feat: propagate invocation metadata

[liangshuo-1]

Summary

Extend shared request metadata propagation for agent-driven CLI invocations while preserving existing behavior when the metadata is unavailable or invalid.

Changes

• Reuse the existing validated invocation metadata reader in the shared request metadata assembly path.
• Add regression coverage for configured, absent, and invalid metadata using vendor-neutral fixtures.
• Require @liangshuo-1 review for go.mod, go.sum, and shared shortcut infrastructure under shortcuts/common/.

Test Plan

• make unit-test
• go vet ./...
• gofmt -l . produces no output
• go mod tidy produces no changes
• golangci-lint v2.1.6 run --new-from-rev=origin/main

Related Issues

• None

Summary by CodeRabbit

• New Features
  • Security responses now include the configured agent name via an X-Agent-Name header when available.
• Bug Fixes
  • Prevents X-Agent-Name from being sent when the agent name is missing or contains invalid line-break characters, preserving existing security header behavior.
• Chores
  • Expanded ownership rules to cover additional key files and directories for better change management.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: fd90f12b-c880-4fd8-bafd-aac99ccf937a

📥 Commits

Reviewing files that changed from the base of the PR and between c2e378a and 4d50250.

📒 Files selected for processing (4)

• .github/CODEOWNERS
• internal/cmdutil/secheader.go
• internal/cmdutil/secheader_test.go
• internal/envvars/read_test.go

🚧 Files skipped from review as they are similar to previous changes (4)

• .github/CODEOWNERS
• internal/cmdutil/secheader_test.go
• internal/cmdutil/secheader.go
• internal/envvars/read_test.go

---

📝 Walkthrough

Walkthrough

BaseSecurityHeaders() conditionally adds X-Agent-Name from envvars.AgentName(), with tests for unset, valid, and invalid values. CODEOWNERS now covers module files and shortcuts/common/.

Changes

Agent Name Header

Layer / File(s)	Summary
Header contract and conditional injection internal/cmdutil/secheader.go, internal/cmdutil/secheader_test.go, internal/envvars/read_test.go	Adds HeaderAgentName, conditionally sets the header from the agent environment value, and validates unset, configured, invalid, and whitespace-trimmed values.

Repository Ownership Rules

Layer / File(s)	Summary
CODEOWNERS path coverage .github/CODEOWNERS	Adds ownership entries for go.mod, go.sum, and shortcuts/common/ while retaining /internal/ coverage.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• larksuite/cli#1757: Modifies BaseSecurityHeaders() and agent-name environment handling.
• larksuite/cli#2098: Updates the same .github/CODEOWNERS path entries.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: propagating invocation metadata.
Description check	✅ Passed	The description includes all required sections and covers scope, changes, testing, and related issues.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/agent-name-header

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@internal/cmdutil/secheader_test.go`:
- Around line 269-283: Add a test alongside
TestBaseSecurityHeaders_IncludesAgentNameHeaderWhenEnvSet that sets
envvars.CliAgentName to an invalid CR/LF-containing value, calls
BaseSecurityHeaders, and asserts HeaderAgentName is absent, preserving the
contract that invalid agent names leave requests unchanged.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: df90b99c-c550-4ce1-b2e2-7464b3ce7ebb

📥 Commits

Reviewing files that changed from the base of the PR and between 59237f3 and fa562b9.

📒 Files selected for processing (2)

• internal/cmdutil/secheader.go
• internal/cmdutil/secheader_test.go

[github-actions]

🚀 PR Preview Install Guide

🧰 CLI update

npm i -g https://pkg.pr.new/larksuite/cli/@larksuite/cli@4d50250c7771d64fdb1a24d7f58f83dd762b3dab

🧩 Skill update

npx skills add larksuite/cli#feat/agent-name-header -y -g

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 75.19%. Comparing base (59237f3) to head (4d50250).
⚠️ Report is 2 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2097      +/-   ##
==========================================
+ Coverage   75.16%   75.19%   +0.03%     
==========================================
  Files         912      914       +2     
  Lines       96475    96783     +308     
==========================================
+ Hits        72517    72778     +261     
- Misses      18381    18407      +26     
- Partials     5577     5598      +21     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.