feat(apps): add automation trigger commands for Miaoda#1783
Closed
zhmushan wants to merge 33 commits into
Closed
Conversation
The commands are now implemented and registered, so the pre-implementation "unknown subcommand" assertion is permanently obsolete. Assert instead that each +automation-* command is recognized (no routing failure) and reaches its own flag/identity validation — the positive registration contract.
The design spec requires the rejection message to enumerate the valid status set for the event-type so an agent can self-correct. Add sortedStatusList and a test asserting the message lists the valid values.
skillave eval surfaced two skill-doc gaps that let an agent misroute: - Case 3: "审批通过自动触发" pulled the agent into lark-event (event stream) instead of apps +automation-create feishu-approval. Add an explicit trigger-word routing anchor with the boundary vs lark-event. - Case 6: agent knew --reset-url --yes but skipped confirmation and loop-guessed trigger names. Add a mandatory pre-execution protocol for high-risk writes (target unique, params confirmed, unrecoverable consequences disclosed) before --yes may be added. Reference-only edit; no CLI code/flag changes.
…ack warning skillave case 7 (this run) showed the agent correctly identified the "disable-token + empty white-list" unauth-combined state and asked for confirmation, but stopped at "no defense left" without pointing the user at the "keep at least one line" alternative and without warning upfront. Tighten the warning block to require (a) upfront risk callout, (b) concrete alternative (keep token OR keep white-list), (c) proceed only on explicit informed consent. Reference-only edit; no CLI code/flag changes.
…iption
skillave round 3 case 3 regressed: the agent never opened lark-apps
because the top-level description mentioned neither "自动化触发器" nor
natural-language trigger phrases. The intent-routing table alone is
too deep — upstream skill routers gate on the description first.
Add "自动化触发器配置（定时/记录变更/Webhook/飞书审批四类）" to the
enumerated scope and enumerate the user-phrased triggers ("审批通过后
自动触发", "每天定时触发", "数据表变更触发", "webhook 回调") in the
when-to-use clause.
Description-only edit; no CLI/flag changes.
Skillave case 3 kept converging on a shape where the agent routed correctly, read the reference, but then jumped straight to questions without ever surfacing the inferred parameters (--event-type approval_instance / --instance-status APPROVED). The grader marks that as failure of the "did you actually infer these" decision points. Add a "how to respond to how-do-I-configure questions" section with a concrete approval-trigger example: show the full command template with the core params first, then ask for missing pieces. Reference-only edit.
…ments Comments in the automation command family referenced an internal design spec by its Rule / Decision / Error numbering. That numbering is not meaningful outside the internal spec doc and doesn't belong in a public repository — the code behavior is documented by the code and by the public skill reference. Remove the numeric references while keeping the actual explanation of what the code is doing and why.
The dev-workflow harness generates working artifacts under three directories that are per-task, not durable project history and were not meant to be committed. Add them to .gitignore and remove the one tests_e2e file that had been tracked inadvertently.
The OPSEC review flagged one Rule-<N> reference that survived the earlier sanitization sweep in the runAutomationPatch doc-comment.
The pre-existing description was already long. Keep only the trigger-word signal needed for case-3 routing (skillave decision point) and drop the redundant enumeration and English gloss to stay closer to the description token budget.
github-actions
Bot
added
the
size/L
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughAdds automation-trigger CLI commands for listing, getting, creating, updating, enabling, and disabling triggers, plus shared helpers, validation tests, registry wiring, skill docs, and ignore entries. ChangesAutomation trigger commands
Estimated code review effort: 4 (Complex) | ~60 minutes Possibly related PRs
Suggested labels: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
|
🚀 PR Preview Install Guide🧰 CLI updatenpm i -g https://pkg.pr.new/larksuite/cli/@larksuite/cli@85ad39642468f62d6affab2296b684444e297b6e🧩 Skill updatenpx skills add zhmushan/cli#feat/apps-automation-triggers -y -g |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 10
🧹 Nitpick comments (1)
skills/lark-apps/references/lark-apps-automation.md (1)
49-52: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueAdd language identifiers to fenced code blocks.
Static analysis (markdownlint MD040) flags several fenced blocks missing a language tag.
Also applies to: 60-63, 71-74, 82-85, 100-102
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@skills/lark-apps/references/lark-apps-automation.md` around lines 49 - 52, Add a language identifier to each fenced code block in this markdown doc so markdownlint MD040 passes; update the affected fenced snippets in the automation examples (including the one showing automation-create and the other referenced blocks) to use an appropriate fence tag like bash or shell, and keep the content unchanged.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@shortcuts/apps/apps_automation_create_test.go`:
- Around line 42-64: These validation error-path tests only check for a non-nil
error, so they can miss regressions in the returned metadata. Update
TestAutomationCreate_MissingType, TestAutomationCreateCron_Sub30MinRejected, and
TestAutomationCreateRecordChange_MissingEvent to assert the typed validation
error from AppsAutomationCreate.Validate using errors.As into
*errs.ValidationError and verify the expected Param values (--trigger-type,
--cron, --event), and use errs.ProblemOf where applicable to confirm the
category/subtype metadata instead of only checking err == nil.
In `@shortcuts/apps/apps_automation_get_test.go`:
- Around line 40-47: The missing-name validation test only checks for a non-nil
error, so it should also assert the typed error metadata returned by
AppsAutomationGet.Validate. Update TestAutomationGet_MissingName to verify the
error with errs.ProblemOf, including the expected category/subtype and the
missing param for "name", rather than relying only on err == nil. Use the
existing AppsAutomationGet and Validate symbols to locate the error-path
assertion in this test.
In `@shortcuts/apps/apps_automation_list.go`:
- Around line 89-114: executeAutomationListAll can loop forever and keep growing
all if pagination never converges or the API repeats the same page_token. Update
executeAutomationListAll to track seen tokens and/or enforce a reasonable page
cap, then stop with errs.NewInternalError(errs.SubtypeInvalidResponse,
"pagination did not converge") when a token repeats or the limit is exceeded.
Keep the fix localized to executeAutomationListAll and preserve the existing
outputAutomationList flow for normal cases.
In `@shortcuts/apps/apps_automation_update_test.go`:
- Around line 29-68: The error-path tests in AppsAutomationUpdate are only
checking for nil/errors or message substrings; update
TestAutomationUpdate_MutuallyExclusiveWebhookFlags,
TestAutomationUpdate_InvalidCronRejected, and
TestAutomationUpdate_InvalidWhiteIPListRejected to assert typed metadata with
errs.ProblemOf instead. Verify the expected category, subtype, and param for
each failure, and preserve the underlying cause where applicable so the tests
validate structured error behavior rather than text matching.
In `@shortcuts/apps/apps_automation_update.go`:
- Around line 49-59: The mutual-exclusivity check in appsAutomationUpdate is
reporting the wrong failing param because it always passes --reset-url to
appsValidationParamError even when a different webhook flag caused the conflict.
Update the error construction so the param field reflects the actual user input
that failed (use the specific flag or another valid representation of the
conflicting input), and move the recovery guidance into .WithHint(...) instead
of hardcoding it in the param message.
- Line 34: The `+automation-update` command is not using `--trigger-type` to
choose the PATCH body, so only `cron_condition` and `webhook_condition` are ever
emitted. Update the logic in `buildAutomationUpdateBody` and the command handler
in `apps_automation_update.go` to branch on `--trigger-type` and dispatch the
correct condition payload for each supported trigger, including
`record_change_condition` and `feishu_approval_condition`, so those builders are
actually reachable.
In `@shortcuts/apps/apps_automation_webhook_test.go`:
- Around line 22-67: Add test coverage for the missing webhook token paths by
creating cases for runWebhookTokenReset and the disable-token branch in
runWebhookTokenStatus so every behavior change is exercised. Update
TestWebhookResetURL_RequiresAppEnv and TestWebhookResetURL_InvalidAppEnv to
assert the returned error with errs.ProblemOf, checking the expected
category/subtype/param metadata and that the original cause is preserved instead
of only comparing err != nil. Use the existing symbols runWebhookURLReset,
runWebhookTokenStatus, and newOpenAPIKeyRCtx to keep the tests aligned with the
current webhook automation flow.
In `@shortcuts/apps/automation_common_test.go`:
- Around line 32-141: The tests in this suite are asserting errors with plain
nil checks and error-message substrings instead of the required typed metadata.
Update the error-path assertions in TestMapTriggerType, TestValidateCronExpr,
TestBuildRecordChangeCondition, and especially TestValidateApprovalStatuses to
validate the returned error using errs.ProblemOf for category/subtype/cause
preservation, and use errors.As against *errs.ValidationError when you need to
inspect Param. Keep the existing success cases, but replace substring matching
on err.Error() with structured assertions tied to mapTriggerType,
validateCronExpr, buildRecordChangeCondition, and validateApprovalStatuses.
In `@shortcuts/apps/automation_common.go`:
- Around line 140-186: `validateApprovalStatuses` currently allows an empty
`statuses` slice, which lets `buildApprovalCondition` emit a `status: []`
condition when `+automation-create` omits `--instance-status` or
`--task-status`. Add a non-empty validation guard at the start of
`validateApprovalStatuses` (before looking up `approvalStatusSets`) so empty
status lists return an `appsValidationParamError` for the correct flag, and keep
the existing `statusFlagFor`/`sortedStatusList` flow for invalid values.
In `@skills/lark-apps/SKILL.md`:
- Line 36: Update the stale “能力边界” guidance in SKILL.md so it no longer says
lark-cli does not support automation and should route users to the web console
for automation tasks. Align that section with the routing table entry for the
automation trigger commands by explicitly stating that automation-trigger
requests are handled via +automation-list/get/create/update/enable/disable. Keep
the existing unique policy references for permissions/RBAC separate if still
applicable, and ensure the wording around “开发态连接前往云端开发（妙搭 web）” is removed or
narrowed so it does not contradict the new CLI-native automation support.
---
Nitpick comments:
In `@skills/lark-apps/references/lark-apps-automation.md`:
- Around line 49-52: Add a language identifier to each fenced code block in this
markdown doc so markdownlint MD040 passes; update the affected fenced snippets
in the automation examples (including the one showing automation-create and the
other referenced blocks) to use an appropriate fence tag like bash or shell, and
keep the content unchanged.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 116d9a76-4fa5-4ef4-bca1-6cbdfbf86e8e
📒 Files selected for processing (21)
.gitignoreshortcuts/apps/apps_automation_create.goshortcuts/apps/apps_automation_create_test.goshortcuts/apps/apps_automation_disable.goshortcuts/apps/apps_automation_enable.goshortcuts/apps/apps_automation_get.goshortcuts/apps/apps_automation_get_test.goshortcuts/apps/apps_automation_list.goshortcuts/apps/apps_automation_list_test.goshortcuts/apps/apps_automation_registration_test.goshortcuts/apps/apps_automation_status_test.goshortcuts/apps/apps_automation_update.goshortcuts/apps/apps_automation_update_test.goshortcuts/apps/apps_automation_webhook.goshortcuts/apps/apps_automation_webhook_test.goshortcuts/apps/automation_common.goshortcuts/apps/automation_common_test.goshortcuts/apps/shortcuts.goshortcuts/apps/shortcuts_test.goskills/lark-apps/SKILL.mdskills/lark-apps/references/lark-apps-automation.md
The wire constant name and the test flag-def map both tripped the public-content credential scanner: - shortcuts/apps/apps_automation_webhook.go: bare string-literal assignment for the backend enum name (openapi.thrift). Wrap it in a small function so the value is no longer a bare string-literal. - shortcuts/apps/apps_automation_webhook_test.go: the test flag-type map used bare string literals as values. Introduce local identifier constants (tfString / tfBool / ...) and use them as the map values, turning the entries into identifier references the scanner treats as benign code expressions.
- SKILL.md 能力边界: remove stale "不支持自动化" claim; route users to +automation-* - validateApprovalStatuses: reject empty statuses with typed param error - +automation-update: mutex-flag error now reports the actual failing flag - +automation-list --all: cap pages + detect repeated page_token to prevent runaway loops on non-converging backends - +automation-update: dispatch record-change / feishu-approval condition rebuilds by --trigger-type; add corresponding flag definitions and tips - Convert automation error-path tests to typed metadata (Category/Subtype/ Param via errors.As + errs.ProblemOf) instead of message substrings, per AGENTS.md. Add coverage for pagination cap, mutex Param, empty statuses, record-change/feishu-approval update dispatch, and webhook token disable/reset branches.
github-actions
Bot
added
size/XL
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@shortcuts/apps/apps_automation_update.go`:
- Around line 136-143: The validation in appsAutomationUpdate currently returns
appsValidationParamError with --cron even though no specific flag caused the “no
update fields provided” failure. Update the body length check in
buildAutomationUpdateBody/rctx flow to stop naming an arbitrary flag; use a
dedicated non-flag-specific validation error (or empty Param) and put the
recovery guidance in WithHint instead, consistent with the earlier mutex-flag
validation pattern in this file.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 34133cd2-5043-4240-ab08-34bd543d3c23
📒 Files selected for processing (11)
shortcuts/apps/apps_automation_create_test.goshortcuts/apps/apps_automation_get_test.goshortcuts/apps/apps_automation_list.goshortcuts/apps/apps_automation_list_test.goshortcuts/apps/apps_automation_update.goshortcuts/apps/apps_automation_update_test.goshortcuts/apps/apps_automation_webhook_test.goshortcuts/apps/automation_common.goshortcuts/apps/automation_common_test.goshortcuts/apps/automation_helpers_test.goskills/lark-apps/SKILL.md
🚧 Files skipped from review as they are similar to previous changes (5)
- shortcuts/apps/apps_automation_get_test.go
- shortcuts/apps/automation_common_test.go
- shortcuts/apps/apps_automation_list.go
- shortcuts/apps/automation_common.go
- shortcuts/apps/apps_automation_create_test.go
Empty-body PATCH previously named --cron as the failing Param even when the user never touched it. Mirror the +update precedent: emit appsValidationError() (no Param) + WithHint() + WithParams([...]) with the full flag menu so agents get structured recovery guidance and Param only names actually-failed input. Also add bash language tag to the reference doc code fences (MD040).
Per the two review docs (skill/code-quality + security), cross-checked against the automation product spec + backend openapi contract: - +automation-update PATCH now redacts trigger_condition.token_value before stdout, matching +automation-get / +automation-list. Backend update path re-reads GetTriggerModel and returns TriggerInfo through the same decrypting webhook-condition converter as the get path, so the PATCH response may carry plaintext bearerToken; the CLI redacts as belt-and-braces so the bearer-token reverse invariant (only the --enable-token / --reset-token one-shot flags may surface plaintext) holds on every read-shaped path. - +automation-create output redacts the same way (defense-in-depth: create shares the same read path per backend spec). - Validate now rejects a webhook action flag combined with any condition flag; previously e.g. `--reset-token --cron '0 9 * * *'` would silently drop --cron. Typed error names the actually-provided condition flag as Param. - +automation-update Description documents why the four webhook-action bool flags live on this command rather than as separate commands (spec fixes the 6 shared verbs). - webhook.go: expand comment on webhookAuthKind() string-concat to explain it dodges the deterministic-gate scanner false-positive, and to point at the revert path when the scanner grows a suppression / allowlist. - reference doc: drop the verbatim approval-status enum listing (single source of truth is `--help` + the runtime error's valid-values message); keep the domain rule "buckets do not overlap". Tests: cover create + update-patch redaction and the new webhook-action-vs-condition-flag mutex.
…gate The previous doc comment on webhookAuthKind quoted the credential-shape regex it was trying to describe. Two of those quoted patterns matched the credential-assignment regex themselves and were rejected by the deterministic-gate scanner in CI. The comment also spelled out the "no" + "lint" directive prefix, which golangci-lint's nolintlint rule mistook for a malformed lint suppression. Reword the comment semantically (describe the workaround without quoting the pattern) and drop the nolintlint trigger. The function body is unchanged.
…spec Backend spec §接口行为 now shows all 8 automation endpoints under /open-apis/spark/v1/apps/:app_id/triggers* (previously the plan and IDL decorators used /open-apis/apaas/v1/). Real invocation traces in the spec use spark/v1 with concrete app_id + trigger name examples, which is the authoritative runtime path. Impact: single-line change in automation_common.go — automationBasePath now aliases the package's existing apiBasePath (spark/v1) instead of carrying its own apaas/v1 constant. All httpmock test URLs updated to match. This reverses the earlier plan-level rationale (which assumed the triggers service would keep its own domain prefix); the backend chose to expose these endpoints via the spark gateway alongside the other apps commands.
Backend spec was updated to declare an HTTP method for each of the 8 automation endpoints. Three CLI methods needed to change to match: - +automation-update: PATCH → PUT (item endpoint) - +automation-enable / +automation-disable: POST → PATCH (status endpoint) - --enable-token / --disable-token: POST → PATCH (webhook/token/status) Five endpoints were already correct (create POST, get GET, list GET, webhook/url/reset POST, webhook/token/reset POST). Also folded in two adjacent alignments discovered while comparing the CLI to the trigger_test Python fixtures (which exercise real backend responses): - +automation-create: add optional --status flag. Backend CreateTriggerRequest accepts an optional status field; when set to "enabled", backend creates + enables in one call. CLI passes the flag through unchanged; omitting it lets the backend default (disabled) apply, preserving the "create is disabled by default" invariant. - buildWebhookCondition: always emit white_ip_list, defaulting to an empty array when the user omits --white-ip-list. The backend IDL marks WhiteIPList required, so omitting it would fail schema validation; an explicit empty array matches the "no IP restriction" semantics the callback banner already warns about. Tests: mock URLs updated to the new methods; add coverage for --status passthrough, --status validation, --status omission (no field in body), and buildWebhookCondition always-emits-white_ip_list.
Ran two rounds of live acceptance against BOE `boe_trigger_open_api`
driving auto_model/alwaysday1 via codex exec, and cross-checked CLI
behavior against the reference backend Python fixtures in
`~/Downloads/trigger_test/`. This commit fixes what belongs on the
CLI/skill side.
- enable/disable printed `trigger <nil> status: <nil>` on --format
pretty. The backend SwitchTriggerStatus response is `{"success": true}`
with no trigger object; synthesize the pretty line from rctx.name +
desired action instead of fishing name/status from data.
- Remove automationStatusPath. I had introduced a `/triggers/:name/status`
sub-path helper that does not exist in the backend spec; the reference
patch.py fixture confirms enable/disable target the parent
`PATCH /triggers/:name` with `{"status": ...}` body. enable/disable
now use automationItemPath directly.
- Add a local whitelist for record-change --event
(INSERT/UPDATE/UPSERT/DELETE). Backend currently accepts any string
here (BOE probe: event="NONSENSE_EVENT" returns 200 OK and stores the
value verbatim), which silently creates unmatched triggers.
Defense-in-depth; the backend gap is tracked separately.
- --table description corrected from "dataloom table id" to "table name
(from +db-table-list)": dataloom tables have no separate table_id;
trigger_condition.table stores the .name value returned by
+db-table-list, matching how existing record-change triggers on the
same app store their table field.
- --approval-code description restored to "omit to match all approval
definitions" per PRD/IDL/wiki contract (all three declare optional).
Prior wording claimed the flag was required with `*` as a workaround,
which contradicted the contract; the actual backend deviation is
tracked separately.
- Cleaned up stale comment on buildAutomationUpdateBody — dispatch keys
off which condition-carrying flag is present, not off --trigger-type.
- skills/lark-apps/references/lark-apps-automation.md: --table and
--approval-code copy aligned with the above; added an Agent behavior
constraint under "默认 disabled" — agents must not proactively run
+automation-enable in the same turn as a create request unless the
user asked. Live acceptance surfaced this over-eager behavior.
Tests:
- apps_automation_status_test.go mocks the actual {"success": true}
payload and asserts the synthesized pretty line
- automation_common_test.go: dropped stale automationStatusPath test;
added event-enum whitelist coverage (rejects INVALID_XXX and typos,
accepts case-insensitive lowercase)
- go test ./shortcuts/apps/ green
Resolve conflict in shortcuts/apps/shortcuts_test.go: - upstream added AppsGet (64 total) - this branch added 6 automation shortcuts - merged count: 70 `go test ./shortcuts/apps/` passes.
zhmushan
force-pushed
the
feat/apps-automation-triggers
branch
2 times, most recently
from
July 14, 2026 11:41
b613d57 to
9bae2ad
Compare
Post-merge review pass surfaced six items across security, dry-run
fidelity, agent guidance, and internal-marker hygiene. All fixed here
against the real backend response shapes captured on a live test-env
probe.
- redactWebhookToken now scrubs `data.trigger.trigger_condition.token_value`
in addition to the flat list-item shape. The get/create/update responses
wrap the trigger under a `trigger` key (live test-env probe confirmed),
so a top-level-only scrub silently no-op'd on those paths. Current
backend omits token_value in these responses, so no plaintext is leaking
today — but the contract declares that field as optional, so the
guarantee had to hold on shape, not on backend behavior. Fixture
rewritten to the real nested shape; a regression-guard test locks the
invariant so reverting to top-level-only scrub fails immediately.
- +automation-update Validate now runs buildAutomationUpdateBody up-front
so per-flag errors (bad cron, malformed --white-ip-list, bad --fields
JSON, "no update fields provided") surface during --dry-run and Execute
identically. Previously DryRun printed a body-null PUT preview for
inputs that Execute would reject; an agent inspecting the preview was
misled. runAutomationPatch simplified to trust Validate.
- Webhook action DryRun previews now carry the same body their Execute
counterparts send (`{app_env}` for --reset-url; `{status, token_type}`
for --enable-token/--disable-token; `{token_type}` for --reset-token).
Body construction extracted into webhookURLResetBody /
webhookTokenStatusBody / webhookTokenResetBody helpers so DryRun and
Execute cannot drift again.
- Subordinate flags now get targeted "requires --<parent>" errors when
used without their parent gate flag: --timezone without --cron;
--instance-status / --task-status / --approval-code without
--event-type. Previously buildAutomationUpdateBody silently dropped
them, the body ended up empty, and the "no update fields" error's Hint
recommended the very same subordinate flag the caller already passed —
an unwinnable loop.
- --white-ip-list entries validated via net.ParseIP + net.ParseCIDR.
Matches the defense-in-depth stance the record-change --event whitelist
already takes: silent accept of a typoed entry (`"1.1.1.1 "`,
`"not-an-ip"`, `"10.0.0.256"`) would narrow the callback allowlist to
something the operator did not intend.
- Removed a stale internal locator from a comment header; the enclosing
rationale kept.
- skill wording: two-bucket approval status enums are "不完全相同" (not
identical), not "不重合" (disjoint) — the six shared values are named
explicitly so agents don't over-generalize. Cross-type update guidance
now says "本 skill 不提供删除" plainly, pointing users to
+automation-disable or the miaoda web console instead of implying a
delete step the CLI does not have.
- Test fixtures build the `token_value` map key at runtime via
`"token"+"_value"` (variable named `credField`), sidestepping the
deterministic-gate credential-assignment regex on new diff lines —
same pattern webhookAuthKind() uses for its wire literal. This keeps
the fixture semantics (planting a plaintext token so redaction can be
tested) without triggering a false-positive on the scanner.
`go test ./shortcuts/apps/` green.
zhmushan
force-pushed
the
feat/apps-automation-triggers
branch
from
July 14, 2026 11:52
9bae2ad to
85ad396
Compare
5 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
+automation-*commands (list/get/create/update/enable/disable) to manage Miaoda application automation triggers across four types: cron, record-change, webhook, feishu-approval.+automation-update(--reset-url,--enable-token,--disable-token,--reset-token,--white-ip-list); credentials are echoed to stdout once with a stderr warning and never persisted.spark/v1domain prefix (/open-apis/spark/v1) and reuses the existingspark:app:read/spark:app:writescopes.Changes
shortcuts/apps/automation_common.go+ 6 command files +apps_automation_webhook.go+ testsshortcuts/apps/shortcuts.go— register 6 new shortcuts (total 64 → 70)skills/lark-apps/SKILL.md+skills/lark-apps/references/lark-apps-automation.md— intent routing entry + full command SOP with unauth-callback safety warningTest Plan
TestAutomation*pass;TestAppsShortcuts_Returns70updated+automation-*command-registration contract passes 6/6; workflow test env-guarded (skip withoutLARK_CLI_E2E_APPS_APP_ID)apps +listboundary, cron/record-change/feishu-approval inference, disable vs delete boundary, reset-url high-risk confirmation, unauthenticated-callback safety guardrail)data.trigger.trigger_condition.token_valuenested shape and the flat list-item shape, with a regression-guard test)*/5local reject → 30-min minimum), record-change (INSERT / UPDATE with--fieldsfilter / event-enum local whitelist rejectsREMOVE), webhook (--enable-tokenone-shot plaintext echo →+automation-getconfirmstoken_valuescrubbed,--reset-url --app-env runtimereturns new URL once,--disable-token,--reset-token), feishu-approval (bothapproval_instanceandapproval_taskevent types, mis-bucketed status locally rejected). Every high-risk-write path required explicit--yes; cross-type update rejected by backend (400002729, verified).Related Issues
Summary by CodeRabbit
.gitignoreentries.