feat: add risk-control protection

[kiraWangRuilong]

Summary

Add risk-control protection to help prevent stolen access tokens from being misused for anomalous API activity.

Changes

• Add baseline safe protection for Feishu/Lark API endpoints.
• Add lark-cli config risk-control on|off|default command for workspace-level safety protection control.

Test Plan

• Unit tests cover header handling, official endpoint restrictions, workspace configuration, and platform detection.
• Manual verification confirms the headers are included only in intended requests.

Related Issues

• None

[CLAassistant]

All committers have signed the CLA.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

Adds cross-platform device-model detection, security headers for terminal/device/OS metadata, classified access-token hashing, and request-time hashing in cached HTTP and Lark SDK transport chains.

Changes

Access-token metadata

Layer / File(s)	Summary
Device model collection and platform mapping internal/devicemodel/*	Adds cached, sanitized device-model discovery for Darwin, Linux, Windows, and unsupported platforms, with OS mapping and tests.
Security headers and token classification internal/cmdutil/secheader.go, internal/cmdutil/secheader_test.go	Adds device metadata headers, SHA-256 token hashing, Bearer/JWT classification, host restrictions, and tests.
Hash transport and client-chain integration internal/cmdutil/transport.go, internal/cmdutil/factory_default.go, internal/cmdutil/*_test.go	Adds AccessTokenHashTransport, wires it into both client chains, and verifies middleware ordering and header behavior.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Client
  participant AccessTokenHashTransport
  participant SecurityPolicyTransport
  participant HTTPTransport
  Client->>AccessTokenHashTransport: Send request with bearer token
  AccessTokenHashTransport->>AccessTokenHashTransport: Clone request and inject token hash
  AccessTokenHashTransport->>SecurityPolicyTransport: Forward enriched request
  SecurityPolicyTransport->>HTTPTransport: Apply policy and send request

Loading

Possibly related PRs

• larksuite/cli#596: Adds the BuildHeaderTransport layer that this change extends with access-token hashing.
• larksuite/cli#1213: Changes transport fallback behavior in the same wrapper-chain area used by the new hash transport.

Suggested labels: feature

Suggested reviewers: liangshuo-1

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 35.85% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title is concise and accurately reflects the main change: adding risk-control protection.
Description check	✅ Passed	The description follows the required template and includes summary, changes, test plan, and related issues.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/security_header_enhancement

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🚀 PR Preview Install Guide

🧰 CLI update

npm i -g https://pkg.pr.new/larksuite/cli/@larksuite/cli@db8a7d280dcb5a9a20238acfe3947f1073c69fc1

🧩 Skill update

npx skills add larksuite/cli#feat/security_header_enhancement -y -g

[github-actions]

PR Quality Summary

CI did not complete successfully. Use the failed check links below to decide whether this PR needs a code change or a rerun.

Failed checks

• e2e-live — failure — details
• results — failure — details

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@internal/cmdutil/secheader.go`:
- Around line 268-320: The accessTokenKind flow currently classifies any
parseable JWT without access_mode as UAT; update jwtAccessMode to require an
explicit access-token marker before returning a JWT match, while preserving
app-only as TAT and delegated or omitted access_mode as UAT for valid access
tokens. Add a test covering non-access JWT payloads such as {}, null, or
equivalent markers and verify they produce no token-hash classification.

In `@internal/devicemodel/model_windows.go`:
- Around line 18-33: Update readDeviceModel to use an injectable
registry-reading helper, following the existing Darwin pattern, while preserving
systemInfoRegistryPaths priority and normalization behavior. Add adjacent tests
covering successful first-path lookup, registry open/read failures, empty
normalized values, and fallback to later paths or an empty result when none
succeed.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 1307e12e-ff4f-46d3-9cb9-2bcfb8fa32b4

📥 Commits

Reviewing files that changed from the base of the PR and between 7f43b7e and 0d9564f.

📒 Files selected for processing (13)

• internal/cmdutil/factory_default.go
• internal/cmdutil/factory_http_test.go
• internal/cmdutil/secheader.go
• internal/cmdutil/secheader_test.go
• internal/cmdutil/transport.go
• internal/cmdutil/transport_test.go
• internal/devicemodel/model.go
• internal/devicemodel/model_darwin.go
• internal/devicemodel/model_darwin_test.go
• internal/devicemodel/model_linux.go
• internal/devicemodel/model_other.go
• internal/devicemodel/model_test.go
• internal/devicemodel/model_windows.go

[codecov]

Codecov Report

❌ Patch coverage is 82.05128% with 35 lines in your changes missing coverage. Please review.
✅ Project coverage is 75.14%. Comparing base (d2bb365) to head (db8a7d2).
⚠️ Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
internal/riskcontrol/osmodel.go	73.07%	11 Missing and 3 partials ⚠️
internal/riskcontrol/transport.go	82.75%	5 Missing and 5 partials ⚠️
cmd/config/risk_control.go	89.36%	3 Missing and 2 partials ⚠️
internal/core/config_snapshot.go	60.00%	3 Missing and 1 partial ⚠️
internal/core/config.go	0.00%	2 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1910      +/-   ##
==========================================
+ Coverage   75.13%   75.14%   +0.01%     
==========================================
  Files         905      911       +6     
  Lines       96135    96322     +187     
==========================================
+ Hits        72229    72381     +152     
- Misses      18348    18372      +24     
- Partials     5558     5569      +11     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@internal/cmdutil/secheader_test.go`:
- Around line 353-374: Update the table fixtures in the secheader tests so the
empty-token case contains no token body after the Bearer scheme, and make
unknownJWT include typ access_token while retaining its unsupported access_mode.
Keep the existing expected skipped outcomes, ensuring these cases reach the
intended empty-body and unknown-mode branches rather than being rejected for
unrelated reasons.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 1474ade5-a44c-4773-988d-a905a040cc56

📥 Commits

Reviewing files that changed from the base of the PR and between 4a9de95 and ddefcd7.

📒 Files selected for processing (14)

• internal/cmdutil/factory_default.go
• internal/cmdutil/factory_http_test.go
• internal/cmdutil/secheader.go
• internal/cmdutil/secheader_test.go
• internal/cmdutil/transport.go
• internal/cmdutil/transport_test.go
• internal/devicemodel/model.go
• internal/devicemodel/model_darwin.go
• internal/devicemodel/model_darwin_test.go
• internal/devicemodel/model_linux.go
• internal/devicemodel/model_other.go
• internal/devicemodel/model_test.go
• internal/devicemodel/model_windows.go
• internal/devicemodel/model_windows_test.go

🚧 Files skipped from review as they are similar to previous changes (9)

• internal/devicemodel/model_linux.go
• internal/devicemodel/model_darwin.go
• internal/devicemodel/model_darwin_test.go
• internal/devicemodel/model_other.go
• internal/devicemodel/model_windows_test.go
• internal/devicemodel/model_windows.go
• internal/cmdutil/transport.go
• internal/cmdutil/factory_default.go
• internal/cmdutil/secheader.go