Repository navigation
docs(apps): restrict creative-mode wording in skill guidance - #2801
Merged
Merged
Conversation
An agent handed a creative-mode share link (/page/<token>) and asked to read or
summarize it never reached +export: the lark-apps description did not mention
/page/ links or reading an app's content, and the SKILL.md app_id section told
it to resolve the token through +get first, which a share-link viewer cannot
pass. Name the link shape and the read intent in the description, and route
that intent straight to +export --meta-token.
When the viewer lacks download permission the gateway answers HTTP 200 +
{"code":40300,"msg":"permission denied"}, not a 403, so classifyExportErr's
403 branch never ran and the caller got subtype "unknown" with no hint.
Re-type that envelope as the same permission_denied error the 403 branch
raises, keeping code, log id, troubleshooter and cause. It stays command-scoped
like 40901: the spark code table is global and 40300 is too generic to claim.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Given only a /page/<token> share link and no mention of Miaoda, agents routed it to lark-doc (the URL sits on a Feishu domain and looks like a document) or to a browser, never reaching lark-apps. lark-apps: restore the upstream description and state what a Miaoda app link looks like (/app/app_xxx, /page/<token>) next to the existing runtime domain, so the skill is chosen from the link alone. lark-doc: note that /page/<token> is a Miaoda app, not a Feishu cloud document, right after its path-based routing rule. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
📝 Walkthrough
Merge Risk: ⚪ Minimal · up to This change routes Miaoda app links to the export command and reports permission denials from the export gateway more clearly. No merge-blocking risk was found. Test results were not supplied. Pre-merge checks |
 |
| Check name | Status | Explanation |
|---|---|---|
| Docstring Coverage |  |
Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 5 functions across 2 files. (3 skipped: 3 … |
| Linked Issues check | |
Check skipped because no linked issues were found for this pull request. |
| Out of Scope Changes check | |
Check skipped because no linked issues were found for this pull request. |
| Title check | |
The title accurately refers to the skill-guidance changes, but it does not mention the main export routing and 40300 permission-error classification changes. It is still related to a real part of the … |
| Description check | |
The description includes all required sections: Summary, Changes, Test Plan, and Related Issues. It clearly explains the motivation, implementation changes, and verification results. |
✨ Finishing Touches
-
-
🧪 Generate unit tests (beta)
-
-
- Create a new PR
-
-
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands.
github-actions
Bot
added
domain/ccm
yysbuge
changed the title
yysbuge
changed the title
liangshuo-1
approved these changes
Oct 12, 2026
🚀 PR Preview Install Guide🧰 CLI updatenpm i -g https://pkg.pr.new/larksuite/cli/@larksuite/cli@9fce4d383ab0b331b47acd201130e0c97b88e625🧩 Skill updatenpx skills add yysbuge/cli#fix/apps-export-share-link -y -g |
Merged
3 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Agents given only a Miaoda creative-app share link (
/page/<token>) never reachedlark-apps: the link sits on a Feishu domain and looks like a doc, so they routed it tolark-doc(then chased adocx:document:readonlyscope) or to a browser. When+exportwas reached by a viewer without download permission, the gateway's HTTP 200 +{"code":40300}envelope surfaced as subtypeunknownwith no hint.Changes
lark-appsdescription: state what a Miaoda app link looks like (/app/app_xxx,/page/<token>) next to the existing runtime domain.lark-docdescription: note that/page/<token>is a Miaoda app, not a Feishu cloud document.lark-appsSKILL.md /lark-apps-export.md: route reading or summarizing an app's content to+export; a/page/token goes straight to--meta-tokenwithout a+getdetour; document the 40300 form of permission denial.apps +export: re-type the 200+JSON40300envelope as the sameauthorization/permission_deniederror the HTTP-403 branch raises (code, log_id, troubleshooter and cause kept). Command-scoped like40901, since the spark code table is global.Test Plan
go test ./shortcuts/apps/ ./internal/errclass/), incl. newTestAppsExport_TypesPermissionDeniedEnvelope(fails without the fix)go vet,gofmt, skill format check, skill wire-vocab check+export --meta-tokenon a creative app returns a valid zip; a 40300 response now reportsauthorization/permission_deniedwith a hint (previouslyapi/unknown)/page/<token>+ "summarize" →lark-apps, first commandapps +export --meta-token, export succeeds and the agent summarizes the unzipped source/app/app_xxx+ "analyze" →lark-apps, first commandapps +export --app-id, export succeeds/docx/<token>+ "summarize" →lark-doc,docs +fetchsucceeds (not captured bylark-apps)/page/<token>without download permission →lark-apps,apps +exportreturnspermission_denied; the agent reports the missing permission to the user (it first tried a browser fallback before reporting)## Related Issues