Skip to content

v0.35.0 — lark-cli 1.0.60 + 引导类响应不再被当作错误

Choose a tag to compare

View all tags
@ddpie ddpie released this 30 Jun 12:46
· 21 commits to main since this release
v0.35.0
9f09710
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

中文

升级 lark-cli 1.0.59 → 1.0.60，按 docs/skills/bump-lark-cli.md 重新提取 scope、生成白名单、增量 re-adapt 技能。顺带捎上了几个升级后冒烟测试时发现的服务端可用性修复。

上游变更亮点（v1.0.60）

  • lark-contact — +search-user 文案简化，去掉一处指向 bot 路径的交叉引用；user-only 部署下该能力仍由 lark_contact_search_user(user_ids=…) 覆盖。
  • 上游新增 per-command affordance 指引（渲染进 --help）。本服务的工具目录由解析 --help 生成，已确认当前 catalog 不受影响。
  • scope 无新增、无 bot-only scope；白名单重建后字节不变。

顺带修复

服务端有几种响应其实是在引导调用方做下一步——比如删除操作要求先确认、缺少权限时附上授权链接、工具名写错了给出正确的查找方式、参数不是合法 JSON 时说明正确格式。这些之前都标成了错误（isError: true）。有些 MCP 客户端（比如 Quick Suite）遇到错误响应会丢掉正文，只显示一句 "unknown error"，于是这些本可以照着操作的提示就全丢了，调用方反复重试也找不到原因。

这次把这几种"引导类"响应改成正常响应，正文得以保留；真正的失败（超时、上游 API 报错等）仍然是错误。另外加固了风险等级识别（detectRisk）：新版 --help 里多了使用说明，旧的匹配方式可能把说明里的字眼误判成高危，改成按行精确匹配后规避了这个问题。具体见各 commit。

变更清单

  • docker/Dockerfile — 版本 pin 1.0.59 → 1.0.60
  • docker/shortcut-scopes.json — 重新提取（393 shortcuts，内容不变）
  • docker/rawapi-scopes.json、lambda/token-refresh-shim/scope-allowlist.ts — 重新生成（白名单不变）
  • docker/skills/lark-contact/references/lark-contact-search-user.md — 增量 re-adapt
  • docker/server.js、docker/generate-tools-lib.js — 上述可用性修复 + detectRisk 加固
  • 配套测试：docker/__tests__/ 下 generate-tools / server-runtime / mcp-contract

升级

git pull && ./scripts/deploy.sh

终端用户无需操作。可用性修复需部署新镜像、并在 client 重连会话后生效。

English

Bump lark-cli 1.0.59 → 1.0.60 — re-extract scopes, regenerate the allowlist, and do a diff-guided skill re-adapt per docs/skills/bump-lark-cli.md. Also folds in a few server-side usability fixes found while smoke-testing the upgrade.

Upstream highlights (v1.0.60)

  • lark-contact — +search-user wording trimmed, dropping a cross-reference to the bot path; under this user-only deployment the capability is still covered by lark_contact_search_user(user_ids=…).
  • Upstream adds per-command affordance guidance (rendered into --help). This service builds its tool catalog by parsing --help; the current catalog is unaffected.
  • No new scopes, no bot-only scopes; the allowlist is byte-identical after the rebuild.

Fixes along the way

Several server responses exist to guide the caller's next step — a delete asks for confirmation first, a missing permission comes with an authorization link, a wrong tool name points to how to find the right one, and a non-JSON argument explains the correct format. All of these were flagged as errors (isError: true). Some MCP clients (Quick Suite among them) drop the body of an error response and show only "unknown error", so these actionable hints were lost and the caller would retry blindly with no idea why.

These guidance responses are now returned as normal results, so the body survives; genuine failures (timeouts, upstream API errors, etc.) remain errors. Separately, risk-level detection (detectRisk) was hardened: the new --help embeds usage notes, and the old matching could mistake words in those notes for a high-risk signal — switching to line-anchored matching avoids that. See the individual commits for detail.

Changes

  • docker/Dockerfile — pin 1.0.59 → 1.0.60
  • docker/shortcut-scopes.json — re-extracted (393 shortcuts, content unchanged)
  • docker/rawapi-scopes.json, lambda/token-refresh-shim/scope-allowlist.ts — regenerated (allowlist unchanged)
  • docker/skills/lark-contact/references/lark-contact-search-user.md — incremental re-adapt
  • docker/server.js, docker/generate-tools-lib.js — the usability fixes above + detectRisk hardening
  • tests under docker/__tests__/: generate-tools / server-runtime / mcp-contract

Upgrading

git pull && ./scripts/deploy.sh

No end-user action required. The usability fixes take effect once the new image is deployed and the session is reconnected in the client.

Assets 2
Loading