lark

name	lark
version	0.3.11
description	Lark (international) communication channel. For Feishu (飞书, China) use the separate feishu component instead. Use when: (1) replying to Lark messages (DM or group @mentions), (2) sending proactive messages or media (images, files) to Lark users or groups, (3) managing DM access control (dmPolicy: open/allowlist/owner, dmAllowFrom list), (4) managing group access control (groupPolicy, per-group allowFrom, smart/mention modes), (5) operating Lark productivity surfaces via the bundled lark-cli — documents, sheets, slides, multidim Base, calendar, tasks, mail, drive, wiki, OKR, approval, attendance, video conferencing, minutes, Miaoda/Spark apps, native OpenAPI explorer (see "Bundled Capability Modules" in SKILL.md body — full module index under references/), (6) configuring the bot (admin CLI, markdown card settings, verification token), (7) troubleshooting Lark webhook or service issues. Config at ~/zylos/components/lark/config.json. Service: pm2 zylos-lark.
type	communication
lifecycle	{"npm":true,"service":{"type":"pm2","name":"zylos-lark","entry":"src/index.js"},"data_dir":"~/zylos/components/lark","hooks":{"post-install":"hooks/post-install.js","pre-upgrade":"hooks/pre-upgrade.js","post-upgrade":"hooks/post-upgrade.js"},"preserve":["config.json",".env","data/"]}
upgrade	{"repo":"zylos-ai/zylos-lark","branch":"main"}
config	{"required":[{"name":"LARK_APP_ID","description":"App ID (open.larksuite.com/app -> Credentials)"},{"name":"LARK_APP_SECRET","description":"App Secret (same page as App ID)","sensitive":true}]}
next-steps	BEFORE starting the service: 1) Ask user for their Verification Token (REQUIRED — from developer console Event Subscriptions page). Write to config.bot.verification_token in ~/zylos/components/lark/config.json. The service will refuse to start without it. 2) Optionally ask for Encrypt Key — if provided, write to config.bot.encrypt_key. 3) Read domain from ~/zylos/.zylos/config.json and tell user to configure webhook URL in the developer console — open.larksuite.com/app (Event Subscriptions → Request URL → https://{domain}/lark/webhook). 4) Start the service (pm2 restart zylos-lark).
http_routes	[{"path":"/lark/webhook","type":"reverse_proxy","target":"localhost:3457","strip_prefix":"/lark"}]
dependencies	["comm-bridge","voice-asr"]

Lark

Lark (international) communication channel for zylos.

Depends on: comm-bridge (C4 message routing).

Bundled Capability Modules (lark-cli)

This skill bundles 27 capability modules under references/, each operating against Lark via the lark-cli binary. They are not auto-loaded as top-level skills — Claude Code's skill discovery only scans top-level directories, and these sub-modules live inside this skill. The parent SKILL.md (this file) is the entry point.

How to use a module: when a user's request maps to one of the modules below, Read that module's SKILL.md first to learn its exact commands/flags, then invoke lark-cli <module> ....

Prerequisites (installed automatically by zylos add lark / zylos upgrade lark — see hooks/post-install-shared.js):

• lark-cli binary on PATH (npm install -g @larksuite/cli).
• 27 sub-skill folders under references/lark-*/ (npx xc-skills add larksuite/cli).
• App credentials in lark-cli's keychain (~/.lark-cli/config.json + AES-256-GCM encrypted file under ~/.local/share/lark-cli/); pushed from ~/zylos/.env automatically.

Identity (--as bot vs --as user):

⚠️ Prefer user identity for content operations. When querying or editing documents, wiki / knowledge bases, drive files, sheets, or Base via lark-cli, default to --as user (OAuth-authorized; 7-day rolling refresh token). The bot identity is not a member of any knowledge space and lacks drive scopes, so bot-identity content queries silently find nothing. Bot identity is appropriate for IM messaging operations.

• --as bot works out of the box for app/tenant-level operations (IM messaging, contacts, events). No extra login needed.
• --as user is the default for content operations (docs, wiki, drive, sheets, Base — see note above) and is required for surfaces tied to a real user's data (calendar, mail-write, tasks, attendance, OKR, minutes, VC-agent). The user runs lark-cli auth login --domain <name> once. On auth failure lark-cli exits with a error envelope; the agent should detect this and notify the owner of the login command.