README
¶
Extension
Embed lark-cli into your own Agent or application — swap credential sources, audit every command, restrict the command surface — without modifying CLI source. Write a Go package against these interfaces, import it from a wrapper main, and build your own enhanced binary.
Main extension points:
| Package | Extension point | What it does |
|---|---|---|
credential/ |
Credential | Bring your own credential source: database, Vault, config center… |
transport/ |
Transport | Register one aggregate provider for request interception, URL rewriting, and an optional distribution manifest |
platform/ |
Restrict · Observer · Wrap · On | Command allow/deny rules, audit hooks, onion-style middleware (approval gates, rate limiting), process lifecycle — see the Plugin SDK README |
📖 Full guide: Embed lark-cli in your Agent (中文)
The transport registry has one process-wide owner. Register the aggregate
provider during init, before constructing or executing the CLI. URL rewriting
runs before the request interceptor and also covers CLI-owned presentation URLs
and URLs passed to child processes. ScopedProvider limits only the request
interceptor.
When DistributionProvider returns a manifest URL, that URL and the artifact
URLs inside the manifest are final download addresses. Distribution downloads
retain lark-cli's built-in proxy and custom-CA policy, but deliberately bypass
the registered URL rewriter and request interceptor.
Distribution manifest protocol
The manifest is JSON with this fixed schema:
{
"schema": 1,
"version": "1.2.3",
"artifacts": {
"darwin-arm64": { "url": "https://dist.example/lark-cli-darwin-arm64.tar.gz", "checksum": "sha256:<64 lowercase hex characters>" },
"skills": { "url": "https://dist.example/skills.tar.gz", "checksum": "sha256:<64 lowercase hex characters>" }
}
}
schema, version, and artifacts are required; unknown fields are ignored.
version is an exact opaque target; the staged binary is verified by running
<binary> --version, whose output must be exactly lark-cli version <version>.
artifacts must contain skills and a key named
<GOOS>-<GOARCH> for every published platform. URLs must be absolute HTTP or
HTTPS URLs. Checksums cover the downloaded archive bytes.
Archives may be zip or gzip-compressed tar files. A binary archive contains
lark-cli at its root (lark-cli.exe on Windows). A Skills archive contains
one directory per Skill at its root, for example lark-doc/SKILL.md.
Directories
¶
| Path | Synopsis |
|---|---|
|
Package command defines the public contract for build-time command extensions.
|
Package command defines the public contract for build-time command extensions. |
|
commandtest
Package commandtest supplies an isolated runtime for business command tests.
|
Package commandtest supplies an isolated runtime for business command tests. |
|
examples/chat-brief
command
Command chat-brief is a runnable lark-cli distribution that contributes two business commands to the existing im domain via WithCommandSets:
|
Command chat-brief is a runnable lark-cli distribution that contributes two business commands to the existing im domain via WithCommandSets: |
|
Package download provides validated full and ranged streams for extensions and built-in commands.
|
Package download provides validated full and ranged streams for extensions and built-in commands. |
|
Package platform is the single public extension contract for lark-cli.
|
Package platform is the single public extension contract for lark-cli. |
|
examples/audit-observer
command
Command audit-observer is a runnable fork of lark-cli that logs every dispatched command to stderr.
|
Command audit-observer is a runnable fork of lark-cli that logs every dispatched command to stderr. |
|
examples/readonly-policy
command
Command readonly-policy is a runnable fork of lark-cli that installs a Rule permitting only docs/* and im/* read commands.
|
Command readonly-policy is a runnable fork of lark-cli that installs a Rule permitting only docs/* and im/* read commands. |