource, authpkg.CredentialSource, error) {
-		t.Fatal("explicit root client ID unexpectedly fell back to app credentials")
-		return "", "", "", "", nil
-	}
-	personalLoadProfiles = func(string) (*authpkg.ProfilesConfig, error) {
-		return &authpkg.ProfilesConfig{
-			Version: 2,
-			Profiles: []authpkg.Profile{{
-				Name:     "Runtime profile",
-				CorpID:   "profile-corp",
-				CorpName: "Runtime Org",
-				UserID:   "profile-user",
-				UserName: "Runtime User",
-				ClientID: "profile-client",
-			}},
-		}, nil
-	}
-	authpkg.SetRuntimeProfile("Runtime Org:Runtime User")
-	edition.Override(&edition.Hooks{RuntimeDefaults: func() map[string]edition.RuntimeDefaultFn {
-		return map[string]edition.RuntimeDefaultFn{
-			"$corpId":        func(context.Context) (string, bool) { return "runtime-corp", true },
-			"$currentUserId": func(context.Context) (string, bool) { return "", false },
-		}
-	}})
-
-	identity, err := resolvePersonalEventIdentityWithToken(
-		context.Background(), "unused", "runtime-source", " runtime-canary ", "root-client",
-	)
-	if err != nil {
-		t.Fatalf("resolvePersonalEventIdentityWithToken() error = %v", err)
-	}
-	if identity.CorpID != "runtime-corp" || identity.UserID != "profile-user" || identity.ClientID != "root-client" {
-		t.Fatalf("identity metadata = %#v", identity)
-	}
-	if identity.AccessToken != "" {
-		t.Fatalf("identity retained raw runtime token: %q", identity.AccessToken)
-	}
-	if identity.LocalSubject != "" {
-		t.Fatalf("complete identity LocalSubject = %q, want empty", identity.LocalSubject)
-	}
-}
-
-func TestCrossPlatformCoverageResolvePersonalEventIdentityWithCompleteRuntimeMetadataSkipsProfiles(t *testing.T) {
-	oldEdition := edition.Get()
-	oldLoadProfiles := personalLoadProfiles
-	oldRuntimeClientID := personalRuntimeEventClientID
-	t.Cleanup(func() {
-		edition.Override(oldEdition)
-		personalLoadProfiles = oldLoadProfiles
-		personalRuntimeEventClientID = oldRuntimeClientID
-	})
-	personalLoadProfiles = func(string) (*authpkg.ProfilesConfig, error) {
-		t.Fatal("complete host metadata unexpectedly read profiles.json")
-		return nil, nil
-	}
-	edition.Override(&edition.Hooks{RuntimeDefaults: func() map[string]edition.RuntimeDefaultFn {
-		return map[string]edition.RuntimeDefaultFn{
-			"$corpId":        func(context.Context) (string, bool) { return "runtime-corp", true },
-			"$currentUserId": func(context.Context) (string, bool) { return "runtime-user", true },
-		}
-	}})
-	personalRuntimeEventClientID = func() string { return "edition-client" }
-	identity, err := resolvePersonalEventIdentityWithToken(context.Background(), "unused", "source", "canary", "root-client")
-	if err != nil {
-		t.Fatalf("resolvePersonalEventIdentityWithToken() error = %v", err)
-	}
-	if identity.CorpID != "runtime-corp" || identity.UserID != "runtime-user" || identity.ClientID != "root-client" {
-		t.Fatalf("identity = %#v", identity)
-	}
-}
-
-func TestCrossPlatformCoverageRuntimeEventClientIDPrefersEditionBeforeEnvironment(t *testing.T) {
-	oldEdition := edition.Get()
-	t.Cleanup(func() { edition.Override(oldEdition) })
-	t.Setenv("DWS_CLIENT_ID", "environment-client")
-
-	edition.Override(&edition.Hooks{AuthClientID: "edition-client"})
-	if got := runtimePersonalEventClientID(); got != "edition-client" {
-		t.Fatalf("runtime client ID = %q, want edition hook", got)
-	}
-	edition.Override(&edition.Hooks{})
-	if got := runtimePersonalEventClientID(); got != "environment-client" {
-		t.Fatalf("runtime client ID = %q, want environment fallback", got)
-	}
-}
-
-func TestCrossPlatformCoverageCompleteRuntimeIdentityUsesEditionClientBeforeProfiles(t *testing.T) {
-	oldEdition := edition.Get()
-	oldLoadProfiles := personalLoadProfiles
-	oldRuntimeClientID := personalRuntimeEventClientID
-	t.Cleanup(func() {
-		edition.Override(oldEdition)
-		personalLoadProfiles = oldLoadProfiles
-		personalRuntimeEventClientID = oldRuntimeClientID
-	})
-	personalLoadProfiles = func(string) (*authpkg.ProfilesConfig, error) {
-		t.Fatal("complete host metadata unexpectedly read profiles.json")
-		return nil, errors.New("unreachable")
-	}
-	personalRuntimeEventClientID = func() string { return "edition-client" }
-	edition.Override(&edition.Hooks{RuntimeDefaults: func() map[string]edition.RuntimeDefaultFn {
-		return map[string]edition.RuntimeDefaultFn{
-			"$corpId":        func(context.Context) (string, bool) { return "runtime-corp", true },
-			"$currentUserId": func(context.Context) (string, bool) { return "runtime-user", true },
-		}
-	}})
-	identity, err := resolvePersonalEventIdentityWithToken(context.Background(), "unused", "source", "canary")
-	if err != nil {
-		t.Fatalf("resolvePersonalEventIdentityWithToken() error = %v", err)
-	}
-	if identity.CorpID != "runtime-corp" || identity.UserID != "runtime-user" || identity.ClientID != "edition-client" {
-		t.Fatalf("identity = %#v", identity)
-	}
-}
-
-func TestCrossPlatformCoverageSelectedProfileClientPrecedesPersistedGlobalClient(t *testing.T) {
-	oldEdition := edition.Get()
-	oldLoadProfiles := personalLoadProfiles
-	oldRuntimeClientID := personalRuntimeEventClientID
-	oldClientID := personalClientID
-	previousProfile := authpkg.RuntimeProfile()
-	t.Cleanup(func() {
-		edition.Override(oldEdition)
-		personalLoadProfiles = oldLoadProfiles
-		personalRuntimeEventClientID = oldRuntimeClientID
-		personalClientID = oldClientID
-		authpkg.SetRuntimeProfile(previousProfile)
-	})
-	edition.Override(&edition.Hooks{})
-	personalRuntimeEventClientID = func() string { return "" }
-	personalClientID = func() string { return "stale-global-client" }
-	personalLoadProfiles = func(string) (*authpkg.ProfilesConfig, error) {
-		return &authpkg.ProfilesConfig{
-			Version:        3,
-			CurrentProfile: "corp:user",
-			Profiles: []authpkg.Profile{{
-				Name: "Selected", CorpID: "corp", UserID: "user", ClientID: "profile-client",
-			}},
-		}, nil
-	}
-	authpkg.SetRuntimeProfile("corp:user")
-	identity, err := resolvePersonalEventIdentityWithToken(context.Background(), "unused", "source", "canary")
-	if err != nil {
-		t.Fatalf("resolvePersonalEventIdentityWithToken() error = %v", err)
-	}
-	if identity.ClientID != "profile-client" {
-		t.Fatalf("ClientID = %q, want selected profile client", identity.ClientID)
-	}
-}
-
-func TestCrossPlatformCoverageMalformedPersistedProfilesDoNotBlockRuntimeDefaultsAndGlobalClient(t *testing.T) {
-	oldEdition := edition.Get()
-	oldLoadProfiles := personalLoadProfiles
-	oldRuntimeClientID := personalRuntimeEventClientID
-	oldClientID := personalClientID
-	previousProfile := authpkg.RuntimeProfile()
-	t.Cleanup(func() {
-		edition.Override(oldEdition)
-		personalLoadProfiles = oldLoadProfiles
-		personalRuntimeEventClientID = oldRuntimeClientID
-		personalClientID = oldClientID
-		authpkg.SetRuntimeProfile(previousProfile)
-	})
-	authpkg.SetRuntimeProfile("")
-	personalRuntimeEventClientID = func() string { return "" }
-	personalClientID = func() string { return "global-client" }
-	personalLoadProfiles = func(string) (*authpkg.ProfilesConfig, error) {
-		return nil, errors.New("malformed persisted profiles")
-	}
-	edition.Override(&edition.Hooks{RuntimeDefaults: func() map[string]edition.RuntimeDefaultFn {
-		return map[string]edition.RuntimeDefaultFn{
-			"$corpId":        func(context.Context) (string, bool) { return "runtime-corp", true },
-			"$currentUserId": func(context.Context) (string, bool) { return "runtime-user", true },
-		}
-	}})
-
-	identity, err := resolvePersonalEventIdentityWithToken(context.Background(), "unused", "source", "canary")
-	if err != nil {
-		t.Fatalf("resolvePersonalEventIdentityWithToken() error = %v", err)
-	}
-	if identity.CorpID != "runtime-corp" || identity.UserID != "runtime-user" || identity.ClientID != "global-client" {
-		t.Fatalf("identity = %#v", identity)
-	}
-}
-
-func TestCrossPlatformCoverageResolvePersonalEventIdentityWithTokenRejectsMultipleProfilesBeforeMetadata(t *testing.T) {
-	oldEdition := edition.Get()
-	oldLoadProfiles := personalLoadProfiles
-	previousProfile := authpkg.RuntimeProfile()
-	t.Cleanup(func() {
-		edition.Override(oldEdition)
-		personalLoadProfiles = oldLoadProfiles
-		authpkg.SetRuntimeProfile(previousProfile)
-	})
-	personalLoadProfiles = func(string) (*authpkg.ProfilesConfig, error) {
-		t.Fatal("multiple runtime profiles unexpectedly reached metadata loading")
-		return nil, nil
-	}
-	authpkg.SetRuntimeProfile("corp-a:user-a,corp-b:user-b")
-	edition.Override(&edition.Hooks{RuntimeDefaults: func() map[string]edition.RuntimeDefaultFn {
-		return map[string]edition.RuntimeDefaultFn{
-			"$corpId":        func(context.Context) (string, bool) { return "runtime-corp", true },
-			"$currentUserId": func(context.Context) (string, bool) { return "runtime-user", true },
-		}
-	}})
-	_, err := resolvePersonalEventIdentityWithToken(context.Background(), "unused", "source", "canary", "root-client")
-	if err == nil || !strings.Contains(err.Error(), "exactly one --profile") {
-		t.Fatalf("multiple-profile error = %v", err)
-	}
-}
-
-func TestCrossPlatformCoverageExplicitProfileRequiresMetadataRegistry(t *testing.T) {
-	oldLoadProfiles := personalLoadProfiles
-	defer func() { personalLoadProfiles = oldLoadProfiles }()
-	oldProfile := authpkg.RuntimeProfile()
-	authpkg.SetRuntimeProfile("missing-profile")
-	defer authpkg.SetRuntimeProfile(oldProfile)
-
-	personalLoadProfiles = func(string) (*authpkg.ProfilesConfig, error) {
-		return &authpkg.ProfilesConfig{}, nil
-	}
-	_, err := personalEventProfileMetadata(t.TempDir())
-	if err == nil || !strings.Contains(err.Error(), `profile "missing-profile" not found`) {
-		t.Fatalf("personalEventProfileMetadata() error = %v", err)
-	}
-}
-
-func TestCrossPlatformCoverageCompleteRuntimeIdentityStillValidatesExplicitProfile(t *testing.T) {
-	oldEdition := edition.Get()
-	oldLoadProfiles := personalLoadProfiles
-	oldRuntimeClientID := personalRuntimeEventClientID
-	oldProfile := authpkg.RuntimeProfile()
-	t.Cleanup(func() {
-		edition.Override(oldEdition)
-		personalLoadProfiles = oldLoadProfiles
-		personalRuntimeEventClientID = oldRuntimeClientID
-		authpkg.SetRuntimeProfile(oldProfile)
-	})
-
-	authpkg.SetRuntimeProfile("missing-profile")
-	personalLoadProfiles = func(string) (*authpkg.ProfilesConfig, error) {
-		return &authpkg.ProfilesConfig{}, nil
-	}
-	personalRuntimeEventClientID = func() string { return "runtime-client" }
-	edition.Override(&edition.Hooks{RuntimeDefaults: func() map[string]edition.RuntimeDefaultFn {
-		return map[string]edition.RuntimeDefaultFn{
-			"$corpId":        func(context.Context) (string, bool) { return "runtime-corp", true },
-			"$currentUserId": func(context.Context) (string, bool) { return "runtime-user", true },
-		}
-	}})
-
-	_, err := resolvePersonalEventIdentityWithToken(context.Background(), t.TempDir(), "source", "canary")
-	if err == nil || !strings.Contains(err.Error(), `profile "missing-profile" not found`) {
-		t.Fatalf("resolvePersonalEventIdentityWithToken() error = %v", err)
-	}
-}
-
-func TestCrossPlatformCoveragePersonalProfileMetadataOrganizationCurrentBeatsUnresolved(t *testing.T) {
-	cfg := &authpkg.ProfilesConfig{
-		Version: 3,
-		Profiles: []authpkg.Profile{
-			{Name: "Historical", CorpID: "corp-1"},
-			{Name: "Exact", CorpID: "corp-1", UserID: "user-1"},
-		},
-		OrgCurrentProfiles: map[string]string{"corp-1": "corp-1:user-1"},
-	}
-	profile, err := selectPersonalEventProfileMetadata(cfg, "corp-1", make(map[string]struct{}))
-	if err != nil {
-		t.Fatalf("selectPersonalEventProfileMetadata() error = %v", err)
-	}
-	if profile == nil || profile.UserID != "user-1" {
-		t.Fatalf("selected profile = %#v, want organization current account", profile)
-	}
-}
-
-func TestCrossPlatformCoverageExplicitTokenControlClientRedactsReflected401(t *testing.T) {
-	const token = "runtime-control-canary"
-	oldLogger := slog.Default()
-	var logs bytes.Buffer
-	slog.SetDefault(slog.New(slog.NewTextHandler(&logs, &slog.HandlerOptions{Level: slog.LevelDebug})))
-	t.Cleanup(func() { slog.SetDefault(oldLogger) })
-
-	client := newPersonalEventControlClient("unused", "https://control.invalid", personal.Identity{
-		ClientID: "client", SourceID: "source",
-	}, token)
-	wrapped, ok := client.HTTPClient.Transport.(runtimeTokenControlTransport)
-	if !ok {
-		t.Fatalf("control transport = %T, want runtimeTokenControlTransport", client.HTTPClient.Transport)
-	}
-	var authorization string
-	wrapped.base = eventRuntimeRoundTripFunc(func(req *http.Request) (*http.Response, error) {
-		authorization = req.Header.Get("Authorization")
-		body := `{"code":"UNAUTHORIZED","message":"rejected ` + token + `"}`
-		header := make(http.Header)
-		header.Set("X-Request-Id", "request-"+token)
-		header.Set("X-Trace-Id", "trace-"+token)
-		return &http.Response{
-			StatusCode: http.StatusUnauthorized,
-			Header:     header,
-			Body:       io.NopCloser(strings.NewReader(body)),
-			Request:    req,
-		}, nil
-	})
-	client.HTTPClient.Transport = wrapped
-
-	_, err := client.ListSubscriptions(context.Background(), personal.ListOptions{})
-	if err == nil {
-		t.Fatal("ListSubscriptions() unexpectedly succeeded")
-	}
-	if authorization != "Bearer "+token {
-		t.Fatalf("Authorization = %q", authorization)
-	}
-	if strings.Contains(err.Error(), token) || strings.Contains(logs.String(), token) {
-		t.Fatalf("runtime token leaked: error=%q logs=%q", err, logs.String())
-	}
-	if !strings.Contains(err.Error(), "RUNTIME_TOKEN_REJECTED") {
-		t.Fatalf("error = %q, want fixed runtime token rejection", err)
-	}
-}
-
-func TestCrossPlatformCoverageRuntimeTokenRedirectGuardDoesNotForwardCustomHeader(t *testing.T) {
-	const token = "runtime-redirect-canary"
-	var controlTargetHits, ticketTargetHits atomic.Int32
-	controlTarget := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		controlTargetHits.Add(1)
-		if r.Header.Get("x-user-access-token") == token {
-			t.Error("control redirect forwarded runtime token")
-		}
-		w.WriteHeader(http.StatusNoContent)
-	}))
-	defer controlTarget.Close()
-	controlOrigin := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if r.Header.Get("x-user-access-token") != token {
-			t.Error("control origin did not receive runtime token")
-		}
-		http.Redirect(w, r, controlTarget.URL, http.StatusFound)
-	}))
-	defer controlOrigin.Close()
-
-	client := newPersonalEventControlClient("unused", controlOrigin.URL, personal.Identity{
-		ClientID: "client", SourceID: "source",
-	}, token)
-	_, controlErr := client.ListSubscriptions(context.Background(), personal.ListOptions{})
-	if controlErr == nil {
-		t.Fatal("cross-host control redirect unexpectedly succeeded")
-	}
-	if controlTargetHits.Load() != 0 || strings.Contains(controlErr.Error(), token) {
-		t.Fatalf("control redirect hits=%d error=%q", controlTargetHits.Load(), controlErr)
-	}
-
-	ticketTarget := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		ticketTargetHits.Add(1)
-		if r.Header.Get("x-user-access-token") == token {
-			t.Error("ticket redirect forwarded runtime token")
-		}
-		w.WriteHeader(http.StatusNoContent)
-	}))
-	defer ticketTarget.Close()
-	ticketOrigin := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if r.Header.Get("x-user-access-token") != token {
-			t.Error("ticket origin did not receive runtime token")
-		}
-		http.Redirect(w, r, ticketTarget.URL, http.StatusFound)
-	}))
-	defer ticketOrigin.Close()
-
-	broker := runtimecred.New(runtimecred.Config{RequireSeed: true})
-	if _, err := broker.Update(0, token); err != nil {
-		t.Fatal(err)
-	}
-	src, err := newPersonalStreamSource(context.Background(), personalStreamSourceOptions{
-		ConfigDir:        "unused",
-		Identity:         personal.Identity{ClientID: "client", SourceID: "source"},
-		TicketURL:        ticketOrigin.URL,
-		CredentialBroker: broker,
-		RuntimeTokenMode: true,
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-	err = src.Start(context.Background(), func(*dwsevent.RawEvent) {})
-	if err == nil {
-		t.Fatal("cross-host ticket redirect unexpectedly succeeded")
-	}
-	if ticketTargetHits.Load() != 0 || strings.Contains(err.Error(), token) {
-		t.Fatalf("ticket redirect hits=%d error=%q", ticketTargetHits.Load(), err)
-	}
-}
-
-func TestCrossPlatformCoverageRuntimeTokenRedirectPolicyBranches(t *testing.T) {
-	origin, _ := http.NewRequest(http.MethodGet, "https://control.example/start", nil)
-	sameHost, _ := http.NewRequest(http.MethodGet, "https://control.example/next", nil)
-	if err := runtimeTokenRedirectPolicy(sameHost, []*http.Request{origin}); err != nil {
-		t.Fatalf("same-host HTTPS redirect rejected: %v", err)
-	}
-	for name, request := range map[string]*http.Request{
-		"cross-host": func() *http.Request {
-			r, _ := http.NewRequest(http.MethodGet, "https://other.example/next", nil)
-			return r
-		}(),
-		"downgrade": func() *http.Request {
-			r, _ := http.NewRequest(http.MethodGet, "http://control.example/next", nil)
-			return r
-		}(),
-	} {
-		if err := runtimeTokenRedirectPolicy(request, []*http.Request{origin}); !errors.Is(err, http.ErrUseLastResponse) {
-			t.Fatalf("%s redirect policy error = %v", name, err)
-		}
-	}
-	if err := runtimeTokenRedirectPolicy(nil, nil); !errors.Is(err, http.ErrUseLastResponse) {
-		t.Fatalf("empty redirect chain error = %v", err)
-	}
-}
-
-func TestCrossPlatformCoverageExplicitTokenControlClientRedactsEveryErrorEnvelope(t *testing.T) {
-	const token = "runtime-control-all-status-canary"
-	tests := []struct {
-		name   string
-		status int
-		body   string
-	}{
-		{name: "bad-request", status: http.StatusBadRequest, body: `{"code":"BAD_REQUEST","message":"` + token + `"}`},
-		{name: "server-error", status: http.StatusInternalServerError, body: `{"code":"INTERNAL","message":"` + token + `"}`},
-		{name: "success-false", status: http.StatusOK, body: `{"success":false,"errorCode":"DENIED","errorMsg":"` + token + `"}`},
-	}
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			oldLogger := slog.Default()
-			var logs bytes.Buffer
-			slog.SetDefault(slog.New(slog.NewTextHandler(&logs, &slog.HandlerOptions{Level: slog.LevelDebug})))
-			t.Cleanup(func() { slog.SetDefault(oldLogger) })
-
-			client := newPersonalEventControlClient("unused", "https://control.invalid", personal.Identity{
-				ClientID: "client", SourceID: "source",
-			}, token)
-			wrapped := client.HTTPClient.Transport.(runtimeTokenControlTransport)
-			wrapped.base = eventRuntimeRoundTripFunc(func(req *http.Request) (*http.Response, error) {
-				header := make(http.Header)
-				header.Set("X-Request-Id", "request-"+token)
-				header.Set("X-Trace-Id", "trace-"+token)
-				return &http.Response{
-					StatusCode: tc.status,
-					Header:     header,
-					Body:       io.NopCloser(strings.NewReader(tc.body)),
-					Request:    req,
-				}, nil
-			})
-			client.HTTPClient.Transport = wrapped
-
-			_, err := client.ListSubscriptions(context.Background(), personal.ListOptions{})
-			if err == nil {
-				t.Fatal("ListSubscriptions() unexpectedly succeeded")
-			}
-			if strings.Contains(err.Error(), token) || strings.Contains(logs.String(), token) {
-				t.Fatalf("runtime token leaked: error=%q logs=%q", err, logs.String())
-			}
-		})
-	}
-}
-
-func TestCrossPlatformCoverageExplicitTokenControlTransportPreservesSuccessfulResponse(t *testing.T) {
-	client := newPersonalEventControlClient("unused", "https://control.invalid", personal.Identity{
-		ClientID: "client", SourceID: "source",
-	}, "runtime-success-canary")
-	wrapped := client.HTTPClient.Transport.(runtimeTokenControlTransport)
-	wrapped.base = eventRuntimeRoundTripFunc(func(req *http.Request) (*http.Response, error) {
-		return &http.Response{
-			StatusCode: http.StatusOK,
-			Header:     make(http.Header),
-			Body:       io.NopCloser(strings.NewReader(`{"success":true,"result":{"items":[],"total":0}}`)),
-			Request:    req,
-		}, nil
-	})
-	client.HTTPClient.Transport = wrapped
-	if _, err := client.ListSubscriptions(context.Background(), personal.ListOptions{}); err != nil {
-		t.Fatalf("ListSubscriptions() successful response error = %v", err)
-	}
-}
-
-func TestCrossPlatformCoverageExplicitTokenControlClientRedactsJSONEscapedToken(t *testing.T) {
-	const token = "runtime<escaped>&canary"
-	body, err := json.Marshal(map[string]any{"code": "BAD_REQUEST", "message": "rejected " + token})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if bytes.Contains(body, []byte(token)) {
-		t.Fatalf("fixture was not JSON-escaped: %s", body)
-	}
-	oldLogger := slog.Default()
-	var logs bytes.Buffer
-	slog.SetDefault(slog.New(slog.NewTextHandler(&logs, &slog.HandlerOptions{Level: slog.LevelDebug})))
-	t.Cleanup(func() { slog.SetDefault(oldLogger) })
-
-	client := newPersonalEventControlClient("unused", "https://control.invalid", personal.Identity{
-		ClientID: "client", SourceID: "source",
-	}, token)
-	wrapped := client.HTTPClient.Transport.(runtimeTokenControlTransport)
-	wrapped.base = eventRuntimeRoundTripFunc(func(req *http.Request) (*http.Response, error) {
-		return &http.Response{
-			StatusCode: http.StatusBadRequest,
-			Header:     make(http.Header),
-			Body:       io.NopCloser(bytes.NewReader(body)),
-			Request:    req,
-		}, nil
-	})
-	client.HTTPClient.Transport = wrapped
-	_, err = client.ListSubscriptions(context.Background(), personal.ListOptions{})
-	if err == nil {
-		t.Fatal("ListSubscriptions() unexpectedly succeeded")
-	}
-	if strings.Contains(err.Error(), token) || strings.Contains(logs.String(), token) {
-		t.Fatalf("escaped runtime token leaked: error=%q logs=%q", err, logs.String())
-	}
-}
-
-func TestCrossPlatformCoverageRuntimeTokenBusModeSkipsLocalOAuthIdentity(t *testing.T) {
-	t.Setenv("DWS_CONFIG_DIR", t.TempDir())
-	oldResolve := eventResolvePersonal
-	oldSource := eventNewPersonalSource
-	oldRun := eventBusRun
-	t.Cleanup(func() {
-		eventResolvePersonal = oldResolve
-		eventNewPersonalSource = oldSource
-		eventBusRun = oldRun
-	})
-
-	resolvedLocal := false
-	eventResolvePersonal = func(context.Context, string, string) (personal.Identity, error) {
-		resolvedLocal = true
-		return personal.Identity{}, nil
-	}
-	var sourceOpts personalStreamSourceOptions
-	eventNewPersonalSource = func(_ context.Context, opts personalStreamSourceOptions) (*source.PersonalSource, error) {
-		sourceOpts = opts
-		return nil, nil
-	}
-	var busCfg bus.Config
-	eventBusRun = func(_ context.Context, cfg bus.Config) error {
-		busCfg = cfg
-		return nil
-	}
-
-	cmd := newEventBusCommand()
-	cmd.SetArgs([]string{
-		"--source-kind", "personal_stream",
-		"--runtime-token-mode",
-		"--identity-hash", "0123456789abcdef",
-		"--client-id", "runtime-client",
-		"--stream-source-id", "runtime-source",
-		"--idle-timeout", "0",
-	})
-	if err := cmd.Execute(); err != nil {
-		t.Fatalf("event _bus runtime mode error = %v", err)
-	}
-	if resolvedLocal {
-		t.Fatal("runtime token bus resolved local OAuth identity")
-	}
-	if sourceOpts.CredentialBroker == nil || busCfg.CredentialBroker != sourceOpts.CredentialBroker {
-		t.Fatal("personal source and bus did not share one credential broker")
-	}
-	if busCfg.IdentityHash != "0123456789abcdef" || busCfg.ClientID != "runtime-client" || busCfg.SourceID != "runtime-source" {
-		t.Fatalf("bus identity = %#v", busCfg)
-	}
-	generation, err := sourceOpts.CredentialBroker.Update(0, "detached-activation-canary")
-	if err != nil {
-		t.Fatalf("seed detached broker: %v", err)
-	}
-	waitCtx, cancel := context.WithTimeout(context.Background(), 20*time.Millisecond)
-	defer cancel()
-	if _, err := sourceOpts.CredentialBroker.Resolve(waitCtx); !errors.Is(err, context.DeadlineExceeded) {
-		t.Fatalf("detached broker resolved before consumer activation: %v", err)
-	}
-	if _, err := sourceOpts.CredentialBroker.Activate(generation); err != nil {
-		t.Fatalf("activate detached broker: %v", err)
-	}
-	if resolved, err := sourceOpts.CredentialBroker.Resolve(context.Background()); err != nil || resolved == "" {
-		t.Fatalf("detached broker did not resolve after activation: %v", err)
-	}
-}
-
-func TestCrossPlatformCoverageForegroundRuntimeBrokerDoesNotRequireActivation(t *testing.T) {
-	broker := newPersonalCredentialBroker(t.TempDir(), true, false)
-	if _, err := broker.Update(0, "foreground-activation-canary"); err != nil {
-		t.Fatalf("seed foreground broker: %v", err)
-	}
-	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
-	defer cancel()
-	if resolved, err := broker.Resolve(ctx); err != nil || resolved == "" {
-		t.Fatalf("foreground broker unexpectedly waited for activation: %v", err)
-	}
-}
-
-func TestCrossPlatformCoveragePersonalRuntimeBusSpawnArgsContainNoSecretOrProfile(t *testing.T) {
-	const token = "runtime-spawn-canary"
-	args := personalBusSpawnArgsForToken(personal.Identity{
-		ClientID: "client", SourceID: "source", CorpID: "corp", UserID: "user",
-	}, "identity-hash", "normal", "https://ticket.invalid", "corp:user", token)
-	joined := strings.Join(args, " ")
-	for _, forbidden := range []string{token, "--profile", "corp:user"} {
-		if strings.Contains(joined, forbidden) {
-			t.Fatalf("spawn args leaked %q: %q", forbidden, joined)
-		}
-	}
-	for _, required := range []string{"--runtime-token-mode", "--identity-hash", "identity-hash", "--stream-source-id", "source"} {
-		if !strings.Contains(joined, required) {
-			t.Fatalf("spawn args %q missing %q", joined, required)
-		}
-	}
-}
-
-func TestCrossPlatformCoverageUnsupportedOldBusDoesNotDeleteReusedSubscription(t *testing.T) {
-	t.Setenv("DWS_CONFIG_DIR", t.TempDir())
-	oldEdition := edition.Get()
-	oldEnsure := personalEnsureSubscription
-	oldUpsert := personalUpsertRunState
-	oldDelete := personalDeleteSubscription
-	oldRemove := personalRemoveRunStates
-	oldConsume := personalConsumeRun
-	oldValidate := personalValidateConsumeConfig
-	oldConflict := personalValidateNoOutputConflict
-	t.Cleanup(func() {
-		edition.Override(oldEdition)
-		personalEnsureSubscription = oldEnsure
-		personalUpsertRunState = oldUpsert
-		personalDeleteSubscription = oldDelete
-		personalRemoveRunStates = oldRemove
-		personalConsumeRun = oldConsume
-		personalValidateConsumeConfig = oldValidate
-		personalValidateNoOutputConflict = oldConflict
-	})
-	edition.Override(&edition.Hooks{RuntimeDefaults: func() map[string]edition.RuntimeDefaultFn {
-		return map[string]edition.RuntimeDefaultFn{
-			"$corpId":        func(context.Context) (string, bool) { return "runtime-corp", true },
-			"$currentUserId": func(context.Context) (string, bool) { return "runtime-user", true },
-		}
-	}})
-	personalEnsureSubscription = func(context.Context, *personal.Client, personal.Identity, personalConsumeOptions) (*personal.Subscription, string, string, error) {
-		return &personal.Subscription{SubscribeID: "sub-existing"}, personal.EventMention, "at", nil
-	}
-	personalUpsertRunState = func(string, personal.RunState) error { return nil }
-	deleteCalls := 0
-	personalDeleteSubscription = func(*personal.Client, context.Context, string) error {
-		deleteCalls++
-		return nil
-	}
-	var removed []string
-	personalRemoveRunStates = func(_ string, ids []string) error {
-		removed = append(removed, ids...)
-		return nil
-	}
-	personalValidateConsumeConfig = func(consume.Config) error { return nil }
-	personalValidateNoOutputConflict = func(consume.Config, string) error { return nil }
-	personalConsumeRun = func(_ context.Context, cfg consume.Config) error {
-		if strings.TrimSpace(cfg.RuntimeToken) == "" {
-			t.Fatal("runtime token was not wired to consume")
-		}
-		return &consume.RuntimeTokenUnsupportedError{BusPID: 72}
-	}
-
-	err := runPersonalEventConsumeSingle(newPersonalCoverageCommand(), personalConsumeOptions{
-		SubscribeID:      "sub-existing",
-		ExplicitToken:    "old-bus-cleanup-canary",
-		ClientIDOverride: "runtime-client",
-	})
-	if !errors.Is(err, consume.ErrRuntimeTokenUnsupported) {
-		t.Fatalf("consume error = %v", err)
-	}
-	if deleteCalls != 0 {
-		t.Fatalf("reused remote subscription was deleted %d time(s)", deleteCalls)
-	}
-	if len(removed) != 0 {
-		t.Fatalf("reused local run-state was removed: %#v", removed)
-	}
-}
-
-func TestCrossPlatformCoverageRuntimeTokenReusedDryRunUsesExplicitControlCredential(t *testing.T) {
-	const token = "runtime-dry-run-control-canary"
-	t.Setenv("DWS_CONFIG_DIR", t.TempDir())
-	oldEdition := edition.Get()
-	oldEnsure := personalEnsureSubscription
-	oldUpsert := personalUpsertRunState
-	oldConsume := personalConsumeRun
-	oldBusRun := personalBusRun
-	t.Cleanup(func() {
-		edition.Override(oldEdition)
-		personalEnsureSubscription = oldEnsure
-		personalUpsertRunState = oldUpsert
-		personalConsumeRun = oldConsume
-		personalBusRun = oldBusRun
-	})
-	edition.Override(&edition.Hooks{RuntimeDefaults: func() map[string]edition.RuntimeDefaultFn {
-		return map[string]edition.RuntimeDefaultFn{
-			"$corpId":        func(context.Context) (string, bool) { return "runtime-corp", true },
-			"$currentUserId": func(context.Context) (string, bool) { return "runtime-user", true },
-		}
-	}})
-
-	personalEnsureSubscription = func(ctx context.Context, client *personal.Client, _ personal.Identity, _ personalConsumeOptions) (*personal.Subscription, string, string, error) {
-		if _, ok := client.HTTPClient.Transport.(runtimeTokenControlTransport); !ok {
-			t.Fatalf("control transport = %T, want runtimeTokenControlTransport", client.HTTPClient.Transport)
-		}
-		got, err := client.AccessTokenProvider(ctx)
-		if err != nil || got != token {
-			t.Fatalf("control token = %q, %v", got, err)
-		}
-		return &personal.Subscription{SubscribeID: "sub-existing"}, personal.EventMention, "at", nil
-	}
-	personalUpsertRunState = func(string, personal.RunState) error {
-		t.Fatal("dry-run unexpectedly persisted run state")
-		return nil
-	}
-	consumeCalls := 0
-	personalConsumeRun = func(_ context.Context, cfg consume.Config) error {
-		consumeCalls++
-		if !cfg.DryRun {
-			t.Fatal("consume config is not dry-run")
-		}
-		if strings.Contains(strings.Join(cfg.SpawnExtraArgs, " "), token) {
-			t.Fatal("dry-run spawn args leaked runtime token")
-		}
-		return nil
-	}
-	personalBusRun = func(context.Context, bus.Config) error {
-		t.Fatal("dry-run unexpectedly started a bus")
-		return nil
-	}
-
-	err := runPersonalEventConsumeSingle(newPersonalCoverageCommand(), personalConsumeOptions{
-		SubscribeID:      "sub-existing",
-		ExplicitToken:    token,
-		ClientIDOverride: "runtime-client",
-		Common:           commonConsumeOptions{DryRun: true},
-	})
-	if err != nil {
-		t.Fatalf("dry-run consume error = %v", err)
-	}
-	if consumeCalls != 1 {
-		t.Fatalf("dry-run consume calls = %d, want 1", consumeCalls)
-	}
-}
-
-func TestCrossPlatformCoverageRuntimeTokenControlRejectionReleasesSubscriptionClaim(t *testing.T) {
-	store := &personalRecordingAttemptStore{}
-	reservation := &personalSubscriptionAttemptReservation{
-		store: store,
-		claim: &personal.AttemptClaim{AttemptID: "runtime-token-attempt"},
-		items: []personalSubscriptionAttemptItem{{eventKey: personal.EventMention, fingerprint: strings.Repeat("a", 64)}},
-	}
-	cause := &personal.APIError{
-		Code:       "RUNTIME_TOKEN_REJECTED",
-		Message:    "event runtime token was rejected; retry with a fresh host credential",
-		HTTPStatus: http.StatusUnauthorized,
-	}
-	if !personalRuntimeTokenControlRejection(cause) {
-		t.Fatal("runtime token control rejection was not classified")
-	}
-	err := reservation.releaseRuntimeTokenFailure()
-	if err == nil || !strings.Contains(err.Error(), "runtime token was rejected") {
-		t.Fatalf("releaseRuntimeTokenFailure() error = %v", err)
-	}
-	if store.releaseCalls != 1 || store.failureCalls != 0 {
-		t.Fatalf("attempt store release=%d failure=%d, want release only", store.releaseCalls, store.failureCalls)
-	}
-}
-
-type eventRuntimeRoundTripFunc func(*http.Request) (*http.Response, error)
-
-func (f eventRuntimeRoundTripFunc) RoundTrip(req *http.Request) (*http.Response, error) {
-	return f(req)
-}
@@ -1,74 +0,0 @@
-// Copyright 2026 Alibaba Group
-// Licensed under the Apache License, Version 2.0 (the "License");
-
-package app
-
-import (
-	"strings"
-	"testing"
-
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/cli"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/corecmd/contract"
-)
-
-func TestCrossPlatformCoverageEventAgentSelectionBoundaries(t *testing.T) {
-	_ = NewRootCommand()
-
-	eventProduct, ok := contract.LookupProductDecl("event")
-	if !ok {
-		t.Fatal("event ProductDecl is not registered")
-	}
-	assertSelectionContains(t, "event product", eventProduct.Selection.AgentSummary,
-		[]string{"IM", "OA"})
-	assertSelectionContains(t, "event product use_when", strings.Join(eventProduct.Selection.UseWhen, "\n"),
-		[]string{"消息", "群生命周期", "OA"})
-	assertSelectionContains(t, "event product avoid_when", strings.Join(eventProduct.Selection.AvoidWhen, "\n"),
-		[]string{"chat", "oa", "dev app event"})
-
-	listenMeta, ok := cli.ResolveMeta("event +listen-im")
-	if !ok {
-		t.Fatal("event +listen-im metadata is not registered")
-	}
-	assertSelectionContains(t, "event.listen_im use_when", strings.Join(listenMeta.Selection.UseWhen, "\n"),
-		[]string{"@我", "message/reaction/read/recall"})
-	assertSelectionContains(t, "event.listen_im avoid_when", strings.Join(listenMeta.Selection.AvoidWhen, "\n"),
-		[]string{"OA 审批事件", "群标题", "Filter DSL", "event consume", "历史消息"})
-
-	consumeMeta, ok := cli.ResolveMeta("event consume")
-	if !ok {
-		t.Fatal("event consume metadata is not registered")
-	}
-	consumeUse := strings.Join(consumeMeta.Selection.UseWhen, "\n")
-	assertSelectionContains(t, "event.consume use_when", consumeUse,
-		[]string{"OA", "群", "EventKey", "Filter DSL", "subscribe_id", "transport envelope", "高级多事件"})
-	consumeAvoid := strings.Join(consumeMeta.Selection.AvoidWhen, "\n")
-	assertSelectionContains(t, "event.consume avoid_when", consumeAvoid,
-		[]string{"event +listen-im", "历史聊天", "oa", "dev app event"})
-
-	schemaMeta, ok := cli.ResolveMeta("event schema")
-	if !ok {
-		t.Fatal("event schema metadata is not registered")
-	}
-	assertSelectionContains(t, "event.schema use_when", strings.Join(schemaMeta.Selection.UseWhen, "\n"),
-		[]string{"IM", "OA", "--flatten"})
-
-	for productID, want := range map[string]string{
-		"chat": "event +listen-im",
-		"oa":   "event consume",
-	} {
-		decl, found := contract.LookupProductDecl(productID)
-		if !found {
-			t.Fatalf("%s ProductDecl is not registered", productID)
-		}
-		assertSelectionContains(t, productID+" avoid_when", strings.Join(decl.Selection.AvoidWhen, "\n"), []string{want})
-	}
-}
-
-func assertSelectionContains(t *testing.T, label, text string, fragments []string) {
-	t.Helper()
-	for _, fragment := range fragments {
-		if !strings.Contains(text, fragment) {
-			t.Errorf("%s = %q, want fragment %q", label, text, fragment)
-		}
-	}
-}
@@ -39,7 +39,7 @@ func (c *paramAliasCaptureCaller) CallTool(_ context.Context, server, tool strin
 		copyArgs[key] = value
 	}
 	c.calls = append(c.calls, paramAliasToolCall{server: server, tool: tool, args: copyArgs})
-	text := c.paramAliasResponseForTool(tool)
+	text := paramAliasResponseForTool(tool)
 	return &edition.ToolResult{Content: []edition.ContentBlock{{Type: "text", Text: text}}}, nil
 }

@@ -48,7 +48,7 @@ func (c *paramAliasCaptureCaller) CallTool(_ context.Context, server, tool strin
 // print the transport result and need an empty object; smart shortcuts that
 // inspect a read response receive the smallest shape that lets their full RunE
 // complete without falling back to a validation error.
-func (c *paramAliasCaptureCaller) paramAliasResponseForTool(tool string) string {
+func paramAliasResponseForTool(tool string) string {
 	switch tool {
 	case "list_calendar_events":
 		return `{"result":{"events":[]}}`
@@ -62,22 +62,9 @@ func (c *paramAliasCaptureCaller) paramAliasResponseForTool(tool string) string
 		return `{"result":[{"name":"Fixture User","userId":"fixture-user","openDingTalkId":"D-fixture-user"}]}`
 	case "list_doc_versions":
 		return `{"result":{"items":[{"version":3}]}}`
-	case "revert_doc_version":
-		return `{"version":3}`
 	case "search_doc_templates":
 		return `{"result":[{"templateId":"fixture-template-id"}]}`
-	case "create_document":
-		return `{"nodeId":"fixture-node"}`
 	case "get_document_content":
-		for index := len(c.calls) - 2; index >= 0; index-- {
-			call := c.calls[index]
-			for _, key := range []string{"jsonml", "markdown"} {
-				if content, ok := call.args[key].(string); ok {
-					encoded, _ := json.Marshal(map[string]any{"revision": 1, key: content})
-					return string(encoded)
-				}
-			}
-		}
 		return `{"revision":1}`
 	default:
 		return `{}`
@@ -123,7 +123,7 @@ var paramAliasCompleteCommands = map[string][]string{
 	"doc +version-list":                        {"doc", "+version-list", "--node", "node-1", "--limit", "7", "--cursor", "cursor-1"},
 	"doc +version-revert":                      {"doc", "+version-revert", "--node", "node-1", "--version", "3", "--yes"},
 	"doc +version-save":                        {"doc", "+version-save", "--node", "node-1", "--yes"},
-	"doc +update":                              {"doc", "+update", "--node", "node-1", "--command", "overwrite", "--content", `["root",{}]`, "--doc-format", "jsonml", "--expected-revision", "1", "--yes"},
+	"doc +update":                              {"doc", "+update", "--node", "node-1", "--command", "append", "--content", "fixture body", "--expected-revision", "1", "--yes"},
 	"doc block insert":                         {"doc", "block", "insert", "--node", "node-1", "--text", "fixture paragraph", "--yes"},
 	"doc block update":                         {"doc", "block", "update", "--node", "node-1", "--block-id", "block-1", "--text", "fixture paragraph", "--yes"},
 	"doc comment create":                       {"doc", "comment", "create", "--node", "node-1", "--content", "fixture comment", "--yes"},
@@ -472,7 +472,7 @@ func newRootCommandWithEngine(rootCtx context.Context, engine *pipeline.Engine,
 		newConfigCommand(),
 		newDoctorCommand(),
 		newRecoveryCommand(),
-		newEventCommand(flags),
+		newEventCommand(),
 		newAuditCommand(),
 		newCompletionCommand(root),
 		newUpgradeCommand(),
@@ -589,13 +589,29 @@ func (r *runtimeRunner) executeInvocation(ctx context.Context, endpoint string,
 	// Mock mode: return predefined mock response without network call.
 	if r.globalFlags != nil && r.globalFlags.Mock {
 		invocation.Implemented = true
+		result := any([]any{})
+		if invocation.CanonicalProduct == "devapp" {
+			collectionKey := map[string]string{
+				"list_dev_app":             "apps",
+				"list_dev_app_permissions": "items",
+				"list_dev_app_events":      "events",
+				"list_dev_app_versions":    "items",
+			}[invocation.Tool]
+			if collectionKey != "" {
+				result = map[string]any{
+					collectionKey: []any{},
+					"hasMore":     false,
+					"nextCursor":  "",
+				}
+			}
+		}
 		return executor.Result{
 			Invocation: invocation,
 			Response: map[string]any{
 				"endpoint": transport.RedactURL(endpoint),
 				"content": map[string]any{
 					"success": true,
-					"result":  []any{},
+					"result":  result,
 					"_mock":   true,
 					"_tool":   invocation.Tool,
 				},
@@ -296,14 +296,7 @@ func newAgentExampleFiles(t testing.TB, root string) agentExampleFiles {
 			t.Fatalf("write dry-run fixture %s: %v", path, err)
 		}
 	}
-	return agentExampleFiles{
-		root:     root,
-		markdown: "./" + filepath.Base(markdown),
-		json:     "./" + filepath.Base(jsonFile),
-		batch:    "./" + filepath.Base(batch),
-		binary:   "./" + filepath.Base(binary),
-		image:    "./" + filepath.Base(image),
-	}
+	return agentExampleFiles{root: root, markdown: markdown, json: jsonFile, batch: batch, binary: binary, image: image}
 }

 func materializeAgentExampleArgv(argv []string, files agentExampleFiles) []string {
@@ -26,14 +26,6 @@ func TestReviewedMutationSafetyReachesFinalSchema(t *testing.T) {
 	wants := []finalSchemaSafetyWant{
 		{canonical: "aitable.form_field_hide", effect: "write", risk: "medium", confirmation: "not_required", idempotency: "idempotent", provenance: declared},
 		{canonical: "chat.dismiss_group", effect: "destructive", risk: "high", confirmation: "user_required", idempotency: "unknown", provenance: declared},
-		// Card update intentionally layers confirmation: the atomic typed command
-		// preserves its original contract, while the Agent-facing shortcut owns
-		// the outer confirmation boundary.
-		{canonical: "chat.update_streaming_card", effect: "write", risk: "medium", confirmation: "not_required", idempotency: "unknown", provenance: declared},
-		{canonical: "chat.shortcut_messages_send", effect: "write", risk: "medium", confirmation: "user_required", idempotency: "unknown", provenance: declared},
-		{canonical: "chat.shortcut_messages_send_by_webhook", effect: "write", risk: "medium", confirmation: "user_required", idempotency: "unknown", provenance: declared},
-		{canonical: "chat.shortcut_messages_send_card", effect: "write", risk: "medium", confirmation: "user_required", idempotency: "unknown", provenance: declared},
-		{canonical: "chat.shortcut_messages_update_card", effect: "write", risk: "medium", confirmation: "user_required", idempotency: "unknown", provenance: declared},
 		{canonical: "drive.recycle_restore", effect: "write", risk: "medium", confirmation: "not_required", idempotency: "unknown", provenance: declared},
 		{canonical: "minutes.create_speaker_summary", effect: "write", risk: "medium", confirmation: "not_required", idempotency: "unknown", provenance: declared},
 		{canonical: "sheet.clear_range", effect: "write", risk: "medium", confirmation: "user_required", idempotency: "unknown", provenance: declared},
@@ -129,75 +129,6 @@ func TestDeliveryShortcutProgressiveQueriesReturnCompleteContracts(t *testing.T)
 	}
 }

-func TestDeliveryDocUpdateShortcutPublishesCompleteConditionalContract(t *testing.T) {
-	leaf := executeShortcutSchemaQuery(t, "--cli-path", "doc +update")
-	if got, want := schemaContractString(leaf["confirmation"]), "user_required"; got != want {
-		t.Fatalf("confirmation = %q, want %q", got, want)
-	}
-	parameters := schemaContractMap(leaf["parameters"])
-	if got, want := len(parameters), 11; got != want {
-		t.Fatalf("parameter count = %d, want %d: %#v", got, want, parameters)
-	}
-	if required, _ := parameters["node"]["required"].(bool); !required {
-		t.Errorf("--node required = %#v, want true", parameters["node"]["required"])
-	}
-	if required, _ := parameters["command"]["required"].(bool); required {
-		t.Errorf("--command required = true, want runtime custom validation")
-	}
-	wantProperties := map[string]string{
-		"node": "node", "doc": "node", "command": "command", "content": "content", "text": "content", "doc-format": "docFormat",
-		"block-id": "blockId", "after-block-id": "afterBlockId", "old": "old", "new": "new",
-		"expected-revision": "expectedRevision",
-	}
-	for name, want := range wantProperties {
-		if got := schemaContractString(parameters[name]["property"]); got != want {
-			t.Errorf("--%s property = %q, want %q", name, got, want)
-		}
-	}
-	for _, name := range []string{"content", "block-id", "after-block-id", "old", "new"} {
-		parameter := parameters[name]
-		if required, _ := parameter["required"].(bool); required {
-			t.Errorf("--%s required = true, want runtime custom validation", name)
-		}
-		if got := schemaContractString(parameter["required_when"]); got != "" {
-			t.Errorf("--%s required_when = %q, want compatibility-safe custom validation", name, got)
-		}
-	}
-	if constraints, exists := leaf["constraints"]; exists && constraints != nil {
-		t.Fatalf("enum-discriminated requirements must not be mispublished as relationship constraints: %#v", constraints)
-	}
-}
-
-func TestDeliveryDocCommentExportImportContractsAreCanonical(t *testing.T) {
-	comment := executeShortcutSchemaQuery(t, "--cli-path", "doc +comment-create")
-	commentParameters := schemaContractMap(comment["parameters"])
-	for _, name := range []string{"node", "content", "selection", "block-id", "start", "end", "selected-text", "mention"} {
-		if _, ok := commentParameters[name]; !ok {
-			t.Errorf("comment-create missing --%s: %#v", name, commentParameters)
-		}
-	}
-	for name, want := range map[string]string{"node": "node", "mention": "mention"} {
-		if got := schemaContractString(commentParameters[name]["property"]); got != want {
-			t.Errorf("comment-create --%s property = %q, want %q", name, got, want)
-		}
-	}
-
-	export := executeShortcutSchemaQuery(t, "--cli-path", "doc +export")
-	exportFormat := schemaContractMap(export["parameters"])["export-format"]
-	if required, _ := exportFormat["required"].(bool); required {
-		t.Fatalf("export --export-format required = true, want compatibility default")
-	}
-	if defaultValue := schemaContractString(exportFormat["default"]); defaultValue != "docx" {
-		t.Fatalf("export --export-format default = %q, want docx", defaultValue)
-	}
-
-	importLeaf := executeShortcutSchemaQuery(t, "--cli-path", "doc +import")
-	constraints, _ := importLeaf["constraints"].(map[string]any)
-	if requireOneOf, ok := constraints["require_one_of"]; ok && !schemaContractJSONEqual(requireOneOf, [][]string{}) {
-		t.Fatalf("import unexpectedly requires a target: %#v", constraints)
-	}
-}
-
 func executeShortcutSchemaQuery(t testing.TB, args ...string) map[string]any {
 	t.Helper()
 	root := NewRootCommand()
@@ -81,7 +81,6 @@ func newServerFailureAPIError(
 		apperrors.WithReason(fallbackReason),
 		apperrors.WithServerKey(serverKey),
 		apperrors.WithHint(fallbackHint),
-		apperrors.WithActions("运行 dws doctor 检查登录态、网络和本地环境；持续失败时保留 Trace ID 和 Server Code"),
 		apperrors.WithServerDiag(diag),
 	}
 	if classified, ok := classifyServerFailure(message, diag); ok {
@@ -95,9 +95,6 @@ func TestCrossPlatformCoverageServerFailureClassifierUnknownFallsBack(t *testing
 	if typed.Reason != "business_error" || typed.Origin != "" || typed.FailureStage != "" || typed.ExecutionStarted != nil {
 		t.Fatalf("unexpected fallback classification: %#v", typed)
 	}
-	if len(typed.Actions) == 0 || !strings.Contains(typed.Actions[0], "dws doctor") {
-		t.Fatalf("fallback error has no stable troubleshooting entry: %#v", typed.Actions)
-	}
 }

 func TestCrossPlatformCoverageServerFailureReasonUsesTypedClassification(t *testing.T) {
@@ -51,8 +51,6 @@ var (
 	skillSetupInstallMono    = installSkillToHomes
 	skillSetupInstallMulti   = installMultiSkillToHomes
 	skillSetupCopyDir        = copyDir
-	skillSetupMkdirTemp      = os.MkdirTemp
-	skillSetupRename         = os.Rename
 	skillSetupRunForm        = (*huh.Form).Run
 	skillSetupInteractive    = isInteractiveTerminal
 	skillSetupReadDir        = os.ReadDir
@@ -138,9 +136,6 @@ func runSkillSetup(cmd *cobra.Command, _ []string) error {

 	// multi 模式枚举 src 下的子 skill 名，供确认信息与安装步骤共用
 	var multiSkillNames []string
-	var foldedEventMiscTargets []string
-	var migrateEventMiscTargets []string
-	var installsEventMiscCompanion bool
 	if mode == skillSetupModeMulti {
 		allMultiSkillNames, listErr := skillSetupListMulti(skillSrc)
 		if listErr != nil {
@@ -156,30 +151,6 @@ func runSkillSetup(cmd *cobra.Command, _ []string) error {
 		// dingtalk-shared carries the global rules every product skill declares as a
 		// PREREQUISITE; it must ship even when --skill / --exclude narrows the set.
 		multiSkillNames = ensureMandatorySharedSkill(filtered, allMultiSkillNames)
-
-		foldedEventMiscTargets = findFoldedEventMiscTargets(dests)
-		if len(foldedEventMiscTargets) > 0 {
-			hasEvent := containsSkillName(multiSkillNames, multiEventSkill)
-			hasMisc := containsSkillName(multiSkillNames, multiMiscSkill)
-			switch {
-			case normalizedSkillListContains(excludeRaw, multiEventSkill):
-				return fmt.Errorf("检测到已有 dingtalk-misc 仍承载个人 Event 路由；不能显式 --exclude event，请先完成 dingtalk-event 迁移")
-			case hasMisc && !hasEvent:
-				return fmt.Errorf("检测到已有 dingtalk-misc 仍承载个人 Event 路由；不能只覆盖 dingtalk-misc，必须同时迁移 dingtalk-event")
-			case hasEvent:
-				if normalizedSkillListContains(excludeRaw, multiMiscSkill) {
-					return fmt.Errorf("检测到已有 dingtalk-misc 仍承载个人 Event 路由；本次安装 dingtalk-event 必须同时迁移 dingtalk-misc，不能显式 --exclude misc")
-				}
-				if !containsSkillName(allMultiSkillNames, multiMiscSkill) {
-					return fmt.Errorf("检测到已有 dingtalk-misc 仍承载个人 Event 路由，但当前 multi 源缺少迁移所需的 %s", multiMiscSkill)
-				}
-				if err := validateEventMiscMigrationSource(skillSrc); err != nil {
-					return err
-				}
-				migrateEventMiscTargets = append(migrateEventMiscTargets, foldedEventMiscTargets...)
-				installsEventMiscCompanion = !hasMisc
-			}
-		}
 	}

 	// --dry-run：仅预览将安装的内容与目标目录，不写入任何文件、不弹确认。
@@ -191,15 +162,11 @@ func runSkillSetup(cmd *cobra.Command, _ []string) error {
 		}
 		if mode == skillSetupModeMulti && len(multiSkillNames) > 0 {
 			fmt.Fprintf(out, "子 skill：%s\n", strings.Join(multiSkillNames, ", "))
-			printEventMiscMigrationPreview(out, migrateEventMiscTargets, installsEventMiscCompanion)
 		}
 		return nil
 	}

 	if !autoYes {
-		if mode == skillSetupModeMulti {
-			printEventMiscMigrationPreview(out, migrateEventMiscTargets, installsEventMiscCompanion)
-		}
 		ok, err := skillSetupConfirm(out, mode, skillSrc, dests, multiSkillNames)
 		if err != nil {
 			return err
@@ -215,14 +182,7 @@ func runSkillSetup(cmd *cobra.Command, _ []string) error {
 	case skillSetupModeMono:
 		installed, skipped, err = skillSetupInstallMono(skillSrc, dests, out, errOut)
 	case skillSetupModeMulti:
-		installed, skipped, err = installMultiSkillsWithEventMigration(
-			skillSrc,
-			multiSkillNames,
-			dests,
-			migrateEventMiscTargets,
-			out,
-			errOut,
-		)
+		installed, skipped, err = skillSetupInstallMulti(skillSrc, multiSkillNames, dests, out, errOut)
 	default:
 		return fmt.Errorf("内部错误：未知 mode %q", mode)
 	}
@@ -231,7 +191,6 @@ func runSkillSetup(cmd *cobra.Command, _ []string) error {
 	}

 	fmt.Fprintf(out, "\n✅ Skill 安装完成（mode=%s, installed=%d, skipped=%d）\n", mode, installed, skipped)
-	fmt.Fprintln(out, "ℹ️  若 Agent 会话已打开，请重启 Agent 或重新加载 Skills 后再验证路由。")
 	return nil
 }

@@ -245,226 +204,6 @@ const multiSkillPrefix = "dingtalk-"
 // dingtalk-shared that was never installed.
 const multiSharedSkill = "dingtalk-shared"

-// legacyMultiSharedSkill is the retired name shipped by older multi-skill
-// bundles. Once the replacement has been installed successfully, remove this
-// exact directory so Agent discovery cannot load both routing contracts.
-const legacyMultiSharedSkill = "dws-shared"
-
-const (
-	multiEventSkill = "dingtalk-event"
-	multiMiscSkill  = "dingtalk-misc"
-)
-
-var eventMigrationRequiredReferences = []string{
-	"event-im.md",
-	"event-im-keys.md",
-	"event-im-lifecycle.md",
-	"event-im-operations.md",
-	"event-im-output.md",
-	"event-oa.md",
-}
-
-func containsSkillName(names []string, want string) bool {
-	for _, name := range names {
-		if name == want {
-			return true
-		}
-	}
-	return false
-}
-
-func normalizedSkillListContains(raw []string, want string) bool {
-	for _, name := range raw {
-		if normalizeMultiSkillName(name) == want {
-			return true
-		}
-	}
-	return false
-}
-
-// findFoldedEventMiscTargets identifies the short-lived multi-skill layout in
-// which personal Event routing lived inside dingtalk-misc. Both markers are
-// required so an unrelated misc install is never treated as a migration target.
-func findFoldedEventMiscTargets(dests []string) []string {
-	var targets []string
-	for _, dest := range dests {
-		miscRoot := filepath.Join(dest, multiMiscSkill)
-		skillBody, err := os.ReadFile(filepath.Join(miscRoot, "SKILL.md"))
-		if err != nil || !containsPersonalEventRoute(skillBody) {
-			continue
-		}
-		eventRef, err := skillSetupStat(filepath.Join(miscRoot, "references", "event.md"))
-		if err != nil || eventRef.IsDir() {
-			continue
-		}
-		targets = append(targets, dest)
-	}
-	sort.Strings(targets)
-	return targets
-}
-
-func containsPersonalEventRoute(skillBody []byte) bool {
-	body := strings.ToLower(string(skillBody))
-	for _, marker := range []string{
-		"dws event",
-		"个人 event",
-		"个人 im 事件",
-		"个人 im/oa",
-		"personal event",
-	} {
-		if strings.Contains(body, marker) {
-			return true
-		}
-	}
-	return false
-}
-
-func printEventMiscMigrationPreview(out io.Writer, targets []string, installsCompanion bool) {
-	if len(targets) == 0 {
-		return
-	}
-	action := "将原子切换 dingtalk-event 与本次已选择的干净 dingtalk-misc"
-	if installsCompanion {
-		action = "将原子切换 dingtalk-event，并额外安装干净的 dingtalk-misc 作为迁移伴侣（仅限以下目标）"
-	}
-	fmt.Fprintf(out, "Event Skill 迁移：%s：\n", action)
-	for _, target := range targets {
-		fmt.Fprintf(out, "  - %s\n", target)
-	}
-}
-
-func validateEventMiscMigrationSource(src string) error {
-	if err := validateEventMigrationSkillRoot(filepath.Join(src, multiEventSkill)); err != nil {
-		return fmt.Errorf("event Skill 迁移源无效: %w", err)
-	}
-	if err := validateMigrationSkillRoot(filepath.Join(src, multiMiscSkill), multiMiscSkill, nil); err != nil {
-		return fmt.Errorf("event Skill 迁移源无效: %w", err)
-	}
-
-	if err := validateCleanEventMiscRoot(filepath.Join(src, multiMiscSkill)); err != nil {
-		return fmt.Errorf("event Skill 迁移源无效: %w", err)
-	}
-	return nil
-}
-
-func validateEventMigrationSkillRoot(root string) error {
-	required := make([]string, 0, len(eventMigrationRequiredReferences))
-	for _, name := range eventMigrationRequiredReferences {
-		required = append(required, filepath.Join("references", name))
-	}
-	return validateMigrationSkillRoot(root, multiEventSkill, required)
-}
-
-func validateMigrationSkillRoot(root, expectedName string, requiredFiles []string) error {
-	skillPath := filepath.Join(root, "SKILL.md")
-	skillBody, err := os.ReadFile(skillPath)
-	if err != nil {
-		return fmt.Errorf("无法读取 %s: %w", skillPath, err)
-	}
-	name, err := parseMigrationSkillFrontmatter(skillBody)
-	if err != nil {
-		return fmt.Errorf("%s 无效: %w", skillPath, err)
-	}
-	if name != expectedName {
-		return fmt.Errorf("%s 的 name=%q，期望 %q", skillPath, name, expectedName)
-	}
-	for _, rel := range requiredFiles {
-		path := filepath.Join(root, rel)
-		info, statErr := skillSetupStat(path)
-		if statErr != nil || info.IsDir() {
-			if statErr == nil {
-				statErr = errors.New("is a directory")
-			}
-			return fmt.Errorf("缺少有效文件 %s: %w", path, statErr)
-		}
-		body, readErr := os.ReadFile(path)
-		if readErr != nil {
-			return fmt.Errorf("无法读取 %s: %w", path, readErr)
-		}
-		if strings.TrimSpace(string(body)) == "" {
-			return fmt.Errorf("文件为空 %s", path)
-		}
-	}
-	return nil
-}
-
-func parseMigrationSkillFrontmatter(body []byte) (string, error) {
-	normalized := strings.ReplaceAll(string(body), "\r\n", "\n")
-	lines := strings.Split(normalized, "\n")
-	if len(lines) == 0 || strings.TrimSpace(lines[0]) != "---" {
-		return "", errors.New("缺少 YAML frontmatter")
-	}
-	name := ""
-	description := ""
-	closingLine := -1
-	for i := 1; i < len(lines); i++ {
-		rawLine := lines[i]
-		line := strings.TrimSpace(rawLine)
-		if line == "---" {
-			closingLine = i
-			break
-		}
-		// Only inspect top-level frontmatter keys. Nested metadata may legally
-		// contain its own `name` without changing the Skill identity.
-		if strings.TrimLeft(rawLine, " \t") != rawLine {
-			continue
-		}
-		key, value, ok := strings.Cut(line, ":")
-		if !ok {
-			continue
-		}
-		value = strings.Trim(strings.TrimSpace(value), "\"'")
-		switch strings.TrimSpace(key) {
-		case "name":
-			if name != "" {
-				return "", errors.New("frontmatter 含重复 name")
-			}
-			name = value
-		case "description":
-			description = value
-		}
-	}
-	if closingLine < 0 {
-		return "", errors.New("YAML frontmatter 未闭合")
-	}
-	if name == "" {
-		return "", errors.New("frontmatter 缺少 name")
-	}
-	if description == "" {
-		return "", errors.New("frontmatter 缺少 description")
-	}
-	if strings.TrimSpace(strings.Join(lines[closingLine+1:], "\n")) == "" {
-		return "", errors.New("SKILL.md 正文为空")
-	}
-	return name, nil
-}
-
-func validateCleanEventMiscRoot(miscRoot string) error {
-	miscSkillPath := filepath.Join(miscRoot, "SKILL.md")
-	miscBody, err := os.ReadFile(miscSkillPath)
-	if err != nil {
-		return fmt.Errorf("无法读取 %s: %w", miscSkillPath, err)
-	}
-	if containsPersonalEventRoute(miscBody) {
-		return fmt.Errorf("%s 仍包含个人 Event 路由", miscSkillPath)
-	}
-	refsRoot := filepath.Join(miscRoot, "references")
-	entries, err := skillSetupReadDir(refsRoot)
-	if errors.Is(err, os.ErrNotExist) {
-		return nil
-	}
-	if err != nil {
-		return fmt.Errorf("无法检查 %s: %w", refsRoot, err)
-	}
-	for _, entry := range entries {
-		name := strings.ToLower(entry.Name())
-		if !entry.IsDir() && strings.HasPrefix(name, "event") && strings.HasSuffix(name, ".md") {
-			return fmt.Errorf("%s 仍存在折叠 Event 参考页", filepath.Join(refsRoot, entry.Name()))
-		}
-	}
-	return nil
-}
-
 // ensureMandatorySharedSkill guarantees the shared dependency skill is included
 // whenever it exists in the source, even if --skill / --exclude narrowed it out.
 func ensureMandatorySharedSkill(selected, all []string) []string {
@@ -868,21 +607,6 @@ func cleanupMutualExclusion(dest, mode string, out, errOut io.Writer) {
 	}
 }

-func cleanupLegacyMultiSharedSkill(dest string, out, errOut io.Writer) {
-	legacyPath := filepath.Join(dest, legacyMultiSharedSkill)
-	if _, err := skillSetupStat(legacyPath); err != nil {
-		if !errors.Is(err, os.ErrNotExist) {
-			fmt.Fprintf(errOut, "  ⚠️  无法检查已退役 Skill 残留 %s: %v\n", legacyPath, err)
-		}
-		return
-	}
-	if err := skillSetupRemoveAll(legacyPath); err != nil {
-		fmt.Fprintf(errOut, "  ⚠️  已退役 Skill 清理失败（已安装 %s） %s: %v\n", multiSharedSkill, legacyPath, err)
-		return
-	}
-	fmt.Fprintf(out, "  × 已清理已退役 Skill 残留 %s\n", legacyPath)
-}
-
 func installSkillToHomes(src string, dests []string, out, errOut io.Writer) (installed, skipped int, err error) {
 	sort.Strings(dests)
 	for _, dest := range dests {
@@ -910,299 +634,6 @@ func installSkillToHomes(src string, dests []string, out, errOut io.Writer) (ins
 	return installed, skipped, nil
 }

-func installMultiSkillsWithEventMigration(
-	src string,
-	skillNames []string,
-	dests []string,
-	migrationTargets []string,
-	out, errOut io.Writer,
-) (installed, skipped int, err error) {
-	if len(migrationTargets) == 0 {
-		return skillSetupInstallMulti(src, skillNames, dests, out, errOut)
-	}
-
-	migrationSet := make(map[string]struct{}, len(migrationTargets))
-	for _, dest := range migrationTargets {
-		migrationSet[dest] = struct{}{}
-	}
-	var ordinaryTargets []string
-	for _, dest := range dests {
-		if _, migrates := migrationSet[dest]; !migrates {
-			ordinaryTargets = append(ordinaryTargets, dest)
-		}
-	}
-
-	if len(ordinaryTargets) > 0 {
-		var n, nSkipped int
-		n, nSkipped, err = skillSetupInstallMulti(src, skillNames, ordinaryTargets, out, errOut)
-		installed += n
-		skipped += nSkipped
-		if err != nil {
-			return installed, skipped, err
-		}
-		if nSkipped > 0 {
-			return installed, skipped, fmt.Errorf("multi Skill 安装不完整（skipped=%d）；已保留折叠版 Event/misc，未执行迁移", nSkipped)
-		}
-	}
-
-	// The folded pair is excluded from the ordinary best-effort installer. All
-	// other selected skills (especially dingtalk-shared) must succeed before the
-	// old Event route is touched.
-	for _, dest := range migrationTargets {
-		cleanupMutualExclusion(dest, skillSetupModeMulti, out, errOut)
-	}
-	var prerequisiteNames []string
-	for _, name := range skillNames {
-		if name != multiEventSkill && name != multiMiscSkill {
-			prerequisiteNames = append(prerequisiteNames, name)
-		}
-	}
-	if len(prerequisiteNames) > 0 {
-		var n, nSkipped int
-		n, nSkipped, err = skillSetupInstallMulti(src, prerequisiteNames, migrationTargets, out, errOut)
-		installed += n
-		skipped += nSkipped
-		if err != nil {
-			return installed, skipped, err
-		}
-		if nSkipped > 0 {
-			return installed, skipped, fmt.Errorf("event Skill 迁移前置安装不完整（skipped=%d）；已保留折叠版 Event/misc", nSkipped)
-		}
-	}
-
-	migrated, migrationErr := migrateEventMiscAtomically(src, migrationTargets, out, errOut)
-	installed += migrated
-	if migrationErr != nil {
-		return installed, skipped, migrationErr
-	}
-	return installed, skipped, nil
-}
-
-type eventMiscMigration struct {
-	dest string
-
-	stageRoot   string
-	stagedEvent string
-	stagedMisc  string
-	backupEvent string
-	backupMisc  string
-
-	eventPath string
-	miscPath  string
-
-	eventBackedUp   bool
-	miscBackedUp    bool
-	newEventEnabled bool
-	newMiscEnabled  bool
-}
-
-func prepareEventMiscMigration(src, dest string) (*eventMiscMigration, error) {
-	stageRoot, err := skillSetupMkdirTemp(dest, ".dws-event-migration-")
-	if err != nil {
-		return nil, fmt.Errorf("无法在目标文件系统创建 Event Skill 迁移 staging %s: %w", dest, err)
-	}
-	migration := &eventMiscMigration{
-		dest:        dest,
-		stageRoot:   stageRoot,
-		stagedEvent: filepath.Join(stageRoot, "new-event"),
-		stagedMisc:  filepath.Join(stageRoot, "new-misc"),
-		backupEvent: filepath.Join(stageRoot, "old-event"),
-		backupMisc:  filepath.Join(stageRoot, "old-misc"),
-		eventPath:   filepath.Join(dest, multiEventSkill),
-		miscPath:    filepath.Join(dest, multiMiscSkill),
-	}
-	cleanupOnError := func(cause error) (*eventMiscMigration, error) {
-		if cleanupErr := skillSetupRemoveAll(stageRoot); cleanupErr != nil {
-			cause = errors.Join(cause, fmt.Errorf("清理 staging %s 失败: %w", stageRoot, cleanupErr))
-		}
-		return nil, cause
-	}
-
-	if err := skillSetupCopyDir(filepath.Join(src, multiEventSkill), migration.stagedEvent); err != nil {
-		return cleanupOnError(fmt.Errorf("预备 dingtalk-event 失败 %s: %w", dest, err))
-	}
-	if err := skillSetupCopyDir(filepath.Join(src, multiMiscSkill), migration.stagedMisc); err != nil {
-		return cleanupOnError(fmt.Errorf("预备 dingtalk-misc 失败 %s: %w", dest, err))
-	}
-	if err := validateEventMigrationSkillRoot(migration.stagedEvent); err != nil {
-		return cleanupOnError(fmt.Errorf("迁移 staging 验证失败 %s: %w", migration.stagedEvent, err))
-	}
-	if err := validateMigrationSkillRoot(migration.stagedMisc, multiMiscSkill, nil); err != nil {
-		return cleanupOnError(fmt.Errorf("迁移 staging 验证失败 %s: %w", migration.stagedMisc, err))
-	}
-	if err := validateCleanEventMiscRoot(migration.stagedMisc); err != nil {
-		return cleanupOnError(fmt.Errorf("迁移 staging 验证失败 %s: %w", migration.stagedMisc, err))
-	}
-	return migration, nil
-}
-
-func migrateEventMiscAtomically(src string, dests []string, out, errOut io.Writer) (int, error) {
-	sortedDests := append([]string(nil), dests...)
-	sort.Strings(sortedDests)
-	migrations := make([]*eventMiscMigration, 0, len(sortedDests))
-
-	// Stage every target before switching any target. This prevents a source or
-	// copy failure on a later Agent home from leaving earlier homes upgraded.
-	for _, dest := range sortedDests {
-		migration, err := prepareEventMiscMigration(src, dest)
-		if err != nil {
-			if cleanupErr := cleanupEventMiscStages(migrations, false, errOut); cleanupErr != nil {
-				err = errors.Join(err, cleanupErr)
-			}
-			return 0, err
-		}
-		migrations = append(migrations, migration)
-	}
-
-	committed := make([]*eventMiscMigration, 0, len(migrations))
-	for _, migration := range migrations {
-		if err := commitEventMiscMigration(migration); err != nil {
-			rollbackErr := rollbackEventMiscMigrations(committed)
-			if rollbackErr != nil {
-				err = errors.Join(err, fmt.Errorf("已切换目标回滚失败: %w", rollbackErr))
-			}
-			var recoveryRoots []string
-			for _, candidate := range migrations {
-				if eventMiscMigrationNeedsRecovery(candidate) {
-					recoveryRoots = append(recoveryRoots, candidate.stageRoot)
-				}
-			}
-			if len(recoveryRoots) > 0 {
-				err = errors.Join(err, fmt.Errorf("回滚不完整，已保留恢复目录（请勿删除）: %s", strings.Join(recoveryRoots, ", ")))
-			}
-			if cleanupErr := cleanupEventMiscStages(migrations, true, errOut); cleanupErr != nil {
-				err = errors.Join(err, cleanupErr)
-			}
-			return 0, err
-		}
-		committed = append(committed, migration)
-	}
-
-	for _, migration := range migrations {
-		fmt.Fprintf(out, "  ✓ %s\n", migration.eventPath)
-		fmt.Fprintf(out, "  ✓ %s（Event 原子迁移）\n", migration.miscPath)
-	}
-	if cleanupErr := cleanupEventMiscStages(migrations, false, errOut); cleanupErr != nil {
-		fmt.Fprintf(errOut, "  ⚠️  Event Skill 迁移已完成，但 staging 清理不完整: %v\n", cleanupErr)
-	}
-	return len(migrations) * 2, nil
-}
-
-func cleanupEventMiscStages(migrations []*eventMiscMigration, preserveRecovery bool, errOut io.Writer) error {
-	var cleanupErr error
-	for _, migration := range migrations {
-		if preserveRecovery && eventMiscMigrationNeedsRecovery(migration) {
-			fmt.Fprintf(errOut, "  ⚠️  已保留 Event Skill 恢复目录 %s\n", migration.stageRoot)
-			continue
-		}
-		if err := skillSetupRemoveAll(migration.stageRoot); err != nil {
-			cleanupErr = errors.Join(cleanupErr, fmt.Errorf("清理 Event Skill staging %s 失败: %w", migration.stageRoot, err))
-		}
-	}
-	return cleanupErr
-}
-
-func eventMiscMigrationNeedsRecovery(migration *eventMiscMigration) bool {
-	return migration.eventBackedUp || migration.miscBackedUp || migration.newEventEnabled || migration.newMiscEnabled
-}
-
-func commitEventMiscMigration(migration *eventMiscMigration) error {
-	eventExists, err := skillSetupPathExists(migration.eventPath)
-	if err != nil {
-		return fmt.Errorf("无法检查旧 dingtalk-event %s: %w", migration.dest, err)
-	}
-	miscExists, err := skillSetupPathExists(migration.miscPath)
-	if err != nil {
-		return fmt.Errorf("无法检查旧 dingtalk-misc %s: %w", migration.dest, err)
-	}
-	if !miscExists {
-		return fmt.Errorf("event Skill 迁移中止：折叠版 dingtalk-misc 已不存在 %s", migration.dest)
-	}
-
-	rollbackFailure := func(cause error) error {
-		if rollbackErr := rollbackEventMiscMigration(migration); rollbackErr != nil {
-			return errors.Join(cause, fmt.Errorf("回滚 Event/misc 失败 %s: %w", migration.dest, rollbackErr))
-		}
-		return cause
-	}
-	if eventExists {
-		if err := skillSetupRename(migration.eventPath, migration.backupEvent); err != nil {
-			return fmt.Errorf("备份旧 dingtalk-event 失败 %s: %w", migration.dest, err)
-		}
-		migration.eventBackedUp = true
-	}
-	if err := skillSetupRename(migration.stagedEvent, migration.eventPath); err != nil {
-		return rollbackFailure(fmt.Errorf("切换 dingtalk-event 失败 %s: %w", migration.dest, err))
-	}
-	migration.newEventEnabled = true
-	if err := skillSetupRename(migration.miscPath, migration.backupMisc); err != nil {
-		return rollbackFailure(fmt.Errorf("备份旧 dingtalk-misc 失败 %s: %w", migration.dest, err))
-	}
-	migration.miscBackedUp = true
-	if err := skillSetupRename(migration.stagedMisc, migration.miscPath); err != nil {
-		return rollbackFailure(fmt.Errorf("切换 dingtalk-misc 失败 %s: %w", migration.dest, err))
-	}
-	migration.newMiscEnabled = true
-	return nil
-}
-
-func rollbackEventMiscMigrations(migrations []*eventMiscMigration) error {
-	var rollbackErr error
-	for i := len(migrations) - 1; i >= 0; i-- {
-		if err := rollbackEventMiscMigration(migrations[i]); err != nil {
-			rollbackErr = errors.Join(rollbackErr, err)
-		}
-	}
-	return rollbackErr
-}
-
-func rollbackEventMiscMigration(migration *eventMiscMigration) error {
-	move := func(enabled *bool, from, to, label string) error {
-		if !*enabled {
-			return nil
-		}
-		if err := skillSetupRename(from, to); err != nil {
-			return fmt.Errorf("%s: %w", label, err)
-		}
-		*enabled = false
-		return nil
-	}
-
-	// Stop at the first rollback failure. In particular, do not remove the
-	// already-working standalone Event while the folded misc route has not been
-	// restored: even an incomplete rollback must leave at least one Event entry
-	// point live and preserve the remaining assets in staging for recovery.
-	steps := []struct {
-		enabled *bool
-		from    string
-		to      string
-		label   string
-	}{
-		{&migration.newMiscEnabled, migration.miscPath, migration.stagedMisc, "移出新 dingtalk-misc"},
-		{&migration.miscBackedUp, migration.backupMisc, migration.miscPath, "恢复旧 dingtalk-misc"},
-		{&migration.newEventEnabled, migration.eventPath, migration.stagedEvent, "移出新 dingtalk-event"},
-		{&migration.eventBackedUp, migration.backupEvent, migration.eventPath, "恢复旧 dingtalk-event"},
-	}
-	for _, step := range steps {
-		if err := move(step.enabled, step.from, step.to, step.label); err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-func skillSetupPathExists(path string) (bool, error) {
-	_, err := skillSetupStat(path)
-	switch {
-	case err == nil:
-		return true, nil
-	case errors.Is(err, os.ErrNotExist):
-		return false, nil
-	default:
-		return false, err
-	}
-}
-
 // installMultiSkillToHomes installs each subdir of src (dingtalk-*) into
 // dest as a sibling skill directory. installed/skipped is counted per
 // (agent-home × sub-skill) pair so the user sees granular progress.
@@ -1218,7 +649,6 @@ func installMultiSkillToHomes(src string, skillNames []string, dests []string, o
 			continue
 		}

-		sharedInstalled := false
 		for _, name := range skillNames {
 			subSrc := filepath.Join(src, name)
 			subDest := filepath.Join(dest, name)
@@ -1234,12 +664,6 @@ func installMultiSkillToHomes(src string, skillNames []string, dests []string, o
 			}
 			fmt.Fprintf(out, "  ✓ %s\n", subDest)
 			installed++
-			if name == multiSharedSkill {
-				sharedInstalled = true
-			}
-		}
-		if sharedInstalled {
-			cleanupLegacyMultiSharedSkill(dest, out, errOut)
 		}
 	}
 	return installed, skipped, nil
@@ -58,9 +58,8 @@ func TestMaterializeEmbeddedSkillSourceMono(t *testing.T) {
 }

 // TestMaterializeEmbeddedSkillSourceMulti verifies that the peer multi bundle
-// contains the standalone Event skill, shared routing skill, and clean misc
-// (including PAT docs). Structured Schema hints are build inputs and must not
-// become a third installable mode.
+// contains both the shared routing skill and misc (including folded PAT docs). Structured
+// Schema hints are build inputs and must not become a third installable mode.
 func TestMaterializeEmbeddedSkillSourceMulti(t *testing.T) {
 	dir, cleanup, err := materializeEmbeddedSkillSource(skillSetupModeMulti)
 	if err != nil {
@@ -72,8 +71,6 @@ func TestMaterializeEmbeddedSkillSourceMulti(t *testing.T) {
 		t.Fatalf("extracted dir %s is not a valid multi skill source root", dir)
 	}
 	for _, rel := range []string{
-		filepath.Join("dingtalk-event", "SKILL.md"),
-		filepath.Join("dingtalk-event", "references", "event-oa.md"),
 		filepath.Join("dingtalk-shared", "SKILL.md"),
 		filepath.Join("dingtalk-misc", "SKILL.md"),
 		filepath.Join("dingtalk-misc", "references", "pat.md"),
@@ -82,11 +79,6 @@ func TestMaterializeEmbeddedSkillSourceMulti(t *testing.T) {
 			t.Errorf("expected embedded multi skill to contain %s: %v", rel, err)
 		}
 	}
-	if _, err := os.Stat(filepath.Join(dir, "dingtalk-misc", "references", "event.md")); err == nil {
-		t.Fatal("embedded misc must not retain the folded personal Event reference")
-	} else if !os.IsNotExist(err) {
-		t.Fatalf("stat embedded misc event reference: %v", err)
-	}
 	if _, err := os.Stat(filepath.Join(dir, "schema-hints")); err == nil {
 		t.Fatal("embedded multi skill must not contain build-only schema-hints")
 	} else if !os.IsNotExist(err) {
@@ -7,11 +7,9 @@ import (
 	"io/fs"
 	"os"
 	"path/filepath"
-	"strings"
 	"testing"
 	"time"

-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/testseam"
 	"github.com/charmbracelet/huh"
 	"github.com/spf13/cobra"
 )
@@ -122,112 +120,12 @@ func TestCrossPlatformCoverageSkillSetupHighLevelRemainingCoverage(t *testing.T)
 	}
 }

-func TestCrossPlatformCoverageSkillSetupMigratesLegacySharedAfterReplacement(t *testing.T) {
-	src := writeMultiSkillSource(t, []string{multiSharedSkill, "dingtalk-chat"})
-	home := filepath.Join(t.TempDir(), "skills")
-	legacyPath := filepath.Join(home, legacyMultiSharedSkill)
-	customPath := filepath.Join(home, "custom-skill")
-	for _, path := range []string{legacyPath, customPath} {
-		if err := os.MkdirAll(path, 0o755); err != nil {
-			t.Fatal(err)
-		}
-		if err := os.WriteFile(filepath.Join(path, "SKILL.md"), []byte("legacy or custom\n"), 0o644); err != nil {
-			t.Fatal(err)
-		}
-	}
-
-	var out, errOut bytes.Buffer
-	installed, skipped, err := installMultiSkillToHomes(
-		src,
-		[]string{multiSharedSkill, "dingtalk-chat"},
-		[]string{home},
-		&out,
-		&errOut,
-	)
-	if err != nil || installed != 2 || skipped != 0 {
-		t.Fatalf("install = %d/%d, err=%v, stderr=%s", installed, skipped, err, errOut.String())
-	}
-	if _, err := os.Stat(legacyPath); !os.IsNotExist(err) {
-		t.Fatalf("legacy shared skill still exists: %v", err)
-	}
-	if _, err := os.Stat(filepath.Join(home, multiSharedSkill, "SKILL.md")); err != nil {
-		t.Fatalf("replacement shared skill missing: %v", err)
-	}
-	if _, err := os.Stat(filepath.Join(customPath, "SKILL.md")); err != nil {
-		t.Fatalf("unrelated custom skill changed: %v", err)
-	}
-	if !strings.Contains(out.String(), "已清理已退役 Skill 残留") {
-		t.Fatalf("legacy cleanup was not reported: %s", out.String())
-	}
-
-	t.Run("failed replacement preserves legacy", func(t *testing.T) {
-		missingSource := t.TempDir()
-		failureHome := filepath.Join(t.TempDir(), "skills")
-		failureLegacy := filepath.Join(failureHome, legacyMultiSharedSkill)
-		if err := os.MkdirAll(failureLegacy, 0o755); err != nil {
-			t.Fatal(err)
-		}
-		if err := os.WriteFile(filepath.Join(failureLegacy, "SKILL.md"), []byte("legacy\n"), 0o644); err != nil {
-			t.Fatal(err)
-		}
-
-		var failureOut, failureErr bytes.Buffer
-		installed, skipped, err := installMultiSkillToHomes(
-			missingSource,
-			[]string{multiSharedSkill},
-			[]string{failureHome},
-			&failureOut,
-			&failureErr,
-		)
-		if err != nil || installed != 0 || skipped != 1 {
-			t.Fatalf("failed replacement = %d/%d, err=%v", installed, skipped, err)
-		}
-		if _, err := os.Stat(filepath.Join(failureLegacy, "SKILL.md")); err != nil {
-			t.Fatalf("failed replacement removed legacy shared skill: %v", err)
-		}
-	})
-}
-
-func TestCrossPlatformCoverageSkillSetupLegacySharedCleanupFailures(t *testing.T) {
-	fail := errors.New("legacy cleanup failure")
-
-	t.Run("missing legacy is a no-op", func(t *testing.T) {
-		var out, errOut bytes.Buffer
-		cleanupLegacyMultiSharedSkill(t.TempDir(), &out, &errOut)
-		if out.Len() != 0 || errOut.Len() != 0 {
-			t.Fatalf("missing legacy emitted output: stdout=%q stderr=%q", out.String(), errOut.String())
-		}
-	})
-
-	t.Run("stat failure is reported", func(t *testing.T) {
-		testseam.Swap(t, &skillSetupStat, func(string) (os.FileInfo, error) { return nil, fail })
-		var out, errOut bytes.Buffer
-		cleanupLegacyMultiSharedSkill("dest", &out, &errOut)
-		if out.Len() != 0 || !strings.Contains(errOut.String(), "无法检查已退役 Skill 残留") {
-			t.Fatalf("stat failure output: stdout=%q stderr=%q", out.String(), errOut.String())
-		}
-	})
-
-	t.Run("remove failure is reported", func(t *testing.T) {
-		testseam.Swap(t, &skillSetupStat, func(path string) (os.FileInfo, error) {
-			return skillSetupFileInfo{name: filepath.Base(path), mode: os.ModeDir}, nil
-		})
-		testseam.Swap(t, &skillSetupRemoveAll, func(string) error { return fail })
-		var out, errOut bytes.Buffer
-		cleanupLegacyMultiSharedSkill("dest", &out, &errOut)
-		if out.Len() != 0 || !strings.Contains(errOut.String(), "已退役 Skill 清理失败") {
-			t.Fatalf("remove failure output: stdout=%q stderr=%q", out.String(), errOut.String())
-		}
-	})
-}
-
 func TestCrossPlatformCoverageSkillSetupLowLevelRemainingCoverage(t *testing.T) {
 	oldRunForm, oldInteractive := skillSetupRunForm, skillSetupInteractive
 	oldReadDir, oldStat := skillSetupReadDir, skillSetupStat
 	oldExecutable, oldGetwd, oldHome := skillSetupExecutable, skillSetupGetwd, skillSetupUserHomeDir
 	oldRemove, oldMkdir := skillSetupRemoveAll, skillSetupMkdirAll
 	oldCopyDir, oldWalk, oldRel := skillSetupCopyDir, skillSetupWalk, skillSetupRel
-	oldMkdirTemp, oldRename := skillSetupMkdirTemp, skillSetupRename
 	oldReadlink, oldOpen, oldOpenFile, oldCopy := skillSetupReadlink, skillSetupOpen, skillSetupOpenFile, skillSetupCopy
 	t.Cleanup(func() {
 		skillSetupRunForm, skillSetupInteractive = oldRunForm, oldInteractive
@@ -235,7 +133,6 @@ func TestCrossPlatformCoverageSkillSetupLowLevelRemainingCoverage(t *testing.T)
 		skillSetupExecutable, skillSetupGetwd, skillSetupUserHomeDir = oldExecutable, oldGetwd, oldHome
 		skillSetupRemoveAll, skillSetupMkdirAll = oldRemove, oldMkdir
 		skillSetupCopyDir, skillSetupWalk, skillSetupRel = oldCopyDir, oldWalk, oldRel
-		skillSetupMkdirTemp, skillSetupRename = oldMkdirTemp, oldRename
 		skillSetupReadlink, skillSetupOpen, skillSetupOpenFile, skillSetupCopy = oldReadlink, oldOpen, oldOpenFile, oldCopy
 	})
 	fail := errors.New("failure")
@@ -413,236 +310,3 @@ func TestCrossPlatformCoverageSkillSetupLowLevelRemainingCoverage(t *testing.T)
 	}
 	_ = fs.ValidPath("path")
 }
-
-func TestCrossPlatformCoverageSkillSetupEventMigrationFailureBranches(t *testing.T) {
-	fail := errors.New("injected failure")
-	validSkill := func(name string) []byte {
-		return []byte("---\nname: " + name + "\ndescription: valid migration skill\n---\n\n# Skill\n")
-	}
-
-	t.Run("folded discovery rejects directory reference", func(t *testing.T) {
-		dest := t.TempDir()
-		miscRoot := filepath.Join(dest, multiMiscSkill)
-		if err := os.MkdirAll(miscRoot, 0o755); err != nil {
-			t.Fatal(err)
-		}
-		if err := os.WriteFile(filepath.Join(miscRoot, "SKILL.md"), []byte("dws event\n"), 0o644); err != nil {
-			t.Fatal(err)
-		}
-		testseam.Swap(t, &skillSetupStat, func(path string) (os.FileInfo, error) {
-			if strings.HasSuffix(path, filepath.Join("references", "event.md")) {
-				return skillSetupFileInfo{name: "event.md", mode: os.ModeDir}, nil
-			}
-			return os.Stat(path)
-		})
-		if got := findFoldedEventMiscTargets([]string{dest}); len(got) != 0 {
-			t.Fatalf("directory event reference accepted: %#v", got)
-		}
-	})
-
-	t.Run("migration root validation failures", func(t *testing.T) {
-		if err := validateMigrationSkillRoot(filepath.Join(t.TempDir(), "missing"), multiEventSkill, nil); err == nil {
-			t.Fatal("missing SKILL.md succeeded")
-		}
-
-		root := t.TempDir()
-		if err := os.WriteFile(filepath.Join(root, "SKILL.md"), validSkill(multiEventSkill), 0o644); err != nil {
-			t.Fatal(err)
-		}
-		if err := os.MkdirAll(filepath.Join(root, "references", "directory.md"), 0o755); err != nil {
-			t.Fatal(err)
-		}
-		if err := validateMigrationSkillRoot(root, multiEventSkill, []string{filepath.Join("references", "directory.md")}); err == nil || !strings.Contains(err.Error(), "is a directory") {
-			t.Fatalf("directory required file = %v", err)
-		}
-
-		missing := filepath.Join("references", "missing.md")
-		testseam.Swap(t, &skillSetupStat, func(path string) (os.FileInfo, error) {
-			if path == filepath.Join(root, missing) {
-				return skillSetupFileInfo{name: "missing.md"}, nil
-			}
-			return os.Stat(path)
-		})
-		if err := validateMigrationSkillRoot(root, multiEventSkill, []string{missing}); err == nil || !strings.Contains(err.Error(), "无法读取") {
-			t.Fatalf("unreadable required file = %v", err)
-		}
-	})
-
-	t.Run("frontmatter validation branches", func(t *testing.T) {
-		validWithIgnoredLine := []byte("---\nignored line\nname: dingtalk-event\ndescription: valid\n---\n\nbody\n")
-		if name, err := parseMigrationSkillFrontmatter(validWithIgnoredLine); err != nil || name != multiEventSkill {
-			t.Fatalf("ignored frontmatter line = %q, %v", name, err)
-		}
-		for name, body := range map[string][]byte{
-			"duplicate name": []byte("---\nname: one\nname: two\ndescription: valid\n---\nbody\n"),
-			"unclosed":       []byte("---\nname: one\ndescription: valid\nbody\n"),
-			"missing name":   []byte("---\ndescription: valid\n---\nbody\n"),
-			"missing desc":   []byte("---\nname: one\n---\nbody\n"),
-			"empty body":     []byte("---\nname: one\ndescription: valid\n---\n  \n"),
-		} {
-			t.Run(name, func(t *testing.T) {
-				if _, err := parseMigrationSkillFrontmatter(body); err == nil {
-					t.Fatal("invalid frontmatter succeeded")
-				}
-			})
-		}
-	})
-
-	t.Run("clean misc validation branches", func(t *testing.T) {
-		if err := validateCleanEventMiscRoot(filepath.Join(t.TempDir(), "missing")); err == nil {
-			t.Fatal("missing misc root succeeded")
-		}
-
-		routed := t.TempDir()
-		if err := os.WriteFile(filepath.Join(routed, "SKILL.md"), append(validSkill(multiMiscSkill), []byte("dws event\n")...), 0o644); err != nil {
-			t.Fatal(err)
-		}
-		if err := validateCleanEventMiscRoot(routed); err == nil || !strings.Contains(err.Error(), "仍包含个人 Event 路由") {
-			t.Fatalf("routed misc = %v", err)
-		}
-
-		clean := t.TempDir()
-		if err := os.WriteFile(filepath.Join(clean, "SKILL.md"), validSkill(multiMiscSkill), 0o644); err != nil {
-			t.Fatal(err)
-		}
-		if err := validateCleanEventMiscRoot(clean); err != nil {
-			t.Fatalf("missing references should be clean: %v", err)
-		}
-
-		testseam.Swap(t, &skillSetupReadDir, func(string) ([]os.DirEntry, error) { return nil, fail })
-		if err := validateCleanEventMiscRoot(clean); !errors.Is(err, fail) {
-			t.Fatalf("read-dir failure = %v", err)
-		}
-	})
-
-	t.Run("ordinary and prerequisite install errors", func(t *testing.T) {
-		testseam.Swap(t, &skillSetupInstallMulti, func(string, []string, []string, io.Writer, io.Writer) (int, int, error) {
-			return 0, 0, fail
-		})
-		migration := filepath.Join(t.TempDir(), "migration")
-		ordinary := filepath.Join(t.TempDir(), "ordinary")
-		if _, _, err := installMultiSkillsWithEventMigration("src", []string{multiEventSkill}, []string{migration, ordinary}, []string{migration}, io.Discard, io.Discard); !errors.Is(err, fail) {
-			t.Fatalf("ordinary install failure = %v", err)
-		}
-		if _, _, err := installMultiSkillsWithEventMigration("src", []string{multiEventSkill, multiMiscSkill, multiSharedSkill}, []string{migration}, []string{migration}, io.Discard, io.Discard); !errors.Is(err, fail) {
-			t.Fatalf("prerequisite install failure = %v", err)
-		}
-	})
-
-	t.Run("preparation cleanup and staged misc validation", func(t *testing.T) {
-		src := writeMultiSkillSource(t, []string{multiEventSkill, multiMiscSkill})
-		dest := t.TempDir()
-		testseam.Swap(t, &skillSetupCopyDir, func(string, string) error { return fail })
-		cleanupFail := errors.New("cleanup failure")
-		testseam.Swap(t, &skillSetupRemoveAll, func(string) error { return cleanupFail })
-		if _, err := prepareEventMiscMigration(src, dest); err == nil || !errors.Is(err, fail) || !errors.Is(err, cleanupFail) {
-			t.Fatalf("joined preparation cleanup error = %v", err)
-		}
-	})
-
-	t.Run("invalid staged misc root", func(t *testing.T) {
-		src := writeMultiSkillSource(t, []string{multiEventSkill, multiMiscSkill})
-		if err := os.WriteFile(filepath.Join(src, multiMiscSkill, "SKILL.md"), validSkill(multiEventSkill), 0o644); err != nil {
-			t.Fatal(err)
-		}
-		if _, err := prepareEventMiscMigration(src, t.TempDir()); err == nil || !strings.Contains(err.Error(), "staging 验证失败") {
-			t.Fatalf("invalid staged misc = %v", err)
-		}
-	})
-
-	t.Run("later staging failure joins cleanup error", func(t *testing.T) {
-		src := writeMultiSkillSource(t, []string{multiEventSkill, multiMiscSkill})
-		first := filepath.Join(t.TempDir(), "a")
-		second := filepath.Join(t.TempDir(), "b")
-		if err := os.MkdirAll(first, 0o755); err != nil {
-			t.Fatal(err)
-		}
-		if err := os.MkdirAll(second, 0o755); err != nil {
-			t.Fatal(err)
-		}
-		originalMkdirTemp := skillSetupMkdirTemp
-		calls := 0
-		testseam.Swap(t, &skillSetupMkdirTemp, func(dir, pattern string) (string, error) {
-			calls++
-			if calls == 2 {
-				return "", fail
-			}
-			return originalMkdirTemp(dir, pattern)
-		})
-		cleanupFail := errors.New("stage cleanup failure")
-		testseam.Swap(t, &skillSetupRemoveAll, func(string) error { return cleanupFail })
-		if _, err := migrateEventMiscAtomically(src, []string{second, first}, io.Discard, io.Discard); err == nil || !errors.Is(err, fail) || !errors.Is(err, cleanupFail) {
-			t.Fatalf("later preparation failure = %v", err)
-		}
-	})
-
-	t.Run("successful migration reports cleanup warning", func(t *testing.T) {
-		src := writeMultiSkillSource(t, []string{multiEventSkill, multiMiscSkill})
-		home := filepath.Join(t.TempDir(), "skills")
-		writeFoldedEventMisc(t, home)
-		cleanupFail := errors.New("final cleanup failure")
-		testseam.Swap(t, &skillSetupRemoveAll, func(string) error { return cleanupFail })
-		var stderr bytes.Buffer
-		installed, err := migrateEventMiscAtomically(src, []string{home}, io.Discard, &stderr)
-		if err != nil || installed != 2 || !strings.Contains(stderr.String(), cleanupFail.Error()) {
-			t.Fatalf("successful migration cleanup warning: installed=%d err=%v stderr=%s", installed, err, stderr.String())
-		}
-	})
-
-	t.Run("commit rollback and cleanup failures are joined", func(t *testing.T) {
-		src := writeMultiSkillSource(t, []string{multiEventSkill, multiMiscSkill})
-		root := t.TempDir()
-		first := filepath.Join(root, "a", "skills")
-		second := filepath.Join(root, "b", "skills")
-		for _, home := range []string{first, second} {
-			writeFoldedEventMisc(t, home)
-			writeOldStandaloneEvent(t, home)
-		}
-		commitFail := errors.New("second commit failure")
-		rollbackFail := errors.New("first rollback failure")
-		originalRename := skillSetupRename
-		testseam.Swap(t, &skillSetupRename, func(oldPath, newPath string) error {
-			if filepath.Base(oldPath) == "new-misc" && newPath == filepath.Join(second, multiMiscSkill) {
-				return commitFail
-			}
-			if filepath.Base(oldPath) == "old-misc" && newPath == filepath.Join(first, multiMiscSkill) {
-				return rollbackFail
-			}
-			return originalRename(oldPath, newPath)
-		})
-		cleanupFail := errors.New("post-rollback cleanup failure")
-		testseam.Swap(t, &skillSetupRemoveAll, func(string) error { return cleanupFail })
-		if _, err := migrateEventMiscAtomically(src, []string{second, first}, io.Discard, io.Discard); err == nil || !errors.Is(err, commitFail) || !errors.Is(err, rollbackFail) || !errors.Is(err, cleanupFail) {
-			t.Fatalf("joined commit/rollback/cleanup error = %v", err)
-		}
-	})
-
-	t.Run("commit preflight and rollback aggregation", func(t *testing.T) {
-		migration := &eventMiscMigration{dest: "dest", eventPath: "event", miscPath: "misc"}
-		testseam.Swap(t, &skillSetupStat, func(string) (os.FileInfo, error) { return nil, fail })
-		if err := commitEventMiscMigration(migration); !errors.Is(err, fail) {
-			t.Fatalf("event stat failure = %v", err)
-		}
-
-		testseam.Swap(t, &skillSetupStat, func(path string) (os.FileInfo, error) {
-			if path == migration.eventPath {
-				return skillSetupFileInfo{name: "event", mode: os.ModeDir}, nil
-			}
-			return nil, fail
-		})
-		if err := commitEventMiscMigration(migration); !errors.Is(err, fail) {
-			t.Fatalf("misc stat failure = %v", err)
-		}
-
-		testseam.Swap(t, &skillSetupStat, func(string) (os.FileInfo, error) { return nil, os.ErrNotExist })
-		if err := commitEventMiscMigration(migration); err == nil || !strings.Contains(err.Error(), "已不存在") {
-			t.Fatalf("missing misc = %v", err)
-		}
-
-		migration.newMiscEnabled = true
-		testseam.Swap(t, &skillSetupRename, func(string, string) error { return fail })
-		if err := rollbackEventMiscMigrations([]*eventMiscMigration{migration}); !errors.Is(err, fail) {
-			t.Fatalf("rollback aggregation = %v", err)
-		}
-	})
-}
@@ -2,9 +2,6 @@ package app

 import (
 	"bytes"
-	"errors"
-	"fmt"
-	"io"
 	"os"
 	"path/filepath"
 	"strings"
@@ -187,20 +184,12 @@ func writeMultiSkillSource(t *testing.T, names []string) string {
 		if err := os.MkdirAll(filepath.Join(sub, "references"), 0o755); err != nil {
 			t.Fatal(err)
 		}
-		skillBody := "---\nname: " + n + "\ndescription: test skill\n---\n\n# " + n + "\n"
-		if err := os.WriteFile(filepath.Join(sub, "SKILL.md"), []byte(skillBody), 0o644); err != nil {
+		if err := os.WriteFile(filepath.Join(sub, "SKILL.md"), []byte("# "+n), 0o644); err != nil {
 			t.Fatal(err)
 		}
 		if err := os.WriteFile(filepath.Join(sub, "references", n+".md"), []byte("ref "+n), 0o644); err != nil {
 			t.Fatal(err)
 		}
-		if n == multiEventSkill {
-			for _, ref := range eventMigrationRequiredReferences {
-				if err := os.WriteFile(filepath.Join(sub, "references", ref), []byte("ref "+ref+"\n"), 0o644); err != nil {
-					t.Fatal(err)
-				}
-			}
-		}
 	}
 	return root
 }
@@ -560,787 +549,3 @@ func TestResolveSkillSetupSourceMultiFinds(t *testing.T) {
 		t.Fatalf("expected %s, got %s", multiDir, got)
 	}
 }
-
-func executeMultiSkillSetupTest(t *testing.T, src string, dests []string, args ...string) (string, string, error) {
-	t.Helper()
-	originalTargets := skillSetupResolveTargets
-	skillSetupResolveTargets = func(string, string) ([]string, error) {
-		return append([]string(nil), dests...), nil
-	}
-	t.Cleanup(func() { skillSetupResolveTargets = originalTargets })
-
-	cmd := newSkillSetupCommand()
-	cmd.Flags().Bool("dry-run", false, "")
-	var stdout, stderr bytes.Buffer
-	cmd.SetOut(&stdout)
-	cmd.SetErr(&stderr)
-	baseArgs := []string{"--mode", "multi", "--source", src}
-	cmd.SetArgs(append(baseArgs, args...))
-	err := cmd.Execute()
-	return stdout.String(), stderr.String(), err
-}
-
-func writeFoldedEventMisc(t *testing.T, agentHome string) {
-	t.Helper()
-	miscRoot := filepath.Join(agentHome, multiMiscSkill)
-	if err := os.MkdirAll(filepath.Join(miscRoot, "references"), 0o755); err != nil {
-		t.Fatal(err)
-	}
-	if err := os.WriteFile(filepath.Join(miscRoot, "SKILL.md"), []byte("personal IM route: dws event consume\n"), 0o644); err != nil {
-		t.Fatal(err)
-	}
-	if err := os.WriteFile(filepath.Join(miscRoot, "references", "event.md"), []byte("folded event docs\n"), 0o644); err != nil {
-		t.Fatal(err)
-	}
-}
-
-func writeOldStandaloneEvent(t *testing.T, agentHome string) {
-	t.Helper()
-	eventRoot := filepath.Join(agentHome, multiEventSkill)
-	if err := os.MkdirAll(eventRoot, 0o755); err != nil {
-		t.Fatal(err)
-	}
-	if err := os.WriteFile(filepath.Join(eventRoot, "SKILL.md"), []byte("old standalone event\n"), 0o644); err != nil {
-		t.Fatal(err)
-	}
-}
-
-func assertOldEventMiscPair(t *testing.T, agentHome string) {
-	t.Helper()
-	eventBody, err := os.ReadFile(filepath.Join(agentHome, multiEventSkill, "SKILL.md"))
-	if err != nil || string(eventBody) != "old standalone event\n" {
-		t.Fatalf("old standalone event was not restored: body=%q err=%v", eventBody, err)
-	}
-	miscBody, err := os.ReadFile(filepath.Join(agentHome, multiMiscSkill, "SKILL.md"))
-	if err != nil || !strings.Contains(string(miscBody), "dws event") {
-		t.Fatalf("folded misc was not restored: body=%q err=%v", miscBody, err)
-	}
-	if _, err := os.Stat(filepath.Join(agentHome, multiMiscSkill, "references", "event.md")); err != nil {
-		t.Fatalf("folded Event reference was not restored: %v", err)
-	}
-}
-
-func assertNoEventMigrationStages(t *testing.T, agentHome string) {
-	t.Helper()
-	entries, err := os.ReadDir(agentHome)
-	if err != nil {
-		t.Fatal(err)
-	}
-	for _, entry := range entries {
-		if strings.HasPrefix(entry.Name(), ".dws-event-migration-") {
-			t.Fatalf("unexpected leftover Event migration stage %s", filepath.Join(agentHome, entry.Name()))
-		}
-	}
-}
-
-func TestSkillSetupSelectiveEventMigratesOnlyFoldedTargets(t *testing.T) {
-	src := writeMultiSkillSource(t, []string{
-		multiEventSkill, multiSharedSkill, multiMiscSkill, "dingtalk-doc",
-	})
-	foldedHome := filepath.Join(t.TempDir(), "folded", "skills")
-	freshHome := filepath.Join(t.TempDir(), "fresh", "skills")
-	writeFoldedEventMisc(t, foldedHome)
-	if err := os.MkdirAll(filepath.Join(foldedHome, multiEventSkill), 0o755); err != nil {
-		t.Fatal(err)
-	}
-	if err := os.WriteFile(filepath.Join(foldedHome, multiEventSkill, "SKILL.md"), []byte("old standalone event\n"), 0o644); err != nil {
-		t.Fatal(err)
-	}
-	if err := os.MkdirAll(filepath.Join(foldedHome, "dingtalk-chat"), 0o755); err != nil {
-		t.Fatal(err)
-	}
-	if err := os.WriteFile(filepath.Join(foldedHome, "dingtalk-chat", "SKILL.md"), []byte("keep sibling\n"), 0o644); err != nil {
-		t.Fatal(err)
-	}
-
-	stdout, stderr, err := executeMultiSkillSetupTest(t, src, []string{freshHome, foldedHome}, "--skill", "event")
-	if err != nil {
-		t.Fatalf("selective event setup failed: %v\nstderr=%s\nstdout=%s", err, stderr, stdout)
-	}
-	if !strings.Contains(stdout, "迁移伴侣") || !strings.Contains(stdout, foldedHome) {
-		t.Fatalf("confirmation output should expose folded misc migration: %s", stdout)
-	}
-	if !strings.Contains(stdout, "重新加载 Skills") {
-		t.Fatalf("completion should tell the user to reload skills: %s", stdout)
-	}
-
-	for _, home := range []string{freshHome, foldedHome} {
-		for _, name := range []string{multiSharedSkill, multiEventSkill} {
-			if _, err := os.Stat(filepath.Join(home, name, "SKILL.md")); err != nil {
-				t.Errorf("%s missing from %s: %v", name, home, err)
-			}
-		}
-		if _, err := os.Stat(filepath.Join(home, "dingtalk-doc")); !os.IsNotExist(err) {
-			t.Errorf("unselected doc appeared in %s: %v", home, err)
-		}
-	}
-	if _, err := os.Stat(filepath.Join(freshHome, multiMiscSkill)); !os.IsNotExist(err) {
-		t.Fatalf("fresh selective target must not receive misc, stat err=%v", err)
-	}
-	if _, err := os.Stat(filepath.Join(foldedHome, multiMiscSkill, "references", "event.md")); !os.IsNotExist(err) {
-		t.Fatalf("folded event reference survived clean misc replacement, stat err=%v", err)
-	}
-	eventBody, err := os.ReadFile(filepath.Join(foldedHome, multiEventSkill, "SKILL.md"))
-	if err != nil || strings.Contains(string(eventBody), "old standalone") {
-		t.Fatalf("old standalone event was not replaced: body=%q err=%v", eventBody, err)
-	}
-	siblingBody, err := os.ReadFile(filepath.Join(foldedHome, "dingtalk-chat", "SKILL.md"))
-	if err != nil || string(siblingBody) != "keep sibling\n" {
-		t.Fatalf("unrelated sibling changed: body=%q err=%v", siblingBody, err)
-	}
-
-	// A second selective run sees the already-clean misc, does not plan another
-	// migration, and leaves that unselected sibling in place.
-	stdout, stderr, err = executeMultiSkillSetupTest(t, src, []string{freshHome, foldedHome}, "--skill", "event", "--yes")
-	if err != nil {
-		t.Fatalf("idempotent event setup failed: %v\nstderr=%s", err, stderr)
-	}
-	if strings.Contains(stdout, "迁移伴侣") {
-		t.Fatalf("clean second run should not re-detect folded misc: %s", stdout)
-	}
-	if _, err := os.Stat(filepath.Join(foldedHome, multiMiscSkill, "SKILL.md")); err != nil {
-		t.Fatalf("second selective run removed clean misc: %v", err)
-	}
-}
-
-func TestSkillSetupEventMigrationDryRunAndExplicitExclude(t *testing.T) {
-	src := writeMultiSkillSource(t, []string{
-		multiEventSkill, multiSharedSkill, multiMiscSkill, "dingtalk-doc",
-	})
-
-	t.Run("dry run reports companion without writes", func(t *testing.T) {
-		home := filepath.Join(t.TempDir(), "skills")
-		writeFoldedEventMisc(t, home)
-		stdout, stderr, err := executeMultiSkillSetupTest(t, src, []string{home}, "--skill", "event", "--dry-run", "--yes")
-		if err != nil {
-			t.Fatalf("dry run failed: %v\nstderr=%s", err, stderr)
-		}
-		if !strings.Contains(stdout, "DRY-RUN") || !strings.Contains(stdout, "迁移伴侣") {
-			t.Fatalf("dry run did not expose migration: %s", stdout)
-		}
-		body, readErr := os.ReadFile(filepath.Join(home, multiMiscSkill, "SKILL.md"))
-		if readErr != nil || !strings.Contains(string(body), "dws event") {
-			t.Fatalf("dry run changed folded misc: body=%q err=%v", body, readErr)
-		}
-		if _, statErr := os.Stat(filepath.Join(home, multiEventSkill)); !os.IsNotExist(statErr) {
-			t.Fatalf("dry run installed event, stat err=%v", statErr)
-		}
-	})
-
-	t.Run("excluding required misc fails before writes", func(t *testing.T) {
-		home := filepath.Join(t.TempDir(), "skills")
-		writeFoldedEventMisc(t, home)
-		_, _, err := executeMultiSkillSetupTest(t, src, []string{home}, "--exclude", "misc", "--yes")
-		if err == nil || !strings.Contains(err.Error(), "不能显式 --exclude misc") {
-			t.Fatalf("expected clear migration exclusion error, got %v", err)
-		}
-		if _, statErr := os.Stat(filepath.Join(home, multiEventSkill)); !os.IsNotExist(statErr) {
-			t.Fatalf("failed migration installed event, stat err=%v", statErr)
-		}
-		body, readErr := os.ReadFile(filepath.Join(home, multiMiscSkill, "SKILL.md"))
-		if readErr != nil || !strings.Contains(string(body), "dws event") {
-			t.Fatalf("failed migration changed misc: body=%q err=%v", body, readErr)
-		}
-	})
-}
-
-func TestSkillSetupEventMigrationRequiresCleanMiscInSource(t *testing.T) {
-	src := writeMultiSkillSource(t, []string{multiEventSkill, multiSharedSkill})
-	home := filepath.Join(t.TempDir(), "skills")
-	writeFoldedEventMisc(t, home)
-
-	_, _, err := executeMultiSkillSetupTest(t, src, []string{home}, "--skill", "event", "--yes")
-	if err == nil || !strings.Contains(err.Error(), "当前 multi 源缺少") {
-		t.Fatalf("expected missing migration companion error, got %v", err)
-	}
-	if _, statErr := os.Stat(filepath.Join(home, multiEventSkill)); !os.IsNotExist(statErr) {
-		t.Fatalf("failed preflight installed event, stat err=%v", statErr)
-	}
-}
-
-func TestSkillSetupEventMigrationAcceptsShippedMultiBundle(t *testing.T) {
-	wd, err := os.Getwd()
-	if err != nil {
-		t.Fatal(err)
-	}
-	src := filepath.Clean(filepath.Join(wd, "..", "..", "skills", "multi"))
-	if err := validateEventMiscMigrationSource(src); err != nil {
-		t.Fatalf("shipped multi bundle is not a valid Event migration source: %v", err)
-	}
-}
-
-func TestSkillSetupEventMigrationRejectsInvalidSkillBundlesBeforeWrites(t *testing.T) {
-	tests := []struct {
-		name   string
-		mutate func(t *testing.T, src string)
-	}{
-		{
-			name: "empty event root",
-			mutate: func(t *testing.T, src string) {
-				t.Helper()
-				if err := os.WriteFile(filepath.Join(src, multiEventSkill, "SKILL.md"), nil, 0o644); err != nil {
-					t.Fatal(err)
-				}
-			},
-		},
-		{
-			name: "wrong event name",
-			mutate: func(t *testing.T, src string) {
-				t.Helper()
-				body := "---\nname: dingtalk-chat\ndescription: wrong skill\n---\n\n# Wrong\n"
-				if err := os.WriteFile(filepath.Join(src, multiEventSkill, "SKILL.md"), []byte(body), 0o644); err != nil {
-					t.Fatal(err)
-				}
-			},
-		},
-		{
-			name: "missing event reference",
-			mutate: func(t *testing.T, src string) {
-				t.Helper()
-				if err := os.Remove(filepath.Join(src, multiEventSkill, "references", "event-oa.md")); err != nil {
-					t.Fatal(err)
-				}
-			},
-		},
-		{
-			name: "empty event reference",
-			mutate: func(t *testing.T, src string) {
-				t.Helper()
-				if err := os.WriteFile(filepath.Join(src, multiEventSkill, "references", "event-im.md"), nil, 0o644); err != nil {
-					t.Fatal(err)
-				}
-			},
-		},
-		{
-			name: "wrong misc name",
-			mutate: func(t *testing.T, src string) {
-				t.Helper()
-				body := "---\nname: dingtalk-event\ndescription: wrong skill\n---\n\n# Wrong\n"
-				if err := os.WriteFile(filepath.Join(src, multiMiscSkill, "SKILL.md"), []byte(body), 0o644); err != nil {
-					t.Fatal(err)
-				}
-			},
-		},
-	}
-
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			src := writeMultiSkillSource(t, []string{multiEventSkill, multiSharedSkill, multiMiscSkill})
-			test.mutate(t, src)
-			home := filepath.Join(t.TempDir(), "skills")
-			writeFoldedEventMisc(t, home)
-			writeOldStandaloneEvent(t, home)
-
-			stdout, _, err := executeMultiSkillSetupTest(t, src, []string{home}, "--skill", "event", "--yes")
-			if err == nil || !strings.Contains(err.Error(), "迁移源无效") {
-				t.Fatalf("invalid migration source was accepted: %v", err)
-			}
-			if strings.Contains(stdout, "Skill 安装完成") {
-				t.Fatalf("invalid migration source reported success: %s", stdout)
-			}
-			assertOldEventMiscPair(t, home)
-			if _, statErr := os.Stat(filepath.Join(home, multiSharedSkill)); !os.IsNotExist(statErr) {
-				t.Fatalf("invalid source wrote shared skill: %v", statErr)
-			}
-		})
-	}
-}
-
-func TestSkillSetupSelectiveEventPreservesFoldedMiscAfterPrimarySkip(t *testing.T) {
-	src := writeMultiSkillSource(t, []string{multiEventSkill, multiSharedSkill, multiMiscSkill})
-	home := filepath.Join(t.TempDir(), "skills")
-	writeFoldedEventMisc(t, home)
-
-	originalInstallMulti := skillSetupInstallMulti
-	t.Cleanup(func() { skillSetupInstallMulti = originalInstallMulti })
-	calls := 0
-	skillSetupInstallMulti = func(string, []string, []string, io.Writer, io.Writer) (int, int, error) {
-		calls++
-		if calls > 1 {
-			t.Fatal("misc migration companion ran after a primary install skip")
-		}
-		return 1, 1, nil
-	}
-
-	stdout, _, err := executeMultiSkillSetupTest(t, src, []string{home}, "--skill", "event", "--yes")
-	if err == nil || !strings.Contains(err.Error(), "已保留折叠版 Event/misc") {
-		t.Fatalf("expected preserved-fallback error, got %v", err)
-	}
-	if calls != 1 {
-		t.Fatalf("install calls = %d, want 1", calls)
-	}
-	if strings.Contains(stdout, "Skill 安装完成") {
-		t.Fatalf("partial migration reported success: %s", stdout)
-	}
-	body, readErr := os.ReadFile(filepath.Join(home, multiMiscSkill, "SKILL.md"))
-	if readErr != nil || !strings.Contains(string(body), "dws event") {
-		t.Fatalf("primary skip changed folded misc: body=%q err=%v", body, readErr)
-	}
-	if _, statErr := os.Stat(filepath.Join(home, multiMiscSkill, "references", "event.md")); statErr != nil {
-		t.Fatalf("primary skip removed folded Event reference: %v", statErr)
-	}
-}
-
-func TestSkillSetupFreshTargetFailureDoesNotTouchFoldedPair(t *testing.T) {
-	src := writeMultiSkillSource(t, []string{multiEventSkill, multiSharedSkill, multiMiscSkill})
-	freshHome := filepath.Join(t.TempDir(), "fresh", "skills")
-	foldedHome := filepath.Join(t.TempDir(), "folded", "skills")
-	writeFoldedEventMisc(t, foldedHome)
-	writeOldStandaloneEvent(t, foldedHome)
-
-	originalInstallMulti := skillSetupInstallMulti
-	t.Cleanup(func() { skillSetupInstallMulti = originalInstallMulti })
-	calls := 0
-	skillSetupInstallMulti = func(string, []string, []string, io.Writer, io.Writer) (int, int, error) {
-		calls++
-		if calls > 1 {
-			t.Fatal("folded target prerequisites ran after fresh target failure")
-		}
-		return 1, 1, nil
-	}
-
-	stdout, _, err := executeMultiSkillSetupTest(
-		t,
-		src,
-		[]string{foldedHome, freshHome},
-		"--skill", "event",
-		"--yes",
-	)
-	if err == nil || !strings.Contains(err.Error(), "已保留折叠版 Event/misc") {
-		t.Fatalf("fresh target failure did not block migration: %v", err)
-	}
-	if strings.Contains(stdout, "Skill 安装完成") {
-		t.Fatalf("partial mixed-target install reported success: %s", stdout)
-	}
-	assertOldEventMiscPair(t, foldedHome)
-	assertNoEventMigrationStages(t, foldedHome)
-}
-
-func TestSkillSetupUnrelatedSelectiveInstallLeavesFoldedPairUntouched(t *testing.T) {
-	src := writeMultiSkillSource(t, []string{
-		multiEventSkill, multiSharedSkill, multiMiscSkill, "dingtalk-doc",
-	})
-	home := filepath.Join(t.TempDir(), "skills")
-	writeFoldedEventMisc(t, home)
-	writeOldStandaloneEvent(t, home)
-
-	stdout, stderr, err := executeMultiSkillSetupTest(t, src, []string{home}, "--skill", "doc", "--yes")
-	if err != nil {
-		t.Fatalf("unrelated selective install failed: %v\nstdout=%s\nstderr=%s", err, stdout, stderr)
-	}
-	if strings.Contains(stdout, "Event Skill 迁移") || strings.Contains(stdout, "Event 原子迁移") {
-		t.Fatalf("unrelated selective install planned Event migration: %s", stdout)
-	}
-	if _, err := os.Stat(filepath.Join(home, "dingtalk-doc", "SKILL.md")); err != nil {
-		t.Fatalf("selected doc was not installed: %v", err)
-	}
-	assertOldEventMiscPair(t, home)
-	assertNoEventMigrationStages(t, home)
-}
-
-func TestSkillSetupSelectiveEventAtomicStageFailurePreservesFoldedPair(t *testing.T) {
-	src := writeMultiSkillSource(t, []string{multiEventSkill, multiSharedSkill, multiMiscSkill})
-	home := filepath.Join(t.TempDir(), "skills")
-	writeFoldedEventMisc(t, home)
-
-	originalCopyDir := skillSetupCopyDir
-	t.Cleanup(func() { skillSetupCopyDir = originalCopyDir })
-	skillSetupCopyDir = func(src, dest string) error {
-		if strings.HasSuffix(dest, "new-misc") {
-			return errors.New("injected stage failure")
-		}
-		return originalCopyDir(src, dest)
-	}
-
-	stdout, _, err := executeMultiSkillSetupTest(t, src, []string{home}, "--skill", "event", "--yes")
-	if err == nil || !strings.Contains(err.Error(), "预备 dingtalk-misc 失败") {
-		t.Fatalf("expected atomic staging error, got %v", err)
-	}
-	if strings.Contains(stdout, "Skill 安装完成") {
-		t.Fatalf("partial atomic migration reported success: %s", stdout)
-	}
-	body, readErr := os.ReadFile(filepath.Join(home, multiMiscSkill, "SKILL.md"))
-	if readErr != nil || !strings.Contains(string(body), "dws event") {
-		t.Fatalf("stage failure changed folded misc: body=%q err=%v", body, readErr)
-	}
-	if _, statErr := os.Stat(filepath.Join(home, multiEventSkill)); !os.IsNotExist(statErr) {
-		t.Fatalf("stage failure installed standalone event, stat err=%v", statErr)
-	}
-}
-
-func TestSkillSetupEventMigrationPreparationFailuresPreserveFoldedPair(t *testing.T) {
-	t.Run("same-filesystem staging creation", func(t *testing.T) {
-		src := writeMultiSkillSource(t, []string{multiEventSkill, multiSharedSkill, multiMiscSkill})
-		home := filepath.Join(t.TempDir(), "skills")
-		writeFoldedEventMisc(t, home)
-		writeOldStandaloneEvent(t, home)
-
-		originalMkdirTemp := skillSetupMkdirTemp
-		t.Cleanup(func() { skillSetupMkdirTemp = originalMkdirTemp })
-		skillSetupMkdirTemp = func(dir, pattern string) (string, error) {
-			if dir != home {
-				t.Fatalf("staging dir = %s, want target filesystem root %s", dir, home)
-			}
-			return "", errors.New("injected mkdir-temp failure")
-		}
-
-		_, _, err := executeMultiSkillSetupTest(t, src, []string{home}, "--skill", "event", "--yes")
-		if err == nil || !strings.Contains(err.Error(), "injected mkdir-temp failure") {
-			t.Fatalf("staging creation failure was not returned: %v", err)
-		}
-		assertOldEventMiscPair(t, home)
-		assertNoEventMigrationStages(t, home)
-	})
-
-	t.Run("event staging copy", func(t *testing.T) {
-		src := writeMultiSkillSource(t, []string{multiEventSkill, multiSharedSkill, multiMiscSkill})
-		home := filepath.Join(t.TempDir(), "skills")
-		writeFoldedEventMisc(t, home)
-		writeOldStandaloneEvent(t, home)
-
-		originalCopyDir := skillSetupCopyDir
-		t.Cleanup(func() { skillSetupCopyDir = originalCopyDir })
-		skillSetupCopyDir = func(src, dest string) error {
-			if strings.HasSuffix(dest, "new-event") {
-				return errors.New("injected event copy failure")
-			}
-			return originalCopyDir(src, dest)
-		}
-
-		_, _, err := executeMultiSkillSetupTest(t, src, []string{home}, "--skill", "event", "--yes")
-		if err == nil || !strings.Contains(err.Error(), "injected event copy failure") {
-			t.Fatalf("event staging failure was not returned: %v", err)
-		}
-		assertOldEventMiscPair(t, home)
-		assertNoEventMigrationStages(t, home)
-	})
-}
-
-func TestSkillSetupSelectiveEventRejectsCorruptStagedMisc(t *testing.T) {
-	src := writeMultiSkillSource(t, []string{multiEventSkill, multiSharedSkill, multiMiscSkill})
-	home := filepath.Join(t.TempDir(), "skills")
-	writeFoldedEventMisc(t, home)
-
-	originalCopyDir := skillSetupCopyDir
-	t.Cleanup(func() { skillSetupCopyDir = originalCopyDir })
-	skillSetupCopyDir = func(src, dest string) error {
-		if err := originalCopyDir(src, dest); err != nil {
-			return err
-		}
-		if strings.HasSuffix(dest, "new-misc") {
-			return os.WriteFile(filepath.Join(dest, "references", "event-partial.md"), []byte("corrupt\n"), 0o644)
-		}
-		return nil
-	}
-
-	_, _, err := executeMultiSkillSetupTest(t, src, []string{home}, "--skill", "event", "--yes")
-	if err == nil || !strings.Contains(err.Error(), "staging 验证失败") {
-		t.Fatalf("corrupt staged misc was accepted: %v", err)
-	}
-	miscBody, readErr := os.ReadFile(filepath.Join(home, multiMiscSkill, "SKILL.md"))
-	if readErr != nil || !strings.Contains(string(miscBody), "dws event") {
-		t.Fatalf("staging validation failure changed folded misc: body=%q err=%v", miscBody, readErr)
-	}
-	if _, err := os.Stat(filepath.Join(home, multiEventSkill)); !os.IsNotExist(err) {
-		t.Fatalf("staging validation failure installed event: %v", err)
-	}
-	assertNoEventMigrationStages(t, home)
-}
-
-func TestSkillSetupSelectiveEventRejectsIncompleteStagedEvent(t *testing.T) {
-	src := writeMultiSkillSource(t, []string{multiEventSkill, multiSharedSkill, multiMiscSkill})
-	home := filepath.Join(t.TempDir(), "skills")
-	writeFoldedEventMisc(t, home)
-	writeOldStandaloneEvent(t, home)
-
-	originalCopyDir := skillSetupCopyDir
-	t.Cleanup(func() { skillSetupCopyDir = originalCopyDir })
-	skillSetupCopyDir = func(src, dest string) error {
-		if err := originalCopyDir(src, dest); err != nil {
-			return err
-		}
-		if strings.HasSuffix(dest, "new-event") {
-			return os.Remove(filepath.Join(dest, "references", "event-oa.md"))
-		}
-		return nil
-	}
-
-	_, _, err := executeMultiSkillSetupTest(t, src, []string{home}, "--skill", "event", "--yes")
-	if err == nil || !strings.Contains(err.Error(), "staging 验证失败") {
-		t.Fatalf("incomplete staged Event was accepted: %v", err)
-	}
-	assertOldEventMiscPair(t, home)
-	assertNoEventMigrationStages(t, home)
-}
-
-func TestSkillSetupFullEventMigrationIsAtomicAndPreservesSiblings(t *testing.T) {
-	src := writeMultiSkillSource(t, []string{
-		multiEventSkill, multiSharedSkill, multiMiscSkill, "dingtalk-doc",
-	})
-	home := filepath.Join(t.TempDir(), "skills")
-	writeFoldedEventMisc(t, home)
-	writeOldStandaloneEvent(t, home)
-	sibling := filepath.Join(home, "dingtalk-private-sibling")
-	if err := os.MkdirAll(sibling, 0o755); err != nil {
-		t.Fatal(err)
-	}
-	if err := os.WriteFile(filepath.Join(sibling, "SKILL.md"), []byte("keep\n"), 0o644); err != nil {
-		t.Fatal(err)
-	}
-
-	stdout, stderr, err := executeMultiSkillSetupTest(t, src, []string{home}, "--yes")
-	if err != nil {
-		t.Fatalf("full setup migration failed: %v\nstdout=%s\nstderr=%s", err, stdout, stderr)
-	}
-	if !strings.Contains(stdout, "Event 原子迁移") || !strings.Contains(stdout, "Skill 安装完成") {
-		t.Fatalf("full setup did not report atomic migration success: %s", stdout)
-	}
-	for _, name := range []string{multiEventSkill, multiMiscSkill, multiSharedSkill, "dingtalk-doc"} {
-		if _, err := os.Stat(filepath.Join(home, name, "SKILL.md")); err != nil {
-			t.Fatalf("full setup missing %s: %v", name, err)
-		}
-	}
-	if _, err := os.Stat(filepath.Join(home, multiMiscSkill, "references", "event.md")); !os.IsNotExist(err) {
-		t.Fatalf("full setup retained folded Event reference: %v", err)
-	}
-	body, err := os.ReadFile(filepath.Join(sibling, "SKILL.md"))
-	if err != nil || string(body) != "keep\n" {
-		t.Fatalf("full setup changed unrelated sibling: body=%q err=%v", body, err)
-	}
-	assertNoEventMigrationStages(t, home)
-}
-
-func TestSkillSetupEventMigrationWithoutSharedStillCleansMonoLeftover(t *testing.T) {
-	src := writeMultiSkillSource(t, []string{multiEventSkill, multiMiscSkill})
-	home := filepath.Join(t.TempDir(), "skills")
-	writeFoldedEventMisc(t, home)
-	monoLeftover := filepath.Join(home, "dws")
-	if err := os.MkdirAll(monoLeftover, 0o755); err != nil {
-		t.Fatal(err)
-	}
-	if err := os.WriteFile(filepath.Join(monoLeftover, "SKILL.md"), []byte("old mono\n"), 0o644); err != nil {
-		t.Fatal(err)
-	}
-
-	stdout, stderr, err := executeMultiSkillSetupTest(t, src, []string{home}, "--skill", "event", "--yes")
-	if err != nil {
-		t.Fatalf("migration without shared failed: %v\nstdout=%s\nstderr=%s", err, stdout, stderr)
-	}
-	if _, err := os.Stat(monoLeftover); !os.IsNotExist(err) {
-		t.Fatalf("migration without prerequisites retained mono leftover: %v", err)
-	}
-	for _, name := range []string{multiEventSkill, multiMiscSkill} {
-		if _, err := os.Stat(filepath.Join(home, name, "SKILL.md")); err != nil {
-			t.Fatalf("migration without shared missing %s: %v", name, err)
-		}
-	}
-	assertNoEventMigrationStages(t, home)
-}
-
-func TestSkillSetupFoldedEventMigrationSelectionPreflight(t *testing.T) {
-	src := writeMultiSkillSource(t, []string{
-		multiEventSkill, multiSharedSkill, multiMiscSkill, "dingtalk-doc",
-	})
-	tests := []struct {
-		name string
-		args []string
-		want string
-	}{
-		{name: "misc only", args: []string{"--skill", "misc", "--yes"}, want: "不能只覆盖 dingtalk-misc"},
-		{name: "explicitly excludes event", args: []string{"--exclude", "event", "--yes"}, want: "不能显式 --exclude event"},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			home := filepath.Join(t.TempDir(), "skills")
-			writeFoldedEventMisc(t, home)
-			_, _, err := executeMultiSkillSetupTest(t, src, []string{home}, tt.args...)
-			if err == nil || !strings.Contains(err.Error(), tt.want) {
-				t.Fatalf("preflight error = %v, want %q", err, tt.want)
-			}
-			if _, err := os.Stat(filepath.Join(home, multiSharedSkill)); !os.IsNotExist(err) {
-				t.Fatalf("preflight failure wrote shared skill: %v", err)
-			}
-			if _, err := os.Stat(filepath.Join(home, multiEventSkill)); !os.IsNotExist(err) {
-				t.Fatalf("preflight failure wrote event skill: %v", err)
-			}
-			miscBody, readErr := os.ReadFile(filepath.Join(home, multiMiscSkill, "SKILL.md"))
-			if readErr != nil || !strings.Contains(string(miscBody), "dws event") {
-				t.Fatalf("preflight failure changed folded misc: body=%q err=%v", miscBody, readErr)
-			}
-		})
-	}
-}
-
-func TestSkillSetupEventMigrationRejectsEveryFoldedReferenceVariant(t *testing.T) {
-	for _, filename := range []string{"event.md", "event-im.md", "event-oa.md", "EVENT-legacy.MD"} {
-		t.Run(filename, func(t *testing.T) {
-			src := writeMultiSkillSource(t, []string{multiEventSkill, multiSharedSkill, multiMiscSkill})
-			if err := os.WriteFile(filepath.Join(src, multiMiscSkill, "references", filename), []byte("stale\n"), 0o644); err != nil {
-				t.Fatal(err)
-			}
-			home := filepath.Join(t.TempDir(), "skills")
-			writeFoldedEventMisc(t, home)
-
-			_, _, err := executeMultiSkillSetupTest(t, src, []string{home}, "--skill", "event", "--yes")
-			if err == nil || !strings.Contains(err.Error(), "仍存在折叠 Event 参考页") {
-				t.Fatalf("source with %s was accepted: %v", filename, err)
-			}
-			if _, err := os.Stat(filepath.Join(home, multiSharedSkill)); !os.IsNotExist(err) {
-				t.Fatalf("invalid source wrote shared skill: %v", err)
-			}
-		})
-	}
-}
-
-func TestSkillSetupEventMigrationRenameFailuresRollbackPair(t *testing.T) {
-	for failAt := 1; failAt <= 4; failAt++ {
-		t.Run(fmt.Sprintf("rename_%d", failAt), func(t *testing.T) {
-			src := writeMultiSkillSource(t, []string{multiEventSkill, multiSharedSkill, multiMiscSkill})
-			home := filepath.Join(t.TempDir(), "skills")
-			writeFoldedEventMisc(t, home)
-			writeOldStandaloneEvent(t, home)
-
-			originalRename := skillSetupRename
-			t.Cleanup(func() { skillSetupRename = originalRename })
-			renameCalls := 0
-			skillSetupRename = func(oldPath, newPath string) error {
-				renameCalls++
-				if renameCalls == failAt {
-					return errors.New("injected rename failure")
-				}
-				return originalRename(oldPath, newPath)
-			}
-
-			stdout, _, err := executeMultiSkillSetupTest(t, src, []string{home}, "--skill", "event", "--yes")
-			if err == nil || !strings.Contains(err.Error(), "injected rename failure") {
-				t.Fatalf("rename failure %d was not returned: %v", failAt, err)
-			}
-			if strings.Contains(stdout, "Skill 安装完成") {
-				t.Fatalf("rename failure %d reported success: %s", failAt, stdout)
-			}
-			assertOldEventMiscPair(t, home)
-			assertNoEventMigrationStages(t, home)
-		})
-	}
-}
-
-func TestSkillSetupEventMigrationFailureRollsBackEarlierTargets(t *testing.T) {
-	src := writeMultiSkillSource(t, []string{multiEventSkill, multiSharedSkill, multiMiscSkill})
-	root := t.TempDir()
-	firstHome := filepath.Join(root, "a", "skills")
-	secondHome := filepath.Join(root, "b", "skills")
-	for _, home := range []string{firstHome, secondHome} {
-		writeFoldedEventMisc(t, home)
-		writeOldStandaloneEvent(t, home)
-	}
-
-	originalRename := skillSetupRename
-	t.Cleanup(func() { skillSetupRename = originalRename })
-	failed := false
-	skillSetupRename = func(oldPath, newPath string) error {
-		if !failed && oldPath == filepath.Join(secondHome, multiMiscSkill) {
-			failed = true
-			return errors.New("second target failure")
-		}
-		return originalRename(oldPath, newPath)
-	}
-
-	_, _, err := executeMultiSkillSetupTest(t, src, []string{secondHome, firstHome}, "--skill", "event", "--yes")
-	if err == nil || !strings.Contains(err.Error(), "second target failure") {
-		t.Fatalf("second target failure was not returned: %v", err)
-	}
-	for _, home := range []string{firstHome, secondHome} {
-		assertOldEventMiscPair(t, home)
-		assertNoEventMigrationStages(t, home)
-	}
-}
-
-func TestSkillSetupEventMigrationRollbackFailurePreservesRecoveryDirectory(t *testing.T) {
-	src := writeMultiSkillSource(t, []string{multiEventSkill, multiSharedSkill, multiMiscSkill})
-	home := filepath.Join(t.TempDir(), "skills")
-	writeFoldedEventMisc(t, home)
-	writeOldStandaloneEvent(t, home)
-
-	originalRename := skillSetupRename
-	t.Cleanup(func() { skillSetupRename = originalRename })
-	skillSetupRename = func(oldPath, newPath string) error {
-		if strings.HasSuffix(oldPath, filepath.Join("new-misc")) && newPath == filepath.Join(home, multiMiscSkill) {
-			return errors.New("commit failure")
-		}
-		if strings.HasSuffix(oldPath, filepath.Join("old-misc")) && newPath == filepath.Join(home, multiMiscSkill) {
-			return errors.New("rollback restore failure")
-		}
-		return originalRename(oldPath, newPath)
-	}
-
-	_, stderr, err := executeMultiSkillSetupTest(t, src, []string{home}, "--skill", "event", "--yes")
-	if err == nil || !strings.Contains(err.Error(), "回滚不完整") || !strings.Contains(err.Error(), "恢复目录") {
-		t.Fatalf("rollback failure did not expose recovery directory: %v", err)
-	}
-	entries, readErr := os.ReadDir(home)
-	if readErr != nil {
-		t.Fatal(readErr)
-	}
-	var recoveryRoot string
-	for _, entry := range entries {
-		if strings.HasPrefix(entry.Name(), ".dws-event-migration-") {
-			recoveryRoot = filepath.Join(home, entry.Name())
-			break
-		}
-	}
-	if recoveryRoot == "" {
-		t.Fatal("rollback failure deleted the only recovery directory")
-	}
-	if !strings.Contains(err.Error(), recoveryRoot) || !strings.Contains(stderr, recoveryRoot) {
-		t.Fatalf("recovery directory was not reported: err=%v stderr=%s", err, stderr)
-	}
-	if _, err := os.Stat(filepath.Join(recoveryRoot, "old-misc", "SKILL.md")); err != nil {
-		t.Fatalf("old folded misc backup is missing from recovery directory: %v", err)
-	}
-	if _, err := os.Stat(filepath.Join(recoveryRoot, "old-event", "SKILL.md")); err != nil {
-		t.Fatalf("old standalone Event backup is missing from recovery directory: %v", err)
-	}
-	if _, err := os.Stat(filepath.Join(home, multiEventSkill, "SKILL.md")); err != nil {
-		t.Fatalf("rollback failure removed the live standalone Event entry: %v", err)
-	}
-}
-
-func TestSkillSetupEventMigrationRollbackFailureKeepsNewEventWithoutOldStandalone(t *testing.T) {
-	src := writeMultiSkillSource(t, []string{multiEventSkill, multiSharedSkill, multiMiscSkill})
-	home := filepath.Join(t.TempDir(), "skills")
-	writeFoldedEventMisc(t, home)
-
-	originalRename := skillSetupRename
-	t.Cleanup(func() { skillSetupRename = originalRename })
-	skillSetupRename = func(oldPath, newPath string) error {
-		if strings.HasSuffix(oldPath, filepath.Join("new-misc")) && newPath == filepath.Join(home, multiMiscSkill) {
-			return errors.New("commit failure")
-		}
-		if strings.HasSuffix(oldPath, filepath.Join("old-misc")) && newPath == filepath.Join(home, multiMiscSkill) {
-			return errors.New("rollback restore failure")
-		}
-		return originalRename(oldPath, newPath)
-	}
-
-	_, _, err := executeMultiSkillSetupTest(t, src, []string{home}, "--skill", "event", "--yes")
-	if err == nil || !strings.Contains(err.Error(), "回滚不完整") {
-		t.Fatalf("rollback failure was not returned: %v", err)
-	}
-	if _, statErr := os.Stat(filepath.Join(home, multiEventSkill, "SKILL.md")); statErr != nil {
-		t.Fatalf("rollback failure removed the only live Event entry: %v", statErr)
-	}
-	entries, readErr := os.ReadDir(home)
-	if readErr != nil {
-		t.Fatal(readErr)
-	}
-	for _, entry := range entries {
-		if !strings.HasPrefix(entry.Name(), ".dws-event-migration-") {
-			continue
-		}
-		if _, statErr := os.Stat(filepath.Join(home, entry.Name(), "old-misc", "SKILL.md")); statErr != nil {
-			t.Fatalf("rollback failure lost the folded misc recovery copy: %v", statErr)
-		}
-		return
-	}
-	t.Fatal("rollback failure did not preserve a recovery directory")
-}
@@ -44,10 +44,6 @@ import (
 // test binary never launches a page on the developer's machine; tests that
 // need to assert the URL can still replace openBrowserFunc locally.
 func TestMain(m *testing.M) {
-	if code, ok := runRuntimeTokenDetachedE2EChild(); ok {
-		os.Exit(code)
-	}
-
 	tmpDir, err := os.MkdirTemp("", "dws-app-test-keychain-")
 	if err != nil {
 		panic("create test keychain tempdir: " + err.Error())
@@ -1,40 +0,0 @@
-// Copyright 2026 Alibaba Group
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-
-package auth
-
-import "testing"
-
-func TestCrossPlatformCoverageResolveProfileMetadataUsesSelectorGrammarAndReturnsCopy(t *testing.T) {
-	cfg := &ProfilesConfig{
-		Version: 3,
-		Profiles: []Profile{
-			{Name: "Historical", CorpID: "corp-1", CorpName: "Example Org"},
-			{Name: "Exact", CorpID: "corp-1", CorpName: "Example Org", UserID: "user-1", UserName: "Example User", ClientID: "client-1"},
-		},
-		OrgCurrentProfiles: map[string]string{"corp-1": "corp-1:user-1"},
-	}
-
-	for _, selector := range []string{"corp-1", "Example Org", "corp-1:Example User", "Example Org:Example User"} {
-		profile, err := ResolveProfileMetadata(cfg, selector)
-		if err != nil {
-			t.Fatalf("ResolveProfileMetadata(%q) error = %v", selector, err)
-		}
-		if profile == nil || profile.UserID != "user-1" || profile.ClientID != "client-1" {
-			t.Fatalf("ResolveProfileMetadata(%q) = %#v", selector, profile)
-		}
-	}
-
-	profile, err := ResolveProfileMetadata(cfg, "corp-1:user-1")
-	if err != nil {
-		t.Fatalf("ResolveProfileMetadata(exact) error = %v", err)
-	}
-	profile.Name = "mutated copy"
-	if cfg.Profiles[1].Name != "Exact" {
-		t.Fatalf("ResolveProfileMetadata returned registry-owned pointer")
-	}
-	if _, err := ResolveProfileMetadata(cfg, "missing"); err == nil {
-		t.Fatal("ResolveProfileMetadata(missing) unexpectedly succeeded")
-	}
-}
@@ -738,20 +738,6 @@ func ResolveProfileWithScope(configDir, selector string) (*Profile, bool, error)
 	return result, exact, err
 }

-// ResolveProfileMetadata applies the public profile-selector grammar to an
-// already-loaded, non-sensitive profiles registry. It performs no migration,
-// keychain access, token loading, or persistence, making it suitable for
-// callers that carry an externally managed bearer credential and need only
-// corp/user/client identity metadata.
-func ResolveProfileMetadata(cfg *ProfilesConfig, selector string) (*Profile, error) {
-	profile, _, err := resolveProfileSelection("", cfg, selector)
-	if err != nil || profile == nil {
-		return nil, err
-	}
-	copy := *profile
-	return &copy, nil
-}
-
 func resolveProfileWithScopeLocked(configDir, selector string) (*Profile, bool, error) {
 	if err := profilesEnsureMigration(configDir); err != nil {
 		return nil, false, err
@@ -2003,6 +2003,7 @@ var generatedParamAliases = []ParamAliasEntry{
 			"next-page-token": "cursor",
 			"next-token":      "cursor",
 			"node-id":         "node",
+			"page-size":       "limit",
 			"page-token":      "cursor",
 			"per-page":        "limit",
 			"size":            "limit",
@@ -2458,15 +2459,25 @@ var generatedParamAliases = []ParamAliasEntry{
 	{
 		CLIPath: "doc +version-list",
 		Aliases: map[string]string{
-			"doc":         "node",
-			"doc-id":      "node",
-			"document-id": "node",
-			"file-id":     "node",
-			"node-id":     "node",
-			"url":         "node",
+			"doc":             "node",
+			"doc-id":          "node",
+			"document-id":     "node",
+			"file-id":         "node",
+			"max-result":      "limit",
+			"max-results":     "limit",
+			"next-cursor":     "cursor",
+			"next-page-token": "cursor",
+			"next-token":      "cursor",
+			"node-id":         "node",
+			"page-size":       "limit",
+			"page-token":      "cursor",
+			"per-page":        "limit",
+			"size":            "limit",
+			"take":            "limit",
+			"top":             "limit",
+			"url":             "node",
 		},
-		Blocked:   []string{"block-id", "comment-id", "comment-key", "folder", "folder-id", "id", "job-id", "parent-id", "revision", "task-id", "template-id", "version", "workspace", "workspace-id"},
-		Ambiguous: []string{"max-result", "max-results", "next-cursor", "next-page-token", "next-token", "per-page", "size", "take", "top"},
+		Blocked: []string{"block-id", "comment-id", "comment-key", "count", "folder", "folder-id", "id", "job-id", "offset", "page", "parent-id", "revision", "task-id", "template-id", "version", "workspace", "workspace-id"},
 	},
 	{
 		CLIPath: "doc +version-revert",
@@ -44,7 +44,6 @@
  },

  "command_overrides": {
-	"doc +version-list": {"ambiguous": ["size", "max-results", "max-result", "take", "top", "per-page", "next-cursor", "next-token", "next-page-token"], "note": "--limit/--cursor and the shipped visible compatibility flags --page-size/--page-token remain native. Other pagination spellings cannot choose between two visible real flags and must stop before execution."},
    "chat group rename": {"bind": {"id": "open_conversation_id"}, "note": "This command's real --id carries one openConversationId; aliases reduce to --id without changing the value."},
    "chat group members": {"bind": {"id": "open_conversation_id"}},
    "chat group members add": {"bind": {"id": "open_conversation_id"}, "block": ["user-id", "open-dingtalk-id"], "note": "The real --users is a list and may contain mixed userId/openDingTalkId values; singular inputs are not promoted automatically."},
@@ -256,10 +256,6 @@ var reviewedSchemaParameterMappingExclusions = map[string]string{
 	"chat.list_conversation_message_v2 --open-dingtalk-id":               "selects the alternate list_individual_chat_message branch",
 	"chat.list_conversation_message_v2 --user":                           "selects the alternate list_individual_chat_message branch",
 	"chat.list_message_favorites --cursor":                               "Reviewed unpinned adapter: chat.list_message_favorites has no singular pinned interface_ref; --cursor is a CLI wrapper input and does not publish a direct interface property.",
-	"chat.list_message_favorites --max-items":                            "Reviewed helper-only pagination control: --max-items caps aggregated CLI output for chat.list_message_favorites and is not sent to the remote adapter.",
-	"chat.list_message_favorites --page-all":                             "Reviewed helper-only pagination control: --page-all enables CLI-side looping for chat.list_message_favorites and is not sent to the remote adapter.",
-	"chat.list_message_favorites --page-delay":                           "Reviewed helper-only pagination control: --page-delay controls local delay between chat.list_message_favorites pages and is not sent to the remote adapter.",
-	"chat.list_message_favorites --page-limit":                           "Reviewed helper-only pagination control: --page-limit caps CLI-side page fetches for chat.list_message_favorites and is not sent to the remote adapter.",
 	"chat.list_message_favorites --size":                                 "Reviewed unpinned adapter: chat.list_message_favorites has no singular pinned interface_ref; --size is a CLI wrapper input and does not publish a direct interface property.",
 	"chat.query_msg_read_status --user":                                  "conditional wrapper: parseCSVValues + appendChatIDArgs routes each supplied identifier to targetUserIds or targetOpenDingTalkIds according to its runtime ID shape; there is no single RPC property for this flag",
 	"chat.query_msg_read_status --users":                                 "conditional wrapper/alias of --user: parseCSVValues + appendChatIDArgs routes each supplied identifier to targetUserIds or targetOpenDingTalkIds according to its runtime ID shape; there is no single RPC property for this flag",
@@ -558,18 +558,6 @@ func RegisterFlags(cmd *cobra.Command, flags []FlagSpec) {
 		for _, alias := range flag.Aliases {
 			RegisterFlag(cmd, flag.Kind, alias, "", flag.Usage+" (alias)")
 			_ = cmd.Flags().MarkHidden(alias)
-			if registered := cmd.Flags().Lookup(alias); registered != nil {
-				runtimeannotate.SetFlagAnnotation(
-					registered,
-					runtimeannotate.AnnotationFlagAliasOf,
-					flag.Name,
-				)
-				runtimeannotate.SetFlagAnnotation(
-					registered,
-					runtimeannotate.AnnotationFlagAliasOrigin,
-					runtimeannotate.FlagAliasOriginCorecmdV1,
-				)
-			}
 		}
 		if flag.MarkRequired {
 			_ = cmd.MarkFlagRequired(flag.Name)
@@ -90,17 +90,11 @@ func TestCrossPlatformCoverageRegisterFlagsAllKinds(t *testing.T) {
 		}
 	}
 	// Aliases are registered with the main kind and hidden.
-	for alias, canonical := range map[string]string{"i-alias": "i", "sl-alias": "sl"} {
+	for _, alias := range []string{"i-alias", "sl-alias"} {
 		f := cmd.Flags().Lookup(alias)
 		if f == nil || !f.Hidden {
 			t.Fatalf("alias %q = %#v, want registered+hidden", alias, f)
 		}
-		if got := f.Annotations[runtimeannotate.AnnotationFlagAliasOf]; len(got) != 1 || got[0] != canonical {
-			t.Fatalf("alias %q annotation = %#v, want alias_of %q", alias, got, canonical)
-		}
-		if got := f.Annotations[runtimeannotate.AnnotationFlagAliasOrigin]; len(got) != 1 || got[0] != runtimeannotate.FlagAliasOriginCorecmdV1 {
-			t.Fatalf("alias %q origin = %#v, want corecmd FlagSpec marker", alias, got)
-		}
 	}
 	if cmd.Flags().Lookup("i-alias").Value.Type() != "int" {
 		t.Fatal("int alias must be registered as int")
@@ -1,25 +0,0 @@
-// Copyright 2026 Alibaba Group
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package runtimeannotate
-
-// CLI flag alias evidence is kept in this narrow file so the base-owned
-// Interface Snapshot helper can add the protocol constants to an older stable
-// worktree without replacing that revision's complete runtimeannotate package.
-// Only corecmd.FlagSpec.Aliases writes the exact origin; neither field is a
-// Schema synonym or final payload-equivalence proof.
-const (
-	AnnotationFlagAliasOf     = "dws.compat.alias_of"
-	AnnotationFlagAliasOrigin = "dws.compat.alias_origin"
-	FlagAliasOriginCorecmdV1  = "corecmd.flag_spec_aliases.v1"
-)
@@ -41,7 +41,7 @@ func TestCrossPlatformCoverageDiagnosticsAndErrorRenderingEdges(t *testing.T) {
 		t.Fatalf("PrintJSON friendly diagnostics = %q, %v", out.String(), err)
 	}
 	out.Reset()
-	if err := PrintHumanAt(&out, err, VerbosityVerbose); err != nil || !strings.Contains(out.String(), "处理入口") {
+	if err := PrintHumanAt(&out, err, VerbosityVerbose); err != nil || !strings.Contains(out.String(), "开启地址") {
 		t.Fatalf("PrintHuman friendly diagnostics = %q, %v", out.String(), err)
 	}
 	out.Reset()
@@ -19,7 +19,6 @@ import (
 	stderrors "errors"
 	"fmt"
 	"io"
-	"net/url"
 	"strings"
 	"time"

@@ -461,7 +460,7 @@ func PrintHumanAt(w io.Writer, err error, v Verbosity) error {
 			lines = append(lines, tui.Cyan("Hint: "+friendlyHint))
 		}
 		if actionURL != "" {
-			lines = append(lines, tui.White("Action: 处理入口: "+actionURL))
+			lines = append(lines, tui.White("Action: 开启地址: "+actionURL))
 		}
 	}

@@ -541,7 +540,7 @@ func PrintHumanAt(w io.Writer, err error, v Verbosity) error {

 func serverGuidance(diag ServerDiagnostics) (string, string) {
 	friendlyHint := strings.TrimSpace(diag.FriendlyHint)
-	actionURL := safeServerActionURL(diag.ActionURL)
+	actionURL := strings.TrimSpace(diag.ActionURL)
 	if friendlyHint == "" || actionURL == "" {
 		switch diag.ServerErrorCode {
 		case "TOKEN_VERIFIED_FAILED", "CLI_ORG_NOT_AUTHORIZED":
@@ -556,19 +555,6 @@ func serverGuidance(diag ServerDiagnostics) (string, string) {
 	return friendlyHint, actionURL
 }

-func safeServerActionURL(raw string) string {
-	raw = strings.TrimSpace(raw)
-	if raw == "" {
-		return ""
-	}
-	parsed, err := url.Parse(raw)
-	if err != nil || !strings.EqualFold(parsed.Scheme, "https") ||
-		parsed.Hostname() == "" || parsed.User != nil {
-		return ""
-	}
-	return parsed.String()
-}
-
 func category(err error) string {
 	var typed *Error
 	if stderrors.As(err, &typed) {
@@ -336,40 +336,11 @@ func TestCrossPlatformCoveragePrintHumanIncludesServerGuidance(t *testing.T) {
 	if !strings.Contains(got, "Hint: 请联系管理员开通消息搜索权益") {
 		t.Fatalf("expected server guidance in output, got %q", got)
 	}
-	if !strings.Contains(got, "Action: 处理入口: https://example.test/enable-search") {
+	if !strings.Contains(got, "Action: 开启地址: https://example.test/enable-search") {
 		t.Fatalf("expected server action URL in output, got %q", got)
 	}
 }

-func TestCrossPlatformCoverageServerGuidanceSuppressesUnsafeActionURL(t *testing.T) {
-	t.Parallel()
-	for _, actionURL := range []string{
-		"http://example.test/help",
-		"javascript:alert(1)",
-		"https://user:secret@example.test/help",
-		"not a url",
-	} {
-		var human strings.Builder
-		err := NewAPI("server error", WithServerDiag(ServerDiagnostics{
-			FriendlyHint: "保留 Trace ID 后排查",
-			ActionURL:    actionURL,
-		}))
-		if printErr := PrintHuman(&human, err); printErr != nil {
-			t.Fatal(printErr)
-		}
-		if strings.Contains(human.String(), actionURL) || strings.Contains(human.String(), "处理入口") {
-			t.Fatalf("unsafe action URL %q leaked to human output: %q", actionURL, human.String())
-		}
-		var jsonOutput strings.Builder
-		if printErr := PrintJSON(&jsonOutput, err); printErr != nil {
-			t.Fatal(printErr)
-		}
-		if strings.Contains(jsonOutput.String(), `"action_url"`) {
-			t.Fatalf("unsafe action URL %q leaked to JSON output: %q", actionURL, jsonOutput.String())
-		}
-	}
-}
-
 func TestCrossPlatformCoveragePrintJSONIncludesRPCCodeAndData(t *testing.T) {
 	t.Parallel()

@@ -17,7 +17,6 @@ import (

 	dwsevent "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/event"
 	eventlock "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/event/lock"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/event/runtimecred"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/event/transport"
 )

@@ -325,21 +324,6 @@ func TestCrossPlatformCoverageRunStartupAndSourceEdges(t *testing.T) {
 	if err := Run(context.Background(), base); !errors.Is(err, errBusInjected) {
 		t.Fatalf("source error = %v", err)
 	}
-
-	runtimeWorkDir := shortTempDir(t)
-	base.WorkDir = runtimeWorkDir
-	base.IPCEndpoint = dwsevent.IPCEndpoint(
-		runtimeWorkDir,
-		"open",
-		dwsevent.SourceKindPersonalStream,
-		dwsevent.IdentityHash(runtimeWorkDir),
-	)
-	base.Source = edgeSource{start: func(context.Context, dwsevent.EmitFn) error {
-		return runtimecred.ErrRuntimeTokenRejected
-	}}
-	if err := Run(context.Background(), base); !errors.Is(err, runtimecred.ErrRuntimeTokenRejected) {
-		t.Fatalf("runtime source error = %v", err)
-	}
 }

 type scriptedListener struct {
@@ -1,275 +0,0 @@
-package bus
-
-import (
-	"context"
-	"errors"
-	"io"
-	"log/slog"
-	"net"
-	"runtime"
-	"testing"
-	"time"
-
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/event/runtimecred"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/event/transport"
-)
-
-func eventCoreDaemon(broker *runtimecred.Broker) *daemon {
-	return &daemon{
-		cfg:      Config{CredentialBroker: broker, IdleTimeout: time.Second},
-		log:      slog.New(slog.NewTextHandler(io.Discard, nil)),
-		hub:      NewHub(4),
-		started:  time.Now(),
-		idleStop: make(chan struct{}),
-	}
-}
-
-func eventCoreConnection(d *daemon, wrap func(net.Conn) net.Conn) (net.Conn, *transport.Writer, *transport.Reader, <-chan struct{}) {
-	server, client := net.Pipe()
-	if wrap != nil {
-		server = wrap(server)
-	}
-	done := make(chan struct{})
-	go func() {
-		d.handleConnection(context.Background(), server)
-		close(done)
-	}()
-	return client, transport.NewWriter(client), transport.NewReader(client), done
-}
-
-func eventCoreWaitDone(t *testing.T, done <-chan struct{}) {
-	t.Helper()
-	select {
-	case <-done:
-	case <-time.After(time.Second):
-		t.Fatal("connection handler did not stop")
-	}
-}
-
-type eventCoreWriteHookConn struct {
-	net.Conn
-	writes int
-	hook   func(int)
-}
-
-func (c *eventCoreWriteHookConn) Write(p []byte) (int, error) {
-	n, err := c.Conn.Write(p)
-	c.writes++
-	if err == nil && c.hook != nil {
-		c.hook(c.writes)
-	}
-	return n, err
-}
-
-func TestCrossPlatformCoverageEventCoreDaemonHandshakeEdges(t *testing.T) {
-	t.Run("incompatible ack write failure", func(t *testing.T) {
-		d := eventCoreDaemon(nil)
-		client, w, _, done := eventCoreConnection(d, nil)
-		if err := w.WriteJSON(transport.Hello{Type: transport.FrameTypeHello, CredentialMode: "unsupported"}); err != nil {
-			t.Fatal(err)
-		}
-		_ = client.Close()
-		eventCoreWaitDone(t, done)
-	})
-
-	t.Run("runtime ack write failure", func(t *testing.T) {
-		d := eventCoreDaemon(runtimecred.New(runtimecred.Config{}))
-		client, w, _, done := eventCoreConnection(d, nil)
-		if err := w.WriteJSON(transport.Hello{Type: transport.FrameTypeHello, CredentialMode: transport.CredentialModeRuntimeToken}); err != nil {
-			t.Fatal(err)
-		}
-		_ = client.Close()
-		eventCoreWaitDone(t, done)
-	})
-
-	t.Run("terminal runtime hello", func(t *testing.T) {
-		d := eventCoreDaemon(runtimecred.New(runtimecred.Config{}))
-		d.setTerminalReason(transport.ByeReasonRuntimeTokenRejected)
-		client, w, r, done := eventCoreConnection(d, nil)
-		defer client.Close()
-		if err := w.WriteJSON(transport.Hello{Type: transport.FrameTypeHello, CredentialMode: transport.CredentialModeRuntimeToken}); err != nil {
-			t.Fatal(err)
-		}
-		var ack transport.HelloAck
-		if err := r.ReadJSON(&ack); err != nil || ack.TerminalReason != transport.ByeReasonRuntimeTokenRejected {
-			t.Fatalf("terminal ack = %#v, %v", ack, err)
-		}
-		eventCoreWaitDone(t, done)
-	})
-
-	t.Run("malformed credential update", func(t *testing.T) {
-		d := eventCoreDaemon(runtimecred.New(runtimecred.Config{}))
-		client, w, r, done := eventCoreConnection(d, nil)
-		defer client.Close()
-		if err := w.WriteJSON(transport.Hello{Type: transport.FrameTypeHello, CredentialMode: transport.CredentialModeRuntimeToken}); err != nil {
-			t.Fatal(err)
-		}
-		var ack transport.HelloAck
-		if err := r.ReadJSON(&ack); err != nil {
-			t.Fatal(err)
-		}
-		if _, err := client.Write([]byte("{\n")); err != nil {
-			t.Fatal(err)
-		}
-		eventCoreWaitDone(t, done)
-	})
-
-	t.Run("unexpected credential update", func(t *testing.T) {
-		d := eventCoreDaemon(runtimecred.New(runtimecred.Config{}))
-		client, w, r, done := eventCoreConnection(d, nil)
-		defer client.Close()
-		if err := w.WriteJSON(transport.Hello{Type: transport.FrameTypeHello, CredentialMode: transport.CredentialModeRuntimeToken}); err != nil {
-			t.Fatal(err)
-		}
-		var ack transport.HelloAck
-		if err := r.ReadJSON(&ack); err != nil {
-			t.Fatal(err)
-		}
-		if err := w.WriteJSON(transport.Heartbeat{Type: transport.FrameTypeHeartbeat}); err != nil {
-			t.Fatal(err)
-		}
-		var updateAck transport.CredentialUpdateAck
-		if err := r.ReadJSON(&updateAck); err != nil || updateAck.ErrorCode != transport.CredentialErrorInvalid {
-			t.Fatalf("unexpected-frame ack = %#v, %v", updateAck, err)
-		}
-		eventCoreWaitDone(t, done)
-	})
-
-	t.Run("credential ack write failure", func(t *testing.T) {
-		d := eventCoreDaemon(runtimecred.New(runtimecred.Config{}))
-		client, w, r, done := eventCoreConnection(d, nil)
-		if err := w.WriteJSON(transport.Hello{Type: transport.FrameTypeHello, CredentialMode: transport.CredentialModeRuntimeToken}); err != nil {
-			t.Fatal(err)
-		}
-		var ack transport.HelloAck
-		if err := r.ReadJSON(&ack); err != nil {
-			t.Fatal(err)
-		}
-		if err := w.WriteJSON(transport.CredentialUpdate{
-			Type: transport.FrameTypeCredentialUpdate, ExpectedGeneration: ack.CredentialGeneration, Token: "token",
-		}); err != nil {
-			t.Fatal(err)
-		}
-		_ = client.Close()
-		eventCoreWaitDone(t, done)
-	})
-
-	t.Run("activation conflict", func(t *testing.T) {
-		broker := runtimecred.New(runtimecred.Config{RequireSeed: true, RequireActivation: true})
-		d := eventCoreDaemon(broker)
-		client, w, r, done := eventCoreConnection(d, func(conn net.Conn) net.Conn {
-			return &eventCoreWriteHookConn{Conn: conn, hook: func(write int) {
-				if write == 2 {
-					_, _ = broker.Update(1, "newer-token")
-				}
-			}}
-		})
-		defer client.Close()
-		if err := w.WriteJSON(transport.Hello{Type: transport.FrameTypeHello, CredentialMode: transport.CredentialModeRuntimeToken}); err != nil {
-			t.Fatal(err)
-		}
-		var ack transport.HelloAck
-		if err := r.ReadJSON(&ack); err != nil {
-			t.Fatal(err)
-		}
-		if err := w.WriteJSON(transport.CredentialUpdate{Type: transport.FrameTypeCredentialUpdate, Token: "first-token"}); err != nil {
-			t.Fatal(err)
-		}
-		var updateAck transport.CredentialUpdateAck
-		if err := r.ReadJSON(&updateAck); err != nil || !updateAck.Accepted {
-			t.Fatalf("credential ack = %#v, %v", updateAck, err)
-		}
-		var bye transport.Bye
-		if err := r.ReadJSON(&bye); err != nil || bye.Reason != "runtime_credential_activation_failed" {
-			t.Fatalf("activation failure bye = %#v, %v", bye, err)
-		}
-		eventCoreWaitDone(t, done)
-	})
-}
-
-func TestCrossPlatformCoverageEventCoreDaemonWriterStopEdges(t *testing.T) {
-	originalProcs := runtime.GOMAXPROCS(1)
-	t.Cleanup(func() { runtime.GOMAXPROCS(originalProcs) })
-
-	run := func(t *testing.T, queueEvent bool) {
-		t.Helper()
-		d := eventCoreDaemon(nil)
-		client, w, r, done := eventCoreConnection(d, nil)
-		defer client.Close()
-		if err := w.WriteJSON(transport.Hello{Type: transport.FrameTypeHello, SubscribeID: "writer-stop"}); err != nil {
-			t.Fatal(err)
-		}
-		var ack transport.HelloAck
-		if err := r.ReadJSON(&ack); err != nil {
-			t.Fatal(err)
-		}
-		deadline := time.Now().Add(time.Second)
-		for d.hub.Len() != 1 && time.Now().Before(deadline) {
-			time.Sleep(time.Millisecond)
-		}
-		time.Sleep(5 * time.Millisecond)
-		d.hub.mu.RLock()
-		var consumer *Consumer
-		for _, candidate := range d.hub.consumers {
-			consumer = candidate
-		}
-		d.hub.mu.RUnlock()
-		if consumer == nil {
-			t.Fatal("consumer not registered")
-		}
-		if queueEvent {
-			consumer.SendCh <- transport.Heartbeat{Type: transport.FrameTypeHeartbeat}
-		}
-		consumer.StopCh <- "writer-stop"
-		var bye transport.Bye
-		if err := r.ReadJSON(&bye); err != nil || bye.Reason != "writer-stop" {
-			t.Fatalf("writer stop bye = %#v, %v", bye, err)
-		}
-		eventCoreWaitDone(t, done)
-	}
-
-	t.Run("recheck after event", func(t *testing.T) { run(t, true) })
-	t.Run("blocked stop select", func(t *testing.T) { run(t, false) })
-}
-
-func TestCrossPlatformCoverageEventCoreDaemonHelpersAndStopAll(t *testing.T) {
-	var nilDaemon *daemon
-	nilDaemon.setTerminalReason("ignored")
-	if nilDaemon.getTerminalReason() != "" {
-		t.Fatal("nil daemon returned terminal reason")
-	}
-	d := eventCoreDaemon(nil)
-	d.setTerminalReason("ignored")
-	if d.getTerminalReason() != "" {
-		t.Fatal("invalid terminal reason was stored")
-	}
-	d.setTerminalReason(transport.ByeReasonRuntimeTokenRejected)
-	if d.getTerminalReason() != transport.ByeReasonRuntimeTokenRejected {
-		t.Fatal("terminal reason was not stored")
-	}
-
-	if code, _ := classifyCredentialUpdateError(runtimecred.ErrEmptyToken); code != transport.CredentialErrorInvalid {
-		t.Fatalf("empty-token classification = %q", code)
-	}
-	if code, message := classifyCredentialUpdateError(errors.New("internal detail")); code != transport.CredentialErrorInternal || message != "runtime credential update failed" {
-		t.Fatalf("internal classification = %q, %q", code, message)
-	}
-
-	hub := NewHub(1)
-	consumer, err := hub.Register(transport.Hello{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if stopped := hub.StopAll("   "); stopped != 1 {
-		t.Fatalf("StopAll = %d", stopped)
-	}
-	select {
-	case reason := <-consumer.StopCh:
-		if reason != "shutdown" {
-			t.Fatalf("default stop reason = %q", reason)
-		}
-	case <-time.After(time.Second):
-		t.Fatal("default stop reason not delivered")
-	}
-	hub.Unregister(consumer.ID)
-}
@@ -30,7 +30,6 @@ import (

 	dwsevent "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/event"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/event/dedup"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/event/runtimecred"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/event/transport"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/config"
 )
@@ -79,11 +78,6 @@ type Config struct {
 	// Source is the cloud adapter. Required.
 	Source SourceAdapter

-	// CredentialBroker enables additive runtime-token handoff over the
-	// owner-only local IPC transport. Nil preserves the original protocol and
-	// does not advertise runtime-token support.
-	CredentialBroker *runtimecred.Broker
-
 	// IdleTimeout: bus self-exits after this long with zero consumers.
 	// Zero disables (bus runs until SIGTERM).
 	IdleTimeout time.Duration
@@ -112,13 +106,11 @@ type Config struct {
 }

 var (
-	daemonMkdirAll                   = os.MkdirAll
-	daemonAcquire                    = Acquire
-	daemonWriteMeta                  = WriteMeta
-	daemonListen                     = transport.Listen
-	daemonShutdownTimeout            = 2 * time.Second
-	daemonByeDrainTimeout            = 100 * time.Millisecond
-	daemonCredentialHandshakeTimeout = 10 * time.Second
+	daemonMkdirAll        = os.MkdirAll
+	daemonAcquire         = Acquire
+	daemonWriteMeta       = WriteMeta
+	daemonListen          = transport.Listen
+	daemonShutdownTimeout = 2 * time.Second
 )

 // Run starts the bus daemon. Lifecycle (plan §4 invariant #6):
@@ -245,22 +237,12 @@ func Run(ctx context.Context, cfg Config) error {

 	// 6. Wait for shutdown trigger.
 	var exitErr error
-	shutdownReason := "shutdown"
 	select {
 	case <-ctx.Done():
 		log.Info("bus: shutdown requested by ctx", "reason", ctx.Err())
 	case err := <-srcErr:
 		log.Error("bus: source exited", "err", err)
 		exitErr = err
-		shutdownReason = sourceShutdownReason(err)
-		if shutdownReason == transport.ByeReasonRuntimeTokenRejected {
-			// A runtime token can fail immediately after Broker.Update. Serialize
-			// terminal publication with that handshake so the initiating consumer
-			// is registered (or receives a terminal HelloAck) before shutdown.
-			d.credentialHandoffMu.Lock()
-			d.setTerminalReason(shutdownReason)
-			d.credentialHandoffMu.Unlock()
-		}
 	case <-d.idleStop:
 		log.Info("bus: idle timeout reached, shutting down")
 	}
@@ -270,7 +252,7 @@ func Run(ctx context.Context, cfg Config) error {
 	// consumers. The accept-loop barrier is required before WaitGroup.Wait:
 	// sync.WaitGroup forbids a positive Add racing with Wait.
 	cancelRun()
-	d.shutdown(acceptDone, shutdownReason)
+	d.shutdown(acceptDone)
 	<-idleDone
 	<-dropWarnDone

@@ -292,10 +274,6 @@ type daemon struct {
 	shutdownMu   sync.Mutex
 	shuttingDown atomic.Bool
 	idleStop     chan struct{}
-
-	credentialHandoffMu sync.Mutex
-	terminalMu          sync.RWMutex
-	terminalReason      string
 }

 // closeOnceConn makes every connection close path idempotent. A live consumer
@@ -352,8 +330,7 @@ func (d *daemon) acceptLoop(ctx context.Context) {
 }

 // handleConnection processes one IPC connection's full lifecycle: read
-// Hello → optional runtime credential negotiation → register with Hub → spawn
-// writer goroutine → read until EOF/Bye.
+// Hello → register with Hub → spawn writer goroutine → read until EOF/Bye.
 // Always Unregisters and Closes on exit (plan invariant #5).
 func (d *daemon) handleConnection(ctx context.Context, conn net.Conn) {
 	conn = ensureCloseOnce(conn)
@@ -395,141 +372,29 @@ func (d *daemon) handleConnection(ctx context.Context, conn net.Conn) {
 		return
 	}

-	// HelloAck — credentials_source fields are filled in by the daemon
-	// runner (which knows from the strict resolver) and exposed via the
-	// adapter for forward-compat. v1 leaves them empty here; daemon.Run
-	// passes them through future config if the caller wishes.
-	ack := d.helloAck()
-	handoffLocked := false
-	runtimeGeneration := uint64(0)
-	defer func() {
-		if handoffLocked {
-			d.credentialHandoffMu.Unlock()
-		}
-	}()
-
-	// Runtime credentials use a two-phase additive handshake. The first ack
-	// proves capability before the client sends any secret. Only a successful
-	// CAS and credential ack permit Hub registration.
-	if hello.CredentialMode != "" {
-		if hello.CredentialMode != transport.CredentialModeRuntimeToken || d.cfg.CredentialBroker == nil {
-			ack.Capabilities = nil
-			ack.CredentialGeneration = 0
-			if err := w.WriteJSON(ack); err != nil {
-				d.log.Warn("bus: incompatible helloack write failed", "err", err)
-			}
-			return
-		}
-		d.credentialHandoffMu.Lock()
-		handoffLocked = true
-		// Terminal state may have been published while this Hello waited for a
-		// concurrent credential handoff. Rebuild the ack while holding the gate.
-		ack = d.helloAck()
-		if err := w.WriteJSON(ack); err != nil {
-			d.log.Warn("bus: runtime helloack write failed", "err", err)
-			return
-		}
-		if ack.TerminalReason == transport.ByeReasonRuntimeTokenRejected {
-			return
-		}
-
-		var update transport.CredentialUpdate
-		_ = conn.SetReadDeadline(time.Now().Add(daemonCredentialHandshakeTimeout))
-		if err := r.ReadJSON(&update); err != nil {
-			// Do not include the decoder error: malformed JSON may contain
-			// fragments of the credential.
-			d.log.Warn("bus: malformed runtime credential update")
-			return
-		}
-		_ = conn.SetReadDeadline(time.Time{})
-		if update.Type != transport.FrameTypeCredentialUpdate {
-			_ = w.WriteJSON(transport.CredentialUpdateAck{
-				Type:                 transport.FrameTypeCredentialUpdateAck,
-				Accepted:             false,
-				CredentialGeneration: d.cfg.CredentialBroker.Generation(),
-				ErrorCode:            transport.CredentialErrorInvalid,
-				Error:                "unexpected credential update frame",
-			})
-			return
-		}
-		// Validate registration before applying the credential or sending an
-		// accepted ack. Hub.Register performs the same deterministic compile
-		// before mutating the Hub; this preflight keeps invalid filters from
-		// producing a ready marker after credential negotiation.
-		if _, err := compileMatcher(hello.EventTypes, hello.Filter, hello.SubscribeID); err != nil {
-			update.Token = ""
-			_ = w.WriteJSON(transport.CredentialUpdateAck{
-				Type:                 transport.FrameTypeCredentialUpdateAck,
-				Accepted:             false,
-				CredentialGeneration: d.cfg.CredentialBroker.Generation(),
-				ErrorCode:            transport.CredentialErrorRegistration,
-				Error:                "consumer registration validation failed",
-			})
-			d.log.Warn("bus: runtime consumer registration validation failed")
-			return
-		}
-
-		generation, updateErr := d.cfg.CredentialBroker.Update(update.ExpectedGeneration, update.Token)
-		runtimeGeneration = generation
-		update.Token = ""
-		credentialAck := transport.CredentialUpdateAck{
-			Type:                 transport.FrameTypeCredentialUpdateAck,
-			Accepted:             updateErr == nil,
-			CredentialGeneration: generation,
-		}
-		if updateErr != nil {
-			credentialAck.ErrorCode, credentialAck.Error = classifyCredentialUpdateError(updateErr)
-		}
-		if err := w.WriteJSON(credentialAck); err != nil {
-			d.log.Warn("bus: credential update ack write failed", "err", err)
-			return
-		}
-		if updateErr != nil {
-			d.log.Warn("bus: runtime credential update rejected", "error_code", credentialAck.ErrorCode)
-			return
-		}
-	}
-
-	// Regular consumer registration. Local clients retain the original
-	// register-before-HelloAck ordering; runtime clients were already acked by
-	// the additive handshake above.
+	// Regular consumer registration
 	c, err := d.hub.Register(hello)
 	if err != nil {
 		d.log.Warn("bus: register failed", "err", err, "pid", hello.ConsumerPID)
 		_ = w.WriteJSON(transport.Bye{Type: transport.FrameTypeBye, Reason: "register_failed: " + err.Error()})
 		return
 	}
-	if handoffLocked {
-		// The runtime broker deliberately keeps the seed pending until the
-		// initiating consumer is registered. This prevents ticket acquisition
-		// (and an immediate 401) from racing ahead of the only connection that
-		// can observe the typed terminal reason.
-		if _, activateErr := d.cfg.CredentialBroker.Activate(runtimeGeneration); activateErr != nil {
-			d.log.Error("bus: runtime credential activation failed")
-			_ = w.WriteJSON(transport.Bye{Type: transport.FrameTypeBye, Reason: "runtime_credential_activation_failed"})
-			d.hub.Unregister(c.ID)
-			return
-		}
-	}
-	// A local/legacy consumer can arrive after terminal publication but after
-	// StopAll took its snapshot. Refuse it synchronously so it cannot observe a
-	// clean EOF for a runtime-token rejection.
-	if terminalReason := d.getTerminalReason(); terminalReason != "" {
-		_ = w.WriteJSON(transport.Bye{Type: transport.FrameTypeBye, Reason: terminalReason})
-		d.hub.Unregister(c.ID)
+
+	// HelloAck — credentials_source fields are filled in by the daemon
+	// runner (which knows from the strict resolver) and exposed via the
+	// adapter for forward-compat. v1 leaves them empty here; daemon.Run
+	// passes them through future config if the caller wishes.
+	idleSecs := int(d.cfg.IdleTimeout / time.Second)
+	if err := w.WriteJSON(transport.HelloAck{
+		Type:            transport.FrameTypeHelloAck,
+		BusPID:          os.Getpid(),
+		SourceState:     "connected", // best-effort; full state machine pushed via SourceState frames
+		StateSource:     "inferred",
+		IdleTimeoutSecs: idleSecs,
+	}); err != nil {
+		d.log.Warn("bus: helloack write failed", "err", err)
 		return
 	}
-	if handoffLocked {
-		d.credentialHandoffMu.Unlock()
-		handoffLocked = false
-	}
-	if hello.CredentialMode == "" {
-		if err := w.WriteJSON(ack); err != nil {
-			d.log.Warn("bus: helloack write failed", "err", err)
-			d.hub.Unregister(c.ID)
-			return
-		}
-	}

 	// Writer goroutine pulls from SendCh and writes to the wire.
 	writerDone := make(chan struct{})
@@ -551,16 +416,6 @@ func (d *daemon) handleConnection(ctx context.Context, conn net.Conn) {
 				if !ok {
 					return
 				}
-				// A stop may have arrived while both channels were ready and the
-				// scheduler selected the buffered event. Re-check before starting a
-				// potentially blocking event write so terminal reasons stay prompt.
-				select {
-				case reason := <-c.StopCh:
-					_ = w.WriteJSON(transport.Bye{Type: transport.FrameTypeBye, Reason: reason})
-					_ = conn.Close()
-					return
-				default:
-				}
 				if err := w.WriteJSON(frame); err != nil {
 					return
 				}
@@ -599,51 +454,6 @@ func (d *daemon) handleConnection(ctx context.Context, conn net.Conn) {
 	_ = ctx // for future use (writer ctx-cancel propagation)
 }

-func (d *daemon) helloAck() transport.HelloAck {
-	ack := transport.HelloAck{
-		Type:            transport.FrameTypeHelloAck,
-		BusPID:          os.Getpid(),
-		SourceState:     "connected", // best-effort; full state machine pushed via SourceState frames
-		StateSource:     "inferred",
-		IdleTimeoutSecs: int(d.cfg.IdleTimeout / time.Second),
-	}
-	if d.cfg.CredentialBroker != nil {
-		ack.Capabilities = []string{transport.CapabilityRuntimeTokenV1}
-		ack.CredentialGeneration = d.cfg.CredentialBroker.Generation()
-	}
-	ack.TerminalReason = d.getTerminalReason()
-	return ack
-}
-
-func (d *daemon) setTerminalReason(reason string) {
-	if d == nil || reason != transport.ByeReasonRuntimeTokenRejected {
-		return
-	}
-	d.terminalMu.Lock()
-	d.terminalReason = reason
-	d.terminalMu.Unlock()
-}
-
-func (d *daemon) getTerminalReason() string {
-	if d == nil {
-		return ""
-	}
-	d.terminalMu.RLock()
-	defer d.terminalMu.RUnlock()
-	return d.terminalReason
-}
-
-func classifyCredentialUpdateError(err error) (string, string) {
-	var conflict *runtimecred.GenerationConflictError
-	if errors.As(err, &conflict) {
-		return transport.CredentialErrorGenerationConflict, conflict.Error()
-	}
-	if errors.Is(err, runtimecred.ErrEmptyToken) || errors.Is(err, runtimecred.ErrTokenTooLarge) {
-		return transport.CredentialErrorInvalid, err.Error()
-	}
-	return transport.CredentialErrorInternal, "runtime credential update failed"
-}
-
 func (d *daemon) handleConsumerStopRPC(w *transport.Writer, r *transport.Reader) {
 	var req transport.ConsumerStopReq
 	if err := r.ReadJSON(&req); err != nil {
@@ -767,64 +577,38 @@ func (d *daemon) triggerShutdown(reason string) {
 //  4. wait for acceptLoop to return so no future consumerWG.Add can occur
 //  5. close all accepted connections and wait for handlers to drain
 //  6. lock + meta cleanup via Run's defers
-func (d *daemon) shutdown(acceptDone <-chan struct{}, reasons ...string) {
+func (d *daemon) shutdown(acceptDone <-chan struct{}) {
 	d.shutdownMu.Lock()
 	defer d.shutdownMu.Unlock()
 	if !d.shuttingDown.CompareAndSwap(false, true) {
 		return
 	}
-	reason := normalizedShutdownReason(reasons...)
-	if reason == transport.ByeReasonRuntimeTokenRejected {
-		d.hub.StopAll(reason)
-	} else {
-		d.hub.Broadcast(transport.Bye{Type: transport.FrameTypeBye, Reason: reason})
-	}
+	d.hub.Broadcast(transport.Bye{Type: transport.FrameTypeBye, Reason: "shutdown"})
 	_ = d.listener.Close()
 	<-acceptDone
-	// Let local consumers drain the final Bye before force-closing their
-	// connections. This short grace period is what makes typed shutdown
-	// reasons (notably runtime_token_rejected) observable instead of racing
-	// with EOF. Consumers close their side immediately after reading Bye.
+	// Force-close all open IPC connections so any reader goroutine blocked
+	// on Read() returns with a network error and exits cleanly. Without
+	// this the consumerWG never drains and Run hangs forever.
+	d.conns.Range(func(k, _ any) bool {
+		if c, ok := k.(net.Conn); ok {
+			_ = c.Close()
+		}
+		return true
+	})
+	// Give consumers a brief moment to drain final frames before we tear
+	// down their channels.
 	doneCh := make(chan struct{})
 	go func() {
 		d.consumerWG.Wait()
 		close(doneCh)
 	}()
 	select {
-	case <-doneCh:
-		return
-	case <-time.After(daemonByeDrainTimeout):
-	}
-
-	// A wedged/old consumer may not close after Bye. Force-close remaining
-	// connections so the daemon still has a bounded shutdown.
-	d.conns.Range(func(k, _ any) bool {
-		if c, ok := k.(net.Conn); ok {
-			_ = c.Close()
-		}
-		return true
-	})
-	select {
 	case <-doneCh:
 	case <-time.After(daemonShutdownTimeout):
 		d.log.Warn("bus: shutdown: consumer goroutines did not drain within 2s")
 	}
 }

-func sourceShutdownReason(err error) string {
-	if errors.Is(err, runtimecred.ErrRuntimeTokenRejected) {
-		return transport.ByeReasonRuntimeTokenRejected
-	}
-	return "shutdown"
-}
-
-func normalizedShutdownReason(reasons ...string) string {
-	if len(reasons) > 0 && reasons[0] == transport.ByeReasonRuntimeTokenRejected {
-		return transport.ByeReasonRuntimeTokenRejected
-	}
-	return "shutdown"
-}
-
 // signalReady writes a single 'R' byte to the ready pipe (if provided) and
 // closes it. The parent process (busctl/spawn) reads one byte and proceeds.
 func signalReady(p *os.File) {
@@ -246,31 +246,6 @@ func (h *Hub) StopConsumers(subscribeIDs []string, reason string) []string {
 	return out
 }

-// StopAll requests a high-priority graceful close for every live consumer.
-// Unlike Broadcast(Bye), this uses the writer's priority StopCh and therefore
-// cannot sit behind a full event buffer during a terminal source failure.
-func (h *Hub) StopAll(reason string) int {
-	reason = strings.TrimSpace(reason)
-	if reason == "" {
-		reason = "shutdown"
-	}
-	h.mu.RLock()
-	consumers := make([]*Consumer, 0, len(h.consumers))
-	for _, consumer := range h.consumers {
-		consumers = append(consumers, consumer)
-	}
-	h.mu.RUnlock()
-	stopped := 0
-	for _, consumer := range consumers {
-		select {
-		case consumer.StopCh <- reason:
-			stopped++
-		default:
-		}
-	}
-	return stopped
-}
-
 // Unregister removes a consumer by ID and closes its sendCh. Idempotent —
 // calling twice or on an unknown ID is a no-op. closeSend shares the same
 // per-consumer lock as Deliver/Broadcast, so a stale Hub snapshot cannot send
@@ -346,27 +346,6 @@ func TestHub_StopConsumersCoalescesQueuedStop(t *testing.T) {
 	}
 }

-func TestCrossPlatformCoverageHubStopAllBypassesFullEventBuffer(t *testing.T) {
-	hub := NewHub(1)
-	consumer, err := hub.Register(transport.Hello{Type: transport.FrameTypeHello})
-	if err != nil {
-		t.Fatal(err)
-	}
-	consumer.SendCh <- transport.Event{Type: transport.FrameTypeEvent}
-
-	if stopped := hub.StopAll(transport.ByeReasonRuntimeTokenRejected); stopped != 1 {
-		t.Fatalf("StopAll() = %d, want 1", stopped)
-	}
-	select {
-	case reason := <-consumer.StopCh:
-		if reason != transport.ByeReasonRuntimeTokenRejected {
-			t.Fatalf("StopCh reason = %q", reason)
-		}
-	default:
-		t.Fatal("terminal stop was blocked behind the full event buffer")
-	}
-}
-
 func TestHub_ConcurrentStopConsumersRegisterUnregister(t *testing.T) {
 	h := NewHub(4)
 	const workers = 32
@@ -1,407 +0,0 @@
-// Copyright 2026 Alibaba Group
-// Licensed under the Apache License, Version 2.0 (the "License");
-
-package bus
-
-import (
-	"bytes"
-	"context"
-	"errors"
-	"io"
-	"log/slog"
-	"net"
-	"path/filepath"
-	"strings"
-	"testing"
-	"time"
-
-	dwsevent "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/event"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/event/runtimecred"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/event/transport"
-)
-
-type runtimeCredentialRejectSource struct {
-	broker *runtimecred.Broker
-}
-
-func (s *runtimeCredentialRejectSource) Start(ctx context.Context, _ dwsevent.EmitFn) error {
-	if _, err := s.broker.Resolve(ctx); err != nil {
-		return err
-	}
-	return runtimecred.ErrRuntimeTokenRejected
-}
-
-func runtimeCredentialDaemon(broker *runtimecred.Broker, logOutput io.Writer) *daemon {
-	if logOutput == nil {
-		logOutput = io.Discard
-	}
-	return &daemon{
-		cfg:      Config{CredentialBroker: broker},
-		log:      slog.New(slog.NewTextHandler(logOutput, nil)),
-		hub:      NewHub(2),
-		started:  time.Now(),
-		idleStop: make(chan struct{}),
-	}
-}
-
-func runRuntimeCredentialConnection(t *testing.T, d *daemon) (net.Conn, *transport.Writer, *transport.Reader, <-chan struct{}) {
-	t.Helper()
-	server, client := net.Pipe()
-	done := make(chan struct{})
-	go func() {
-		d.handleConnection(context.Background(), server)
-		close(done)
-	}()
-	return client, transport.NewWriter(client), transport.NewReader(client), done
-}
-
-func TestCrossPlatformCoverageDaemonRuntimeCredentialHandshakeBeforeRegister(t *testing.T) {
-	broker := runtimecred.New(runtimecred.Config{RequireSeed: true, RequireActivation: true})
-	d := runtimeCredentialDaemon(broker, nil)
-	client, w, r, done := runRuntimeCredentialConnection(t, d)
-	defer client.Close()
-
-	if err := w.WriteJSON(transport.Hello{
-		Type:           transport.FrameTypeHello,
-		ConsumerPID:    42,
-		CredentialMode: transport.CredentialModeRuntimeToken,
-	}); err != nil {
-		t.Fatal(err)
-	}
-	var helloAck transport.HelloAck
-	if err := r.ReadJSON(&helloAck); err != nil {
-		t.Fatal(err)
-	}
-	if !hasTransportCapability(helloAck.Capabilities, transport.CapabilityRuntimeTokenV1) || helloAck.CredentialGeneration != 0 {
-		t.Fatalf("hello ack = %#v", helloAck)
-	}
-	if d.hub.Len() != 0 {
-		t.Fatalf("consumer registered before credential update: %d", d.hub.Len())
-	}
-
-	const canary = "ipc-canary-runtime-token"
-	if err := w.WriteJSON(transport.CredentialUpdate{
-		Type:               transport.FrameTypeCredentialUpdate,
-		ExpectedGeneration: helloAck.CredentialGeneration,
-		Token:              canary,
-	}); err != nil {
-		t.Fatal(err)
-	}
-	var updateAck transport.CredentialUpdateAck
-	if err := r.ReadJSON(&updateAck); err != nil {
-		t.Fatal(err)
-	}
-	if !updateAck.Accepted || updateAck.CredentialGeneration != 1 {
-		t.Fatalf("credential ack = %#v", updateAck)
-	}
-	deadline := time.Now().Add(time.Second)
-	for d.hub.Len() != 1 && time.Now().Before(deadline) {
-		time.Sleep(time.Millisecond)
-	}
-	if d.hub.Len() != 1 {
-		t.Fatal("consumer was not registered after credential ack")
-	}
-	if token, err := broker.Resolve(context.Background()); err != nil || token != canary {
-		t.Fatalf("broker did not resolve installed runtime token: %v", err)
-	}
-
-	if err := w.WriteJSON(transport.Bye{Type: transport.FrameTypeBye, Reason: "done"}); err != nil {
-		t.Fatal(err)
-	}
-	select {
-	case <-done:
-	case <-time.After(time.Second):
-		t.Fatal("connection did not close")
-	}
-}
-
-func TestCrossPlatformCoverageDaemonCompatibleBusRotatesRuntimeCredentialAcrossConnections(t *testing.T) {
-	broker := runtimecred.New(runtimecred.Config{RequireSeed: true, RequireActivation: true})
-	d := runtimeCredentialDaemon(broker, nil)
-
-	handshake := func(token string, wantHelloGeneration, wantAckGeneration uint64) {
-		t.Helper()
-		client, w, r, done := runRuntimeCredentialConnection(t, d)
-		if err := w.WriteJSON(transport.Hello{
-			Type:           transport.FrameTypeHello,
-			CredentialMode: transport.CredentialModeRuntimeToken,
-		}); err != nil {
-			t.Fatal(err)
-		}
-		var helloAck transport.HelloAck
-		if err := r.ReadJSON(&helloAck); err != nil {
-			t.Fatal(err)
-		}
-		if helloAck.CredentialGeneration != wantHelloGeneration {
-			t.Fatalf("hello generation = %d, want %d", helloAck.CredentialGeneration, wantHelloGeneration)
-		}
-		if err := w.WriteJSON(transport.CredentialUpdate{
-			Type:               transport.FrameTypeCredentialUpdate,
-			ExpectedGeneration: helloAck.CredentialGeneration,
-			Token:              token,
-		}); err != nil {
-			t.Fatal(err)
-		}
-		var updateAck transport.CredentialUpdateAck
-		if err := r.ReadJSON(&updateAck); err != nil {
-			t.Fatal(err)
-		}
-		if !updateAck.Accepted || updateAck.CredentialGeneration != wantAckGeneration {
-			t.Fatalf("credential ack accepted=%v generation=%d, want true/%d", updateAck.Accepted, updateAck.CredentialGeneration, wantAckGeneration)
-		}
-		if err := w.WriteJSON(transport.Bye{Type: transport.FrameTypeBye, Reason: "done"}); err != nil {
-			t.Fatal(err)
-		}
-		_ = client.Close()
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Fatal("connection did not close")
-		}
-	}
-
-	handshake("runtime-token-a", 0, 1)
-	if token, err := broker.Resolve(context.Background()); err != nil || token != "runtime-token-a" {
-		t.Fatalf("broker did not retain first token: %v", err)
-	}
-	handshake("runtime-token-b", 1, 2)
-	if token, err := broker.Resolve(context.Background()); err != nil || token != "runtime-token-b" {
-		t.Fatalf("broker did not rotate to second token: %v", err)
-	}
-}
-
-func TestCrossPlatformCoverageDaemonRuntimeCredentialMissingCapabilityDoesNotRegister(t *testing.T) {
-	d := runtimeCredentialDaemon(nil, nil)
-	client, w, r, done := runRuntimeCredentialConnection(t, d)
-	defer client.Close()
-	if err := w.WriteJSON(transport.Hello{
-		Type:           transport.FrameTypeHello,
-		CredentialMode: transport.CredentialModeRuntimeToken,
-	}); err != nil {
-		t.Fatal(err)
-	}
-	var ack transport.HelloAck
-	if err := r.ReadJSON(&ack); err != nil {
-		t.Fatal(err)
-	}
-	if hasTransportCapability(ack.Capabilities, transport.CapabilityRuntimeTokenV1) {
-		t.Fatalf("unsupported daemon advertised capability: %#v", ack)
-	}
-	if d.hub.Len() != 0 {
-		t.Fatalf("unsupported daemon registered consumer: %d", d.hub.Len())
-	}
-	select {
-	case <-done:
-	case <-time.After(time.Second):
-		t.Fatal("unsupported connection did not close")
-	}
-}
-
-func TestCrossPlatformCoverageDaemonTerminalStateRejectsLateLegacyConsumer(t *testing.T) {
-	d := runtimeCredentialDaemon(nil, nil)
-	d.setTerminalReason(transport.ByeReasonRuntimeTokenRejected)
-	client, w, r, done := runRuntimeCredentialConnection(t, d)
-	defer client.Close()
-
-	if err := w.WriteJSON(transport.Hello{Type: transport.FrameTypeHello, ConsumerPID: 7}); err != nil {
-		t.Fatal(err)
-	}
-	var bye transport.Bye
-	if err := r.ReadJSON(&bye); err != nil {
-		t.Fatal(err)
-	}
-	if bye.Type != transport.FrameTypeBye || bye.Reason != transport.ByeReasonRuntimeTokenRejected {
-		t.Fatalf("late consumer frame = %#v", bye)
-	}
-	select {
-	case <-done:
-	case <-time.After(time.Second):
-		t.Fatal("late consumer connection did not close")
-	}
-	if d.hub.Len() != 0 {
-		t.Fatalf("late terminal consumer remained registered: %d", d.hub.Len())
-	}
-}
-
-func TestCrossPlatformCoverageDaemonRuntimeCredentialConflictDoesNotLeakOrRegister(t *testing.T) {
-	broker := runtimecred.New(runtimecred.Config{})
-	if _, err := broker.Update(0, "installed-secret"); err != nil {
-		t.Fatal(err)
-	}
-	var logs bytes.Buffer
-	d := runtimeCredentialDaemon(broker, &logs)
-	client, w, r, done := runRuntimeCredentialConnection(t, d)
-	defer client.Close()
-	if err := w.WriteJSON(transport.Hello{
-		Type:           transport.FrameTypeHello,
-		CredentialMode: transport.CredentialModeRuntimeToken,
-	}); err != nil {
-		t.Fatal(err)
-	}
-	var helloAck transport.HelloAck
-	if err := r.ReadJSON(&helloAck); err != nil {
-		t.Fatal(err)
-	}
-	const canary = "rejected-canary-secret"
-	if err := w.WriteJSON(transport.CredentialUpdate{
-		Type:               transport.FrameTypeCredentialUpdate,
-		ExpectedGeneration: 0,
-		Token:              canary,
-	}); err != nil {
-		t.Fatal(err)
-	}
-	var updateAck transport.CredentialUpdateAck
-	if err := r.ReadJSON(&updateAck); err != nil {
-		t.Fatal(err)
-	}
-	if updateAck.Accepted || updateAck.ErrorCode != transport.CredentialErrorGenerationConflict || updateAck.CredentialGeneration != 1 {
-		t.Fatalf("conflict ack = %#v", updateAck)
-	}
-	select {
-	case <-done:
-	case <-time.After(time.Second):
-		t.Fatal("rejected connection did not close")
-	}
-	if strings.Contains(updateAck.Error, canary) || strings.Contains(logs.String(), canary) {
-		t.Fatal("credential appeared in acknowledgement or logs")
-	}
-	if d.hub.Len() != 0 {
-		t.Fatalf("rejected consumer registered: %d", d.hub.Len())
-	}
-}
-
-func TestCrossPlatformCoverageDaemonRuntimeCredentialInvalidFilterRejectedBeforeUpdate(t *testing.T) {
-	broker := runtimecred.New(runtimecred.Config{})
-	d := runtimeCredentialDaemon(broker, nil)
-	client, w, r, done := runRuntimeCredentialConnection(t, d)
-	defer client.Close()
-	if err := w.WriteJSON(transport.Hello{
-		Type:           transport.FrameTypeHello,
-		CredentialMode: transport.CredentialModeRuntimeToken,
-		Filter:         "[",
-	}); err != nil {
-		t.Fatal(err)
-	}
-	var helloAck transport.HelloAck
-	if err := r.ReadJSON(&helloAck); err != nil {
-		t.Fatal(err)
-	}
-	if err := w.WriteJSON(transport.CredentialUpdate{
-		Type:               transport.FrameTypeCredentialUpdate,
-		ExpectedGeneration: helloAck.CredentialGeneration,
-		Token:              "filter-canary-secret",
-	}); err != nil {
-		t.Fatal(err)
-	}
-	var updateAck transport.CredentialUpdateAck
-	if err := r.ReadJSON(&updateAck); err != nil {
-		t.Fatal(err)
-	}
-	if updateAck.Accepted || updateAck.ErrorCode != transport.CredentialErrorRegistration {
-		t.Fatalf("invalid filter ack = %#v", updateAck)
-	}
-	if broker.Generation() != 0 || d.hub.Len() != 0 {
-		t.Fatalf("invalid filter mutated state: generation=%d consumers=%d", broker.Generation(), d.hub.Len())
-	}
-	select {
-	case <-done:
-	case <-time.After(time.Second):
-		t.Fatal("invalid filter connection did not close")
-	}
-}
-
-func TestCrossPlatformCoverageRuntimeCredentialShutdownReason(t *testing.T) {
-	if got := sourceShutdownReason(runtimecred.ErrRuntimeTokenRejected); got != transport.ByeReasonRuntimeTokenRejected {
-		t.Fatalf("runtime source shutdown reason = %q", got)
-	}
-	if got := sourceShutdownReason(errors.New("local source failed")); got != "shutdown" {
-		t.Fatalf("local source shutdown reason = %q", got)
-	}
-	if got := normalizedShutdownReason(transport.ByeReasonRuntimeTokenRejected); got != transport.ByeReasonRuntimeTokenRejected {
-		t.Fatalf("normalized runtime shutdown reason = %q", got)
-	}
-	for _, reasons := range [][]string{nil, {"peer-controlled"}} {
-		if got := normalizedShutdownReason(reasons...); got != "shutdown" {
-			t.Fatalf("normalized untrusted shutdown reason = %q", got)
-		}
-	}
-}
-
-func TestCrossPlatformCoverageDaemonRuntimeCredentialSourceRejectionBroadcastsTypedBye(t *testing.T) {
-	skipOnWindows(t, "uses Unix socket dial")
-	workDir := shortTempDir(t)
-	sockPath := filepath.Join(workDir, "bus.sock")
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-
-	broker := runtimecred.New(runtimecred.Config{RequireSeed: true, RequireActivation: true})
-	runDone := make(chan error, 1)
-	go func() {
-		runDone <- Run(ctx, Config{
-			WorkDir:          workDir,
-			IPCEndpoint:      sockPath,
-			ClientID:         "runtime-client",
-			Edition:          "open",
-			SourceKind:       dwsevent.SourceKindPersonalStream,
-			IdentityHash:     "0123456789abcdef",
-			SourceID:         "open",
-			Source:           &runtimeCredentialRejectSource{broker: broker},
-			CredentialBroker: broker,
-		})
-	}()
-	waitForFile(t, sockPath, 2*time.Second)
-
-	conn, err := transport.Dial(sockPath)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer conn.Close()
-	r, w := transport.NewReader(conn), transport.NewWriter(conn)
-	if err := w.WriteJSON(transport.Hello{
-		Type:           transport.FrameTypeHello,
-		CredentialMode: transport.CredentialModeRuntimeToken,
-	}); err != nil {
-		t.Fatal(err)
-	}
-	var helloAck transport.HelloAck
-	if err := r.ReadJSON(&helloAck); err != nil {
-		t.Fatal(err)
-	}
-	if err := w.WriteJSON(transport.CredentialUpdate{
-		Type:               transport.FrameTypeCredentialUpdate,
-		ExpectedGeneration: helloAck.CredentialGeneration,
-		Token:              "runtime-rejected-canary",
-	}); err != nil {
-		t.Fatal(err)
-	}
-	var updateAck transport.CredentialUpdateAck
-	if err := r.ReadJSON(&updateAck); err != nil || !updateAck.Accepted {
-		t.Fatalf("credential update ack = %#v, %v", updateAck, err)
-	}
-
-	var bye transport.Bye
-	if err := r.ReadJSON(&bye); err != nil {
-		t.Fatalf("read typed shutdown: %v", err)
-	}
-	if bye.Type != transport.FrameTypeBye || bye.Reason != transport.ByeReasonRuntimeTokenRejected {
-		t.Fatalf("shutdown frame = %#v", bye)
-	}
-	_ = conn.Close()
-	select {
-	case err := <-runDone:
-		if !errors.Is(err, runtimecred.ErrRuntimeTokenRejected) {
-			t.Fatalf("Run() error = %v", err)
-		}
-	case <-time.After(3 * time.Second):
-		t.Fatal("runtime credential bus did not stop")
-	}
-}
-
-func hasTransportCapability(capabilities []string, want string) bool {
-	for _, capability := range capabilities {
-		if capability == want {
-			return true
-		}
-	}
-	return false
-}
@@ -1,101 +0,0 @@
-package consume
-
-import (
-	"bytes"
-	"context"
-	"errors"
-	"io"
-	"strings"
-	"testing"
-
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/event/runtimecred"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/event/transport"
-)
-
-func eventCoreCredentialReader(t *testing.T, frame any) *transport.Reader {
-	t.Helper()
-	var buffer bytes.Buffer
-	if err := transport.NewWriter(&buffer).WriteJSON(frame); err != nil {
-		t.Fatal(err)
-	}
-	return transport.NewReader(&buffer)
-}
-
-func TestCrossPlatformCoverageEventCoreRuntimeNegotiationEdges(t *testing.T) {
-	capable := transport.HelloAck{Capabilities: []string{transport.CapabilityRuntimeTokenV1}}
-	if err := negotiateRuntimeToken(
-		transport.NewWriter(io.Discard),
-		transport.NewReader(strings.NewReader("")),
-		transport.HelloAck{TerminalReason: transport.ByeReasonRuntimeTokenRejected},
-		"token",
-	); !errors.Is(err, runtimecred.ErrRuntimeTokenRejected) {
-		t.Fatalf("terminal hello error = %v", err)
-	}
-
-	wantWriteErr := errors.New("write failed")
-	if err := negotiateRuntimeToken(
-		transport.NewWriter(errorWriter{err: wantWriteErr}),
-		transport.NewReader(strings.NewReader("")),
-		capable,
-		"token",
-	); !errors.Is(err, wantWriteErr) {
-		t.Fatalf("credential write error = %v", err)
-	}
-
-	if err := negotiateRuntimeToken(
-		transport.NewWriter(io.Discard),
-		transport.NewReader(strings.NewReader("")),
-		capable,
-		"token",
-	); !errors.Is(err, io.EOF) {
-		t.Fatalf("credential ack read error = %v", err)
-	}
-
-	if err := negotiateRuntimeToken(
-		transport.NewWriter(io.Discard),
-		eventCoreCredentialReader(t, transport.Heartbeat{Type: transport.FrameTypeHeartbeat}),
-		capable,
-		"token",
-	); err == nil || !strings.Contains(err.Error(), "unexpected runtime credential response") {
-		t.Fatalf("unexpected credential frame error = %v", err)
-	}
-
-	if err := negotiateRuntimeToken(
-		transport.NewWriter(io.Discard),
-		eventCoreCredentialReader(t, transport.CredentialUpdateAck{
-			Type:      transport.FrameTypeCredentialUpdateAck,
-			Accepted:  false,
-			ErrorCode: transport.CredentialErrorRuntimeRejected,
-		}),
-		capable,
-		"token",
-	); !errors.Is(err, runtimecred.ErrRuntimeTokenRejected) {
-		t.Fatalf("runtime rejected ack error = %v", err)
-	}
-
-	for _, code := range []string{
-		transport.CredentialErrorGenerationConflict,
-		transport.CredentialErrorInvalid,
-		transport.CredentialErrorRegistration,
-		transport.CredentialErrorRuntimeRejected,
-		transport.CredentialErrorInternal,
-	} {
-		if got := safeCredentialErrorCode(code); got != code {
-			t.Fatalf("safeCredentialErrorCode(%q) = %q", code, got)
-		}
-	}
-	if got := safeCredentialErrorCode("peer-controlled"); got != transport.CredentialErrorInternal {
-		t.Fatalf("unknown credential error code = %q", got)
-	}
-}
-
-func TestCrossPlatformCoverageEventCoreRunManyHandshakeFailure(t *testing.T) {
-	bus := newManyFakeBus(901, nil)
-	installManyDiscover(t, bus)
-	cfg := manyTestConfig(io.Discard, io.Discard)
-	cfg.RuntimeToken = "runtime-token"
-	err := RunMany(context.Background(), cfg, manyTestSpecs())
-	if !errors.Is(err, ErrRuntimeTokenUnsupported) || !strings.Contains(err.Error(), "runtime credential handshake") {
-		t.Fatalf("RunMany handshake error = %v", err)
-	}
-}
@@ -21,11 +21,9 @@ import (
 	"io"
 	"net"
 	"os"
-	"strings"
 	"time"

 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/event/busctl"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/event/runtimecred"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/event/transport"
 )

@@ -47,11 +45,6 @@ type Config struct {
 	// personal_stream.
 	SpawnExtraArgs []string

-	// RuntimeToken is a host-supplied credential handed to a compatible bus
-	// only after capability negotiation over owner-only local IPC. It is never
-	// included in dry-run output, child argv, environment, or persisted state.
-	RuntimeToken string `json:"-" yaml:"-"`
-
 	// EventTypes / Filter / Compact are forwarded to the bus via Hello
 	// for server-side pushdown filtering.
 	EventTypes  []string
@@ -139,36 +132,6 @@ type Config struct {

 var discoverBus = busctl.Discover

-var (
-	ErrRuntimeTokenUnsupported = errors.New("consume: event bus does not support secure runtime-token handoff")
-	ErrRuntimeTokenUpdate      = errors.New("consume: event bus rejected runtime-token update")
-)
-
-// RuntimeTokenUnsupportedError is returned before the token is sent when the
-// connected bus lacks the runtime_token_v1 capability.
-type RuntimeTokenUnsupportedError struct {
-	BusPID int
-}
-
-func (e *RuntimeTokenUnsupportedError) Error() string {
-	return fmt.Sprintf("consume: running event bus (pid %d) does not support secure runtime-token handoff; let existing consumers exit, inspect with `dws event status --as user --format json`, preview cleanup with `dws event stop --as user --all --dry-run`, then confirm with `dws event stop --as user --all --yes` and retry", e.BusPID)
-}
-
-func (e *RuntimeTokenUnsupportedError) Unwrap() error { return ErrRuntimeTokenUnsupported }
-
-// RuntimeTokenUpdateError reports a rejected credential CAS without carrying
-// either the credential or peer-provided free-form error text.
-type RuntimeTokenUpdateError struct {
-	Code       string
-	Generation uint64
-}
-
-func (e *RuntimeTokenUpdateError) Error() string {
-	return fmt.Sprintf("consume: event bus rejected runtime-token update (code=%s, generation=%d)", e.Code, e.Generation)
-}
-
-func (e *RuntimeTokenUpdateError) Unwrap() error { return ErrRuntimeTokenUpdate }
-
 // Run dials the bus (forking one if necessary), sends Hello, and writes
 // each received Event frame as one NDJSON line to stdout. Blocks until
 // ctx is cancelled, MaxEvents is reached, the bus sends Bye, or the
@@ -181,7 +144,6 @@ func Run(ctx context.Context, cfg Config) error {
 	if cfg.WorkDir == "" || cfg.IPCEndpoint == "" || cfg.ClientID == "" {
 		return errors.New("consume: WorkDir, IPCEndpoint, and ClientID are required")
 	}
-	cfg.RuntimeToken = strings.TrimSpace(cfg.RuntimeToken)
 	if cfg.Stdout == nil {
 		cfg.Stdout = os.Stdout
 	}
@@ -263,9 +225,6 @@ func Run(ctx context.Context, cfg Config) error {
 		SubscribeID: cfg.SubscribeID,
 		Compact:     cfg.Compact,
 	}
-	if cfg.RuntimeToken != "" {
-		hello.CredentialMode = transport.CredentialModeRuntimeToken
-	}
 	if err := w.WriteJSON(hello); err != nil {
 		return fmt.Errorf("consume: write hello: %w", err)
 	}
@@ -277,9 +236,6 @@ func Run(ctx context.Context, cfg Config) error {
 	if ack.Type != transport.FrameTypeHelloAck {
 		return fmt.Errorf("consume: unexpected first frame type %q", ack.Type)
 	}
-	if err := negotiateRuntimeToken(w, r, ack, cfg.RuntimeToken); err != nil {
-		return err
-	}
 	if !cfg.Quiet {
 		// Contract: a fixed ready line on stderr BEFORE any stdout event.
 		// Parents block on stderr until this appears, then read stdout.
@@ -375,9 +331,6 @@ func Run(ctx context.Context, cfg Config) error {
 		case transport.FrameTypeBye:
 			var bye transport.Bye
 			_ = json.Unmarshal(raw, &bye)
-			if bye.Reason == transport.ByeReasonRuntimeTokenRejected {
-				return fmt.Errorf("consume: %w", runtimecred.ErrRuntimeTokenRejected)
-			}
 			if !cfg.Quiet {
 				fmt.Fprintf(cfg.Stderr, "[event] bus closing: %s\n", bye.Reason)
 			}
@@ -397,62 +350,6 @@ func Run(ctx context.Context, cfg Config) error {
 	}
 }

-func negotiateRuntimeToken(w *transport.Writer, r *transport.Reader, ack transport.HelloAck, token string) error {
-	if token == "" {
-		return nil
-	}
-	if ack.TerminalReason == transport.ByeReasonRuntimeTokenRejected {
-		return fmt.Errorf("consume: %w", runtimecred.ErrRuntimeTokenRejected)
-	}
-	if !hasCapability(ack.Capabilities, transport.CapabilityRuntimeTokenV1) {
-		return &RuntimeTokenUnsupportedError{BusPID: ack.BusPID}
-	}
-	if err := w.WriteJSON(transport.CredentialUpdate{
-		Type:               transport.FrameTypeCredentialUpdate,
-		ExpectedGeneration: ack.CredentialGeneration,
-		Token:              token,
-	}); err != nil {
-		return fmt.Errorf("consume: write runtime credential update: %w", err)
-	}
-	var updateAck transport.CredentialUpdateAck
-	if err := r.ReadJSON(&updateAck); err != nil {
-		return fmt.Errorf("consume: read runtime credential update ack: %w", err)
-	}
-	if updateAck.Type != transport.FrameTypeCredentialUpdateAck {
-		return errors.New("consume: unexpected runtime credential response frame")
-	}
-	if !updateAck.Accepted {
-		code := safeCredentialErrorCode(updateAck.ErrorCode)
-		if code == transport.CredentialErrorRuntimeRejected {
-			return fmt.Errorf("consume: %w", runtimecred.ErrRuntimeTokenRejected)
-		}
-		return &RuntimeTokenUpdateError{Code: code, Generation: updateAck.CredentialGeneration}
-	}
-	return nil
-}
-
-func safeCredentialErrorCode(code string) string {
-	switch code {
-	case transport.CredentialErrorGenerationConflict,
-		transport.CredentialErrorInvalid,
-		transport.CredentialErrorRegistration,
-		transport.CredentialErrorRuntimeRejected,
-		transport.CredentialErrorInternal:
-		return code
-	default:
-		return transport.CredentialErrorInternal
-	}
-}
-
-func hasCapability(capabilities []string, want string) bool {
-	for _, capability := range capabilities {
-		if capability == want {
-			return true
-		}
-	}
-	return false
-}
-
 // closeOnContext spawns a goroutine that closes conn when ctx is done.
 // This unblocks any pending Read on conn so the main loop can return.
 func closeOnContext(ctx context.Context, conn net.Conn) {
@@ -16,7 +16,6 @@ import (
 	"time"

 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/event/busctl"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/event/runtimecred"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/event/transport"
 )

@@ -54,7 +53,6 @@ func RunMany(ctx context.Context, cfg Config, specs []ConsumerSpec) error {
 	if cfg.WorkDir == "" || cfg.IPCEndpoint == "" || cfg.ClientID == "" {
 		return errors.New("consume: WorkDir, IPCEndpoint, and ClientID are required")
 	}
-	cfg.RuntimeToken = strings.TrimSpace(cfg.RuntimeToken)
 	if len(specs) < 2 {
 		return errors.New("consume: RunMany requires at least two consumers")
 	}
@@ -129,18 +127,14 @@ func RunMany(ctx context.Context, cfg Config, specs []ConsumerSpec) error {
 		}
 		sessions = append(sessions, session)
 		closeOnContext(ctx, session.conn)
-		hello := transport.Hello{
+		if err := session.w.WriteJSON(transport.Hello{
 			Type:        transport.FrameTypeHello,
 			ConsumerPID: os.Getpid(),
 			EventTypes:  spec.EventTypes,
 			Filter:      spec.Filter,
 			SubscribeID: spec.SubscribeID,
 			Compact:     cfg.Compact,
-		}
-		if cfg.RuntimeToken != "" {
-			hello.CredentialMode = transport.CredentialModeRuntimeToken
-		}
-		if err := session.w.WriteJSON(hello); err != nil {
+		}); err != nil {
 			return fmt.Errorf("consume: write hello for %s: %w", spec.EventKey, err)
 		}
 		if err := session.r.ReadJSON(&session.ack); err != nil {
@@ -149,16 +143,9 @@ func RunMany(ctx context.Context, cfg Config, specs []ConsumerSpec) error {
 		if session.ack.Type != transport.FrameTypeHelloAck {
 			return fmt.Errorf("consume: unexpected first frame type %q for %s", session.ack.Type, spec.EventKey)
 		}
-		// Verify that every connection reached the same bus before handing a
-		// runtime credential to it. Discovery is expected to converge on one
-		// daemon, but a stale endpoint/race must not propagate the host token to
-		// an unrelated process merely so we can report the PID mismatch later.
 		if len(sessions) > 1 && session.ack.BusPID != sessions[0].ack.BusPID {
 			return fmt.Errorf("consume: consumers connected to different bus processes (%d and %d)", sessions[0].ack.BusPID, session.ack.BusPID)
 		}
-		if err := negotiateRuntimeToken(session.w, session.r, session.ack, cfg.RuntimeToken); err != nil {
-			return fmt.Errorf("consume: runtime credential handshake for %s: %w", spec.EventKey, err)
-		}
 	}

 	if !cfg.Quiet {
@@ -238,9 +225,6 @@ func RunMany(ctx context.Context, cfg Config, specs []ConsumerSpec) error {
 			case transport.FrameTypeBye:
 				var bye transport.Bye
 				_ = json.Unmarshal(frame.raw, &bye)
-				if bye.Reason == transport.ByeReasonRuntimeTokenRejected {
-					return fmt.Errorf("consume: %w", runtimecred.ErrRuntimeTokenRejected)
-				}
 				if bye.Reason == transport.ByeReasonSubscriptionStopped {
 					delete(active, frame.index)
 					_ = sessions[frame.index].conn.Close()
@@ -16,7 +16,6 @@ import (
 	"time"

 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/event/busctl"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/event/runtimecred"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/event/transport"
 )

@@ -38,25 +37,23 @@ func (b *synchronizedBuffer) String() string {
 }

 type manyFakeBus struct {
-	client           net.Conn
-	server           net.Conn
-	hello            chan transport.Hello
-	credentialUpdate chan transport.CredentialUpdate
-	acked            chan struct{}
-	ackGate          <-chan struct{}
-	ack              transport.HelloAck
-	send             chan any
+	client  net.Conn
+	server  net.Conn
+	hello   chan transport.Hello
+	acked   chan struct{}
+	ackGate <-chan struct{}
+	ack     transport.HelloAck
+	send    chan any
 }

 func newManyFakeBus(busPID int, ackGate <-chan struct{}) *manyFakeBus {
 	client, server := net.Pipe()
 	f := &manyFakeBus{
-		client:           client,
-		server:           server,
-		hello:            make(chan transport.Hello, 1),
-		credentialUpdate: make(chan transport.CredentialUpdate, 1),
-		acked:            make(chan struct{}),
-		ackGate:          ackGate,
+		client:  client,
+		server:  server,
+		hello:   make(chan transport.Hello, 1),
+		acked:   make(chan struct{}),
+		ackGate: ackGate,
 		ack: transport.HelloAck{
 			Type:            transport.FrameTypeHelloAck,
 			BusPID:          busPID,
@@ -88,23 +85,6 @@ func (f *manyFakeBus) serve() {
 	if err := w.WriteJSON(f.ack); err != nil {
 		return
 	}
-	if hello.CredentialMode == transport.CredentialModeRuntimeToken {
-		if !hasCapability(f.ack.Capabilities, transport.CapabilityRuntimeTokenV1) {
-			return
-		}
-		var update transport.CredentialUpdate
-		if err := r.ReadJSON(&update); err != nil {
-			return
-		}
-		f.credentialUpdate <- update
-		if err := w.WriteJSON(transport.CredentialUpdateAck{
-			Type:                 transport.FrameTypeCredentialUpdateAck,
-			Accepted:             true,
-			CredentialGeneration: f.ack.CredentialGeneration + 1,
-		}); err != nil {
-			return
-		}
-	}
 	close(f.acked)
 	go func() {
 		for {
@@ -241,91 +221,6 @@ func TestRunManyWaitsForAllConsumersAndStopsOneAtATime(t *testing.T) {
 	}
 }

-func TestCrossPlatformCoverageRunManyRuntimeTokenUsesEachConnectionGeneration(t *testing.T) {
-	const canary = "many-runtime-canary"
-	busA := newManyFakeBus(111, nil)
-	busB := newManyFakeBus(111, nil)
-	busA.ack.Capabilities = []string{transport.CapabilityRuntimeTokenV1}
-	busB.ack.Capabilities = []string{transport.CapabilityRuntimeTokenV1}
-	busA.ack.CredentialGeneration = 2
-	busB.ack.CredentialGeneration = 8
-	installManyDiscover(t, busA, busB)
-
-	cfg := manyTestConfig(io.Discard, io.Discard)
-	cfg.RuntimeToken = canary
-	done := make(chan error, 1)
-	go func() { done <- RunMany(context.Background(), cfg, manyTestSpecs()) }()
-
-	updateA := <-busA.credentialUpdate
-	updateB := <-busB.credentialUpdate
-	if updateA.Token != canary || updateA.ExpectedGeneration != 2 {
-		t.Fatal("first connection used the wrong credential or generation")
-	}
-	if updateB.Token != canary || updateB.ExpectedGeneration != 8 {
-		t.Fatal("second connection used the wrong credential or generation")
-	}
-	busA.send <- transport.Bye{Type: transport.FrameTypeBye, Reason: "shutdown"}
-	select {
-	case err := <-done:
-		if err != nil {
-			t.Fatal(err)
-		}
-	case <-time.After(2 * time.Second):
-		t.Fatal("RunMany did not stop")
-	}
-}
-
-func TestCrossPlatformCoverageRunManyRuntimeTokenRejectsDifferentBusBeforeSecondCredential(t *testing.T) {
-	const canary = "many-mismatched-bus-canary"
-	busA := newManyFakeBus(111, nil)
-	busB := newManyFakeBus(222, nil)
-	busA.ack.Capabilities = []string{transport.CapabilityRuntimeTokenV1}
-	busB.ack.Capabilities = []string{transport.CapabilityRuntimeTokenV1}
-	installManyDiscover(t, busA, busB)
-
-	cfg := manyTestConfig(io.Discard, io.Discard)
-	cfg.RuntimeToken = canary
-	err := RunMany(context.Background(), cfg, manyTestSpecs())
-	if err == nil || !strings.Contains(err.Error(), "different bus processes") {
-		t.Fatalf("RunMany() error = %v", err)
-	}
-	if update := <-busA.credentialUpdate; update.Token != canary {
-		t.Fatal("first bus did not receive the negotiated credential")
-	}
-	select {
-	case update := <-busB.credentialUpdate:
-		t.Fatalf("mismatched second bus received credential: generation=%d", update.ExpectedGeneration)
-	default:
-	}
-}
-
-func TestCrossPlatformCoverageRunManyRuntimeTokenRejectedByeReturnsTypedError(t *testing.T) {
-	busA := newManyFakeBus(333, nil)
-	busB := newManyFakeBus(333, nil)
-	busA.ack.Capabilities = []string{transport.CapabilityRuntimeTokenV1}
-	busB.ack.Capabilities = []string{transport.CapabilityRuntimeTokenV1}
-	installManyDiscover(t, busA, busB)
-
-	cfg := manyTestConfig(io.Discard, io.Discard)
-	cfg.RuntimeToken = "many-runtime-rejected-canary"
-	done := make(chan error, 1)
-	go func() { done <- RunMany(context.Background(), cfg, manyTestSpecs()) }()
-	<-busA.credentialUpdate
-	<-busB.credentialUpdate
-	busA.send <- transport.Bye{
-		Type:   transport.FrameTypeBye,
-		Reason: transport.ByeReasonRuntimeTokenRejected,
-	}
-	select {
-	case err := <-done:
-		if !errors.Is(err, runtimecred.ErrRuntimeTokenRejected) {
-			t.Fatalf("RunMany() error = %v", err)
-		}
-	case <-time.After(2 * time.Second):
-		t.Fatal("RunMany did not return runtime credential rejection")
-	}
-}
-
 func TestRunManyMaxEventsIsSharedAcrossConsumers(t *testing.T) {
 	busA := newManyFakeBus(202, nil)
 	busB := newManyFakeBus(202, nil)
@@ -1,242 +0,0 @@
-// Copyright 2026 Alibaba Group
-// Licensed under the Apache License, Version 2.0 (the "License");
-
-package consume
-
-import (
-	"bytes"
-	"context"
-	"errors"
-	"io"
-	"net"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/event/busctl"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/event/runtimecred"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/event/transport"
-)
-
-func installRuntimeCredentialDiscover(t *testing.T, serve func(net.Conn)) {
-	t.Helper()
-	oldDiscover := discoverBus
-	done := make(chan struct{})
-	discoverBus = func(busctl.DiscoverConfig) (net.Conn, error) {
-		client, server := net.Pipe()
-		go func() {
-			defer close(done)
-			defer server.Close()
-			serve(server)
-		}()
-		return client, nil
-	}
-	t.Cleanup(func() {
-		discoverBus = oldDiscover
-		select {
-		case <-done:
-		case <-time.After(time.Second):
-			t.Error("fake runtime credential bus did not stop")
-		}
-	})
-}
-
-func TestCrossPlatformCoverageRunRuntimeTokenNegotiatesBeforeReady(t *testing.T) {
-	const canary = "consume-runtime-canary"
-	helloSeen := make(chan transport.Hello, 1)
-	updateSeen := make(chan transport.CredentialUpdate, 1)
-	installRuntimeCredentialDiscover(t, func(conn net.Conn) {
-		r, w := transport.NewReader(conn), transport.NewWriter(conn)
-		var hello transport.Hello
-		if err := r.ReadJSON(&hello); err != nil {
-			return
-		}
-		helloSeen <- hello
-		_ = w.WriteJSON(transport.HelloAck{
-			Type:                 transport.FrameTypeHelloAck,
-			BusPID:               71,
-			Capabilities:         []string{transport.CapabilityRuntimeTokenV1},
-			CredentialGeneration: 3,
-		})
-		var update transport.CredentialUpdate
-		if err := r.ReadJSON(&update); err != nil {
-			return
-		}
-		updateSeen <- update
-		_ = w.WriteJSON(transport.CredentialUpdateAck{
-			Type:                 transport.FrameTypeCredentialUpdateAck,
-			Accepted:             true,
-			CredentialGeneration: 4,
-		})
-		_ = w.WriteJSON(transport.Bye{Type: transport.FrameTypeBye, Reason: "done"})
-	})
-
-	var stderr bytes.Buffer
-	cfg := validRunConfig()
-	cfg.RuntimeToken = "  " + canary + "  "
-	cfg.Stderr = &stderr
-	if err := Run(context.Background(), cfg); err != nil {
-		t.Fatal(err)
-	}
-	hello := <-helloSeen
-	if hello.CredentialMode != transport.CredentialModeRuntimeToken {
-		t.Fatalf("credential mode = %q", hello.CredentialMode)
-	}
-	update := <-updateSeen
-	if update.ExpectedGeneration != 3 || update.Token != canary {
-		t.Fatal("credential update used the wrong token or generation")
-	}
-	if !strings.Contains(stderr.String(), "[event] ready bus_pid=71") {
-		t.Fatalf("ready marker missing: %s", stderr.String())
-	}
-}
-
-func TestCrossPlatformCoverageRunRuntimeTokenMissingCapabilityFailsBeforeSendingSecretOrReady(t *testing.T) {
-	const canary = "unsupported-canary-secret"
-	peerBytes := make(chan string, 1)
-	installRuntimeCredentialDiscover(t, func(conn net.Conn) {
-		r, w := transport.NewReader(conn), transport.NewWriter(conn)
-		var hello transport.Hello
-		if err := r.ReadJSON(&hello); err != nil {
-			return
-		}
-		_ = w.WriteJSON(transport.HelloAck{Type: transport.FrameTypeHelloAck, BusPID: 72})
-		raw, _ := io.ReadAll(conn)
-		peerBytes <- string(raw)
-	})
-
-	var stderr bytes.Buffer
-	cfg := validRunConfig()
-	cfg.RuntimeToken = canary
-	cfg.Stderr = &stderr
-	err := Run(context.Background(), cfg)
-	if !errors.Is(err, ErrRuntimeTokenUnsupported) {
-		t.Fatalf("Run error = %v", err)
-	}
-	if strings.Contains(err.Error(), canary) {
-		t.Fatal("unsupported-bus error contained runtime token")
-	}
-	for _, recoveryStep := range []string{
-		"dws event status --as user --format json",
-		"dws event stop --as user --all --dry-run",
-		"dws event stop --as user --all --yes",
-	} {
-		if !strings.Contains(err.Error(), recoveryStep) {
-			t.Fatalf("unsupported-bus error missing recovery step %q: %v", recoveryStep, err)
-		}
-	}
-	if strings.Contains(stderr.String(), "[event] ready") {
-		t.Fatal("ready marker was written before capability negotiation succeeded")
-	}
-	if got := <-peerBytes; strings.Contains(got, canary) || got != "" {
-		t.Fatal("client sent data after unsupported capability acknowledgement")
-	}
-}
-
-func TestCrossPlatformCoverageRunRuntimeTokenRejectedDoesNotSurfacePeerText(t *testing.T) {
-	const canary = "rejected-canary-secret"
-	installRuntimeCredentialDiscover(t, func(conn net.Conn) {
-		r, w := transport.NewReader(conn), transport.NewWriter(conn)
-		var hello transport.Hello
-		if err := r.ReadJSON(&hello); err != nil {
-			return
-		}
-		_ = w.WriteJSON(transport.HelloAck{
-			Type:         transport.FrameTypeHelloAck,
-			Capabilities: []string{transport.CapabilityRuntimeTokenV1},
-		})
-		var update transport.CredentialUpdate
-		if err := r.ReadJSON(&update); err != nil {
-			return
-		}
-		_ = w.WriteJSON(transport.CredentialUpdateAck{
-			Type:      transport.FrameTypeCredentialUpdateAck,
-			Accepted:  false,
-			ErrorCode: "malicious-code-" + update.Token,
-			Error:     "malicious echo " + update.Token,
-		})
-	})
-
-	cfg := validRunConfig()
-	cfg.RuntimeToken = canary
-	err := Run(context.Background(), cfg)
-	if !errors.Is(err, ErrRuntimeTokenUpdate) {
-		t.Fatalf("Run error = %v", err)
-	}
-	if strings.Contains(err.Error(), canary) {
-		t.Fatal("credential update error contained peer-provided token text")
-	}
-}
-
-func TestCrossPlatformCoverageRuntimeTokenNeverAppearsInDryRun(t *testing.T) {
-	const canary = "dry-run-canary-secret"
-	var output bytes.Buffer
-	cfg := validRunConfig()
-	cfg.RuntimeToken = canary
-	PrintDryRun(&output, cfg)
-	if strings.Contains(output.String(), canary) || strings.Contains(output.String(), "RuntimeToken") {
-		t.Fatal("dry-run output contained runtime-token data")
-	}
-}
-
-func TestCrossPlatformCoverageRunWhitespaceRuntimeTokenUsesLegacyHandshake(t *testing.T) {
-	helloSeen := make(chan transport.Hello, 1)
-	installRuntimeCredentialDiscover(t, func(conn net.Conn) {
-		r, w := transport.NewReader(conn), transport.NewWriter(conn)
-		var hello transport.Hello
-		if err := r.ReadJSON(&hello); err != nil {
-			return
-		}
-		helloSeen <- hello
-		_ = w.WriteJSON(transport.HelloAck{Type: transport.FrameTypeHelloAck})
-		_ = w.WriteJSON(transport.Bye{Type: transport.FrameTypeBye, Reason: "done"})
-	})
-	cfg := validRunConfig()
-	cfg.RuntimeToken = "   "
-	if err := Run(context.Background(), cfg); err != nil {
-		t.Fatal(err)
-	}
-	if hello := <-helloSeen; hello.CredentialMode != "" {
-		t.Fatalf("whitespace token enabled mode %q", hello.CredentialMode)
-	}
-}
-
-func TestCrossPlatformCoverageRunRuntimeTokenRejectedByeReturnsTypedError(t *testing.T) {
-	installRuntimeCredentialDiscover(t, func(conn net.Conn) {
-		r, w := transport.NewReader(conn), transport.NewWriter(conn)
-		var hello transport.Hello
-		if err := r.ReadJSON(&hello); err != nil {
-			return
-		}
-		_ = w.WriteJSON(transport.HelloAck{
-			Type:         transport.FrameTypeHelloAck,
-			BusPID:       73,
-			Capabilities: []string{transport.CapabilityRuntimeTokenV1},
-		})
-		var update transport.CredentialUpdate
-		if err := r.ReadJSON(&update); err != nil {
-			return
-		}
-		_ = w.WriteJSON(transport.CredentialUpdateAck{
-			Type:                 transport.FrameTypeCredentialUpdateAck,
-			Accepted:             true,
-			CredentialGeneration: 1,
-		})
-		_ = w.WriteJSON(transport.Bye{
-			Type:   transport.FrameTypeBye,
-			Reason: transport.ByeReasonRuntimeTokenRejected,
-		})
-	})
-
-	var stderr bytes.Buffer
-	cfg := validRunConfig()
-	cfg.RuntimeToken = "runtime-rejected-canary"
-	cfg.Stderr = &stderr
-	err := Run(context.Background(), cfg)
-	if !errors.Is(err, runtimecred.ErrRuntimeTokenRejected) {
-		t.Fatalf("Run() error = %v", err)
-	}
-	if strings.Contains(stderr.String(), "reason: bus_shutdown") {
-		t.Fatalf("runtime rejection was reported as a successful exit: %s", stderr.String())
-	}
-}
@@ -113,9 +113,8 @@ func IsValidationError(err error) bool {
 // human-readable block. Called by Run when cfg.DryRun is true. Format
 // avoids JSON so users can `dws event consume --dry-run | head` cleanly.
 //
-// RuntimeToken is the only secret-bearing Config field and is deliberately
-// not read or rendered here. Keep this function allowlist-based: never switch
-// it to generic struct serialization.
+// Secret-bearing fields are never present in Config (credentials never
+// reach this layer), so no redaction is required here.
 func PrintDryRun(w io.Writer, cfg Config) {
 	if w == nil {
 		return
@@ -128,12 +128,6 @@ func TestClientCreateRuleBasedSubscriptionsUsesDocumentedRuleParam(t *testing.T)
 		{"receive_user/openDingtalkId", EventFromUser, RuleOptions{OpenDingTalkID: "open-user-1"}, map[string]any{"targetUid": "open-user-1", "targetUidType": "openDingtalkId"}},
 		{"receive_o2o_all", EventAllSingleChat, RuleOptions{}, map[string]any{}},
 		{"receive_group_all", EventAllGroupChat, RuleOptions{}, map[string]any{}},
-		{"oa_approval_task_created", EventOAApprovalTaskCreated, RuleOptions{}, map[string]any{}},
-		{"oa_approval_task_finished", EventOAApprovalTaskFinished, RuleOptions{}, map[string]any{}},
-		{"oa_approval_task_redirected", EventOAApprovalTaskRedirected, RuleOptions{}, map[string]any{}},
-		{"oa_approval_instance_started", EventOAApprovalInstanceStarted, RuleOptions{}, map[string]any{}},
-		{"oa_approval_instance_terminated", EventOAApprovalInstanceTerminated, RuleOptions{}, map[string]any{}},
-		{"oa_approval_instance_finished", EventOAApprovalInstanceFinished, RuleOptions{}, map[string]any{}},
 		{"read_group", EventReadGroup, RuleOptions{GroupID: "cid-1"}, map[string]any{"openConversationId": "cid-1"}},
 		{"recall_group", EventRecallGroup, RuleOptions{GroupID: "cid-1"}, map[string]any{"openConversationId": "cid-1"}},
 		{"reaction_group", EventReactionGroup, RuleOptions{GroupID: "cid-1"}, map[string]any{"openConversationId": "cid-1"}},
@@ -121,94 +121,6 @@ type GroupLifecycleEventOutput struct {
 	Payload     map[string]any `json:"payload" description:"群生命周期事件业务数据，字段以服务端实际推送为准" additional_properties:"true"`
 }

-type OAApprovalTaskCreatedOutput struct {
-	Type              string `json:"type" description:"事件类型，固定为当前 event_key"`
-	EventID           string `json:"event_id" description:"事件 ID，可用于去重"`
-	Timestamp         int64  `json:"timestamp" description:"事件发生时间戳" format:"timestamp_ms"`
-	SubscribeID       string `json:"subscribe_id" description:"订阅 ID"`
-	ProcessInstanceID string `json:"process_instance_id" description:"审批实例 ID"`
-	ProcessCode       string `json:"process_code" description:"审批流程模板编码"`
-	TaskID            string `json:"task_id" description:"审批任务 ID"`
-	Title             string `json:"title" description:"审批标题"`
-	Status            string `json:"status" description:"审批任务状态"`
-	CreateTime        int64  `json:"create_time" description:"审批任务创建时间" format:"timestamp_ms"`
-	EventTime         int64  `json:"event_time" description:"审批任务事件业务时间" format:"timestamp_ms"`
-}
-
-type OAApprovalTaskFinishedOutput struct {
-	Type              string `json:"type" description:"事件类型，固定为当前 event_key"`
-	EventID           string `json:"event_id" description:"事件 ID，可用于去重"`
-	Timestamp         int64  `json:"timestamp" description:"事件发生时间戳" format:"timestamp_ms"`
-	SubscribeID       string `json:"subscribe_id" description:"订阅 ID"`
-	ProcessInstanceID string `json:"process_instance_id" description:"审批实例 ID"`
-	ProcessCode       string `json:"process_code" description:"审批流程模板编码"`
-	TaskID            string `json:"task_id" description:"审批任务 ID"`
-	Title             string `json:"title" description:"审批标题"`
-	Status            string `json:"status" description:"审批任务状态"`
-	Result            string `json:"result" description:"审批任务处理结果，值以服务端实际推送为准"`
-	CreateTime        int64  `json:"create_time" description:"审批任务创建时间" format:"timestamp_ms"`
-	FinishTime        int64  `json:"finish_time" description:"审批任务完成时间" format:"timestamp_ms"`
-	EventTime         int64  `json:"event_time" description:"审批任务事件业务时间" format:"timestamp_ms"`
-}
-
-type OAApprovalTaskRedirectedOutput struct {
-	Type              string `json:"type" description:"事件类型，固定为当前 event_key"`
-	EventID           string `json:"event_id" description:"事件 ID，可用于去重"`
-	Timestamp         int64  `json:"timestamp" description:"事件发生时间戳" format:"timestamp_ms"`
-	SubscribeID       string `json:"subscribe_id" description:"订阅 ID"`
-	ProcessInstanceID string `json:"process_instance_id" description:"审批实例 ID"`
-	ProcessCode       string `json:"process_code" description:"审批流程模板编码"`
-	TaskID            string `json:"task_id" description:"原审批任务 ID"`
-	Title             string `json:"title" description:"审批标题"`
-	Status            string `json:"status" description:"原审批任务状态"`
-	Result            string `json:"result" description:"审批任务转交结果，值以服务端实际推送为准"`
-	CreateTime        int64  `json:"create_time" description:"原审批任务创建时间" format:"timestamp_ms"`
-	FinishTime        int64  `json:"finish_time" description:"原审批任务转交完成时间" format:"timestamp_ms"`
-	EventTime         int64  `json:"event_time" description:"审批任务转交事件业务时间" format:"timestamp_ms"`
-}
-
-type OAApprovalInstanceStartedOutput struct {
-	Type              string `json:"type" description:"事件类型，固定为当前 event_key"`
-	EventID           string `json:"event_id" description:"事件 ID，可用于去重"`
-	Timestamp         int64  `json:"timestamp" description:"事件发生时间戳" format:"timestamp_ms"`
-	SubscribeID       string `json:"subscribe_id" description:"订阅 ID"`
-	ProcessInstanceID string `json:"process_instance_id" description:"审批实例 ID"`
-	ProcessCode       string `json:"process_code" description:"审批流程模板编码"`
-	Title             string `json:"title" description:"审批标题"`
-	Status            string `json:"status" description:"审批实例状态"`
-	CreateTime        int64  `json:"create_time" description:"审批实例创建时间" format:"timestamp_ms"`
-	EventTime         int64  `json:"event_time" description:"审批实例事件业务时间" format:"timestamp_ms"`
-}
-
-type OAApprovalInstanceTerminatedOutput struct {
-	Type              string `json:"type" description:"事件类型，固定为当前 event_key"`
-	EventID           string `json:"event_id" description:"事件 ID，可用于去重"`
-	Timestamp         int64  `json:"timestamp" description:"事件发生时间戳" format:"timestamp_ms"`
-	SubscribeID       string `json:"subscribe_id" description:"订阅 ID"`
-	ProcessInstanceID string `json:"process_instance_id" description:"审批实例 ID"`
-	ProcessCode       string `json:"process_code" description:"审批流程模板编码"`
-	Title             string `json:"title" description:"审批标题"`
-	Status            string `json:"status" description:"审批实例状态"`
-	CreateTime        int64  `json:"create_time" description:"审批实例创建时间" format:"timestamp_ms"`
-	FinishTime        int64  `json:"finish_time" description:"审批实例终止时间" format:"timestamp_ms"`
-	EventTime         int64  `json:"event_time" description:"审批实例终止事件业务时间" format:"timestamp_ms"`
-}
-
-type OAApprovalInstanceFinishedOutput struct {
-	Type              string `json:"type" description:"事件类型，固定为当前 event_key"`
-	EventID           string `json:"event_id" description:"事件 ID，可用于去重"`
-	Timestamp         int64  `json:"timestamp" description:"事件发生时间戳" format:"timestamp_ms"`
-	SubscribeID       string `json:"subscribe_id" description:"订阅 ID"`
-	ProcessInstanceID string `json:"process_instance_id" description:"审批实例 ID"`
-	ProcessCode       string `json:"process_code" description:"审批流程模板编码"`
-	Title             string `json:"title" description:"审批标题"`
-	Status            string `json:"status" description:"审批实例状态"`
-	Result            string `json:"result" description:"审批实例处理结果，值以服务端实际推送为准"`
-	CreateTime        int64  `json:"create_time" description:"审批实例创建时间" format:"timestamp_ms"`
-	FinishTime        int64  `json:"finish_time" description:"审批实例完成时间" format:"timestamp_ms"`
-	EventTime         int64  `json:"event_time" description:"审批实例事件业务时间" format:"timestamp_ms"`
-}
-
 type GroupMemberEventOutput struct {
 	Type                   string                   `json:"type" description:"事件类型，固定为当前 event_key"`
 	EventID                string                   `json:"event_id" description:"事件 ID，可用于去重"`
@@ -318,22 +230,6 @@ type personalGroupMemberRecord struct {
 	OpenDingTalkID string `json:"openDingTalkId"`
 }

-type personalOAApprovalPayload struct {
-	EventTime int64                  `json:"event_time"`
-	Body      personalOAApprovalBody `json:"body"`
-}
-
-type personalOAApprovalBody struct {
-	ProcessInstanceID string `json:"processInstanceId"`
-	ProcessCode       string `json:"processCode"`
-	TaskID            string `json:"taskId"`
-	Title             string `json:"title"`
-	Status            string `json:"status"`
-	Result            string `json:"result"`
-	CreateTime        int64  `json:"createTime"`
-	FinishTime        int64  `json:"finishTime"`
-}
-
 func (b *personalReactionBody) UnmarshalJSON(data []byte) error {
 	// encoding/json otherwise falls back to case-insensitive field matching.
 	// Read this protocol field from a map so only operOpenDingtalkId is accepted.
@@ -447,7 +343,7 @@ func ProjectOutput(ev transport.Event) (any, error) {
 	case isGroupMemberEvent(eventType):
 		return projectGroupMemberEvent(ev, base, data.Payload)
 	case isGroupLifecycleEvent(eventType):
-		payload, err := decodeConservativePayload(data.Payload)
+		payload, err := decodeGroupLifecyclePayload(data.Payload)
 		if err != nil {
 			return ev, fmt.Errorf("decode personal group lifecycle payload: %w", err)
 		}
@@ -458,8 +354,6 @@ func ProjectOutput(ev transport.Event) (any, error) {
 			SubscribeID: base.SubscribeID,
 			Payload:     payload,
 		}, nil
-	case isOAEvent(eventType):
-		return projectOAApprovalEvent(ev, base, data.Payload)
 	default:
 		return ev, fmt.Errorf("unsupported personal event type %q", eventType)
 	}
@@ -476,7 +370,7 @@ func projectMessageEventContext(message personalMessageContext) MessageEventCont
 	}
 }

-func decodeConservativePayload(raw json.RawMessage) (map[string]any, error) {
+func decodeGroupLifecyclePayload(raw json.RawMessage) (map[string]any, error) {
 	trimmed := bytes.TrimSpace(raw)
 	if len(trimmed) == 0 || bytes.Equal(trimmed, []byte("null")) {
 		return nil, fmt.Errorf("payload is missing")
@@ -595,112 +489,6 @@ func projectGroupMemberEvent(ev transport.Event, base baseEventOutput, raw json.
 	}, nil
 }

-func projectOAApprovalEvent(ev transport.Event, base baseEventOutput, raw json.RawMessage) (any, error) {
-	var payload personalOAApprovalPayload
-	if err := decodeRequiredPayload(raw, &payload); err != nil {
-		return ev, fmt.Errorf("decode personal OA payload: %w", err)
-	}
-	if strings.TrimSpace(payload.Body.ProcessInstanceID) == "" {
-		return ev, fmt.Errorf("decode personal OA payload: processInstanceId is required")
-	}
-	if isOAApprovalTaskEvent(base.Type) && strings.TrimSpace(payload.Body.TaskID) == "" {
-		return ev, fmt.Errorf("decode personal OA payload: taskId is required for %s", base.Type)
-	}
-
-	switch base.Type {
-	case EventOAApprovalTaskCreated:
-		return OAApprovalTaskCreatedOutput{
-			Type:              base.Type,
-			EventID:           base.EventID,
-			Timestamp:         base.Timestamp,
-			SubscribeID:       base.SubscribeID,
-			ProcessInstanceID: payload.Body.ProcessInstanceID,
-			ProcessCode:       payload.Body.ProcessCode,
-			TaskID:            payload.Body.TaskID,
-			Title:             payload.Body.Title,
-			Status:            payload.Body.Status,
-			CreateTime:        payload.Body.CreateTime,
-			EventTime:         payload.EventTime,
-		}, nil
-	case EventOAApprovalTaskFinished:
-		return OAApprovalTaskFinishedOutput{
-			Type:              base.Type,
-			EventID:           base.EventID,
-			Timestamp:         base.Timestamp,
-			SubscribeID:       base.SubscribeID,
-			ProcessInstanceID: payload.Body.ProcessInstanceID,
-			ProcessCode:       payload.Body.ProcessCode,
-			TaskID:            payload.Body.TaskID,
-			Title:             payload.Body.Title,
-			Status:            payload.Body.Status,
-			Result:            payload.Body.Result,
-			CreateTime:        payload.Body.CreateTime,
-			FinishTime:        payload.Body.FinishTime,
-			EventTime:         payload.EventTime,
-		}, nil
-	case EventOAApprovalTaskRedirected:
-		return OAApprovalTaskRedirectedOutput{
-			Type:              base.Type,
-			EventID:           base.EventID,
-			Timestamp:         base.Timestamp,
-			SubscribeID:       base.SubscribeID,
-			ProcessInstanceID: payload.Body.ProcessInstanceID,
-			ProcessCode:       payload.Body.ProcessCode,
-			TaskID:            payload.Body.TaskID,
-			Title:             payload.Body.Title,
-			Status:            payload.Body.Status,
-			Result:            payload.Body.Result,
-			CreateTime:        payload.Body.CreateTime,
-			FinishTime:        payload.Body.FinishTime,
-			EventTime:         payload.EventTime,
-		}, nil
-	case EventOAApprovalInstanceStarted:
-		return OAApprovalInstanceStartedOutput{
-			Type:              base.Type,
-			EventID:           base.EventID,
-			Timestamp:         base.Timestamp,
-			SubscribeID:       base.SubscribeID,
-			ProcessInstanceID: payload.Body.ProcessInstanceID,
-			ProcessCode:       payload.Body.ProcessCode,
-			Title:             payload.Body.Title,
-			Status:            payload.Body.Status,
-			CreateTime:        payload.Body.CreateTime,
-			EventTime:         payload.EventTime,
-		}, nil
-	case EventOAApprovalInstanceTerminated:
-		return OAApprovalInstanceTerminatedOutput{
-			Type:              base.Type,
-			EventID:           base.EventID,
-			Timestamp:         base.Timestamp,
-			SubscribeID:       base.SubscribeID,
-			ProcessInstanceID: payload.Body.ProcessInstanceID,
-			ProcessCode:       payload.Body.ProcessCode,
-			Title:             payload.Body.Title,
-			Status:            payload.Body.Status,
-			CreateTime:        payload.Body.CreateTime,
-			FinishTime:        payload.Body.FinishTime,
-			EventTime:         payload.EventTime,
-		}, nil
-	case EventOAApprovalInstanceFinished:
-		return OAApprovalInstanceFinishedOutput{
-			Type:              base.Type,
-			EventID:           base.EventID,
-			Timestamp:         base.Timestamp,
-			SubscribeID:       base.SubscribeID,
-			ProcessInstanceID: payload.Body.ProcessInstanceID,
-			ProcessCode:       payload.Body.ProcessCode,
-			Title:             payload.Body.Title,
-			Status:            payload.Body.Status,
-			Result:            payload.Body.Result,
-			CreateTime:        payload.Body.CreateTime,
-			FinishTime:        payload.Body.FinishTime,
-			EventTime:         payload.EventTime,
-		}, nil
-	default:
-		return ev, fmt.Errorf("unsupported personal OA event type %q", base.Type)
-	}
-}
-
 func decodeRequiredPayload(raw json.RawMessage, target any) error {
 	trimmed := bytes.TrimSpace(raw)
 	if len(trimmed) == 0 || bytes.Equal(trimmed, []byte("null")) {
@@ -863,18 +651,6 @@ func outputTypeForEvent(eventKey string) reflect.Type {
 		return reflect.TypeOf(GroupMemberEventOutput{})
 	case isGroupLifecycleEvent(eventKey):
 		return reflect.TypeOf(GroupLifecycleEventOutput{})
-	case eventKey == EventOAApprovalTaskCreated:
-		return reflect.TypeOf(OAApprovalTaskCreatedOutput{})
-	case eventKey == EventOAApprovalTaskFinished:
-		return reflect.TypeOf(OAApprovalTaskFinishedOutput{})
-	case eventKey == EventOAApprovalTaskRedirected:
-		return reflect.TypeOf(OAApprovalTaskRedirectedOutput{})
-	case eventKey == EventOAApprovalInstanceStarted:
-		return reflect.TypeOf(OAApprovalInstanceStartedOutput{})
-	case eventKey == EventOAApprovalInstanceTerminated:
-		return reflect.TypeOf(OAApprovalInstanceTerminatedOutput{})
-	case eventKey == EventOAApprovalInstanceFinished:
-		return reflect.TypeOf(OAApprovalInstanceFinishedOutput{})
 	default:
 		return reflect.TypeOf(baseEventOutput{})
 	}
@@ -901,21 +677,6 @@ func isGroupLifecycleEvent(eventKey string) bool {
 		eventKey == EventGroupDisbanded
 }

-func isOAEvent(eventKey string) bool {
-	return eventKey == EventOAApprovalTaskCreated ||
-		eventKey == EventOAApprovalTaskFinished ||
-		eventKey == EventOAApprovalTaskRedirected ||
-		eventKey == EventOAApprovalInstanceStarted ||
-		eventKey == EventOAApprovalInstanceTerminated ||
-		eventKey == EventOAApprovalInstanceFinished
-}
-
-func isOAApprovalTaskEvent(eventKey string) bool {
-	return eventKey == EventOAApprovalTaskCreated ||
-		eventKey == EventOAApprovalTaskFinished ||
-		eventKey == EventOAApprovalTaskRedirected
-}
-
 func schemaType(t reflect.Type) string {
 	switch t.Kind() {
 	case reflect.String:
@@ -150,59 +150,6 @@ func personalGroupMemberData(eventKey string) string {
 	}`, eventKey)
 }

-func personalOAData(eventKey string) string {
-	body := map[string]any{
-		"processInstanceId": "process-instance-1",
-		"createTime":        int64(1785229100000),
-		"processCode":       "PROC-TEST-1",
-		"title":             "测试审批",
-	}
-	switch eventKey {
-	case EventOAApprovalTaskCreated:
-		body["taskId"] = "approval-task-1"
-		body["status"] = "RUNNING"
-	case EventOAApprovalTaskFinished:
-		body["taskId"] = "approval-task-1"
-		body["status"] = "FINISHED"
-		body["result"] = "agree"
-		body["finishTime"] = int64(1785229199000)
-	case EventOAApprovalTaskRedirected:
-		body["taskId"] = "approval-task-1"
-		body["status"] = "FINISHED"
-		body["result"] = "redirect"
-		body["finishTime"] = int64(1785229199000)
-	case EventOAApprovalInstanceStarted:
-		body["status"] = "RUNNING"
-	case EventOAApprovalInstanceTerminated:
-		body["status"] = "TERMINATED"
-		body["finishTime"] = int64(1785229199000)
-	case EventOAApprovalInstanceFinished:
-		body["status"] = "FINISHED"
-		body["result"] = "agree"
-		body["finishTime"] = int64(1785229199000)
-	}
-	data := map[string]any{
-		"eventId":      "oa-event",
-		"eventKey":     eventKey,
-		"occurredAtMs": int64(1785229200123),
-		"subId":        "oa-data-sub",
-		"payload": map[string]any{
-			"uid":         100001,
-			"CORPID":      "internal-corp",
-			"clientId":    "internal-client",
-			"filterSubId": "internal-filter",
-			"bizid":       "internal-biz",
-			"orgId":       100002,
-			"sourceId":    "open",
-			"body":        body,
-			"event_time":  int64(1785229199000),
-			"futureField": map[string]any{"nested": true},
-		},
-	}
-	encoded, _ := json.Marshal(data)
-	return string(encoded)
-}
-
 func TestCrossPlatformCoverageProjectOutputMessageEvents(t *testing.T) {
 	for _, eventKey := range []string{EventMention, EventSingleChat, EventInChat, EventFromUser, EventAllSingleChat, EventAllGroupChat} {
 		t.Run(eventKey, func(t *testing.T) {
@@ -449,170 +396,6 @@ func TestCrossPlatformCoverageProjectOutputGroupLifecycleEvents(t *testing.T) {
 	}
 }

-func TestCrossPlatformCoverageProjectOutputOAEvents(t *testing.T) {
-	tests := []struct {
-		eventKey string
-		want     any
-	}{
-		{
-			eventKey: EventOAApprovalTaskCreated,
-			want: OAApprovalTaskCreatedOutput{
-				Type:              EventOAApprovalTaskCreated,
-				EventID:           "oa-event",
-				Timestamp:         1785229200123,
-				SubscribeID:       "outer-sub",
-				ProcessInstanceID: "process-instance-1",
-				ProcessCode:       "PROC-TEST-1",
-				TaskID:            "approval-task-1",
-				Title:             "测试审批",
-				Status:            "RUNNING",
-				CreateTime:        1785229100000,
-				EventTime:         1785229199000,
-			},
-		},
-		{
-			eventKey: EventOAApprovalTaskFinished,
-			want: OAApprovalTaskFinishedOutput{
-				Type:              EventOAApprovalTaskFinished,
-				EventID:           "oa-event",
-				Timestamp:         1785229200123,
-				SubscribeID:       "outer-sub",
-				ProcessInstanceID: "process-instance-1",
-				ProcessCode:       "PROC-TEST-1",
-				TaskID:            "approval-task-1",
-				Title:             "测试审批",
-				Status:            "FINISHED",
-				Result:            "agree",
-				CreateTime:        1785229100000,
-				FinishTime:        1785229199000,
-				EventTime:         1785229199000,
-			},
-		},
-		{
-			eventKey: EventOAApprovalTaskRedirected,
-			want: OAApprovalTaskRedirectedOutput{
-				Type:              EventOAApprovalTaskRedirected,
-				EventID:           "oa-event",
-				Timestamp:         1785229200123,
-				SubscribeID:       "outer-sub",
-				ProcessInstanceID: "process-instance-1",
-				ProcessCode:       "PROC-TEST-1",
-				TaskID:            "approval-task-1",
-				Title:             "测试审批",
-				Status:            "FINISHED",
-				Result:            "redirect",
-				CreateTime:        1785229100000,
-				FinishTime:        1785229199000,
-				EventTime:         1785229199000,
-			},
-		},
-		{
-			eventKey: EventOAApprovalInstanceStarted,
-			want: OAApprovalInstanceStartedOutput{
-				Type:              EventOAApprovalInstanceStarted,
-				EventID:           "oa-event",
-				Timestamp:         1785229200123,
-				SubscribeID:       "outer-sub",
-				ProcessInstanceID: "process-instance-1",
-				ProcessCode:       "PROC-TEST-1",
-				Title:             "测试审批",
-				Status:            "RUNNING",
-				CreateTime:        1785229100000,
-				EventTime:         1785229199000,
-			},
-		},
-		{
-			eventKey: EventOAApprovalInstanceTerminated,
-			want: OAApprovalInstanceTerminatedOutput{
-				Type:              EventOAApprovalInstanceTerminated,
-				EventID:           "oa-event",
-				Timestamp:         1785229200123,
-				SubscribeID:       "outer-sub",
-				ProcessInstanceID: "process-instance-1",
-				ProcessCode:       "PROC-TEST-1",
-				Title:             "测试审批",
-				Status:            "TERMINATED",
-				CreateTime:        1785229100000,
-				FinishTime:        1785229199000,
-				EventTime:         1785229199000,
-			},
-		},
-		{
-			eventKey: EventOAApprovalInstanceFinished,
-			want: OAApprovalInstanceFinishedOutput{
-				Type:              EventOAApprovalInstanceFinished,
-				EventID:           "oa-event",
-				Timestamp:         1785229200123,
-				SubscribeID:       "outer-sub",
-				ProcessInstanceID: "process-instance-1",
-				ProcessCode:       "PROC-TEST-1",
-				Title:             "测试审批",
-				Status:            "FINISHED",
-				Result:            "agree",
-				CreateTime:        1785229100000,
-				FinishTime:        1785229199000,
-				EventTime:         1785229199000,
-			},
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.eventKey, func(t *testing.T) {
-			projected, err := ProjectOutput(transport.Event{
-				EventID:       "outer-event",
-				EventBornTime: 11,
-				EventType:     tt.eventKey,
-				SubscribeID:   "outer-sub",
-				Data:          personalOAData(tt.eventKey),
-			})
-			if err != nil {
-				t.Fatalf("ProjectOutput() error = %v", err)
-			}
-			if !reflect.DeepEqual(projected, tt.want) {
-				t.Fatalf("ProjectOutput() = %#v, want %#v", projected, tt.want)
-			}
-			assertNoInternalActionFields(t, projected)
-		})
-	}
-}
-
-func TestCrossPlatformCoverageProjectOutputRejectsUnsupportedOAType(t *testing.T) {
-	ev := transport.Event{EventID: "outer-event", EventType: "user_oa_approval_unknown"}
-	projected, err := projectOAApprovalEvent(
-		ev,
-		baseEventOutput{Type: ev.EventType, EventID: ev.EventID},
-		json.RawMessage(`{"body":{"processInstanceId":"process-instance-1"},"event_time":1}`),
-	)
-	if err == nil || !strings.Contains(err.Error(), `unsupported personal OA event type "user_oa_approval_unknown"`) {
-		t.Fatalf("projectOAApprovalEvent() error = %v", err)
-	}
-	if got, ok := projected.(transport.Event); !ok || !reflect.DeepEqual(got, ev) {
-		t.Fatalf("projectOAApprovalEvent() fallback = %#v, want %#v", projected, ev)
-	}
-}
-
-func TestCrossPlatformCoverageProjectOutputOADecodesDoublyWrappedJSONString(t *testing.T) {
-	once, err := json.Marshal(personalOAData(EventOAApprovalTaskCreated))
-	if err != nil {
-		t.Fatal(err)
-	}
-	twice, err := json.Marshal(string(once))
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	projected, err := ProjectOutput(transport.Event{Data: string(twice)})
-	if err != nil {
-		t.Fatalf("ProjectOutput() error = %v", err)
-	}
-	got, ok := projected.(OAApprovalTaskCreatedOutput)
-	if !ok {
-		t.Fatalf("ProjectOutput() type = %T, want OAApprovalTaskCreatedOutput", projected)
-	}
-	if got.Type != EventOAApprovalTaskCreated || got.EventID != "oa-event" || got.SubscribeID != "oa-data-sub" {
-		t.Fatalf("ProjectOutput() = %#v", got)
-	}
-}
-
 func TestCrossPlatformCoverageProjectOutputGroupMemberEvents(t *testing.T) {
 	for _, eventKey := range []string{EventGroupMemberAdded, EventGroupMemberExited} {
 		t.Run(eventKey, func(t *testing.T) {
@@ -766,93 +549,6 @@ func TestCrossPlatformCoverageProjectOutputRejectsInvalidGroupLifecyclePayloads(
 	}
 }

-func TestCrossPlatformCoverageProjectOutputRejectsInvalidOAPayloads(t *testing.T) {
-	tests := []struct {
-		name    string
-		payload string
-	}{
-		{name: "missing"},
-		{name: "null", payload: `,"payload":null`},
-		{name: "empty object", payload: `,"payload":{}`},
-		{name: "array", payload: `,"payload":[]`},
-		{name: "string", payload: `,"payload":"invalid"`},
-		{name: "missing body", payload: `,"payload":{"event_time":1}`},
-		{name: "null body", payload: `,"payload":{"body":null,"event_time":1}`},
-		{name: "empty body", payload: `,"payload":{"body":{},"event_time":1}`},
-	}
-	for _, eventKey := range []string{
-		EventOAApprovalTaskCreated,
-		EventOAApprovalTaskFinished,
-		EventOAApprovalTaskRedirected,
-		EventOAApprovalInstanceStarted,
-		EventOAApprovalInstanceTerminated,
-		EventOAApprovalInstanceFinished,
-	} {
-		for _, tt := range tests {
-			t.Run(eventKey+"/"+tt.name, func(t *testing.T) {
-				ev := transport.Event{
-					EventID:   "outer-event",
-					EventType: eventKey,
-					Data:      fmt.Sprintf(`{"eventKey":%q%s}`, eventKey, tt.payload),
-				}
-				projected, err := ProjectOutput(ev)
-				if err == nil {
-					t.Fatal("ProjectOutput() error = nil, want OA payload validation error")
-				}
-				if !strings.Contains(err.Error(), "decode personal OA payload") {
-					t.Fatalf("ProjectOutput() error = %v, want OA payload context", err)
-				}
-				got, ok := projected.(transport.Event)
-				if !ok || !reflect.DeepEqual(got, ev) {
-					t.Fatalf("ProjectOutput() fallback = %#v, want %#v", projected, ev)
-				}
-			})
-		}
-	}
-}
-
-func TestCrossPlatformCoverageProjectOutputRejectsOAWithoutStableIDs(t *testing.T) {
-	tests := []struct {
-		name     string
-		eventKey string
-		body     string
-		want     string
-	}{
-		{
-			name:     "missing process instance",
-			eventKey: EventOAApprovalInstanceStarted,
-			body:     `{"status":"RUNNING"}`,
-			want:     "processInstanceId is required",
-		},
-		{
-			name:     "missing task",
-			eventKey: EventOAApprovalTaskCreated,
-			body:     `{"processInstanceId":"process-instance-1","status":"RUNNING"}`,
-			want:     "taskId is required",
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			ev := transport.Event{
-				EventID:   "outer-event",
-				EventType: tt.eventKey,
-				Data: fmt.Sprintf(
-					`{"eventKey":%q,"payload":{"body":%s,"event_time":1}}`,
-					tt.eventKey,
-					tt.body,
-				),
-			}
-			projected, err := ProjectOutput(ev)
-			if err == nil || !strings.Contains(err.Error(), tt.want) {
-				t.Fatalf("ProjectOutput() error = %v, want %q", err, tt.want)
-			}
-			if got, ok := projected.(transport.Event); !ok || !reflect.DeepEqual(got, ev) {
-				t.Fatalf("ProjectOutput() fallback = %#v, want %#v", projected, ev)
-			}
-		})
-	}
-}
-
 func TestCrossPlatformCoverageProjectOutputDecodesWrappedJSONString(t *testing.T) {
 	wrapped, err := json.Marshal(personalMessageData(EventSingleChat))
 	if err != nil {
@@ -23,28 +23,22 @@ import (
 )

 const (
-	EventMention                      = "user_im_message_receive_at"
-	EventSingleChat                   = "user_im_message_receive_o2o"
-	EventInChat                       = "user_im_message_receive_group"
-	EventFromUser                     = "user_im_message_receive_user"
-	EventAllSingleChat                = "user_im_message_receive_o2o_all"
-	EventAllGroupChat                 = "user_im_message_receive_group_all"
-	EventReadO2O                      = "user_im_message_read_o2o"
-	EventReadGroup                    = "user_im_message_read_group"
-	EventRecallO2O                    = "user_im_message_recall_o2o"
-	EventRecallGroup                  = "user_im_message_recall_group"
-	EventReactionO2O                  = "user_im_message_reaction_o2o"
-	EventReactionGroup                = "user_im_message_reaction_group"
-	EventGroupUpdated                 = "user_im_group_updated"
-	EventGroupMemberAdded             = "user_im_group_member_added"
-	EventGroupMemberExited            = "user_im_group_member_exited"
-	EventGroupDisbanded               = "user_im_group_disbanded"
-	EventOAApprovalTaskCreated        = "user_oa_approval_task_created"
-	EventOAApprovalTaskFinished       = "user_oa_approval_task_finished"
-	EventOAApprovalTaskRedirected     = "user_oa_approval_task_redirected"
-	EventOAApprovalInstanceStarted    = "user_oa_approval_instance_started"
-	EventOAApprovalInstanceTerminated = "user_oa_approval_instance_terminated"
-	EventOAApprovalInstanceFinished   = "user_oa_approval_instance_finished"
+	EventMention           = "user_im_message_receive_at"
+	EventSingleChat        = "user_im_message_receive_o2o"
+	EventInChat            = "user_im_message_receive_group"
+	EventFromUser          = "user_im_message_receive_user"
+	EventAllSingleChat     = "user_im_message_receive_o2o_all"
+	EventAllGroupChat      = "user_im_message_receive_group_all"
+	EventReadO2O           = "user_im_message_read_o2o"
+	EventReadGroup         = "user_im_message_read_group"
+	EventRecallO2O         = "user_im_message_recall_o2o"
+	EventRecallGroup       = "user_im_message_recall_group"
+	EventReactionO2O       = "user_im_message_reaction_o2o"
+	EventReactionGroup     = "user_im_message_reaction_group"
+	EventGroupUpdated      = "user_im_group_updated"
+	EventGroupMemberAdded  = "user_im_group_member_added"
+	EventGroupMemberExited = "user_im_group_member_exited"
+	EventGroupDisbanded    = "user_im_group_disbanded"
 )

 const (
@@ -279,72 +273,6 @@ var definitions = []Definition{
 		Auth:           map[string]any{"identity": "user"},
 		Public:         true,
 	},
-	{
-		EventKey:       EventOAApprovalTaskCreated,
-		DisplayName:    "审批任务创建",
-		Description:    "审批任务创建，发送给审批人",
-		Category:       "oa",
-		RuleType:       "all",
-		Status:         StatusEnabled,
-		RequiredParams: nil,
-		Auth:           map[string]any{"identity": "user"},
-		Public:         true,
-	},
-	{
-		EventKey:       EventOAApprovalTaskFinished,
-		DisplayName:    "审批任务完成",
-		Description:    "审批任务已完成",
-		Category:       "oa",
-		RuleType:       "all",
-		Status:         StatusEnabled,
-		RequiredParams: nil,
-		Auth:           map[string]any{"identity": "user"},
-		Public:         true,
-	},
-	{
-		EventKey:       EventOAApprovalTaskRedirected,
-		DisplayName:    "审批人任务转交",
-		Description:    "审批任务已转交",
-		Category:       "oa",
-		RuleType:       "all",
-		Status:         StatusEnabled,
-		RequiredParams: nil,
-		Auth:           map[string]any{"identity": "user"},
-		Public:         true,
-	},
-	{
-		EventKey:       EventOAApprovalInstanceStarted,
-		DisplayName:    "发起审批单",
-		Description:    "审批实例已发起",
-		Category:       "oa",
-		RuleType:       "all",
-		Status:         StatusEnabled,
-		RequiredParams: nil,
-		Auth:           map[string]any{"identity": "user"},
-		Public:         true,
-	},
-	{
-		EventKey:       EventOAApprovalInstanceTerminated,
-		DisplayName:    "审批单终止",
-		Description:    "审批实例已终止",
-		Category:       "oa",
-		RuleType:       "all",
-		Status:         StatusEnabled,
-		RequiredParams: nil,
-		Auth:           map[string]any{"identity": "user"},
-		Public:         true,
-	},
-	{
-		EventKey:       EventOAApprovalInstanceFinished,
-		DisplayName:    "审批单完成",
-		Description:    "审批实例完成，发送给审批单发起人",
-		Category:       "oa",
-		RuleType:       "all",
-		Status:         StatusEnabled,
-		RequiredParams: nil,
-		Auth:           map[string]any{"identity": "user"},
-		Public:         true,
-	},
 }

 func targetUIDConstraints() *ParameterConstraints {
@@ -46,47 +46,12 @@ func TestCatalogEnabledEvents(t *testing.T) {
 		EventGroupMemberAdded,
 		EventGroupMemberExited,
 		EventGroupDisbanded,
-		EventOAApprovalTaskCreated,
-		EventOAApprovalTaskFinished,
-		EventOAApprovalTaskRedirected,
-		EventOAApprovalInstanceStarted,
-		EventOAApprovalInstanceTerminated,
-		EventOAApprovalInstanceFinished,
 	}
 	if !reflect.DeepEqual(keys, want) {
 		t.Fatalf("keys = %#v, want %#v", keys, want)
 	}
 }

-func TestOAEventCatalogDefinitions(t *testing.T) {
-	items := Catalog("oa", true, false)
-	wantKeys := []string{
-		EventOAApprovalTaskCreated,
-		EventOAApprovalTaskFinished,
-		EventOAApprovalTaskRedirected,
-		EventOAApprovalInstanceStarted,
-		EventOAApprovalInstanceTerminated,
-		EventOAApprovalInstanceFinished,
-	}
-	if len(items) != len(wantKeys) {
-		t.Fatalf("Catalog(oa) = %#v, want %d events", items, len(wantKeys))
-	}
-	for i, item := range items {
-		if item.EventKey != wantKeys[i] {
-			t.Fatalf("Catalog(oa)[%d].event_key = %q, want %q", i, item.EventKey, wantKeys[i])
-		}
-		if item.Category != "oa" || item.RuleType != "all" || item.Status != StatusEnabled || !item.Public {
-			t.Fatalf("Catalog(oa)[%d] = %#v, want public enabled oa/all event", i, item)
-		}
-		if len(item.RequiredParams) != 0 || item.Constraints != nil {
-			t.Fatalf("Catalog(oa)[%d] parameters = %#v/%#v, want none", i, item.RequiredParams, item.Constraints)
-		}
-		if item.Auth["identity"] != "user" {
-			t.Fatalf("Catalog(oa)[%d].auth = %#v, want user identity", i, item.Auth)
-		}
-	}
-}
-
 func TestEventFromUserIsPublic(t *testing.T) {
 	if _, ok := Lookup(EventFromUser); !ok {
 		t.Fatalf("Lookup(%q) failed", EventFromUser)
@@ -154,12 +119,6 @@ func TestSchemaDocumentsDefaultToTransportEnvelope(t *testing.T) {
 		EventGroupMemberAdded,
 		EventGroupMemberExited,
 		EventGroupDisbanded,
-		EventOAApprovalTaskCreated,
-		EventOAApprovalTaskFinished,
-		EventOAApprovalTaskRedirected,
-		EventOAApprovalInstanceStarted,
-		EventOAApprovalInstanceTerminated,
-		EventOAApprovalInstanceFinished,
 	} {
 		t.Run(eventKey, func(t *testing.T) {
 			def, ok := Lookup(eventKey)
@@ -474,96 +433,6 @@ func TestGroupLifecycleSchemaDocumentsUseConservativePayload(t *testing.T) {
 	}
 }

-func TestOAEventSchemaDocumentsMatchOutputDTO(t *testing.T) {
-	tests := []struct {
-		eventKey   string
-		properties []string
-	}{
-		{
-			eventKey: EventOAApprovalTaskCreated,
-			properties: []string{
-				"type", "event_id", "timestamp", "subscribe_id", "process_instance_id",
-				"process_code", "task_id", "title", "status", "create_time", "event_time",
-			},
-		},
-		{
-			eventKey: EventOAApprovalTaskFinished,
-			properties: []string{
-				"type", "event_id", "timestamp", "subscribe_id", "process_instance_id",
-				"process_code", "task_id", "title", "status", "result", "create_time",
-				"finish_time", "event_time",
-			},
-		},
-		{
-			eventKey: EventOAApprovalTaskRedirected,
-			properties: []string{
-				"type", "event_id", "timestamp", "subscribe_id", "process_instance_id",
-				"process_code", "task_id", "title", "status", "result", "create_time",
-				"finish_time", "event_time",
-			},
-		},
-		{
-			eventKey: EventOAApprovalInstanceStarted,
-			properties: []string{
-				"type", "event_id", "timestamp", "subscribe_id", "process_instance_id",
-				"process_code", "title", "status", "create_time", "event_time",
-			},
-		},
-		{
-			eventKey: EventOAApprovalInstanceTerminated,
-			properties: []string{
-				"type", "event_id", "timestamp", "subscribe_id", "process_instance_id",
-				"process_code", "title", "status", "create_time", "finish_time", "event_time",
-			},
-		},
-		{
-			eventKey: EventOAApprovalInstanceFinished,
-			properties: []string{
-				"type", "event_id", "timestamp", "subscribe_id", "process_instance_id",
-				"process_code", "title", "status", "result", "create_time", "finish_time",
-				"event_time",
-			},
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.eventKey, func(t *testing.T) {
-			def, ok := Lookup(tt.eventKey)
-			if !ok {
-				t.Fatalf("Lookup(%q) failed", tt.eventKey)
-			}
-			doc := BuildSchemaDocumentForMode(def, true)
-			if doc.JQRootPath != "." {
-				t.Fatalf("jq_root_path = %q, want .", doc.JQRootPath)
-			}
-			props, ok := doc.Schema["properties"].(map[string]any)
-			if !ok || len(props) != len(tt.properties) {
-				t.Fatalf("schema.properties = %#v, want exactly %d fields", doc.Schema["properties"], len(tt.properties))
-			}
-			for _, name := range tt.properties {
-				if _, ok := props[name].(map[string]any); !ok {
-					t.Fatalf("schema.properties.%s = %#v, want object", name, props[name])
-				}
-			}
-			eventType := props["type"].(map[string]any)
-			if !reflect.DeepEqual(eventType["enum"], []string{tt.eventKey}) {
-				t.Fatalf("schema.properties.type.enum = %#v, want %q", eventType["enum"], tt.eventKey)
-			}
-			if _, ok := props["payload"]; ok {
-				t.Fatalf("schema.properties exposed generic payload: %#v", props)
-			}
-			for _, name := range []string{"timestamp", "create_time", "finish_time", "event_time"} {
-				property, exists := props[name].(map[string]any)
-				if !exists {
-					continue
-				}
-				if property["type"] != "integer" || property["format"] != "timestamp_ms" {
-					t.Fatalf("schema.properties.%s = %#v, want timestamp_ms integer", name, property)
-				}
-			}
-		})
-	}
-}
-
 func TestGroupMemberSchemaDocumentsMatchOutputDTO(t *testing.T) {
 	wantProperties := []string{
 		"type", "event_id", "timestamp", "subscribe_id", "conversation_id",
@@ -626,16 +495,7 @@ func TestBuildRuleParamMention(t *testing.T) {
 }

 func TestBuildRuleParamAllEvents(t *testing.T) {
-	for _, eventKey := range []string{
-		EventAllSingleChat,
-		EventAllGroupChat,
-		EventOAApprovalTaskCreated,
-		EventOAApprovalTaskFinished,
-		EventOAApprovalTaskRedirected,
-		EventOAApprovalInstanceStarted,
-		EventOAApprovalInstanceTerminated,
-		EventOAApprovalInstanceFinished,
-	} {
+	for _, eventKey := range []string{EventAllSingleChat, EventAllGroupChat} {
 		t.Run(eventKey, func(t *testing.T) {
 			rule, param, err := BuildRuleParam(eventKey, RuleOptions{})
 			if err != nil {
@@ -841,12 +701,6 @@ func TestSupportsMessageFilter(t *testing.T) {
 		EventReadO2O,
 		EventReactionGroup,
 		EventGroupUpdated,
-		EventOAApprovalTaskCreated,
-		EventOAApprovalTaskFinished,
-		EventOAApprovalTaskRedirected,
-		EventOAApprovalInstanceStarted,
-		EventOAApprovalInstanceTerminated,
-		EventOAApprovalInstanceFinished,
 		"unknown_event",
 	} {
 		if SupportsMessageFilter(eventKey) {
@@ -1,300 +0,0 @@
-// Copyright 2026 Alibaba Group
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-// Package runtimecred provides an in-memory credential broker for event bus
-// processes. Runtime credentials are never persisted by this package.
-package runtimecred
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"strings"
-	"sync"
-)
-
-// DefaultMaxTokenBytes bounds credentials accepted over the local IPC
-// channel. Access tokens are normally only a few KiB; the larger limit leaves
-// ample room for future token formats while avoiding accidental large secret
-// allocations.
-const DefaultMaxTokenBytes = 64 << 10
-
-var (
-	ErrEmptyToken              = errors.New("runtime credential: token is empty")
-	ErrTokenTooLarge           = errors.New("runtime credential: token exceeds size limit")
-	ErrCredentialUnavailable   = errors.New("runtime credential: no credential resolver is available")
-	ErrLocalRefreshUnavailable = errors.New("runtime credential: no local refresh callback is available")
-	ErrRuntimeTokenRejected    = &RuntimeTokenRejectedError{}
-)
-
-// RuntimeTokenRejectedError means the currently installed runtime token was
-// rejected and no newer runtime token is available. It deliberately carries
-// no token or server response data so it is safe to surface to users and logs.
-type RuntimeTokenRejectedError struct{}
-
-func (*RuntimeTokenRejectedError) Error() string {
-	return "event runtime token was rejected; retry with a fresh host credential"
-}
-
-func (*RuntimeTokenRejectedError) Is(target error) bool {
-	_, ok := target.(*RuntimeTokenRejectedError)
-	return ok
-}
-
-// GenerationConflictError reports a failed compare-and-swap update.
-type GenerationConflictError struct {
-	Expected uint64
-	Actual   uint64
-}
-
-func (e *GenerationConflictError) Error() string {
-	return fmt.Sprintf("runtime credential: generation conflict (expected %d, actual %d)", e.Expected, e.Actual)
-}
-
-// ResolveFunc resolves the existing local OAuth credential when no runtime
-// credential has been installed.
-type ResolveFunc func(context.Context) (string, error)
-
-// RefreshFunc refreshes a rejected local OAuth credential. It is never called
-// after a runtime credential has been installed.
-type RefreshFunc func(context.Context, string) (string, error)
-
-type Config struct {
-	LocalResolve ResolveFunc
-	LocalRefresh RefreshFunc
-	RequireSeed  bool
-	// RequireActivation keeps the first installed runtime credential pending
-	// until Activate is called. Detached buses use it to register the consumer
-	// before ticket acquisition can emit or fail.
-	RequireActivation bool
-	MaxTokenBytes     int
-}
-
-// Broker holds at most one runtime credential. All state, including the
-// credential generation, is process-local and concurrency-safe.
-type Broker struct {
-	localResolve      ResolveFunc
-	localRefresh      RefreshFunc
-	requireSeed       bool
-	requireActivation bool
-	maxBytes          int
-
-	mu         sync.Mutex
-	token      string
-	generation uint64
-	active     bool
-	changed    chan struct{}
-}
-
-func New(cfg Config) *Broker {
-	maxBytes := cfg.MaxTokenBytes
-	if maxBytes <= 0 {
-		maxBytes = DefaultMaxTokenBytes
-	}
-	return &Broker{
-		localResolve:      cfg.LocalResolve,
-		localRefresh:      cfg.LocalRefresh,
-		requireSeed:       cfg.RequireSeed,
-		requireActivation: cfg.RequireActivation,
-		maxBytes:          maxBytes,
-		active:            !cfg.RequireActivation,
-		changed:           make(chan struct{}),
-	}
-}
-
-// Generation returns the current runtime credential generation. Generation 0
-// means that no runtime credential has been installed yet.
-func (b *Broker) Generation() uint64 {
-	if b == nil {
-		return 0
-	}
-	b.mu.Lock()
-	defer b.mu.Unlock()
-	return b.generation
-}
-
-// Update atomically installs token when expectedGeneration matches the
-// current generation. Reinstalling the same token is idempotent, including
-// when another concurrent writer already installed it.
-func (b *Broker) Update(expectedGeneration uint64, token string) (uint64, error) {
-	if b == nil {
-		return 0, ErrCredentialUnavailable
-	}
-	normalized, err := b.validate(token)
-	if err != nil {
-		return b.Generation(), err
-	}
-
-	b.mu.Lock()
-	defer b.mu.Unlock()
-	if b.token == normalized {
-		return b.generation, nil
-	}
-	if expectedGeneration != b.generation {
-		return b.generation, &GenerationConflictError{Expected: expectedGeneration, Actual: b.generation}
-	}
-	b.token = normalized
-	b.generation++
-	if b.active {
-		b.signalChangedLocked()
-	}
-	return b.generation, nil
-}
-
-// Activate publishes a pending first runtime credential after the bus has
-// registered the initiating consumer. It is an idempotent generation-checked
-// no-op for brokers that do not require activation.
-func (b *Broker) Activate(expectedGeneration uint64) (uint64, error) {
-	if b == nil {
-		return 0, ErrCredentialUnavailable
-	}
-	b.mu.Lock()
-	defer b.mu.Unlock()
-	if expectedGeneration != b.generation {
-		return b.generation, &GenerationConflictError{Expected: expectedGeneration, Actual: b.generation}
-	}
-	if b.token == "" {
-		return b.generation, ErrCredentialUnavailable
-	}
-	if b.active {
-		return b.generation, nil
-	}
-	b.active = true
-	b.signalChangedLocked()
-	return b.generation, nil
-}
-
-// Resolve returns the runtime credential when installed. In RequireSeed mode
-// it waits until Update installs one; otherwise it preserves the existing
-// local resolver behavior until a runtime credential arrives.
-func (b *Broker) Resolve(ctx context.Context) (string, error) {
-	if b == nil {
-		return "", ErrCredentialUnavailable
-	}
-	for {
-		token, wait, requireSeed, active := b.snapshot()
-		if token != "" && active {
-			return token, nil
-		}
-		if requireSeed || (token != "" && !active) {
-			select {
-			case <-ctx.Done():
-				return "", ctx.Err()
-			case <-wait:
-				continue
-			}
-		}
-		if b.localResolve == nil {
-			return "", ErrCredentialUnavailable
-		}
-		local, err := b.localResolve(ctx)
-		if err != nil {
-			return "", err
-		}
-		if runtime, _, _, runtimeActive := b.snapshot(); runtime != "" && runtimeActive {
-			return runtime, nil
-		}
-		return validateResolved(local)
-	}
-}
-
-// RefreshRejected returns a newer runtime token if one was installed after
-// rejectedToken was used. If the installed runtime token itself was rejected,
-// it returns RuntimeTokenRejectedError and never invokes local OAuth refresh.
-func (b *Broker) RefreshRejected(ctx context.Context, rejectedToken string) (string, error) {
-	if b == nil {
-		return "", ErrCredentialUnavailable
-	}
-	for {
-		token, wait, requireSeed, active := b.snapshot()
-		if token != "" && active {
-			if token != rejectedToken {
-				return token, nil
-			}
-			return "", &RuntimeTokenRejectedError{}
-		}
-		if requireSeed || (token != "" && !active) {
-			select {
-			case <-ctx.Done():
-				return "", ctx.Err()
-			case <-wait:
-				continue
-			}
-		}
-		if b.localRefresh == nil {
-			return "", ErrLocalRefreshUnavailable
-		}
-		refreshed, err := b.localRefresh(ctx, rejectedToken)
-		if err != nil {
-			return "", err
-		}
-		if runtime, _, _, runtimeActive := b.snapshot(); runtime != "" && runtimeActive {
-			if runtime != rejectedToken {
-				return runtime, nil
-			}
-			return "", &RuntimeTokenRejectedError{}
-		}
-		return validateResolved(refreshed)
-	}
-}
-
-// ClassifyRejectedAfterRetry is called when a token returned by
-// RefreshRejected was itself rejected. When a still newer runtime credential
-// is already installed, superseded is true so the source may reconnect and
-// resolve that generation without a second in-attempt retry. When the rejected
-// token is still current, the fixed typed rejection is returned. With no
-// runtime credential installed it preserves local OAuth behavior by returning
-// (false, nil).
-func (b *Broker) ClassifyRejectedAfterRetry(rejectedToken string) (superseded bool, err error) {
-	if b == nil {
-		return false, ErrCredentialUnavailable
-	}
-	token, _, _, active := b.snapshot()
-	if token == "" || !active {
-		return false, nil
-	}
-	if token != strings.TrimSpace(rejectedToken) {
-		return true, nil
-	}
-	return false, &RuntimeTokenRejectedError{}
-}
-
-func (b *Broker) snapshot() (string, <-chan struct{}, bool, bool) {
-	b.mu.Lock()
-	defer b.mu.Unlock()
-	return b.token, b.changed, b.requireSeed, b.active
-}
-
-func (b *Broker) signalChangedLocked() {
-	close(b.changed)
-	b.changed = make(chan struct{})
-}
-
-func (b *Broker) validate(token string) (string, error) {
-	normalized := strings.TrimSpace(token)
-	if normalized == "" {
-		return "", ErrEmptyToken
-	}
-	if len(normalized) > b.maxBytes {
-		return "", ErrTokenTooLarge
-	}
-	return normalized, nil
-}
-
-func validateResolved(token string) (string, error) {
-	token = strings.TrimSpace(token)
-	if token == "" {
-		return "", ErrCredentialUnavailable
-	}
-	return token, nil
-}
@@ -1,203 +0,0 @@
-// Copyright 2026 Alibaba Group
-// Licensed under the Apache License, Version 2.0 (the "License");
-
-package runtimecred
-
-import (
-	"context"
-	"errors"
-	"strings"
-	"sync"
-	"sync/atomic"
-	"testing"
-	"time"
-)
-
-func TestCrossPlatformCoverageBrokerLocalFallbackAndRuntimePrecedence(t *testing.T) {
-	var localCalls atomic.Int32
-	b := New(Config{LocalResolve: func(context.Context) (string, error) {
-		localCalls.Add(1)
-		return "local", nil
-	}})
-	if got, err := b.Resolve(context.Background()); err != nil || got != "local" {
-		t.Fatalf("local Resolve = %q, %v", got, err)
-	}
-	gen, err := b.Update(0, " runtime ")
-	if err != nil || gen != 1 {
-		t.Fatalf("Update = %d, %v", gen, err)
-	}
-	if got, err := b.Resolve(context.Background()); err != nil || got != "runtime" {
-		t.Fatalf("runtime Resolve = %q, %v", got, err)
-	}
-	if localCalls.Load() != 1 {
-		t.Fatalf("local resolver calls = %d", localCalls.Load())
-	}
-}
-
-func TestCrossPlatformCoverageBrokerRequireSeedWaitsAndCancels(t *testing.T) {
-	b := New(Config{RequireSeed: true})
-	ctx, cancel := context.WithCancel(context.Background())
-	done := make(chan error, 1)
-	go func() { _, err := b.Resolve(ctx); done <- err }()
-	cancel()
-	if err := <-done; !errors.Is(err, context.Canceled) {
-		t.Fatalf("Resolve error = %v", err)
-	}
-
-	resolved := make(chan string, 1)
-	go func() {
-		token, _ := b.Resolve(context.Background())
-		resolved <- token
-	}()
-	select {
-	case <-resolved:
-		t.Fatal("Resolve returned before seed")
-	case <-time.After(20 * time.Millisecond):
-	}
-	if _, err := b.Update(0, "seed"); err != nil {
-		t.Fatal(err)
-	}
-	if got := <-resolved; got != "seed" {
-		t.Fatalf("Resolve = %q", got)
-	}
-}
-
-func TestCrossPlatformCoverageBrokerUpdateCASIdempotenceAndConcurrentConflict(t *testing.T) {
-	b := New(Config{})
-	if gen, err := b.Update(0, "same"); err != nil || gen != 1 {
-		t.Fatalf("first update = %d, %v", gen, err)
-	}
-	if gen, err := b.Update(0, "same"); err != nil || gen != 1 {
-		t.Fatalf("idempotent stale update = %d, %v", gen, err)
-	}
-	if _, err := b.Update(0, "different"); err == nil {
-		t.Fatal("expected generation conflict")
-	} else {
-		var conflict *GenerationConflictError
-		if !errors.As(err, &conflict) || conflict.Actual != 1 {
-			t.Fatalf("conflict = %#v, %v", conflict, err)
-		}
-	}
-
-	b = New(Config{})
-	start := make(chan struct{})
-	var successes atomic.Int32
-	var conflicts atomic.Int32
-	var wg sync.WaitGroup
-	for _, token := range []string{"a", "b"} {
-		wg.Add(1)
-		go func(token string) {
-			defer wg.Done()
-			<-start
-			_, err := b.Update(0, token)
-			if err == nil {
-				successes.Add(1)
-				return
-			}
-			var conflict *GenerationConflictError
-			if errors.As(err, &conflict) {
-				conflicts.Add(1)
-			}
-		}(token)
-	}
-	close(start)
-	wg.Wait()
-	if successes.Load() != 1 || conflicts.Load() != 1 {
-		t.Fatalf("successes=%d conflicts=%d", successes.Load(), conflicts.Load())
-	}
-}
-
-func TestCrossPlatformCoverageBrokerRefreshRejectedRuntimeNeverFallsBack(t *testing.T) {
-	var refreshCalls atomic.Int32
-	b := New(Config{LocalRefresh: func(context.Context, string) (string, error) {
-		refreshCalls.Add(1)
-		return "local-new", nil
-	}})
-	if _, err := b.Update(0, "runtime-a"); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := b.RefreshRejected(context.Background(), "runtime-a"); !errors.Is(err, ErrRuntimeTokenRejected) {
-		t.Fatalf("same token refresh error = %v", err)
-	}
-	if refreshCalls.Load() != 0 {
-		t.Fatalf("local refresh called %d times", refreshCalls.Load())
-	}
-	if _, err := b.Update(1, "runtime-b"); err != nil {
-		t.Fatal(err)
-	}
-	if got, err := b.RefreshRejected(context.Background(), "runtime-a"); err != nil || got != "runtime-b" {
-		t.Fatalf("rotated refresh = %q, %v", got, err)
-	}
-	if superseded, err := b.ClassifyRejectedAfterRetry("runtime-b"); superseded || !errors.Is(err, ErrRuntimeTokenRejected) {
-		t.Fatalf("current retry rejection = superseded %v, error %v", superseded, err)
-	}
-	if _, err := b.Update(2, "runtime-c"); err != nil {
-		t.Fatal(err)
-	}
-	if superseded, err := b.ClassifyRejectedAfterRetry("runtime-b"); !superseded || err != nil {
-		t.Fatalf("newer generation classification = superseded %v, error %v", superseded, err)
-	}
-	localOnly := New(Config{})
-	if superseded, err := localOnly.ClassifyRejectedAfterRetry("local"); superseded || err != nil {
-		t.Fatalf("local-only classification = superseded %v, error %v", superseded, err)
-	}
-}
-
-func TestCrossPlatformCoverageBrokerDefersSeedUntilActivation(t *testing.T) {
-	b := New(Config{RequireSeed: true, RequireActivation: true})
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-
-	resolved := make(chan string, 1)
-	errs := make(chan error, 1)
-	go func() {
-		token, err := b.Resolve(ctx)
-		if err != nil {
-			errs <- err
-			return
-		}
-		resolved <- token
-	}()
-
-	generation, err := b.Update(0, "runtime-a")
-	if err != nil || generation != 1 {
-		t.Fatalf("Update() = generation %d, err %v", generation, err)
-	}
-	select {
-	case token := <-resolved:
-		t.Fatalf("Resolve() returned before activation: %q", token)
-	case err := <-errs:
-		t.Fatalf("Resolve() failed before activation: %v", err)
-	case <-time.After(20 * time.Millisecond):
-	}
-
-	if _, err := b.Activate(0); err == nil {
-		t.Fatal("Activate() with stale generation unexpectedly succeeded")
-	}
-	if activeGeneration, err := b.Activate(generation); err != nil || activeGeneration != generation {
-		t.Fatalf("Activate() = generation %d, err %v", activeGeneration, err)
-	}
-	select {
-	case token := <-resolved:
-		if token != "runtime-a" {
-			t.Fatalf("Resolve() token = %q", token)
-		}
-	case err := <-errs:
-		t.Fatalf("Resolve() failed after activation: %v", err)
-	case <-time.After(time.Second):
-		t.Fatal("Resolve() remained blocked after activation")
-	}
-}
-
-func TestCrossPlatformCoverageBrokerRejectsInvalidTokensWithoutEcho(t *testing.T) {
-	b := New(Config{MaxTokenBytes: 4})
-	for _, token := range []string{"   ", "secret-token"} {
-		_, err := b.Update(0, token)
-		if err == nil {
-			t.Fatalf("Update(%q) succeeded", token)
-		}
-		if strings.Contains(err.Error(), token) {
-			t.Fatal("validation error contained rejected token")
-		}
-	}
-}
@@ -1,150 +0,0 @@
-package runtimecred
-
-import (
-	"context"
-	"errors"
-	"testing"
-	"time"
-)
-
-func TestCrossPlatformCoverageEventCoreBrokerEdges(t *testing.T) {
-	rejected := &RuntimeTokenRejectedError{}
-	if rejected.Error() == "" || !errors.Is(rejected, ErrRuntimeTokenRejected) || rejected.Is(errors.New("other")) {
-		t.Fatal("runtime rejection error contract failed")
-	}
-	conflict := &GenerationConflictError{Expected: 2, Actual: 3}
-	if conflict.Error() == "" {
-		t.Fatal("generation conflict error is empty")
-	}
-
-	var nilBroker *Broker
-	if nilBroker.Generation() != 0 {
-		t.Fatal("nil broker generation is non-zero")
-	}
-	if _, err := nilBroker.Update(0, "token"); !errors.Is(err, ErrCredentialUnavailable) {
-		t.Fatalf("nil Update error = %v", err)
-	}
-	if _, err := nilBroker.Activate(0); !errors.Is(err, ErrCredentialUnavailable) {
-		t.Fatalf("nil Activate error = %v", err)
-	}
-	if _, err := nilBroker.Resolve(context.Background()); !errors.Is(err, ErrCredentialUnavailable) {
-		t.Fatalf("nil Resolve error = %v", err)
-	}
-	if _, err := nilBroker.RefreshRejected(context.Background(), "token"); !errors.Is(err, ErrCredentialUnavailable) {
-		t.Fatalf("nil RefreshRejected error = %v", err)
-	}
-	if superseded, err := nilBroker.ClassifyRejectedAfterRetry("token"); superseded || !errors.Is(err, ErrCredentialUnavailable) {
-		t.Fatalf("nil classification = %v, %v", superseded, err)
-	}
-
-	b := New(Config{})
-	if _, err := b.Activate(0); !errors.Is(err, ErrCredentialUnavailable) {
-		t.Fatalf("empty Activate error = %v", err)
-	}
-	if _, err := b.Update(0, "token"); err != nil {
-		t.Fatal(err)
-	}
-	if generation, err := b.Activate(1); err != nil || generation != 1 {
-		t.Fatalf("active Activate = %d, %v", generation, err)
-	}
-
-	if _, err := New(Config{}).Resolve(context.Background()); !errors.Is(err, ErrCredentialUnavailable) {
-		t.Fatalf("missing local resolver error = %v", err)
-	}
-	wantResolveErr := errors.New("resolve failed")
-	if _, err := New(Config{LocalResolve: func(context.Context) (string, error) {
-		return "", wantResolveErr
-	}}).Resolve(context.Background()); !errors.Is(err, wantResolveErr) {
-		t.Fatalf("local resolve error = %v", err)
-	}
-	if _, err := New(Config{LocalResolve: func(context.Context) (string, error) {
-		return "   ", nil
-	}}).Resolve(context.Background()); !errors.Is(err, ErrCredentialUnavailable) {
-		t.Fatalf("empty resolved credential error = %v", err)
-	}
-	var racingResolve *Broker
-	racingResolve = New(Config{LocalResolve: func(context.Context) (string, error) {
-		_, err := racingResolve.Update(0, "runtime-wins")
-		return "local", err
-	}})
-	if token, err := racingResolve.Resolve(context.Background()); err != nil || token != "runtime-wins" {
-		t.Fatalf("runtime precedence after resolve = %q, %v", token, err)
-	}
-
-	seed := New(Config{RequireSeed: true})
-	canceled, cancel := context.WithCancel(context.Background())
-	cancel()
-	if _, err := seed.Resolve(canceled); !errors.Is(err, context.Canceled) {
-		t.Fatalf("seed cancellation = %v", err)
-	}
-
-	if _, err := New(Config{}).RefreshRejected(context.Background(), "local"); !errors.Is(err, ErrLocalRefreshUnavailable) {
-		t.Fatalf("missing local refresh error = %v", err)
-	}
-	wantRefreshErr := errors.New("refresh failed")
-	if _, err := New(Config{LocalRefresh: func(context.Context, string) (string, error) {
-		return "", wantRefreshErr
-	}}).RefreshRejected(context.Background(), "local"); !errors.Is(err, wantRefreshErr) {
-		t.Fatalf("local refresh error = %v", err)
-	}
-	if _, err := New(Config{LocalRefresh: func(context.Context, string) (string, error) {
-		return " ", nil
-	}}).RefreshRejected(context.Background(), "local"); !errors.Is(err, ErrCredentialUnavailable) {
-		t.Fatalf("empty refreshed credential error = %v", err)
-	}
-
-	var racingRefresh *Broker
-	racingRefresh = New(Config{LocalRefresh: func(context.Context, string) (string, error) {
-		_, err := racingRefresh.Update(0, "runtime-new")
-		return "local-new", err
-	}})
-	if token, err := racingRefresh.RefreshRejected(context.Background(), "runtime-old"); err != nil || token != "runtime-new" {
-		t.Fatalf("runtime precedence after refresh = %q, %v", token, err)
-	}
-	var sameRefresh *Broker
-	sameRefresh = New(Config{LocalRefresh: func(context.Context, string) (string, error) {
-		_, err := sameRefresh.Update(0, "same")
-		return "local-new", err
-	}})
-	if _, err := sameRefresh.RefreshRejected(context.Background(), "same"); !errors.Is(err, ErrRuntimeTokenRejected) {
-		t.Fatalf("same runtime after refresh error = %v", err)
-	}
-
-	pending := New(Config{RequireSeed: true, RequireActivation: true})
-	generation, err := pending.Update(0, "pending")
-	if err != nil {
-		t.Fatal(err)
-	}
-	waitCtx, waitCancel := context.WithCancel(context.Background())
-	waitCancel()
-	if _, err := pending.RefreshRejected(waitCtx, "pending"); !errors.Is(err, context.Canceled) {
-		t.Fatalf("pending refresh cancellation = %v", err)
-	}
-	refreshDone := make(chan error, 1)
-	go func() {
-		_, err := pending.RefreshRejected(context.Background(), "pending")
-		refreshDone <- err
-	}()
-	// Let RefreshRejected take the pending credential's changed-channel path
-	// before activation publishes it.
-	time.Sleep(10 * time.Millisecond)
-	if _, err := pending.Activate(generation); err != nil {
-		t.Fatal(err)
-	}
-	select {
-	case err := <-refreshDone:
-		if !errors.Is(err, ErrRuntimeTokenRejected) {
-			t.Fatalf("activated pending refresh error = %v", err)
-		}
-	case <-time.After(time.Second):
-		t.Fatal("pending refresh did not resume")
-	}
-
-	inactive := New(Config{RequireActivation: true})
-	if _, err := inactive.Update(0, "inactive"); err != nil {
-		t.Fatal(err)
-	}
-	if superseded, err := inactive.ClassifyRejectedAfterRetry("other"); superseded || err != nil {
-		t.Fatalf("inactive classification = %v, %v", superseded, err)
-	}
-}
@@ -1,40 +0,0 @@
-package source
-
-import (
-	"context"
-	"io"
-	"net/http"
-	"strings"
-	"testing"
-)
-
-func TestCrossPlatformCoverageEventCorePersonalSupersededRetry(t *testing.T) {
-	source, err := NewPersonal(PersonalConfig{
-		AccessToken: "stale",
-		ForceRefreshToken: func(context.Context, string) (string, error) {
-			return "rotated", nil
-		},
-		ClassifyRetryReject: func(token string) (bool, error) {
-			if token != "rotated" {
-				t.Fatalf("classified token = %q", token)
-			}
-			return true, nil
-		},
-		ClientID:  "client",
-		SourceID:  "source",
-		TicketURL: "https://ticket.test",
-		HTTPClient: &http.Client{Transport: roundTripFunc(func(*http.Request) (*http.Response, error) {
-			return &http.Response{
-				StatusCode: http.StatusUnauthorized,
-				Body:       io.NopCloser(strings.NewReader("rejected")),
-				Header:     make(http.Header),
-			}, nil
-		})},
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if _, err := source.fetchTicket(context.Background()); !isRetryablePersonalError(err) {
-		t.Fatalf("superseded retry error = %v", err)
-	}
-}
@@ -45,7 +45,6 @@ type PersonalConfig struct {
 	AccessToken         string
 	AccessTokenProvider AccessTokenProvider
 	ForceRefreshToken   ForceRefreshTokenFn
-	ClassifyRetryReject RetryRejectClassifier
 	ClientID            string
 	ClientSecret        string
 	SourceID            string
@@ -67,12 +66,6 @@ type AccessTokenProvider func(context.Context) (string, error)
 // when nil a 401 stays fatal, matching the previous behavior.
 type ForceRefreshTokenFn func(ctx context.Context, rejectedToken string) (string, error)

-// RetryRejectClassifier classifies a 401 from the one refreshed-token retry.
-// superseded means a newer credential is already available and the outer
-// reconnect loop should start a fresh attempt; err is a terminal typed
-// rejection. A nil callback preserves the historical local OAuth behavior.
-type RetryRejectClassifier func(rejectedToken string) (superseded bool, err error)
-
 type PersonalSource struct {
 	cfg     PersonalConfig
 	machine *Machine
@@ -230,19 +223,7 @@ func (s *PersonalSource) fetchTicket(ctx context.Context) (*ticketResponse, erro
 			return nil, refreshErr
 		}
 		// Retry once with the freshly rotated token; a second 401 stays fatal.
-		var retryStatus int
-		var retryErr error
-		ticket, retryStatus, retryErr = s.fetchTicketAttempt(ctx, refreshed)
-		if retryStatus == http.StatusUnauthorized && s.cfg.ClassifyRetryReject != nil {
-			superseded, classifyErr := s.cfg.ClassifyRetryReject(refreshed)
-			if classifyErr != nil {
-				return nil, classifyErr
-			}
-			if superseded {
-				return nil, retryPersonal(retryErr)
-			}
-		}
-		err = retryErr
+		ticket, _, err = s.fetchTicketAttempt(ctx, refreshed)
 	}
 	return ticket, err
 }
@@ -14,7 +14,6 @@ import (
 	"time"

 	dwsevent "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/event"
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/event/runtimecred"
 	"github.com/gorilla/websocket"
 	"github.com/open-dingtalk/dingtalk-stream-sdk-go/payload"
 )
@@ -317,46 +316,6 @@ func TestCrossPlatformCoveragePersonalFetchTicket401RefreshFailureStaysFatal(t *
 	}
 }

-func TestCrossPlatformCoveragePersonalRuntimeTokenAtoBSecond401IsTyped(t *testing.T) {
-	broker := runtimecred.New(runtimecred.Config{})
-	if _, err := broker.Update(0, "runtime-a"); err != nil {
-		t.Fatal(err)
-	}
-	var attemptTokens []string
-	src, err := NewPersonal(PersonalConfig{
-		AccessTokenProvider: broker.Resolve,
-		ForceRefreshToken:   broker.RefreshRejected,
-		ClassifyRetryReject: broker.ClassifyRejectedAfterRetry,
-		ClientID:            "client",
-		SourceID:            "source",
-		TicketURL:           "https://ticket.test",
-		HTTPClient: &http.Client{Transport: roundTripFunc(func(req *http.Request) (*http.Response, error) {
-			token := req.Header.Get("x-user-access-token")
-			attemptTokens = append(attemptTokens, token)
-			if token == "runtime-a" {
-				if _, err := broker.Update(1, "runtime-b"); err != nil {
-					t.Fatalf("rotate runtime credential: %v", err)
-				}
-			}
-			return &http.Response{
-				StatusCode: http.StatusUnauthorized,
-				Body:       io.NopCloser(strings.NewReader("must-not-surface")),
-				Header:     make(http.Header),
-			}, nil
-		})},
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-	_, err = src.fetchTicket(context.Background())
-	if !errors.Is(err, runtimecred.ErrRuntimeTokenRejected) {
-		t.Fatalf("fetchTicket() error = %v", err)
-	}
-	if len(attemptTokens) != 2 || attemptTokens[0] != "runtime-a" || attemptTokens[1] != "runtime-b" {
-		t.Fatalf("attempt tokens = %v", attemptTokens)
-	}
-}
-
 // brokenBody simulates a response body that fails mid-read, e.g. the server
 // closing the connection before the error payload is fully written.
 type brokenBody struct{}
@@ -26,28 +26,16 @@ import (
 type FrameType string

 const (
-	FrameTypeHello               FrameType = "hello"                 // consume → bus
-	FrameTypeHelloAck            FrameType = "hello_ack"             // bus → consume
-	FrameTypeEvent               FrameType = "event"                 // bus → consume
-	FrameTypeHeartbeat           FrameType = "heartbeat"             // bidirectional
-	FrameTypeSourceState         FrameType = "source_state"          // bus → consume
-	FrameTypeBye                 FrameType = "bye"                   // bidirectional
-	FrameTypeStatusReq           FrameType = "status_req"            // consume/ad-hoc → bus
-	FrameTypeStatusResp          FrameType = "status_resp"           // bus → consume/ad-hoc
-	FrameTypeConsumerStopReq     FrameType = "consumer_stop_req"     // ad-hoc → bus
-	FrameTypeConsumerStopResp    FrameType = "consumer_stop_resp"    // bus → ad-hoc
-	FrameTypeCredentialUpdate    FrameType = "credential_update"     // consume → bus
-	FrameTypeCredentialUpdateAck FrameType = "credential_update_ack" // bus → consume
-)
-
-// CredentialMode declares that a consumer needs an additive credential
-// negotiation before it can register for events. The zero value preserves the
-// original protocol.
-type CredentialMode string
-
-const (
-	CredentialModeRuntimeToken CredentialMode = "runtime_token"
-	CapabilityRuntimeTokenV1                  = "runtime_token_v1"
+	FrameTypeHello            FrameType = "hello"              // consume → bus
+	FrameTypeHelloAck         FrameType = "hello_ack"          // bus → consume
+	FrameTypeEvent            FrameType = "event"              // bus → consume
+	FrameTypeHeartbeat        FrameType = "heartbeat"          // bidirectional
+	FrameTypeSourceState      FrameType = "source_state"       // bus → consume
+	FrameTypeBye              FrameType = "bye"                // bidirectional
+	FrameTypeStatusReq        FrameType = "status_req"         // consume/ad-hoc → bus
+	FrameTypeStatusResp       FrameType = "status_resp"        // bus → consume/ad-hoc
+	FrameTypeConsumerStopReq  FrameType = "consumer_stop_req"  // ad-hoc → bus
+	FrameTypeConsumerStopResp FrameType = "consumer_stop_resp" // bus → ad-hoc
 )

 // Hello is the first frame a consumer sends after dialing the bus. The bus
@@ -63,8 +51,7 @@ type Hello struct {
 	// Role distinguishes a real consumer (registered for events) from an
 	// ad-hoc tooling connection (status/list/stop). Ad-hoc connections do
 	// NOT register with the Hub.
-	Role           HelloRole      `json:"role,omitempty"`
-	CredentialMode CredentialMode `json:"credential_mode,omitempty"`
+	Role HelloRole `json:"role,omitempty"`
 }

 // HelloRole tags the purpose of a Hello connection.
@@ -89,38 +76,6 @@ type HelloAck struct {
 	ClientIDSource     string    `json:"client_id_source"`            // auth.CredentialSource string
 	ClientSecretSource string    `json:"client_secret_source"`        // auth.CredentialSource string
 	IdleTimeoutSecs    int       `json:"idle_timeout_secs,omitempty"` // bus's IdleTimeout for diagnostics
-	Capabilities       []string  `json:"capabilities,omitempty"`
-	// CredentialGeneration is process-local and contains no secret data.
-	CredentialGeneration uint64 `json:"credential_generation"`
-	// TerminalReason is a fixed, non-sensitive bus terminal state. A runtime
-	// client checks it before sending credential material.
-	TerminalReason string `json:"terminal_reason,omitempty"`
-}
-
-// CredentialUpdate installs a host-supplied runtime token into a compatible
-// bus after the bus has advertised CapabilityRuntimeTokenV1. Token is carried
-// only over the owner-only local IPC connection and must never be logged.
-type CredentialUpdate struct {
-	Type               FrameType `json:"type"`
-	ExpectedGeneration uint64    `json:"expected_generation"`
-	Token              string    `json:"token"`
-}
-
-const (
-	CredentialErrorGenerationConflict = "generation_conflict"
-	CredentialErrorInvalid            = "invalid_credential"
-	CredentialErrorRegistration       = "registration_failed"
-	CredentialErrorRuntimeRejected    = "runtime_token_rejected"
-	CredentialErrorInternal           = "internal_error"
-)
-
-// CredentialUpdateAck reports the CAS result without echoing any credential.
-type CredentialUpdateAck struct {
-	Type                 FrameType `json:"type"`
-	Accepted             bool      `json:"accepted"`
-	CredentialGeneration uint64    `json:"credential_generation"`
-	ErrorCode            string    `json:"error_code,omitempty"`
-	Error                string    `json:"error,omitempty"`
 }

 // Event wraps one delivered RawEvent for the wire. We keep the payload as
@@ -171,10 +126,7 @@ type Bye struct {
 	Reason string    `json:"reason"`
 }

-const (
-	ByeReasonSubscriptionStopped  = "subscription_stopped"
-	ByeReasonRuntimeTokenRejected = "runtime_token_rejected"
-)
+const ByeReasonSubscriptionStopped = "subscription_stopped"

 // ConsumerStopReq asks the bus to close consumers whose exact personal
 // subscription IDs match. It is an additive local IPC control operation;
@@ -23,23 +23,21 @@ import (
 // to guard against accidental wire-format changes (the JSON field tags
 // double as part of the cross-version protocol contract).

-func TestCrossPlatformCoverageFrameTypeStableWireValues(t *testing.T) {
+func TestFrameType_StableWireValues(t *testing.T) {
 	// If any of these strings change we've made a protocol-breaking
 	// change. The test value list is duplicated here on purpose so a
 	// reviewer renaming a constant is forced to also update the test.
 	wants := map[FrameType]string{
-		FrameTypeHello:               "hello",
-		FrameTypeHelloAck:            "hello_ack",
-		FrameTypeEvent:               "event",
-		FrameTypeHeartbeat:           "heartbeat",
-		FrameTypeSourceState:         "source_state",
-		FrameTypeBye:                 "bye",
-		FrameTypeStatusReq:           "status_req",
-		FrameTypeStatusResp:          "status_resp",
-		FrameTypeConsumerStopReq:     "consumer_stop_req",
-		FrameTypeConsumerStopResp:    "consumer_stop_resp",
-		FrameTypeCredentialUpdate:    "credential_update",
-		FrameTypeCredentialUpdateAck: "credential_update_ack",
+		FrameTypeHello:            "hello",
+		FrameTypeHelloAck:         "hello_ack",
+		FrameTypeEvent:            "event",
+		FrameTypeHeartbeat:        "heartbeat",
+		FrameTypeSourceState:      "source_state",
+		FrameTypeBye:              "bye",
+		FrameTypeStatusReq:        "status_req",
+		FrameTypeStatusResp:       "status_resp",
+		FrameTypeConsumerStopReq:  "consumer_stop_req",
+		FrameTypeConsumerStopResp: "consumer_stop_resp",
 	}
 	for ft, want := range wants {
 		if string(ft) != want {
@@ -106,91 +104,54 @@ func roundTrip(t *testing.T, in any, dst any) {
 	}
 }

-func TestCrossPlatformCoverageHelloRoundtrip(t *testing.T) {
+func TestHello_Roundtrip(t *testing.T) {
 	in := Hello{
-		Type:           FrameTypeHello,
-		ConsumerPID:    42,
-		EventTypes:     []string{"im.*", "approval.task"},
-		Filter:         `^im\.`,
-		Compact:        true,
-		Role:           HelloRoleStatus,
-		CredentialMode: CredentialModeRuntimeToken,
+		Type:        FrameTypeHello,
+		ConsumerPID: 42,
+		EventTypes:  []string{"im.*", "approval.task"},
+		Filter:      `^im\.`,
+		Compact:     true,
+		Role:        HelloRoleStatus,
 	}
 	var out Hello
 	roundTrip(t, in, &out)
 	if out.Type != in.Type || out.ConsumerPID != in.ConsumerPID || out.Filter != in.Filter ||
-		out.Compact != in.Compact || out.Role != in.Role || out.CredentialMode != in.CredentialMode || len(out.EventTypes) != len(in.EventTypes) {
+		out.Compact != in.Compact || out.Role != in.Role || len(out.EventTypes) != len(in.EventTypes) {
 		t.Fatalf("roundtrip mismatch: %+v != %+v", out, in)
 	}
 }

-func TestCrossPlatformCoverageHelloOmitemptyForDefaults(t *testing.T) {
+func TestHello_OmitemptyForDefaults(t *testing.T) {
 	// Default values should NOT appear in the wire form so old/new readers
 	// stay tolerant of each other (each new field comes in with its
 	// zero value by default).
 	in := Hello{Type: FrameTypeHello, ConsumerPID: 1}
 	b, _ := json.Marshal(in)
 	s := string(b)
-	for _, k := range []string{`"event_types"`, `"filter"`, `"compact"`, `"role"`, `"credential_mode"`} {
+	for _, k := range []string{`"event_types"`, `"filter"`, `"compact"`, `"role"`} {
 		if strings.Contains(s, k) {
 			t.Errorf("zero-value field %s leaked into wire form: %s", k, s)
 		}
 	}
 }

-func TestCrossPlatformCoverageHelloAckRoundtrip(t *testing.T) {
+func TestHelloAck_Roundtrip(t *testing.T) {
 	in := HelloAck{
-		Type:                 FrameTypeHelloAck,
-		BusPID:               12345,
-		SourceState:          "connected",
-		StateSource:          "inferred",
-		ClientIDSource:       "env",
-		ClientSecretSource:   "env",
-		IdleTimeoutSecs:      300,
-		Capabilities:         []string{CapabilityRuntimeTokenV1},
-		CredentialGeneration: 7,
+		Type:               FrameTypeHelloAck,
+		BusPID:             12345,
+		SourceState:        "connected",
+		StateSource:        "inferred",
+		ClientIDSource:     "env",
+		ClientSecretSource: "env",
+		IdleTimeoutSecs:    300,
 	}
 	var out HelloAck
 	roundTrip(t, in, &out)
-	if out.Type != in.Type || out.BusPID != in.BusPID || out.SourceState != in.SourceState ||
-		out.StateSource != in.StateSource || out.ClientIDSource != in.ClientIDSource ||
-		out.ClientSecretSource != in.ClientSecretSource || out.IdleTimeoutSecs != in.IdleTimeoutSecs ||
-		out.CredentialGeneration != in.CredentialGeneration || strings.Join(out.Capabilities, ",") != CapabilityRuntimeTokenV1 {
+	if out != in {
 		t.Fatalf("HelloAck roundtrip: %+v != %+v", out, in)
 	}
 }

-func TestCrossPlatformCoverageCredentialFramesRoundtripWithoutTokenInAck(t *testing.T) {
-	update := CredentialUpdate{
-		Type:               FrameTypeCredentialUpdate,
-		ExpectedGeneration: 4,
-		Token:              "canary-secret",
-	}
-	var decodedUpdate CredentialUpdate
-	roundTrip(t, update, &decodedUpdate)
-	if decodedUpdate != update {
-		t.Fatal("CredentialUpdate roundtrip mismatch")
-	}
-
-	ack := CredentialUpdateAck{
-		Type:                 FrameTypeCredentialUpdateAck,
-		Accepted:             true,
-		CredentialGeneration: 5,
-	}
-	var decodedAck CredentialUpdateAck
-	roundTrip(t, ack, &decodedAck)
-	if decodedAck != ack {
-		t.Fatalf("CredentialUpdateAck roundtrip = %#v", decodedAck)
-	}
-	b, err := json.Marshal(ack)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if strings.Contains(string(b), update.Token) {
-		t.Fatal("credential acknowledgement contained token")
-	}
-}
-
 func TestEvent_Roundtrip(t *testing.T) {
 	in := Event{
 		Type:              FrameTypeEvent,
@@ -284,7 +245,7 @@ func TestStatusResp_Roundtrip(t *testing.T) {
 // PeekType is used by the daemon to dispatch incoming frames before
 // fully decoding into the typed struct. Behaviour at boundaries matters.

-func TestCrossPlatformCoveragePeekTypeEachFrameVariant(t *testing.T) {
+func TestPeekType_EachFrameVariant(t *testing.T) {
 	cases := []struct {
 		v   any
 		typ FrameType
@@ -297,8 +258,6 @@ func TestCrossPlatformCoveragePeekTypeEachFrameVariant(t *testing.T) {
 		{Bye{Type: FrameTypeBye, Reason: "x"}, FrameTypeBye},
 		{StatusReq{Type: FrameTypeStatusReq}, FrameTypeStatusReq},
 		{StatusResp{Type: FrameTypeStatusResp}, FrameTypeStatusResp},
-		{CredentialUpdate{Type: FrameTypeCredentialUpdate}, FrameTypeCredentialUpdate},
-		{CredentialUpdateAck{Type: FrameTypeCredentialUpdateAck}, FrameTypeCredentialUpdateAck},
 	}
 	for _, c := range cases {
 		b, _ := json.Marshal(c.v)
@@ -16,7 +16,6 @@ import (
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/paging"
 	"github.com/spf13/cobra"

-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/corecmd"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/corecmd/contract"
 )

@@ -126,70 +125,6 @@ func resolveWorkflowDSL(cmd *cobra.Command) (map[string]any, error) {
 	return dsl, nil
 }

-func validateWorkflowRunFlags(cmd *cobra.Command, _ []string) error {
-	tableID, _ := cmd.Flags().GetString("table-id")
-	tableID = strings.TrimSpace(tableID)
-	recordIDs, _ := cmd.Flags().GetStringSlice("record-ids")
-	cleaned := make([]string, 0, len(recordIDs))
-	seen := make(map[string]struct{}, len(recordIDs))
-	for _, recordID := range recordIDs {
-		recordID = strings.TrimSpace(recordID)
-		if recordID == "" {
-			continue
-		}
-		if _, ok := seen[recordID]; ok {
-			return apperrors.NewValidation(fmt.Sprintf("--record-ids 不能包含重复值 %q", recordID))
-		}
-		seen[recordID] = struct{}{}
-		cleaned = append(cleaned, recordID)
-	}
-	if cmd.Flags().Changed("table-id") && tableID == "" {
-		return apperrors.NewValidation("--table-id 不能为空")
-	}
-	if cmd.Flags().Changed("record-ids") && len(cleaned) == 0 {
-		return apperrors.NewValidation("--record-ids 必须包含 1 到 5 个非空记录 ID")
-	}
-	if len(cleaned) > 5 {
-		return apperrors.NewValidation(fmt.Sprintf("--record-ids 最多支持 5 个记录 ID，got %d", len(cleaned)))
-	}
-	if (tableID != "") != (len(cleaned) > 0) {
-		return apperrors.NewValidation("--table-id 与 --record-ids 必须同时提供；定时触发工作流则两者都不传")
-	}
-	return nil
-}
-
-func validateWorkflowHistoryFlags(cmd *cobra.Command, _ []string) error {
-	if cmd.Flags().Changed("page") {
-		page, _ := cmd.Flags().GetInt("page")
-		if page < 0 {
-			return apperrors.NewValidation(fmt.Sprintf("--page 必须 >= 0，got %d", page))
-		}
-	}
-	if cmd.Flags().Changed("size") {
-		size, _ := cmd.Flags().GetInt("size")
-		if size < 1 || size > 100 {
-			return apperrors.NewValidation(fmt.Sprintf("--size 必须在 [1, 100] 范围内，got %d", size))
-		}
-	}
-	for _, name := range []string{"after-time", "before-time"} {
-		if !cmd.Flags().Changed(name) {
-			continue
-		}
-		value, _ := cmd.Flags().GetInt(name)
-		if value < 0 {
-			return apperrors.NewValidation(fmt.Sprintf("--%s 必须是 >= 0 的 Unix 毫秒时间戳，got %d", name, value))
-		}
-	}
-	if cmd.Flags().Changed("after-time") && cmd.Flags().Changed("before-time") {
-		afterTime, _ := cmd.Flags().GetInt("after-time")
-		beforeTime, _ := cmd.Flags().GetInt("before-time")
-		if afterTime >= beforeTime {
-			return apperrors.NewValidation(fmt.Sprintf("--after-time 必须小于 --before-time，got %d >= %d", afterTime, beforeTime))
-		}
-	}
-	return nil
-}
-
 // recordQueryFetchAll implements --all auto-pagination for record query.
 // It prints only a complete result. A page limit, empty/invalid response,
 // transport failure, or cursor cycle returns a non-zero structured error whose
@@ -1103,7 +1038,7 @@ func newAitableCommand() *cobra.Command {
  dws aitable form       [list|delete|update]                                           表单管理
  dws aitable form field [list|update|hide]                                             表单字段管理
  dws aitable form share [get|update|notify]                                            表单分享管理
-  dws aitable workflow   [edit-example|create|update|enable|disable|run|history|get|list] 自动化工作流管理
+  dws aitable workflow   [edit-example|create|update|enable|disable|get|list]           自动化工作流管理
  dws aitable dashboard  [get|create|update|delete|config-example]                      仪表盘管理
  dws aitable chart      [get|create|update|delete|widgets-example]                     图表管理
  dws aitable export     data                                                           数据导出
@@ -4943,7 +4878,7 @@ locked 为 true 表示视图已锁定，false 表示未锁定。`,

 	workflowCmd := &cobra.Command{
 		Use:   "workflow",
-		Short: "自动化工作流管理（创建 / 更新 / 启停 / 执行 / 历史 / 查询）",
+		Short: "自动化工作流管理（创建 / 更新 / 启停 / 查看 / 列表）",
 		RunE:  groupRunE,
 	}

@@ -5288,116 +5223,6 @@ valid=false 仍表示 DSL 校验或发布未通过，必须读取 issues 修正
 		},
 	})

-	workflowRunCmd := NewLeafCommand(LeafSpec{
-		Use:   "run",
-		Short: "执行指定自动化工作流",
-		Long: `立即执行指定 Base 中的自动化工作流。此命令会启动真实的异步执行，并可能产生该工作流配置的消息发送、记录写入等副作用，因此执行前需要确认；CLI 不自动重试。
-
-记录类触发器必须同时提供 --table-id 与 --record-ids；--table-id 必须与触发器绑定的数据表一致，--record-ids 接受 1 到 5 个不重复记录 ID。定时触发器不传这两个参数。
-返回每条记录的提交状态；提交成功项包含 executionId，可用 workflow history 返回项的 instanceId 匹配执行记录。`,
-		Example: `  dws aitable workflow run --base-id BASE_ID --workflow-id WORKFLOW_ID --table-id TABLE_ID --record-ids RECORD_ID_1,RECORD_ID_2
-  dws aitable workflow run --base-id BASE_ID --workflow-id WORKFLOW_ID`,
-		Tool: "run_workflow",
-		Safety: contract.SafetySpec{
-			Effect: "write", Risk: "medium",
-			Confirmation: "user_required", Idempotency: "non_idempotent",
-		},
-		Validate: validateWorkflowRunFlags,
-		Flags: []LeafFlag{
-			{Name: "base-id", Usage: "目标 Base ID (必填)", Bind: "baseId", Trim: true, Required: true, Aliases: []string{"base"}},
-			{Name: "workflow-id", Usage: "目标工作流 ID (必填)", Bind: "workflowId", Trim: true, Required: true},
-			{Name: "table-id", Usage: "记录类触发器绑定的 Table ID；定时触发器不传", Bind: "tableId", Trim: true, OmitEmpty: true, RequiredWhen: "record-ids is provided or the workflow uses a record-based trigger"},
-			{Name: "record-ids", Usage: "触发工作流的记录 ID，逗号分隔；记录类触发器必填，1 到 5 个且不可重复", Kind: LeafStringSlice, Bind: "recordIds", RequiredWhen: "table-id is provided or the workflow uses a record-based trigger"},
-		},
-		Constraints: []LeafConstraint{{
-			Kind:        corecmd.Custom,
-			Flags:       []string{"table-id", "record-ids"},
-			Description: "记录类触发器必须同时提供 --table-id 与 --record-ids；定时触发器两者都不传",
-		}},
-		Contract: LeafContract{
-			Identity: contract.ToolIdentitySpec{
-				ProductID:      "aitable",
-				Name:           "workflow_run",
-				CanonicalPath:  "aitable.workflow_run",
-				CLIPath:        "aitable workflow run",
-				PrimaryCLIPath: "aitable workflow run",
-			},
-			Description: "立即执行 AI 表格自动化工作流，并返回异步执行提交结果。",
-			Interface:   aitableMCPInterface("run_workflow"),
-			Selection: contract.SelectionSpec{
-				AgentSummary: "立即执行已知 AI 表格自动化工作流，并获取 executionId。",
-				UseWhen:      []string{"用户明确要求立即执行已知工作流，已确认真实 base-id、workflow-id、触发类型及可能产生的业务副作用；记录类触发器还需确认绑定的 table-id 和 1 到 5 个真实 record-id"},
-				AvoidWhen:    []string{"仅开启后续自动触发用 workflow enable；查询工作流定义用 workflow get；查询既有执行结果用 workflow history；返回 executionId 后应以 history 的 instanceId 核对，不要在结果不确定时直接重复执行"},
-				Examples: []string{
-					"dws aitable workflow run --base-id <BASE_ID> --workflow-id <WORKFLOW_ID> --table-id <TABLE_ID> --record-ids <RECORD_ID>",
-					"dws aitable workflow run --base-id <BASE_ID> --workflow-id <WORKFLOW_ID>",
-				},
-			},
-			Parameters: []contract.ParamDecl{
-				{Name: "base-id", Property: "baseId", Required: boolPtr(true), InterfaceType: "string"},
-				{Name: "workflow-id", Property: "workflowId", Required: boolPtr(true), InterfaceType: "string"},
-				{Name: "table-id", Property: "tableId", InterfaceType: "string", RequiredWhen: "record-ids is provided or the workflow uses a record-based trigger"},
-				{Name: "record-ids", Property: "recordIds", InterfaceType: "array", RequiredWhen: "table-id is provided or the workflow uses a record-based trigger"},
-			},
-		},
-	})
-
-	workflowHistoryCmd := NewLeafCommand(LeafSpec{
-		Use:   "history",
-		Short: "查询工作流执行历史",
-		Long: `分页查询指定 AI 表格工作流的执行历史。
-可按状态和 Unix 毫秒时间范围筛选；同时提供 --after-time 与 --before-time 时，前者必须小于后者。--page 从 0 开始，--size 默认 20、最大 100。
-返回 totalCount 与 list；run 返回的 executionId 可与历史项 instanceId 匹配。`,
-		Example: `  dws aitable workflow history --base-id BASE_ID --workflow-id WORKFLOW_ID
-  dws aitable workflow history --base-id BASE_ID --workflow-id WORKFLOW_ID --status failed --after-time 1786000000000 --before-time 1787000000000 --page 0 --size 50`,
-		Tool:     "get_flow_record_list",
-		Safety:   aitableSafetyRead(),
-		Validate: validateWorkflowHistoryFlags,
-		Flags: []LeafFlag{
-			{Name: "base-id", Usage: "目标 Base ID (必填)", Bind: "baseId", Trim: true, Required: true, Aliases: []string{"base"}},
-			{Name: "workflow-id", Usage: "目标工作流 ID (必填)", Bind: "flowId", Trim: true, Required: true},
-			{Name: "status", Usage: "执行状态筛选；不传表示全部", Bind: "status", Trim: true, OmitEmpty: true, Enum: []string{"success", "failed", "running", "break", "untrigger"}},
-			{Name: "after-time", Usage: "开始时间（Unix 毫秒）", Kind: LeafInt, Bind: "afterTime"},
-			{Name: "before-time", Usage: "结束时间（Unix 毫秒）", Kind: LeafInt, Bind: "beforeTime"},
-			{Name: "page", Usage: "页码，从 0 开始", Kind: LeafInt, Default: "0", Bind: "page"},
-			{Name: "size", Usage: "每页条数 [1, 100]", Kind: LeafInt, Default: "20", Bind: "size"},
-		},
-		Constraints: []LeafConstraint{{
-			Kind:        corecmd.Custom,
-			Flags:       []string{"after-time", "before-time"},
-			Description: "同时提供 --after-time 与 --before-time 时，--after-time 必须小于 --before-time",
-		}},
-		Contract: LeafContract{
-			Identity: contract.ToolIdentitySpec{
-				ProductID:      "aitable",
-				Name:           "workflow_history",
-				CanonicalPath:  "aitable.workflow_history",
-				CLIPath:        "aitable workflow history",
-				PrimaryCLIPath: "aitable workflow history",
-			},
-			Description: "分页查询 AI 表格自动化工作流执行历史。",
-			Interface:   aitableMCPInterface("get_flow_record_list"),
-			Selection: contract.SelectionSpec{
-				AgentSummary: "按状态、时间和分页条件查询工作流执行历史。",
-				UseWhen:      []string{"需要核对工作流是否执行、执行结果或定位 run 返回的 executionId 时；executionId 与历史项 instanceId 相同，running 为非终态"},
-				AvoidWhen:    []string{"查询工作流定义用 workflow get；列出工作流用 workflow list；立即发起执行用 workflow run"},
-				Examples: []string{
-					"dws aitable workflow history --base-id <BASE_ID> --workflow-id <WORKFLOW_ID>",
-					"dws aitable workflow history --base-id <BASE_ID> --workflow-id <WORKFLOW_ID> --status failed --page 0 --size 50",
-				},
-			},
-			Parameters: []contract.ParamDecl{
-				{Name: "base-id", Property: "baseId", Required: boolPtr(true), InterfaceType: "string"},
-				{Name: "workflow-id", Property: "flowId", Required: boolPtr(true), InterfaceType: "string"},
-				{Name: "status", Property: "status", InterfaceType: "string", Enum: []string{"success", "failed", "running", "break", "untrigger"}},
-				{Name: "after-time", Property: "afterTime", InterfaceType: "number"},
-				{Name: "before-time", Property: "beforeTime", InterfaceType: "number"},
-				{Name: "page", Property: "page", InterfaceType: "number"},
-				{Name: "size", Property: "size", InterfaceType: "number"},
-			},
-		},
-	})
-
 	// ── dashboard: 仪表盘管理 ────────────────────────────────────

 	dashboardCmd := &cobra.Command{Use: "dashboard", Short: "仪表盘管理", RunE: groupRunE}
@@ -7599,7 +7424,6 @@ parentSectionId 为空串表示该节点在 Base 根目录下。
 	workflowCmd.AddCommand(
 		workflowEditExampleCmd, workflowCreateCmd, workflowUpdateCmd,
 		workflowEnableCmd, workflowDisableCmd,
-		workflowRunCmd, workflowHistoryCmd,
 		workflowGetCmd, workflowListCmd,
 	)

@@ -12,7 +12,6 @@ import (
 	"strings"
 	"testing"

-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/testseam"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/edition"
 )

@@ -41,23 +40,26 @@ func (*aitableWorkflowCaller) JQ() string     { return "" }

 func runAitableWorkflowCommand(t *testing.T, stdin io.Reader, args ...string) (*aitableWorkflowCaller, error) {
 	t.Helper()
-	testseam.Protect(t, &os.Args)
+	previousDeps := deps
+	previousArgs := os.Args
+	t.Cleanup(func() {
+		deps = previousDeps
+		os.Args = previousArgs
+	})

 	caller := &aitableWorkflowCaller{}
-	InitDepsForTest(t, caller)
+	InitDeps(caller)
 	deps.Out.w = io.Discard
 	os.Args = append([]string{"dws", "aitable", "workflow"}, args...)

 	cmd := newAitableCommand()
 	cmd.PersistentFlags().String("format", "json", "output format")
-	cmd.PersistentFlags().Bool("yes", false, "skip confirmation")
 	cmd.SilenceErrors = true
 	cmd.SilenceUsage = true
 	cmd.SetArgs(append([]string{"workflow"}, args...))
-	if stdin == nil {
-		stdin = strings.NewReader("")
+	if stdin != nil {
+		cmd.SetIn(stdin)
 	}
-	cmd.SetIn(stdin)
 	return caller, cmd.Execute()
 }

@@ -195,158 +197,3 @@ func TestAitableWorkflowWriteRejectsInvalidInput(t *testing.T) {
 		})
 	}
 }
-
-func TestCrossPlatformCoverageAitableWorkflowRunMapsRecordTrigger(t *testing.T) {
-	caller, err := runAitableWorkflowCommand(t, nil,
-		"run",
-		"--base-id", "base-run",
-		"--workflow-id", "workflow-run",
-		"--table-id", "table-run",
-		"--record-ids", "record-1,record-2",
-		"--yes",
-	)
-	if err != nil {
-		t.Fatalf("workflow run returned error: %v", err)
-	}
-	if len(caller.calls) != 1 {
-		t.Fatalf("tool call count = %d, want 1", len(caller.calls))
-	}
-	call := caller.calls[0]
-	if call.productID != "aitable" || call.toolName != "run_workflow" {
-		t.Fatalf("tool call = %s/%s, want aitable/run_workflow", call.productID, call.toolName)
-	}
-	wantArgs := map[string]any{
-		"baseId":     "base-run",
-		"workflowId": "workflow-run",
-		"tableId":    "table-run",
-		"recordIds":  []string{"record-1", "record-2"},
-	}
-	if !reflect.DeepEqual(call.args, wantArgs) {
-		t.Fatalf("tool args = %#v, want %#v", call.args, wantArgs)
-	}
-}
-
-func TestCrossPlatformCoverageAitableWorkflowRunMapsScheduledTrigger(t *testing.T) {
-	caller, err := runAitableWorkflowCommand(t, nil,
-		"run", "--base", "base-scheduled", "--workflow-id", "workflow-scheduled", "--yes",
-	)
-	if err != nil {
-		t.Fatalf("scheduled workflow run returned error: %v", err)
-	}
-	wantArgs := map[string]any{
-		"baseId":     "base-scheduled",
-		"workflowId": "workflow-scheduled",
-	}
-	if len(caller.calls) != 1 || !reflect.DeepEqual(caller.calls[0].args, wantArgs) {
-		t.Fatalf("calls = %#v, want one scheduled invocation %#v", caller.calls, wantArgs)
-	}
-}
-
-func TestCrossPlatformCoverageAitableWorkflowRunRejectsUnsafeOrInvalidInput(t *testing.T) {
-	tests := []struct {
-		name string
-		args []string
-		want string
-	}{
-		{name: "confirmation", args: []string{"run", "--base-id", "base", "--workflow-id", "workflow"}, want: "用户确认"},
-		{name: "blank table", args: []string{"run", "--base-id", "base", "--workflow-id", "workflow", "--table-id", "   ", "--yes"}, want: "--table-id 不能为空"},
-		{name: "blank records", args: []string{"run", "--base-id", "base", "--workflow-id", "workflow", "--record-ids", " , ", "--yes"}, want: "--record-ids 必须包含"},
-		{name: "table without records", args: []string{"run", "--base-id", "base", "--workflow-id", "workflow", "--table-id", "table", "--yes"}, want: "必须同时提供"},
-		{name: "records without table", args: []string{"run", "--base-id", "base", "--workflow-id", "workflow", "--record-ids", "record", "--yes"}, want: "必须同时提供"},
-		{name: "duplicate records", args: []string{"run", "--base-id", "base", "--workflow-id", "workflow", "--table-id", "table", "--record-ids", "record,record", "--yes"}, want: "不能包含重复值"},
-		{name: "too many records", args: []string{"run", "--base-id", "base", "--workflow-id", "workflow", "--table-id", "table", "--record-ids", "r1,r2,r3,r4,r5,r6", "--yes"}, want: "最多支持 5 个"},
-	}
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			caller, err := runAitableWorkflowCommand(t, nil, tc.args...)
-			if err == nil || !strings.Contains(strings.ToLower(err.Error()), strings.ToLower(tc.want)) {
-				t.Fatalf("error = %v, want substring %q", err, tc.want)
-			}
-			if len(caller.calls) != 0 {
-				t.Fatalf("invalid run reached MCP: %#v", caller.calls)
-			}
-		})
-	}
-}
-
-func TestCrossPlatformCoverageAitableWorkflowHistoryMapsFilters(t *testing.T) {
-	caller, err := runAitableWorkflowCommand(t, nil,
-		"history",
-		"--base-id", "base-history",
-		"--workflow-id", "workflow-history",
-		"--status", "failed",
-		"--after-time", "1786000000000",
-		"--before-time", "1787000000000",
-		"--page", "2",
-		"--size", "50",
-	)
-	if err != nil {
-		t.Fatalf("workflow history returned error: %v", err)
-	}
-	if len(caller.calls) != 1 {
-		t.Fatalf("tool call count = %d, want 1", len(caller.calls))
-	}
-	call := caller.calls[0]
-	if call.productID != "aitable" || call.toolName != "get_flow_record_list" {
-		t.Fatalf("tool call = %s/%s, want aitable/get_flow_record_list", call.productID, call.toolName)
-	}
-	wantArgs := map[string]any{
-		"baseId":     "base-history",
-		"flowId":     "workflow-history",
-		"status":     "failed",
-		"afterTime":  1786000000000,
-		"beforeTime": 1787000000000,
-		"page":       2,
-		"size":       50,
-	}
-	if !reflect.DeepEqual(call.args, wantArgs) {
-		t.Fatalf("tool args = %#v, want %#v", call.args, wantArgs)
-	}
-}
-
-func TestCrossPlatformCoverageAitableWorkflowHistoryMapsSingleTimeFilter(t *testing.T) {
-	caller, err := runAitableWorkflowCommand(t, nil,
-		"history",
-		"--base-id", "base-history",
-		"--workflow-id", "workflow-history",
-		"--after-time", "1786000000000",
-	)
-	if err != nil {
-		t.Fatalf("workflow history returned error: %v", err)
-	}
-	wantArgs := map[string]any{
-		"baseId":    "base-history",
-		"flowId":    "workflow-history",
-		"afterTime": 1786000000000,
-		"size":      20,
-	}
-	if len(caller.calls) != 1 || !reflect.DeepEqual(caller.calls[0].args, wantArgs) {
-		t.Fatalf("calls = %#v, want one history invocation %#v", caller.calls, wantArgs)
-	}
-}
-
-func TestCrossPlatformCoverageAitableWorkflowHistoryRejectsInvalidFilters(t *testing.T) {
-	tests := []struct {
-		name string
-		args []string
-		want string
-	}{
-		{name: "status", args: []string{"history", "--base-id", "base", "--workflow-id", "workflow", "--status", "unknown"}, want: "允许值"},
-		{name: "negative page", args: []string{"history", "--base-id", "base", "--workflow-id", "workflow", "--page", "-1"}, want: "--page 必须 >= 0"},
-		{name: "zero size", args: []string{"history", "--base-id", "base", "--workflow-id", "workflow", "--size", "0"}, want: "--size 必须在"},
-		{name: "large size", args: []string{"history", "--base-id", "base", "--workflow-id", "workflow", "--size", "101"}, want: "--size 必须在"},
-		{name: "negative after", args: []string{"history", "--base-id", "base", "--workflow-id", "workflow", "--after-time", "-1"}, want: "Unix 毫秒时间戳"},
-		{name: "reversed range", args: []string{"history", "--base-id", "base", "--workflow-id", "workflow", "--after-time", "200", "--before-time", "100"}, want: "必须小于"},
-	}
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			caller, err := runAitableWorkflowCommand(t, nil, tc.args...)
-			if err == nil || !strings.Contains(err.Error(), tc.want) {
-				t.Fatalf("error = %v, want substring %q", err, tc.want)
-			}
-			if len(caller.calls) != 0 {
-				t.Fatalf("invalid history query reached MCP: %#v", caller.calls)
-			}
-		})
-	}
-}
@@ -1,163 +0,0 @@
-// Copyright 2026 Alibaba Group
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package helpers
-
-import (
-	"errors"
-	"reflect"
-	"testing"
-
-	apperrors "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/errors"
-)
-
-func runNativeCardUpdate(t *testing.T, caller *scriptedToolCaller, args ...string) error {
-	t.Helper()
-	installScriptedCaller(t, caller)
-	root := newChatCommand()
-	root.SilenceErrors = true
-	root.SilenceUsage = true
-	if root.PersistentFlags().Lookup("dry-run") == nil {
-		root.PersistentFlags().Bool("dry-run", false, "preview without executing")
-	}
-	if root.PersistentFlags().Lookup("yes") == nil {
-		root.PersistentFlags().Bool("yes", false, "skip confirmation")
-	}
-	root.SetArgs(args)
-	return root.Execute()
-}
-
-func TestCrossPlatformCoverageNativeMessageUpdateCardVerifiesWrite(t *testing.T) {
-	t.Run("atomic command preserves no-extra-confirmation contract", func(t *testing.T) {
-		caller := &scriptedToolCaller{steps: []scriptedToolStep{{text: `{"result":{"bizId":"biz-confirm","updated":true}}`}}}
-		if err := runNativeCardUpdate(t, caller,
-			"message", "update-card",
-			"--biz-id", "biz-confirm",
-			"--content", "原子更新",
-			"--flow-status", "3",
-		); err != nil {
-			t.Fatal(err)
-		}
-		wantArgs := map[string]any{
-			"bizId":      "biz-confirm",
-			"msgContent": "原子更新",
-			"flowStatus": 3,
-		}
-		if caller.calls != 1 || caller.server != "im" || caller.tool != "update_streaming_card" || !reflect.DeepEqual(caller.args, wantArgs) {
-			t.Fatalf("atomic call = count:%d server:%q tool:%q args:%#v", caller.calls, caller.server, caller.tool, caller.args)
-		}
-	})
-
-	t.Run("explicit evidence succeeds", func(t *testing.T) {
-		caller := &scriptedToolCaller{steps: []scriptedToolStep{{text: `{"result":{"bizId":"biz-1","updated":true}}`}}}
-		err := runNativeCardUpdate(t, caller,
-			"message", "update-card",
-			"--biz-id", "biz-1",
-			"--content", "完成",
-			"--flow-status", "3",
-		)
-		if err != nil {
-			t.Fatal(err)
-		}
-		if caller.calls != 1 || caller.server != "im" || caller.tool != "update_streaming_card" {
-			t.Fatalf("call = count:%d server:%q tool:%q", caller.calls, caller.server, caller.tool)
-		}
-		if caller.args["bizId"] != "biz-1" {
-			t.Fatalf("args = %#v", caller.args)
-		}
-	})
-
-	t.Run("generic success is unverified", func(t *testing.T) {
-		caller := &scriptedToolCaller{steps: []scriptedToolStep{{text: `{"success":true,"errorCode":null}`}}}
-		err := runNativeCardUpdate(t, caller,
-			"message", "update-card",
-			"--biz-id", "not-a-real-card",
-			"--content", "完成",
-			"--flow-status", "3",
-		)
-		var typed *apperrors.Error
-		if !errors.As(err, &typed) || typed.Reason != "streaming_card_update_unverified" {
-			t.Fatalf("error = %#v, want streaming_card_update_unverified", err)
-		}
-	})
-
-	t.Run("lower write error is preserved", func(t *testing.T) {
-		caller := &scriptedToolCaller{steps: []scriptedToolStep{{err: errors.New("write unavailable")}}}
-		err := runNativeCardUpdate(t, caller,
-			"message", "update-card",
-			"--biz-id", "biz-1",
-			"--content", "完成",
-			"--flow-status", "3",
-		)
-		if err == nil {
-			t.Fatal("lower write error was ignored")
-		}
-	})
-
-	for _, test := range []struct {
-		name       string
-		response   string
-		wantReason string
-	}{
-		{name: "empty response", response: "", wantReason: "streaming_card_update_unverified"},
-		{name: "invalid response", response: "{", wantReason: "streaming_card_update_response_invalid"},
-		{name: "not applied", response: `{"result":{"updated":false}}`, wantReason: "streaming_card_update_not_applied"},
-		{name: "biz id drift", response: `{"result":{"bizId":"biz-other","updated":true}}`, wantReason: "streaming_card_update_biz_id_mismatch"},
-	} {
-		t.Run(test.name, func(t *testing.T) {
-			caller := &scriptedToolCaller{steps: []scriptedToolStep{{text: test.response}}}
-			err := runNativeCardUpdate(t, caller,
-				"message", "update-card",
-				"--biz-id", "biz-1",
-				"--content", "完成",
-				"--flow-status", "3",
-			)
-			var typed *apperrors.Error
-			if !errors.As(err, &typed) || typed.Reason != test.wantReason {
-				t.Fatalf("error = %#v, want reason %q", err, test.wantReason)
-			}
-		})
-	}
-
-	t.Run("invalid arguments make no call", func(t *testing.T) {
-		for _, args := range [][]string{
-			{"message", "update-card", "--biz-id", "<bizId>", "--content", "完成", "--flow-status", "3"},
-			{"message", "update-card", "--biz-id", "biz-1", "--content", "完成", "--flow-status", "6"},
-		} {
-			caller := &scriptedToolCaller{}
-			if err := runNativeCardUpdate(t, caller, args...); err == nil {
-				t.Fatalf("args %v unexpectedly succeeded", args)
-			}
-			if caller.calls != 0 {
-				t.Fatalf("args %v made %d calls", args, caller.calls)
-			}
-		}
-	})
-
-	t.Run("dry run publishes unverified plan without write", func(t *testing.T) {
-		caller := &scriptedToolCaller{}
-		err := runNativeCardUpdate(t, caller,
-			"message", "update-card",
-			"--biz-id", "biz-preview",
-			"--content", "完成",
-			"--flow-status", "3",
-			"--dry-run",
-		)
-		if err != nil {
-			t.Fatal(err)
-		}
-		if caller.calls != 0 {
-			t.Fatalf("dry-run made %d calls", caller.calls)
-		}
-	})
-}
@@ -25,7 +25,7 @@ func runChatCoverageCommand(t *testing.T, caller edition.ToolCaller, args ...str
 	root.SilenceUsage = true
 	root.SetOut(io.Discard)
 	root.SetErr(io.Discard)
-	root.SetArgs(append(append([]string(nil), args...), "--yes"))
+	root.SetArgs(args)
 	return root.ExecuteContext(context.Background())
 }

@@ -1,267 +0,0 @@
-package helpers
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-	"io"
-	"reflect"
-	"testing"
-	"time"
-
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/edition"
-)
-
-type chatMessagePaginationCaller struct {
-	steps []scriptedToolStep
-	calls []pagedCommandCall
-}
-
-func (c *chatMessagePaginationCaller) CallTool(_ context.Context, serverID, toolName string, args map[string]any) (*edition.ToolResult, error) {
-	copied := map[string]any{}
-	for k, v := range args {
-		copied[k] = v
-	}
-	c.calls = append(c.calls, pagedCommandCall{server: serverID, tool: toolName, args: copied})
-	if len(c.steps) == 0 {
-		return textToolResult(`{"result":{"messages":[],"items":[],"hasMore":false,"nextCursor":"0"}}`), nil
-	}
-	step := c.steps[len(c.calls)-1]
-	if step.err != nil {
-		return nil, step.err
-	}
-	return textToolResult(step.text), nil
-}
-
-func (*chatMessagePaginationCaller) Format() string { return "json" }
-func (*chatMessagePaginationCaller) DryRun() bool   { return false }
-func (*chatMessagePaginationCaller) Fields() string { return "" }
-func (*chatMessagePaginationCaller) JQ() string     { return "" }
-
-func executeChatMessagePaginationCommand(t *testing.T, caller *chatMessagePaginationCaller, args ...string) (map[string]any, error) {
-	t.Helper()
-	oldDeps := deps
-	oldSleep := helperSleep
-	t.Cleanup(func() {
-		deps = oldDeps
-		helperSleep = oldSleep
-	})
-	InitDeps(caller)
-	out := &bytes.Buffer{}
-	deps.Out.w = out
-	deps.Out.errW = io.Discard
-	helperSleep = func(d time.Duration) {}
-
-	root := newChatCommand()
-	root.SilenceErrors = true
-	root.SilenceUsage = true
-	root.SetOut(io.Discard)
-	root.SetErr(io.Discard)
-	root.SetArgs(args)
-	err := root.ExecuteContext(context.Background())
-	if out.Len() == 0 {
-		return nil, err
-	}
-	var parsed map[string]any
-	if unmarshalErr := json.Unmarshal(out.Bytes(), &parsed); unmarshalErr != nil {
-		t.Fatalf("stdout JSON = %q, err = %v", out.String(), unmarshalErr)
-	}
-	return parsed, err
-}
-
-func TestChatMessagePaginationDefaultSinglePageUnchanged(t *testing.T) {
-	tests := []struct {
-		name   string
-		args   []string
-		server string
-		tool   string
-		want   map[string]any
-	}{
-		{
-			name:   "list-all",
-			args:   []string{"message", "list-all", "--start", "2026-08-01 00:00:00", "--end", "2026-08-02 00:00:00"},
-			server: "",
-			tool:   "search_messages_by_time_range",
-			want:   map[string]any{"startTime": "2026-08-01 00:00:00", "endTime": "2026-08-02 00:00:00", "limit": 50, "cursor": "0"},
-		},
-		{
-			name:   "list-by-sender",
-			args:   []string{"message", "list-by-sender", "--sender-user-id", "u1", "--start", "2026-08-01T00:00:00+08:00", "--end", "2026-08-02T00:00:00+08:00"},
-			server: "",
-			tool:   "search_messages_by_sender",
-			want:   map[string]any{"senderUserId": "u1", "startTime": float64(1785513600000), "endTime": float64(1785600000000), "limit": 50, "cursor": "0"},
-		},
-		{
-			name:   "list-mentions",
-			args:   []string{"message", "list-mentions", "--group", "cid1", "--start", "2026-08-01T00:00:00+08:00", "--end", "2026-08-02T00:00:00+08:00"},
-			server: "",
-			tool:   "search_at_me_message",
-			want:   map[string]any{"openConversationId": "cid1", "startTime": float64(1785513600000), "endTime": float64(1785600000000), "limit": 50, "cursor": "0"},
-		},
-		{
-			name:   "list-focused",
-			args:   []string{"message", "list-focused"},
-			server: "",
-			tool:   "list_special_focus_messages",
-			want:   map[string]any{"limit": 50},
-		},
-		{
-			name:   "search",
-			args:   []string{"message", "search", "--query", "发布", "--start", "2026-08-01T00:00:00+08:00", "--end", "2026-08-02T00:00:00+08:00"},
-			server: "",
-			tool:   "search_messages_by_keyword",
-			want:   map[string]any{"keyword": "发布", "startTime": float64(1785513600000), "endTime": float64(1785600000000), "limit": 100, "cursor": "0"},
-		},
-		{
-			name:   "search-advanced",
-			args:   []string{"message", "search-advanced", "--query", "周报", "--start", "2026-08-01T00:00:00+08:00", "--end", "2026-08-02T00:00:00+08:00"},
-			server: "im",
-			tool:   "search_messages",
-			want:   map[string]any{"keyword": "周报", "startTime": float64(1785513600000), "endTime": float64(1785600000000), "limit": 100, "cursor": "0"},
-		},
-		{
-			name:   "list-favorites",
-			args:   []string{"message", "list-favorites"},
-			server: "im",
-			tool:   "list_message_favorites",
-			want:   map[string]any{"cursor": int64(0), "size": "20"},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			caller := &chatMessagePaginationCaller{}
-			args := append([]string{}, tt.args...)
-			args = append(args, "--page-limit", "2", "--max-items", "1", "--page-delay", "0")
-			_, err := executeChatMessagePaginationCommand(t, caller, args...)
-			if err != nil {
-				t.Fatal(err)
-			}
-			if len(caller.calls) != 1 {
-				t.Fatalf("calls = %#v, want one fallback call", caller.calls)
-			}
-			got := caller.calls[0]
-			if got.server != tt.server || got.tool != tt.tool || !argsEqual(got.args, tt.want) {
-				t.Fatalf("call = %#v, want server=%s tool=%s args=%#v", got, tt.server, tt.tool, tt.want)
-			}
-		})
-	}
-}
-
-func TestChatMessagePaginationPageAllAggregatesSevenCommands(t *testing.T) {
-	tests := []struct {
-		name      string
-		args      []string
-		server    string
-		tool      string
-		itemPath  string
-		cursorOne any
-		cursorTwo any
-		pageOne   string
-		pageTwo   string
-	}{
-		{
-			name: "list-all", args: []string{"message", "list-all", "--start", "2026-08-01 00:00:00", "--end", "2026-08-02 00:00:00"},
-			server: "chat", tool: "search_messages_by_time_range", itemPath: "conversationMessagesList", cursorOne: "0", cursorTwo: "c2",
-			pageOne: `{"result":{"conversationMessagesList":[{"openConversationId":"cid1","title":"群1","messages":[{"id":"m1"}]}],"hasMore":true,"nextCursor":"c2"}}`,
-			pageTwo: `{"result":{"conversationMessagesList":[{"openConversationId":"cid1","title":"群1","messages":[{"id":"m2"}]}],"hasMore":false,"nextCursor":""}}`,
-		},
-		{
-			name: "list-by-sender", args: []string{"message", "list-by-sender", "--sender-user-id", "u1", "--start", "2026-08-01T00:00:00+08:00", "--end", "2026-08-02T00:00:00+08:00"},
-			server: "chat", tool: "search_messages_by_sender", itemPath: "conversationMessagesList", cursorOne: "0", cursorTwo: "c2",
-			pageOne: `{"result":{"conversationMessagesList":[{"openConversationId":"cid1","title":"洄川","messages":[{"id":"m1"}]}],"hasMore":true,"nextCursor":"c2"}}`,
-			pageTwo: `{"result":{"conversationMessagesList":[{"openConversationId":"cid1","title":"洄川","messages":[{"id":"m2"}]}],"hasMore":false,"nextCursor":""}}`,
-		},
-		{
-			name: "list-mentions", args: []string{"message", "list-mentions", "--start", "2026-08-01T00:00:00+08:00", "--end", "2026-08-02T00:00:00+08:00"},
-			server: "chat", tool: "search_at_me_message", itemPath: "conversationMessagesList", cursorOne: "0", cursorTwo: "c2",
-			pageOne: `{"result":{"conversationMessagesList":[{"openConversationId":"cid1","title":"群1","messages":[{"id":"m1"}]}],"hasMore":true,"nextCursor":"c2"}}`,
-			pageTwo: `{"result":{"conversationMessagesList":[{"openConversationId":"cid1","title":"群1","messages":[{"id":"m2"}]}],"hasMore":false,"nextCursor":""}}`,
-		},
-		{
-			name: "list-focused", args: []string{"message", "list-focused"},
-			server: "chat", tool: "list_special_focus_messages", itemPath: "messages", cursorOne: nil, cursorTwo: int64(2),
-			pageOne: `{"result":{"messages":[{"id":"m1"}],"hasMore":true,"nextCursor":2}}`,
-			pageTwo: `{"result":{"messages":[{"id":"m2"}],"hasMore":false,"nextCursor":0}}`,
-		},
-		{
-			name: "search", args: []string{"message", "search", "--query", "发布", "--start", "2026-08-01T00:00:00+08:00", "--end", "2026-08-02T00:00:00+08:00"},
-			server: "chat", tool: "search_messages_by_keyword", itemPath: "conversationMessagesList", cursorOne: "0", cursorTwo: "c2",
-			pageOne: `{"result":{"conversationMessagesList":[{"openConversationId":"cid1","title":"群1","messages":[{"id":"m1"}]}],"hasMore":true,"nextCursor":"c2"}}`,
-			pageTwo: `{"result":{"conversationMessagesList":[{"openConversationId":"cid1","title":"群1","messages":[{"id":"m2"}]}],"hasMore":false,"nextCursor":""}}`,
-		},
-		{
-			name: "search-advanced", args: []string{"message", "search-advanced", "--query", "周报"},
-			server: "im", tool: "search_messages", itemPath: "conversationMessagesList", cursorOne: "0", cursorTwo: "c2",
-			pageOne: `{"result":{"conversationMessagesList":[{"openConversationId":"cid1","title":"群1","messages":[{"id":"m1"}]}],"hasMore":true,"nextCursor":"c2"}}`,
-			pageTwo: `{"result":{"conversationMessagesList":[{"openConversationId":"cid1","title":"群1","messages":[{"id":"m2"}]}],"hasMore":false,"nextCursor":""}}`,
-		},
-		{
-			name: "list-favorites", args: []string{"message", "list-favorites"},
-			server: "im", tool: "list_message_favorites", itemPath: "items", cursorOne: int64(0), cursorTwo: int64(20),
-			pageOne: `{"result":{"items":[{"id":"f1"}],"hasMore":true,"nextCursor":20}}`,
-			pageTwo: `{"result":{"items":[{"id":"f2"}],"hasMore":false,"nextCursor":0}}`,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			caller := &chatMessagePaginationCaller{steps: []scriptedToolStep{{text: tt.pageOne}, {text: tt.pageTwo}}}
-			args := append([]string{}, tt.args...)
-			args = append(args, "--page-all", "--page-delay", "0")
-			got, err := executeChatMessagePaginationCommand(t, caller, args...)
-			if err != nil {
-				t.Fatal(err)
-			}
-			items := got["result"].(map[string]any)[tt.itemPath].([]any)
-			if tt.itemPath == "conversationMessagesList" {
-				messages := items[0].(map[string]any)["messages"].([]any)
-				if len(items) != 1 || len(messages) != 2 {
-					t.Fatalf("conversation items = %#v", items)
-				}
-			} else if len(items) != 2 {
-				t.Fatalf("items = %#v", items)
-			}
-			if len(caller.calls) != 2 {
-				t.Fatalf("calls = %#v, want two pages", caller.calls)
-			}
-			if caller.calls[0].server != tt.server || caller.calls[0].tool != tt.tool {
-				t.Fatalf("first call = %#v", caller.calls[0])
-			}
-			if !reflect.DeepEqual(caller.calls[0].args["cursor"], tt.cursorOne) {
-				t.Fatalf("first cursor = %#v, want %#v", caller.calls[0].args["cursor"], tt.cursorOne)
-			}
-			if !reflect.DeepEqual(caller.calls[1].args["cursor"], tt.cursorTwo) {
-				t.Fatalf("second cursor = %#v, want %#v", caller.calls[1].args["cursor"], tt.cursorTwo)
-			}
-			paging := got["paging"].(map[string]any)
-			if paging["pages"].(float64) != 2 || paging["total"].(float64) != 2 || paging["truncated"] != false {
-				t.Fatalf("paging = %#v", paging)
-			}
-		})
-	}
-}
-
-func argsEqual(got, want map[string]any) bool {
-	if len(got) != len(want) {
-		return false
-	}
-	for key, wantValue := range want {
-		gotValue, ok := got[key]
-		if !ok {
-			return false
-		}
-		switch w := wantValue.(type) {
-		case float64:
-			g, ok := gotValue.(int64)
-			if !ok || float64(g) != w {
-				return false
-			}
-		default:
-			if !reflect.DeepEqual(gotValue, wantValue) {
-				return false
-			}
-		}
-	}
-	return true
-}
@@ -16,7 +16,6 @@ package helpers
 import (
 	"context"
 	"encoding/json"
-	"errors"
 	"io"
 	"os"
 	"reflect"
@@ -24,10 +23,8 @@ import (
 	"testing"
 	"time"

-	apperrors "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/errors"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/agentproduct"
 	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/edition"
-	"github.com/spf13/cobra"
 )

 type chatMessageSearchCall struct {
@@ -37,41 +34,12 @@ type chatMessageSearchCall struct {
 }

 type chatMessageSearchCaller struct {
-	calls           []chatMessageSearchCall
-	searchResponse  string
-	searchResponses []string
-	searchCalls     int
-	searchError     error
-	failPreflight   bool
-	preflightError  error
+	calls []chatMessageSearchCall
 }

 func (c *chatMessageSearchCaller) CallTool(_ context.Context, productID, toolName string, args map[string]any) (*edition.ToolResult, error) {
 	c.calls = append(c.calls, chatMessageSearchCall{productID: productID, toolName: toolName, args: args})
-	text := `{}`
-	if toolName == "get_conversation_info" {
-		if c.preflightError != nil {
-			return nil, c.preflightError
-		}
-		if c.failPreflight {
-			return nil, errors.New("conversation not found")
-		}
-		text = `{"result":{"openConversationId":"` + args["openConversationId"].(string) + `"}}`
-	}
-	if toolName == "search_messages_by_keyword" || toolName == "search_messages" {
-		if c.searchError != nil {
-			c.searchCalls++
-			return nil, c.searchError
-		}
-		text = `{"result":{"messages":[],"hasMore":false}}`
-		if c.searchCalls < len(c.searchResponses) {
-			text = c.searchResponses[c.searchCalls]
-		} else if c.searchResponse != "" {
-			text = c.searchResponse
-		}
-		c.searchCalls++
-	}
-	return &edition.ToolResult{Content: []edition.ContentBlock{{Type: "text", Text: text}}}, nil
+	return &edition.ToolResult{Content: []edition.ContentBlock{{Type: "text", Text: `{}`}}}, nil
 }

 func (*chatMessageSearchCaller) Format() string { return "json" }
@@ -104,7 +72,6 @@ func TestCrossPlatformCoverageChatMessageSearchUsesMCPContracts(t *testing.T) {
 		productID   string
 		toolName    string
 		wantToolArg map[string]any
-		preflight   []string
 	}{
 		{
 			name:      "keyword search",
@@ -112,13 +79,13 @@ func TestCrossPlatformCoverageChatMessageSearchUsesMCPContracts(t *testing.T) {
 			productID: "chat",
 			toolName:  "search_messages_by_keyword",
 			wantToolArg: map[string]any{
-				"keyword":   "categoryName",
-				"startTime": startTime.UnixMilli(),
-				"endTime":   endTime.UnixMilli(),
-				"limit":     100,
-				"cursor":    "0",
+				"keyword":            "categoryName",
+				"openConversationId": "cid-1",
+				"startTime":          startTime.UnixMilli(),
+				"endTime":            endTime.UnixMilli(),
+				"limit":              100,
+				"cursor":             "0",
 			},
-			preflight: []string{"cid-1"},
 		},
 		{
 			name:      "advanced search",
@@ -126,16 +93,16 @@ func TestCrossPlatformCoverageChatMessageSearchUsesMCPContracts(t *testing.T) {
 			productID: "im",
 			toolName:  "search_messages",
 			wantToolArg: map[string]any{
-				"keyword":           "categoryName",
-				"messageType":       "text",
-				"onlyRobotMessages": true,
-				"searchConvType":    "group",
-				"startTime":         startTime.UnixMilli(),
-				"endTime":           endTime.UnixMilli(),
-				"limit":             100,
-				"cursor":            "0",
+				"keyword":             "categoryName",
+				"openConversationIds": []string{"cid-1", "cid-2"},
+				"messageType":         "text",
+				"onlyRobotMessages":   true,
+				"searchConvType":      "group",
+				"startTime":           startTime.UnixMilli(),
+				"endTime":             endTime.UnixMilli(),
+				"limit":               100,
+				"cursor":              "0",
 			},
-			preflight: []string{"cid-1", "cid-2"},
 		},
 	}

@@ -149,21 +116,14 @@ func TestCrossPlatformCoverageChatMessageSearchUsesMCPContracts(t *testing.T) {
 			cmd := newChatCommand()
 			cmd.SilenceErrors = true
 			cmd.SilenceUsage = true
-			cmd.SetOut(io.Discard)
 			cmd.SetArgs(tt.args)
 			if err := cmd.Execute(); err != nil {
 				t.Fatalf("chat search returned error: %v", err)
 			}
-			if len(caller.calls) != len(tt.preflight)+1 {
-				t.Fatalf("tool calls = %#v", caller.calls)
+			if len(caller.calls) != 1 {
+				t.Fatalf("tool call count = %d, want 1", len(caller.calls))
 			}
-			for index, conversationID := range tt.preflight {
-				call := caller.calls[index]
-				if call.productID != "chat" || call.toolName != "get_conversation_info" || call.args["openConversationId"] != conversationID {
-					t.Fatalf("preflight[%d] = %#v", index, call)
-				}
-			}
-			call := caller.calls[len(caller.calls)-1]
+			call := caller.calls[0]
 			if call.productID != tt.productID || call.toolName != tt.toolName {
 				t.Fatalf("tool call = %s/%s, want %s/%s", call.productID, call.toolName, tt.productID, tt.toolName)
 			}
@@ -174,507 +134,6 @@ func TestCrossPlatformCoverageChatMessageSearchUsesMCPContracts(t *testing.T) {
 	}
 }

-func executeNativeScopedSearch(t *testing.T, caller *chatMessageSearchCaller, args ...string) (map[string]any, error) {
-	t.Helper()
-	previousDeps := deps
-	t.Cleanup(func() { deps = previousDeps })
-	InitDeps(caller)
-	deps.Out.w = io.Discard
-	cmd := newChatCommand()
-	cmd.SilenceErrors = true
-	cmd.SilenceUsage = true
-	var output strings.Builder
-	cmd.SetOut(&output)
-	cmd.SetArgs(args)
-	if err := cmd.Execute(); err != nil {
-		return nil, err
-	}
-	var payload map[string]any
-	if err := json.Unmarshal([]byte(output.String()), &payload); err != nil {
-		return nil, err
-	}
-	return payload, nil
-}
-
-func TestNativeScopedSearchFiltersGlobalResultsForBothEntries(t *testing.T) {
-	start := "2026-07-09T00:00:00+08:00"
-	end := "2026-07-11T00:00:00+08:00"
-	for _, tt := range []struct {
-		name       string
-		args       []string
-		tool       string
-		scopeParam string
-	}{
-		{
-			name:       "keyword search",
-			args:       []string{"message", "search", "--query", "周报", "--group", "cid-target", "--start", start, "--end", end},
-			tool:       "search_messages_by_keyword",
-			scopeParam: "openConversationId",
-		},
-		{
-			name:       "advanced search",
-			args:       []string{"message", "search-advanced", "--query", "周报", "--conversation-ids", "cid-target"},
-			tool:       "search_messages",
-			scopeParam: "openConversationIds",
-		},
-	} {
-		t.Run(tt.name, func(t *testing.T) {
-			caller := &chatMessageSearchCaller{searchResponse: `{
-				"result": {
-					"conversationMessagesList": [
-						{"openConversationId":"cid-target","title":"目标群","messages":[{"openMessageId":"m-target","content":"目标"}]},
-						{"openConversationId":"cid-other","title":"其他群","messages":[{"openMessageId":"m-other","content":"越界"}]}
-					],
-					"hasMore": false
-				}
-			}`}
-			payload, err := executeNativeScopedSearch(t, caller, tt.args...)
-			if err != nil {
-				t.Fatal(err)
-			}
-			result, _ := payload["result"].(map[string]any)
-			groups, _ := result["conversationMessagesList"].([]any)
-			if len(groups) != 1 {
-				t.Fatalf("result = %#v", result)
-			}
-			group, _ := groups[0].(map[string]any)
-			if group["openConversationId"] != "cid-target" {
-				t.Fatalf("group = %#v", group)
-			}
-			scope, _ := payload["scope"].(map[string]any)
-			if scope["targetsValidated"] != true || scope["resultsWithinScope"] != true || scope["filterMode"] != "client" {
-				t.Fatalf("scope = %#v", scope)
-			}
-			searchCall := caller.calls[len(caller.calls)-1]
-			if searchCall.toolName != tt.tool {
-				t.Fatalf("search call = %#v", searchCall)
-			}
-			if _, exists := searchCall.args[tt.scopeParam]; exists {
-				t.Fatalf("global fallback unexpectedly forwarded %s: %#v", tt.scopeParam, searchCall.args)
-			}
-		})
-	}
-}
-
-func TestNativeScopedSearchInvalidCIDStopsBeforeSearch(t *testing.T) {
-	caller := &chatMessageSearchCaller{failPreflight: true}
-	_, err := executeNativeScopedSearch(t, caller,
-		"message", "search-advanced", "--query", "周报", "--conversation-ids", "cid-invalid")
-	if err == nil {
-		t.Fatal("invalid CID unexpectedly succeeded")
-	}
-	var typed *apperrors.Error
-	if !errors.As(err, &typed) || typed.Reason != "search_conversation_scope_invalid" {
-		t.Fatalf("error = %#v", err)
-	}
-	if len(caller.calls) != 1 || caller.calls[0].toolName != "get_conversation_info" {
-		t.Fatalf("calls = %#v", caller.calls)
-	}
-}
-
-func TestNativeScopedSearchPreservesPreflightAuthError(t *testing.T) {
-	want := &CLIError{Code: CodeAuthNotConfigured, Message: "当前未登录"}
-	caller := &chatMessageSearchCaller{preflightError: want}
-	_, err := executeNativeScopedSearch(t, caller,
-		"message", "search-advanced", "--query", "周报", "--conversation-ids", "cid-target")
-	if err == nil {
-		t.Fatal("auth failure unexpectedly succeeded")
-	}
-	var cliErr *CLIError
-	if !errors.As(err, &cliErr) || cliErr.Code != CodeAuthNotConfigured {
-		t.Fatalf("error = %#v", err)
-	}
-}
-
-func TestCrossPlatformCoverageNativeScopedSearchPreservesAmbiguousMCPToolErrors(t *testing.T) {
-	for _, test := range []struct {
-		name string
-		want *CLIError
-	}{
-		{
-			name: "rate limited",
-			want: &CLIError{
-				Code:    CodeMCPToolError,
-				Message: `{"success":false,"errorCode":"invalidRequest.rateLimited","errorMsg":"slow down"}`,
-			},
-		},
-		{
-			name: "permission denied",
-			want: &CLIError{
-				Code:    CodeMCPToolError,
-				Message: `{"success":false,"errorCode":"forbidden.noPermission","errorMsg":"permission denied"}`,
-			},
-		},
-	} {
-		t.Run(test.name, func(t *testing.T) {
-			caller := &chatMessageSearchCaller{preflightError: test.want}
-			_, err := executeNativeScopedSearch(t, caller,
-				"message", "search-advanced", "--query", "周报", "--conversation-ids", "cid-target")
-			if err != test.want {
-				t.Fatalf("error = %#v, want original %#v", err, test.want)
-			}
-			if len(caller.calls) != 1 || caller.calls[0].toolName != "get_conversation_info" {
-				t.Fatalf("calls = %#v", caller.calls)
-			}
-		})
-	}
-}
-
-func TestNativeScopedSearchScansUntilTargetConversationAppears(t *testing.T) {
-	caller := &chatMessageSearchCaller{searchResponses: []string{
-		`{"result":{"conversationMessagesList":[{"openConversationId":"cid-other","messages":[{"openMessageId":"m-other"}]}],"hasMore":true,"nextCursor":"c2"}}`,
-		`{"result":{"conversationMessagesList":[{"openConversationId":"cid-target","messages":[{"openMessageId":"m-target"}]}],"hasMore":false}}`,
-	}}
-	payload, err := executeNativeScopedSearch(t, caller,
-		"message", "search-advanced", "--query", "周报", "--conversation-ids", "cid-target")
-	if err != nil {
-		t.Fatal(err)
-	}
-	result, _ := payload["result"].(map[string]any)
-	if result["pagesFetched"] != float64(2) || result["complete"] != true {
-		t.Fatalf("result = %#v", result)
-	}
-	groups, _ := result["conversationMessagesList"].([]any)
-	if len(groups) != 1 {
-		t.Fatalf("groups = %#v", groups)
-	}
-	searchCalls := make([]chatMessageSearchCall, 0, 2)
-	for _, call := range caller.calls {
-		if call.toolName == "search_messages" {
-			searchCalls = append(searchCalls, call)
-		}
-	}
-	if len(searchCalls) != 2 || searchCalls[1].args["cursor"] != "c2" {
-		t.Fatalf("search calls = %#v", searchCalls)
-	}
-}
-
-func TestCrossPlatformCoverageNativeScopedSearchPageAllOptions(t *testing.T) {
-	t.Run("page limit preserves continuation", func(t *testing.T) {
-		caller := &chatMessageSearchCaller{searchResponse: `{
-			"result": {
-				"conversationMessagesList": [
-					{"openConversationId":"cid-target","messages":[{"openMessageId":"m1"}]}
-				],
-				"hasMore": true,
-				"nextCursor": "c2"
-			}
-		}`}
-		payload, err := executeNativeScopedSearch(t, caller,
-			"message", "search-advanced", "--query", "周报", "--conversation-ids", "cid-target",
-			"--page-all", "--page-limit", "1", "--page-delay", "0")
-		if err != nil {
-			t.Fatal(err)
-		}
-		paging, _ := payload["paging"].(map[string]any)
-		if paging["pages"] != float64(1) || paging["total"] != float64(1) || paging["truncated"] != true {
-			t.Fatalf("paging = %#v", paging)
-		}
-		if caller.searchCalls != 1 {
-			t.Fatalf("search calls = %d, want 1", caller.searchCalls)
-		}
-	})
-
-	t.Run("max items truncates within filtered page", func(t *testing.T) {
-		caller := &chatMessageSearchCaller{searchResponse: `{
-			"result": {
-				"conversationMessagesList": [
-					{"openConversationId":"cid-target","messages":[
-						{"openMessageId":"m1"},
-						{"openMessageId":"m2"}
-					]}
-				],
-				"hasMore": false
-			}
-		}`}
-		payload, err := executeNativeScopedSearch(t, caller,
-			"message", "search-advanced", "--query", "周报", "--conversation-ids", "cid-target",
-			"--page-all", "--max-items", "1", "--page-delay", "0")
-		if err != nil {
-			t.Fatal(err)
-		}
-		result, _ := payload["result"].(map[string]any)
-		groups, _ := result["conversationMessagesList"].([]any)
-		group, _ := groups[0].(map[string]any)
-		messages, _ := group["messages"].([]any)
-		if len(messages) != 1 {
-			t.Fatalf("messages = %#v", messages)
-		}
-		paging, _ := payload["paging"].(map[string]any)
-		if paging["total"] != float64(1) || paging["truncatedWithinPage"] != true || paging["resumeCursorReliable"] != false {
-			t.Fatalf("paging = %#v", paging)
-		}
-	})
-}
-
-func TestNativeScopedSearchMissingConversationIdentityFailsClosed(t *testing.T) {
-	caller := &chatMessageSearchCaller{searchResponse: `{"result":{"messages":[{"openMessageId":"m1"}],"hasMore":false}}`}
-	_, err := executeNativeScopedSearch(t, caller,
-		"message", "search-advanced", "--query", "周报", "--conversation-ids", "cid-target")
-	if err == nil {
-		t.Fatal("unverifiable scoped result unexpectedly succeeded")
-	}
-	var typed *apperrors.Error
-	if !errors.As(err, &typed) || typed.Reason != "search_conversation_scope_unverified" {
-		t.Fatalf("error = %#v", err)
-	}
-}
-
-func TestNativeScopedSearchValidEmptyResultIsComplete(t *testing.T) {
-	caller := &chatMessageSearchCaller{searchResponse: `{"result":{"messages":[],"hasMore":false}}`}
-	payload, err := executeNativeScopedSearch(t, caller,
-		"message", "search-advanced", "--query", "周报", "--conversation-ids", "cid-empty")
-	if err != nil {
-		t.Fatal(err)
-	}
-	result, _ := payload["result"].(map[string]any)
-	if result["complete"] != true || result["hasMore"] != false {
-		t.Fatalf("result = %#v", result)
-	}
-	scope, _ := payload["scope"].(map[string]any)
-	if scope["targetsValidated"] != true || scope["sourceComplete"] != true {
-		t.Fatalf("scope = %#v", scope)
-	}
-}
-
-func TestCrossPlatformCoverageNativeScopedSearchFailureAndPaginationBranches(t *testing.T) {
-	t.Run("empty scope uses the native search call", func(t *testing.T) {
-		caller := &chatMessageSearchCaller{}
-		previousDeps := deps
-		t.Cleanup(func() { deps = previousDeps })
-		InitDeps(caller)
-		deps.Out.w = io.Discard
-
-		cmd := &cobra.Command{Use: "search"}
-		err := runConversationScopedMessageSearch(
-			cmd,
-			"im",
-			"search_messages",
-			"openConversationIds",
-			map[string]any{"keyword": "周报"},
-			[]string{"", " "},
-		)
-		if err != nil {
-			t.Fatal(err)
-		}
-		if len(caller.calls) != 1 || caller.calls[0].toolName != "search_messages" {
-			t.Fatalf("calls = %#v", caller.calls)
-		}
-	})
-
-	t.Run("invalid page options fail before preflight", func(t *testing.T) {
-		caller := &chatMessageSearchCaller{}
-		previousDeps := deps
-		t.Cleanup(func() { deps = previousDeps })
-		InitDeps(caller)
-
-		cmd := &cobra.Command{Use: "search"}
-		AddPagedMCPFlags(cmd)
-		if err := cmd.Flags().Set("page-all", "true"); err != nil {
-			t.Fatal(err)
-		}
-		if err := cmd.Flags().Set("page-limit", "0"); err != nil {
-			t.Fatal(err)
-		}
-		err := runConversationScopedMessageSearch(
-			cmd,
-			"im",
-			"search_messages",
-			"openConversationIds",
-			map[string]any{"keyword": "周报"},
-			[]string{"cid-target"},
-		)
-		if err == nil || !strings.Contains(err.Error(), "--page-limit must be between 1 and 500") {
-			t.Fatalf("error = %v", err)
-		}
-		if len(caller.calls) != 0 {
-			t.Fatalf("invalid paging made calls: %#v", caller.calls)
-		}
-	})
-
-	t.Run("cancelled context interrupts page delay", func(t *testing.T) {
-		caller := &chatMessageSearchCaller{searchResponse: `{
-			"result": {
-				"messages": [{"openMessageId":"m1","openConversationId":"cid-target"}],
-				"hasMore": true,
-				"nextCursor": "c2"
-			}
-		}`}
-		previousDeps := deps
-		t.Cleanup(func() { deps = previousDeps })
-		InitDeps(caller)
-		deps.Out.w = io.Discard
-
-		cmd := &cobra.Command{Use: "search"}
-		AddPagedMCPFlags(cmd)
-		if err := cmd.Flags().Set("page-all", "true"); err != nil {
-			t.Fatal(err)
-		}
-		if err := cmd.Flags().Set("page-delay", "60000"); err != nil {
-			t.Fatal(err)
-		}
-		ctx, cancel := context.WithCancel(context.Background())
-		cancel()
-		cmd.SetContext(ctx)
-		err := runConversationScopedMessageSearch(
-			cmd,
-			"im",
-			"search_messages",
-			"openConversationIds",
-			map[string]any{"keyword": "周报", "limit": 100, "cursor": "0"},
-			[]string{"cid-target"},
-		)
-		if !errors.Is(err, context.Canceled) {
-			t.Fatalf("error = %v, want context canceled", err)
-		}
-		if caller.searchCalls != 1 {
-			t.Fatalf("search calls = %d, want 1", caller.searchCalls)
-		}
-	})
-
-	t.Run("lower search error", func(t *testing.T) {
-		caller := &chatMessageSearchCaller{searchError: errors.New("search unavailable")}
-		_, err := executeNativeScopedSearch(t, caller,
-			"message", "search-advanced", "--query", "周报", "--conversation-ids", "cid-target")
-		if err == nil {
-			t.Fatal("lower search error was ignored")
-		}
-	})
-
-	t.Run("stalled cursor fails closed", func(t *testing.T) {
-		caller := &chatMessageSearchCaller{searchResponse: `{
-			"result": {
-				"messages": [{"openMessageId":"m1","openConversationId":"cid-target"}],
-				"hasMore": true
-			}
-		}`}
-		_, err := executeNativeScopedSearch(t, caller,
-			"message", "search-advanced", "--query", "周报", "--conversation-ids", "cid-target")
-		var typed *apperrors.Error
-		if !errors.As(err, &typed) || typed.Reason != "search_conversation_scope_cursor_stalled" {
-			t.Fatalf("error = %#v", err)
-		}
-	})
-
-	t.Run("result limit preserves continuation", func(t *testing.T) {
-		caller := &chatMessageSearchCaller{searchResponse: `{
-			"result": {
-				"messages": [{"openMessageId":"m1","openConversationId":"cid-target"}],
-				"hasMore": true,
-				"nextCursor": "c2"
-			}
-		}`}
-		payload, err := executeNativeScopedSearch(t, caller,
-			"message", "search-advanced", "--query", "周报", "--conversation-ids", "cid-target", "--limit", "1")
-		if err != nil {
-			t.Fatal(err)
-		}
-		result, _ := payload["result"].(map[string]any)
-		if result["complete"] != false || result["hasMore"] != true || result["nextCursor"] != "c2" {
-			t.Fatalf("result = %#v", result)
-		}
-	})
-
-	t.Run("duplicate message ids are removed across pages", func(t *testing.T) {
-		caller := &chatMessageSearchCaller{searchResponses: []string{
-			`{"result":{"messages":[{"openMessageId":"m1","openConversationId":"cid-target"}],"hasMore":true,"nextCursor":"c2"}}`,
-			`{"result":{"messages":[{"openMessageId":"m1","openConversationId":"cid-target"},{"openMessageId":"m2","openConversationId":"cid-target"}],"hasMore":false}}`,
-		}}
-		payload, err := executeNativeScopedSearch(t, caller,
-			"message", "search-advanced", "--query", "周报", "--conversation-ids", "cid-target")
-		if err != nil {
-			t.Fatal(err)
-		}
-		result, _ := payload["result"].(map[string]any)
-		groups, _ := result["conversationMessagesList"].([]any)
-		group, _ := groups[0].(map[string]any)
-		messages, _ := group["messages"].([]any)
-		if len(messages) != 2 {
-			t.Fatalf("deduplicated messages = %#v", messages)
-		}
-	})
-
-	if got := uniqueNonEmptyStrings([]string{" cid ", "", "cid"}); !reflect.DeepEqual(got, []string{"cid"}) {
-		t.Fatalf("uniqueNonEmptyStrings = %#v", got)
-	}
-	for _, test := range []struct {
-		value any
-		want  int
-	}{
-		{value: int64(7), want: 7},
-		{value: json.Number("8"), want: 8},
-		{value: float64(9), want: 9},
-		{value: int64(0), want: 11},
-	} {
-		if got := positiveSearchLimit(test.value, 11); got != test.want {
-			t.Errorf("positiveSearchLimit(%#v) = %d, want %d", test.value, got, test.want)
-		}
-	}
-	if cleanSearchCursor(nil) != "" || cleanSearchCursor(" null ") != "" || cleanSearchCursor(" c2 ") != "c2" {
-		t.Fatal("cleanSearchCursor did not normalize sentinel values")
-	}
-}
-
-func TestCrossPlatformCoverageNativeScopedSearchDryRunShowsCompositePlanWithoutCallingTools(t *testing.T) {
-	caller := &chatMessageSearchCaller{}
-	previousDeps := deps
-	t.Cleanup(func() { deps = previousDeps })
-	InitDeps(caller)
-	cmd := &cobra.Command{Use: "search"}
-	cmd.Flags().Bool("dry-run", true, "")
-	AddPagedMCPFlags(cmd)
-	for name, value := range map[string]string{
-		"page-all":   "true",
-		"page-limit": "7",
-		"max-items":  "9",
-		"page-delay": "11",
-	} {
-		if err := cmd.Flags().Set(name, value); err != nil {
-			t.Fatalf("set --%s: %v", name, err)
-		}
-	}
-	var output strings.Builder
-	cmd.SetOut(&output)
-	err := runConversationScopedMessageSearch(
-		cmd,
-		"im",
-		"search_messages",
-		"openConversationIds",
-		map[string]any{
-			"keyword":             "周报",
-			"openConversationIds": []string{"cid-target"},
-			"limit":               100,
-			"cursor":              "0",
-		},
-		[]string{"cid-target"},
-	)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(caller.calls) != 0 {
-		t.Fatalf("dry-run made calls: %#v", caller.calls)
-	}
-	var payload map[string]any
-	if err := json.Unmarshal([]byte(output.String()), &payload); err != nil {
-		t.Fatal(err)
-	}
-	plan, _ := payload["plan"].([]any)
-	if payload["dry_run"] != true || payload["executed"] != false || len(plan) != 3 {
-		t.Fatalf("payload = %#v", payload)
-	}
-	searchStage, _ := plan[1].(map[string]any)
-	arguments, _ := searchStage["arguments"].(map[string]any)
-	if _, exists := arguments["openConversationIds"]; exists {
-		t.Fatalf("dry-run global search still carries scope: %#v", searchStage)
-	}
-	if searchStage["pageAll"] != true ||
-		searchStage["pageLimit"] != float64(7) ||
-		searchStage["maxItems"] != float64(9) ||
-		searchStage["pageDelay"] != float64(11) {
-		t.Fatalf("dry-run paging = %#v", searchStage)
-	}
-}
-
 type chatChangedContractCaller struct {
 	calls        []chatMessageSearchCall
 	resolveUsers bool
@@ -701,12 +160,9 @@ func executeChatChangedContract(t *testing.T, caller *chatChangedContractCaller,
 	InitDeps(caller)
 	deps.Out.w = io.Discard
 	cmd := newChatCommand()
-	if cmd.PersistentFlags().Lookup("yes") == nil {
-		cmd.PersistentFlags().Bool("yes", false, "skip confirmation")
-	}
 	cmd.SilenceErrors = true
 	cmd.SilenceUsage = true
-	cmd.SetArgs(append(append([]string(nil), args...), "--yes"))
+	cmd.SetArgs(args)
 	return cmd.Execute()
 }

@@ -1,123 +0,0 @@
-// Copyright 2026 Alibaba Group
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-// http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package helpers
-
-import (
-	"encoding/json"
-	"errors"
-	"fmt"
-	"strings"
-
-	apperrors "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/errors"
-)
-
-// NormalizeSearchConversationScopeError maps only errors that prove the
-// requested conversation does not exist or that openConversationId itself is
-// invalid. Unknown MCP tool failures must remain unchanged: the legacy
-// CodeMCPToolError bucket also carries permission, throttling, and transient
-// backend failures, none of which proves that the caller supplied a bad CID.
-func NormalizeSearchConversationScopeError(conversationID string, err error) error {
-	if err == nil || !isDefinitiveInvalidSearchConversationError(err) {
-		return err
-	}
-	return apperrors.NewValidation(
-		fmt.Sprintf("无法验证会话 CID %q；已停止搜索，避免过滤失效后返回其他会话消息", conversationID),
-		apperrors.WithReason("search_conversation_scope_invalid"),
-		apperrors.WithDetails(map[string]any{"conversationId": conversationID}),
-		apperrors.WithRetryable(false),
-		apperrors.WithHint("确认 openConversationId 存在且当前账号可访问后重试"),
-		apperrors.WithCause(err),
-	)
-}
-
-func isDefinitiveInvalidSearchConversationError(err error) bool {
-	var cliErr *CLIError
-	if errors.As(err, &cliErr) {
-		switch cliErr.Code {
-		case CodeResourceNotFound, CodeInvalidParam:
-			return true
-		}
-		code, message := searchConversationErrorFacts(cliErr.Message)
-		if isExplicitInvalidConversationCode(code) || isConversationParameterError(code, message) {
-			return true
-		}
-	}
-
-	// Transport errors can survive below a legacy CLIError in the cause chain.
-	// Inspect their structured diagnostics, but require conversation-specific
-	// evidence before treating a generic PARAM_ERROR as an invalid CID.
-	var appErr *apperrors.Error
-	if errors.As(err, &appErr) {
-		code := strings.TrimSpace(appErr.ServerDiag.ServerErrorCode)
-		message := strings.Join([]string{
-			appErr.Message,
-			appErr.ServerDiag.TechnicalDetail,
-			appErr.Reason,
-			appErr.FailureStage,
-		}, " ")
-		return isExplicitInvalidConversationCode(code) || isConversationParameterError(code, message)
-	}
-	return false
-}
-
-func searchConversationErrorFacts(raw string) (string, string) {
-	var body map[string]any
-	if json.Unmarshal([]byte(raw), &body) != nil {
-		return "", raw
-	}
-	code := firstSearchConversationErrorString(body, "errorCode", "error_code", "code")
-	message := firstSearchConversationErrorString(body, "errorMsg", "error_msg", "message", "error")
-	return code, message
-}
-
-func firstSearchConversationErrorString(body map[string]any, keys ...string) string {
-	for _, key := range keys {
-		if value, ok := body[key].(string); ok && strings.TrimSpace(value) != "" {
-			return strings.TrimSpace(value)
-		}
-	}
-	return ""
-}
-
-func isExplicitInvalidConversationCode(code string) bool {
-	switch strings.ToUpper(strings.TrimSpace(code)) {
-	case "INVALID_OPEN_CONVERSATION_ID", "OPEN_CONVERSATION_NOT_FOUND", "CONVERSATION_NOT_FOUND":
-		return true
-	default:
-		return false
-	}
-}
-
-func isConversationParameterError(code, message string) bool {
-	normalizedCode := strings.ToUpper(strings.TrimSpace(code))
-	if normalizedCode != "PARAM_ERROR" && normalizedCode != "PARAMETER_ERROR" && normalizedCode != "INVALID_ARGUMENT" {
-		return false
-	}
-	normalizedMessage := strings.ToLower(strings.TrimSpace(message))
-	mentionsConversationID := strings.Contains(normalizedMessage, "openconversationid") ||
-		strings.Contains(normalizedMessage, "open conversation id") ||
-		strings.Contains(normalizedMessage, "conversation id") ||
-		strings.Contains(normalizedMessage, "cid")
-	if !mentionsConversationID {
-		return false
-	}
-	for _, marker := range []string{
-		"invalid", "illegal", "malformed", "required", "missing", "not found", "不存在", "无效", "非法", "缺少", "必填",
-	} {
-		if strings.Contains(normalizedMessage, marker) {
-			return true
-		}
-	}
-	return false
-}
@@ -1,123 +0,0 @@
-// Copyright 2026 Alibaba Group
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-// http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package helpers
-
-import (
-	"errors"
-	"testing"
-
-	apperrors "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/errors"
-)
-
-func TestCrossPlatformCoverageNormalizeSearchConversationScopeError(t *testing.T) {
-	if got := NormalizeSearchConversationScopeError("cid", nil); got != nil {
-		t.Fatalf("nil error normalized to %#v", got)
-	}
-
-	invalidCases := []struct {
-		name string
-		err  error
-	}{
-		{
-			name: "classified resource not found",
-			err:  &CLIError{Code: CodeResourceNotFound, Message: "conversation not found"},
-		},
-		{
-			name: "explicit conversation error code",
-			err: &CLIError{
-				Code:    CodeMCPToolError,
-				Message: `{"success":false,"errorCode":"INVALID_OPEN_CONVERSATION_ID","errorMsg":"invalid conversation"}`,
-			},
-		},
-		{
-			name: "conversation specific parameter error",
-			err: &CLIError{
-				Code:    CodeMCPToolError,
-				Message: `{"success":false,"errorCode":"PARAM_ERROR","errorMsg":"openConversationId is invalid"}`,
-			},
-		},
-		{
-			name: "transport diagnostic proves invalid conversation",
-			err: apperrors.NewAPI(
-				"conversation validation failed",
-				apperrors.WithServerDiag(apperrors.ServerDiagnostics{
-					ServerErrorCode: "INVALID_OPEN_CONVERSATION_ID",
-				}),
-			),
-		},
-	}
-	for _, test := range invalidCases {
-		t.Run(test.name, func(t *testing.T) {
-			got := NormalizeSearchConversationScopeError("cid-invalid", test.err)
-			var typed *apperrors.Error
-			if !errors.As(got, &typed) || typed.Reason != "search_conversation_scope_invalid" {
-				t.Fatalf("normalized error = %#v", got)
-			}
-			if !typed.RetryableSet || typed.Retryable {
-				t.Fatalf("retryable = (%t, set=%t), want false and set", typed.Retryable, typed.RetryableSet)
-			}
-			if typed.Details["conversationId"] != "cid-invalid" || !errors.Is(got, test.err) {
-				t.Fatalf("normalized error lost details or cause: %#v", typed)
-			}
-		})
-	}
-
-	preservedCases := []struct {
-		name string
-		err  error
-	}{
-		{
-			name: "rate limit",
-			err: &CLIError{
-				Code:    CodeMCPToolError,
-				Message: `{"success":false,"errorCode":"invalidRequest.rateLimited","errorMsg":"slow down","retryable":true}`,
-			},
-		},
-		{
-			name: "permission denied",
-			err: &CLIError{
-				Code:    CodeMCPToolError,
-				Message: `{"success":false,"errorCode":"forbidden.noPermission","errorMsg":"permission denied"}`,
-			},
-		},
-		{
-			name: "generic parameter error without CID evidence",
-			err: &CLIError{
-				Code:    CodeMCPToolError,
-				Message: `{"success":false,"errorCode":"PARAM_ERROR","errorMsg":"未找到指定工具"}`,
-			},
-		},
-		{
-			name: "structured error without recognized facts",
-			err: &CLIError{
-				Code:    CodeMCPToolError,
-				Message: `{"success":false,"retryable":true}`,
-			},
-		},
-		{
-			name: "parameter error mentions CID without invalid evidence",
-			err: &CLIError{
-				Code:    CodeMCPToolError,
-				Message: `{"success":false,"errorCode":"PARAM_ERROR","errorMsg":"openConversationId could not be processed"}`,
-			},
-		},
-	}
-	for _, test := range preservedCases {
-		t.Run(test.name, func(t *testing.T) {
-			if got := NormalizeSearchConversationScopeError("cid-target", test.err); got != test.err {
-				t.Fatalf("error = %#v, want original %#v", got, test.err)
-			}
-		})
-	}
-}
@@ -101,7 +101,7 @@ func TestCrossPlatformCoverageChatMessageSendLocation(t *testing.T) {
 	caller = &guardedMutationCaller{}
 	err = executeGuardedMutationCommand(t, caller, newChatCommand,
 		"message", "send", "--group", "cid1", "--msg-type", "location",
-		"--latitude", "39.9", "--longitude", "116.4", "--location-name", "国贸", "--map-thumbnail-url", "@media1", "--yes")
+		"--latitude", "39.9", "--longitude", "116.4", "--location-name", "国贸", "--map-thumbnail-url", "@media1")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -128,7 +128,7 @@ func TestCrossPlatformCoverageChatMessageSendProfile(t *testing.T) {

 	caller = &guardedMutationCaller{}
 	err = executeGuardedMutationCommand(t, caller, newChatCommand,
-		"message", "send", "--group", "cid1", "--msg-type", "profile", "--contact-id", "od123", "--yes")
+		"message", "send", "--group", "cid1", "--msg-type", "profile", "--contact-id", "od123")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -94,7 +94,7 @@ func newDevAppCommand(runner executor.Runner) *cobra.Command {
 				"请求涉及企业内部应用的查询、创建、配置、成员权限、机器人、事件订阅或版本管理",
 			},
 			AvoidWhen: []string{
-				"个人 IM/OA 实时事件监听使用 event；开放平台接口文档搜索使用 devdoc；普通钉钉业务数据使用对应产品命令",
+				"开放平台接口文档搜索使用 devdoc；普通钉钉业务数据使用对应产品命令",
 			},
 		},
 	})
@@ -293,7 +293,7 @@ func newDevAppEventListCommand(runner executor.Runner) *cobra.Command {
 			Selection: contract.SelectionSpec{
 				AgentSummary: "列出或搜索应用可订阅的事件",
 				UseWhen:      []string{"需要查事件码、事件名称或当前事件列表时"},
-				AvoidWhen:    []string{"订阅或退订应用回调事件使用对应写命令；监听当前用户个人 IM/OA 事件使用 event"},
+				AvoidWhen:    []string{"订阅或退订事件使用对应写命令"},
 				Examples:     []string{`dws dev app event list --unified-app-id <unifiedAppId> --keyword "审批" --page-size 20`},
 			},
 		},
@@ -329,7 +329,7 @@ func newDevAppEventSubscribeCommand(runner executor.Runner) *cobra.Command {
 			Selection: contract.SelectionSpec{
 				AgentSummary: "为应用订阅指定事件码",
 				UseWhen:      []string{"已确认事件码并需要新增事件订阅时"},
-				AvoidWhen:    []string{"查询事件码或已有订阅时先使用 dev app event list；个人 IM/OA 事件长连接监听使用 event"},
+				AvoidWhen:    []string{"查询事件码或已有订阅时先使用 dev app event list"},
 				Examples:     []string{"dws dev app event subscribe --unified-app-id <unifiedAppId> --event-codes bpms_task_change --dry-run"},
 			},
 		},
@@ -365,7 +365,7 @@ func newDevAppEventUnsubscribeCommand(runner executor.Runner) *cobra.Command {
 			Selection: contract.SelectionSpec{
 				AgentSummary: "取消应用的指定事件订阅",
 				UseWhen:      []string{"需要停止接收一个或多个已订阅事件时"},
-				AvoidWhen:    []string{"只是查看应用事件订阅时使用 dev app event list；停止个人事件监听使用 event stop"},
+				AvoidWhen:    []string{"只是查看事件订阅时使用 dev app event list"},
 				Examples:     []string{"dws dev app event unsubscribe --unified-app-id <unifiedAppId> --event-codes bpms_task_change --dry-run"},
 			},
 		},
@@ -532,23 +532,16 @@ func runMediaInsert(cmd *cobra.Command, _ []string) error {
 	fileSize := fileInfo.Size()

 	if deps.Caller.DryRun() {
-		return deps.Out.PrintJSON(map[string]any{
-			"contractVersion": "doc.operation.v1",
-			"dry_run":         true,
-			"preview_kind":    "plan",
-			"ok":              true,
-			"status":          "success",
-			"complete":        true,
-			"operation":       "doc.media_insert",
-			"data": map[string]any{
-				"executed": false, "nodeId": nodeID, "file": filePath,
-				"fileName": fileName, "mimeType": mimeType, "sizeBytes": fileSize,
-			},
-			"steps": []map[string]any{{"name": "validate_local_file", "status": "success"}},
-		})
+		deps.Out.PrintKeyValue("操作", "上传附件并插入文档")
+		deps.Out.PrintKeyValue("文档", nodeID)
+		deps.Out.PrintKeyValue("文件", filePath)
+		deps.Out.PrintKeyValue("名称", fileName)
+		deps.Out.PrintKeyValue("类型", mimeType)
+		deps.Out.PrintKeyValue("大小", fmt.Sprintf("%d bytes", fileSize))
+		return nil
 	}

-	ctx := cmd.Context()
+	ctx := context.Background()

 	// Step 1: get upload credentials (uploadUrl + resourceId)
 	deps.Out.PrintInfo(fmt.Sprintf("[1/3] 获取附件上传凭证 (%s, %d bytes)...", fileName, fileSize))
@@ -575,20 +568,7 @@ func runMediaInsert(cmd *cobra.Command, _ []string) error {
 		"Content-Type": mimeType,
 	}
 	if err := httpPutFile(ctx, uploadURL, ossHeaders, filePath, fileSize); err != nil {
-		return apperrors.NewAPI(
-			"附件上传结果未知；尚未确认正文 block 已插入，请先检查文档媒体列表，禁止改用手写 HTTP",
-			apperrors.WithOperation("doc.media_insert"),
-			apperrors.WithReason("doc_media_upload_unknown"),
-			apperrors.WithFailureStage("upload_oss"),
-			apperrors.WithExecutionStarted(true),
-			apperrors.WithRetryable(false),
-			apperrors.WithActions("运行 dws doc +media-list 检查当前文档", "确认没有对应媒体后才重新执行 +media-insert", "不要 curl 上传地址或安装本地依赖"),
-			apperrors.WithDetails(map[string]any{
-				"contractVersion": "doc.operation.v1", "status": "unknown", "nodeId": nodeID,
-				"resourceId": resourceID, "fileName": fileName, "stage": "upload_oss",
-			}),
-			apperrors.WithCause(err),
-		)
+		return err
 	}

 	// Step 3: insert block into document
@@ -645,43 +625,15 @@ func runMediaInsert(cmd *cobra.Command, _ []string) error {
 	}

 	if err := callMCPTool("insert_document_block", insertArgs); err != nil {
-		return apperrors.NewAPI(
-			"附件已上传，但正文 block 插入结果未知；请先检查媒体列表，不要重复上传或插入",
-			apperrors.WithOperation("doc.media_insert"),
-			apperrors.WithReason("doc_media_insert_partial"),
-			apperrors.WithFailureStage("insert_block"),
-			apperrors.WithExecutionStarted(true),
-			apperrors.WithRetryable(false),
-			apperrors.WithActions("运行 dws doc +media-list 检查 resourceId/blockId", "不要直接重试 +media-insert，不要使用 resourceUrl 手写请求"),
-			apperrors.WithDetails(map[string]any{
-				"contractVersion": "doc.operation.v1", "status": "partial_success", "nodeId": nodeID,
-				"resourceId": resourceID, "resourceUrl": resourceURL, "fileName": fileName,
-				"steps": []map[string]any{
-					{"name": "resolve_upload", "status": "success"},
-					{"name": "upload_oss", "status": "success"},
-					{"name": "insert_block", "status": "unknown"},
-				},
-			}),
-			apperrors.WithCause(err),
-		)
+		return err
 	}

-	return deps.Out.PrintJSON(map[string]any{
-		"contractVersion": "doc.operation.v1",
-		"ok":              true,
-		"status":          "success",
-		"complete":        true,
-		"operation":       "doc.media_insert",
-		"data": map[string]any{
-			"nodeId": nodeID, "resourceId": resourceID, "resourceUrl": resourceURL,
-			"fileName": fileName, "mimeType": mimeType, "sizeBytes": fileSize, "inserted": true,
-		},
-		"steps": []map[string]any{
-			{"name": "resolve_upload", "status": "success"},
-			{"name": "upload_oss", "status": "success"},
-			{"name": "insert_block", "status": "success"},
-		},
-	})
+	if strings.HasPrefix(mimeType, "image/") {
+		deps.Out.PrintInfo(fmt.Sprintf("图片已插入文档: %s (resourceUrl=%s)", fileName, resourceURL))
+	} else {
+		deps.Out.PrintInfo(fmt.Sprintf("附件已插入文档: %s (resourceId=%s)", fileName, resourceID))
+	}
+	return nil
 }

 // parseAttachmentUploadInfo extracts uploadUrl, resourceId and resourceUrl from the MCP tool response.
@@ -3668,17 +3620,6 @@ CLI 内部自动完成全部流程：
 			}

 			if deps.Caller.DryRun() {
-				if strings.EqualFold(strings.TrimSpace(deps.Caller.Format()), "json") {
-					return deps.Out.PrintJSON(map[string]any{
-						"dry_run":      true,
-						"executed":     false,
-						"preview_kind": "plan",
-						"operation":    "doc_export",
-						"nodeId":       node,
-						"exportFormat": format,
-						"savedPath":    outputPath,
-					})
-				}
 				deps.Out.PrintKeyValue("操作", "导出文档（提交+轮询+下载）")
 				deps.Out.PrintKeyValue("文档", node)
 				deps.Out.PrintKeyValue("输出", outputPath)
@@ -3689,7 +3630,7 @@ CLI 内部自动完成全部流程：
 			ctx := context.Background()

 			// ── Step 1: 提交导出任务 ──
-			printJSONSafeInfo("[1/3] 提交导出任务...")
+			deps.Out.PrintInfo("[1/3] 提交导出任务...")
 			submitText, err := callMCPToolReturnText(ctx, "submit_export_job", submitArgs)
 			if err != nil {
 				return fmt.Errorf("提交导出任务失败: %w", err)
@@ -3704,10 +3645,10 @@ CLI 内部自动完成全部流程：
 				deps.Out.PrintRaw(submitText)
 				return fmt.Errorf("提交导出任务成功但未返回 jobId")
 			}
-			printJSONSafeInfo(fmt.Sprintf("    任务已提交，jobId: %s", jobID))
+			deps.Out.PrintInfo(fmt.Sprintf("    任务已提交，jobId: %s", jobID))

 			// ── Step 2: 渐进式退避轮询 ──
-			printJSONSafeInfo("[2/3] 等待导出完成...")
+			deps.Out.PrintInfo("[2/3] 等待导出完成...")
 			downloadURL, err := pollDocExportJob(ctx, jobID)
 			if err != nil {
 				return err
@@ -3726,28 +3667,11 @@ CLI 内部自动完成全部流程：
 				outputPath = filepath.Join(outputPath, filename)
 			}

-			printJSONSafeInfo(fmt.Sprintf("[3/3] 下载文件到 %s ...", outputPath))
+			deps.Out.PrintInfo(fmt.Sprintf("[3/3] 下载文件到 %s ...", outputPath))
 			if err := httpGetFile(ctx, downloadURL, nil, outputPath); err != nil {
 				return fmt.Errorf("文件下载失败 (jobId=%s): %w", jobID, err)
 			}

-			if strings.EqualFold(strings.TrimSpace(deps.Caller.Format()), "json") {
-				info, err := os.Stat(outputPath)
-				if err != nil {
-					return fmt.Errorf("读取导出产物信息失败 (jobId=%s): %w", jobID, err)
-				}
-				return deps.Out.PrintJSON(map[string]any{
-					"success":      true,
-					"nodeId":       node,
-					"exportFormat": format,
-					"jobId":        jobID,
-					"taskId":       jobID,
-					"status":       "SUCCESS",
-					"savedPath":    outputPath,
-					"sizeBytes":    info.Size(),
-				})
-			}
-
 			deps.Out.PrintInfo(fmt.Sprintf("导出完成: %s", outputPath))
 			return nil
 		},
@@ -3907,8 +3831,8 @@ CLI 内部自动完成全部流程:
 		},
 	}
 	importCmd.Flags().String("file", "", "本地文件路径 (必填)")
-	importCmd.Flags().String("folder", "", "目标文件夹 ID 或 URL (可选；folder/workspace 都不传时导入到默认根目录)")
-	importCmd.Flags().String("workspace", "", "目标知识库 ID 或 URL (可选；folder/workspace 都不传时导入到默认根目录)")
+	importCmd.Flags().String("folder", "", "目标文件夹 ID 或 URL (可选，与 --workspace 至少传一个)")
+	importCmd.Flags().String("workspace", "", "目标知识库 ID 或 URL (可选，与 --folder 至少传一个)")
 	importCmd.Flags().StringP("name", "n", "", "导入后文档名称 (可选，默认取文件名)")
 	importCmd.Flags().String("folder-id", "", "")
 	_ = importCmd.Flags().MarkHidden("folder-id")
@@ -4685,7 +4609,7 @@ func pollDocExportJob(ctx context.Context, jobID string) (downloadURL string, er

 	for attempt := 1; attempt <= maxPolls; attempt++ {
 		interval := pollInterval(attempt)
-		printJSONSafeInfo(fmt.Sprintf("    第 %d/%d 次查询，等待 %v ...", attempt, maxPolls, interval))
+		deps.Out.PrintInfo(fmt.Sprintf("    第 %d/%d 次查询，等待 %v ...", attempt, maxPolls, interval))

 		select {
 		case <-ctx.Done():
@@ -9,7 +9,6 @@ import (
 	"syscall"
 	"unicode/utf8"

-	apperrors "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/errors"
 	"github.com/spf13/cobra"
 )

@@ -18,6 +17,9 @@ const (
 	// Server-side OSS delta resolution is now fixed, so large chunks are safe.
 	initialChunkSize = 10000

+	// minChunkSize is the floor; below this we report an error instead of retrying.
+	minChunkSize = 5000
+
 	// longContentWarningThreshold triggers a hint to use --content-file.
 	longContentWarningThreshold = 2048
 )
@@ -93,11 +95,10 @@ func docWritePipeline(cmd *cobra.Command, toolName string, toolArgs map[string]a
 		// Single write path
 		nodeID, lastResponse, writeErr = singleWrite(ctx, toolName, toolArgs)
 		chunksWritten = 1
-		if writeErr != nil && isTimeoutError(writeErr.Error()) {
-			// The server may have committed the write before the client observed the
-			// timeout. Replaying create/append here can duplicate a document or
-			// content, so fail closed and require inspection before any retry.
-			writeErr = docWriteUnknownStateError(operation, nodeID, "single_write", 0, 1, writeErr)
+		if writeErr != nil && isTimeoutError(writeErr.Error()) && runeCount > minChunkSize {
+			// Timeout on single write — fallback to chunked with halved size
+			deps.Out.PrintInfo("[INFO] 单次写入超时，自动切换为分片写入...")
+			nodeID, chunksWritten, lastResponse, writeErr = chunkedWrite(ctx, toolName, toolArgs, markdown, operation, initialChunkSize/2)
 		}
 	} else {
 		// Chunked write path
@@ -155,9 +156,6 @@ func chunkedWrite(ctx context.Context, toolName string, toolArgs map[string]any,
 			len(chunks), utf8.RuneCountInString(chunks[0])))
 		resultText, err := callMCPToolReturnText(ctx, "create_document", createArgs)
 		if err != nil {
-			if isTimeoutError(err.Error()) {
-				return "", 0, resultText, docWriteUnknownStateError(operation, "", "chunk_1", 0, len(chunks), err)
-			}
 			return "", 0, resultText, fmt.Errorf("创建文档失败: %w", err)
 		}
 		nodeID = extractNodeIDFromResult(resultText)
@@ -183,9 +181,6 @@ func chunkedWrite(ctx context.Context, toolName string, toolArgs map[string]any,
 			len(chunks), utf8.RuneCountInString(chunks[0]), firstMode))
 		resultText, err := callMCPToolReturnText(ctx, "update_document", updateArgs)
 		if err != nil {
-			if isTimeoutError(err.Error()) {
-				return nodeID, 0, resultText, docWriteUnknownStateError(operation, nodeID, "chunk_1", 0, len(chunks), err)
-			}
 			return nodeID, 0, resultText, fmt.Errorf("第 1 片写入失败: %w", err)
 		}
 		lastResponse = resultText
@@ -214,9 +209,29 @@ func chunkedWrite(ctx context.Context, toolName string, toolArgs map[string]any,
 		resultText, err := callMCPToolReturnText(ctx, "update_document", updateArgs)
 		if err != nil {
 			if isTimeoutError(err.Error()) {
-				return nodeID, writtenCount, resultText, docWriteUnknownStateError(
-					operation, nodeID, fmt.Sprintf("chunk_%d", i+1), writtenCount, len(chunks), err,
-				)
+				newSize := chunkSize / 2
+				if newSize < minChunkSize {
+					return nodeID, writtenCount, resultText, &CLIError{
+						Code: CodeContentTruncated,
+						Message: fmt.Sprintf("分片写入持续超时，已写入 %d 片。当前分片大小 %d 字符已低于最小阈值 %d",
+							writtenCount, chunkSize, minChunkSize),
+						Suggestion: fmt.Sprintf("后端写入超时无法恢复。已成功写入部分内容到 nodeId=%s，请使用 dws doc read --node %s 查看已写入部分",
+							nodeID, nodeID),
+						Operation: operation,
+					}
+				}
+				deps.Out.PrintInfo(fmt.Sprintf("[INFO] 写入超时，分片大小减半为 %d 字符后重试...", newSize))
+				chunkSize = newSize
+
+				var remaining strings.Builder
+				remaining.WriteString(chunk)
+				for j := i + 1; j < len(chunks); j++ {
+					remaining.WriteString(chunks[j])
+				}
+				newChunks := splitMarkdownSafe(remaining.String(), chunkSize)
+				chunks = append(chunks[:i], newChunks...)
+				i-- // retry current index
+				continue
 			}
 			return nodeID, writtenCount, resultText, fmt.Errorf("分片 %d 写入失败: %w", writtenCount+1, err)
 		}
@@ -228,27 +243,6 @@ func chunkedWrite(ctx context.Context, toolName string, toolArgs map[string]any,
 	return nodeID, writtenCount, lastResponse, nil
 }

-func docWriteUnknownStateError(operation, nodeID, stage string, written, total int, cause error) error {
-	details := map[string]any{
-		"status":        "unknown",
-		"nodeId":        nodeID,
-		"chunksWritten": written,
-		"chunksTotal":   total,
-		"failedStage":   stage,
-	}
-	return apperrors.NewAPI(
-		"文档写入响应超时，服务端提交状态未知；为避免重复创建或重复追加，已停止自动重试",
-		apperrors.WithOperation(operation),
-		apperrors.WithReason("doc_write_commit_unknown"),
-		apperrors.WithFailureStage(stage),
-		apperrors.WithExecutionStarted(true),
-		apperrors.WithRetryable(false),
-		apperrors.WithActions("先读取目标文档确认实际写入状态", "仅在确认服务端未提交后重新执行"),
-		apperrors.WithDetails(details),
-		apperrors.WithCause(cause),
-	)
-}
-
 // isTimeoutError checks if an error message indicates a server-side timeout.
 func isTimeoutError(msg string) bool {
 	lower := strings.ToLower(msg)
@@ -7,7 +7,6 @@ import (
 	"strings"
 	"testing"

-	apperrors "github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/errors"
 	"github.com/spf13/cobra"
 )

@@ -41,12 +40,10 @@ func TestCrossPlatformCoverageDocWritePipelineStrategyRemainingCoverage(t *testi
 		t.Fatalf("long literal single write: %v", err)
 	}

-	fallback := strings.Repeat("x", 5100)
-	timeoutCaller := &scriptedToolCaller{steps: []scriptedToolStep{{err: errors.New("timeout")}, {text: `{}`}}}
-	installScriptedCaller(t, timeoutCaller)
-	err := docWritePipeline(docWriteCoverageCommand(), "update_document", map[string]any{"nodeId": "node", "mode": "overwrite", "markdown": fallback}, fallback, "update")
-	if err == nil || !strings.Contains(err.Error(), "提交状态未知") || timeoutCaller.calls != 1 {
-		t.Fatalf("single timeout must stop without replay: err=%v calls=%d", err, timeoutCaller.calls)
+	fallback := strings.Repeat("x", minChunkSize+100)
+	installScriptedCaller(t, &scriptedToolCaller{steps: []scriptedToolStep{{err: errors.New("timeout")}, {text: `{}`}, {text: `{}`}}})
+	if err := docWritePipeline(docWriteCoverageCommand(), "update_document", map[string]any{"nodeId": "node", "mode": "overwrite", "markdown": fallback}, fallback, "update"); err != nil {
+		t.Fatalf("single timeout fallback: %v", err)
 	}

 	chunked := strings.Repeat("x", initialChunkSize+100)
@@ -61,43 +58,9 @@ func TestCrossPlatformCoverageChunkedWriteAdaptiveRetryRemainingCoverage(t *test
 	os.Args = []string{"dws", "doc"}
 	t.Cleanup(func() { os.Args = oldArgs })
 	markdown := strings.Repeat("x", 24000)
-	caller := &scriptedToolCaller{steps: []scriptedToolStep{{text: `{}`}, {err: errors.New("HSFTimeoutException")}, {text: `{}`}}}
-	installScriptedCaller(t, caller)
+	installScriptedCaller(t, &scriptedToolCaller{steps: []scriptedToolStep{{text: `{}`}, {err: errors.New("HSFTimeoutException")}, {text: `{}`}}})
 	_, written, _, err := chunkedWrite(context.Background(), "update_document", map[string]any{"nodeId": "node"}, markdown, "update", 10000)
-	if err == nil || written != 1 || caller.calls != 2 || !strings.Contains(err.Error(), "提交状态未知") {
-		t.Fatalf("timeout must stop without replay: written=%d calls=%d err=%v", written, caller.calls, err)
-	}
-}
-
-func TestCrossPlatformCoverageDocWriteFirstChunkTimeoutIsUnknown(t *testing.T) {
-	oldArgs := os.Args
-	os.Args = []string{"dws", "doc"}
-	t.Cleanup(func() { os.Args = oldArgs })
-	markdown := strings.Repeat("x", 24000)
-	tests := []struct {
-		name     string
-		tool     string
-		args     map[string]any
-		wantNode string
-	}{
-		{name: "create", tool: "create_document", args: map[string]any{"name": "doc"}},
-		{name: "update", tool: "update_document", args: map[string]any{"nodeId": "node", "mode": "overwrite"}, wantNode: "node"},
-	}
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			caller := &scriptedToolCaller{steps: []scriptedToolStep{{err: errors.New("HSFTimeoutException")}, {text: `{}`}}}
-			installScriptedCaller(t, caller)
-			nodeID, written, _, err := chunkedWrite(context.Background(), tc.tool, tc.args, markdown, tc.name, 10000)
-			var typed *apperrors.Error
-			if err == nil || !errors.As(err, &typed) {
-				t.Fatalf("error = %#v", err)
-			}
-			if nodeID != tc.wantNode || written != 0 || caller.calls != 1 {
-				t.Fatalf("node=%q written=%d calls=%d", nodeID, written, caller.calls)
-			}
-			if typed.Reason != "doc_write_commit_unknown" || typed.FailureStage != "chunk_1" || typed.ExecutionStarted == nil || !*typed.ExecutionStarted || !typed.RetryableSet || typed.Retryable {
-				t.Fatalf("unknown commit metadata = %#v", typed)
-			}
-		})
+	if err != nil || written < 3 {
+		t.Fatalf("adaptive retry written=%d err=%v", written, err)
 	}
 }
@@ -619,20 +619,10 @@ func newDriveCommand() *cobra.Command {
 				return err
 			}
 			dlOpts.logf = func(format string, a ...any) {
-				printJSONSafeInfo(fmt.Sprintf(format, a...))
+				deps.Out.PrintInfo(fmt.Sprintf(format, a...))
 			}

 			if deps.Caller.DryRun() {
-				if strings.EqualFold(strings.TrimSpace(deps.Caller.Format()), "json") {
-					return deps.Out.PrintJSON(map[string]any{
-						"dry_run":      true,
-						"executed":     false,
-						"preview_kind": "plan",
-						"operation":    "drive_download",
-						"nodeId":       fileID,
-						"savedPath":    outputPath,
-					})
-				}
 				deps.Out.PrintKeyValue("操作", "下载钉盘文件")
 				deps.Out.PrintKeyValue("文件ID", fileID)
 				deps.Out.PrintKeyValue("输出", outputPath)
@@ -642,7 +632,7 @@ func newDriveCommand() *cobra.Command {
 			ctx := cmd.Context()

 			// Step 1: 获取下载 URL 和签名请求头
-			printJSONSafeInfo("[1/2] 获取下载链接...")
+			deps.Out.PrintInfo("[1/2] 获取下载链接...")
 			text, err := callMCPToolReturnText(ctx, "download_file", argsMap)
 			if err != nil {
 				return err
@@ -664,7 +654,7 @@ func newDriveCommand() *cobra.Command {
 			}

 			// Step 2: 分片下载（自动分派 + 401/403 凭证刷新重试）
-			printJSONSafeInfo(fmt.Sprintf("[2/2] 下载文件到 %s ...", outputPath))
+			deps.Out.PrintInfo(fmt.Sprintf("[2/2] 下载文件到 %s ...", outputPath))
 			dlOpts.knownSize = parseDownloadFileSize(text)
 			dlOpts.nodeID = fileID
 			dlOpts.version = parseDownloadFileVersion(text)
@@ -694,19 +684,6 @@ func newDriveCommand() *cobra.Command {
 				return err
 			}

-			if strings.EqualFold(strings.TrimSpace(deps.Caller.Format()), "json") {
-				info, err := os.Stat(outputPath)
-				if err != nil {
-					return fmt.Errorf("读取下载产物信息失败: %w", err)
-				}
-				return deps.Out.PrintJSON(map[string]any{
-					"success":   true,
-					"nodeId":    fileID,
-					"version":   dlOpts.version,
-					"savedPath": outputPath,
-					"sizeBytes": info.Size(),
-				})
-			}
 			deps.Out.PrintInfo(fmt.Sprintf("下载完成: %s", outputPath))
 			return nil
 		},
@@ -795,21 +772,10 @@ func newDriveCommand() *cobra.Command {
 				return err
 			}
 			dlOpts.logf = func(format string, a ...any) {
-				printJSONSafeInfo(fmt.Sprintf(format, a...))
+				deps.Out.PrintInfo(fmt.Sprintf(format, a...))
 			}

 			if deps.Caller.DryRun() {
-				if strings.EqualFold(strings.TrimSpace(deps.Caller.Format()), "json") {
-					return deps.Out.PrintJSON(map[string]any{
-						"dry_run":      true,
-						"executed":     false,
-						"preview_kind": "plan",
-						"operation":    "drive_download_version",
-						"nodeId":       fileID,
-						"version":      versionNum,
-						"savedPath":    outputPath,
-					})
-				}
 				deps.Out.PrintKeyValue("操作", "下载文件历史版本")
 				deps.Out.PrintKeyValue("节点ID", fileID)
 				deps.Out.PrintKeyValue("版本号", fmt.Sprintf("%d", versionNum))
@@ -818,7 +784,7 @@ func newDriveCommand() *cobra.Command {
 			}

 			ctx := cmd.Context()
-			printJSONSafeInfo("[1/2] 获取历史版本下载链接...")
+			deps.Out.PrintInfo("[1/2] 获取历史版本下载链接...")
 			dlArgsMap := map[string]any{
 				"nodeId":  fileID,
 				"version": versionNum,
@@ -838,7 +804,7 @@ func newDriveCommand() *cobra.Command {
 				}
 				outputPath = filepath.Join(outputPath, filename)
 			}
-			printJSONSafeInfo(fmt.Sprintf("[2/2] 下载文件到 %s ...", outputPath))
+			deps.Out.PrintInfo(fmt.Sprintf("[2/2] 下载文件到 %s ...", outputPath))
 			dlOpts.knownSize = parseDownloadFileSize(text)
 			dlOpts.nodeID = fileID
 			dlOpts.version = versionNum
@@ -867,19 +833,6 @@ func newDriveCommand() *cobra.Command {
 				}
 				return err
 			}
-			if strings.EqualFold(strings.TrimSpace(deps.Caller.Format()), "json") {
-				info, err := os.Stat(outputPath)
-				if err != nil {
-					return fmt.Errorf("读取下载产物信息失败: %w", err)
-				}
-				return deps.Out.PrintJSON(map[string]any{
-					"success":   true,
-					"nodeId":    fileID,
-					"version":   versionNum,
-					"savedPath": outputPath,
-					"sizeBytes": info.Size(),
-				})
-			}
 			deps.Out.PrintInfo(fmt.Sprintf("下载完成: %s", outputPath))
 			return nil
 		},
@@ -1,198 +0,0 @@
-// Copyright 2026 Alibaba Group
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package helpers
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/internal/testseam"
-	"github.com/spf13/cobra"
-)
-
-func executeJSONOutputContractCommand(t *testing.T, caller *scriptedToolCaller, build func() *cobra.Command, args ...string) (string, string, error) {
-	t.Helper()
-	testseam.Protect(t, &deps)
-	testseam.Protect(t, &os.Args)
-	InitDeps(caller)
-	var stdout, stderr bytes.Buffer
-	deps.Out.w = &stdout
-	deps.Out.errW = &stderr
-
-	root := build()
-	installExampleGlobalFlags(root)
-	os.Args = append([]string{"dws", root.Name()}, args...)
-	root.SilenceErrors = true
-	root.SilenceUsage = true
-	root.SetArgs(args)
-	if err := root.Execute(); err != nil {
-		return stdout.String(), stderr.String(), err
-	}
-	return stdout.String(), stderr.String(), nil
-}
-
-func assertJSONOutputPayload(t *testing.T, stdout string) map[string]any {
-	t.Helper()
-	var payload map[string]any
-	if err := json.Unmarshal([]byte(stdout), &payload); err != nil {
-		t.Fatalf("stdout is not JSON: %v\n%s", err, stdout)
-	}
-	return payload
-}
-
-func TestCrossPlatformCoverageJSONOutputContractForCompletedFileTransfers(t *testing.T) {
-	testseam.Swap(t, &httpGetFile, func(_ context.Context, _ string, _ map[string]string, destination string) error {
-		return os.WriteFile(destination, []byte("payload"), 0o600)
-	})
-
-	t.Run("drive latest download", func(t *testing.T) {
-		outputPath := filepath.Join(t.TempDir(), "latest.txt")
-		stdout, stderr, err := executeJSONOutputContractCommand(t,
-			&scriptedToolCaller{format: "json", steps: []scriptedToolStep{{text: `{"downloadUrl":"https://example.test/latest.txt","fileSize":7,"version":9}`}}},
-			newDriveCommand,
-			"download", "--node", "node-latest", "--output", outputPath)
-		if err != nil {
-			t.Fatal(err)
-		}
-		payload := assertJSONOutputPayload(t, stdout)
-		if payload["nodeId"] != "node-latest" || payload["savedPath"] != outputPath || payload["sizeBytes"] != float64(7) || payload["version"] != float64(9) {
-			t.Fatalf("payload = %#v", payload)
-		}
-		if !strings.Contains(stderr, "下载完成") && !strings.Contains(stderr, "下载文件到") {
-			t.Fatalf("expected progress on stderr, got %q", stderr)
-		}
-	})
-
-	t.Run("drive historical download through compatibility flag", func(t *testing.T) {
-		outputPath := filepath.Join(t.TempDir(), "versioned.txt")
-		stdout, _, err := executeJSONOutputContractCommand(t,
-			&scriptedToolCaller{format: "json", steps: []scriptedToolStep{{text: `{"downloadUrl":"https://example.test/versioned.txt","fileSize":7}`}}},
-			newDriveCommand,
-			"download", "--node", "node-versioned", "--version", "4", "--output", outputPath)
-		if err != nil {
-			t.Fatal(err)
-		}
-		payload := assertJSONOutputPayload(t, stdout)
-		if payload["nodeId"] != "node-versioned" || payload["version"] != float64(4) || payload["sizeBytes"] != float64(7) {
-			t.Fatalf("payload = %#v", payload)
-		}
-	})
-
-	t.Run("doc export", func(t *testing.T) {
-		testseam.Swap(t, &helperAfter, func(time.Duration) <-chan time.Time {
-			ch := make(chan time.Time, 1)
-			ch <- time.Now()
-			return ch
-		})
-		outputPath := filepath.Join(t.TempDir(), "export.md")
-		stdout, stderr, err := executeJSONOutputContractCommand(t,
-			&scriptedToolCaller{format: "json", steps: []scriptedToolStep{
-				{text: `{"jobId":"export-job-1"}`},
-				{text: `{"status":"SUCCESS","downloadUrl":"https://example.test/export.md"}`},
-			}},
-			newDocCommand,
-			"export", "--node", "doc-node", "--export-format", "markdown", "--output", outputPath)
-		if err != nil {
-			t.Fatal(err)
-		}
-		payload := assertJSONOutputPayload(t, stdout)
-		if payload["nodeId"] != "doc-node" || payload["exportFormat"] != "markdown" || payload["jobId"] != "export-job-1" || payload["taskId"] != "export-job-1" || payload["status"] != "SUCCESS" || payload["sizeBytes"] != float64(7) {
-			t.Fatalf("payload = %#v", payload)
-		}
-		if !strings.Contains(stderr, "提交导出任务") {
-			t.Fatalf("expected export progress on stderr, got %q", stderr)
-		}
-	})
-}
-
-func TestCrossPlatformCoverageJSONOutputContractDryRunIsMachineReadable(t *testing.T) {
-	stdout, _, err := executeJSONOutputContractCommand(t,
-		&scriptedToolCaller{format: "json", dry: true},
-		newDriveCommand,
-		"download", "--node", "node-dry-run", "--output", filepath.Join(t.TempDir(), "out.txt"), "--dry-run")
-	if err != nil {
-		t.Fatal(err)
-	}
-	payload := assertJSONOutputPayload(t, stdout)
-	if payload["dry_run"] != true || payload["executed"] != false || payload["nodeId"] != "node-dry-run" {
-		t.Fatalf("payload = %#v", payload)
-	}
-
-	stdout, _, err = executeJSONOutputContractCommand(t,
-		&scriptedToolCaller{format: "json", dry: true},
-		newDocCommand,
-		"export", "--node", "doc-dry-run", "--export-format", "markdown", "--output", filepath.Join(t.TempDir(), "export.md"), "--dry-run")
-	if err != nil {
-		t.Fatal(err)
-	}
-	payload = assertJSONOutputPayload(t, stdout)
-	if payload["dry_run"] != true || payload["executed"] != false || payload["nodeId"] != "doc-dry-run" || payload["operation"] != "doc_export" {
-		t.Fatalf("payload = %#v", payload)
-	}
-}
-
-func TestCrossPlatformCoverageJSONOutputContractReportsMissingLocalArtifact(t *testing.T) {
-	testseam.Swap(t, &httpGetFile, func(context.Context, string, map[string]string, string) error {
-		return nil
-	})
-	testseam.Swap(t, &helperAfter, func(time.Duration) <-chan time.Time {
-		ch := make(chan time.Time, 1)
-		ch <- time.Now()
-		return ch
-	})
-
-	tests := []struct {
-		name  string
-		build func() *cobra.Command
-		args  []string
-		steps []scriptedToolStep
-	}{
-		{
-			name:  "latest drive download",
-			build: newDriveCommand,
-			args:  []string{"download", "--node", "node-latest", "--output", filepath.Join(t.TempDir(), "latest.txt")},
-			steps: []scriptedToolStep{{text: `{"downloadUrl":"https://example.test/latest.txt","fileSize":7,"version":9}`}},
-		},
-		{
-			name:  "versioned drive download",
-			build: newDriveCommand,
-			args:  []string{"download", "--node", "node-versioned", "--version", "4", "--output", filepath.Join(t.TempDir(), "versioned.txt")},
-			steps: []scriptedToolStep{{text: `{"downloadUrl":"https://example.test/versioned.txt","fileSize":7}`}},
-		},
-		{
-			name:  "doc export",
-			build: newDocCommand,
-			args:  []string{"export", "--node", "doc-node", "--export-format", "markdown", "--output", filepath.Join(t.TempDir(), "export.md")},
-			steps: []scriptedToolStep{
-				{text: `{"jobId":"export-job-1"}`},
-				{text: `{"status":"SUCCESS","downloadUrl":"https://example.test/export.md"}`},
-			},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			_, _, err := executeJSONOutputContractCommand(t, &scriptedToolCaller{format: "json", steps: tt.steps}, tt.build, tt.args...)
-			if err == nil || !strings.Contains(err.Error(), "读取") {
-				t.Fatalf("expected missing local artifact error, got %v", err)
-			}
-		})
-	}
-}
@@ -1346,7 +1346,7 @@ func newMinutesCommand() *cobra.Command {
 		Short: "批量删除个人热词",
 		Long: `批量删除听记个人热词。
 支持一次删除多个热词（逗号分隔）。删除后对应热词不再参与后续语音识别优化。`,
-		Example: `  dws minutes hot-word delete --words "天气"
+		Example: `  dws minutes hot-word delete --words "钉钉"
  dws minutes hot-word delete --words "OKR,钉钉,Copilot"`,
 		RunE: func(cmd *cobra.Command, args []string) error {
 			if err := validateRequiredFlags(cmd, "words"); err != nil {
@@ -1384,7 +1384,7 @@ func newMinutesCommand() *cobra.Command {
 					"不确定现有热词时先用 hot-word list",
 				},
 				Examples: []string{
-					"dws minutes hot-word delete --words \"天气\"",
+					"dws minutes hot-word delete --words \"钉钉\"",
 					"dws minutes hot-word delete --words \"OKR,钉钉,Copilot\"",
 				},
 			},
@@ -1883,12 +1883,11 @@ func newMinutesCommand() *cobra.Command {
 			if err := validateRequiredFlagWithAliases(cmd, "id", "url", "task-uuid", "uuid"); err != nil {
 				return err
 			}
-			// 手动校验必填参数（避免 validateRequiredFlags 对 Int 的误判）
-			if !cmd.Flags().Changed("policy") {
-				return fmt.Errorf("missing required flag --policy")
+			if err := validateRequiredFlags(cmd, "policy"); err != nil {
+				return err
 			}

-			policyID, err := cmd.Flags().GetInt("policy")
+			policyID, err := strconv.ParseInt(mustGetFlag(cmd, "policy"), 10, 64)
 			if err != nil || policyID < 2 || policyID > 4 {
 				return fmt.Errorf("flag --policy must be an integer between 2 and 4 (2=可编辑, 3=可查看/下载, 4=仅查看)")
 			}
@@ -1943,7 +1942,7 @@ func newMinutesCommand() *cobra.Command {
 	_ = permissionApplyCmd.Flags().MarkHidden("task-uuid")
 	permissionApplyCmd.Flags().String("uuid", "", "--id 的别名")
 	_ = permissionApplyCmd.Flags().MarkHidden("uuid")
-	permissionApplyCmd.Flags().Int("policy", 0, "权限类型: 2=可编辑, 3=可查看/下载, 4=仅查看 (必填)")
+	permissionApplyCmd.Flags().String("policy", "", "权限类型: 2=可编辑, 3=可查看/下载, 4=仅查看 (必填)")

 	permissionCmd.AddCommand(permissionAddCmd, permissionRemoveCmd, permissionApplyCmd)

@@ -63,7 +63,7 @@ func newOaCommand() *cobra.Command {
 				"查看待审、已办、已发起或抄送审批，并执行同意、拒绝、撤销、转交等审批动作时",
 			},
 			AvoidWhen: []string{
-				"不要用于普通待办任务或工作日志；需要实时监听未来的审批任务/实例事件时使用 event consume",
+				"不要用于普通待办任务或工作日志；需要创建审批实例时先确认当前命令面是否支持",
 			},
 		},
 	})
@@ -151,17 +151,6 @@ func (f *Formatter) PrintInfo(msg string)     { fmt.Fprintf(f.w, "[INFO] %s\n",
 func (f *Formatter) PrintProgress(msg string) { fmt.Fprintf(f.errW, "%s\n", msg) }
 func (f *Formatter) PrintDim(msg string)      { fmt.Fprintf(f.w, "  %s\n", msg) }

-// printJSONSafeInfo keeps command progress out of stdout when the caller
-// requested JSON. A successful JSON command must leave stdout parseable; its
-// human-readable progress belongs on stderr instead.
-func printJSONSafeInfo(msg string) {
-	if deps != nil && deps.Caller != nil && strings.EqualFold(strings.TrimSpace(deps.Caller.Format()), "json") {
-		deps.Out.PrintProgress("[INFO] " + msg)
-		return
-	}
-	deps.Out.PrintInfo(msg)
-}
-
 func (f *Formatter) PrintKeyValue(key, value string) {
 	fmt.Fprintf(f.w, "%-16s%s\n", key+":", value)
 }
@@ -1,521 +0,0 @@
-package helpers
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"strconv"
-	"strings"
-	"time"
-
-	"github.com/spf13/cobra"
-)
-
-const (
-	defaultPagedCommandPageLimit = 50
-	maxPagedCommandPageLimit     = 500
-	defaultPagedCommandDelayMS   = 200
-)
-
-type PagedCursorKind int
-
-const (
-	PagedCursorString PagedCursorKind = iota
-	PagedCursorInt64
-)
-
-type PagedAggregationMode int
-
-const (
-	PagedAggregationArray PagedAggregationMode = iota
-	PagedAggregationConversationMessages
-)
-
-type PagedMCPCommandConfig struct {
-	ServerID        string
-	ToolName        string
-	ItemPath        string
-	CursorPath      string
-	HasMorePath     string
-	CursorArg       string
-	CursorKind      PagedCursorKind
-	AggregationMode PagedAggregationMode
-	BuildArgs       func(*cobra.Command) (map[string]any, error)
-	Fallback        func(map[string]any) error
-}
-
-type pagedCommandOptions struct {
-	pageAll   bool
-	pageLimit int
-	maxItems  int
-	delayMS   int
-}
-
-func AddPagedMCPFlags(cmd *cobra.Command) {
-	cmd.Flags().Bool("page-all", false, "自动按 nextCursor 拉取所有分页；未设置时保持单页调用")
-	cmd.Flags().Int("page-limit", defaultPagedCommandPageLimit, "自动翻页最多请求页数（默认 50，范围 1-500；仅 --page-all 生效）")
-	cmd.Flags().Int("max-items", 0, "自动翻页最多返回条数（默认 0 表示不限制；仅 --page-all 生效）")
-	cmd.Flags().Int("page-delay", defaultPagedCommandDelayMS, "自动翻页每页之间等待毫秒数（默认 200；0 表示不等待；仅 --page-all 生效）")
-}
-
-func RunPagedMCPCommand(cmd *cobra.Command, cfg PagedMCPCommandConfig) error {
-	args, err := cfg.BuildArgs(cmd)
-	if err != nil {
-		return err
-	}
-	opts, err := readPagedCommandOptions(cmd)
-	if err != nil {
-		return err
-	}
-	if !opts.pageAll {
-		return cfg.Fallback(args)
-	}
-	if err := validatePagedConfig(cfg); err != nil {
-		return err
-	}
-	if deps.Caller.DryRun() {
-		return deps.Out.PrintJSON(map[string]any{
-			"dry_run": true,
-			"request": map[string]any{
-				"server": cfg.ServerID,
-				"name":   cfg.ToolName,
-				"args":   args,
-			},
-			"paging": map[string]any{
-				"pageAll":   true,
-				"pageLimit": opts.pageLimit,
-				"maxItems":  opts.maxItems,
-				"pageDelay": opts.delayMS,
-			},
-		})
-	}
-	return runPagedMCPCommand(cmd, cfg, opts, args)
-}
-
-func readPagedCommandOptions(cmd *cobra.Command) (pagedCommandOptions, error) {
-	pageAll, _ := cmd.Flags().GetBool("page-all")
-	opts := pagedCommandOptions{pageAll: pageAll}
-	if !pageAll {
-		return opts, nil
-	}
-	opts.pageLimit, _ = cmd.Flags().GetInt("page-limit")
-	if opts.pageLimit < 1 || opts.pageLimit > maxPagedCommandPageLimit {
-		return opts, fmt.Errorf("--page-limit must be between 1 and 500")
-	}
-	opts.maxItems, _ = cmd.Flags().GetInt("max-items")
-	if opts.maxItems < 0 {
-		return opts, fmt.Errorf("--max-items must be greater than or equal to 0")
-	}
-	opts.delayMS, _ = cmd.Flags().GetInt("page-delay")
-	if opts.delayMS < 0 {
-		return opts, fmt.Errorf("--page-delay must be greater than or equal to 0")
-	}
-	return opts, nil
-}
-
-func validatePagedConfig(cfg PagedMCPCommandConfig) error {
-	switch {
-	case strings.TrimSpace(cfg.ServerID) == "":
-		return fmt.Errorf("paged command server is required")
-	case strings.TrimSpace(cfg.ToolName) == "":
-		return fmt.Errorf("paged command tool is required")
-	case strings.TrimSpace(cfg.ItemPath) == "":
-		return fmt.Errorf("paged command item path is required")
-	case strings.TrimSpace(cfg.CursorPath) == "":
-		return fmt.Errorf("paged command cursor path is required")
-	case strings.TrimSpace(cfg.HasMorePath) == "":
-		return fmt.Errorf("paged command hasMore path is required")
-	case strings.TrimSpace(cfg.CursorArg) == "":
-		return fmt.Errorf("paged command cursor arg is required")
-	case cfg.BuildArgs == nil || cfg.Fallback == nil:
-		return fmt.Errorf("paged command callbacks are required")
-	default:
-		return nil
-	}
-}
-
-func runPagedMCPCommand(cmd *cobra.Command, cfg PagedMCPCommandConfig, opts pagedCommandOptions, args map[string]any) error {
-	var envelope map[string]any
-	ctx := cmd.Context()
-	items := newPagedCollection(cfg)
-	seenCursors := map[string]bool{}
-	currentCursor := cursorValueKey(args[cfg.CursorArg], cfg.CursorKind)
-	lastCursor := args[cfg.CursorArg]
-	hasMore := true
-
-	for page := 1; page <= opts.pageLimit && hasMore; page++ {
-		pageCursor := args[cfg.CursorArg]
-		seenCursors[currentCursor] = true
-		text, err := callMCPToolReturnTextOnServer(ctx, cfg.ServerID, cfg.ToolName, args)
-		if err != nil {
-			return handlePagedCommandError(cmd, envelope, cfg, items, page, currentCursor, err)
-		}
-		parsed, pageItems, nextCursor, more, err := parsePagedCommandPage(text, cfg)
-		if err != nil {
-			return handlePagedCommandError(cmd, envelope, cfg, items, page, currentCursor, err)
-		}
-		if envelope == nil {
-			envelope = parsed
-		}
-		if err := items.Add(pageItems); err != nil {
-			return handlePagedCommandError(cmd, envelope, cfg, items, page, currentCursor, err)
-		}
-		hasMore = more
-
-		if opts.maxItems > 0 && items.Total() > opts.maxItems {
-			items.Truncate(opts.maxItems)
-			return writePagedCommandResult(envelope, cfg, items, pagingMetadata{
-				Truncated:           true,
-				HasMore:             true,
-				LastCursor:          pageCursor,
-				Pages:               page,
-				Total:               items.Total(),
-				TruncatedWithinPage: true,
-			})
-		}
-		lastCursor = nextCursor
-		if opts.maxItems > 0 && items.Total() == opts.maxItems && hasMore {
-			return writePagedCommandResult(envelope, cfg, items, pagingMetadata{
-				Truncated:  true,
-				HasMore:    true,
-				LastCursor: lastCursor,
-				Pages:      page,
-				Total:      items.Total(),
-			})
-		}
-		if !hasMore {
-			return writePagedCommandResult(envelope, cfg, items, pagingMetadata{
-				Truncated:  false,
-				HasMore:    false,
-				LastCursor: lastCursor,
-				Pages:      page,
-				Total:      items.Total(),
-			})
-		}
-		nextKey := cursorValueKey(nextCursor, cfg.CursorKind)
-		if nextKey == "" || nextKey == currentCursor || seenCursors[nextKey] {
-			err := fmt.Errorf("pagination cursor did not advance: %s", nextKey)
-			return handlePagedCommandError(cmd, envelope, cfg, items, page+1, nextKey, err)
-		}
-		normalizedCursor, err := normalizeCursorArg(nextCursor, cfg.CursorKind)
-		if err != nil {
-			return handlePagedCommandError(cmd, envelope, cfg, items, page+1, nextKey, err)
-		}
-		currentCursor = nextKey
-		args[cfg.CursorArg] = normalizedCursor
-		if opts.delayMS > 0 {
-			if err := sleepPagedCommandDelay(ctx, time.Duration(opts.delayMS)*time.Millisecond); err != nil {
-				return handlePagedCommandError(cmd, envelope, cfg, items, page+1, currentCursor, err)
-			}
-		}
-	}
-
-	return writePagedCommandResult(envelope, cfg, items, pagingMetadata{
-		Truncated:  hasMore,
-		HasMore:    hasMore,
-		LastCursor: lastCursor,
-		Pages:      opts.pageLimit,
-		Total:      items.Total(),
-	})
-}
-
-func parsePagedCommandPage(text string, cfg PagedMCPCommandConfig) (map[string]any, []any, any, bool, error) {
-	var parsed map[string]any
-	if err := json.Unmarshal([]byte(text), &parsed); err != nil {
-		return nil, nil, nil, false, fmt.Errorf("parse paged response JSON: %w", err)
-	}
-	rawHasMore, ok := getJSONPath(parsed, cfg.HasMorePath)
-	if !ok {
-		return nil, nil, nil, false, fmt.Errorf("paged response missing %s", cfg.HasMorePath)
-	}
-	hasMore, ok := rawHasMore.(bool)
-	if !ok {
-		return nil, nil, nil, false, fmt.Errorf("paged response %s must be boolean", cfg.HasMorePath)
-	}
-	rawItems, ok := getJSONPath(parsed, cfg.ItemPath)
-	if !ok && cfg.AggregationMode == PagedAggregationConversationMessages && !hasMore {
-		rawItems = []any{}
-		ok = true
-	}
-	if !ok {
-		return nil, nil, nil, false, fmt.Errorf("paged response missing %s", cfg.ItemPath)
-	}
-	items, ok := rawItems.([]any)
-	if !ok {
-		return nil, nil, nil, false, fmt.Errorf("paged response %s must be array", cfg.ItemPath)
-	}
-	nextCursor, ok := getJSONPath(parsed, cfg.CursorPath)
-	if hasMore && !ok {
-		return nil, nil, nil, false, fmt.Errorf("paged response missing %s", cfg.CursorPath)
-	}
-	return parsed, items, nextCursor, hasMore, nil
-}
-
-type pagingMetadata struct {
-	Truncated           bool
-	HasMore             bool
-	LastCursor          any
-	Pages               int
-	Total               int
-	TruncatedWithinPage bool
-	Partial             bool
-	FailedPage          int
-	FailedCursor        string
-	PagesFetched        int
-	ItemsFetched        int
-	Error               string
-}
-
-func handlePagedCommandError(cmd *cobra.Command, envelope map[string]any, cfg PagedMCPCommandConfig, items *pagedCollection, failedPage int, failedCursor string, err error) error {
-	if envelope == nil {
-		return err
-	}
-	fmt.Fprintf(cmd.ErrOrStderr(), "pagination stopped at page %d: %v\n", failedPage, err)
-	if outputErr := writePagedCommandResult(envelope, cfg, items, pagingMetadata{
-		Truncated:    true,
-		HasMore:      true,
-		LastCursor:   failedCursor,
-		Pages:        failedPage - 1,
-		Total:        items.Total(),
-		Partial:      true,
-		FailedPage:   failedPage,
-		FailedCursor: failedCursor,
-		PagesFetched: failedPage - 1,
-		ItemsFetched: items.Total(),
-		Error:        err.Error(),
-	}); outputErr != nil {
-		return errors.Join(err, outputErr)
-	}
-	return err
-}
-
-func writePagedCommandResult(envelope map[string]any, cfg PagedMCPCommandConfig, items *pagedCollection, meta pagingMetadata) error {
-	_ = setJSONPath(envelope, cfg.ItemPath, items.Values())
-	_ = setJSONPath(envelope, cfg.HasMorePath, meta.HasMore)
-	_ = setJSONPath(envelope, cfg.CursorPath, meta.LastCursor)
-	paging := map[string]any{
-		"truncated":  meta.Truncated,
-		"hasMore":    meta.HasMore,
-		"lastCursor": meta.LastCursor,
-		"pages":      meta.Pages,
-		"total":      meta.Total,
-	}
-	if meta.Partial {
-		paging["partial"] = true
-		paging["failedPage"] = meta.FailedPage
-		paging["failedCursor"] = meta.FailedCursor
-		paging["pagesFetched"] = meta.PagesFetched
-		paging["itemsFetched"] = meta.ItemsFetched
-		paging["error"] = meta.Error
-	}
-	if meta.TruncatedWithinPage {
-		paging["truncatedWithinPage"] = true
-		paging["resumeCursorReliable"] = false
-	}
-	envelope["paging"] = paging
-	return deps.Out.PrintJSON(envelope)
-}
-
-func sleepPagedCommandDelay(ctx context.Context, delay time.Duration) error {
-	select {
-	case <-ctx.Done():
-		return ctx.Err()
-	case <-helperAfter(delay):
-		return nil
-	}
-}
-
-type pagedCollection struct {
-	mode              PagedAggregationMode
-	items             []any
-	conversationIndex map[string]int
-	total             int
-}
-
-func newPagedCollection(cfg PagedMCPCommandConfig) *pagedCollection {
-	return &pagedCollection{
-		mode:              cfg.AggregationMode,
-		conversationIndex: map[string]int{},
-	}
-}
-
-func (c *pagedCollection) Add(items []any) error {
-	if c.mode != PagedAggregationConversationMessages {
-		c.items = append(c.items, items...)
-		c.total = len(c.items)
-		return nil
-	}
-	for _, item := range items {
-		if err := c.addConversation(item); err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-func (c *pagedCollection) Values() []any {
-	if c.items == nil {
-		return []any{}
-	}
-	return c.items
-}
-
-func (c *pagedCollection) Total() int {
-	return c.total
-}
-
-func (c *pagedCollection) Truncate(maxItems int) bool {
-	if maxItems <= 0 || c.total <= maxItems {
-		return false
-	}
-	if c.mode != PagedAggregationConversationMessages {
-		c.items = c.items[:maxItems]
-		c.total = len(c.items)
-		return true
-	}
-	c.truncateConversationMessages(maxItems)
-	return true
-}
-
-func (c *pagedCollection) addConversation(item any) error {
-	conversation, ok := item.(map[string]any)
-	if !ok {
-		return fmt.Errorf("paged response conversation item must be object")
-	}
-	key, _ := conversation["openConversationId"].(string)
-	if strings.TrimSpace(key) == "" {
-		return fmt.Errorf("paged response conversation item missing openConversationId")
-	}
-	messages, err := conversationMessages(conversation)
-	if err != nil {
-		return err
-	}
-	if idx, ok := c.conversationIndex[key]; ok {
-		existing := c.items[idx].(map[string]any)
-		existingMessages, err := conversationMessages(existing)
-		if err != nil {
-			return err
-		}
-		existing["messages"] = append(existingMessages, messages...)
-		c.total += len(messages)
-		return nil
-	}
-	c.conversationIndex[key] = len(c.items)
-	c.items = append(c.items, conversation)
-	c.total += len(messages)
-	return nil
-}
-
-func (c *pagedCollection) truncateConversationMessages(maxItems int) {
-	remaining := maxItems
-	for i, item := range c.items {
-		conversation := item.(map[string]any)
-		messages, _ := conversationMessages(conversation)
-		if remaining >= len(messages) {
-			remaining -= len(messages)
-			continue
-		}
-		if remaining == 0 {
-			c.items = c.items[:i]
-			c.total = maxItems
-			return
-		}
-		conversation["messages"] = messages[:remaining]
-		c.items = c.items[:i+1]
-		c.total = maxItems
-		return
-	}
-}
-
-func conversationMessages(conversation map[string]any) ([]any, error) {
-	raw, ok := conversation["messages"]
-	if !ok {
-		return []any{}, nil
-	}
-	messages, ok := raw.([]any)
-	if !ok {
-		return nil, fmt.Errorf("paged response conversation messages must be array")
-	}
-	return messages, nil
-}
-
-func getJSONPath(root map[string]any, path string) (any, bool) {
-	var current any = root
-	for _, part := range strings.Split(path, ".") {
-		obj, ok := current.(map[string]any)
-		if !ok {
-			return nil, false
-		}
-		current, ok = obj[part]
-		if !ok {
-			return nil, false
-		}
-	}
-	return current, true
-}
-
-func setJSONPath(root map[string]any, path string, value any) bool {
-	parts := strings.Split(path, ".")
-	current := root
-	for _, part := range parts[:len(parts)-1] {
-		next, ok := current[part].(map[string]any)
-		if !ok {
-			return false
-		}
-		current = next
-	}
-	current[parts[len(parts)-1]] = value
-	return true
-}
-
-func cursorValueKey(value any, kind PagedCursorKind) string {
-	switch kind {
-	case PagedCursorInt64:
-		switch v := value.(type) {
-		case int64:
-			return strconv.FormatInt(v, 10)
-		case int:
-			return strconv.Itoa(v)
-		case float64:
-			return strconv.FormatInt(int64(v), 10)
-		case string:
-			return strings.TrimSpace(v)
-		default:
-			return ""
-		}
-	default:
-		if value == nil {
-			return ""
-		}
-		return strings.TrimSpace(fmt.Sprint(value))
-	}
-}
-
-func normalizeCursorArg(value any, kind PagedCursorKind) (any, error) {
-	if kind != PagedCursorInt64 {
-		if value == nil {
-			return "", nil
-		}
-		return fmt.Sprint(value), nil
-	}
-	switch v := value.(type) {
-	case int64:
-		return v, nil
-	case int:
-		return int64(v), nil
-	case float64:
-		converted := int64(v)
-		if float64(converted) != v {
-			return nil, fmt.Errorf("paged response cursor must be an integer, got %v", v)
-		}
-		return converted, nil
-	case string:
-		parsed, err := strconv.ParseInt(strings.TrimSpace(v), 10, 64)
-		if err == nil {
-			return parsed, nil
-		}
-		return nil, fmt.Errorf("paged response cursor must be a base-10 int64 string, got %q", v)
-	}
-	return nil, fmt.Errorf("paged response cursor must be int64-compatible, got %T", value)
-}
@@ -1,973 +0,0 @@
-package helpers
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-	"errors"
-	"io"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/DingTalk-Real-AI/dingtalk-workspace-cli/pkg/edition"
-	"github.com/spf13/cobra"
-)
-
-type pagedCommandCall struct {
-	server string
-	tool   string
-	args   map[string]any
-	ctx    context.Context
-}
-
-type pagedCommandCaller struct {
-	steps  []scriptedToolStep
-	calls  []pagedCommandCall
-	format string
-	dry    bool
-}
-
-func (c *pagedCommandCaller) CallTool(ctx context.Context, serverID, toolName string, args map[string]any) (*edition.ToolResult, error) {
-	copied := map[string]any{}
-	for k, v := range args {
-		copied[k] = v
-	}
-	c.calls = append(c.calls, pagedCommandCall{server: serverID, tool: toolName, args: copied, ctx: ctx})
-	if len(c.steps) == 0 {
-		return textToolResult(`{"result":{"messages":[],"hasMore":false}}`), nil
-	}
-	step := c.steps[len(c.calls)-1]
-	if step.err != nil {
-		return nil, step.err
-	}
-	return textToolResult(step.text), nil
-}
-
-func (c *pagedCommandCaller) Format() string { return c.format }
-func (c *pagedCommandCaller) DryRun() bool   { return c.dry }
-func (*pagedCommandCaller) Fields() string   { return "" }
-func (*pagedCommandCaller) JQ() string       { return "" }
-
-func runPagedCommandTest(t *testing.T, caller *pagedCommandCaller, cfg PagedMCPCommandConfig, args ...string) (map[string]any, string, error) {
-	t.Helper()
-	return runPagedCommandTestWithSleep(t, caller, cfg, func(time.Duration) {}, args...)
-}
-
-func runPagedCommandTestWithSleep(t *testing.T, caller *pagedCommandCaller, cfg PagedMCPCommandConfig, sleep func(time.Duration), args ...string) (map[string]any, string, error) {
-	t.Helper()
-	out, stderr, err := executePagedCommandTest(t, caller, cfg, sleep, &bytes.Buffer{}, args...)
-	if strings.TrimSpace(out) == "" {
-		return nil, stderr, err
-	}
-	var parsed map[string]any
-	if unmarshalErr := json.Unmarshal([]byte(out), &parsed); unmarshalErr != nil {
-		t.Fatalf("stdout JSON = %q, err = %v", out, unmarshalErr)
-	}
-	return parsed, stderr, err
-}
-
-func executePagedCommandTest(t *testing.T, caller *pagedCommandCaller, cfg PagedMCPCommandConfig, sleep func(time.Duration), stdout io.Writer, args ...string) (string, string, error) {
-	t.Helper()
-	return executePagedCommandTestWithContext(t, context.Background(), caller, cfg, sleep, stdout, args...)
-}
-
-func executePagedCommandTestWithContext(t *testing.T, ctx context.Context, caller *pagedCommandCaller, cfg PagedMCPCommandConfig, sleep func(time.Duration), stdout io.Writer, args ...string) (string, string, error) {
-	t.Helper()
-	oldDeps := deps
-	oldSleep := helperSleep
-	oldAfter := helperAfter
-	t.Cleanup(func() {
-		deps = oldDeps
-		helperSleep = oldSleep
-		helperAfter = oldAfter
-	})
-	InitDeps(caller)
-	out := stdout
-	errOut := &bytes.Buffer{}
-	deps.Out.w = out
-	deps.Out.errW = errOut
-	if sleep != nil {
-		helperSleep = sleep
-		helperAfter = func(d time.Duration) <-chan time.Time {
-			sleep(d)
-			ch := make(chan time.Time, 1)
-			ch <- time.Now()
-			return ch
-		}
-	}
-
-	cmd := &cobra.Command{
-		Use:          "paged",
-		SilenceUsage: true,
-		RunE: func(cmd *cobra.Command, _ []string) error {
-			return RunPagedMCPCommand(cmd, cfg)
-		},
-	}
-	cmd.SetContext(ctx)
-	cmd.Flags().String("cursor", "0", "")
-	AddPagedMCPFlags(cmd)
-	cmd.SetErr(errOut)
-	cmd.SetArgs(args)
-	err := cmd.Execute()
-	if buf, ok := out.(*bytes.Buffer); ok {
-		return buf.String(), errOut.String(), err
-	}
-	return "", errOut.String(), err
-}
-
-func pagedCommandMessagesConfig(fallback func(map[string]any) error) PagedMCPCommandConfig {
-	if fallback == nil {
-		fallback = func(map[string]any) error { return nil }
-	}
-	return PagedMCPCommandConfig{
-		ServerID:    "chat",
-		ToolName:    "search_messages_by_time_range",
-		ItemPath:    "result.messages",
-		CursorPath:  "result.nextCursor",
-		HasMorePath: "result.hasMore",
-		CursorArg:   "cursor",
-		CursorKind:  PagedCursorString,
-		BuildArgs: func(cmd *cobra.Command) (map[string]any, error) {
-			cursor, _ := cmd.Flags().GetString("cursor")
-			return map[string]any{"cursor": cursor, "limit": 2}, nil
-		},
-		Fallback: fallback,
-	}
-}
-
-func pagedCommandConversationMessagesConfig(fallback func(map[string]any) error) PagedMCPCommandConfig {
-	cfg := pagedCommandMessagesConfig(fallback)
-	cfg.ItemPath = "result.conversationMessagesList"
-	cfg.AggregationMode = PagedAggregationConversationMessages
-	return cfg
-}
-
-func TestPagedMCPCommandDefaultUsesFallbackOnly(t *testing.T) {
-	caller := &pagedCommandCaller{}
-	fallbackCalls := 0
-	cfg := pagedCommandMessagesConfig(func(args map[string]any) error {
-		fallbackCalls++
-		if args["cursor"] != "0" {
-			t.Fatalf("fallback args = %#v", args)
-		}
-		return nil
-	})
-	_, _, err := runPagedCommandTest(t, caller, cfg, "--page-limit", "2", "--max-items", "1", "--page-delay", "0")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if fallbackCalls != 1 || len(caller.calls) != 0 {
-		t.Fatalf("fallback=%d remote=%d, want fallback only", fallbackCalls, len(caller.calls))
-	}
-}
-
-func TestPagedMCPCommandRejectsInvalidConfigWhenPageAll(t *testing.T) {
-	caller := &pagedCommandCaller{}
-	cfg := pagedCommandMessagesConfig(nil)
-	cfg.ServerID = " "
-
-	got, _, err := runPagedCommandTest(t, caller, cfg, "--page-all")
-	if err == nil || !strings.Contains(err.Error(), "server is required") {
-		t.Fatalf("result=%#v err=%v, want config error", got, err)
-	}
-	if got != nil {
-		t.Fatalf("result=%#v, want no stdout", got)
-	}
-	if len(caller.calls) != 0 {
-		t.Fatalf("calls=%#v, want no remote call", caller.calls)
-	}
-}
-
-func TestPagedMCPCommandDryRunPrintsRequestAndSkipsRemote(t *testing.T) {
-	caller := &pagedCommandCaller{dry: true}
-
-	got, _, err := runPagedCommandTest(t, caller, pagedCommandMessagesConfig(nil), "--page-all", "--page-limit", "3", "--max-items", "7", "--page-delay", "0")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(caller.calls) != 0 {
-		t.Fatalf("calls=%#v, want no remote call", caller.calls)
-	}
-	if got["dry_run"] != true {
-		t.Fatalf("dry_run=%#v, want true", got["dry_run"])
-	}
-	request := got["request"].(map[string]any)
-	if request["server"] != "chat" || request["name"] != "search_messages_by_time_range" {
-		t.Fatalf("request=%#v", request)
-	}
-	args := request["args"].(map[string]any)
-	if args["cursor"] != "0" || args["limit"].(float64) != 2 {
-		t.Fatalf("args=%#v", args)
-	}
-	paging := got["paging"].(map[string]any)
-	if paging["pageAll"] != true || paging["pageLimit"].(float64) != 3 || paging["maxItems"].(float64) != 7 || paging["pageDelay"].(float64) != 0 {
-		t.Fatalf("paging=%#v", paging)
-	}
-}
-
-func TestPagedMCPCommandValidateConfigRejectsMissingRequiredFields(t *testing.T) {
-	tests := []struct {
-		name string
-		edit func(*PagedMCPCommandConfig)
-		want string
-	}{
-		{
-			name: "server",
-			edit: func(cfg *PagedMCPCommandConfig) {
-				cfg.ServerID = ""
-			},
-			want: "server is required",
-		},
-		{
-			name: "tool",
-			edit: func(cfg *PagedMCPCommandConfig) {
-				cfg.ToolName = ""
-			},
-			want: "tool is required",
-		},
-		{
-			name: "item path",
-			edit: func(cfg *PagedMCPCommandConfig) {
-				cfg.ItemPath = ""
-			},
-			want: "item path is required",
-		},
-		{
-			name: "cursor path",
-			edit: func(cfg *PagedMCPCommandConfig) {
-				cfg.CursorPath = ""
-			},
-			want: "cursor path is required",
-		},
-		{
-			name: "hasMore path",
-			edit: func(cfg *PagedMCPCommandConfig) {
-				cfg.HasMorePath = ""
-			},
-			want: "hasMore path is required",
-		},
-		{
-			name: "cursor arg",
-			edit: func(cfg *PagedMCPCommandConfig) {
-				cfg.CursorArg = ""
-			},
-			want: "cursor arg is required",
-		},
-		{
-			name: "build args callback",
-			edit: func(cfg *PagedMCPCommandConfig) {
-				cfg.BuildArgs = nil
-			},
-			want: "callbacks are required",
-		},
-		{
-			name: "fallback callback",
-			edit: func(cfg *PagedMCPCommandConfig) {
-				cfg.Fallback = nil
-			},
-			want: "callbacks are required",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			cfg := pagedCommandMessagesConfig(nil)
-			tt.edit(&cfg)
-			err := validatePagedConfig(cfg)
-			if err == nil || !strings.Contains(err.Error(), tt.want) {
-				t.Fatalf("err=%v, want %q", err, tt.want)
-			}
-		})
-	}
-}
-
-func TestPagedMCPCommandStringCursorAggregatesAndPageLimit(t *testing.T) {
-	caller := &pagedCommandCaller{steps: []scriptedToolStep{
-		{text: `{"result":{"messages":[{"id":"m1"}],"hasMore":true,"nextCursor":"c2"}}`},
-		{text: `{"result":{"messages":[{"id":"m2"}],"hasMore":true,"nextCursor":"c3"}}`},
-	}}
-	got, _, err := runPagedCommandTest(t, caller, pagedCommandMessagesConfig(nil), "--page-all", "--page-limit", "2", "--page-delay", "0")
-	if err != nil {
-		t.Fatal(err)
-	}
-	items := got["result"].(map[string]any)["messages"].([]any)
-	result := got["result"].(map[string]any)
-	paging := got["paging"].(map[string]any)
-	if len(items) != 2 || paging["truncated"] != true || paging["pages"].(float64) != 2 {
-		t.Fatalf("result = %#v", got)
-	}
-	if result["hasMore"] != true || result["nextCursor"] != "c3" {
-		t.Fatalf("result=%#v, want final page-limit cursor state", result)
-	}
-	if caller.calls[0].args["cursor"] != "0" || caller.calls[1].args["cursor"] != "c2" {
-		t.Fatalf("call args = %#v", caller.calls)
-	}
-}
-
-func TestPagedMCPCommandStringCursorAggregatesAndSyncsCompletionFields(t *testing.T) {
-	caller := &pagedCommandCaller{steps: []scriptedToolStep{
-		{text: `{"result":{"messages":[{"id":"m1"}],"hasMore":true,"nextCursor":"c2"}}`},
-		{text: `{"result":{"messages":[{"id":"m2"}],"hasMore":false,"nextCursor":""}}`},
-	}}
-
-	got, _, err := runPagedCommandTest(t, caller, pagedCommandMessagesConfig(nil), "--page-all", "--page-delay", "0")
-	if err != nil {
-		t.Fatal(err)
-	}
-	result := got["result"].(map[string]any)
-	items := result["messages"].([]any)
-	if len(items) != 2 || result["hasMore"] != false || result["nextCursor"] != "" {
-		t.Fatalf("result=%#v, want complete aggregate with final cursor state", result)
-	}
-	paging := got["paging"].(map[string]any)
-	if paging["truncated"] != false || paging["hasMore"] != false || paging["lastCursor"] != "" {
-		t.Fatalf("paging=%#v, want complete pagination metadata", paging)
-	}
-}
-
-func TestPagedMCPCommandConversationMessagesMergeSameConversation(t *testing.T) {
-	caller := &pagedCommandCaller{steps: []scriptedToolStep{
-		{text: `{"result":{"conversationMessagesList":[{"openConversationId":"cid1","title":"群1","messages":[{"id":"m1"}]}],"hasMore":true,"nextCursor":"c2"}}`},
-		{text: `{"result":{"conversationMessagesList":[{"openConversationId":"cid1","title":"ignored","messages":[{"id":"m2"}]}],"hasMore":false,"nextCursor":""}}`},
-	}}
-	got, _, err := runPagedCommandTest(t, caller, pagedCommandConversationMessagesConfig(nil), "--page-all", "--page-delay", "0")
-	if err != nil {
-		t.Fatal(err)
-	}
-	conversations := got["result"].(map[string]any)["conversationMessagesList"].([]any)
-	if len(conversations) != 1 {
-		t.Fatalf("conversations=%#v, want one merged conversation", conversations)
-	}
-	conversation := conversations[0].(map[string]any)
-	messages := conversation["messages"].([]any)
-	if conversation["title"] != "群1" || len(messages) != 2 {
-		t.Fatalf("conversation=%#v, want preserved title and two messages", conversation)
-	}
-	paging := got["paging"].(map[string]any)
-	if paging["total"].(float64) != 2 {
-		t.Fatalf("paging=%#v, want total message count 2", paging)
-	}
-}
-
-func TestPagedMCPCommandConversationMessagesPreserveFirstConversationOrder(t *testing.T) {
-	caller := &pagedCommandCaller{steps: []scriptedToolStep{
-		{text: `{"result":{"conversationMessagesList":[{"openConversationId":"cid2","messages":[{"id":"m2"}]},{"openConversationId":"cid1","messages":[{"id":"m1"}]}],"hasMore":true,"nextCursor":"c2"}}`},
-		{text: `{"result":{"conversationMessagesList":[{"openConversationId":"cid3","messages":[{"id":"m3"}]}],"hasMore":false,"nextCursor":""}}`},
-	}}
-	got, _, err := runPagedCommandTest(t, caller, pagedCommandConversationMessagesConfig(nil), "--page-all", "--page-delay", "0")
-	if err != nil {
-		t.Fatal(err)
-	}
-	conversations := got["result"].(map[string]any)["conversationMessagesList"].([]any)
-	gotIDs := []string{
-		conversations[0].(map[string]any)["openConversationId"].(string),
-		conversations[1].(map[string]any)["openConversationId"].(string),
-		conversations[2].(map[string]any)["openConversationId"].(string),
-	}
-	if strings.Join(gotIDs, ",") != "cid2,cid1,cid3" {
-		t.Fatalf("conversation order=%v", gotIDs)
-	}
-}
-
-func TestPagedMCPCommandConversationMessagesMaxItemsTruncatesMessages(t *testing.T) {
-	caller := &pagedCommandCaller{steps: []scriptedToolStep{
-		{text: `{"result":{"conversationMessagesList":[{"openConversationId":"cid1","messages":[{"id":"m1"},{"id":"m2"}]},{"openConversationId":"cid2","messages":[{"id":"m3"},{"id":"m4"}]}],"hasMore":true,"nextCursor":"c2"}}`},
-	}}
-	got, _, err := runPagedCommandTest(t, caller, pagedCommandConversationMessagesConfig(nil), "--page-all", "--max-items", "3", "--page-delay", "0")
-	if err != nil {
-		t.Fatal(err)
-	}
-	conversations := got["result"].(map[string]any)["conversationMessagesList"].([]any)
-	if len(conversations) != 2 {
-		t.Fatalf("conversations=%#v, want two conversations", conversations)
-	}
-	secondMessages := conversations[1].(map[string]any)["messages"].([]any)
-	paging := got["paging"].(map[string]any)
-	if len(secondMessages) != 1 || paging["total"].(float64) != 3 || paging["truncated"] != true {
-		t.Fatalf("result=%#v", got)
-	}
-}
-
-func TestPagedMCPCommandConversationMessagesMissingListOnFinalPageIsEmpty(t *testing.T) {
-	caller := &pagedCommandCaller{steps: []scriptedToolStep{
-		{text: `{"result":{"hasMore":false,"nextCursor":""}}`},
-	}}
-	got, _, err := runPagedCommandTest(t, caller, pagedCommandConversationMessagesConfig(nil), "--page-all", "--page-delay", "0")
-	if err != nil {
-		t.Fatal(err)
-	}
-	conversations := got["result"].(map[string]any)["conversationMessagesList"].([]any)
-	if len(conversations) != 0 {
-		t.Fatalf("conversations=%#v, want empty", conversations)
-	}
-}
-
-func TestPagedMCPCommandConversationMessagesLaterFailureOutputsPartial(t *testing.T) {
-	caller := &pagedCommandCaller{steps: []scriptedToolStep{
-		{text: `{"result":{"conversationMessagesList":[{"openConversationId":"cid1","messages":[{"id":"m1"}]}],"hasMore":true,"nextCursor":"c2"}}`},
-		{err: errors.New("page failed")},
-	}}
-	got, stderr, err := runPagedCommandTest(t, caller, pagedCommandConversationMessagesConfig(nil), "--page-all", "--page-delay", "0")
-	if err == nil || !strings.Contains(stderr, "pagination stopped") {
-		t.Fatalf("err=%v stderr=%q", err, stderr)
-	}
-	conversations := got["result"].(map[string]any)["conversationMessagesList"].([]any)
-	paging := got["paging"].(map[string]any)
-	if len(conversations) != 1 || paging["partial"] != true || paging["itemsFetched"].(float64) != 1 {
-		t.Fatalf("result=%#v", got)
-	}
-}
-
-func TestPagedMCPCommandConversationMessagesAddErrorsOutputPartial(t *testing.T) {
-	tests := []struct {
-		name     string
-		response string
-		want     string
-	}{
-		{
-			name:     "conversation item not object",
-			response: `{"result":{"conversationMessagesList":["bad"],"hasMore":false,"nextCursor":""}}`,
-			want:     "conversation item must be object",
-		},
-		{
-			name:     "conversation missing openConversationId",
-			response: `{"result":{"conversationMessagesList":[{"messages":[]}],"hasMore":false,"nextCursor":""}}`,
-			want:     "missing openConversationId",
-		},
-		{
-			name:     "conversation messages not array",
-			response: `{"result":{"conversationMessagesList":[{"openConversationId":"cid1","messages":"bad"}],"hasMore":false,"nextCursor":""}}`,
-			want:     "conversation messages must be array",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			caller := &pagedCommandCaller{steps: []scriptedToolStep{{text: tt.response}}}
-			got, stderr, err := runPagedCommandTest(t, caller, pagedCommandConversationMessagesConfig(nil), "--page-all", "--page-delay", "0")
-			if err == nil || !strings.Contains(err.Error(), tt.want) {
-				t.Fatalf("result=%#v err=%v, want %q", got, err, tt.want)
-			}
-			if !strings.Contains(stderr, "pagination stopped at page 1") {
-				t.Fatalf("stderr=%q", stderr)
-			}
-			paging := got["paging"].(map[string]any)
-			if paging["partial"] != true || paging["itemsFetched"].(float64) != 0 {
-				t.Fatalf("paging=%#v", paging)
-			}
-		})
-	}
-}
-
-func TestPagedMCPCommandConversationMessagesMaxItemsTruncatesAtConversationBoundary(t *testing.T) {
-	caller := &pagedCommandCaller{steps: []scriptedToolStep{
-		{text: `{"result":{"conversationMessagesList":[{"openConversationId":"cid1","messages":[{"id":"m1"},{"id":"m2"}]},{"openConversationId":"cid2","messages":[{"id":"m3"},{"id":"m4"}]}],"hasMore":true,"nextCursor":"c2"}}`},
-	}}
-	got, _, err := runPagedCommandTest(t, caller, pagedCommandConversationMessagesConfig(nil), "--page-all", "--max-items", "2", "--page-delay", "0")
-	if err != nil {
-		t.Fatal(err)
-	}
-	conversations := got["result"].(map[string]any)["conversationMessagesList"].([]any)
-	paging := got["paging"].(map[string]any)
-	if len(conversations) != 1 || paging["total"].(float64) != 2 || paging["truncated"] != true {
-		t.Fatalf("result=%#v", got)
-	}
-}
-
-func TestPagedMCPCommandConversationMessagesAcceptsMissingMessages(t *testing.T) {
-	messages, err := conversationMessages(map[string]any{"openConversationId": "cid1"})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(messages) != 0 {
-		t.Fatalf("messages=%#v, want empty", messages)
-	}
-}
-
-func TestPagedMCPCommandConversationMessagesRejectsCorruptExistingMessages(t *testing.T) {
-	collection := newPagedCollection(PagedMCPCommandConfig{AggregationMode: PagedAggregationConversationMessages})
-	collection.items = []any{map[string]any{"openConversationId": "cid1", "messages": "bad"}}
-	collection.conversationIndex["cid1"] = 0
-
-	err := collection.Add([]any{map[string]any{"openConversationId": "cid1", "messages": []any{map[string]any{"id": "m2"}}}})
-	if err == nil || !strings.Contains(err.Error(), "conversation messages must be array") {
-		t.Fatalf("err=%v, want corrupt existing messages error", err)
-	}
-}
-
-func TestPagedMCPCommandResponseShapeErrors(t *testing.T) {
-	tests := []struct {
-		name     string
-		response string
-		want     string
-	}{
-		{
-			name:     "items not array",
-			response: `{"result":{"messages":"bad","hasMore":false}}`,
-			want:     "result.messages must be array",
-		},
-		{
-			name:     "missing hasMore",
-			response: `{"result":{"messages":[]}}`,
-			want:     "missing result.hasMore",
-		},
-		{
-			name:     "hasMore not bool",
-			response: `{"result":{"messages":[],"hasMore":"yes"}}`,
-			want:     "result.hasMore must be boolean",
-		},
-		{
-			name:     "missing next cursor",
-			response: `{"result":{"messages":[{"id":"m1"}],"hasMore":true}}`,
-			want:     "missing result.nextCursor",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			caller := &pagedCommandCaller{steps: []scriptedToolStep{{text: tt.response}}}
-			got, _, err := runPagedCommandTest(t, caller, pagedCommandMessagesConfig(nil), "--page-all", "--page-delay", "0")
-			if err == nil || !strings.Contains(err.Error(), tt.want) {
-				t.Fatalf("result=%#v err=%v, want %q", got, err, tt.want)
-			}
-			if got != nil {
-				t.Fatalf("result=%#v, want no partial stdout", got)
-			}
-		})
-	}
-}
-
-func TestPagedMCPCommandPageDelayControlsSleep(t *testing.T) {
-	tests := []struct {
-		name       string
-		delay      string
-		wantSleeps []time.Duration
-	}{
-		{
-			name:       "non zero delay sleeps between pages",
-			delay:      "200",
-			wantSleeps: []time.Duration{200 * time.Millisecond},
-		},
-		{
-			name:       "zero delay skips sleep",
-			delay:      "0",
-			wantSleeps: nil,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			caller := &pagedCommandCaller{steps: []scriptedToolStep{
-				{text: `{"result":{"messages":[{"id":"m1"}],"hasMore":true,"nextCursor":"c2"}}`},
-				{text: `{"result":{"messages":[{"id":"m2"}],"hasMore":false,"nextCursor":""}}`},
-			}}
-			var sleeps []time.Duration
-			got, _, err := runPagedCommandTestWithSleep(t, caller, pagedCommandMessagesConfig(nil), func(d time.Duration) {
-				sleeps = append(sleeps, d)
-			}, "--page-all", "--page-delay", tt.delay)
-			if err != nil {
-				t.Fatal(err)
-			}
-			items := got["result"].(map[string]any)["messages"].([]any)
-			if len(items) != 2 || len(caller.calls) != 2 {
-				t.Fatalf("items=%#v calls=%#v", items, caller.calls)
-			}
-			if len(sleeps) != len(tt.wantSleeps) {
-				t.Fatalf("sleeps=%v, want %v", sleeps, tt.wantSleeps)
-			}
-			for i := range tt.wantSleeps {
-				if sleeps[i] != tt.wantSleeps[i] {
-					t.Fatalf("sleeps=%v, want %v", sleeps, tt.wantSleeps)
-				}
-			}
-		})
-	}
-}
-
-func TestPagedMCPCommandMaxItemsTruncatesPrecisely(t *testing.T) {
-	caller := &pagedCommandCaller{steps: []scriptedToolStep{
-		{text: `{"result":{"messages":[{"id":"m1"},{"id":"m2"}],"hasMore":true,"nextCursor":"c2"}}`},
-	}}
-	got, _, err := runPagedCommandTest(t, caller, pagedCommandMessagesConfig(nil), "--page-all", "--max-items", "1", "--page-delay", "0")
-	if err != nil {
-		t.Fatal(err)
-	}
-	items := got["result"].(map[string]any)["messages"].([]any)
-	paging := got["paging"].(map[string]any)
-	if len(items) != 1 || paging["total"].(float64) != 1 || paging["truncated"] != true {
-		t.Fatalf("result = %#v", got)
-	}
-}
-
-func TestPagedMCPCommandMaxItemsStopsWhenPageExactlyReachesLimit(t *testing.T) {
-	caller := &pagedCommandCaller{steps: []scriptedToolStep{
-		{text: `{"result":{"messages":[{"id":"m1"},{"id":"m2"}],"hasMore":true,"nextCursor":"c2"}}`},
-		{err: errors.New("second page should not run")},
-	}}
-
-	got, _, err := runPagedCommandTest(t, caller, pagedCommandMessagesConfig(nil), "--page-all", "--max-items", "2", "--page-delay", "0")
-	if err != nil {
-		t.Fatal(err)
-	}
-	items := got["result"].(map[string]any)["messages"].([]any)
-	result := got["result"].(map[string]any)
-	paging := got["paging"].(map[string]any)
-	if len(caller.calls) != 1 || len(items) != 2 {
-		t.Fatalf("calls=%#v items=%#v, want one full page", caller.calls, items)
-	}
-	if paging["truncated"] != true || paging["hasMore"] != true || paging["lastCursor"] != "c2" {
-		t.Fatalf("paging=%#v, want safe page-boundary cursor", paging)
-	}
-	if result["hasMore"] != true || result["nextCursor"] != "c2" {
-		t.Fatalf("result=%#v, want safe page-boundary cursor fields", result)
-	}
-	if _, ok := paging["truncatedWithinPage"]; ok {
-		t.Fatalf("paging=%#v, want no within-page truncation marker", paging)
-	}
-}
-
-func TestPagedMCPCommandMaxItemsWithinPageKeepsCurrentCursor(t *testing.T) {
-	caller := &pagedCommandCaller{steps: []scriptedToolStep{
-		{text: `{"result":{"messages":[{"id":"m1"},{"id":"m2"}],"hasMore":true,"nextCursor":"c2"}}`},
-	}}
-
-	got, _, err := runPagedCommandTest(t, caller, pagedCommandMessagesConfig(nil), "--page-all", "--max-items", "1", "--page-delay", "0")
-	if err != nil {
-		t.Fatal(err)
-	}
-	items := got["result"].(map[string]any)["messages"].([]any)
-	result := got["result"].(map[string]any)
-	paging := got["paging"].(map[string]any)
-	if len(items) != 1 || paging["lastCursor"] != "0" {
-		t.Fatalf("result=%#v, want current-page cursor after within-page truncation", got)
-	}
-	if result["hasMore"] != true || result["nextCursor"] != "0" {
-		t.Fatalf("result=%#v, want unreliable current-page cursor fields", result)
-	}
-	if paging["truncatedWithinPage"] != true || paging["resumeCursorReliable"] != false {
-		t.Fatalf("paging=%#v, want unreliable resume marker", paging)
-	}
-}
-
-func TestPagedCollectionTruncateReturnsFalseWhenLimitDoesNotTrim(t *testing.T) {
-	collection := newPagedCollection(PagedMCPCommandConfig{})
-	if err := collection.Add([]any{map[string]any{"id": "m1"}}); err != nil {
-		t.Fatal(err)
-	}
-
-	if collection.Truncate(0) {
-		t.Fatal("Truncate(0) should not trim")
-	}
-	if collection.Truncate(1) {
-		t.Fatal("Truncate(total) should not trim")
-	}
-	if collection.Total() != 1 || len(collection.Values()) != 1 {
-		t.Fatalf("collection=%#v, want unchanged single item", collection.Values())
-	}
-}
-
-func TestPagedMCPCommandConversationMessagesMaxItemsWithinPageKeepsCurrentCursor(t *testing.T) {
-	caller := &pagedCommandCaller{steps: []scriptedToolStep{
-		{text: `{"result":{"conversationMessagesList":[{"openConversationId":"cid1","messages":[{"id":"m1"},{"id":"m2"}]}],"hasMore":true,"nextCursor":"c2"}}`},
-	}}
-
-	got, _, err := runPagedCommandTest(t, caller, pagedCommandConversationMessagesConfig(nil), "--page-all", "--max-items", "1", "--page-delay", "0")
-	if err != nil {
-		t.Fatal(err)
-	}
-	conversations := got["result"].(map[string]any)["conversationMessagesList"].([]any)
-	messages := conversations[0].(map[string]any)["messages"].([]any)
-	paging := got["paging"].(map[string]any)
-	if len(messages) != 1 || paging["lastCursor"] != "0" {
-		t.Fatalf("result=%#v, want truncated conversation with current-page cursor", got)
-	}
-	if paging["truncatedWithinPage"] != true || paging["resumeCursorReliable"] != false {
-		t.Fatalf("paging=%#v, want unreliable resume marker", paging)
-	}
-}
-
-func TestPagedMCPCommandPassesCommandContextToCaller(t *testing.T) {
-	ctx, cancel := context.WithCancel(context.Background())
-	cancel()
-	caller := &pagedCommandCaller{steps: []scriptedToolStep{
-		{text: `{"result":{"messages":[{"id":"m1"}],"hasMore":false,"nextCursor":""}}`},
-	}}
-
-	out, _, err := executePagedCommandTestWithContext(t, ctx, caller, pagedCommandMessagesConfig(nil), func(time.Duration) {}, &bytes.Buffer{}, "--page-all", "--page-delay", "0")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if strings.TrimSpace(out) == "" || len(caller.calls) != 1 {
-		t.Fatalf("stdout=%q calls=%#v, want one successful call", out, caller.calls)
-	}
-	if caller.calls[0].ctx != ctx || caller.calls[0].ctx.Err() != context.Canceled {
-		t.Fatalf("call ctx=%#v err=%v, want canceled command context", caller.calls[0].ctx, caller.calls[0].ctx.Err())
-	}
-}
-
-func TestPagedMCPCommandPageDelayStopsWhenContextCanceled(t *testing.T) {
-	ctx, cancel := context.WithCancel(context.Background())
-	cancel()
-	caller := &pagedCommandCaller{steps: []scriptedToolStep{
-		{text: `{"result":{"messages":[{"id":"m1"}],"hasMore":true,"nextCursor":"c2"}}`},
-		{text: `{"result":{"messages":[{"id":"m2"}],"hasMore":false,"nextCursor":""}}`},
-	}}
-	var out bytes.Buffer
-
-	stdout, stderr, err := executePagedCommandTestWithContext(t, ctx, caller, pagedCommandMessagesConfig(nil), nil, &out, "--page-all", "--page-delay", "10")
-	if strings.TrimSpace(stdout) == "" {
-		t.Fatal("stdout is empty, want partial pagination JSON")
-	}
-	if err == nil || !errors.Is(err, context.Canceled) {
-		t.Fatalf("err=%v, want context canceled", err)
-	}
-	if !strings.Contains(stderr, "pagination stopped at page 2") || len(caller.calls) != 1 {
-		t.Fatalf("stderr=%q calls=%#v, want cancellation before second call", stderr, caller.calls)
-	}
-	var got map[string]any
-	if unmarshalErr := json.Unmarshal([]byte(stdout), &got); unmarshalErr != nil {
-		t.Fatalf("stdout JSON = %q, err = %v", stdout, unmarshalErr)
-	}
-	paging := got["paging"].(map[string]any)
-	if paging["partial"] != true || paging["failedPage"].(float64) != 2 || paging["itemsFetched"].(float64) != 1 {
-		t.Fatalf("paging=%#v, want partial cancellation metadata", paging)
-	}
-}
-
-func TestPagedMCPCommandPropagatesAggregatedOutputErrors(t *testing.T) {
-	tests := []struct {
-		name       string
-		steps      []scriptedToolStep
-		args       []string
-		wantStderr string
-	}{
-		{
-			name: "normal end",
-			steps: []scriptedToolStep{
-				{text: `{"result":{"messages":[{"id":"m1"}],"hasMore":false,"nextCursor":""}}`},
-			},
-			args: []string{"--page-all", "--page-delay", "0"},
-		},
-		{
-			name: "max items truncation",
-			steps: []scriptedToolStep{
-				{text: `{"result":{"messages":[{"id":"m1"},{"id":"m2"}],"hasMore":true,"nextCursor":"c2"}}`},
-			},
-			args: []string{"--page-all", "--max-items", "1", "--page-delay", "0"},
-		},
-		{
-			name: "page limit truncation",
-			steps: []scriptedToolStep{
-				{text: `{"result":{"messages":[{"id":"m1"}],"hasMore":true,"nextCursor":"c2"}}`},
-			},
-			args: []string{"--page-all", "--page-limit", "1", "--page-delay", "0"},
-		},
-		{
-			name: "partial result after later failure",
-			steps: []scriptedToolStep{
-				{text: `{"result":{"messages":[{"id":"m1"}],"hasMore":true,"nextCursor":"c2"}}`},
-				{err: errors.New("page failed")},
-			},
-			args:       []string{"--page-all", "--page-delay", "0"},
-			wantStderr: "pagination stopped at page 2",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			// TC-output-error: aggregate stdout write failures must fail the command.
-			caller := &pagedCommandCaller{steps: tt.steps}
-			_, stderr, err := executePagedCommandTest(t, caller, pagedCommandMessagesConfig(nil), func(time.Duration) {}, failingWriter{}, tt.args...)
-			if err == nil || !strings.Contains(err.Error(), "write failed") {
-				t.Fatalf("err=%v, want propagated write failure", err)
-			}
-			if tt.wantStderr != "" && !strings.Contains(stderr, tt.wantStderr) {
-				t.Fatalf("stderr=%q, want %q", stderr, tt.wantStderr)
-			}
-		})
-	}
-}
-
-func TestPagedMCPCommandInt64CursorAndItemsPath(t *testing.T) {
-	caller := &pagedCommandCaller{steps: []scriptedToolStep{
-		{text: `{"result":{"items":[{"id":"f1"}],"hasMore":true,"nextCursor":20}}`},
-		{text: `{"result":{"items":[{"id":"f2"}],"hasMore":false,"nextCursor":0}}`},
-	}}
-	cfg := PagedMCPCommandConfig{
-		ServerID:    "im",
-		ToolName:    "list_message_favorites",
-		ItemPath:    "result.items",
-		CursorPath:  "result.nextCursor",
-		HasMorePath: "result.hasMore",
-		CursorArg:   "cursor",
-		CursorKind:  PagedCursorInt64,
-		BuildArgs: func(cmd *cobra.Command) (map[string]any, error) {
-			return map[string]any{"cursor": int64(0), "size": "20"}, nil
-		},
-		Fallback: func(map[string]any) error { return nil },
-	}
-	got, _, err := runPagedCommandTest(t, caller, cfg, "--page-all", "--page-delay", "0")
-	if err != nil {
-		t.Fatal(err)
-	}
-	items := got["result"].(map[string]any)["items"].([]any)
-	if len(items) != 2 || caller.calls[1].args["cursor"] != int64(20) {
-		t.Fatalf("items=%#v calls=%#v", items, caller.calls)
-	}
-}
-
-func TestPagedMCPCommandInt64CursorRejectsNonNumericNextCursor(t *testing.T) {
-	caller := &pagedCommandCaller{steps: []scriptedToolStep{
-		{text: `{"result":{"items":[{"id":"f1"}],"hasMore":true,"nextCursor":"not-a-number"}}`},
-	}}
-	cfg := PagedMCPCommandConfig{
-		ServerID:    "im",
-		ToolName:    "list_message_favorites",
-		ItemPath:    "result.items",
-		CursorPath:  "result.nextCursor",
-		HasMorePath: "result.hasMore",
-		CursorArg:   "cursor",
-		CursorKind:  PagedCursorInt64,
-		BuildArgs: func(cmd *cobra.Command) (map[string]any, error) {
-			return map[string]any{"cursor": int64(0), "size": "20"}, nil
-		},
-		Fallback: func(map[string]any) error { return nil },
-	}
-	got, stderr, err := runPagedCommandTest(t, caller, cfg, "--page-all", "--page-delay", "0")
-	if err == nil || !strings.Contains(err.Error(), "base-10 int64 string") {
-		t.Fatalf("err=%v, want invalid int64 cursor error", err)
-	}
-	if !strings.Contains(stderr, "pagination stopped at page 2") {
-		t.Fatalf("stderr=%q", stderr)
-	}
-	paging := got["paging"].(map[string]any)
-	if paging["partial"] != true || paging["failedCursor"] != "not-a-number" || paging["pagesFetched"].(float64) != 1 {
-		t.Fatalf("paging = %#v", paging)
-	}
-	if len(caller.calls) != 1 {
-		t.Fatalf("calls=%#v, want no second call with cursor 0", caller.calls)
-	}
-}
-
-func TestPagedMCPCommandFirstPageFailureReturnsNoPartial(t *testing.T) {
-	caller := &pagedCommandCaller{steps: []scriptedToolStep{{err: errors.New("boom")}}}
-	got, _, err := runPagedCommandTest(t, caller, pagedCommandMessagesConfig(nil), "--page-all")
-	if err == nil || got != nil {
-		t.Fatalf("result=%#v err=%v, want first-page error without stdout", got, err)
-	}
-}
-
-func TestPagedMCPCommandLaterFailureOutputsPartial(t *testing.T) {
-	caller := &pagedCommandCaller{steps: []scriptedToolStep{
-		{text: `{"result":{"messages":[{"id":"m1"}],"hasMore":true,"nextCursor":"c2"}}`},
-		{err: errors.New("page failed")},
-	}}
-	got, stderr, err := runPagedCommandTest(t, caller, pagedCommandMessagesConfig(nil), "--page-all", "--page-delay", "0")
-	if err == nil || !strings.Contains(stderr, "pagination stopped") {
-		t.Fatalf("err=%v stderr=%q", err, stderr)
-	}
-	paging := got["paging"].(map[string]any)
-	if paging["partial"] != true || paging["failedPage"].(float64) != 2 || paging["itemsFetched"].(float64) != 1 {
-		t.Fatalf("paging = %#v", paging)
-	}
-}
-
-func TestPagedMCPCommandCursorCycleOutputsPartial(t *testing.T) {
-	caller := &pagedCommandCaller{steps: []scriptedToolStep{
-		{text: `{"result":{"messages":[{"id":"m1"}],"hasMore":true,"nextCursor":"0"}}`},
-	}}
-	got, _, err := runPagedCommandTest(t, caller, pagedCommandMessagesConfig(nil), "--page-all", "--page-delay", "0")
-	if err == nil {
-		t.Fatal("cursor cycle should return error")
-	}
-	paging := got["paging"].(map[string]any)
-	if paging["partial"] != true || paging["pagesFetched"].(float64) != 1 {
-		t.Fatalf("paging = %#v", paging)
-	}
-}
-
-func TestPagedMCPCommandSetJSONPathRejectsNonObjectIntermediate(t *testing.T) {
-	root := map[string]any{"result": "not-object"}
-
-	if setJSONPath(root, "result.messages", []any{}) {
-		t.Fatal("setJSONPath should reject a non-object intermediate")
-	}
-	if root["result"] != "not-object" {
-		t.Fatalf("root=%#v, want original intermediate preserved", root)
-	}
-}
-
-func TestPagedMCPCommandCursorValueKeyCoversBoundaryKinds(t *testing.T) {
-	if got := cursorValueKey(7, PagedCursorInt64); got != "7" {
-		t.Fatalf("int cursor key=%q, want 7", got)
-	}
-	if got := cursorValueKey(nil, PagedCursorString); got != "" {
-		t.Fatalf("nil string cursor key=%q, want empty", got)
-	}
-}
-
-func TestPagedMCPCommandNormalizeCursorArgCoversBoundaryKinds(t *testing.T) {
-	tests := []struct {
-		name    string
-		value   any
-		kind    PagedCursorKind
-		want    any
-		wantErr string
-	}{
-		{
-			name:  "nil string cursor",
-			value: nil,
-			kind:  PagedCursorString,
-			want:  "",
-		},
-		{
-			name:  "int64 cursor",
-			value: int64(9),
-			kind:  PagedCursorInt64,
-			want:  int64(9),
-		},
-		{
-			name:  "int cursor",
-			value: 10,
-			kind:  PagedCursorInt64,
-			want:  int64(10),
-		},
-		{
-			name:  "numeric string cursor",
-			value: " 11 ",
-			kind:  PagedCursorInt64,
-			want:  int64(11),
-		},
-		{
-			name:    "fractional float cursor",
-			value:   1.5,
-			kind:    PagedCursorInt64,
-			wantErr: "must be an integer",
-		},
-		{
-			name:    "unsupported cursor type",
-			value:   []string{"bad"},
-			kind:    PagedCursorInt64,
-			wantErr: "int64-compatible",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			got, err := normalizeCursorArg(tt.value, tt.kind)
-			if tt.wantErr != "" {
-				if err == nil || !strings.Contains(err.Error(), tt.wantErr) {
-					t.Fatalf("value=%#v err=%v, want %q", tt.value, err, tt.wantErr)
-				}
-				return
-			}
-			if err != nil {
-				t.Fatal(err)
-			}
-			if got != tt.want {
-				t.Fatalf("value=%#v got=%#v, want %#v", tt.value, got, tt.want)
-			}
-		})
-	}
-}
@@ -31,17 +31,6 @@ func executePR868Command(t *testing.T, root *cobra.Command, args ...string) erro
 }

 func TestCrossPlatformCoverageMinutesNewSurfaces(t *testing.T) {
-	t.Run("permission add requires explicit policy", func(t *testing.T) {
-		caller := &scriptedToolCaller{}
-		installScriptedCaller(t, caller)
-		err := executePR868Command(t, newMinutesCommand(), "permission", "add", "--ids", "task-1", "--member-uids", "user-1")
-		if err == nil || !strings.Contains(err.Error(), "--policy") {
-			t.Fatalf("permission add without --policy error = %v", err)
-		}
-		if caller.calls != 0 {
-			t.Fatalf("permission add called MCP %d times before required policy validation", caller.calls)
-		}
-	})
 	t.Run("hot-word delete dry-run", func(t *testing.T) {
 		installScriptedCaller(t, &scriptedToolCaller{dry: true, format: "json"})
 		if err := executePR868Command(t, newMinutesCommand(), "hot-word", "delete", "--words", "钉钉,OKR"); err != nil {
@@ -102,21 +91,6 @@ func TestCrossPlatformCoverageMinutesNewSurfaces(t *testing.T) {
 			t.Fatal("expected missing policy")
 		}
 	})
-	t.Run("permission apply policy flag is int", func(t *testing.T) {
-		// 数值参数声明为 int 类型 flag；必填校验走 cmd.Flags().Changed，
-		// 不能用 validateRequiredFlags（它把 int 零值当成未传）。
-		cmd, _, err := newMinutesCommand().Find([]string{"permission", "apply"})
-		if err != nil {
-			t.Fatalf("find permission apply: %v", err)
-		}
-		flag := cmd.Flags().Lookup("policy")
-		if flag == nil {
-			t.Fatal("flag --policy not found")
-		}
-		if flag.Value.Type() != "int" {
-			t.Fatalf("flag --policy type = %q, want %q", flag.Value.Type(), "int")
-		}
-	})

 	t.Run("audio-memo list default", func(t *testing.T) {
 		caller := &scriptedToolCaller{steps: []scriptedToolStep{{text: `{"items":[]}`}}}
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
玉澜	5f7db84d47	fix(devapp): restore paginated mock contracts	2026-08-10 16:41:08 +08:00
玉澜	a023a2956a	Merge remote-tracking branch 'upstream/main' into codex/issue-917-devapp-pagination-contract # Conflicts: # CHANGELOG.md	2026-08-10 16:38:23 +08:00
玉澜	e023be1444	fix(devapp): preserve pagination across list shortcuts	2026-08-10 15:50:34 +08:00
修雨	7cc8db4eb0	fix(devapp): preserve list pagination contract	2026-08-09 08:03:16 +08:00